History of Flight

On the morning of September 5, 2014, a commercial pilot and his wife, who was a pilot-rated passenger, departed Greater Rochester International Airport in New York on a personal flight. They were bound for Naples Municipal Airport in Florida in their TBM 700 (marketed as a 900). Approximately one hour 40 minutes into the flight, and while cruising at FL280 (approximately 28,000 feet), the pilot contacted Air Traffic Control (ATC) and said he had an "indication that is not correct in the plane." He requested a descent, but only to FL180.

The controller instructed the pilot to descend to FL250. The pilot acknowledged and complied with the instruction; and, again, requested a lower altitude. The controller asked the pilot if he was declaring an emergency, and the pilot responded, "Not yet, but we will let you know." The controller coordinated with another ATC facility to clear nearby traffic so that the pilot could descend lower. After approximately two minutes, the controller told the pilot to descend to FL200 and change course; however, the pilot did not comply with that instruction despite multiple prior acknowledgements with ATC. Four minutes after initially reporting the problem, the pilot became completely unresponsive to ATC calls. Investigators concluded that the pilot's failure to comply with the controller's instructions, his long microphone pauses after concluding a statement over the radio, and his confusion, were consistent with cognitive impairment due to hypoxia.

Approximately 30 minutes after the last ATC transmission, a pair of Air National Guard F-16s were sent to intercept the aircraft and observed that the occupants were unconscious, had rapid chest movement consistent with heavy breathing, and were not wearing oxygen masks. Photographs revealed that the airplane's emergency exit door was recessed slightly into the fuselage frame, which confirmed that the airplane was depressurized. If the plane had been pressurized, forces would have pushed the emergency exit to protrude slightly beyond the fuselage.

The F-16s were relieved by a pair of F-15s, which observed the aircraft until it entered Cuban airspace. The Socata TBM 900 continued level flight at FL250 until it ran out of fuel, entered a high rate of descent, and impacted the Caribbean Sea northeast of Port Antonio, Jamaica.

Pilot Experience

Before the pilot purchased the accident airplane, the pilot had owned two other Daher-Socata Model TBM 700 airplanes, known as the TBM 700 "A" and the TBM 850 "Legacy." The pilot had a total time of 7,100 flight hours and had about 4,000 hours in TBM Model 700 airplanes. He had purchased the TBM 900 (accident airplane) in April 2014. In August 2014, a week before the accident, he completed a five-day ground and simulator training course to satisfy an insurance requirement. The simulator portion included environmental systems, equipment failures, and emergency descent procedures. Proper oxygen mask donning procedures were also demonstrated and discussed.

The NTSB final report notes that the pilot had a high-altitude endorsement, but he may not have received any training in an altitude chamber. The FAA does not require an altitude chamber experience but recommends it for all pilots operating at high altitudes. This recommendation is found in Advisory Circular AC 61-107 entitled Aircraft Operations at Altitudes Above 25,000 Feet Mean Sea Level or MACH Numbers Greater Than .75.

 

Pressurization System Failure and Pilot Alerts

The following animation explains how the pressurization system failed during flight and shows the cockpit alerts the pilot probably received. Although the fault that resulted in this accident was a pressurization system failure, many other events could cause the cabin to depressurize with the same outcome, such as door failures, window failures, duct failures, pilot errors configuring the system, and maintenance errors.

 

The following video shows how the oxygen masks on the TBM 850 are checked, donned, and used. There are several differences between the TBM 850 and TBM 900, but oxygen mask donning would be the same as that shown in the video, except the video shows non-standard Velcro straps retaining the oxygen masks.

Source: Aerodite

Hypoxia Overview

Pilots must understand, recognize, and know how to manage physiological threats, especially the threat of hypoxia (an insufficient supply of oxygen to body cells and tissues) that is inherent when flying at high altitudes if pressurization is lost. Hypoxia (hypo = less than normal / oxia = oxygen) is an oxygen deficiency in the blood, tissues, and cells sufficient to cause an impairment of body functions. Loss of cabin pressurization in-flight presents an immediate and critical hypoxic hazard.

The atmosphere is a mixture of gases comprised of approximately 78% nitrogen, 21% oxygen, 1% carbon dioxide, water vapor, and trace gases. Atmospheric pressure decreases with altitude and as the pressure around the gas molecules decreases, the molecules spread out and travel farther apart (i.e., the air becomes less dense with altitude). As total pressure decreases with altitude, the percentage of oxygen (21%) remains constant. Hypoxic hypoxia, or altitude hypoxia, is insufficient oxygen due to a decrease in atmospheric pressure at altitude – there is a decrease in the pressure "driving force" to move oxygen from the lungs into the bloodstream leading to a decrease in blood oxygen saturation level. Hypoxia poses the greatest potential physiological hazard to the flight crew and cabin occupants because decreasing blood (and brain) oxygen saturation levels lead to reduced cognitive and physical ability.

 

Most individuals begin to exhibit mild symptoms of hypoxia (e.g., headache, fatigue) around 10,000 feet mean sea level (MSL), although more subtle impairments may go unrecognized at lower altitudes. An example is night vision degradation at 5,000 feet MSL, since the eyes are sensitive to a lack of oxygen. Common hypoxia signs and symptoms are listed in the table; however, cognitive abilities may be degraded even before some of these symptoms occur and affect a person’s ability to assess these symptoms.

Common Signs and Symptoms of Hypoxia

Signs of Hypoxia (Observable)	Symptoms of Hypoxia (Internal Feelings)
Rapid Breathing Cyanosis (bluing of the skin, especially the fingernail beds and around the lips) Poor Coordination Lethargy Executing Poor Judgement Sweating Trembling/Muscle Spasms Slowed Reaction Time	Air Hunger Fatigue Nausea Headache Dizziness Hot and Cold Flashes Tingling Visual Impairment Euphoria

At 15,000 feet with a loss of pressurization, passenger oxygen masks deploy automatically on most pressurized airplanes, and hypoxic symptoms become pronounced with noticeable cognitive and physical impairment. At 25,000 feet, oxygen saturation drops to 50% and most individuals become profoundly hypoxic and lose consciousness within three to five minutes.

If the pilot does not immediately don oxygen, hypoxic symptoms can lead to poor judgment, a lack of self-assessment, impaired critical thinking, euphoria, and irritability. Hypoxia can also lead to task saturation and task fixation, making it difficult for a pilot to identify and perform the most critical action – donning the oxygen mask. A pilot may even lose muscle coordination and be unable to reach for, much less don, the oxygen mask. After prolonged hypoxic exposure at altitude without supplemental oxygen, the pilot becomes semi-conscious, then unconscious, and after several minutes, the brain and other organs can be damaged and death may occur.

Timeline of Useful Consciousness

The Time of Useful Consciousness (TUC), also known as Effective Performance Time (EPT), describes the time interval from exposure to an oxygen-poor environment until a pilot is unable to perform flying duties effectively. This includes crucial tasks such as donning an oxygen mask or descending to a safe altitude. The TUC is not the time to total unconsciousness.

A rapid decompression reduces the time of useful consciousness by half. Note that the times listed in the table are averages and can vary widely among individuals depending on age, fatigue, level of physical fitness, rate of cabin depressurization, and other factors.

Time of Useful Consciousness / Effective Performance Time by Altitude
Reference Advisory Circular AC 61-107

Altitude (feet)	TUC/EPT	Following Rapid Decompression
18,000	20-30 minutes	10-15 minutes
22,000	10 minutes	5-6 minutes
25,000	3-5 minutes	1.5-2.5 minutes
28,000	2.5-3 minutes	1-1.5 minutes
30,000	1-2 minutes	30 seconds - 1 minute
35,000	30 seconds - 1 minute	15-30 seconds
40,000	15-20 seconds	Nominal
43,000	9-12 seconds	Nominal
50,000	9-12 seconds	Nominal

A slow, gradual decompression is often more dangerous (and more likely to occur) than an obvious rapid decompression because of the insidious effects of slow onset hypoxia. With a slowly increasing cabin pressure altitude, pilots may start to feel fatigued, lightheaded, dizzy, or slightly confused and attribute these symptoms to merely not feeling well rather than to hypoxia. Symptoms gradually worsen to the point of impaired judgement and lack of muscle coordination and an inability to don the oxygen mask. Therefore, system alerts and early pilot actions are the first line of defense during any depressurizations, before hypoxic symptoms and effects occur.

It can be difficult for a pilot to recognize unique hypoxic symptoms before reaching the TUC if the pilot has not participated in hypoxia awareness training in an altitude chamber, as discussed in the Training section.

Application of Hypoxia Knowledge

It is extremely important that all pilots understand the signs, symptoms, and physiology of hypoxia. The risks are different in pressurized versus unpressurized airplanes.

For pilots of pressurized airplanes, if there is a failure of the pressurization system, a warning appears when the cabin pressure altitude exceeds 10,000 feet. This warning is the most reliable cue to the pilot to put on the oxygen mask immediately. If they do not, the pilot's cognitive abilities rapidly deteriorate.

Unpressurized airplanes can also operate at altitudes where hypoxia is a serious risk. These airplanes are typically equipped with nasal cannulas up to 18,000 feet and continuous flow masks up to 25,000

feet. Pilots of unpressurized airplanes must rely on supplemental oxygen to prevent hypoxia, and failures in the oxygen system may not produce an alert. Thus, awareness of hypoxic signs and symptoms are especially relevant in non-pressurized airplanes since a fault in the oxygen system could be difficult for the pilot to detect (e.g., pinched or disconnected hoses on continuous flow oxygen systems).

FAA regulatory requirements stipulate pilots of unpressurized airplanes must use oxygen:

• Above 12,500 feet for any duration longer than 30 minutes
• Above 14,000 feet for any amount of time

However, pilots are encouraged to use oxygen at lower altitudes since hypoxia affects pilot performance and many hypoxia-related accidents have occurred below 14,000 feet MSL. The Airman Information Manual suggests that supplemental oxygen should be used at 10,000 feet during the day and at 5,000 feet during the night.

The following video shows an excerpt of the hypoxia training used by NASA. It is worth noting that NASA, the military, and other organizations require hypoxia training to be repeated by pilots periodically. While not required by the FAA, recurring hypoxia training is a best practice.

Source: Destin of Smarter Every Day

Training

14 CFR 61.31(g) specifies additional training for a one-time endorsement before flying pressurized aircraft above 25,000 feet. To receive authorization, pilots must have classroom or ground instruction on topics including:

• Effects, symptoms, and causes of hypoxia and any other high-altitude sickness;
• Duration of consciousness without supplemental oxygen;
• Physical phenomena and incidents of decompression; and
• Any other physiological aspects of high-altitude flight.

Pilots must also receive training in a pressurized aircraft or acceptable simulator on procedures that include:

• Proper emergency procedures for simulated rapid decompression without depressurizing the aircraft; and
• Emergency descent procedures.

While 61.31(g) does not require pilots seeking a high-altitude endorsement to experience hypoxia for themselves, AC 61.107 does highly recommend experiencing hypoxia in a controlled setting. Hypoxia training can be performed safely under supervision in an altitude chamber (also known as a hypobaric chamber) or in a normobaric chamber, which simulates depressurization at ambient pressure. In either chamber, participants are enclosed within a sealed compartment which simulates a depressurized environment while using supplemental oxygen. At various pressure altitudes, the students remove their oxygen masks, attempt different tasks, and assess their symptoms to understand how hypoxia affects them personally. More importantly, the students learn to treat themselves by going on supplemental oxygen as soon as they recognize their hypoxic symptoms.

The FAA's Civil Aerospace Medical Institute (CAMI) offers a one-day physiological training course that includes hypoxia training. The FAA also uses a portable normobaric chamber for hypoxia training at periodic events across the United States, such as Experimental Aircraft Association’s AirVenture Oshkosh and Sun 'n Fun, at no cost to the participant.

Checklists

The aircraft manufacturer creates checklists for routine operation in the Normal Procedures section of the Pilot's Operating Handbook (POH) and checklists for emergencies or critical situations in the Emergency Procedures section. Pilots are required to have up-to-date checklists readily available in the airplane per 14 CFR part 91.503 and taught to use them consistently to avoid missing important steps. For emergency situations, pilots are taught to memorize the immediate action items and, after completion, refer to the appropriate checklist.

Before Starting Engine Checklist

Investigators found that the cockpit oxygen switch was in the "OFF" position in the aircraft wreckage when the Before Starting Engine checklist required it to be "ON." The checklist also required the pilot to check the oxygen masks, which the pilot cannot do if the cockpit oxygen switch is "OFF." Investigators found this to be unexpected since this pilot was known for his diligence in using checklists. With the cockpit oxygen switch in the "OFF" position, the pilot would not be able to inflate the oxygen mask harness to don the oxygen mask. The oxygen would not flow even if the pilot put on the mask unless an additional step, that is not in the emergency procedures or practiced in training, is completed to select the oxygen switch to "ON".

Checklist discipline and checklist confusion have been factors in many accidents, including the August 14, 2005 Helios Airways Flight 52. Research shows that when checklists are interrupted (for example by ATC communications) or items are deferred, pilots are more likely to miss steps or make errors. This Aviation Week article further discusses checklist errors: Give E-Checklists an A+

Cabin Altitude Emergency Procedure Checklist

Investigators noted that the emergency procedure checklists did not require flight crews to don their oxygen masks as the first item and included checklists as a factor in the probable cause of the accident. After a similar accident on a Learjet 35, the FAA issued AD 2000-24-19 to make donning the oxygen mask the first item in the checklist for the cabin altitude alert and the NTSB made the following recommendation:

The Safety Board concludes that, because of the lack of clear and explicit guidance to flight crews regarding the donning of oxygen masks immediately after the onset of the cabin altitude warning, flight crews may attempt to diagnose and troubleshoot the problem before donning masks and, therefore, risk becoming incapacitated. Therefore, the Safety Board believes that the FAA should require that all pressurized aircraft certificated to operate above 25,000 feet have a clear and explicit emergency procedure associated with the onset of the cabin altitude warning that contains instructions for flight crews to don oxygen masks as a first and immediate action item, followed by instructions appropriate to diagnose, manage, and resolve the condition indicated by the warning.

The pilot in the Socata accident received three CAS messages in a short period with three corresponding emergency procedure checklists to follow while flying the airplane and negotiating a descent with ATC. Investigators determined that manufacturers should design checklists to make it as clear as possible that oxygen masks must be donned immediately when pressurization is lost. Donning oxygen masks immediately should be the first and immediate action in response to a cabin altitude warning. Pilots should be prepared to respond quickly to emergency situations from memory, especially warning level alerts which require immediate action, such as the cabin pressure altitude warning. After completion of the memory items, pilots should refer to the appropriate checklist.

 

 

 

Recovery of Wreckage

Map of Wreckage on Ocean Floor from NTSB Docket

Investigators were able to identify the causal chain that resulted in this accident because of non-volatile memory (NVM) recovered from the wreckage on the ocean floor four months after the accident. This resulted in a more complete accident report from which lessons could be learned. Non-volatile memory refers to an electronic device or medium that can retain information even after power is removed. This is the opposite of volatile memory, such as random-access memory (RAM), which requires a constant source of power to maintain the stored data. Examples of NVM include solid state drives and flash drives. NVM, which can be derived from avionics and instrumentation and is different from voice or flight recorders, can be effective in collecting information to help in accident investigation.

The TBM 900 Global Air System Controller (GASC) stores fault codes in its limited memory that are overwritten at each takeoff. Data recovered from the accident aircraft NVM showed the overheat thermal switch (OTSW) had been triggered and did not reset. This caused a shutdown of the engine bleed air supply to the cabin pressurization system.

Flight data recorders and cockpit voice recorders are not required in this class of airplane. For this reason, investigators often cannot determine the causes of hypoxia events. For example, consider the following excerpts from a typical hypoxia accident report:

"The National Transportation Safety Board determines the probable cause(s) of this accident to be: Incapacitation of the flight crewmembers as a result of their failure to receive supplemental oxygen following a loss of cabin pressurization, for undetermined reasons." - Learjet 35, N47BA, October 1999

Conclusion

Hypoxia is a critical situation that requires an immediate response. Donning an oxygen mask eliminates the potential for hypoxia, its debilitating symptoms, and possible death. Conflicting cockpit information, multiple warning alarms, and inadequately designed emergency procedures and checklists can contribute to information overload and generate pilot responses different than required.

Back to top

The National Transportation Safety Board determined the probable causes of this accident to be: "The design of the cabin pressurization system, which made it prone to unnecessary shutdown, combined with a checklist design that prioritized troubleshooting over ensuring that the pilot was sufficiently protected from hypoxia. This resulted in a loss of cabin pressure that rendered the pilot and passenger unconscious during cruise flight and eventually led to an in-flight loss of power due to fuel exhaustion over the open ocean."

NTSB Report: ERA14LA424

Back to top

None issued.

Back to top

14 CFR § 61.31(g) specifies additional training for a one-time endorsement before flying pressurized aircraft above 25,000 feet. For the pilot to receive this authorization, they must have classroom or ground instruction on topics including:

• Effects, symptoms, and causes of hypoxia and any other high-altitude sickness;
• Duration of consciousness without supplemental oxygen;
• Physical phenomena and incidents of decompression; and
• Any other physiological aspects of high-altitude flight.

They must also receive training in a pressurized aircraft or acceptable simulator on procedures that include:

• Proper emergency procedures for simulated rapid decompression without actually depressurizing the aircraft; and
• Emergency descent procedures.

14 CFR § 91.211 specifies oxygen use requirements for pilots.

Advisory Circular 25.1322-1 Flight crew Alerting. While developed for transport aircraft, the guidance contains concepts that are relevant to general aviation.

Advisory Circular 61-107B (as amended) Aircraft Operations at Altitudes Above 25,000 Feet Mean Sea Level or MACH Numbers Greater Than .75

Safety Alert SA-055, "Pilots: Help ATC Help You" - NTSB Safety Alert SA-055 noted this accident and other general aviation accidents where the pilot did not say "MAYDAY" and declare an emergency; but, doing so could have prevented a fatal accident.

Back to top

Declaring Emergencies

Pilots are sometimes reluctant to declare an emergency to ATC even though the controller would give them priority handling. In this accident, the pilot told ATC of an unspecified abnormal indication in the airplane and requested a descent to FL180. Since the controller could not immediately approve this descent due to other airplanes in the area, they asked the pilot if he was declaring an emergency. The pilot said, “Not yet, but we’ll let you know.” Had the pilot declared an emergency, the controller would have immediately diverted other aircraft out of his way so that he could do an emergency descent to 10,000 feet. In this accident, ATC progressively gave them clearance for a stepped descent to FL250 and then down to FL200 feet. At that point, the pilot became unresponsive and never descended below FL250.

The NTSB released Safety Alert SA-055 in August 2016 titled, "Pilots: Help ATC Help You." The alert highlights the importance of declaring an emergency if a pilot needs assistance or priority from ATC. The best phrase pilots should use to declare an emergency is "Mayday, Mayday, Mayday!" The NTSB alert listed this Socata accident along with four others.

Oxygen Selection

Some pilots of pressurized airplanes mistakenly choose to keep their oxygen system turned off. It is commonly believed that leaks may occur and the bottles will need to be refilled more often. This was a factor in a King Air accident (CHI07LA063) that is in the Precursor section.

Back to top

Prevalence of depressurization events- Cabin depressurizations occur due to many causes such as system failure, structure failure, bird or hailstone strikes, improperly configuring pressurization controls, and other reasons. Depressurization occurred in this accident when the overheat thermal switch detected a fault that shut off the bleed air used for pressurization.

The Australian Transportation Safety Bureau conducted an analysis of 517 depressurization events that occurred in Australia from 1975 to March 2006 and identified the following causes of depressurization. Depressurizations occur in the United States due to the same types of causes.

In the Socata accident, investigators could not determine if there was a real overheat detected by the overheat thermal switch or if the overheat thermal switch was faulty. Either way, the result was the automatic shutdown of the pressurization system.

Pilot improper response to emergencies - Because cognitive abilities are severely affected by hypoxia, it is imperative that pilots begin using oxygen immediately upon depressurization in accordance with emergency procedures and training. In this accident the airplane depressurized and the pilot did not don his oxygen mask, did not declare an emergency in response to the cabin altitude warning, nor begin an immediate descent to 10,000 feet.

 

Back to top

Pilots follow the preflight checklist and verify that oxygen is turned on and capable of flowing to the mask prior to every flight.

• Investigators concluded that the pilot did not turn on the oxygen according to the Before Starting Engine checklist.

When the cabin pressure altitude exceeds 10,000 feet, pilots immediately don their oxygen masks and conduct an emergency descent.

• Despite the pilot’s experience and training, in this accident he did not don the oxygen mask, declare an emergency, nor conduct an emergency descent.

Emergency checklists ensure procedures are timely, prioritized, and complete to address emergency situations.

• The NTSB determined in this accident that the checklist design prioritized troubleshooting over ensuring the pilot was sufficiently protected from hypoxia by donning an oxygen mask first.

 

Back to top

Depressurization Events

Depressurization events periodically occur on pressurized airplanes. Investigators noted in the accident report that several depressurizations had occurred on TBM 850 and TBM 900 airplanes prior to this accident; however, they did not result in accidents.

Depressurization accidents where the pilot did not immediately use supplemental oxygen

Beech King Air C90B, private pilot, N43KM, Rocksprings, TX, December 14,2008

The airplane departed Hondo, TX and climbed to 17,000 feet. Radar showed the airplane in a meandering flight path that became increasingly off course. This erratic course continued through the end of the flight, even after the air traffic controller provided several heading corrections to the pilot. At one point, the controller asked the pilot if he was experiencing any problems or emergencies, and the pilot replied that he was okay. After the airplane climbed to FL240, ATC attempted to contact the pilot multiple times but did not receive a response. The airplane then entered a rapid descent that continued to impact. Investigators determined the probable cause of the accident was: "The pilot's failure to properly configure the pressurization controls, resulting in his impairment and subsequent incapacitation due to hypoxia."

Accident Report: CEN09FA087

Beechcraft King Air B200, N777AF, Cape Girardeau, MO, February 2, 2007

The flight crew depressurized the airplane after the inner layer of the windshield shattered, and then donned their oxygen masks and initiated an emergency descent. Because they had inappropriately turned the oxygen system ready switch to the OFF position prior to the flight, no oxygen was flowing to the masks, so both pilots lost consciousness. After descending below 8,000 feet, the pilots came to and were able to recover the plane from its uncontrolled descent. Acceleration forces from the uncontrolled descent and recovery substantially damaged the airplane. During interviews with investigators, the pilot explained that he had checked the oxygen system during his preflight checks but then turned the system off to save the oxygen. He stated that he, "Didn't want the oxygen to deplete if he left the system on."

Accident Report: CHI07LA063

Boeing 737-300, Helios Airways Flight 52, HCY522, Hellas, Greece, August 15, 2005

Due to the first officer not correctly configuring the pressurization panel, the Boeing 737-300 climbed to FL340  without pressurizing. The pilots passed out and the airplane continued on autopilot until the fuel depleted and it crashed into terrain. This accident also involved the flight crew’s incorrect response to the high cabin altitude warning. This accident highlighted human failures related to checklist discipline and served to question the airworthiness assumptions that allowed the manufacturer to use the same horn for both the takeoff configuration warning and the cabin altitude warning.

Library module: Helios Airways Flight 52

Beechcraft Super King Air B200, VH-SKC, Burketown, Queensland, Australia, September 4, 2000

 

The investigators concluded that while there were several possible reasons for the pilot and passengers being  incapacitated, it was most likely the result of hypoxia due to the aircraft being fully or partially unpressurized and the pilot not using supplemental oxygen. Due to the extensive nature of the damage to the aircraft caused by the impact with the ground, and because no recording systems were installed in the aircraft (nor were they required to be), the investigators could not determine the reason for the aircraft being unpressurized or why the occupants did not receive supplemental oxygen.

Accident report: ATSB 200003771

Learjet 35, Sunjet Aviation, N47BA, Aberdeen, SD, October 25, 1999

The Learjet departed Orlando International Airport. After climbing through FL230, the pilots stopped responding to ATC. The airplane climbed to FL460 and continued for about three hours until the plane ran out of fuel. A cockpit voice recorder recorded the last 30 minutes of the flight, during which one could hear the constant cabin altitude aural warning. Investigators determined the probable cause of the accident was: "Incapacitation of the flight crewmembers as a result of their failure to receive supplemental oxygen following a loss of cabin pressurization for undetermined reasons."

In response to this accident the FAA issued Airworthiness Directives to make donning oxygen masks the first and immediate step in response to a cabin altitude warning for all pressurized transport category airplanes that operate above 25,000 feet.

AD-2000-23-10 Lockheed L-188A and L-188C

AD 2000-24-19 Learjet 35, 35A, 36, 36A

AD 2001-22-10 Mystere-Falcon 50, 900, and Falcon 900EX

AD 2002-20-06 Gulfstream Aerospace LP Model Astra SPX and 1125 Westwind Astra

AD 2002-24-04 Airbus Model A300B2, A300B4-600, B4-600R, F4-600R, and A310

AD 2003-12-03 Gulfstream Aerospace LP Model 1124 and 1124A

AD 2003-14-08 and 2003-03-15 Boeing 747, 707, 720, 727, 737, 757, 767, DC8, DC9, MD80, MD90, DC10, MD10, MD11

Also following this accident, the NTSB issued safety recommendations, some of which are relevant to the Socata accident.

• Require that operators of all pressurized cabin aircraft provide guidance to pilots on the importance of a thorough functional preflight of the oxygen system, including, but not limited to, verification of supply pressure, regulator operation, oxygen flow, mask fit, and communications using mask microphones. (A-00-111)
• Require that all pressurized aircraft certificated to operate above 25,000 feet have a clear and explicit emergency procedure associated with the onset of the cabin altitude warning that contains instructions for flight crews to don oxygen masks as a first and immediate action item, followed by instructions appropriate to diagnose, manage, and resolve the condition indicated by the warning. (A-00-113)
• Issue guidance within six months directly to pilots operating pressurized aircraft regarding the need to don oxygen masks immediately following activation of the cabin altitude warning. (A-00-114)

Accident report: DCA00MA005

Accident where the pilot did not declare an emergency

Boeing 707-321B, Avianca Airlines Flight 52, HK2016, Long Island, NY, July 19, 1989

A noteworthy accident where declaring an emergency could have prevented a tragic accident was Boeing 707-321B, Avianca Airlines Flight 52, HK2016, Long Island, New York, January 25,1990. The aircraft was a scheduled international flight from Bogota, Colombia to John F. Kennedy (JFK) International Airport, New York. Poor weather conditions in the Northeast of the U.S. resulted in the flight being put into a holding pattern three times for a total of one hour and 17 minutes. The airplane had a loss of power to all four engines and crashed in a wooded residential area in Cove Neck, Long Island, NY, approximately 16 miles from the airport. Investigators concluded that not declaring an emergency was a key factor in this accident.

Library module: Avianca Airlines Flight 052

 

Back to top

The NTSB released Safety Alert SA-055 in August 2016 titled "Pilots: Help ATC Help You." The alert highlights the importance of declaring an emergency if a pilot needs assistance or priority from ATC. This Socata accident and four others were listed in the alert.

Safety Alert SA-055, "Pilots: Help ATC Help You"

About 14 months after the Socata accident, the airplane manufacturer issued a service bulletin that changed the Global Air System Controller logic so the overheat thermal switch cannot shut down bleed air for pressurization. The new logic changes also corrected other possible scenarios that could shut down bleed air for pressurization, such as a cabin inlet temperature sensor fault. All new production aircraft incorporated this change.

Airplane Manufacturer Service Bulletin SB70-226-21

At the same time, Socata also updated the Pilot Operating Handbook to reflect the changed Global Air System Controller logic and clarified the steps the pilot should take in the Bleed Temp and Bleed Off procedures.

Later TBM aircraft included several other safety-enhancing features. The features that related to hypoxia included:

• When the cabin altitude exceeds a safe altitude, along with the current alerts, a voice message says, "USE OXYGEN MASK, USE OXYGEN MASK, USE OXYGEN MASK." This voice message was part of a global change from warning tones to voice message alerts.
• The airplane automatically initiates an emergency descent and then holds at a safe altitude if the system detects a high cabin pressure altitude and the pilot does not respond. The system also automatically turns the airplane 90 degrees off course to avoid other airplanes and changes the transponder code to 7700. This gives the pilot an opportunity to recover from hypoxia.

The following video shows these features demonstrated during a Socata marketing presentation and shows how conscientious design of aircraft systems can mitigate the risk of hypoxia.

Source: AOPA

 

Back to top

None issued.

 

Back to top

Airplane Life Cycle

• Operational
• Maintenance / Repair / Alteration

---

Accident Threats

• Automation
• System/Component Failure - Non-Powerplant (SCF-NP)

---

Operations

• Personal

---

Accident Common Themes

• Organizational Lapses
• Human Error

 

Back to top

Human Error

In this accident the pilot did not follow checklist procedures both preflight and following a depressurization event. As a result, had he donned his oxygen mask, no oxygen would have flowed to the mask, since the cockpit oxygen switch was not turned "ON" as required by the Before Starting Engine checklist.

Advisory Circular AC 61-107 (as amended) discusses the importance of immediately using oxygen and conducting emergency descents whenever hypoxia occurs. If hypoxia is suspected, immediately don oxygen mask and breathe 100 percent oxygen. Initiate an emergency descent to an altitude below 10,000 feet MSL, terrain permitting. If symptoms persist, land as soon as possible.

Organizational Lapses

As the NTSB determined that the checklist did not prioritize oxygen use and emergency descent, manufacturers should ensure that emergency procedures emphasize the importance of using supplemental oxygen and descending to an altitude with sufficient oxygen before troubleshooting other problems.

Back to top

Cessna 501, private pilot, N804ST, Texarkana, AR, May 23, 2016

While flying at FL430, the primary pressurization duct failed. When this occurs, a check-valve should close rapidly to trap the pressurized air in the cabin. However, one of the check valve flaps fractured, which resulted in a rapid depressurization. The pilot and passengers lost consciousness. Given the airplane's cruise altitude, the pilot was required by 91.211(b)(1)(ii) to be constantly wearing a supplemental oxygen mask; however, he was not doing so when the plane depressurized. The pilot regained consciousness and control of the airplane at 7,000 feet and landed the airplane. Due to excessive aerodynamic loads during the uncontrolled descent and recovery, the airplane sustained substantial damage to both wings.

NTSB Report: CEN16LA197

 

Back to top

Technical Related Lessons

In the event of a cabin depressurization above 10,000 feet, supplemental oxygen must be used immediately and the pilot must conduct an emergency descent to 10,000 feet or below (terrain permitting). (Threat Category: System / Component Failure – Non-Powerplant)

• Because cognitive abilities are rapidly and severely affected by hypoxia, especially at higher altitudes, it is imperative for pilots of pressurized airplanes to begin using oxygen immediately in the event of a loss of pressurization, especially when flight levels exceed 10,000 feet. The pilot should be aware of this hazard and be prepared to react quickly. In this accident, the pilot did not don his oxygen mask, declare an emergency, or initiate an emergency descent.

Alerts, indications, equipment, and procedures related to depressurization need to be clear. (Threat Category: Automation)

• The NTSB determined that the checklist did not prioritize oxygen use and emergency descent. Emergency checklist procedures related to pressurization failure should emphasize the importance of using supplemental oxygen and descending to an altitude with sufficient oxygen before troubleshooting a problem. Donning oxygen masks should be the first and immediate item in response to a cabin pressure altitude warning since the pilot will rapidly experience impaired cognitive abilities and motor skills.
• Cabin pressurization alerts should be made as simple and clear as possible. In this accident, the pilot did not have the benefit of enhanced alerting that came with later avionics and did not get the oral alert saying, "USE OXYGEN MASK, USE OXYGEN MASK, USE OXYGEN MASK" when the cabin depressurized.
• Although the oxygen masks in the accident aircraft were of a quick donning design, they were not used.

Common Theme Related Lessons

Proper performance of preflight tasks and adherence to normal and emergency checklist items, especially regarding to oxygen and other emergency procedures, are critical tasks for a flight crew. (Common Theme: Human Error)

• Investigators found that the cockpit oxygen switch was in the "OFF" position when the Before Starting Engine checklist called for it to be in the "ON" position.
• The red CAS message "Cabin Altitude" was designed to illuminate on the accident aircraft when the cabin pressure altitude exceeded 10,000 feet, along with a flashing Master Warning light and chime. The emergency procedure for this message included using oxygen and conducting an emergency descent, but the pilot did not perform either of these steps.

When pilots receive multiple warnings/alerts they must prioritize critical items. This is essential for alerts that demand immediate action. (Common Theme: Human Error)

• In this accident, after the failure of the pressurization system, a red Bleed Temp Crew Alert System (CAS) message and an amber Bleed Off CAS message would have been displayed. Soon after, the red Cabin Altitude CAS message would illuminate. If a pilot is focused on addressing earlier CAS messages when a cabin pressure altitude message appears, it is critical they temporarily suspend any response to earlier (less important) messages, put on a quick donning oxygen mask, and conduct an emergency descent.
• Due to the pressurization system failure in this accident, the pilot needed to prioritize the most critical action needed, which in this case was use of supplemental oxygen and an emergency descent. Because the pilot did not immediately use oxygen and conduct an emergency descent, his cognitive abilities swiftly deteriorated.

 

Back to top