History of Flight

Preceding flight from London to Cyprus

On August 13, 2005, a Helios Boeing 737-300 aircraft, registration number 5B-DBY, departed London's Heathrow airport (LHR) enroute to Larnaca, Cyprus, where it landed at 0425 local time. During this flight, which was the flight immediately prior to the accident flight, the cabin crew noted a problem with the aircraft's right aft service door and made an entry in the Aircraft Cabin Defect Log. The writeup stated, "Aft service door (starboard) seal around door freezes & hard bangs are heard during flt [flight]." This writeup was then transferred to the Aircraft Technical Log by the flight crew as "Aft service door requires full inspection."

Preflight Maintenance Activity

Upon arrival in Cyprus, ground engineers conducted inspections which included a visual inspection and operation of the aft right service door and a cabin pressurization leak check. Investigators concluded that the leak check did not follow the Aircraft Maintenance Manual procedures. The leak check required the use of bleed air from the Auxiliary Power Unit (APU) to manually pressurize the aircraft. Cabin pressure was raised by manually closing the outflow valve using the Digital Pressure Control Panel (DPCP) located on the overhead panel in the cockpit. No leaks were discovered, but this may have been due to the differences between the procedure used by the Helios ground engineers and the Aircraft Maintenance Manual procedures. Analysis completed during the investigation indicated that there was additional leakage present.

Following the leak check, the flight crew oxygen masks were checked, and the aircraft was released for flight by the ground engineer. Control of the outflow valve during the test required setting the DPCP to "MAN" (manual). Maintenance procedures concluded with "Put the Airplane Back to Its Usual Condition," but did not explicitly require returning the switch from the manual setting to "AUTO" (automatic). Investigators concluded that the pressure control panel mode selector switch was not returned to the "AUTO" position at the conclusion of the pressurization check. With the DPCP pressurization mode remaining in "MAN" mode, the outflow valve would stay in its

last commanded position, which due to the need to return the cabin back to ambient pressure at the conclusion of the pressurization leak check, would have been partially open.

Accident Flight

The flight crew arrived at Larnaca before 0800 local time and conducted a flight briefing in preparation for flight HCY522, scheduled to depart Larnaca, Cyprus at 0900. The flight was to Prague, Czech Republic, via Athens, Greece. Prior to takeoff at 0907, preflight checks would have included checking the equipment cooling switches, the cabin pressurization panel, and the flight crew oxygen masks. Investigators noted that these checks would have provided the first opportunity for the flight crew to notice the DPCP mode selector switch in the "MAN" (manual) mode rather than the typical "AUTO" (automatic) mode.

The design of the 737-300 DPCP, which is located above the first officer's seat, includes a green advisory light indicating MANUAL which is illuminated when the pressurization mode switch is in the manual mode position. Since the preflight would have been performed after sunrise in Larnaca, investigators, seeking an explanation as to why the manual mode switch position was overlooked, considered the possibility that the flight crew performed the cockpit setup with the annunciator lights set to DIM. Ultimately, however, the board came to the conclusion that since it would have been almost two hours after sunrise when the flight crew was configuring the aircraft, it was more likely that the annunciator lights were set to BRIGHT, and the green MANUAL indication was simply overlooked. Investigators were concerned that the overhead panel design was not conducive to safeguarding against these types of inadvertent omissions. Specifically, they felt the color of the illuminated indication (green) does not imply something out of the ordinary, as do amber (caution) or red (warning) lights. Investigators believed that these colors would have a higher likelihood of attracting the flight crew's attention that something was out of the ordinary.

The cockpit voice recorder (CVR) uses a 30-minute tape that records over itself. As a result, the recordings of the crew preflight checks would have been overwritten as the flight progressed. Therefore, investigators could not determine if the crew orally executed a preflight checklist. Standard Operating Procedures (SOPs) would have required that they do so. Investigators noted that this would have been the second opportunity for the crew to discover the incorrect switch position.

In step 12 of the 15-step preflight checklist the captain challenges and the first officer should respond as follows:

Captain challenge: AIR COND(ITIONING) & PRESS(URIZATION)..........

First officer reply: ____PACK(S), BLEEDS ON, SET

At this point, investigators noted that the flight crew should have detected and correctly set the pressurization control switch.

Following takeoff, the flight crew, per normal procedures, would have performed an after-takeoff checklist. The first item in this checklist is to check the pressurization system again and verify its settings. Investigators cited this as the third opportunity for the flight crew to detect that the pressure control panel mode selector was still inadvertently set to MAN(ual). For the accident flight, this meant that the outflow valve would remain in the last commanded position during the climb to altitude. As the last commanded position was partially open and the aircraft fuselage leakage was abnormally high, the aircraft could not pressurize to a safe cabin altitude.

Four minutes later, the flight crew reported passing through 10,000 feet enroute to 20,000 feet. Nicosia Area Control Centre (ACC) identified and cleared the flight for a final cruising altitude of flight level 340 (34,000 feet pressure altitude). The captain acknowledged the clearance. This was the last recorded communication between the flight crew and Nicosia ACC. A minute later, as the airplane climbed through 12,000 feet, the cabin altitude reached 10,000 feet, which would have triggered the cabin altitude warning horn. Investigators determined that instead of donning oxygen masks, taking control of the pressurization system and descending, as would be expected with a cabin altitude warning, the actions taken by the flight crew were consistent with an interpretation that the horn was a takeoff configuration warning.

In the 737 design, the takeoff configuration warning shares the same aural warning horn as the cabin altitude warning. At the onset of the warning, at about 10,000 feet, the flight crew took actions to disengage the autopilot and auto-throttle, and retarded the throttles, but then re-engaged the autopilot and auto-throttle and continued the climb. The captain then called the company dispatcher to report that the "Takeoff configuration warning (was) on" and "Cooling equipment normal and alternate off line." The airplane continued climbing through 16,000 feet.

 

 

Based on statements from ground personnel assisting the flight, investigators concluded that as the airplane climbed through 17,000 feet, the captain may have become further confused by the occurrence of the MASTER CAUTION light with the accompanying OVERHEAD indication on the annunciator panel. This caution would have illuminated for two different, but related, issues that were developing at approximately the same time: (1) the equipment cooling low-flow detectors were reacting to the low air density, resulting in one or both of the equipment cooling lights illuminating in the OFF position on the overhead panel; and (2) the oxygen masks deployed in the passenger cabin as the cabin altitude reached 14,000 feet. This occurred as the airplane climbed through 18,000 feet and resulted in the illumination of the PASS OXY ON light located further aft on the overhead panel. Investigators considered the possibility that the captain was fixated on the equipment cooling system problem, as indicated by questions to the ground engineer which did not make sense given the ground engineer's limited understanding of the situation at the time. Ultimately, the captain did not respond to the ground engineer's request to confirm that the pressurization panel was selected to AUTO, but instead responded by asking where the cooling fan circuit breakers were located.

Flight Data Recorder (FDR) indications of microphone keying, which was the only recorded evidence of communication between the captain and the ground engineer, ended at 0920 as the flight was passing through 28,900 feet. Above this altitude there was no further response from the captain and the aircraft continued to climb, leveling off at flight level 340 at 0924.

Having been advised by the airline dispatcher, Nicosia ACC made repeated attempts to contact the flight without receiving any response. Investigators believed that the captain had left his seat to troubleshoot what he perceived to be an equipment cooling problem, and at the high cabin altitude, without supplemental oxygen, he succumbed to hypoxia and lost consciousness. It was further concluded that the first officer, who apparently remained in his seat, did not don his oxygen mask and also succumbed to hypoxia and lost consciousness.

The airplane continued to fly its pre-programmed route on autopilot towards Athens. Repeated attempts to contact the flight were unsuccessful. The flight began what appeared to be a standard instrument approach procedure for landing at Athens International Airport, runway 03L, but remained at flight level 340. At 1029, the flight flew over Athens International Airport, flew the published missed approach procedure and entered a holding pattern still at flight level 340. At 1054, the Athens ACC declared an ALERT phase to the Joint Rescue Coordination Center (JRCC).

At 1124, during the sixth circuit of the holding pattern, the flight was intercepted by a pair of F-16 fighter aircraft of the Hellenic Air Force. The fighter aircraft were able to observe that there was no evidence of damage or fire and smoke. They also reported that the captain's seat was vacant, and the first officer's seat was occupied by someone who was slumped over the controls. Several passengers were observed sitting motionless and wearing oxygen masks. These oxygen masks, which would have dropped when the cabin altitude climbed above 14,000 feet, were connected to chemical oxygen generators that, once activated, would provide oxygen for approximately 12 minutes. It had been two hours and ten minutes since the last communication between the captain and the ground engineer.

The Cockpit Voice Recorder (CVR), which is a continuous loop recorder that captures the last 30 minutes of a flight, recorded the sound of someone entering the cockpit at 1149, adjusting the seat, and donning an oxygen mask. This activity was confirmed because, during the tenth holding pattern, the F-16 pilot observed a person enter the cockpit and sit down in the captain's seat. This individual was later concluded to have been flight attendant number 4, who held a British commercial pilot license. One minute after taking the captain's seat, the left engine flamed out causing the airplane to bank to the left and the aircraft started a descent. The occupant in the captain's seat did not respond to the F-16 pilot's attempts to attract his attention. When the Boeing 737 had descended to approximately 7,000 feet, the person in the captain's seat appeared to acknowledge the presence of the F-16 and was partially responsive to gestures but failed to follow the F-16 towards the airport. Just before 1200 the right engine flamed out due to fuel starvation and the aircraft continued to descend rapidly and crashed in hilly terrain in the vicinity of Grammatiko, approximately 33 km northwest of the Athens International Airport.

Map of Sequence of Events

Pressurization

The 737-300, typical of modern passenger jet aircraft, is pressurized to maintain a low cabin altitude while allowing the airplane to cruise at high altitudes. Pressurization is accomplished via engine bleed air, passed through an air conditioning pack to cool the air. At cruise altitudes, cabin pressure is maintained at approximately 8,000 feet above sea level. Pressurization is usually controlled automatically, with desired settings made by the flight crew through the pressurization control panel located on the flight deck overhead panel. The typical operating mode for the Digital Cabin Pressurization Control System (DCPCS) is "AUTO." In AUTO, one of two identical Digital Cabin Pressure Controllers (DCPC) will be the primary controller to open or close the aft outflow valve. The second DCPC remains in standby mode.

The position of the outflow valve determines the size of the exhaust area, and, when conditioned air is supplied to the cabin, automatic control of this exhaust area maintains a differential pressure between the cabin and the outside ambient pressure. The DCPCs use a cabin pressure schedule to control the differential pressure to maintain a comfortable and physiologically safe cabin altitude dependent on the airplane's cruise altitude. Due to the criticality of pressurization, two DCPCs are installed for redundancy. An "ALTN" (alternate) mode selection on the DPCP is available to the crew that will switch the standby and primary controller but still retain the automatic cabin pressure schedule. If a fault is detected, preventing correct operation of the first controller, the second automatically takes over control. "MAN" mode provides direct control of the pressurization outflow valve and can be used as a backup to automatic control in flight. In this mode the valve can only be varied by manipulation of the three-position, spring-loaded switch above the mode selector on the DPCP.

If the outflow valve is closed or nearly closed, restricting the exhaust area, and there is a source of conditioned air, the cabin pressure increases and cabin altitude decreases. Conversely, if the outflow valve is opened, allowing air to leave the cabin faster than it enters, or the source of pressurized air is removed, the cabin pressure decreases, and the cabin altitude increases. In the case of the Helios accident, the outflow valve was inadvertently left in manual control mode and was never moved from the last commanded position, which left the valve partially open. The partially open position of the outflow valve, combined with the abnormally high fuselage leakage, resulted in only partial pressurization of the cabin as the aircraft climbed. Post-accident analysis estimated that due to the abnormally high fuselage leakage and the partially open outflow valve, the cabin altitude would have been in the range of 20,500 feet to 28,200 feet during cruise. Investigators further estimated that the cabin altitude reached approximately 24,000 feet when the Helios aircraft reached its 34,000-foot cruising altitude.

Equipment Cooling

The 737 equipment cooling system routes conditioned air, via ducts, into and out of the electronic equipment in the flight deck and the forward avionics bay, providing cool air and removing heat. A loss of airflow in this system, due to failure of equipment cooling fan or low air density associated with excessive cabin altitude, results in illumination of the related equipment cooling OFF light.

 

 

When either equipment cooling OFF light is illuminated, the amber "MASTER CAUTION" and "OVERHEAD" indicator lights on the glareshield would illuminate to direct the flight crew's attention to the issue. If the equipment cooling problem is due to a failed fan, the flight crew can select the alternate fan and the airflow should be restored within five seconds. However, if the cooling problem is due to a lowered density of air being moved by operable fans (as would be experienced when there is an excessive cabin altitude), switching fans from normal to alternate will not remedy the issue. In the case of the Helios accident, investigators suspected that the captain may have become fixated on the equipment cooling issue, resulting in a crew lack of awareness regarding the pressurization problem.

 

 

Passenger Oxygen System

The passenger oxygen system is activated automatically if the cabin altitude climbs above 14,000 feet. The system can also be manually activated by the flight crew.

When the system is activated, oxygen masks drop in the cabin from Passenger Service Units (PSUs) above the passenger seats. In the accident airplane, these masks were plumbed to chemical oxygen generators, four masks to a PSU, and activation of a single mask in a PSU would result in an oxygen supply to all masks in that PSU. This source of oxygen, a byproduct of a chemical reaction, lasts approximately 12 minutes. Once started, it cannot be turned off. The design intent is solely to provide enough supplementary oxygen to passengers to allow time for the flight crew to descend to a physiologically safe altitude.

Similar to the alerting scheme for the equipment cooling system, when masks drop, the PASS OXY light illuminates and the flight crew receives an amber "MASTER CAUTION" light. Additionally, the "OVERHEAD" indicator light on the right side of the glareshield prompts the flight crew to direct their attention to the overhead in order to discover the source of the caution. Investigators believed that the flight crew did not react to this alert, perhaps due to hypoxia or fixation on the equipment cooling issue. What is unknown, due to the lack of CVR data from the early portion of the flight, is whether the cabin crew attempted to alert the flight crew to the fact that the passenger oxygen masks had dropped, before they themselves became incapacitated.

After the passenger masks deployed, the cabin crew would have expected a level off or descent, followed later by word from the flight deck that it was safe to remove oxygen masks. There was no specific operator procedure to address the contingency where passenger oxygen masks are deployed but the airplane continues to climb or remains at cruise altitude. However, the cabin crew was encouraged to take initiative if faced with an abnormal situation. Following the events of 9/11/2001, flight deck doors were made secure and cabin crew members, while able to enter the flight deck, did not have immediate access.

Hypoxia

Hypoxia is a condition resulting from a lack of oxygen (O2) in the body tissues. There are four types of hypoxia:

• Hypoxic Hypoxia results from an inadequate oxygenation of the arterial blood and is caused by reduced oxygen partial pressure.
• Anemic Hypoxia results from the reduced oxygen-carrying capacity of the blood to the cells, which may be due to blood loss, any of the anemias, carbon monoxide poisoning, or by drugs causing methemoglobinemia.
• Stagnant (or Circulatory) Hypoxia is caused by a circulatory malfunction which prevents the heart from pumping blood to the tissues and results, for example, from the venous pooling encountered during acceleration maneuvers.
• Histotoxic Hypoxia is an inability of the cells to utilize the oxygen provided when normal oxidation processes have been poisoned, such as by cyanide. There is no oxygen deficiency in body tissues, but rather an inability to use available oxygen, with the result that the partial pressure of O2 in the tissues may actually be higher than normal. Therefore, it is not true hypoxia by the definition used here but the consequences to human performance are the same. 

 

 

The most common type of hypoxia encountered in aviation is hypoxic hypoxia and is the type of hypoxia that occurred in this accident. In this case, the continued ascent with the cabin pressurization system in MANUAL mode resulted in the cabin altitude climbing above the physiological efficient zone.

The physiological efficient zone extends from sea level to 10,000 feet. It is the zone to which the human body is well adapted and the oxygen level within this zone is sufficient to keep a normal, healthy individual physiologically fit without the aid of protective equipment, such as supplemental oxygen. Above 10,000 feet is defined as the physiologically deficient zone where noticeable physiological deficits begin to occur. The initial symptoms of hypoxia vary from individual to individual and can change over time. These symptoms can also be masked when the individual experiencing the symptoms is engaged in an activity. Visual acuity is one of the first senses affected by hypoxia. Color vision can degrade, making it difficult to distinguish between colors. Dark adaptation issues often occur, sometimes below 10,000 feet. As the cabin altitude climbs above the physiological efficient zone, the body adjusts to provide defenses against the effects of hypoxia. There is an increase in pulse rate, respiratory volume, blood pressure and cardiac output, which can bring about an increase in fatigue, irritability, headache, and a decrease in judgment. The individual begins to have difficulty with simple tests requiring mental alertness or moderate muscular coordination.

As cabin altitude exceeds 15,000 feet, physiologic responses begin to be inadequate to compensate for the oxygen deficiency and hypoxia becomes evident. Symptoms vary and may include headache, "air-hunger" (gasping for air), tingling, dizziness, and cyanosis (bluing at the base of fingernails and the lips). The individual experiencing hypoxia is often the least likely to recognize their own symptoms and may exhibit euphoria, as the body releases chemicals that can lead to a sense of well-being. Intellectual impairment occurs early, and sufferers have difficulty recognizing an emergency situation. Thinking becomes slow, memory is faulty, and judgment is poor. Muscular coordination is reduced and the performance of fine or delicate muscular movements may become impossible. If the situation is not remedied, there is almost a complete mental and physical incapacitation, resulting in rapid loss of consciousness, convulsions, and finally, respiratory failure and death.

Regarding hypoxia, the United States Navy Flight Surgeons manual states, "...there is a commonly encountered misconception among aviators that it is possible to learn all of the early symptoms of hypoxia and then to take corrective measures once symptoms are noted. This concept is appealing because it allows all action, both preventive and corrective, to be postponed until the actual occurrence. Unfortunately, the theory is both false and dangerous. One of the earliest effects of hypoxia is impairment of judgment. Therefore, even if the early symptoms are noted, an aviator may disregard them and often does... ...at high altitudes, hypoxia may cause unconsciousness as the first symptom."

The following video demonstrates the insidious nature of hypoxia. In this example, the crewmember, at a cabin altitude of 35,000 feet, becomes fixated on a task and does not realize that both mental and physical capabilities are quickly degrading due to hypoxia. This is an excellent demonstration of the effects of hypoxia. The individual notes tingling in his fingers, and demonstrates "air-hunger," while continuing to perform his task, though with increasing difficulty. Ultimately, despite being told that he will die if he does not go on oxygen, he is almost completely incapacitated and requires assistance from other individuals to restore his oxygen. If the crewmember were to remain unassisted, loss of consciousness, convulsions leading to respiratory failure, and finally death would occur.

View Hypoxia Flight Level 350 Video:

 

 

View Time of Useful Consciousness demonstration: 

 

 

Time of Useful Consciousness

In the case of a sudden deprivation of oxygen at altitude, as could occur during rapid decompression of the aircraft, the time of useful consciousness (TUC) is defined in the U.S. Naval Flight Surgeon's Manual as "that period between an individual's sudden deprivation of oxygen at a given altitude and the onset of physical or mental impairment which prohibits his taking rational action." It represents the time during which an individual can recognize a problem and react appropriately. TUC can be as long as 5-10 minutes at a cabin altitude of 22,000 feet, but as short as 18 seconds at a cabin altitude of 40,000 feet.

The FAA's Civil AeroMedical Institute (CAMI) also uses the term effective performance time (EPT) as an interchangeable term with TUC and provides a similar table in its publication Introduction to Aviation Physiology.

The following video demonstrates the effects of hypoxia and the concept of TUC. In this demonstration, the test subject was breathing oxygen prior to experiencing depressurization. In the case of an actual depressurization, where an individual may not have been breathing supplemental oxygen and be suddenly exposed to high cabin altitude, the TUC may be even shorter.

View Helios Flight 522 Accident Animation:

 

 

Conclusion

Investigators concluded that this accident resulted from the flight crew's failure to recognize that the cabin pressurization mode selector was in the manual position; failure to identify the warnings and reasons for the activation of the warnings with a continuation of the climb; and incapacitation of the flight crew due to hypoxia. A contributing factor to the accident was a combination of human errors that caused the pressurization controller to be set for manual rather than automatic control. As a consequence of earlier maintenance activity, and a failure of the flight crew to reset the pressurization mode during the preflight checks and after takeoff checks, the outflow valve was partially open at takeoff and remained in the last commanded (MANUAL) position for the duration of the flight, which prevented the outflow valve from closing as the airplane climbed.

Investigators believed that the flight crew incorrectly interpreted the cabin altitude warning as a takeoff configuration warning, which shares the same aural warning but occurs when the airplane is on the ground. Additionally, it was concluded that the flight crew did not follow the appropriate checklist for a depressurization. As the airplane climbed further, the crew became hypoxic and eventually unresponsive to air traffic control radio calls. Investigators concluded that the flight crew was likely incapacitated as a result of oxygen starvation while the airplane continued to fly its programmed route via the autopilot. Fuel exhaustion resulted in failure of both engines and ultimately the crash near Athens, Greece.

 

Back to top

The Greek Air Accident Investigation & Aviation Safety Board (AAIASB) issued a total of 63 findings. Twenty findings were related to flight crew actions, six were related to the cabin crew, 13 to the aircraft, and six to the aircraft manufacturer, Boeing. Five findings were directed at air traffic control, one directed to the European Airworthiness authorities (EASA/JAA) and ICAO, seven related to the flight itself, four directed to the operator (Helios), and one finding directed toward the Cyprus Department of Civil Action.

The three direct causes of the accident were determined by investigators to be (1) the failure to recognize the pressurization mode selector was in the MAN (manual) position, and not discovering this error during the accomplishment of the preflight, before start, and after takeoff checklists; (2) the failure to identify the warnings and reasons for the warnings (cabin altitude warning, passenger oxygen mask deployment, and master caution warning) with the continued climb after the warnings alerted; and (3) the likely incapacitation of the crew due to hypoxia. Several latent causes and contributing factors were also identified. The complete text of the findings and citation of cause can be viewed at the following link: Accident Board Findings.

The entire accident report can be viewed at the following link: (AAIASB Accident Report).

 

Back to top

The AAIASB issued 16 recommendations. Five were directed to the National Transportation Safety Board (NTSB) of the United States, one was directed to the Cyprus AAIIB (Accident Investigation Board), and one was directed to the Greek ACC (Air Traffic Control). Eight more were directed to the European Certification Authorities (EASA/JAA) and ICAO, and one was directed to the Republic of Cyprus. No recommendations were made directly to the FAA, the certifying authority for the 737, as by the time the Greek accident report was issued, the FAA had already issued an airworthiness directive aimed at correcting the crew error cited as a direct cause of the accident.

The recommendations directed to the NTSB focused primarily on crew training relative to recognition of warnings associated with pressurization anomalies, and procedures for correctly configuring the air conditioning/pressurization system prior to takeoff. Recommendations to the NTSB also included improvements to maintenance procedures to avoid misconfiguration of the air conditioning/pressurization system. Primary recommendations to EASA/JAA and ICAO requested actions by those authorities similar to actions already taken by the FAA.

The complete text of the recommendations can be viewed at the following link: Accident Board Recommendations.

 

Back to top

14 CFR 25.1309 Equipment, systems, and installations.

(b)* * *
(2) The occurrence of any other failure condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable.
(c) Warning information must be provided to alert the crew to unsafe system operating conditions, and to enable them to take appropriate corrective action. Systems, controls, and associated monitoring and warning means must be designed to minimize crew errors which could create additional hazards.
(d) Compliance with the requirements of paragraph (b) of this Sec. must be shown by analysis, and where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider-
* * * * *

Amdt. 25-51, Eff. 9/1/77

14 CFR 25.1322 Warning, caution, and advisory lights.

If warning, caution, or advisory lights are installed in the cockpit, they must, unless otherwise approved by the Administrator, be:

(a) Red, for warning lights (lights indicating a hazard which may require immediate corrective action).
(b) Amber, for caution lights (lights indicating the possible need for future corrective action).
(c) Green for safe operation lights; and
(d) Any other color, including white, for lights not described in paragraphs (a) through (c) of this section, provided the color differs sufficiently from the colors prescribed in paragraphs (a) through (c) of this section to avoid possible confusion.

Amdt. 25-38, Eff. 2/1/77

 

Back to top

At the time of the accident, there had been a history of reports, within the 737 fleet of flight crew confusion regarding inflight warnings of pressurization failures. Multiple events had occurred that focused industry attention on the dual function of the pressurization warning. Following a 2003 event that was reported to the NASA Aviation Safety Reporting System (ASRS), the NASA ASRS office issued an Alert Bulletin entitled "Boeing 737-300 Cabin Altitude Warning Horn."

The bulletin was addressed to the airplane manufacturer and copied to the FAA and other industry safety organizations. It detailed one event in particular where the crew related confusion regarding the pressurization warning horn, believing that it was an erroneous takeoff configuration warning. As the crew persisted in attempting to solve the configuration warning issue, and per their own statements becoming hypoxic, the first officer remembered that the warning also served as a cabin altitude warning. The crew eventually properly configured the pressurization system and safely completed the flight.

The crew report, as detailed in the ASRS Alert Bulletin, expressed a concern that the dual function of the warning horn led to a number of events that would have been avoided had the cabin altitude warning been unique and specific. Following the Helios accident, an analysis of multiple historical events identified the ambiguous nature of the 737 cabin altitude warning. As a result, a redesign of the warning system indications was mandated in an airworthiness directive.

 

Back to top

• Ambiguous cabin altitude and takeoff configuration warning system
• Flight crew failure to properly configure the pressurization system prior to flight
• Flight crew failure to recognize and react properly to a valid cabin altitude warning horn

 

Back to top

A dual-function warning horn (takeoff configuration warning and excessive cabin altitude warning) would not be misinterpreted by flight crews since the warning situations arise in different phases of flight (ground and flight)

• The crew dismissed the warning horn, believing it was an improper alert to takeoff configuration

 

Back to top 

Following this accident, the accident investigation board received information regarding several precursor pressurization incidents involving 737 aircraft. All of these incidents involved breakdowns in checklist discipline and/or standard operating procedures (SOPs). All involved an incorrect configuration of the pressurization system where the source of conditioned air was either removed or never turned on (packs or bleeds off when they should have been on), or the selector switch was left in MANUAL (leaving the outflow valve open), which prevented airplane pressurization. In many of the reported incidents, the flight crew believed they were experiencing a takeoff configuration warning, when in fact they were experiencing a cabin altitude warning. In each of these incidents, at least one flight crew member donned their oxygen mask, or the cabin crew advised the flight crew of environmental conditions in the cabin (e.g., automatic deployment of oxygen masks). Many of these incidents resulted in flight crew members having hypoxia symptoms including confusion and loss of memory of the event.

The NASA ASRS database contained 171 reports of air conditioning and pressurization problems involving Boeing 737 aircraft in the decade from 1994 to 2004. The AAIASB found ten instances in which flight crews reported misinterpreting pressurization warnings as takeoff configuration warnings. On December 14, 2004, NASA ASRS issued an Alert Bulletin entitled "Boeing 737-300 Cabin Altitude Warning Horn." The Canadian Transportation Safety Board and the Australian Air Transport Safety Bureau also reported occurrences involving pressurization problems that included takeoffs and climbs initiated with pressurization systems not properly configured.

 

Back to top

Safety Conferences

As a result of the Helios accident, activities such as InfoShare were initiated to allow for sharing of critical safety experiences such as, in this case, crew confusion following warning system misinterpretations. The objective is to provide a forum by which experience that may have fleetwide implications can be identified and acted on, as needed. Information exchange is handled in a confidential forum to encourage a free flow of issues and concerns.

Design Standards 

Although not a direct reaction to the Helios accident, the FAA and the European Aviation Safety Agency (EASA), recognizing advances in cockpit design, amended the airworthiness standards for transport category airplanes concerning flight crew alerting in 2010. These new standards, entitled "Flight crew Alerting" encompassed and expanded the previous airworthiness standards entitled "Warning, Caution, and Advisory Lights." The new standards include prioritization, color requirements, and performance for flight crew alerting to reflect changes in technology and functionality. This amendment adds additional alerting functions and consolidates and standardizes definitions and regulations for flight crew warning, caution, and advisory alerting systems. These new standards, among other things, are intended to ensure that critical warnings are unambiguous.

Sec. 25.1322 Flight crew alerting.

In 2011, amendment 131 expanded 14 CFR 25.1322 to address the warning function as a system versus the original CFR that focused on the color of warning lights.

View 14 CFR 25.1322 amendment 131.

Technological Advancements

New technologies, such as employed on the Airbus A350 Automatic Emergency Descent function, have been developed to provide an assisted descent down to the highest altitude between flight level 100 and the current minimum off-route altitude (MORA) plus an envelope margin.

The automatic arming performs an automatic emergency descent with engagement of the automatic pilot/flight directors (AP/FDs) following a severe cabin decompression. The purpose is to cover a possible flight crew incapacitation situation, which occurred in the Helios accident. In case of no crew response, the function engages automatically.

Click here for more information on this technology, FCOM A350 Emergency Descent

 

Back to top

Pre-accident

Prior to this accident, the FAA issued two ADs that applied to all 737 models. These ADs were intended to address a safety concern that had been noted in several different airplane models, including the 737. The generic safety concern was related to hypoxia; "Delayed response of the flight crew in donning oxygen masks as a first and immediate action upon the activation of the cabin altitude warning could lead to incapacitation of the flight crew and loss of control of the airplane."

AD 2003-03-15 was a procedural AD that added verbiage to the Airplane Flight Manual (AFM) requiring flight crew to don their oxygen masks and set to 100% oxygen as a first action in response to a cabin altitude warning. This AD was applicable to early Boeing 737 models, 707, 727, early 747, and Douglas DC-8 and DC-9 aircraft and their derivatives.

AD 2003-14-08 was similar to AD 2003-03-15 and was applicable to later model Boeing 737 models as well as 757 and 767 aircraft.

Post-accident

Following this accident, the FAA issued four ADs concerning the 737. The first two ADs mandated procedural changes in the AFM intended to draw the flight crew's attention to the cabin altitude warning system in the 737. These were intended as interim actions while the manufacturer updated the flight deck design. The last two ADs mandated design changes to the 737 aircraft to ensure the flight crew would not misinterpret the dual-use warning horn.

AD 2006-13-13. This AD required revising the AFM to advise the flight crew of improved procedures for pre-flight configuration of the cabin pressurization system as well as improved procedures for interpreting and responding to the cabin altitude/configuration warning horn. This AD resulted from reports that airplanes (including the accident airplane) had failed to pressurize, and that flight crews failed to react properly to the cabin altitude warning horn. This AD was intended to prevent failure of the airplane to pressurize and subsequent failure of the flight crew to recognize and react to a valid cabin altitude warning horn. Failure to react could result in incapacitation of the flight crew due to hypoxia (lack of oxygen in body) and consequent loss of airplane control.

AD 2008-23-07. This AD required revising the AFM to include a new flight crew briefing that must be conducted before the first flight of the day and following any change in flight crew members, and to advise the flight crew of this additional briefing. This AD resulted from continuing reports, subsequent to the Helios accident, and AD 2006-13-13 that flight crews continued to fail to recognize and react properly to the cabin altitude warning horn.

AD 2011-03-14. This AD required installation of two warning level indicator lights on the center instrument panel in the flight compartment for early model 737s (including the Helios accident airplane model, the 737-300). This AD also removed some verbiage instituted by the past procedural ADs and revised emergency procedures and cabin pressurization procedures for normal operations.

AD 2013-02-05. Similar to AD 2011-03-14, this AD mandated installation of the two warning level indicator lights on instrument panels in the flight compartment and made other pressurization panel changes for some later model Boeing 737 model airplanes. This AD also removed some verbiage instituted by the past procedural ADs, and revised emergency procedures and cabin pressurization procedures for normal operations.

 

 

Back to top

Airplane Life Cycle:

• Design / Manufacturing
• Operational
• Maintenance / Repair / Alteration

---

Accident Threat Categories:

• Flight Deck Layout / Avionics Confusion
• Crew Resource Management
• Lack of System Isolation / Segregation
• Pressurization / Decompression Failures

---

Groupings:

• Automation

---

Accident Common Themes:

• Organizational Lapses
• Human Error
• Flawed Assumptions
• Pre-existing Failures
• Unintended Effects

 

Back to top

Organizational Lapses

Many 737 pressurization events, some of which involved flight crew confusion regarding cabin altitude warnings, occurred prior to the Helios accident. Of the 171 events involving the 737, not all were effectively reported. Only a few events were related to aural warning confusion. While industry and airworthiness authorities addressed many of the varied causes, they did not recognize the nature or significance of the reported confusion events, and therefore did not take appropriate corrective action.

Human Error

The ground crew failed to return the aircraft to its original configuration after maintenance, leaving the control panel switch in the incorrect MAN (manual) position.

The flight crew failed to configure the airplane's pressurization system properly for flight in accordance with preflight checklists and did not correctly accomplish other multiple ground and inflight checklists that could have led to correcting the configuration error. The flight crew failed to properly identify and react to the cabin altitude warning horn once airborne.

Flawed Assumptions

The 737-warning system design assumed that the dual nature of the warning system would not result in flight crew confusion and would consistently produce correct crew responses to either the takeoff configuration condition or the hazardous pressurization condition.

The design of the cabin altitude warning system incorporates a warning horn that serves two purposes. On the ground the warning serves as a takeoff configuration (e.g., flap setting) warning and in flight warns of excessive cabin altitude. A combination of pre-flight maintenance activities and multiple flight crew checklist errors resulted in an improperly configured airplane pressurization system. Following takeoff, as the cabin altitude exceeded safe limits, the warning system functioned properly to alert the crew. Due to the dual function, the warning was misinterpreted by the flight crew, who ultimately failed to take appropriate corrective actions.

 

Back to top

LearJet 35 in Aberdeen, South Dakota, USA (N47BA)

The design of the cabin altitude warning system incorporated a warning horn that served two purposes. On the ground the warning served as a takeoff configuration (e.g., flap setting) warning and in flight, warned of excessive cabin altitude. A combination of pre-flight maintenance activities and multiple checklist errors resulted in an improperly configured airplane pressurization system. Following takeoff, as the cabin altitude exceeded safe limits, the warning system functioned properly to alert the crew. Due to the dual function of the warning, it was misinterpreted by the flight crew who ultimately failed to take appropriate corrective actions.

Beech King Air 200 in Burketown, Australia (VH-SKC)

On September 4, 2000, the Beech Super King Air departed Perth in Western Australia for a flight to Leonora. For 23 minutes, communications with the aircraft seemed normal. However, the pilot's speech became impaired and worsened until he apparently became unconscious. The aircraft cruised at flight level 250 for approximately five hours before running out of fuel and crashing.

 

Back to top

Technical Related Lessons

Flight deck annunciations must be clear and unambiguous. They must identify the specific system condition, so flight crews are able to respond in an appropriate and timely manner while not becoming confused. (Threat Category: Flight Deck Layout/Avionics Confusion)

• The 737-cockpit design layout involved the use of the same warning horn to signify two different situations (incorrect takeoff configuration or excessive cabin altitude). This was not consistent with appropriate human factors principles, and could, as in this case, lead to confusion at a time when prompt action by the flight crew was critical to continued safe flight.

Flight and cabin crew members must be trained to understand and recognize physiological threats, including those associated with oxygen deprivation (hypoxia), that are inherent when flying outside of the physiological efficient zone. (Threat Category: Pressurization/Decompression Failures)

• Modern transport airplanes can fly at altitudes that are too high to sustain human life. For this reason, and for passenger comfort, airplanes are pressurized so the conditions inside the airplane generally remain at comfortable temperatures and at pressure altitudes below 8,000 feet, even when the airplane is flying as high as 51,000 feet. Loss of pressurization in flight presents different hazards depending on how quickly the loss occurs. Without pressurization, airplane occupants can suffer the physiological effects from the extreme cold temperatures as well as lack of oxygen, or hypoxia.

Common Theme Related Lessons

Warning/alerting systems must provide sufficiently powerful cues so that flight crews respond appropriately in all flight conditions. Multiple procedures should not be assigned to critical alert sounds/displays. (Common Theme: Flawed Assumptions)

• Early versions of the 737 were designed such that the same warning sound indicated different failures depending on the phase of flight. The Helios crew, when hearing the cabin altitude horn, responded as though it was an erroneous takeoff configuration warning and never corrected the deteriorating pressurization problem. Subsequent to the accident, the system was redesigned to install incorrect takeoff configuration and excessive cabin altitude warning lights that made specific the type of warning indicated by the warning horn.

Proper performance of preflight procedures and adherence to checklist items and standard operating procedures is a critical task for flight crew. (Common Theme: Human Error)

• The Helios flight crew failed to properly configure the aircraft's pressurization system for flight during the initial preflight procedure. Moving the panel mode select switch from "MAN" (manual) to "AUTO" (automatic) would have pressurized the airplane. Their subsequent failure to identify and rectify the configuration error during the preflight checklist and again during the after-takeoff checklist was identified by investigators as the direct cause of this accident.

 

Back to top