Lion Air B737-8 (MAX) PK-LQP crash on the Java Sea, 29 October 2018. Preliminary report.

Released on 28 November 2018.

50669_1540829961

KOMITE NASIONAL KESELAMATAN TRANSPORTASI. REPUBLIC OF INDONESIA. PRELIMINARY KNKT.18.10.35.04

Aircraft Accident Investigation Report. PT. Lion Mentari Airlines. Boeing 737-8 (MAX); PK-LQP. Tanjung Karawang, West Java. Republic of Indonesia. 29 October 2018

FACTUAL INFORMATION

History of the Flight

On 29 October 2018, a Boeing 737-8 (MAX) aircraft registered PK-LQP was being operated by PT. Lion Mentari Airlines (Lion Air) as a scheduled passenger flight from Soekarno-Hatta International Airport (WIII), Jakarta(Soekarno-Hatta International Airport (WIII), Jakarta will be named as Jakarta for the purpose of this report) with intended destination of Depati Amir Airport (WIPK), Pangkal Pinang(Depati Amir Airport (WIPK), Pangkal Pinang will be named as Pangkal Pinang for the purpose of this report). The scheduled time of departure from Jakarta was 0545 LT – 2245 UTC on 28 October 2018 as LNI610 (The 24-hours clock in Universal Time Coordinated (UTC) is used in this report to describe the local time as specific events occurred. The Local Time (LT) is UTC +7 hours).

At 2320 UTC, the aircraft departed from Jakarta using runway 25L and intended cruising altitude was 27,000 feet. The LNI610 pilot was instructed to follow the Standard Instrument Departure (SID) of ABASA 1C (Note: The detail of ABASA 1C Standard Instrument Departure (SID) is described in subchapter 1.8 Aids to Navigation on the original document).

According to the weight and balance sheet, on board the aircraft were two pilots, five flight attendants and 181 passengers consisted of 178 adults one child and two infants. The voyage report showed that the number of flight attendants on board was six flight attendants (Voyage report is the up to date crew names in each sector and available in the web-based system named “Crewlink”).

The Digital Flight Data Recorder (DFDR) recorded a difference between left and right Angle of Attack (AoA – Angle of Attack (AOA) is the angle between wing mean aerodynamic chord and direction of relative wind) of about 20° and continued until the end of the recording. During rotation, the left control column stick-shaker activated and continued for most of the flight (Stick shaker is an artificial warning device to alert the flight crew when airspeed is at a minimum operating speed and is close to a wing stall condition – Boeing 737-8 System Description Section of the Aircraft Maintenance Manual).

Shortly after departure, the Jakarta Tower controller instructed LNI610 to contact Terminal East controller (TE). At 23:21:22 UTC, the LNI60 SIC made initial contact with the TE controller who responded that the aircraft was identified on the controller Aircraft Situational Display/ASD (radar display). Thereafter, the TE controller instructed the LNI610 to climb to altitude 27,000 feet.

At 23:21:28 UTC, the LNI610 SIC asked the TE controller to confirm the altitude of the aircraft as shown on the TE controller radar display. The TE controller responded that the aircraft altitude was 900 feet and was acknowledged by the LNI610 Second in Command (SIC).

At 23:21:53 UTC, the LNI610 SIC requested approval to the TE controller “to some holding point”. The TE controller asked the LNI610 the problem of the aircraft and the pilot responded “flight control problem”.

The LNI610 descended from altitude 1,700 to 1,600 feet and the TE controller then asked the LNI610 of the intended altitude. The LNI610 SIC advised the TE controller that the intended altitude was 5,000 feet.

At 23:22:05 UTC, the DFDR recorded the aircraft altitude was approximately 2,150 feet and the flaps were retracted. After the flaps reached 0, the DFDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim.

At 23:22:31 UTC, the TE controller instructed the LNI610 to climb and maintain altitude of 5,000 feet and to turn left heading 050°. The instruction was acknowledged by the LNI610 SIC.

At 23:22:48 UTC, the flaps extended to 5 and the automatic AND trim stopped.

At 23:22:56 UTC, the LNI610 SIC asked the TE controller the speed as indicated on the radar display. The TE controller responded to the LNI610 that the ground speed of the aircraft shown on the radar display was 322 knots.

At 23:24:51 UTC, the TE controller added “FLIGHT CONT TROB” text for LNI610 target label on the controller radar system as a reminder that the flight was experiencing flight control problem.

At 23:25:05 UTC, the TE controller instructed the LNI610 to turn left heading 350° and maintain altitude of 5,000 feet. The instruction was acknowledged by the LNI610 SIC.

At 23:25:18 UTC, the flaps retracted to 0. At 23:25:27 UTC, the automatic AND trim and flight crew commanded ANU trim recorded began again and continued for the remainder of the flight.

At 23:26:32 UTC, the TE controller instructed the LNI610 to turn right heading 050° and maintain altitude of 5,000 feet. The instruction was acknowledged by the LNI610 SIC.

At 23:26:59 UTC, the TE controller instructed the LNI610 to turn right heading 070° to avoid traffic. The LNI610 pilot did not respond to the TE controller‟s instruction, thereafter, the controller called the LNI610 twice who responded at 23:27:13 UTC.

At 23:27:15 UTC, the TE controller instructed the LNI610 to turn right heading 090° which was acknowledged by the LNI610 SIC. A few seconds later, the TE controller revised the instruction to stop the turn and fly heading 070° which was acknowledged by the LNI610 SIC.

At 23:28:15 UTC, the TE controller provided traffic information to the LNI610 who responded “ZERO”. About 14 seconds later, the TE controller instructed the LNI610 to turn left heading 050° and maintain an altitude of 5,000 feet. The instruction was acknowledged by the LNI610 SIC.

At 23:29:37 UTC, the TE controller questioned the LNI610 whether the aircraft was descending as the TE controller noticed that the aircraft was descending. The LNI610 SIC advised the TE controller that they had a flight control problem and were flying the aircraft manually.

At 23:29:45 UTC, the TE controller instructed the LNI610 to maintain heading 050° and contact the Arrival controller (ARR). The instruction was acknowledged by the LNI610 SIC.

At 23:30:03 UTC, the LNI610 contacted the ARR controller and advised that they were experiencing a flight control problem. The ARR controller advised LNI610 to prepare for landing on runway 25L and instructed them to fly heading 070°. The instruction was read back by the LNI610 SIC.

At 23:30:58 UTC, the LNI610 SIC stated “LNI650 due to weather request proceed to ESALA” which was approved by the ARR controller (Waypoint ESALA is located on coordinate 5°57’42.00″S 107°19’0.00″E which about 40 Nm from Soekarno-Hatta Airport on bearing 75°).

At 23:31:09 UTC, the LNI610 PIC advised the ARR controller that the altitude of the aircraft could not be determined due to all aircraft instruments indicating different altitudes. The pilot used the call sign of LNI650 during the communication. The ARR controller acknowledged then stated, “LNI610 no restriction”.

At 23:31:23 UTC, the LNI610 PIC requested the ARR controller to block altitude 3,000 feet above and below for traffic avoidance. The ARR controller asked what altitude the pilot wanted. At 23:31:35 UTC, the LNI610 PIC responded “five thou”. The ARR controller approved the pilot request.

At 23:31:54 UTC, the FDR stopped recording.

The ARR controller attempted to contact LNI610 twice with no response. At 23:32:19 UTC, the LNI610 target disappeared from the ASD and changed to flight plan track. The ARR controller and TE controller attempted to contact LNI610 four more times with no response.

The ARR controller then checked the last known coordinates of LNI610 and instructed the assistant to report the occurrence to the operations manager.

The ARR controller requested several aircraft to hold over the last known position of LNI610 and to conduct a visual search of the area.

About 0005 UTC (0705 LT), tugboat personnel found floating debris at 5°48’56.04″S; 107° 7’23.04″E which was about 33 Nm from Jakarta on bearing 56°. The debris was later identified as LNI610.

Injuries to Persons

Fatal:

Flight crew 8

Passengers 181

Total in Aircraft 189

Others –

Damage to Aircraft

The aircraft was destroyed

Personnel InformationAircraft Information

Aircraft Flight and Maintenance Log

The Aircraft Flight Maintenance Log (AFML) recorded that since 26 October 2018 until the occurrence date several problems occurred related to airspeed and altitude flag appeared on Captain (left) Primary Flight Display (PFD) three times, SPEED TRIM FAIL light illumination and MACH TRIM FAIL light illumination two times and IAS (Indicated Airspeed) and ALT (Altitude) Disagree shown on the flight Denpasar to Jakarta the day before the accident flight.

The summary of the aircraft defect recorded on AFML was as follows:

Table 3

Aids to Navigation

The runway 25L utilized RNAV-1 Standard Instrument Departure (SID), one of the SID was ABASA 1C which is after departure the pilot has to climb on heading 248.4°, at or above 3,000 feet then turn left direct to BUNGA – RATIH – LARAS – TOMBO – ABASA (figure 3).

fig 3

Automatic Dependent Surveillance – Broadcast

Automatic Dependent Surveillance – Broadcast (ADS–B) is a surveillance technology in which an aircraft determines its position via satellite navigation and periodically broadcasts it, enabling it to be tracked.

The “automatic” in the ADS-B means that the technology does not require pilot or external input. The “dependent” means its surveillance process depends on data on-board aircraft systems to provide surveillance information to the receiver and “broadcast” means the originating source has no knowledge of who receives the data and there is no interrogation or two-way contract.

Several receivers have been installed in several places including in the Jakarta Air Traffic Services Center (JATSC). The PK-LQP aircraft had ADS-B capability and the investigation retrieved the aircraft broadcasted data from the JATSC facility.

The flight track of the LNI610 based on the ADS-B data superimposed on Google Earth.

fig 4

Flight Recorders

The aircraft was equipped with Digital Flight Data Recorder (DFDR) and Cockpit Voice Recorder (CVR) which were located in the tail section of the aircraft.

The search for both DFDR and CVR was conducted by a team consisting of KNKT, Transport Safety Investigation Bureau (TSIB) of Singapore, National Transportation Safety Board (NTSB) of United States of America, Badan SAR Nasional (National Search and Rescue Agency) and Indonesia Navy divers.

The search area was determined based on the last recorded aircraft position from the ADS-B provided by the Air Traffic Services provider.

Digital Flight Data Recorder

The aircraft was fitted with a FA2100 DFDR manufactured by L3 Technologies with part number 2100-4945-22 and serial number 001261573.

On 1 November 2018, the Crash Survivable Memory Unit (CSMU) of the DFDR was recovered by the search team. The CSMU was transported to the KNKT recorder facility for data downloading. The read-out was performed by KNKT investigators with the participation of the Australian Transport Safety Bureau (ATSB), the National Transportation Safety Board (NTSB) of United States of America and Transport Safety Investigation Bureau (TSIB) of Singapore as Accredited Representatives.

The memory unit recorded 1,790 parameters and approximately 69 hours of aircraft operation, which contained 19 flights including the accident flight.

Several significant parameters of the DFDR are shown in the following figures.

fig 5

Cockpit Voice Recorder

The aircraft was fitted with a FA2100 CVR manufactured by L3 Technologies with part number 2100-1925-22 and serial number 001257879. The CVR has not been recovered and search for the CVR is continuing.

Medical and Pathological Information

Not relevant to this accident.

Fire

There was no evidence of in-flight fire.

Survival Aspects

The accident was not survivable.

Tests and Research

The investigation team is in possession of the AoA sensor removed from the accident aircraft in Denpasar. The AoA sensor will undergo further testing and analysis under the supervision of the KNKT.

The investigation team plans to conduct aircraft simulator exercises in the Boeing engineering simulator configured for 737-8 (MAX).

The KNKT has received the Quick Access Recorder (QAR) data for the accident aircraft since its delivery to Lion Air for analysis.

43914256_783931631942166_4200690027124396732_n

Additional Information

PK-LQP Previous Flight

On 28 October 2018, the accident aircraft was operated as a passenger flight from I Gusti Ngurah Rai International Airport (WADD), Denpasar to Jakarta as LNI043 (I Gusti Ngurah Rai International Airport (WADD), Denpasar will be named as Denpasar for the purpose of this report). The aircraft departed from Denpasar with two pilots, five flight attendants and 182 passengers.

During preflight check, the PIC discussed with the engineer the maintenance that had been performed on the aircraft. The engineer informed the PIC that the AoA sensor had been replaced and tested accordingly. The PIC was convinced by the explanation from the engineer and the statement on the Aircraft Flight Maintenance Log (AFML) that the problem had been resolved.

The PIC conducted the crew briefing and stated that he would act as Pilot Flying on the flight to Jakarta. During the briefing, the PIC mentioned the replacement of AoA sensor. The flight departed about 1420 UTC, and during takeoff, the pilot did not notice any abnormalities. About two seconds after landing gear retraction, the Takeoff Configuration Warning appeared then extinguished (Takeoff Configuration Warning is a safety device intended to ensure that takeoff is properly configured. An intermittent warning horn and the TAKEOFF CONFIG warning light illuminates when takeoff configuration warning activates).

About 400 feet, the PIC noticed on the Primary Flight Display (PFD) that the IAS DISAGREE warning appeared and the stick shaker activated. The FDR showed the stick shaker activated during the rotation. Following that indication, the PIC maintained a pitch of 15° and the existing takeoff thrust setting. The stick shaker remained active throughout the flight (Primary Flight Display (PFD) is the primary reference for flight information which displays electromechanical instruments onto a single electronic display).

The PIC handed over control to the SIC and announced “memory item airspeed unreliable”. After the transfer of control, the PIC cross-checked the PFDs with the standby instrument and determined that the left PFD had the problem. The PIC then switched on the right flight director (FD) so the SIC would have a normal display.

While handling the problem, the PIC instructed the SIC to continue acceleration and flap retraction as normal. The PIC commanded the SIC to follow FD command and re-trim the aircraft as required. The PIC noticed that as soon the SIC stopped trim input, the aircraft was automatically trimming aircraft nose down (AND).

After three automatic AND trim occurrences, the SIC commented that the control column was too heavy to hold back. At 14:25:46 UTC, the PIC declared “PAN PAN” to the Denpasar Approach controller due to instrument failure and requested to maintain runway heading. The Denpasar Approach controller acknowledged the message and approved the pilot request. A few seconds later, the Denpasar Approach controller asked the LNI043 whether he wanted to return to Denpasar and the pilot responded “standby”.

At 14:28:28 UTC, the PIC moved the STAB TRIM switches to CUT OUT. The PIC re-engaged the STAB TRIM switches to NORMAL, but almost immediately the problem re-appeared. The PIC then moved the STAB TRIM switches back to CUT OUT and continued with manual trim without auto-pilot until the end of the flight.

The pilot performed three Non-Normal Checklists (NNCs) consisting of Airspeed Unreliable, ALT DISAGREE, and Runaway Stabilizer. None of the NNCs performed contained the instruction “Plan to land at the nearest suitable airport”.

At 14:32:31 UTC, the LNI043 pilot advised the Denpasar Approach controller that the problem had been resolved and requested to continue flight at an altitude of 29,000 feet without Reduced Vertical Separation Minima (RVSM). The Denpasar Approach controller then instructed the LNI043 pilot to climb to an altitude of 28,000 feet and contact Makassar Area Control Center (ACC) for further air traffic control (ATC) services.

At 14:43:36 UTC, the Upper West Madura (UWM) controller of Makassar ACC instructed the LNI043 to climb to an altitude of 38,000 feet.

At 14:48:27 UTC, the LNI043 pilot declared “PAN PAN” to the UWM controller and requested to maintain an altitude of 28,000 feet due to instrument failure. The UWM controller acknowledged and approved the pilot request. At 14:54:07 UTC, the UWM controller instructed the LNI043 to contact Upper West Semarang (UWS) controller for further ATC services.

At 14:55:28 UTC, the LNI043 pilot made an initial call to the UWS controller and advised that the aircraft was maintaining an altitude of 28,000 feet. The UWS controller acknowledged the pilot information and requested the detail of the instrument failure. The LNI043 pilot then advised an altitude and autopilot failure and requested the UWS controller to relay information to Jakarta controller that the LNI043 pilot requested an uninterrupted descent. The UWS controller acknowledged the LNI043 pilot request.

The remainder of the flight was uneventful and the aircraft landed using runway 25L about 1556 UTC.

After parking, the PIC informed the engineer about the aircraft problem and entered IAS (Indicated Air Speed) and ALT (altitude) Disagree and FEEL DIFF PRESS (Feel Differential Pressure) light problem on the Aircraft Flight Maintenance Log (AFML).

The PIC also reported the flight condition through the electronic reporting system of the company A-SHOR. The event was reported as follows:

Airspeed unreliable and ALT disagree shown after takeoff, Speed Trim System – STS also running to the wrong direction, suspected because of speed difference, identified that CAPT instrument was unreliable and handover control to FO. Continue NNC of Airspeed Unreliable and ALT disagree. Decide to continue flying to CGK at FL280, landed safely runway 25L.

Investigation Process

The investigation involved the National Transportation Safety Board (NTSB) of the United States of America as State of design and State of manufacturer, the Transport Safety Investigation Bureau (TSIB) of Singapore and the Australian Transport Safety Bureau (ATSB) as State provide assistant that assigned accredited representatives according to ICAO Annex 13.

The investigation is continuing and, should any further relevant safety issues emerge during the course of the investigation, KNKT will immediately bring the issues to the attention of the relevant parties and publish as required.

FINDINGS

Findings are statements of all significant conditions, events or circumstances in the accident sequence. The findings are significant steps in the accident sequence, but they are not always causal or indicate deficiencies. Some findings point out the conditions that pre-existed the accident sequence, but they are usually essential to the understanding of the occurrence, usually in chronological order.

According to factual information during the investigation, the KNKT identified findings as follows:

On 28 October 2018, a Boeing 737-8 (MAX) aircraft registered PK-LQP was operated as a scheduled passenger flight from Denpasar to Jakarta. Prior to the flight, the Angle of Attack (AoA) sensor had been replaced and tested.
The DFDR showed the stick shaker activated during the rotation and remained active throughout the flight. About 400 feet, the PIC noticed on the Primary Flight Display (PFD) that the IAS DISAGREE warning appeared.
The PIC cross-checked both PFDs with the standby instrument and determined that the left PFD had the problem. The flight was handled by the SIC.
The PIC noticed that as soon the SIC stopped trim input, the aircraft was automatically trimming aircraft nose down (AND). After three automatic AND trim occurrences, the SIC commented that the control column was too heavy to hold back. The PIC moved the STAB TRIM switches to CUT OUT.
The pilot performed three Non-Normal Checklists (NNCs) consisting of Airspeed Unreliable, ALT DISAGREE, and Runaway Stabilizer. None of the NNCs performed contained the instruction “Plan to land at the nearest suitable airport”.
After parking in Jakarta, the PIC informed the engineer about the aircraft problem and entered IAS (Indicated Air Speed) and ALT (altitude) Disagree and FEEL DIFF PRESS (Feel Differential Pressure) light problem on the Aircraft Flight Maintenance Log (AFML).
The PIC also reported the flight condition through the electronic reporting system of the company A-SHOR.
The engineer performed flushing the left Pitot Air Data Module (ADM) and static ADM to rectify the IAS and ALT disagree followed by operation test on ground and found satisfied. The Feel Differential Pressure was rectified by performed cleaned electrical connector plug of elevator feel computer. The test on ground found the problem had been solved.
At 2320 UTC, (29 October 2018, 0620 LT) the aircraft departed from Jakarta using runway 25L and intended destination Pangkal Pinang. The DFDR recorded a difference between left and right Angle of Attack (AoA) of about 20° and continued until the end of the recording. During rotation, the left control column stick shaker activated and continued for most of the flight.
According to the weight and balance sheet, on board the aircraft were two pilots, five flight attendants and 181 passengers consisted of 178 adults one child and two infants. The voyage report showed that the number of flight attendants on board was six flight attendants.
During the flight, the LNI610 SIC asked the TE controller to confirm the altitude of the aircraft and later also asked the speed as shown on the TE controller radar display. The LNI610 SIC reported experienced „flight control problem‟.
After the flaps retracted, the FDR recorded automatic aircraft nose down (AND) trim active for 10 seconds followed by flight crew commanded aircraft nose up (ANU) trim. The flaps extended to 5 and the automatic AND trim stopped.
At 23:25:18 UTC, the flaps retracted to 0 and several seconds later, the automatic AND trim and flight crew commanded ANU trim recorded began again and continued for the remainder of the flight.
The LNI610 PIC advised the controller that the altitude of the aircraft could not be determined due to all aircraft instruments indicating different altitudes and requested to the controller to block altitude 3,000 feet above and below for traffic avoidance.
The flight crew and the flight attendants held valid licenses and medical certificates and certified to operate B737.
The Aircraft Flight Maintenance Log (AFML) recorded that since 26 October 2018 until the occurrence date, several problems occurred related to airspeed and altitude flag appeared on Captain (left) Primary Flight Display (PFD) three times, SPEED TRIM FAIL light illumination and MACH TRIM FAIL light illumination two times and IAS (Indicated Airspeed) and ALT (Altitude) Disagree shown on the flight Denpasar to Jakarta the day before the accident flight.

SAFETY ACTION

At the time of issuing this Preliminary Report, the KNKT had been informed of safety actions taken by several parties resulting from this accident.

Lion Air

On 29 October 2018, the Safety and Security Directorate issued safety reminder to all Boeing 737 pilots to review several procedures including memory items of airspeed unreliable and runaway stabilizer.

On 30 October 2018, issued information to all pilots which contained a reminder to:

Have a thorough understanding of Deferred Maintenance Item (DMI) for the aircraft to be used.
Check any defect and the troubleshooting on Aircraft Maintenance Flight Log (AFML) from the previous flights.
Be ready for any abnormal or emergency conditions by having Memory Items and maneuvers reviewed and have a good Cockpit Resource Management (CRM) to all counterparts.
Write on the AFML for any malfunctions that happened during the flight. Brief the engineer on duty comprehensively about the malfunction happened in flight. Please refer to the Fault Reporting Manual (FRM) provided in the aircraft.
Send report to Safety and Security Directorate through all reporting methods that available as soon as practicable.

On 2 November 2018, the Safety and Security Directorate issued safety instruction:

For Operation Directorate:

To instruct all B737 pilots to use the Fault Reporting Manual (FRM) in all their Aircraft Flight Maintenance Log (AFML) report. This measure shall be enforced by Operations, Training and Standard with immediate effect.
To instruct all pilots to fill the AFML report with as much details as deem necessary to provide a full comprehensive description of the technical defect to the engineering team. This measure should be applied with immediate effect.
To reinforce in the current simulator syllabus, the “Unreliable Airspeed” and “Stabilizer Runaway” maneuvers, with immediate effect to all fleets.
To reinforce the role of Chief Pilot on Duty, in order to raise an operational issue to IOCC/MCC should any significant notification has been received. This measure should be applied with immediate effect.
To reinforce through Notice to Pilots, Ground Recurrent Training, and Simulator Sessions on Decision Making Process when the aircraft has declared and operating in abnormal (PAN-PAN) or emergency (MAYDAY-MAYDAY) condition.

For Maintenance Directorate:

To ensure Batam Aero Technic (BAT) reinforce the role of the technical specialist team as line maintenance support for more efficient troubleshooting process. This service should ensure that the “live” malfunctions are properly followed up until properly solved.
To ensure Batam Aero Technic (BAT) through their TRAX system gives an adequate alert on a repetitive problem, even though reports for a malfunction may have been coded under different ATA references.
To reinforce the MCC role in malfunction follow up and troubleshooting.

On 3 November 2018, the Chief Pilot issued Notice to Pilot which required all pilots to perform the following:

Read and study the FRM (Fault Reporting Manual) and know how to utilize it. Any observed faults, status message, or cabin faults must be written down in the AFML, and ATA Number/Tittle of ECAM Shown (Fault) For A330. Should have any doubt, please contact the chief pilot or Quality Assurance Department via Mission Control (MC) – OM-A 8.6.8.
Do not hesitate to describe in details about the defect that has been encountered. This is a good practice especially for the engineers to do the troubleshooting and for the next crew that will fly the aircraft.
Review the memory item routinely during the briefing, and if applicable, review the course of actions that should be taken if particular situations occur in any phase of flight.

On 5 November 2018, the Training Manager issued Training Notice to Pilot which required all instructor pilots to make additional training of airspeed unreliable and runaway stabilizer.

On 7 November 2018, the Fleet Manager issued Notice to Pilot which required all pilots to improve reporting events of IAS disagree, ALT disagree, SPEED fail, and ALT fail as a serious occurrence.

On 8 November 2018, the Safety and Security Directorate issued Safety Instruction to all pilots to follow Boeing Flight Crew Operations Manual Bulletin Number TBC-19 and Number MLI-15.

On 12 November 2018, the Safety and Security Directorate issued Notice to all station and operation managers of the Emergency Flowchart revision which included occurrence involving urgency and distress call events to be reported through Emergency Response Report flow.

On 15 November 2018, the Safety and Security Directorate issued Safety Instruction to Safety Corporate Director and Batam Aero Technic (BAT) Director to implement Directorate General of Civil Aviation Airworthiness Directive number 18-11-011-U.

Batam Aero Technic

On 08 November 2018, the Batam Aero Technic (BAT) issued Engineering Information to revise Aircraft Flight Manual (AFM) of Boeing 737-8 (MAX) in accordance with Directorate General of Civil Aviation Airworthiness Directive number 18-11-011-U.

On 11 November 2018, the BAT conducted Angle of Attack installation test to all Boeing 737-8 (MAX) aircraft operated by Lion Air.

Boeing Company

On 6 November 2018, issued Flight Crew Operation Manual Bulletin (OMB) Number TBC-19 with subjected Un-commanded Nose Down Stabilizer Trim Due to Erroneous Angle of Attack (AOA) During Manual Flight Only to emphasize the procedures provided in the runaway stabilizer non-normal checklist (NNC). The detail of the FCOM Bulletin is available on the appendices

MAX Boeing FCOM bulletin MAX Boeing FCOM bulletin 2

On 11 November 2018, informed all 737NG/MAX Costumers, Regional Directors, Regional Managers and Boeing Field Service Bases via Multi Operator Messages (MOM) with subject Information – Multi Model Stall Warning and Pitch Augmentation Operation. (From the blogger: Click here to access the Flight Crew Operation Manual Bulletin (OMB) Number TBC-19. )

Federal Aviation Administration

On 7 November 2018, the Federal Aviation Administration (FAA) issued Emergency Airworthiness Directive (AD) Number 2018-23-51 for the owners and operators of the Boeing 737-8 and -9 aircraft. (From the blogger: Click here to access the Emergency AD 2018-23-51 and its amendment)

FAA Emergency AD Lion Air

FAA Emergency AD Lion Air 2

Directorate General of Civil Aviation

On 8 November 2018, the DGCA issued Airworthiness Directive (AD) Number 18-11-011-U applicable for the Boeing 737-8 and -9 aircraft certificated in any category. (From the blogger: The detail of this AD is available on the appendix 5.14 in the original document).

On 15 November 2018, the DGCA issued Safety Circular Number SE.39 as guidance for aircraft operator and inspector to implement AD number 18-11-011-U.

SAFETY RECOMMENDATIONS

The KNKT acknowledges the safety actions taken by Lion Air and considered that the safety actions were relevant to improve safety, however there still safety issue remain to be considered. Therefore, the KNKT issued safety recommendations to address safety issues identified in this report.

Lion Air

04.O-2018-35.1

Refer to the CASR Part 91.7 Civil Aircraft Airworthiness and the Operation Manual part A subchapter 1.4.2, the pilot in command shall discontinue the flight when unairworthy mechanical, electrical, or structural conditions occur.

The flight from Denpasar to Jakarta experienced stick shaker activation during the takeoff rotation and remained active throughout the flight. This condition is considered as a un-airworthy condition and the flight shall not be continued.

KNKT recommend ensuring the implementation of the Operation Manual part A subchapter 1.4.2 in order to improve the safety culture and to enable the pilot to make proper decision to continue the flight.

04.O-2018-35.2

According to the weight and balance sheet, on board the aircraft were two pilots, five flight attendants and 181 passengers consisted of 178 adults, one child and two infants. The voyage report showed that the number of flights attendant on board was six flight attendants. This indicated that the weight and balance sheet did not contain actual information.

KNKT recommend ensuring all the operation documents are properly filled and documented.

EXCERPTED from KOMITE NASIONAL KESELAMATAN TRANSPORTASI – KNKT Lion Mentari Airlines. Boeing 737-8 (MAX); PK-LQP. PRELIMINARY Aircraft Accident Investigation Report. KNKT.18.10.35.04.

**********************

By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@SafelyWith. Human Factors information almost every day

_______________________

Fatigue led to taxiway overflight at SFO on July 7, 2017

Expectation bias, fatigue, breakdowns in CRM and poor document design identified as contributing factors. Human Factors at its best!

Air Canada A320 Robert

Photo (C) Robert Karam

Although today Sept 29, 2018, the full final report is not available yet, NTSB has provided lots of information contained in several documents. The following paragraphs were excerpted from some of these documents, they do not include the NTSB rationale for the conclusions, probable cause, and safety recommendations. Some of the attached information is subject to further review and editing. As soon as the complete final report is available, I’ll share the Human Factors pertinent information with you all.

INCIDENT SUMMARY

Past 7 July 2017 at San Francisco International Airport (SFO), about 2356 Pacific daylight time-PDT (At the time of the event Universal Time Coordinate (Zulu) was plus 7 hours), an Air Canada A320 lined up with parallel taxiway C instead of runway 28R where it was cleared to land on. On taxiway C a Boeing 787, an Airbus A340, another Boeing 787, and a Boeing 737 were awaiting clearance to take off from runway 28R. The incident flight crew initiated a go-around after descending to 100 ft above ground level and overflying the first airplane and reaching a minimum altitude of about 60 ft and overflying the second airplane on the taxiway before starting to climb.

There were no passengers nor crewmembers injured aboard the incident airplane or aboard the airplanes on taxiway C. There was no damage to any aircraft either.

FACTUAL INFORMATION (2)

History of Flight

“AC flight 759 was a scheduled flight from YYZ to SFO. The first officer reported that he obtained the dispatch release while at his residence, before leaving for the airport. Once at the airport, the first officer was notified by the flight’s dispatcher that there was a new version of the release out, after which he acquired the new release via his iPad and a hard copy from the airline’s printers in the briefing room. The crew met at the gate and noted that the inbound flight’s arrival delayed their departure. AC flight 759 had an originally scheduled departure time of 2055 eastern daylight time (EDT) (0055Z) and an original arrival time of 2303 PDT (0603Z); however, it departed 30 minutes late. The crew discussed the weather expected enroute and reviewed their dispatch paperwork, which included NOTAMs for SFO. Both crewmembers indicated that they were aware of the closure of runway 28L, which was NOTAMed to occur at 2300 PDT (0600Z).

According to the crew, the departure from YYZ was uneventful; however, they had to maneuver around weather on the departure. The flight climbed to FL3205 and was later given clearance from air traffic control to climb to FL360. The flight had been filed for FL320 with a step-climb to FL360. The captain was the pilot flying (PF) and the first officer was the pilot monitoring (PM). According to interviews with the flight crew, the cruise and descent were uneventful; however, about the midpoint, the flight had to navigate around an area of weather.

Prior to arrival into the SFO area, the first officer obtained the Automatic Terminal Information Service – ATIS information “Quebec” via the airplane’s Aircraft Communication Addressing and Reporting System – ACARS and printed out the information. Considering the weather information and the reported runway in use, the crew anticipated landing to the west and briefed for the FMS Bridge Visual Approach to runway 28R.

The captain conducted the approach briefing, which included briefing the Air Canada specific Jeppesen 19-3-1 page, FMS BRIDGE VISUAL RWY 28R9, minimum weather requirements, an anticipated taxi route to the gate after landing, and the missed approach procedures.

The crew was issued the DYMND 3 arrival and were cleared to descend via that arrival. Subsequently, the flight was instructed to and subsequently contacted, Northern California (NORCAL) approach.

Following their communication with NORCAL approach, the flight has issued a heading and was vectored off of the arrival and later vectored back toward the initial approach point for the FMS BRIDGE VISUAL RWY 28R approach. The flight was issued traffic that the crew was to follow. They were then queried if they had the airport in sight, to which they acknowledged that the field was in sight. The flight was then cleared for the BRIDGE VISUAL RWY 28R approach and the crew was instructed to contact the SFO Air Traffic Control Tower (ATCT).

The crew reported that the approach was flown, by the autopilot, until prior to the final waypoint on the approach, which was labelled as F101D, at which point the captain disconnected the autopilot and hand flew the remainder of the approach. The captain requested that the first officer verify that their runway was clear. ATC voice recordings included the following:

2355:45 ACA759 Just want to confirm this is Air Canada seven five nine we see some lights on the runway there across the runway. Can you confirm we’re cleared to land?

2355:52 ATCT Air Canada seven five nine confirmed cleared to land runway two eight right. There’s no one on runway two eight right but you. (This time was an estimate. There was no ATC transcript developed for this event; however, the beginning of the statement occurred approximately 7 seconds after the beginning of the previous statement.)

2355:59 United Airlines 1 Where’s this guy going

2356:02 United Airlines 1 He’s on the taxiway

2356:09 ATCT instructed ACA759 to go around

During post-incident interviews, the first officer reported that prior to his query to the ATCT if the runway was clear he was looking more inside the cockpit than out because, as the PM, he was required to set the missed approach altitude and the anticipated heading for a missed approach. These tasks required him to look inside at his approach chart to obtain that information. He further stated that when the captain asked him to query the control tower, he looked outside, and it “didn’t look right.” Although he was not certain what was incorrect, he was unable to process what he was seeing. He subsequently commanded the go around to the captain by saying “go around go around.” According to the captain, that was simultaneous to him beginning the go around. During the initiation of the go around, the ATCT controller also issued go around instructions.

During the downwind leg for the second approach, the first officer asked the captain if they should “tune in the ILS12” to which the captain agreed.

The remainder of the flight was uneventful.

Video NTSB (2)

Previous Arrival – Crew Statement

The flight preceding the incident flight landed on runway 28R about 4 minutes prior to the incident. The flight crew of the preceding flight reported that the “construction lights were so bright we could not determine the location of the inboard runway, 28L.” Visually acquiring the runway, both crewmembers reported questioning if they were lined up for runway 28R; however, after crosschecking with the Lateral Navigation – LNAV they were able to determine they were lined-up for runway 28R. They received additional confirmation about 300 feet above ground level (agl) when the captain visually acquired the painted “28R” on the paved surface of the runway. The captain of that flight further reported that the aircraft on taxiway C were stopped and had their taxi lights off, which “helped to create this misconception that taxiway C was RWY 28R.”

Taxiway C – Crew Statements

The airplanes waiting on Taxiway “C” for departure consisted of two Boeing 787 airplanes, one Airbus 340 airplane, and a Boeing 737 airplane. The crewmembers of those airplanes provided the NTSB with written statements.

Flight Crew Information

The Captain

According to Air Canada records, Transport Canada records, and interview statements, the following information pertained to the captain:

Age at the time of the incident: 56

Seniority Date of hire at Air Canada: February 15, 1988

Prior aviation employment: Canadian Airlines

The captain held a Canadian Airline Transport Pilot – Aeroplane License issued October 2, 2015. The license was endorsed with a blanket type rating for All Single Pilot Non-High Performance, Single and Multiengine Land Aeroplanes and was endorsed with type ratings on the AT42, B73A, BA31, E120, EA3216, SECOND OFFICER DC10. He also held Group 1 Instrument Rating under the Transport Canada regulations. He also held a Category 1 Medical Certificate dated December 20, 2016, which was valid until January 1, 2018, when operating under the provisions of his Airline Transport Pilot – Aeroplane License. The validity was reduced to July 1, 2017, if used during a single-pilot air transport service carrying passengers. The medical certificate had a limitation of “Glasses Must Be Worn.”

Prior to Air Canada, the captain was a pilot at Canadian Airlines where he was a second officer on the DC-10 and then a first officer on the B-737, until the merger with Air Canada in 2000. Prior to

The Captain’s Flight Times

The captain’s flight times, based on Air Canada Airlines employment records and pilot provided flight times:

Table 1 AC

Total flying time last 24 hours included the incident flight which was the only flight flown. Previous flight was completed on 06 July at 2253 EDT (0253Z)

Total flying time last 7 days does not include the incident flight or subsequent return flight. The time consisted of a roundtrip flight on 01 July and 02 July from YYZ to Calgary International Airport (CYYC) and a round-trip flight on 06 July from YYZ to KLGA.

The Captain’s 72-Hour History

On Wednesday, July 5, the captain stated he went to bed between 0030 and 0100 EDT and awoke between 0700 and 0800 EDT. This was his day off.

On Thursday, July 6, he went to bed about 0000 EDT and awoke about 0800. He reported on duty between 1600 and 1700 and flew a round-trip to LGA. He went off duty about 2313 EDT and cleared customs, took the train to the parking lot, walked to his vehicle, and drove home. He stated that this flight “threw off his sleep cycle a little bit” since they arrived so late.

On Friday, July 7, he fell asleep between 0200 and 0300 and awoke about 0745 EDT (445 PDT) by his children. About 1120, crew scheduling called to notify him that he had been assigned a flight. He did not take any naps that day and reported to the airport by 1940 for the flight. The incident flight departed at 2125 EDT (1825 PDT) and this was the incident flight (Incident about 2356 PDT). Prior to the incident flight, he considered himself rested. He started feeling fatigued about midpoint on the incident flight about the time they encountered the area of thunderstorm activity.

The First Officer

According to Air Canada records, Transport Canada records, and interview statements, the following information pertained to the first officer:

Age at the time of the incident: 42

Seniority Date of hire at Air Canada: December 3, 2007

Prior aviation employment: Air Georgian

The first officer held a Canadian Airline Transport Pilot – Aeroplane License issued November 30, 2015. The license was endorsed with a blanket type rating for All Single Pilot Non-High Performance, Single and Multiengine Land Aeroplanes and with type ratings on the BE02, E170, EA32. He held a Group 1 Instrument Rating, under the Transport Canada regulations. He held a Category 1 Medical Certificate dated May 12, 2017, which was valid until June 1, 2018, when operating under the provision of his Airline Transport Pilot – Aeroplane License. The validity was reduced to December 1, 2017, if used during a single-pilot air transport service carrying passengers.

Prior to Air Canada, the first officer was a pilot at Air Georgian where he flew a Cessna Caravan airplane, then the Piper Cheyenne II, and then the Beech 1900D. While at Air Georgian he was also a training captain.

The first officer reported that he had never had any accidents or incidents during his flying career.

The first officer reported that he had attempted previously to upgrade to captain. After two unsatisfactory attempts, however, he elected to return to the first officer seat. Air Canada records showed that on February 6 and 7, 2017, the first officer had passed his command LOE training. On March 1, 2017, he had an unsatisfactory on his Qualifying Oriented Evaluation QOE and a second unsatisfactory QOE on March 16, 2017.

According to the simulator instructors and checkairmen that conducted the incident first officer’s upgrade attempt, the reason for the unsatisfactory upgrade was the first officer’s lack of situational awareness, failure to correctly identify a mandatory altitude on an arrival, non-precision approaches, and a lack of performance to the Transport Canada required performance standards. Some of the instructors and checkairmen categorized the incident first officer as “nervous” and “a weak candidate.”

According to Air Canada’s Flight Operation Director of Safety and Training, the incident first officer’s requalification to the right seat was to complete anything that had been missed within the normal training footprint. For the incident first officer that required Manoeuvres Training and Validation (MTV) and Line Operational Evaluation (LOE) and an additional OE. The OE was the only one of the required items to be conducted in the aircraft and the rest of the items were to be completed in the simulator. The Flight Operation Director of Safety and Training had no concern about the first officer’s training plan as “the weak items were going to be covered.”

The First Officer’s Flight Times

The incident first officer’s flight times, based on Air Canada Airlines employment records and pilot provided flight times:

Table 2 AC

Flying time previous 7 days does not include the incident flight or subsequent return flight. The time consisted of a roundtrip flight on 06 July from YYZ to SFO and a round-trip flight, a 1 leg flight on 2 July from Halifax Stanfield International Airport (YHZ) to YYZ, and a 3 leg flight day on 01 July which consisted of a round trip leg from YYZ to YHZ and a subsequent leg from YYZ to YHZ.

The First Officer’s 72-Hour History

Monday, July 3 and Tuesday, July 4 were his days off. He stated that he got a “proper” night’s sleep on Tuesday evening.

On Wednesday, July 5, he awoke about 0800 and took a nap in the afternoon for 90 minutes. He spent time with his children for about an hour and then got ready for work. He flew a flight to SFO that night.

On Thursday, July 6, he arrived in SFO, went to sleep about 0400 EDT and woke up about 1000 EDT. He got breakfast with his captain for that flight and went for a walk. He took a one-hour nap and flew back to Toronto that night.

On Friday, July 7, the flight to Toronto arrived about 0030 and he went to bed about 0300. He awoke about 0900. The rest of the day, he “took it easy.” His wife and kids were out so he was able to sleep in. He had lunch around noon and took a 90-minute nap about 1300. He woke up from the nap, spent time with his kids, had dinner and went back to work arriving at 1910 for a 1940 report time. He departed on the incident flight to SFO that evening. He stated that both he and the captain began to feel tired about 0200-0300 EDT on Saturday, July 8.

Air_Canada_Airbus_A320-211_C-FKCK_220_(7731084802)

Photo Lord of the Wings© from Toronto, Canada

NOTAMs Provided to Crew

Prior to departure from YYZ the crew was provided a flight plan, or “briefing package” both electronically, via their company-issued iPads, and via printout, which the incident first officer printed in the company provided briefing area, prior to going to the departure gate. During the crew interviews, the incident first officer stated that, prior to leaving his residence he had downloaded their flight plan onto his company issued iPad, in order to review the route of flight. Arriving at YYZ, dispatch contacted him via his cellular phone and informed him that there had been a second release generated, which he recalled was due to an “increase in the zero-fuel weight.” The following NOTAMs, applicable to SFO, were provided on pages 7 through 10 of 27 pages, under the bookmark tab “AIRPORT NOTAMs,” to the flight crew via the “Air Canada Flight Plan Release 2”.

SFO Runway and Taxiway Lighting

According to photographs taken of taxiway “C” (3), there were no taxiway edge lights and the taxiway was equipped with centerline lights

SOME ANALYSIS (4)

“The incident flight was operated by Air Canada under Title 14 Code of Federal Regulations (CFR) Part 129 as an international scheduled passenger flight from Toronto/Lester B. Pearson International Airport, Toronto, Canada. An instrument flight rules flight plan had been filed. Night visual meteorological conditions prevailed at the time of the incident.

The flight crewmembers had recent experience flying into SFO at night and were likely expecting SFO to be in its usual configuration; however, on the night of the incident, SFO parallel runway 28L was scheduled to be closed at 2300. The flight crew had opportunities before beginning the approach to learn about the runway 28L closure. The first opportunity occurred before the flight when the crewmembers received the flight release, which included a notice to airmen (NOTAM) about the runway 28L closure. However, the first officer stated that he could not recall reviewing the specific NOTAM that addressed the runway closure. The captain stated that he saw the runway closure information, but his actions (as the pilot flying) in aligning the airplane with taxiway C instead of runway 28R demonstrated that he did not recall that information when it was needed. The second opportunity occurred in flight when the crewmembers reviewed automatic terminal information system (ATIS) information Quebec (via the airplane’s aircraft communication addressing and reporting system [ACARS]), which also included NOTAM information about the runway 28L closure. Both crewmembers recalled reviewing ATIS information Quebec but could not recall reviewing the specific NOTAM that described the runway closure.

The procedures for the approach to runway 28R required the first officer (as the pilot monitoring) to manually tune the instrument landing system (ILS) frequency for runway 28R, which would provide backup lateral guidance (via the localizer) during the approach to supplement the visual approach procedures. However, when the first officer set up the approach, he missed the step to manually tune the ILS frequency. The captain was required to review and verify all programming by the first officer but did not notice that the ILS frequency had not been entered.

The captain stated that, as the airplane approached the airport, he thought that he saw runway lights for runway 28L and thus believed that runway 28R was runway 28L and that taxiway C was runway 28R. At that time, the first officer was focusing inside the cockpit because he was programming the missed approach altitude and heading (in case a missed approach was necessary) and was setting (per the captain’s instruction) the runway heading, which reduced his opportunity to effectively monitor the approach. The captain asked the first officer to contact the controller to confirm that the runway was clear, at which time the first officer looked up. By that point, the airplane was lined up with taxiway C, but the first officer presumed that the airplane was aligned with runway 28R due, in part, to his expectation that the captain would align the airplane with the intended landing runway.

The controller confirmed that runway 28R was clear, but the flight crewmembers were unable to reconcile their confusion about the perceived lights on the runway (which were lights from airplanes on taxiway C) with the controller’s assurance that the runway was clear. Neither flight crewmember recognized that the airplane was not aligned with the intended landing runway until the airplane was over the airport surface, at which time the flight crew initiated a low-altitude go-around. According to the captain, the first officer called for a go-around at the same time as the captain initiated the maneuver, thereby preventing a collision between the incident airplane and one or more airplanes on the taxiway. However, at that point, safety margins were severely reduced given the incident airplane’s proximity to the ground before the airplane began climbing and the minimal distance between the incident airplane and the airplanes on taxiway C.

The flight crewmembers stated, during post-incident interviews, that the taxiway C surface resembled a runway. Although multiple cues were available to the flight crew to distinguish runway 28R from taxiway C (such as the green centerline lights and flashing yellow guard lights on the taxiway), sufficient cues also existed to confirm the crew’s expectation that the airplane was aligned with the intended landing runway (such as the general outline of airplane lights—in a straight line—on taxiway C and the presence of runway and approach lights on runway 28R, which would also have been present on runway 28L when open). As a result, once the airplane was aligned with what the flight crewmembers thought was the correct landing surface, they were likely not strongly considering contradictory information. The cues available to the flight crew to indicate that the airplane was aligned with a taxiway did not overcome the crew’s belief, as a result of expectation bias, that the taxiway was the intended landing runway.

The flight crewmembers reported that they started to feel tired just after they navigated through an area of thunderstorms, which radar data indicated was about 2145 (0045 eastern daylight time [EDT]). The incident occurred about 2356, which was 0256 EDT according to the flight crew’s normal body clock time; thus, part of the incident flight occurred during a time when the flight crew would normally have been asleep (according to post-incident interviews) and at a time that approximates the start of the human circadian low period described in Air Canada’s fatigue information (in this case, 0300 to 0500 EDT). In addition, at the time of the incident, the captain had been awake for more than 19 hours, and the first officer had been awake for more than hours. Thus, the captain and the first officer were fatigued during the incident flight.

Cockpit voice recorder (CVR) information was not available for this incident because the data were overwritten before senior Air Canada officials became aware of the severity of this incident. Although the National Transportation Safety Board (NTSB) identified significant safety issues during our investigation into this incident, CVR information, if it had been available, could have provided direct evidence about the events leading to the overflight and the go-around. For example, several crew actions/inactions during the incident flight demonstrated breakdowns in crew resource management (CRM), including both pilots’ failure to assimilate the runway 28L closure information included in the ATIS information, the first officer’s failure to manually tune the ILS frequency, and the captain’s failure to verify the tuning of the ILS frequency. However, without CVR information, the NTSB could not determine whether distraction, workload, and/or other factors contributed to these failures.

The NTSB identified the following safety issues as a result of this accident investigation:

Need for consistent flight management system (FMS) autotuning capability within an air carrier’s fleet. The FMS Bridge visual approach to runway 28R was the only approach in Air Canada’s Airbus A320 database that required manual tuning for a navigational aid, so the manual tuning of the ILS frequency was not a usual procedure for the flight crew. Identifying other approaches that require an unusual or abnormal manual frequency input and developing an autotune solution would help preclude such a situation from recurring. Further, the instruction on the approach chart to manually tune the ILS frequency was not conspicuous during the crew’s review of the chart. An action to mitigate this situation for other approaches would be to ensure sufficient salience of the manual tune entry on approach charts.

Need for a more effective presentation of flight operations information to optimize pilot review and retention of relevant information. The way information is presented can significantly affect how information is reviewed and retained because a pilot could miss more relevant information when it is presented with information that is less relevant. Although the NOTAM about the runway 28L closure appeared in the flight release and the ACARS message that was provided to the flight crew, the presentation of that information did not effectively convey the importance of the runway closure information and promote flight crew review and retention. Multiple events in the National Aeronautics and Space Administration’s aviation safety reporting system database showed that this issue has affected other pilots, indicating that all pilots could benefit from the improved display of flight operations information.

Need for airplanes landing at primary airports within class B and class C airspace to be equipped with a system that alerts pilots when an airplane is not aligned with a runway surface. A cockpit system that provides an alert if the system predicts a landing on a surface other than a runway would provide pilots with additional positional awareness information. Although the Federal Aviation Administration (FAA) has not mandated the installation of such a system, the results of a simulation showed that such technology, if it had been installed on the incident airplane, could have helped the flight crew identify its surface misalignment error earlier in the landing sequence, which could have resulted in the go-around being performed at a safer altitude (before the airplane was dangerously close to other airplanes). Flight safety would be enhanced if airplanes landing at primary airports within class B and class C airspace were equipped with such a cockpit system and/or a cockpit system that alerts when an airplane is not aligned with the specific runway for which it has been cleared.
Need for modifications to airport surface detection equipment (ASDE) systems (ASDE-3, ASDE-X, and airport surface surveillance capability [ASSC]) to detect potential taxiway landings and provide alerts to air traffic controllers. The SFO air traffic control tower was equipped with an ASSC system, which was not designed to predict an imminent collision involving an arriving airplane lined up with a taxiway; thus, the ASSC system did not produce an alarm as the incident airplane approached taxiway C. If an airplane were to align with a taxiway, an automated ASDE alert could assist controllers in identifying and preventing a potential taxiway landing as well as a potential collision with aircraft, vehicles, or objects that are positioned along taxiways. An FAA demonstration in February 2018 showed the potential effectiveness of such a system (On March 2, 2011, the NTSB recommended that the FAA “perform a technical review of Airport Surface Detection Equipment—Model X to determine if the capability exists systemwide to detect improper operations such as landings on taxiways” (A-11-12). The NTSB also recommended that the FAA, “at those installation sites where the technical review recommended in Safety Recommendation A-11-12 determines it is feasible, implement modifications to Airport Surface Detection Equipment—Model X to detect improper operations, such as landings on taxiways, and provide alerts to air traffic controllers that these potential collision risks exist” (A-11-13). The NTSB classified these recommendations “Closed-Unacceptable Action” on September 14, 2011).

Need for a method to more effectively signal a runway closure to pilots when at least one parallel runway remains in use. A runway closure marker with a lighted flashing white “X” appeared at the approach and departure ends of runway 28L when it was closed. The runway closure marker was not designed to capture the attention of a flight crew on approach to a different runway, and the marker did not capture the attention of the incident flight crew as the airplane approached the airport while aligned with taxiway C. Increased conspicuity of runway closure markers, especially those used in parallel runway configurations, could help prevent runway misidentification by flight crews while on approach to an airport.
Need for revisions to Canadian regulations to address the potential for fatigue for pilots on reserve duty who are called to operate evening flights that would extend into the pilots’ window of circadian low. The flight crew’s work schedule for the incident flight complied with the applicable Canadian flight time limitations and rest requirements; however, the flight and duty time and rest requirements for the captain (a company reserve pilot) would not have complied with US flight time limitations and rest requirements (14 CFR Part 117). Transport Canada indicated that its current flight and duty time regulations have been in effect since 1996. Transport Canada also indicated that it released a draft of proposed new flight and duty time regulations in 2014 and issued revised draft regulations in 2017. According to Transport Canada, the proposed regulations would better address the challenge of fatigue mitigation for pilots on reserve duty who are called to operate evening flights extending into their window of circadian low. However, Transport Canada has not yet finalized its rulemaking in this area. (Title 14 CFR Part 117, “Flight and Duty Limitations and Rest Requirements: Flightcrew Members.” Described the window of circadian low as 0200 through 0559 (body clock time zone).

Findings

None of the following was a factor in this incident: (1) flight crew qualifications, which were in accordance with Canadian and US regulations; (2) flight crew medical conditions; (3) airplane mechanical conditions; and (4) airport lighting, which met US regulations.
The first officer did not comply with Air Canada’s procedures to tune the instrument landing system (ILS) frequency for the visual approach, and the captain did not comply with company procedures to verify the ILS frequency and identifier for the approach, so the crewmembers could not take advantage of the ILS’ lateral guidance capability to help ensure proper surface alignment.
The flight crew’s failure to manually tune the instrument landing system (ILS) frequency for the approach occurred because (1) the Flight Management System Bridge visual approach was the only approach in Air Canada’s Airbus A320 database that required manual tuning of a navigation frequency, so the manual tuning of the ILS frequency was not a usual procedure for the crew, and (2) the instruction on the approach chart to manually tune the ILS frequency was not conspicuous during the crew’s review of the chart.
The first officer’s focus on tasks inside the cockpit after the airplane passed the final waypoint reduced his opportunity to effectively monitor the approach and recognize that the airplane was not aligned with the intended landing runway.
The flight crew-initiated, low-altitude go-around over the taxiway prevented a collision between the Air Canada airplane and one or more airplanes on the taxiway.
The controller responded appropriately once he became aware of the potential conflict.
Errors that the flight crewmembers made, including their false assumption that runway 28L was open, inadequate preparations for the approach, and delayed recognition that the airplane was not lined up with runway 28R, reflected breakdowns in crew resource management and led to minimal safety margins as the airplane overflew taxiway C.
The flight crewmembers’ lack of awareness about the runway 28L closure and the crewmembers’ previous experience seeing two parallel runways at San Francisco International Airport led to their expectation to identify two runway surfaces during the approach and resulted in their incorrect identification of taxiway C instead of runway 28R as the intended landing runway.
Although the notice to airmen about the runway 28L closure appeared in the flight release and the aircraft communication addressing and reporting system message that were provided to the flight crew, the presentation of the information did not effectively convey the importance of the runway closure information and promote flight crew review and retention.
The cues available to the flight crewmembers to indicate that the airplane was aligned with a taxiway were not sufficient to overcome their belief, as a result of expectation bias, that the taxiway was the intended landing runway.
Multiple salient cues of the surface misalignment were present as the airplane approached the airport seawall, and one or more of these cues likely triggered the captain’s initiation of a go-around, which reportedly occurred simultaneously with the first officer’s call for a go-around.
The captain and the first officer were fatigued during the incident flight due to the number of hours that they had been continuously awake and circadian disruption, which likely contributed to the crewmembers’ misidentification of the intended landing surface, their ongoing expectation bias, and their delayed decision to go around.
Current Canadian regulations do not, in some circumstances, allow for sufficient rest for reserve pilots, which can result in these pilots flying in a fatigued state during their window of circadian low.
Flight safety would be enhanced if airplanes landing at primary airports within class B and class C airspace were equipped with a cockpit system that provided flight crews with positional awareness information that is independent of, and dissimilar from, the current instrument landing system backup capability for navigating to a runway.
Although the investigation into this incident identified significant safety issues, cockpit voice recorder information, had it been available, could have provided direct evidence regarding the flight crew’s approach preparation, cockpit coordination, the perception of the airport environment, and decision-making.
Once the flight crewmembers perceived lights on the runway, they decided to contact the controller to ask about the lights; however, their query was delayed because of congestion on the tower frequency, which reduced the time available for the crewmembers to reconcile their confusion about the lights with the controller’s confirmation that the runway was clear.
Although the use of Line Up and Wait (LUAW) procedures during single-person air traffic control operations was not a factor in this incident, the tower controllers should have delayed consolidating local and non-local control positions until LUAW procedures were no longer needed.
If an airplane were to align with a taxiway, an automated airport surface detection equipment alert would assist controllers in identifying and preventing a potential taxiway landing as well as a potential collision with aircraft, vehicles, or objects that are positioned along taxiways.
Increased conspicuity of runway closure markers, especially those used in parallel runway configurations, could help prevent runway misidentification by flight crews while on approach to an airport.

Probable Cause

The NTSB determines that the probable cause of this incident was the flight crew’s misidentification of taxiway C as the intended landing runway, which resulted from the crewmembers’ lack of awareness of the parallel runway closure due to their ineffective review of NOTAM information before the flight and during the approach briefing. Contributing to the incident were (1) the flight crew’s failure to tune the ILS frequency for backup lateral guidance, expectation bias, fatigue due to circadian disruption and length of continued wakefulness, and breakdowns in CRM and (2) Air Canada’s ineffective presentation of approach procedure and NOTAM information. ”

As a result of this investigation, the NTSB makes safety recommendations to the FAA and Transport Canada (Note from the blogger: To read the seven recommendations please refer to the final report abstract)

EXCERPTED FROM

(1) NATIONAL TRANSPORTATION SAFETY BOARD Group Chairmen’s Factual Report
OPERATIONAL FACTORS/HUMAN PERFORMANCE. DCA17IA148. January 3, 2018

(2) NTSB Docket Management System. DCA17IA148. Jul 07, 2017.San Francisco, CA, United States

(3) NATIONAL TRANSPORTATION SAFETY BOARD Airports Specialist Report AIRPORTS.
DCA17IA148. May 1, 2018

(4) NATIONAL TRANSPORTATION SAFETY BOARD. Public Meeting of September 25, 2018. Taxiway Overflight, Air Canada Flight 759, Airbus A320-211, C-FKCK, San Francisco, California, July 7, 2017. NTSB/AIR-18/01

FURTHER READING

**********************

Science has demonstrated that after 17 hours of continuous wakefulness, cognitive psychomotor performance decreased to a level equivalent to a blood alcohol concentration of 0.05%.

Fatigue, fatigue, fatigue… The neverending story

**********************

_______________________

Otitic and sinus barotrauma by flight. Let’s review

Past September 20th, 2018, a Jet Airways B738 presented an event related to sudden changes in cabin pressure. The Civil Aviation Authority reported 30 passengers suffering nosebleeds and/or ear bleeds.

As usual, news and media are full of speculations and inexact, and in some cases totally erroneous, statements. The investigation has just begun, therefore there is no factual information available yet. However, there are some, long time well known flight physiology issues involved in the event. Let’s review!

MG_0915WEB-1600x700

Back to basics

Gas is present in several cavities in the human body in varying amounts. This gas contained in the middle ear, sinuses, gastrointestinal and respiratory tracks and even untreated decayed teeth, is under the rule of the laws that govern all gases, being the Boyle’s Law the one that is of interest here. Boyle’s Law states: “A volume of a gas is inversely proportional to the pressure to which it is subjected, temperature remaining constant.” Meaning that if you reduce the pressure, as in ascending to altitude, gases increase in volume and as pressure increases during descent the volume reduces. We all know that.

In order to equilibrate and maintain equal pressure on the inside and outside the named cavities containing gas in the human body, there must be a ready interchange of air between these cavities and the environment. If the opening through this interchange is made is reduced in size or closed, then the gas can not enter and/or escape and the pressure cannot be equalized. The result of having changes in gas volume within these cavities without equalization will usually be pain and other symptoms which severity would depend on the grade of barotrauma. We all know that, too

The most common type of barotrauma is the barotitis (aerotitis media, otitic barotrauma) an acute or chronic pathological condition caused by the pressure difference between the ambient air and that of the middle ear. It is the most common otitic disorder among flying personnel today.

How does barotitis present?

The rapid changes in atmospheric pressure during flight demand a rapid and easy interchange of air between the middle ear and the environment, in order to maintain equal pressure on the inside and outside of the tympanic membrane.

This equilibrium is maintained through the Eustachian tube, under normal conditions. The pharyngeal end of the tube is slit-like in shape and acts as a one-way flutter valve. The lumen is closed except during the acts of swallowing, yawning, chewing, etc.

During the ascent, the air in the middle ear expands. The Eustachian tube is forced open by excess pressure in the tympanic cavity, middle ear pressure equalizes and the tympanic membrane snaps or “clicks” into its normal position.

When the atmospheric pressure increases during the descent from altitude the pharyngeal end of the Eustachian tube that remains collapsed prevents the air to enter. Therefore, one must remember to swallow or yawn while descending. While swallowing, the tubal end opens permitting air to enter and pass into the middle ear, equalizing pressure.

middle_ear_pressure

When the pressure in the middle ear cannot be equalized with the external pressure for some time during descent, a negative pressure builds up in the middle ear. This is caused partly by the resorption of the gasses from the middle ear space through the mucosa to the bloodstream, but active pressure balancing processes are involved too.

This negative pressure causes the eardrum to retract into the middle ear box, causing initially the well-known sensation of fullness. As the descent continues and the differential negative pressure between the middle ear and the environment increases, the eardrum retraction becomes more severe and there is a rapid onset of deafness, tinnitus and pain in the ear. In exceptional cases, severe vertigo may occur due to inner ear barotrauma (alternobaric vertigo). A rupture of the fenestral membrane at the round or oval window may take place. If the differential pressure reaches 200–500 mm Hg, the tympanic membrane might rupture.

It should be noted that aerotitis media occurs at low altitudes and is not prevented by cabin pressurization. In 85 per cent or more of the cases, failure to equalize the pressure (and the injury that follows) is all secondary to disease of the upper respiratory tract. However, sudden or rapid changes in pressure from low to high could also produce the condition.

The otoscopic findings of the aerotitis media can be classified into 5 or 6 levels according to Teed. (Table 1)

In the 5-level classification grade, 2 and 3 have merged.

An exact description of the findings is of importance when determining the prognosis. Also, other findings should be taken into account (pain, hearing loss, vertigo). Signs and symptoms of aerotitis media are not compatible with active flying. An applicant may be assessed as fit following an acute process once it has completely subsided and the examination reveals no signs of the disease.

The treatment of barotitis goes far beyond the scope of this article. Just let’s say, though many cases of serious barotitis recover spontaneously or after inflation of the Eustachian tube, some shows progression and complications.

Sinus barotrauma

The paranasal sinuses are four, paired, filled with air, open cavities, surrounding the nasal cavity (Fig 1). This air expands during ascent as atmospheric pressure decreases and contracts as pressure increases during descent. The gas enters and escapes equalizing the pressure through the tubal ostia into the nasal cavity.

The paranasal sinuses may behave as semi-closed cavities (as the middle ear) if their ostia are narrowed by a swelling of their mucosa. If the free exchange of air between sinuses and the nose through the ostia and canals is impeded, a sinus barotrauma will develop due to the same mechanisms as in the middle ear. Like aerotitis, aerosinusitis is caused by pressure differences between the sinus and the ambient air, leading to the creation of negative pressure inside the sinus. This negative pressure causes retraction of the sinus mucosae which, as differential pressure increases, could be retracted, torn and detached from the sinus wall, causing severe pain and haemorrhage within the affected cavity.

As aerotitis, aerosinusitis develops during the descent from higher altitudes. However, in some less frequent cases, sinus barotrauma can develop during the ascent. In those cases, the complete or almost complete obstruction of the tubal ostia prevents the air to escape from the sinus as it expands during the ascent. The trapped gas produces a high-pressure condition inside the sinus.

The sinus barotrauma can affect any of the sinuses, sometimes compromising more than one. Causes headache and at times severe pain over the sinus involved.

Relief can be obtained, usually in minutes, by using a mild nasal vasoconstrictor which will decrease nasal and tuba ostia swelling and edema. Again, the full treatment of barosinusitis goes far beyond the scope of this article.

It should be required that a pilot not suffers from recurrent barotrauma of his/her sinuses or middle ears due to a nasal dysfunction. Barotrauma is very painful and might considerably distract the pilot’s attention from his duties during the critical phase of aircraft descent, approach and landing.

FROM

ICAO Manual of Civil Aviation Medicine. Doc 8984AN/895
JAA Manual of Civil Aviation Medicine
FAA AVIATION PHYSIOLOGY basic information manual

**********************

During descent… From low pressure to high… So, forgetting to turn on the pressurization is NOT the cause of the ear/nose bleeding in Jet Airways passengers

**********************

_______________________

Visual Illusion leading to risk of collision in Saint Maarten. Final report

Released 4 June 2018. Lack of contrast, poor visual references, attention alternation, high visual workload, narrowed visual attention, perceptual limitations, complex flight-path monitoring tasks, expectation bias, anticipation… Physiological and cognitive Human Factors at its best.

Some training and outdated regulations issues found as contributory factors.

Transportation Safety Board of Canada Aviation Investigation Report A17f0052. Risk of collision with terrain. West Jet Boeing 737-800, C-GWSV Princess Juliana International Airport, Saint Maarten 07 March 2017

Factual information

History of the flight

On 07 March 2017, a West Jet Boeing 737-800 aircraft (registration C-GWSV, serial number 37158), operating as flight 2652 (WJA2652), was conducting a scheduled instrument flight rules (IFR) flight from Toronto/Lester B. Pearson International Airport (CYYZ), Ontario, to Princess Juliana International Airport (TNCM) in Saint Maarten, an autonomous country within the Kingdom of the Netherlands. There were 158 passengers, 2 flight crew members, and 4 cabin crew members on board.

Before departure, West Jet dispatch issued a flight release package to the crew containing all of the information pertinent to the flight, including current and forecasted weather and winds-aloft data, notices to airmen (NOTAMs), and airport and runway analysis data. The forecasted conditions for TNCM indicated wind from 070° true (T) at 16 knots, visibility greater than 6 statute miles-sm (One statute mile is equivalent to 5280 feet) in light rain showers, few clouds at 1800 feet, scattered cloud at 2200 feet, and another scattered cloud layer at 3000 feet.

The aircraft departed from CYYZ at 1137 (All times are Atlantic Standard Time (Coordinated Universal Time minus 4 hours), which is the local time in Saint Maarten). The planned duration of the flight was 4 hours and 24 minutes at flight level (FL) 350. The captain occupied the left seat and was the pilot monitoring (PM), while the first officer occupied the right seat and was the pilot flying (PF).

While approaching their destination, the flight crew listened to the automatic terminal information system (ATIS) information Mike, which was issued at 1501 and reported winds from 060º magnetic (M) at 18 knots, unlimited visibility, few clouds at 1400 feet, and no weather conditions of significance in the vicinity of TNCM. In addition to preparing for a visual approach to Runway 10, the flight crew loaded the RNAV (GNSS) approach to Runway 10 (Appendix A) in the flight management system (FMS) and conducted the briefing as a precaution in the event of a change in weather conditions.

At 1518:14, the TNCM air traffic controller (controller) instructed the flight crew to report when they were over the SLUGO waypoint (Figure 1) and to expect descent instructions at that time, and advised them that the current ATIS information was Mike and the altimeter was 30.09 inches of mercury.

At 1523:12, the crew was instructed to descend to 4000 feet, and, at 1523:12, they reported that they were over the SLUGO waypoint.

At 1524:36, the controller informed the flight crew of another aircraft that was on approach to TNCM, ahead of WJA2652, that rain showers were approaching the airport.

At 1524:48, the flight crew of WJA2652 was instructed to fly direct to the AVAKI initial approach waypoint (Figure 1) once they had descended through 8000 feet above sea level (ASL). One minute later, when the aircraft was approximately 25 nautical miles (nm) northwest of TNCM and descending through 9800 feet, the controller advised the flight crew that there were moderate to heavy rain showers at the airport. The crew did not acknowledge this information.

At 1526, ATIS information November was issued, indicating that visibility was 2000 m. The crew did not receive this updated visibility information, but they observed clouds and rain showers around the airport and decided to switch from the visual approach to the RNAV (GNSS) Rwy 10 approach. A minimum visibility of 3600 m (1.94 nm) is required for WJA2652’s aircraft category to conduct the RNAV (GNSS) approach.

At 1527:02, the controller instructed the flight crew a second time to fly direct to the AVAKI initial approach waypoint. One minute later, when the aircraft was 15 nm northwest of the airport and descending through 6700 feet, the controller directed them to descend to 2600 feet.

At 1528:56, when the aircraft was 13 nm west of the airport and descending through 4900 feet, the flight crew was cleared to fly the RNAV approach to Runway 10. Approximately 1 minute later, the controller informed the crew a second time that there were moderate to heavy rain showers at the airport. The flight crew acknowledged the information when they were 12 nm west of the airport and descending through 3700 feet.

At 1530:32, the flight crew of an aircraft that had just landed at the airport reported that there had been steady winds and reduced visibility during the approach, but that they had visually acquired the runway while over the MAPON missed approach point (MAP)(Figure 1). The WJA2652 flight crew acknowledged the information when they were 10 nm from the airport, on final approach and descending through 2100 feet.

At an undetermined point during the approach, because of the moderate to heavy rain showers, the controller illuminated the runway lights using an automatic setting for night operations, that sets the runway lights at 3% intensity and the precision approach path indicator (PAPI) lights at 10% intensity. The controller did not tell the crew about the change in lighting intensity and was not required by regulation to do so.

At 1532, when the aircraft was 4.5 nm from the runway and descending through 1600 feet, the flight crew were cleared to land and informed that the winds were from 060°M at 17 knots. The aircraft’s rate of descent varied between 700 and 800 feet per minute (fpm), and the aircraft was established on a 3° angle of descent. About 0.5 nm before crossing MAPON, the flight crew noticed a rain shower ahead and to their left; however, given that they had the shoreline in sight and expected to see the runway shortly afterwards, they decided to continue their approach visually. The PF disconnected the autopilot and reduced the pitch from 0.5° nose up to 1.2° nose down. Three seconds later, the engine thrust decreased from 62% to 52% N1. Shortly afterwards, the rate of descent increased to 1150 fpm, and the aircraft began to deviate below the 3° descent angle of the standard approach path. Approximately 2 seconds after the aircraft’s descent rate was increased, the crew cycled the flight directors, in accordance with WestJet’s approach procedures for landing at TNCM. The autothrottle changed from speed mode to ARM mode14 when the flight directors were cycled, and thereafter did not provide automatic thrust control.

At 1533:30, the aircraft crossed MAPON at approximately 700 feet above ground level (AGL). The PF indicated that he had the runway in sight and began to roll the aircraft to the left, deviating to a point approximately 250 feet left of the inbound final approach course. The flight crew saw neither the runway lights nor the PAPI lights during the approach, and did not request that the intensity of the lights be increased. After crossing MAPON, the aircraft entered the rain shower, which had moved toward the final approach path, reducing the visibility significantly. Eleven seconds later, when the aircraft was 1.5 nm from the runway on final approach and descending through 500 feet, the flight crew were advised that the wind was 060°M at 14 knots, gusting to 25 knots Approximately 1 nm from the runway, the aircraft exited the shower; the visibility sharply improved, and the crew realized that they had been tracking toward an incorrect visual reference, which was a hotel situated to the left of the runway. At this point, the aircraft was 190 feet AGL, descending at 940 fpm, rather than 320 feet AGL on a standard 3º angle of descent. Now able to see the actual runway, the crew recognized that the aircraft had deviated laterally to the left of the inbound final approach course, but they were not immediately able to assess their height above water. The PF advanced the throttles from 52% to 75% N1 and began to correct the lateral deviation, but the aircraft continued to descend at about 860 fpm.

At 1534:03, when the aircraft was 63 feet above the water, the aircraft’s enhanced ground proximity warning system (EGPWS) issued an aural alert of “TOO LOW, TERRAIN” and the PF increased the pitch to 4° nose up. The aircraft continued to descend, and a second aural alert of “TOO LOW, TERRAIN” sounded as it passed from 54 feet to 49 feet AGL (Figure 2).

Fig 2

At 1534:12, when the aircraft was 40 feet above the water and 0.3 nm from the runway threshold, the crew initiated a go-around. The lowest altitude recorded by the EGPWS during the descent had been 39 feet AGL.

After the go-around, the controller instructed the crew to conduct a holding pattern. Because the visibility was below the level required to conduct an approach (3600 m), the controller then closed Runway 10 for departures and instructed several other aircraft on approach to conduct holding patterns.

About 45 minutes later, the visibility at TNCM increased and WJA2652 was cleared for the RNAV (GNSS) Rwy 10 approach. The aircraft landed safely at 1618:19.

Injuries to persons

There were no reported injuries.

Damage to aircraft

There was no damage to the aircraft.

Other damage

There was no damage to property or objects.

Personnel information

Aids to navigation

Navigational aids at TNCM include a non-directional beacon and a VOR (VHF omnidirectional range) with associated distance measuring equipment. Runway 10 is served by an RNAV (GNSS) approach and a VOR approach.

The aircraft was equipped with the appropriate navigational aids to conduct an RNAV (GNSS) approach, and there were no reported outages involving these aids at the time of the aircraft’s approach to TNCM.

Aerodrome information

1. General

TNCM has 1 asphalt runway (Runway 10/28), which is 7546 feet in length and 148 feet wide. Runway 10 is oriented 096°M; its threshold is displaced by 98 feet and its touchdown zone elevation is 12 feet ASL.

Runway 10/28 is equipped with a medium-intensity runway lighting system, which includes green threshold lights, red runway end lights, and white runway edge lights.

Runway 10 is not serviced by approach lights, but is equipped with a PAPI. At TNCM, the PAPI indicates a 3° angle of descent, and its lights are situated on both sides of the runway.

2. Aerodrome lighting intensity

In its Procedures for Air Navigation Services—Air Traffic Management (PANS-ATM), the International Civil Aviation Organization (ICAO) specifies the following regarding aerodrome lighting:

At aerodromes equipped with lights of variable intensity a table of intensity settings, based on conditions of visibility and ambient light, should be provided for the guidance of air traffic controllers in effecting adjustment of these lights to suit the prevailing conditions. When so requested by an aircraft, further adjustment of intensity shall be made whenever possible.

However, the Princess Juliana International Airport Air Traffic Services (ATS) Standard Operating Procedures Manual does not provide guidance to TNCM controllers on adjusting the intensity of the runway lights or PAPI lights. The operation of the lighting system at TNCM, including light intensity control, is at the controller’s discretion. By comparison, air traffic controllers in Canada are provided with direction regarding aerodrome lighting operation and when to employ specific intensity settings based on reported visibility.

Flight recorders

The aircraft is equipped with a digital flight data recorder (DFDR) and a cockpit voice recorder (CVR). Because the occurrence was originally assessed by WestJet as a non-reportable event, it was not reported directly to the TSB. The CVR and the DFDR data were overwritten and were not available to the investigation.

The quick access recorder (QAR) data file was sent to the TSB laboratory for analysis. QAR data is recorded by the aircraft’s digital flight data acquisition and management unit, which stores the data on a Personal Computer Memory Card International Association (PCMCIA) card for flight data monitoring (FDM) purposes. The data on the card is an exact duplicate of that collected by the DFDR; however, the DFDR is crash-protected whereas the QAR is not, and the latter typically holds many more hours of data.

Tests and research

1. Simulator session

On 26 July 2017, the TSB conducted a session in one of WestJet’s 3 B737-700 flight simulators in Calgary, Alberta. The simulator, a full-flight, level D unit certified by Transport Canada (TC), is used to train WestJet B737-800 crews. The purpose of the session was to assess WJA2652’s approach under similar virtual weather conditions, while familiarizing TSB investigators with procedural workflow in the B737; with the operation of its autopilot, flight director, and navigation systems; and with the user interface of each of these components.

The simulator did not allow for an exact replication of all of the visual conditions at the time of the occurrence, such as the effect of the rain on the windshield. However, the exercise demonstrated a significant reduction in the visual discernibility of the runway environment when visibility diminished to 2000 m. It also highlighted the necessity for runway and PAPI lights to be illuminated at high intensity to clearly demarcate the runway edges under conditions of low visibility.

Through a series of approaches conducted in the simulator, the visual cues available to the flight crew were assessed, beginning from approximately 1000 feet AGL until the height at which the aircraft conducted its go-around, i.e. 40 feet AGL. The assessments indicated that, although the shape of a hotel to the left of the runway (Figure 3) differed from that of the actual runway, its discernible geometric features changed (as with most visual references) according to the approach angle and distance of the aircraft. From a distance, the hotel appeared wider at its base and narrower on top, similar in aspect to a runway. As the aircraft approached, however, its shape became more apparent as that of a building.

2. TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

LP074/2017 − EGPWS Download
LP124/2017 − Analysis of Maintenance Records
LP054/2017 − QAR Data Analysis

3. Route and aerodrome qualification

WestJet produces a document known as a route and aerodrome qualification for each aerodrome at which it operates. The document provides flight crews with general information pertinent to their destination. WestJet’s Route & Aerodrome Qualification for TNCM provides crews with aerodrome-specific guidance that includes cautions, weather-related approach and departure minima, and procedures pertaining to enroute flight, approach and landing, and departure. The arrival procedure described therein states, in part:

RNAV 10 MAP located 2NM prior to threshold – ensure the autopilot is disengage [sic] and the FD cycled or disengaged prior to this point or aircraft will turn in LNAV [lateral navigation] at ONBED and thrust will increase. Be prepared for the thrust to annunciate “ARM” at this point and closely monitor speed. Manual manipulation of thrust or selecting “speed” is required.

Additional information

1. Instrument approaches at Princess Juliana International Airport

There are 2 approaches at TNCM: VOR Rwy 10 and RNAV (GNSS) Rwy 10. During the occurrence, the crew was conducting the RNAV (GNSS) Rwy 10 approach.

The RNAV approach provides flight crews with lateral navigation information (LNAV) for the approach, starting at an initial approach waypoint fix and ending at the MAP. The vertical flight path management for this approach is assured by the crew.

In this occurrence, the FMS provided the crew with vertical guidance to the MAP during the inbound final approach course. Because there is a mountain close to the runway, the MAP is situated 2 nm (3704 m) before the runway threshold, and the MDA is at 700 feet ASL (688 feet AGL), to meet the PANS-OPS criteria for obstacle clearance in the event of a go-around (International Civil Aviation Organization (ICAO), Doc 8168, Procedures for Air Navigation Services: Aircraft Operations (PANS-OPS), Volume II, Construction of Visual and Instrument Flight Procedures, Sixth edition – 2014). Therefore, there is a long visual flight segment following the MAP where the crew is required to manage the descent to the runway threshold in order to complete the landing (Figure 4). It is not common for WestJet pilots to fly long visual segments of an IFR approach such as that of the RNAV (GNSS) Rwy 10 at TNCM. Even less common are long visual segments over water and with the type of weather encountered during the occurrence approach.

1.1. Minimum visibility to conduct an approach to Princess Juliana International Airport

When operating abroad, Canadian air operators must follow the laws, regulations, and procedures of both Canada and the foreign state in which they are operating. Under the Saint Maarten Civil Aviation Regulations, the minimum visibility requirements to conduct an approach are more restrictive than those in the CARs. The Saint Maarten Civil Aviation Regulations stipulate that an aircraft may not continue with an approach past the FAF unless visibility is “equal to or more than the minimums prescribed for that procedure.”

For WJA2652’s aircraft category, the minimum visibility for the RNAV (GNSS) Rwy 10 approach to TNCM is 3600 metres. Visibility must, therefore, be at least 3600 m for an aircraft to continue an approach beyond the FAF (LESOR).

Analysis

Introduction

The aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures, and no mechanical defects that could have contributed to the occurrence were found. The flight crew were certified and qualified for the flight in accordance with existing regulations, and there were no indications that their performance was in any way degraded as a result of physiological factors, such as fatigue.

In an effort to understand why the aircraft descended too low on the visual approach after MAPON missed approach point (MAP) before conducting a go-around, this analysis will focus on the weather information available and visibility, visual references, aircraft handling, airport lighting systems, and human factors.

On 15 September 2017, the island of St. Martin was severely damaged by Hurricane Irma and communication with the Sint Maarten Civil Aviation Authority (SMCAA) was lost. As a result, some local air traffic control information was not available to the investigation.

Visibility

Before WestJet flight 2652 (WJA2652) began its descent toward Princess Juliana International Airport (TNCM), the visibility in the vicinity was reported to be unlimited. However, when the aircraft was approximately 15 nautical miles (nm) from the threshold of the runway, the visibility at the airport deteriorated significantly, becoming 2000 m, with moderate to heavy rain showers. Automatic terminal information system (ATIS) November had been issued approximately 3 minutes before the crew were cleared for the approach. During this phase of flight, crews are not aware when there is a change of ATIS unless advised of it by the controller.

The minimum visibility required to continue an approach to TNCM beyond the final approach fix is 3600 m. The air traffic controller cleared the flight crew for the RNAV Runway 10 approach when the aircraft was approximately 13 nm from the runway. Just after issuing the approach clearance, the controller advised the crew of the presence of moderate to heavy rain showers at the airport but did not inform them of the updated visibility. Unaware that the visibility was below that required to conduct the approach, the crew continued the approach toward the runway.

Significant changes in visibility were not communicated to the crew, which allowed them to continue the approach when the visibility was below the minimum required to do so.

Deviation from approach profile

On final approach, the aircraft was stabilized on a 3° angle of descent and configured for landing. Approximately 0.5 nm before the MAP, the flight crew decided that, given that they had the shoreline in sight and expected to see the runway shortly afterwards, they would continue the approach visually. At that point, the aircraft was descending at approximately 820 feet per minute (fpm) and at 159 knots indicated airspeed, with an N1 of approximately 62%.

The pilot flying (PF) then disconnected the autopilot as per WestJet’s approach procedures for landing at TNCM. Shortly afterwards, the PF reduced the pitch from 0.5° nose up to 1.2° nose down, which initiated an increase in airspeed. In response to the airspeed increase, the autothrottle command reduced the engine thrust from 62% to 52% N1 to maintain the 160-knot speed previously set in the flight management computer (FMC). Following the reduction in thrust, the aircraft began to deviate below the 3° angle of descent, at a descent rate of between 1000 and 1150 fpm. Shortly after, the PF cycled the flight directors and started to manually manipulate the thrust as per WestJet’s approach procedures for landing at TNCM.

The reduction in the pitch attitude led to an increase in airspeed, which resulted in a reduction in engine thrust and a higher rate of descent than that required by the 3° angle of descent.

Acquiring visual references

During the approach phase of flight, pilots may be prone to visual errors as they switch from scanning the instrument panel within the cockpit to scanning outside the aircraft to acquire visual references. The alternation of attention from one to the other increases their cognitive workload, the demand on their perceptual faculties, and the complexity of their flight-path monitoring tasks, particularly in conditions of reduced visibility. Conditions such as expectation bias and anticipation may also contribute to visual errors.

In this occurrence, the crew of an aircraft that had landed just ahead of WJA2652 had reported seeing the runway upon reaching minima. The crew of WJA2652 were expecting to see the runway shortly after crossing MAPON. The occurrence of a moderate to heavy rain shower, after the aircraft crossed MAPON, led to a significant reduction in visibility. The low-intensity setting of the runway lights and precision approach path indicator (PAPI) lights limited the visual references that were available to the crew to properly identify the runway.

Among the visual references that remained available, the features of a hotel located to the left of the runway, such as its colour, shape, and location, made it more conspicuous than the runway environment and led the crew to misidentify it as the runway. As the crew crossed MAPON, the PF advised that he had the runway in sight. He began to roll the aircraft to the left to align it with what he thought was the runway but what was actually the hotel.

The hotel located to the left of the runway appeared from a distance to be wider at its base and narrower on top than it actually was, causing it to appear similar to a runway. However, as the aircraft approached, it became more apparent that the shape was in fact a building. Those changing geometrics would have differed from what the pilot expected of an actual runway’s appearance on approach. Further, rain may have distorted visual references such as the hotel and made the changing geometric shape more difficult to interpret.

The reduced visibility and conspicuity of the runway environment diminished the crew’s ability to detect that they had misidentified the runway.

Airport lighting management

On the day of the occurrence, the runway lights at TNCM were off and the PAPI lights were at 30%. Realizing that visibility was declining due to moderate to heavy rain showers, the controller turned the runway lights on to an automatic setting for night use. That setting illuminated the runway edge lights to 3% but reduced the intensity of the PAPI lights to 10%. The low intensity of the runway lights and PAPI lights reduced their effectiveness as a visual reference and limited the likelihood that they would capture the attention of the flight crew in the crew’s visual scan.

According to the International Civil Aviation Organization (ICAO) Procedures for Air Navigation Services: Air Traffic Management (PANS-ATM), air traffic controllers should be provided with guidance on the adjustment of airport lighting settings to suit prevailing conditions. At TNCM, no guidance is provided for the operation of lighting systems, and the control of light intensity for all conditions is therefore at the controller’s discretion.

If the ICAO PANS-ATM are not implemented in the management of aerodrome light intensity, there is a risk that the optimal light intensity settings for prevailing weather conditions will not be selected.

Flightpath monitoring

A high visual workload can lead pilots to narrow their visual attention and focus only on those stimuli that they perceive to be most important. This narrowing of attention may influence the way they visually scan their flight instruments, such that critical items may be dropped from their scan. Pilots may also intensify their focus on a specific area where they anticipate a change, which prevents them from fully monitoring all relevant flight instruments and degrades their situational awareness.

The Flight Safety Foundation (FSF) has found inadequate flight path monitoring to be a frequent underlying causal factor in approach-and-landing occurrences and provides 20 recommendations for improving flight-path monitoring performance in its 2014 publication, A Practical Guide for Improving Flight Path Monitoring. The guide states, however, that “regardless of any action taken by any operator, […] elevating the monitoring role on the flight deck is a significant and worthwhile operational challenge.”

WestJet provides its crews with guidance on flight path monitoring during all phases of flight and in adverse weather. However, a review of WestJet training and operational procedures indicated that only some of the FSF’s recommendations are in place.

In this occurrence, when the aircraft was on final approach prior to MAPON, a moderate to heavy rain shower ahead and to their left obscured the flight crew’s view of the airport environment and reduced their ability to identify the runway. After crossing MAPON, the crew encountered a greater reduction in forward visibility than they had anticipated when the aircraft entered the shower. The resulting increase in the crew’s visual workload led them to focus their attention on monitoring for external visual references and prevented them from adequately monitoring the aircraft’s altitude.

An increase in visual workload led to inadequate altitude monitoring, which reduced the crew’s situational awareness. As a result, the crew did not notice that the aircraft had descended below the normal 3° angle of descent to the runway threshold. The lack of visual texture and other visual cues available over water contributed to the crew’s inability to detect the aircraft’s reduced height above the water.

Threat and error management

The practice of threat and error management (TEM) includes preparing and adapting crew action plans following the identification of current threats, in order to reduce the risks associated with those threats.

During the visual segment of the aircraft’s final approach over the water, the rain reduced the visibility by a greater degree than the crew had anticipated, given that the prior segments of the approach had been conducted in daylight and under conditions of good visibility. The low intensity of the runway edge lights and PAPI lights and the lack of visual cues over water were not identified as threats. Consequently, the crew did not consider the consequences of such threats or take action to mitigate them.

If crews do not identify and manage threats, there is an increased risk of crew errors, which could lead to undesired aircraft states.

1. Threat and error management training

As detailed in a 2011 TSB investigation report, Canadian Aviation Regulations (CARs) Subpart 705 operators are currently required to conduct crew resource management (CRM) training, but the regulations have not kept pace with advances in CRM theory and application, and are now outdated.

Since the Board’s issuance of TSB Recommendation A09-02, which calls for the provision of contemporary CRM training, and it’s 2011 safety concern regarding the necessity for a comprehensive and integrated approach to CRM by TC and aviation operators, Transport Canada (TC) has taken steps to address the gaps in the existing regulations. A new Commercial Air Service Standard (CASS), set to replace the current CASS subsection 725.124(39) in January 2019, will require operators under subparts 703 (AirTaxi), 704 (Commuter), and 705 (Airline) to provide contemporary CRM training, which includes training in TEM.

The enhanced ground proximity warning system

Enhanced ground proximity warning systems (EGPWSs) are designed to improve safety by providing alerts to flight crews when the aircraft is in a dangerous situation and corrective action is required. Some alerts require a change in aircraft configuration, while others require a change of flight path.

1. Alert response procedures

The EGPWS alert response procedures of both the aircraft manufacturer and the operator instruct pilots to ensure positive visual verification in the event of an EGPWS alert of “TOO LOW, TERRAIN” during flight under daylight visual meteorological conditions (VMC). This step is intended to limit the number of unnecessary go-arounds resulting from nuisance alerts. However, current EGPWS technology has reduced the incidence of nuisance alerts such that they are now rare and almost always predictable. As a result, the positive visual verification step within the response procedure may no longer be necessary. Further, it is not consistent with the EGPWS manufacturer’s procedures, which state that climbing is the only recommended response when receiving an EGPWS alert.

2. Alert recovery reaction time

At 63 feet above ground level (AGL), the flight crew unexpectedly received an EGPWS aural alert of “TOO LOW, TERRAIN,” which caused them to readjust their degraded situational awareness. On receipt of the aural alert, the crew carried out a “positive visual verification that no obstacle or terrain hazard exists” (as per both the aircraft manufacturer’s and operator’s recommendations for EGPWS alert response in daylight VMC), before deciding on a course of action. The PF increased the pitch to 4° nose up; however, as the aircraft continued descending, the crew received a second EGPWS alert when the aircraft was between 54 and 49 feet AGL.

While carrying out the positive visual verification, the crew’s ability to evaluate their height above the water was made more challenging by a lack of texture and other visual cues in the external environment, and it took them several seconds to understand that they were indeed too low. They initiated a go-around 9 seconds after the first EGPWS alert, by which time the aircraft had descended to 40 feet above the water. The alert response procedure recommended by the aircraft manufacturer and the operator led to a delayed response to the first EGPWS alert and resulted in the aircraft’s descent from 63 to 40 feet AGL before corrective action was taken.

Findings

Findings as to causes and contributing factors

Significant changes in visibility were not communicated to the crew, which allowed them to continue the approach when the visibility was below the minimum required to do so.
The reduction in the pitch attitude led to an increase in airspeed, which resulted in a reduction in engine thrust and a higher rate of descent than that required by the 3° angle of descent.
The occurrence of a moderate to heavy rain shower, after the aircraft crossed the missed approach point, led to a significant reduction in visibility. The low-intensity setting of the runway lights and precision approach path indicator lights limited the visual references that were available to the crew to properly identify the runway.
The features of a hotel located to the left of the runway, such as its colour, shape, and location, made it more conspicuous than the runway environment and led the crew to misidentify it as the runway.
The reduced visibility and conspicuity of the runway environment diminished the crew’s ability to detect that they had misidentified the runway.
The lack of visual texture and other visual cues available over water contributed to the crew’s inability to detect the aircraft’s height above the water.
An increase in visual workload led to inadequate altitude monitoring, which reduced the crew’s situational awareness. As a result, the crew did not notice that the aircraft had descended below the normal 3° angle of descent to the runway threshold.

Findings as to risk

If the International Civil Aviation Organization Procedures for Air Navigation Services: Air Traffic Management are not implemented in the management of aerodrome light intensity, there is a risk that the optimal light intensity settings for prevailing weather conditions will not be selected.
If crews do not identify and manage threats, there is an increased risk of crew errors, which could lead to undesired aircraft states.

Other findings

Because the occurrence was originally assessed by WestJet as a non-reportable event, the cockpit voice recorder and the digital flight data recorder data were overwritten and were not available to the investigation.

The enhanced ground proximity warning system (EGPWS) alert response procedures of the aircraft manufacturer and the operator differ from those in the guidance material of the EGPWS manufacturer.
The alert response procedure recommended by the aircraft manufacturer and the operator led to a delayed response to the first EGPWS alert and resulted in the aircraft’s descent from 63 to 40 feet above ground level before corrective action was taken.

***

Excerpted from

Transportation Safety Board of Canada. AVIATION INVESTIGATION REPORT A17F0052. Risk of collision with terrain. WestJet Boeing 737-800, C-GWSV Princess Juliana International Airport, Sint Maarten 07 March 2017.

FURTHER READING

**********************

_______________________

Loss of Control In-flight incident involving a Royal Air Force A330

A camera jammed between the left armrest and the side –stick unit producing an inadvertent physical input to the Captain’s side-stick assessed as the cause of the event. Several organizational and some design factors were identified as contributory factors

ZZ333 (2)

Photo (C) Stewart Marshall. Jetphotos.net

UK Ministry of Defense and Military Aviation Authority Service Inquiry: incident involving Voyager ZZ333 on 9 February 2014.

HISTORY OF THE FLIGHT

On February 9^th, 2014, the crew of ZZ333 briefed at 0925 UTC for a non-stop air transport flight from RAF Brize Norton (BZZ) to Camp Bastion Airfield (QOZ), Afghanistan. ZZ333 taxied approx 20 minutes late with a total flight crew of 9, plus 189 passengers. The departure was delayed slightly by a transponder Electronic Centralized Aircraft Monitoring (ECAM) warning just prior to line-up which was quickly resolved. With a call sign of ISF 63JW, ZZ333 departed BZZ at 1200 UTC for an anticipated 8hr 20min leg to QOZ.

Initially, the flight progressed without incident, with the exception of at least one instance of turbulence, significant enough to warrant the illumination of the seat belt signs. At 1549 UTC (night time), with the aircraft in the cruise at Flight Level (FL) 330 and autopilot 1 engaged, the Co-pilot had left his seat and was in the forward gallery in the vicinity of the forward left passenger door. The Captain (occupying the left-hand flight deck seat) suddenly felt a sensation of weightlessness and being restrained by his harness, accompanied by a rapid pitching down of the aircraft. He attempted to take control by pulling back on his side-stick controller and pressing the autopilot disconnect button but these actions were ineffective.

Immediately prior to pitch-down, the Co-pilot felt a sensation similar to turbulence. Other crew in the cabin reported a similar sensation, describing it as a “jolt”. The Co-pilot then experienced weightlessness and struck the cabin roof but was able to re-enter the flight deck through the open door. He reported a disorderly scene with audio alarms sounding and a violent shaking of the aircraft. He reached down to pull back on the side-stick control. Both pilots reported hearing a “dual input” audio warning, indicating simultaneous inputs by both pilots, on their respective side-sticks. As the aircraft began to recover from the dive, excessive speed was building. The thrust levers were selected to idle and as the aircraft re-established a climb, the speed rapidly reduced. The Captain set Take-off and Go-around (TOGA) power and subsequently re-established a power altitude combination for a straight and level flight at FL310.

The aircraft had lost 4,400 feet n 27 seconds, registering a maximum rate-of-descent of approximately 15,800 feet per minute, before recovering to straight and level flight. The speed had reached 358 knots Indicated Air Speed (KIAS), or Mach 0.9, and g-forces had ranged from minus 0.58 “g” (at the onset of the dive), to plus 2.06 “g” during the recovery. The aircraft was diverted to Incrilik Airbase in southern Turkey without further incident.

The resulting negative “g” forces were sufficient for a significant number of passengers and crew to be thrown towards the cabin roof. Twenty-five passengers and 7 crew reported injuries, and were attended in flight by medical personnel travelling as passengers, and subsequently at the on-base medical facilities. No major injuries were reported at the time of the incident.

Background

Voyager is a modified Airbus A330-243, procured under a comprehensive service delivery contract between the Ministry of Defense and a contractor which owns the aircraft and provides for aircraft, infrastructure, inventory, certain manpower and training services. The aircraft must be able to switch between the Civil Aircraft Register (CAR) and the Military Aircraft Register Hub. Thus, each aircraft must be maintained to civilian standards by an appropriately licensed organization and using licensed staff, therefore the service s administered in the military role and controlled in the civil environment. The Voyager’s key capabilities include probe and drogue air-to-air refuelling (AAR) for all RAF receiver aircraft, plus a carrying capacity of up to 291 passengers and 8 NATO freight pallets.

Flight planning and authorization

The flight on 9 Feb was in support of an operational air-bridge, which provides the military air link between the UK and Afghanistan. The scheduled departure time was 1125 UTC on 9 Feb and the flight was expected to last approximately 8 hours.

The crew of two pilots and eight cabin crew members were scheduled to check in at 0925 UTC on 9 Feb. Accompanying the flight were two Aircraft Ground Engineers (AGE), who would be responsible for ground maintenance on arrival at QOZ.

Pre-event

Start-up and taxi. The aircraft star was normal. On taxi out, the ECAM System displayed a failure of the identification Friend or Foe1 (IFF1) transponder. The crew informed Air Traffic Control (ATC) that they would hold short of the main runway while they addressed the fault. While following the procedure for an IFF reset, the ECAM indicated that IFF2 had also failed. Several resets of both transponders did not remedy the faults and the AGEs were called upon to the flight deck to provide advice. The pIlots were informed that nothing could be done to resolve the faults without taxiing back to the stand and shutting down. While preparing to return to the stand the IFF1 fault cleared, thus satisfying the crew that they could proceed with the flight. Take-off clearance was obtained from ATC.

Take-off. The aircraft was only 0.7 Tones below its Maximum Takeoff Weight (MTOW) and thus required the full length of Runway 26 for take-off. Adopting a standard technique for improving the aircraft’s take-off performance, the crew switched off the air conditioning packs and selected the thrust levers to TOGA power. The take-off roll was normal and, as the aircraft climbed through 300 ft above ground level, the autopilot was engaged. The rest of the departure was uneventful, following the Standard Instrument Departure (SID) from RAF Brize Norton, before conducting a relatively unrestricted climb to cruising altitude Flight Level (FL) 330 with London ATC.

The cruise. Initially, the flight progressed without incident, with the exception of at least instance of turbulence, significant enough to warrant the switching on the seatbelts signs. At 1532 UTC, around 18 minutes before the incident, the Co-pilot left his seat for a break. Approximately two and a half minutes later, he returned briefly to the flight deck to deliver refreshment to the Captain before adjourning to the forward galley in the vicinity of the L1 station (forward left passenger door). He remained at this location until the incident took place, talking to the Purser and a former colleague who was on board as a passenger.

While on his own and in his seat, the Captain was taking photographs of the flight deck with his Nikon digital SLR camera. The last photograph was taken at 1546:38 UTC, three minutes and twenty seconds before the incident, and co-incident with the purser entering the flight deck. The purser and the captain had a brief conversation about the progress of the flight before the purser left the flight deck at 1548:04 UTC, one minute and 54 seconds before the incident.

The event

At 1549:58 UTC, the Captain felt a sensation of weightlessness and being restrained by his harness, accompanied by a rapid pitching down of the aircraft. He attempted to take control by pulling back on his side-stick and pressing the autopilot disconnect button, but these actions were ineffective. The captain was unaware of any alarms but reported an increase in cabin ambient noise and a sensation similar to being underwater. In less than ten seconds the aircraft had pitched to 17 degrees nose-down, was descending at 15,800 feet per minute, and was accelerating rapidly through 300 KIAS.

Immediately prior to the nose-down attitude, the co-pilot felt a sensation similar to turbulence. The purser also reported a similar sensation, describing it as a “jolt”. As the aircraft pitched down, the co-pilot was lifted to the cabin roof and, while experiencing weightlessness, re-entered the flight deck through the open door. He described a confused scene with audio alarms and flashing lights, as well as a violent shaking of the aircraft. The captain shouted repeatedly that he could not disengage the autopilot. With his feet on the flight deck roof, the co-pilot reached down and attempted to disengage the autopilot by pulling back on his side-stick; an action which appeared to have no effect. As he resumed his seat and pulled back again on his side-stick, the aircraft began to pitch up. As the aircraft pitched up, “dual input” audio warnings were heard, indicating simultaneous side-stick inputs by both-pilots. By now (around 14 seconds into the incident), excessive speed had built, leading the pilots to reduce the thrust levers to idle. The aircraft began pitching upwards, and as it did so the speed decreased. The co-pilot warned the captain of the decaying airspeed, who consequently set TOGA power as a straight and level flight was re-established at FL310. The crew then re-engaged autopilot 1.

Meanwhile, in the cabin, a large number of passengers and crew had been thrown towards the ceiling. A significant volume of loose articles, including bags, personal effects, teapots, paper cups and bins were flying around the cabin, while some passengers were shouting. As the negative “g” force from the initial pitch-down subsided, and as the aircraft accelerated in the dive, some of the unrestrained passengers and crew were able to find their way towards vacant seats and strap in. As the aircraft recovered to straight and level flight, the purser made a brief check of the flight deck, before beginning a survey of the situation throughout the cabin.

The aircraft had lost 4,400 feet in 27 seconds, registering a maximum rate-of-descent of approximately 15,800 feet per minute, before recovering to straight and level flight. The speed had reaches 358 knots IAS, and “g” forces had ranged from minus 0.58 “g” (at the onset of the dive), to plus 2.06 “g” during the recovery.

Post-event

Once in level flight, the captain decided to land the aircraft as soon as possible. An initial Mayday call, transmitted by the co-pilot during the event, was followed by another call in which he requested a diversion “to a suitable airfield of our choice”. On the advice of Turkish ATC, the aircraft was turned towards Trabzon, a civilian airfield approximately 60nm away. The captain judged that the close proximity of Trabzon would not allow enough time to descend in good order, and as unsure as to its suitability. Instead, he elected to divert to Istanbul International Airport, some 500nm away. After a few more minutes, however, ATC suggested that they should divert to Incirlik Airbase in southern Turkey, some 340nm from the aircraft’s position at the time. The captain agreed and the aircraft was turned south.

During the diversion the captain and purser addressed the passengers a number of times using the public announcement (PA) system, repeating seat belt instructions, advising on timings and informing them before large attitude or configurations changes. In the immediate aftermath of the incident, the captain used the PA system to inform passengers that the reason for the incident was unknown and that the aircraft was being diverted. He asked all passengers to remain seated with seatbelts fastened. During the purser’s assessment of the rear cabin, it became apparent that one of the passengers was suffering from an acute stress reaction and was attended by a doctor onboard.

The purser checked the cabin crew members to verify their fitness to fly and conducted a second survey of the cabin with one of the AGEs. No external damage was found, the flight crew was updated and the passengers were prepared for landing.

Both pilots remained in their seats and guarded the controls at all times. The aircraft landed at Incirlik Airbase from a straight-in approach without further incident. The aircraft was taxied to an aircraft parking bay and a normal disembarkation was conducted with the emergency services present.

Damage to aircraft

There was no severe damage to the aircraft cabin structure that compromised the function for the landing.

There was no reported damage to the flight deck. The post-occurrence review by Airbus found the side stick received forces beyond its design specification, therefore was deemed unserviceable.

There was no reported damage to the external structure of the aircraft

Post Occurrence Management

As a military aircraft incident, the station lead for post-occurrence management rested with the military chain-of-command.

Injuries

On landing in Incirlik, the following injuries were identified:

Table 1

The co-pilot and seven cabin crew received minor injuries but were able to conduct their duties; one crew member had suffered a stress reaction but recovered within a few minutes and was able to carry out their duties. 24 passengers received minor injuries and one passenger had suffered an acute stress reaction which resulted in his admission to hospital.

FINDINGS

The incident involving Voyager KC Mk 3 (ZZ333) on 9 Feb 14 occurred when the aircraft suddenly pitched down while in the cruise at FL330. The pitch-down command persisted for a total of 33 seconds, during which time the aircraft lost 4,400 ft in height. The aircraft’s self-protection measures initiated a recovery from the dive.

Evidence gathered from the aircraft’s Digital Flight Data Recorder showed that a full pitch-down command had been initiated from the captain’s side-stick, which caused the autopilot to disconnect ante the aircraft to enter a dive. The evidence also showed that the pitch-down command was not the result of a technical malfunction of the side-stick, the control surfaces, the autopilot, the flight control computers, or the aircraft weight and balance. Neither was the pitch-down command the result of turbulence. A detailed examination of the aircraft indicated that there were no pertinent technical faults throughout the flight.

The inquiry established conclusive evidence that the pitch-down command was actually the result of an inadvertent physical input to the captain’s side-stick. Specifically:

Two or three minutes before the event, a Digital Single Lens Reflex (D-SLR) camera was placed directly behind the side-stick, in the space between the side-stick and the captain’s left armrest.
At one minute and 44 seconds before the event, the captain’s seat was moved forward, creating a slight jam of the camera between the front of the armrest ant the rear base of the side-stick.
At the onset of the event, the captain’s seat was moved forward again, forcing the side-stick fully forward and initiating the pitch-down command.
With the captain’s side-stick jammed fully forward, the pitch-down command could not be counteracted initially, as the captain was the only person present on the flight deck.
The resulting forces were sufficient for a considerable number of passengers and crew to be thrown to the ceiling, resulting in a number of injuries.

The panel found that the factors which led to the pitch-down command were influenced principally by the prevailing safety culture with respect to loose articles on the flight deck of RAF air transport aircraft. The small amount of guidance regarding the treatment of loose articles on flight decks was overwhelmed by an organizational requirement to tale large amounts of equipment and documentation onto the flight deck to support missions and to stores it in ad hoc locations. As a result, the carriage, use, and ad hoc storage of a small number of personal items had become normal practice. The recovery from the pitch-down command was initiated by the aircraft’s own protection laws which prevented the incident from being worse. In the opinion of the panel, the evidence suggests strongly that the clearing of the obstruction from behind the side-stick was achieved by means of a physical manipulation of the camera itself.

The situation in the passenger cabin was managed effectively and had no adverse bearing on the injuries sustained by passengers and cabin crew.

The practical response in the immediate aftermath of the incident was fast, thorough and highly effective.

Determining the cause of the pitch-down command

Context

Comprehensive interviews with the pilots conducted in Incirlik had already established a strong theme that pointed towards a technical malfunction on the aircraft, especially associated with the side-stick and the autopilot. However, the initial analysis of the DFDR and CVR had revealed no evidence of any pertinent technical malfunctions, particularly with respect to the side-sticks and the autopilot.

A number of concurrent lines of inquiry became necessary in order to rule out a variety of possible causes, including extensive work carried out by independent parties to help isolate the cause of the pitch-down command.

Analysis

The DFDR showed no indication of indication of system failure, there were no annunciations to the crew of pertinent faults, nor were any relevant fault codes generated that could help explain the incident. The panel assessed this incident to be unique.

At 1548:13 UTC, one minute and 44 seconds prior to the event, the FDR detected a low frequency fluctuating pitch-down command of 0.5 to 0.9 degrees from the captain’s side-stick. This input endured until the onset of the full pitch-down command. This initial forward input was pure in pitch with no discernible lateral input. The force and displacement of the side stick during this command did not disengage the autopilot, because a five deca-Newton force and five-degree displacement in pitch of the side-stick is required to autopilot to disengage. Therefore, the aircraft remained initially in level flight with the autopilot engaged. At 149:57 UTC, a fully-forward input was made by the captain’s side-stick, pure in pitch and at a constant rate, with no discernible lateral input, held for approximately four seconds. This input initiated the pitch-down event.

Early analysis of the CVR identified a distinctive noise on the flight deck at one minute and 44 seconds prior to the event, and at the onset of the event itself. Spectral analysis of the noise identified it, by its frequency of 1900-2000 Hz, as the electric motor used to adjust the flight deck crew seats. In the two minutes prior to the event, the captain was the only person on the flight deck, therefore it was concluded that the motor noise came from the captain’s seat. There was no evidence that the seat had malfunctioned in flight and the functional tests carried out after the event showed that the seat was fully serviceable.

There was an obvious and strong temporal and directional correlation between the seat motor movement and the side-stick movement. The stick and the seat would have to be physically connected, either by the seat’s occupant or by an object.

The pitch input from one minute and forty-four seconds until de onset remain between 0.5 and 0.9 degrees, in a manner inconsistent with human input. The captain was certain that he was not touching the controls prior to the event, and the persistence of the subsequent pitch-down command for around 33 seconds indicated that it was not the product if an inadvertent human input. On the other hand, the lack of roll input on the DFDR trace during the initial pitch-down of the aircraft meant that a hand-flown pitch-down command was unlikely. Therefore, the panel concluded that the captain was not in physical contact with the side-stick immediately prior to or during the onset of the event.

As a result, the panel focusing on the possibility of an object connecting the seat and the side-stick collected the personal effect which had been on the flight deck during the event. It became evident that a Nikon Digital Single Lens Reflex (D-SLR) D5300 Camera belonging to the captain had been present on the flight deck in the minutes leading up to the pitch down event, had been seen on the surface area near the base of the captain’s side-stick and the captain has been seen using it during the flight. In one photograph, the GPS digital clock on the flight deck could be seen, allowing a comparison with the internal time measurement of the camera. 77 photographs were taken during the flight, the last one, taken one minute and thirty-five seconds before the initial pitch event, and three minutes and twenty seconds before the full pitch-down event.

The camera was found to have a large linear dent on its right-hand side (Figure 6). The dent extended from the softer hand grip region toward the front of the camera, across a thin part of the main body frame, and across the memory card flap.

The profile of the large dent was mapped forensically using surface profilometry and was found to be consistent with the flange of the side-stick. The chemical analysis indicated trace amounts of materials present in a swab from the camera indentation consistent with the material typo of the side-stick. Using binocular microscopy to examine the rubber gaiter at the base of the side-stick some marks were found that considered alongside other smaller witness marks on the camera, it was assessed that the damage was consistent with the side-stick being pulled back forcefully against the body of the camera.

The event was reconstructed using the Voyager simulator, placing a camera in the gap between the armrest and the side-stick and moving the seat motor forward until the camera was gently flush against the base of the side-stick. The effect was to push and hold the side-stick fully forward in a manner consistent with the pitch-down command seen on the DFDR. The motion resulted in the grip flange become aligned with a location exactly consistent with the dent in the camera.

Using the calculated movement of the seat, the position of the armrest and the location of the camera, the analysis found that it was feasible for the seat movement recorded on the CVR t have caused the movement recorded on the CVR to have caused the movement of the side-stick to the fully forward position.

In the meantime, the panel ruled out a thorough range of other causes (See the original report)

The captain agreed that a physical interference with the side-stick, in the manner suggested above, represented the most probable trigger for the pitch-down command. Therefore, the panel concluded that the cause of the pitch-down event was an inadvertent physical input to the Captain’s side-stick, by means of a physical obstruction (a camera) that jammed between the left armrest and the side –stick unit when the Captain’s seat has motored forward.

Factors leading to the pitch-down command

A series of individual acts took place at the moment before the pitch-down command which was assessed as having contributed to the incident itself. Those individual acts were influenced by the combination of error promoting conditions, organizational influences and breached defenses.

fig 10

Carriage of the camera

The carriage of the camera was considered by the panel as a contributory factor, however, was consistent with normalized behaviour regarding loose articles on flight decks on RAF air transport aircraft. This issue had been the source of considerable debate amongst junior Air Safety staff but it had not been resolved. Aircrews were required to take a large number of items of equipment on board the aircraft for operational flights, result of the nature of the tasking and the associated volume of paperwork necessary to support the mission. However, only some of these items had designated storage, with the rest usually found space around the flight deck, for example on the floor behind the pilot’s seats. It is likely that this situation promoted an attitude that it was generally acceptable to have a large number of items on the flight deck, such that the carriage of a small number of personal effects would not have seemed unreasonable. There was no evidence, however, of official guidance or training related to the carriage and use of these personal items and how they should be stored and positioned on the flight deck, increasing the likelihood that personnel would develop their own norms and practices as a result of experience and advice of others.

fig 11 y 12

Photographs taken on the flight deck of ZZ333 shortly before the incident indicated that there was a number of loss articles placed in areas around the flight deck, some not officially designed for storage. The selection of typical locations used to store items illustrates the challenge imposed by the imbalance between the available storage, the required volume of official equipment and documentation and the carriage of personal items, resulting in items being stored on the floor and in ad hoc areas, including the area around the side-stick.

fig 13

The carriage of personal items may also have been perceived as advantageous as it would provide access to items in flight which could be used to help maintain mental alertness and prevent boredom during times of low work.

The panel assessed that normalized behaviour regarding the carriage and treatment of loose articles was a contributory factor to the incident. Furthermore an incomplete RAF Brize Norton Occurrence Investigation (OSI) opened on April 2013, executed to examine an Air Safety Occurrence Report (ASOR) about a concern of the number of loose articles being found on board one of the fleets and to determine whether the issue was limited to that fleet, and what measures should be taken to address it and which report has not been issued by the time of the incident, was assessed as a contributory factor.

The carriage of the camera on the flight deck was not prohibited by any rules or regulations. Restrictions on the use of such items were only in regard to their transmitting properties during different phases of flight.

Use of the camera in flight

The use of the camera on the flight deck during the flight was considered a contributory factor. However, this was influenced by a number of associated factors.

The use of the camera was not explicitly prohibited by any rules and the restrictions on the use of personal electronic devices were associated with their transmitting properties. However, the Voyager Operations Manual stated that: “Flight crew must refrain from non-relevant duties (e.g. paperwork, casual conversation), in circumstances such as (but not limited to): while the other pilot is away from the active Air Traffic Control (ATC) frequency.”

While on his own, the captain took 28 photographs, approximately eight minutes and three minutes prior to the incident, which were not related to the duties he was carrying out at the time. The panel considered this was not a deliberate and conscious contravention of the rules. However, the use of the camera represented a lack of compliance with the policy regarding non-relevant duties, thus rendering the policy a breached defense.

This lack of compliance with policies was assessed by the panel as highly probably a consequence of boredom and low work load. During a phase of flight when the workload on pilots is low, as in cruise, a high level of automation, as the Voyager’s, can make it even lower, resulting in boredom and complacency. Some individual factors can make an individual more susceptible to boredom. A high level of knowledge, education and ability, be keen for a demanding job, be fatigue or the lack of adaptation to night work make boredom easier to appear. Given the operation conditions, it was highly likely that the crew would take actions to raise their level of alertness and alleviate boredom. Having regular visitors to the flight deck, taking comfort breaks, reviewing in-flight paperwork and using personal items are actions considered as typical to maintain alertness during flight.

Based on all the above the panel assessed that low workload and boredom were contributory factors.

On the other hand, the presence on ZZ333 of only a single person in the flight deck for an extended period of time increased the risk of boredom and under-arousal, thus increasing the likelihood that the Captain would take actions to maintain his general alertness. The panel assessed that the presence of only a single person on the flight deck for an extended period of time was a contributory factor. Moreover, this represented a potential lack of compliance with the policy regarding crew members at their station, although it was possible to apply a wide interpretation to the rule. Nevertheless, as it did not prevent the extended absence of a pilot from the flight deck, the policy regarding crew members at their station was assessed by the panel to be a failed defense.

Placing the camera

The placing of the camera between the armrest and the side-stick created a hazard. This went unrecognized initially, leading directly to the interference with the side-stick and the subsequent pitch-down. As such the panel assessed that the placing of the camera was a contributory factor.

Immediately after the camera was last used, the CVR indicated that the purser entered the flight deck and began a conversation with the captain. This conversation could have drawn the captain’s attention and so reduced his focus on the task of stowing the camera. It cannot be positively determined that the camera was put down at this time, but if it was the case, the panel assessed that distraction of the captain while using the camera was a possible contributory factor.

Likewise, the design of the side-stick area was considered a contributory factor. Interviews with the ZZ333 crew indicated that there was a known issue that inadvertent contact with the side-stick (most commonly by a knee) could result in the autopilot disconnected. Such incidents have been resolved immediately by re-engaging the autopilot. Data from Air Tanker Services indicated that there have been up to 26 incidents since the start of Voyager flying when the autopilot disconnected in the cruise by moving the side stick against the increased force.

Additionally, although when the seat moves the armrest is never less than 50mm from the side-stick, therefore it is no possible for the armrest itself to interfere directly with the side-stick, the operation of the seat when an item of appropriate size is located between the armrest and the side-stick could create a situation in which movement of the seat causes the side-stick to be moved out of the central position while the autopilot is engaged.

The armrest setting was also considered a contributory factor. As both captain and co-pilot had tall upper bodies, their required seat setting for operating the flying controls was lower than that of majority of pilots, that configuration would cause the armrest to have no vertical separation from the side-stick which increased the risk of an item becoming jammed. Moving the seat forward against a camera similar in size to the captain’s with the armrest at different settings din NOT result in the side-stick being held forward.

Other factors

A widespread lack of awareness regarding the risk of the side-stick interference was considered as contributory factor. The clean cockpit concept and the rendered regulatory article regarding the carriage of loose articles were the breached defenses that influenced this factor.
The lack of reporting regarding inadvertent operations of the side-stick and the lack of a register regarding flight deck control interference as an identified risk were assessed as a contributory factor
The movement of the captain’s seat without the interference with the side-stick being noticed, influenced by captain’s low arousal, distraction and cognitive lack of expectation was considered as a contributory factor

Summary of factors

The key factors which made the pitch-down command more likely were summarized as follows:

Individual acts

The carriage of the camera on the flight deck
The use of the camera in flight
The armrest setting
The placing of the camera behind the side-stick
The movement of the captain seat

Error promoting conditions

Low workload
Boredom and low arousal
The presence of only a single person on the flight deck for an extended period of time
Distraction
Cognitive lack of expectation

Organizational Influences

Normalized behavior regarding the carriage and treatment of loose articles
The RAF Brize Norton OSI into loose articles
The design of the side-stick area
A widespread lack of awareness regarding the risk of side-stick interference
The lack of reporting regarding inadvertent operations of the side-stick
The lack of an identified Duty Holder risk regarding flight deck control interference

Breached or failed defenses

The Voyager policy regarding non-relevant duties
The Voyager Operations Manual policy regarding crew members at their station
The Airbus FCTM advice on the “clean cockpit” concept
MAA Regulatory Article 2309 (carriage of loose articles)

Recommendations

The panel made several recommendations to the Royal Air Force, to the Brize Norton Air Base, to AirTanker Services Ltd, to AIRBUS

EXCERPTED FROM

Service Inquiry: incident involving Voyager ZZ333 on 9 February 2014 Final report. Published 19 March 2014. Last updated 23 March 2015 From UK Ministry of Defense and Military Aviation Authority.

FURTHER READING

USAF C130J accident in Afghanistan: the Prospective Memory Failure. A hard-shell night vision goggle (NVG) case placed and forgotten forward of the yoke
Normalization of Deviance: when non-compliance becomes the “new normal
Battling the Attraction of Distraction
The Organizational Influences behind the aviation accidents & incidents
Loss of flight crew airplane state awareness
Unrecoverable deviation from the intended flight path

**********************

_______________________

Some amendments were made to the article, Subsurface Defect on a high-pressure turbine stage 2 disk led to the uncontained engine failure on American Airlines flight 383, Oct. 28, 2016

via Subsurface Defect on a high-pressure turbine stage 2 disk led to the uncontained engine failure on American Airlines flight 383, Oct. 28, 2016

Descent below minimum permitted altitude, final report

Pitch-up illusion during a go-around at night. Again! Release date: 24 November 2017.

A number of autoflight mode selection errors, high workload, non-routine actions of the pilot flying, CRM issues and fixation, identified as contributing factors. Fatigue due to the time of day and time awake may have acted as a factor that increased risk.

vh-vcj-skytraders-airbus-a319-132_PlanespottersNet_439635

Photo (C) Lance C Broad – YBBN Spotters Group

DESCENT BELOW MINIMUM PERMITTED ALTITUDE INVOLVING AIRBUS A319, VH-VCJ

Near Melbourne Airport, Victoria | 15 May 2015

ATSB Transport Safety Report | Aviation Occurrence Investigation AO-2015-048

Final – 24 November 2017

THE OCCURRENCE

Introduction

On the evening of 14 May 2015 an Airbus A319, call-sign Snowbird Two (SND2) departed Perth, Western Australia for Melbourne, Victoria. The aircraft was registered as VH-VCJ and operated by Skytraders Pty Ltd as a passenger charter service with 5 crew and 18 passengers. The aircraft’s flight crew consisted of two captains. The pilot-in-command occupied the left seat and was the pilot flying (PF).1 The other captain occupied the right seat and was performing the pilot monitoring (PM) duties.

As the aircraft was positioning to commence the approach into Melbourne, the PF made a number of inadvertent autoflight mode selections, which led to the autothrust system disengaging and the engines entering the thrust lock condition. The PF’s actions to correct the thrust lock resulted in an unexpected increase in thrust. In response to the thrust increase, the PF made a number of pitchdown inputs and retarded the thrust levers. The pitch-down inputs, when combined with the increased thrust, resulted in the aircraft developing a high rate of descent with an accelerating airspeed. This led to the aircraft descending below the cleared altitude, as well as the triggering of a number of Terrain Avoidance and Warning System (TAWS) alerts. During the subsequent response to these alerts, the aircraft did not commence climbing for about another 10 seconds, and after two further TAWS alerts had activated.

Events leading up to the inadvertent autoflight mode selections Approaching Melbourne and before commencing descent, the flight crew set up the aircraft’s flight management guidance system and then briefed for an expected WENDY 1A standard arrival route (STAR) procedure, with an instrument landing system (ILS) approach to runway 16 for landing (Figure 1). Shortly after, air traffic control (ATC) cleared the aircraft for the WENDY 1A STAR. In the early morning of 15 May 2015, at about 0120 Eastern Standard Time (Coordinated Universal Time (UTC) + 10 hours), the aircraft commenced the descent into Melbourne.

The PF commenced the descent with the following autoflight systems and modes selected:

Autopilot 1 (AP1) was controlling the aircraft.
Lateral navigation was in the ‘navigation’ (NAV) mode, while vertical navigation was in the ‘descent’ mode, both of which were managed modes where the aircraft follows a pre-planned horizontal and vertical flight path loaded in the flight management guidance computer.
Autothrust system was on, with the thrust levers at the managed thrust position—the climb thrust detent that equated to a thrust lever angle of 22.5 degrees.

At 0128, SND2 called ATC and advised that the aircraft was on descent to a cleared altitude of 9,000 ft and that they had received ATIS information Romeo.

As SND2 approached waypoint KIKEX (Figure 1) at 0134:25, ATC cleared the aircraft to descend to 3,000 ft and for the ILS approach to runway 16. The PF set 3,000 ft into the altitude function of the aircraft’s flight control unit (FCU). At that time, the aircraft was passing 5,900 ft at an indicated airspeed of 253 kt.

Approaching waypoint NEFER, at 0135:30 and passing about 4,700 ft, SND2 commenced a left turn towards BOL (Figure 1). At 0136:38 the PF requested, and the PM selected, flap 1. The flaps reached this setting two seconds later. At 0136:39, the aircraft had completed the turn and rolled level on the NEFER to BOL track.

The inadvertent autoflight mode selections and following events

The following sequence of events, covering the next 39 seconds of flight, was drawn from the aircraft’s digital flight data recorder (DFDR), cockpit voice recorder (CVR) and crew interviews. This period can be divided into three distinct phases:

inadvertent FCU selections
thrust increases and the PF’s responses
recovery.

The sequence of events from 0136:35 is graphically presented in a data plot at Figure 2. Specific points on that data plot are identified to enable a clearer understanding of the rapidly changing events.

Inadvertent FCU selections

As the aircraft descended through 3,600 ft at 0136:39, the PF announced an intent to ‘arm the approach’. This required the PF to press the APPR (approach) pushbutton on the FCU. Instead, the PF pressed the EXPED (expedite) pushbutton (see Figure 3), resulting in the autoflight vertical mode changing from the open descent mode8 to the expedite descent mode9 (point 1). Over the next 5 seconds, the vertical descent rate increased from around 800 ft/min to around 1600 ft/min, while the airspeed remained stable at around 220 kt.

After a few seconds, the PM identified that the vertical mode had changed to expedite descent and announced this change to the PF. At 0136:44, upon recognising the incorrect mode selection the PF, in an apparent attempted to correct the error, pressed the A/THR (autothrust) pushbutton (to off) (point 2). Pressing the A/THR pushbutton had a number of effects:

The autothrust system disengaged and the engines’ thrust was locked at the thrust level prior to disconnection—idle thrust, which was the commanded thrust at that time (the thrust lock condition).
The master caution light and aural alert (a single chime) triggered.
The electronic centralised aircraft monitoring system THR LK message (thrust lock) was displayed, with an associated procedure.
A yellow flashing THR LK message was displayed in the flight mode annunciator on both pilots’ primary flight displays.

Almost immediately, at 0136:47, the PM recognised and announced the thrust lock condition. At about the same time, the autoflight system’s vertical mode transitioned to altitude acquire – ALT* on the vertical mode section (Figure 4), identifying that the autoflight system had captured the 3,000 ft target altitude.

At 0136:51, the PM announced that the aircraft had captured the target altitude. At about the same time the PF recognised the thrust lock condition and pressed the ‘instinctive disconnect’ buttons on both the side stick and thrust levers (see Figure 3). The PF later recalled that the intent behind that action was to reduce the aircraft’s airspeed and to retard the thrust levers. The use of the instinctive disconnect pushbuttons had the following effects:

The action of pressing the instinctive disconnect pushbutton on the sidestick disconnected the autopilot (point 3 in Figure 2), which in turn triggered the autopilot disconnect aural alert (‘CAVALRY CHARGE’). The CAVALRY CHARGE sounded for 1 second.
The pressing of the thrust lever instinctive disconnect pushbutton caused the thrust lock condition to disengage. It also removed the THR LK message from the electronic centralized aircraft monitoring system and the pilots’ flight mode annunciators. As the thrust levers remained set to the climb detent, the commanded thrust changed from idle to climb.

Thrust increases and the PF’s responses

At 0136:53 the engines began to respond to the commanded thrust change by rapidly increasing thrust (point 4). At about the same time, the PF reconnected the autopilot (point 5) but left the autothrust system disconnected. The PF responded to the rapidly increasing thrust by applying pitch-down inputs on the sidestick (point 6). The PF did not recall applying pitch-down input during post-occurrence interviews but did recall thinking that the aircraft was pitching up.

As a result of the PF’s pitch-down inputs on the side stick, at 0136:58 the autopilot disengaged (point 7). This disconnection again triggered the autopilot disconnect aural (CAVALRY CHARGE) alert, which sounded for 1 second. At the same time, the PF rapidly moved the thrust levers to idle (point 8). At this point, the aircraft’s airspeed was 240 kt and increasing, and the PM asked if the flaps should be retracted. The PF responded in the affirmative.

The PF’s pitch-down inputs, coupled with the aircraft’s high thrust level and the now downward flight vector, resulted in the aircraft’s airspeed and vertical rate of descent rapidly increasing (point 9). At 0137:00 the altitude warning (C CHORD aural alert) commenced. It continued to sound for 15 seconds. As the engine thrust reduced (from the thrust levers being moved back to idle) the PF transitioned from pitch-down to pitch-up inputs on the side stick (point 10). As a result, the rate of descent stabilised and then decreased.

At 0137:02, the first of the terrain avoidance and warning system (TAWS) alerts triggered. This alert, a ground proximity warning system Mode 1 SINK RATE caution, repeated twice. The PF responded by rapidly placing the thrust levers fully forward (point 11) and instructed the PM to advise ATC that they were ‘going around’. At 0137:05 the engines began to respond to the commanded thrust change and rapidly increased thrust (point 12). At the same time the second TAWS alert, an enhanced ground proximity warning system TERRAIN AHEAD, PULL UP, TERRAIN AHEAD warning activated, which ended after 3 seconds. The PF again responded to the rapidly increasing thrust by reducing the pitch-up inputs and then commencing pitch-down inputs (point 13). This reduced the rate at which the aircraft’s rate of descent was decreasing, which had the effect of prolonging the period that the aircraft was descending.

Recovery

At 0137:08 the PF began to introduce pitch-up commands, which further reduced but did not arrest the aircraft’s rate of descent (point 14). At 0137:13 the third TAWS alert, a ground proximity warning system Mode 2 TERRAIN TERRAIN PULL UP warning activated, ending after 2 seconds.

The PF responded with increasing pitch-up commands (point 15), which began to arrest the rate of descent. At 0137:15, the PM advised ATC that the aircraft was ‘going around’.

The lowest altitude attained by the aircraft during the occurrence, as recorded by the digital flight data recorder (DFDR), was 2,280 ft at 0137:17. At the same time, the flaps were recorded as being fully retracted. The lowest recorded height above ground level recorded by the radio altimeter was 1,100 ft. The aircraft’s maximum speed while the flaps were in the process of retracting was 314 kt.

At 0137:17, the ATC minimum safe altitude warning13 alert activated for SND2 at the ATC workstation. ATC data identified that the aircraft was descending through 2,300 ft at that time. The lowest recorded altitude by ATC was 2,200 ft. As the aircraft began to climb, ATC cleared the aircraft to climb to 4,000 ft and notified SND2 that a low altitude safety warning had triggered. The aircraft was cleared to and continued to climb to 5,000 ft. The flight crew requested vectors to intercept the ILS approach for runway 16. The aircraft landed on runway 16 at 0150 without further incident.

CONTEXT

Introduction

The Airbus A320 aircraft is a twin-engine, narrow body, short to medium range commercial passenger aircraft. The Airbus A320 family of aircraft comprises the A318, A319, A320 and A321 variants. Based on the original A320, the A319 is a shorter variant.

The air operator’s certificate authorised passenger charter operations using the Airbus A319. The operator used an A320 based simulator for training and proficiency checks.

Personnel information

Pilot recollection of the occurrence

The PM later recalled an impression that there was a lot of button pressing, as well as disconnecting and reconnecting of the autopilot during the event. The PM did not recall any TAWS alerts and neither pilot recalled hearing the altitude alert.

Cockpit voice recorder data identified that the PF did not verbalise any intention to change flight mode selections or other actions during the occurrence, other than the initial call identifying an intention to arm the approach.

The PM commented on the low lighting levels set for the flight instruments, which he considered may have resulted in a difficulty in identifying what selections the PF was making on the FCU.

The pilot flying

The pilot flying (PF) held an Air Transport Pilot (Aeroplane) Licence (ATP(A)L) and had accumulated about 17,250 hours of aeronautical experience. Of these, approximately 2,835 hours were on Airbus A320 type aircraft. In the 90 days preceding the occurrence, the PF had logged 69.5 hours, of which 57.1 were on A319.

The PF held a current Class 1 medical certificate, and as a condition of that certificate was required to wear distance vision correction and have available reading correction. These vision requirements were determined to have not influenced the occurrence.

About three months prior to the occurrence, the PF had completed a recurrent training session to a satisfactory standard in an A320 simulator, and in April 2015 a line check in an A319. The PF was current with all training requirements. The PF’s training reports identified that he had satisfactorily completed the required competency checks and was properly trained and proficient on the A320; however, of the 10 training records available that preceded the occurrence, there were two that contained reports of an occasional tendency to rush actions, and that this led to procedural lapses.

The PF was one of three flight crew employed by the operator authorised to conduct instrument training and checking on the A320 aircraft family. The PF was cross-trained on the operator’s other aircraft type, the CASA 212, and was also authorised to conduct training and checking on that type. Additionally, the PF held a management role, although the time required to conduct this role was reducing.

A significant proportion of the PF’s recent flight hours leading up to the occurrence were assigned to conducting check flights on the A319, rather than as the primary operating crewmember. The PF’s training and checking reports did not identify any recency or skill detriment resultant from the PF’s management and/or training roles. However, as the records were limited to approximately five years there was insufficient evidence to assess this further.

The pilot monitoring

The pilot monitoring (PM) held an ATP(A)L with a current Class 1 medical certificate and had accumulated about 12,290 hours of aeronautical experience, of which about 2,200 hours were on an Airbus A320 type aircraft. The PM was also a check and training captain. Prior to the occurrence, the PM had completed a recurrent training session in an Airbus A320 simulator in February 2015 and a line check in July 2014.

…

Human performance related information

As part of this investigation, several human factors-related aspects were considered in the context of the flight crew’s actions during the descent. These included the:

PF experiencing pitch-up illusions with thrust changes
PF inadvertently pressing the EXPED pushbutton and what could be considered other inadvertent actions by the PF
effect of fatigue
role of workload on both crew.

The pitch-up illusion

Pitch-up illusions are a vestibular misperception of acceleration, confused with a climb, and is amplified when visual cues are absent. Given that it was night-time, there would have been very limited visual cues outside the aircraft available to the pilots. The pitch-up illusion is also referred to as a somatogravic effect when referring to what the pilot experiences and is explained by Stott (2011) as follows:

…forward acceleration of the aircraft produces an equal inertial acceleration acting backwards on the pilot and increasing the sense of pressure from the back of the seat….The sensory information provided by the otolithic system is exactly similar to the…sensation of backward tilt…Thus from nonvisual sensations, a pilot is unable to distinguish between an actual backward tilt associated with the climb and an illusory sense of tilt associated with forwarding acceleration.

The pilot’s pitch-down inputs during the descent are consistent with this type of pitch-up illusion event.

Airbus perspective on pitch-up illusions

Airbus has identified the all-engine go-around as a specific manoeuvre where the pitch-up illusion can adversely affect the outcome of a normal procedure. In July 2011, Airbus published a procedural review of the all-engine go-around manoeuvre in their Safety First magazine.

The review was initiated as a result of a number of poorly handled all-engine go-arounds. Most real-world go-arounds were conducted at light weights and with high thrust. It was found that the likely consequence of not maintaining the correct pitch attitude during the go-around is acceleration towards the flap limit speed—when autothrust is not active, there is no speed protection to prevent a flap limit speed exceedance. A representation of the pitch-up, or what Airbus termed the false climb illusion, is shown in Figure 7.

The review included the following points pertinent to the second event, where the PF introduced pitch-down inputs while conducting the go-around manoeuvre:

All pilots must know the required initial pitch target for their aircraft BEFORE commencing a missed approach. They must maintain that pitch target by following the [speed reference system] commands in manual flight. With the autopilot engaged, they should use this knowledge to confirm the autopilot behaviour.

The go-around pitch target for the A320 was quoted as 15 degrees nose up, the importance of which was highlighted as follows:

During a manual Go Around, if the required pitch is not reached or maintained, linear acceleration will result. Research has shown that this may cause a “false climb illusion”. The false climb illusion may lead a pilot to believe that the aircraft is already above the required pitch. Consequently, a pilot may respond with an opposite and dangerous pitch-down input.

Inadvertent pilot actions

Regarding the PF’s inadvertent selection of the EXPED pushbutton, Reason (1990) stated that A slip is a type of error which results from some failure in the execution stage of an action sequence…These slips could arise because, in a highly routinized set of actions, it is unnecessary to invest the same amount of attention in the matching process….with oft-repeated tasks it is likely that [they] become automatized to the extent that they accept rough rather than precise approximations to the expected inputs.

Additionally, consideration was given to the outcome when similar objects (in this case, the pushbuttons A/THR, EXPED and APPR) were confused for each other. Perceptual confusion is a type of attentional slip and on that, Wickens and Hollands (2000) stated the following:

Perceptual confusions occur because a person may recognise a match for the proper object with an object that looks like it, is in the expected location or does a similar job…

The pushbuttons on the FCU were the same colour and size. Colour coding and placement of objects has an effect on perception, in the sense that if two items are the same colour, then using colour-coding can tie together items that are spatially separated on the display (Wickens and Hollands, 2000). Additionally, two items on a cluttered display will be more easily integrated or compared if they share the same colour (different from the clutter), but the shared colour may disrupt the ability to focus attention on one while ignoring the other.

In addition to considering objects of similar size and shape, the effect of flight deck lighting was also considered. Woodson and Conover (1964) described several important factors that should be considered in the design of any lighting system:

suitable brightness for the task at hand
uniform lighting for the task at hand
suitable brightness contrast between task and background
lack of glare from either the light source or the work surface
suitable quality and colour of illumination and surfaces.

With regard to the FCU pushbutton layout, lighting and colour coding (see Figure 5), the physical similarities (shape, size, and colour) and close proximities between the A/THR, EXPED and APPR pushbuttons on the FCU could have contributed to any perceptual confusion.

Decision making and conscious automaticity

Wickens and Hollands (2000) outline that when undertaking a task, we must translate the information that is perceived about the environment into an action and this action may be either an immediate response or based on a more thorough, time-consuming evaluation.

In relation to the PF’s reaction to the thrust lock condition, the limitations of decision making were considered, as was the concept of automatic actions. As outlined by Klein and Klinger (1991) cited in Harris (2011), naturalistic decision making is characterised by ‘dynamic and continually changing conditions, real-time reactions to these changes, ill-defined tasks, time pressure, significant consequences for mistakes’.

In instances where actions that have become well-learned, ‘it is as though practice leads to a mental repackaging of our behaviour…that can be set off with only a brief conscious thought…’ (Wheatley and Wegner, 2001). In this case, the PF pressing the instinctive disconnect buttons was achieved without any time-consuming conscious elements.

Fatigue

The International Civil Aviation Organization (ICAO 2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety-related operational duties.

Fatigue can have a range of adverse influences on human performance. These include:

slowed reaction time
decreased work efficiency
increased variability in work performance
lapses or errors of omission (Battelle Memorial Institute 1998).

Time of day can be important for determining whether an individual is in a circadian low or high.

Human circadian rhythm is partially determined by the environmental light-dark cycle (Duffy, Kronauer, & Czeisler, 1996). The challenge can be for people to maintain alertness during the night-time hours and reduced sleepiness during the daytime rest break.

The Civil Aviation Safety Authority (2012) stated the following:

The circadian cycle has two periods of sleepiness, known as the circadian trough and the circadian dip. The circadian trough occurs typically between 0200 and 0500 hours (or dawn). During the circadian trough the body’s temperature is at its lowest level and mental performance, especially alertness, is at its poorest.

In the context of time on duty, Goode (2003) identified numerous studies that show an empirical relationship between work patterns and deteriorating performance. In accidents where fatigue was attributed, 20 percent occurred in the tenth (or more) hour of duty.

Caldwell (2003) stated that ‘the primary determinant of the level of fatigue is the time awake since the last sleep period.’ Russo and others (2005) found that ‘significant visual perceptual, complex motor and simple reaction time impairments began in the 19th hour of continuous wakefulness.’ As part of an NTSB study of short-haul domestic air carrier accidents from 1978 to 1990, ‘time since awake’ was a predominant factor, and often related to ‘ineffective decision making’.

The following data was relevant to the PF’s fatigue assessment. The PF:

usually obtained about 7 hours of sleep a night between 2300 and 0600
had conducted two flights over the previous 3 days (one of which was a positioning flight)
duty ended at 2115 the previous day, resulting in a 17-hour break prior to starting duty on the day of the occurrence
woke at about 0600 and commenced duty in Melbourne at 1415
reported feeling well rested
positioned to Perth, before operating the occurrence flight
recalled feeling ‘okay’ around the time of the occurrence, but had been awake for about 19.5 hours.

The occurrence took place at about 0130, which was 11 hours and 15 minutes after the PF’s duty commenced. However, the descent was taking place close to a known window of circadian low.

Along with the night conditions, with a relatively low-level of lighting in the flight deck, this may have contributed to feelings of sleepiness.

The ATSB evaluated the PF’s level of fatigue using two biomathematical models, Fatigue Avoidance Scheduling Tool (FAST) and System for Aircraft Fatigue Evaluation (SAFE). These models are decision aids designed to assess and forecast performance changes induced by sleep restriction and time of day.

Both models indicated a moderate level of fatigue. The FAST results indicated that at the time of the occurrence, there was a moderate likelihood that the PF was experiencing a level of fatigue known to have a demonstrated effect on performance. The SAFE results predicted that the PF would have felt ‘moderately tired, let down’ at the time of the occurrence, and in a moderate to high-risk category for experiencing the effects of fatigue.

The following data was relevant to the PM’s fatigue assessment. The PM:

usually obtained about 7.5 hours sleep a night between 2300 and 0630
was on a rostered period of leave in the two weeks prior to the occurrence
was in Perth on the day of the occurrence and woke at about 0630 Western Standard Time and had therefore been awake for about 17 hours at the time of the occurrence
commenced duty in Perth at 1800
reported feeling well rested and having adequate sleep the night before the occurrence
did not report any fatigue-related concerns associated with the occurrence flight.

Operator fatigue management

Organisations holding an Air Operator Certificate are generally required to comply with the Civil Aviation Orders Part 48 Flight Time Limitations (CAO 48). However, the Civil Aviation Safety Authority had granted the operator an exemption from CAO 48, under a specific instrument. This exemption was in force at the time of the occurrence. In place of the CAO 48 limitations, the operator was required to observe specific flight and duty limits contained in schedules to the instrument. With respect to this occurrence, the following flight and duty limits were relevant:

where the previous duty period did not exceed 12 hours, the time free of duty shall be 10 hours
the maximum hours per flight duty period for a local start time between 1300 and 1459, with one or two sectors, was 13 hours
flight deck duty limits for operations involving two crew was 10 hours.

Workload

In the context of aviation, workload has been described as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady and Orlady, 1999). A person experiences workload differently, based on their individual capabilities and the local conditions at the time. These conditions can include the following:

training and experience in the situation at hand
the operational demands during that phase of flight
if the person is experiencing the effects of fatigue
level of automation in use, and the mental requirements in interpreting their actions.

Research on unexpected changes in workload during flight has found that pilots who encounter abnormal or emergency situations experience a higher workload with an increase in the number of errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983).

Additionally, Holmes and others (2003) outline that high workload and distractions can result in a pilot scanning fewer instruments and checking each instrument less frequently.

Pilot recency and skill decay

The Civil Aviation Safety Regulations CASR 1998 Part 61: Flight Crew Licencing outlines that recent experience, or recency, refers to undertaking particular flight operations in the past 90 days. These flying experiences include take-off and landings, or instrument approaches, for example. Recency will generally be measured by flight hours (Haslbeck and others, 2014) or sectors flown (Ebattson, and others, 2010).

The concept of maintaining recency is important to reduce flight skill decay. In a commercial aviation context, Childs and Spears (1986) suggest that cognitive and procedural elements of flying skills decay more rapidly than control-oriented skills. Pilots were observed to have difficulty correctly identifying cues and classifying situations, although once a situation was correctly classified, they remembered what to do. Therefore, they propose that flying training should focus on pilot monitoring skills and recognition of different situations.

Despite the PF having management responsibilities, the PF had almost 70 hours in the previous 90 days, albeit with a significant training duty component. As a result, there was insufficient evidence to determine whether recency and/or skill decay had any influence on the flight crew’s actions.

vh-vcj-skytraders-airbus-a319-132_PlanespottersNet_396167

Photo (C) Victor Pody

SAFETY ANALYSIS

While conducting an arrival procedure, prior to commencing an approach into Melbourne, Victoria on 15 May 2015, the Skytraders Airbus A319 descended to about 2,200 ft, which was below the ATC-assigned altitude of 3,000 ft. The crew broke off the arrival procedure and climbed to the new ATC cleared altitude of 5,000 ft before returning to land at Melbourne.

During the descent below 3,000 ft, the aircraft’s Terrain Avoidance and Warning System (TAWS) initiated a number of warning alerts, the speed limit for the aircraft flaps was exceeded, and the Minimum Safe Altitude Warning System (MSAW) initiated an alert to the ATC controller. Critically, during the 26 seconds from the time that the PF pressed the instinctive disconnect pushbutton on the thrust levers to when the aircraft reached its minimum altitude, the aircraft descended just over 1,000 ft and increased speed by about 100 kt.

The event was initiated by an inadvertent switch selection by the pilot flying (PF). This was followed by a combination of errors, rapidly changing events, high workload and an apparent response to a pitch-up illusion, resulting in the aircraft quickly developing a very high rate of descent and increasing airspeed.

Inadvertent FCU selections

As the aircraft was approaching the localiser for Melbourne runway 16, the PF recalled intending to arm the aircraft’s autoflight system (AFS) to capture the localiser for the approach. This required the PF to press the APPR pushbutton on the Flight Control Unit (FCU). Instead, the PF mistakenly pressed the EXPED pushbutton and the AFS entered the expedite descent mode. In an apparent attempt to cancel the expedite descent mode, the PF inadvertently pressed the A/THR pushbutton, which was adjacent to the EXPED pushbutton.

The acts of pressing the EXPED and then the A/THR pushbuttons were both predicated by a prior intention to act, but neither action went as planned. In this case, this prior intention was the pressing of the APP push button, which was part of a routine set of actions. Routine actions are generally characterised as requiring less attention.

The pressing of the A/THR was an apparent instinctive reaction to realising that an error had been made. Both selections were consistent with unintentional slips. Furthermore, the similar size, shape and colour of the EXPED and APPR buttons on the FCU, as well as their close proximity, may have contributed to the error. The lighting conditions on the flight deck may have increased the difficulty for the pilot monitoring (PM) to monitor the actions of the PF.

Reaction to ‘thrust lock’ condition

After the PF inadvertently pressed the A/THR pushbutton on the FCU, the Flight Mode Annunciator and Electronic Centralised Aircraft Monitor (ECAM) identified that the autothrust system had disengaged and the thrust locked at the existing setting, which was idle. The ECAM notified the flight crew of this change by displaying the THR LK caution message, as well as an associated procedure. The flight warning computer simultaneously sounded the caution aural alert, while the FMA’s autothrust column displayed the changed mode. The PM immediately identified this changed autothrust condition and verbally notified the PF of the change. It could not be determined whether this call was in response to the ECAM notification with associated master caution aural alert or the FMA change.

Normal procedure for disconnecting the autothrust system was to press the autothrust instinctive disconnect (I/D) pushbutton, but this procedure first required the pilot to match the position of the thrust lever with the actual thrust setting. The thrust lever angle indicator assisted in this process.

The aim of the THR LK ECAM procedure was to remove the engines’ locked thrust condition. That procedure also included matching the thrust lever position to the actual thrust setting.

On becoming aware that the engines’ thrust had been locked, the PF reacted by pressing the autopilot and autothrust instinctive disconnect pushbuttons, thereby removing the thrust lock condition. The likely intent of disconnecting both autopilot and autothrust was to revert to a fully manual flight mode. This is supported by the simultaneous disconnection of the autopilot and autothrust systems through the use of the instinctive disconnect buttons, an automatic action to complete the apparent intent.

However, in disconnecting the autothrust, the PF did not match the thrust levers to the current power or set the desired power. This was likely to be a lapse, which is ‘simply omitting to perform one of the required steps in a sequence of actions’ (Harris, 2011). As to why this lapse occurred, the PF’s incomplete response to the ‘thrust lock’ condition may have been a result of a response consistent with a perceived urgency to handle an undesirable state, particularly as the instinctive disconnect pushbuttons were designed for a quick response

High thrust with pitch-down attitude

As a result of not matching the thrust lever angle to the locked thrust setting when disengaging the thrust lock condition, the thrust increased to the climb setting at which the thrust levers were positioned. This resulted in a significant, unexpected thrust increase. The PF responded by applying pitch-down inputs on the side stick and a few seconds later retarded the thrust levers to idle. The pitch-down attitude with high thrust—the engines did not respond to the commanded thrust reduction for a further few seconds—resulted in the aircraft adopting a rapidly accelerating downward vector. At about this time the altitude alert began to chime and, shortly thereafter, the aircraft descended through its clearance limit altitude.

As the aircraft passed through the clearance limit altitude, the first of the TAWS alerts triggered. The PF responded with a declared intent to go-around and rapidly positioned the thrust levers to full power. However, the PF did not raise the aircraft’s pitch attitude to the recommended 15 degrees nose up for the conduct of a go-around. While the PF commenced some pitch-up commands, the aircraft’s attitude remained well below the horizon, resulting in a continuation of the accelerating airspeed and high rate of descent.

Just as the engines began to increase thrust, the second TAWS alert triggered. The procedural response to this second alert was to apply full backstick and maintain that position while setting the thrust to maximum power. However, the PF again responded to the increasing engine thrust with pitch-down commands, resulting in a continuation of the aircraft’s downward flight path. The PF arrested the descent after about 10 seconds, during which time a further TAWS alert triggered.

The flap overspeed

During the period of high thrust, the PM selected the flaps from 1 to UP as the aircraft was accelerating through 260 kt. The slats were not fully retracted for a further 12 seconds, by which time the aircraft had accelerated to more than 310 kt. The limit speed for flap 1 was 230 kt.

The effect of pitch-up illusions during rapid thrust increases

The PF did recall applying pitch-down side stick input during the rapid thrust increases and did not identify the increasing rate of descent, resulting from the nose-down attitude. The PF did, however, recall thinking that the aircraft was pitching up. Throughout the occurrence, the night conditions and operations within cloud resulted in the absence of a natural horizon. It was therefore likely that the PF’s pitch-down side stick inputs were in response to pitch-up (somatogravic) illusions caused by the unexpected and rapid increase in thrust. The PF’s susceptibility to the effects of pitch-up illusions was possibly exacerbated by also experiencing a high workload, which would likely reduce monitoring of flight instruments.

The effect of the pitch-up illusion influenced the breach of altitude, the EGPWS alerts, and the exceedance of the flap limit speed.

The PM’s ability to influence the events

The primary role of the PM is to monitor the aircraft’s flight path and performance and immediately bring any concern to the PF’s attention. However, Dismukes and Berman (2010) have shown that, while flight crew monitoring is an important defence that is performed appropriately in the vast majority of cases, it does not always catch flight crew errors and equipment malfunctions. They also noted:

…even though automation has enhanced situation awareness in some ways…it has undercut situation awareness by moving pilots from direct, continuous control of the aircraft to managing and monitoring systems, a role for which humans are poorly suited.

When considering whether the PM was likely to be able to identify and therefore influence the events that led to the flap overspeed and the breaching of the cleared altitude, the following factors were considered. The:

PM verbally identified the expedite descent mode change and the appearance of the ‘thrust lock’ condition
PM had difficulty in identifying the PF’s actions, being unable to see the PF selections on the FCU
lighting levels in the flight deck were low
reduced communication between the flight crew—specifically, the PF did not communicate an intended response to the expedite descent mode engagement, THR LK ECAM message, or the various autopilot disconnections and reconnections
PF did not announce mode changes annunciated on the FMA as required by the standard operating procedures, those changes being resultant from FCU and autoflight system inputs made by the PF
PF’s response to the thrust lock condition was contrary to normal procedure
PM’s attention was probably focused on the flap speed when the aircraft started to rapidly accelerate early in the occurrence. By the time that the PM had selected the flap up, the aircraft had developed a very high rate of descent and descended through the clearance limit altitude
PM recalled that there was ‘a lot of button pressing’ throughout the occurrence and that the autopilot was disengaged several times.

The period of time from the inadvertent FCU selections through to the aircraft returning to a positive rate of climb was short but characterised by rapidly changing events with multiple visual and aural alerts. The PM’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine nature of the event, actions of the PF, reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Crew workload

Pilots who encounter abnormal or emergency situations experience a higher workload with an increase in performance errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983). During the occurrence, the attention of the flight crew was likely divided between a number of different information cues and task requirements, from the time the PF made the inadvertent selections on the FCU, through to when the aircraft began to climb.

These included:

multiple aural warnings and alerts
identifying and responding to mode changes, including appropriate actions to address the THR LK ECAM message
disengagements and re-engagement of the autopilot
focus on airspeed (mostly by the PM)
interactions with ATC towards the end of the occurrence sequence.

At the time, the aircraft was in the descent phase, which inherently has a higher workload. The PM recalled that the workload became very high after the inadvertent FCU selections occurred. The high workload experienced by the PM was demonstrated in the use of an incorrect call sign during

ATC communications, as the aircraft started to climb out.

The degree of recollection from both crew after the occurrence also indicated that they experienced a high workload over a short period of time, as details including the numerous aural warnings (including the EGPWS), one of the inadvertent FCU selections and autopilot changes were not recalled. Overall, the high workload the flight crew experienced appeared to have limited their capacity to identify mode changes, such as autopilot disconnections, and to respond to the aircraft’s undesired high rate of descent.

Crew fatigue

The PF awoke at a normal time of 0630, signed on at Melbourne and did not report receiving any rest before or during the operation from Perth to Melbourne. It is reasonable to conclude that, due to time awake, time on duty and the time of day, the PF was probably experiencing a level of fatigue known to have at least some effect on performance. This was predicted by biomathematical fatigue models. There was, however, insufficient evidence to indicate that fatigue contributed to the occurrence. The ATSB also did not ascertain any systemic issues associated with the operator’s management of fatigue.

FINDINGS

From the evidence available, the following findings are made with respect to the descent below minimum permitted altitude involving an A319, VH-VCJ, near Melbourne Airport, Victoria on 15 May 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance.

A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

The pilot flying inadvertently selected the EXPED pushbutton instead of the APPR pushbutton, and, in an attempt to correct the error, pressed the A/THR pushbutton, creating a thrust lock condition.
In attempting to remove the thrust lock condition, the pilot flying pressed the instinctive disconnect pushbutton but did not move the thrust levers to match the locked thrust setting. As the thrust was locked at idle while the thrust levers were set to climb thrust, this resulted in an unexpected, significant thrust increase.
The pilot flying likely experienced pitch-up illusions during two rapid thrust increases and responded to these illusions with pitch-down sidestick input.
Pitch-down inputs by the pilot flying, combined with a very high thrust setting, resulted in a very high rate of descent with rapidly increasing airspeed. This led to the breach of the cleared minimum descent altitude, as well as triggering a number of Enhanced Ground Proximity Warning System alerts.
The rapidly changing aircraft state led to the crew experiencing a high workload. This was likely to have limited their capacity to identify mode changes and to respond to the aircraft’s undesired high airspeed and rate of descent.
The pilot monitoring’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine actions of the pilot flying, the reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Other factors that increased risk

At the time of the occurrence, the pilot flying was likely experiencing a level of fatigue known to have a demonstrated effect on performance, predominantly due to the time of day and time awake.
The aircraft’s rapidly increasing airspeed resulted in the limit speed for the extension of the aircraft slats being significantly exceeded.

SOURCE: Australian Transport Safety Bureau. Excerpted from Descent below minimum permitted altitude involving Airbus A319, VH-VCJ. Aviation Occurrence Investigation AO-2015-048. Final report – 24 November 2017

FURTHER READING

**********************

By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@SafelyWith. Human Factors information almost every day

_______________________

Intersection takeoffs? maybe you shouldn’t

By reducing the amount of runway used during takeoff, pilots have less runway available to them in the event of a system or engine malfunction during takeoff, to abort the takeoff or to perform an emergency landing. This increases the risk of injury, death and aircraft damage.

fig

Photo NTSB

NTSB Safety Alert. 071-17. September 2017

Do Your Takeoff Homework; Runway Length Matters. Understanding the Potential Hazards of Intersection Takeoffs

The problem

Typically used to save time, intersection takeoffs are a common practice in aviation, especially in general aviation operations. However, pilots may not fully understand the potential risks associated with conducting intersection takeoffs.

If an aircraft experiences a problem while conducting an intersection takeoff, the available runway remaining to abort the takeoff or perform an emergency landing is reduced or eliminated, resulting in greater risk of injury or aircraft damage.

Related accidents

The National Transportation Safety Board (NTSB) has investigated several accidents involving pilots who were conducting intersection takeoffs, including the following:

1. Instead of using the full runway length of 6,179 ft for takeoff, the pilot of a Monnett Sonex experimental amateur-built airplane chose to conduct an intersection takeoff with about 2,570 ft of available runway. Shortly after takeoff, the airplane lost engine power and impacted parked vehicles near the departure end of the runway during the pilot’s attempt to turn back for an emergency landing (figure 1 shows the airplane’s takeoff and flightpath). Had the pilot used the entire runway for takeoff, there likely would have been sufficient available runway remaining to land the airplane following the loss of engine power. (CEN15FA249)

Fig 1

Figure 1. Map showing Monnett Sonex airplane’s flightpath

2. A sport pilot of a Luscombe 8A and his flight instructor initiated takeoff from a runway intersection, eliminating nearly 700 ft of usable runway. About 100 ft above the runway, the engine lost partial power.

With insufficient runway remaining on which to land and obstacles at the end of the runway that made a straight-ahead, off-airport landing hazardous, the flight instructor attempted to maneuver toward the ramp area adjacent to the runway. The airplane experienced an aerodynamic stall, impacted the runway in a nosedown attitude, and came to rest inverted (figure 2 shows the main wreckage). In addition, the airplane was 68 pounds over its maximum gross weight and density altitude was over 2,000 ft, which affected the airplane’s performance. The flight instructor sustained serious injuries and the sport pilot sustained fatal injuries. (ERA12FA491)

Fig 2

Figure 2. Main wreckage of Luscombe 8A

3. For schedule expedience, the pilot of a Piper PA-32 airplane, operated as a 14 Code of Federal Regulations Part 135 flight, chose to conduct an intersection takeoff using 5,550 ft of an 8,700-ft-long runway (figure 3 shows an overview of the runway environment). After takeoff, the airplane experienced a partial loss of engine power. The airplane stalled at a low altitude during the pilot’s attempt to return to the runway and impacted airport property. One passenger died, five sustained serious injuries, and one person sustained minor injuries. Based on the accident flightpath, the additional 3,150 ft of runway likely would have been sufficient to enable a straight-ahead landing on the runway after the power loss rather than a turnback. (WPR13LA045)

Fig 3

Figure 3. Runway overview

What can you do?

Allow adequate time for preflight preparations and taxiing to eliminate time pressure to conduct an intersection takeoff.
Do your homework. Know your aircraft’s takeoff and landing performance limitations based on gross weight, density altitude, and other considerations in the event of a malfunction that would require an aborted takeoff or emergency landing.
Communicate the plan. Ensure your pretakeoff briefing to yourself and/or your crew addresses potential emergency situations.
If you do perform an intersection takeoff, clearly communicate your intention to conduct an intersection takeoff, your position, and planned departure, via local air traffic control procedures to alert potential conflicting traffic.
Do not feel obligated to accept an intersection takeoff if it is offered to you by air traffic control.
For most takeoffs, use all available runway length to increase your margin of safety. Recognize that using anything less than the full length of the runway is accepting a higher level of risk.
In the event you need to return to the airport or runway, remember that an aerodynamic stall can occur at any airspeed, at any attitude, and with any engine power setting.

The companion video to this safety alert

Interested in more information?

The FAA’s “Airplane Flying Handbook” (FAH-H-8083-3B), chapter 5, “Takeoffs and Departure Climbs,” provides guidance regarding proper takeoff procedures. Takeoffs may seem simple but often present the most hazards of any phase of flight.
The FAA’s “Pilot’s Handbook of Aeronautical Knowledge” (FAA-H-8083-25B), chapter 2, “Aeronautical DecisionMaking,” provides pilots a systematic approach to determine the best course of action in response to a given set of circumstances.
An article in the July 2004 issue of Flight Training Magazine, an Aircraft Owners and Pilots Association publication, discusses the importance of alerting potentially conflicting traffic of the intent to conduct an intersection takeoff.
NTSB report AAR-08/03/SUM discusses a 2006 fatal accident in which a de Havilland DHC-6-100 being operated as a local parachute operation flight lost power in the right engine shortly after an intersection takeoff.

The reports for the accidents referenced in this safety alert are accessible by NTSB accident number from the Aviation Accident Database link, and each accident’s public docket is accessible from the Accident Dockets link for the Docket Management System. Safety Alert Prevent Aerodynamic Stalls at Low Altitude (SA-019) can be accessed from the Aviation Safety Alerts link.

SOURCE: Excerpted from NTSB Safety Alert. 071-17. September 2017

**********************

_______________________

Eastern Air Lines Runway Excursion at La Guardia, final report

Several failures in close succession by a jetliner’s flight crew were the probable cause of Oct. 27, 2016, runway excursion at La Guardia Airport, according to the National Transportation Safety Board’s final report issued September 21, 2017. Some recurrent training issues were identified as contributing factors.

abc_pence_plane_dc_161027_16x9_992

Photo (C) ABC news

FACTUAL INFORMATION

History of Flight

Landing-flare/touchdown: Landing area overshoot

Landing-landing roll: Runway excursion (Defining event)

On October 27, 2016, about 1942 eastern daylight time, Eastern Air Lines flight 3452, a Boeing 737-700, N923CL, overran runway 22 during the landing roll at LaGuardia Airport (KLGA), Flushing, Queens, New York. The airplane travelled through the right forward corner of the engineered materials arresting system (EMAS) at the departure end of the runway and came to rest off the right side of the EMAS. The 2 certificated airline transport pilots, 7 cabin crewmembers, and 39 passengers were not injured and evacuated the airplane via airstairs.

The airplane sustained minor damage. The charter flight was operating under the provisions of 14 Code of Federal Regulations Part 121. Night instrument flight rules conditions prevailed at the airport at the time of the incident, and an instrument flight rules flight plan was filed for the flight, which originated at Fort Dodge Regional Airport (KFOD), Fort Dodge, Iowa, about 1623 central daylight time.

The first leg of the trip began on October 14, 2016, and the captain and first officer were paired from then to the incident. In post-incident statements, the flight crew indicated that the captain was the pilot monitoring (PM) for the incident flight, and the first officer was the pilot flying (PF). The first officer reported that the autopilot and autothrottles were engaged beginning about 2,500 ft after their takeoff from KFOD. Both pilots stated that the en route portion of the flight and the descent into the terminal area were uneventful but they encountered moderate to heavy rain during the final 15 minutes of the flight.

According to information from the airplane’s cockpit voice recorder (CVR), the first officer partially briefed the instrument landing system (ILS) approach for runway 13 beginning about 1848, indicating an autobrake setting of 3 and a 30º flap setting. ATIS information “Bravo” was current at that time and indicated visibility 3 miles in rain, ceiling 1,500 ft broken, overcast at 2,200 ft, wind from 130º at 9 knots, and that braking action advisories were in effect. About 1852, the first officer began briefing the ILS approach for runway 22 after the captain clarified, based on the ATIS recording, that runway 13 was being used for departures.

About 1902, as the airplane descended through 18,000 ft msl, the flight crew completed the approach briefing for runway 22, with the same autobrake and flap setting as indicated earlier, as well as the decision altitude and visibility required for the approach, the touchdown zone elevation, and a reference speed (Vref) of 137 knots. ATIS information “Charlie” was current at that time and indicated visibility 3 miles in rain, ceiling 900 ft broken, overcast at 1,500 ft, and wind from 120º at 9 knots.

The flight crew also discussed the captain manually deploying the speed brakes (the airplane’s automatic speed brake module had been deactivated 2 days before the incident and deferred in accordance with the company’s minimum equipment list (MEL), with corrective action scheduled for November 4, 2016). In reference to the manual deployment of the speed brakes, the captain stated at 1902:44.5 “you’re gonna do these. I’m gonna do this” to which the first officer replied “[that] is correct.”

About 1927, the flight was provided vectors to the final approach course for the ILS approach to runway 22. About 1936, the flight was cleared for the approach. The first officer then called for the landing gear to be extended and the flaps set at 15º. About 1937, the captain stated that the localizer and glideslope were captured. About 1938, as the airplane neared the final approach fix, the flight crew completed the landing checklist and configured the airplane for landing, with flaps set to 30º.

The CVR indicates that the captain pointed out the approach lights about 1939. The first officer reported, and flight data recorder (FDR) data indicate, that about 1940:12, he disconnected the autopilot when the airplane’s altitude was about 300 ft radio altitude, as required by Eastern Air Lines standard operating procedure. FDR data indicate that the first officer disconnected the autothrottles about 1940:19.

FDR data indicate that, shortly after the first officer disconnected the autopilot and autothrottles (about 300 ft radio altitude), the airplane began to increasingly deviate above the glideslope beam and crossed the threshold at a height consistent with the threshold crossing height of the VGSI, which was not coincident with the glide slope beam. CVR data indicate that between 1940:35 and 1940:46, the enhanced ground proximity warning system alerted the decreasing altitude in increments of 10, beginning at 50 ft. The pitch attitude started to increase in the flare from 2.8° at a radio altitude of about 38 ft. After the 20-ft alert, the captain stated “down” at 1940:43.3. After the 10-ft alert, the captain stated, “down down down down you’re three thousand feet remaining” at 1940:46.6. There was no callout of spoilers or thrust reversers during the rollout on the CVR.

FDR data and performance calculations indicate that the airplane crossed the runway threshold at a radio altitude of 66 ft, with an increasing glideslope deviation and a descent rate of about 750 ft per minute. When the airplane had travelled about 2,500 ft beyond the runway threshold, its descent rate decreased to near zero, and it floated before touching down. The captain later reported that the descent to the touchdown zone was normal until the flare. He stated that the airplane floated initially in the flare, which prompted the captain to tell the first officer to “get it down.”

The first officer recalled hearing the captain’s instruction to “put [the airplane] down” during the flare but was not certain how far down the runway the airplane touched down. FDR data indicate that at 1940:51.8, the airplane’s main landing gear touched down; maximum manual wheel brakes were applied at main gear touchdown. The throttles were not fully reduced to idle until about 16 seconds after the flare was initiated, and after the airplane had touched down.

The touchdown point was about 4,242 ft beyond the threshold of the 7,001-ft-long runway. The nose gear initially touched down about 2 seconds after the main landing gear but rebounded into the air due to aft control column input. The nose gear touched down a second and final time at 1940:56.8.

The captain reported that, as briefed, he manually deployed the speed brakes, which FDR data indicate were manually extended to full at 1940:56.3, about 4.5 seconds after the main landing gear touched down and the airplane had travelled about 1,250 ft farther down the runway from the touchdown point. At 1940:59.8, when the airplane had travelled about 1,650 ft down the runway from the touchdown point (and 5,892 ft from the threshold), maximum reverse thrust was commanded. The captain reported that he saw the end of the runway approaching and began to apply maximum braking, as well as right rudder because he thought it would be better to veer to the right rather than continue straight to the road beyond the end of the runway.

The first officer reported that the captain did not, as required in the operator’s procedures, tell him that he was attempting to brake and steer the airplane during the landing rollout, and no such callout is recorded on the CVR. The first officer stated that the airplane was pulling to the right “really hard,” which prompted him to apply left rudder. He reported that the left rudder input was counter to his expectation due to a 9-knot crosswind from the left, which he expected to counteract with right rudder input. He attempted to maintain alignment with the runway centerline by applying left rudder and overriding the autobrakes with pressure on the brake pedal.

At 1941:08.3, the CVR recorded the sound of rumbling, consistent with the airplane exiting the runway. The airplane then entered the EMAS about 35 knots groundspeed and came to rest 172 ft beyond the end of the runway and to the right of the EMAS. Review of the CVR recording revealed that, after the airplane came to a stop, the first officer twice remarked that they should have conducted a go-around, and the captain agreed. The first officer later reported that he did not believe the approach or landing were abnormal at the time. The captain later stated that he should have called for a go-around when the airplane floated during the flare.

1084064

Photo (C) REUTERS Lucas Jackson

Flight Crew Information

Pilot 1

Pilot 2

Meteorological Information and Flight Plan

meteo Meteo

At 1851 EDT, (ASOS) at KLGA reported the wind from 090° true at 9 knots, visibility of 3 statute miles (sm), moderate rain, ceiling broken at 900 ft agl, overcast clouds at 1,500 ft agl, temperature of 13°C and a dew point temperature of 11°C, and altimeter setting of 30.14 inches of mercury. Remarks included: surface visibility of 4 sm, precipitation accumulation of 0.14 inch since 1751 EDT.

At 1951 EDT, KLGA ASOS reported the wind from 100° true at 10 knots with gusts to 15 knots, visibility of 3 sm, moderate rain, mist, ceiling overcast at 1,000 ft agl, temperature of 13°C and a dew point temperature of 12°C, and an altimeter setting of 30.10 inches of mercury. Remarks included: surface visibility of 4 sm, precipitation accumulation of 0.32 inch since 1851 EDT, precipitation accumulation of 0.61 inch during previous 3 hours.

Wreckage and Impact Information

Crew: 11 Injuries: None

Passenger: 37 Injuries: None

Ground Injuries: N/A

Total 48 Injuries: None

Aircraft Damage: Minor

Aircraft Fire: None

Aircraft Explosion: None

Latitude, Longitude: 40.769167, -73.885000

As a result of the airplane’s travel through the EMAS, pulverized EMAS material (a gray, powdery residue) was noted on portions of the airplane’s exterior during postincident examination. The lower and forward portions of the airplane—fuselage, landing gear, and antennas—were coated with a dried residue resulting from the mixture of the EMAS material and rainwater. In addition, pieces of a matting material used in the EMAS were found in various locations on the airplane.

No damage or anomalies were noted during the visual examination of the nosewheel landing gear and associated assemblies. A preliminary visual examination of the main landing gear strut, doors, assemblies, associated hydraulic lines, and antiskid components did not reveal evidence of physical damage. However, after the airplane was cleaned of EMAS debris and the main landing gears were retracted, damage was noted on the underside of each gear strut. The operator indicated that the lower wire bundle support brackets for the left and right main landing gear were both damaged, as well as the wire conduit sleeve on the left main landing gear.

Each of the four main wheel tires showed cut damage in addition to normal wear. None of the observed cuts were deep enough to reach the tire treads. No flat spots or other evidence of hydroplaning was noted on any of the tires. Examination of the four brake assemblies found no evidence of damage or hydraulic leaks. No evidence of a hydraulic power malfunction or damage to any of the visible hydraulic lines was noted.

Both engines showed evidence of EMAS material and matting on the engine inlet and internal components. The No. 1 engine sustained fan blade damage, including four blades bent in the direction opposite of rotation, at the tip corner. No visible blade damage was noted on the No. 2 engine. Visual examination of the thrust reversers found no preincident anomalies. The operator later reported that, after cleaning and deploying the thrust reversers, damage was found on the inboard thrust reverser sleeves and blocker doors for both engines.

Cv3l6IcXEAAVTA8

Photo (C) NTSB

Examination of the speed brake control components on the incident airplane noted the speed brake handle positioned full forward. All spoiler panels, including the ground spoilers, were found in the down or retracted position. No damage was noted to any of the ground spoilers.

Communications

No problems with communications equipment were reported.

Flight Recorders

The airplane was equipped with a cockpit voice recorder (CVR) and a flight data recorder (FDR). Both recorders were removed from the airplane and retained by the NTSB for further examination and readout at the NTSB’s Recorder Laboratory in Washington, DC. The recorders showed no signs of damage.

Cockpit Voice Recorder

The CVR, a Honeywell 6022, serial number 3452, was a solid-state CVR that recorded 120 minutes of digital audio. It was played back normally without difficulty and contained excellent quality audio information. The recording was transcribed in two parts focusing on the en route approach briefing and the approach, landing, and events thereafter until the end of the recording. Part one began at 18:48:06 EDT, when flight 3452 was en route at FL390, and continued until 1902:52 EDT. Part two began at 1918:01 EDT and ended at 1948:32 EDT (the end of the recording

Flight Data Recorder

The FDR, a Honeywell 4700, serial number SSFDR-16936, recorded airplane flight information in digital format using solid-state flash memory as the recording medium. The FDR could record a minimum of 25 hours of flight data and was configured to record 256 12-bit words of digital information every second. The FDR was designed to meet the crash survivability requirements of Technical Standard Order C-124.

Data from the FDR were extracted normally. The event flight was the last flight of the recording, and its duration was about 2 hours and 19 minutes.

Medical And Pathological Information

Eastern Air Lines conducted drug and alcohol testing for both pilots about 6 hours after the incident. Test results were negative for alcohol and major drugs of abuse.

Organizational And Management Information

Company Overview and Management Organization

Eastern Air Lines, Inc., received certification to operate as a Part 121 supplemental carrier on May 15, 2015. Subsequently, Eastern Air Lines began scheduled charter services to Havana and four other cities in Cuba. Before the incident, the airline also launched charter service to other Latin American and Caribbean destinations. The airline’s sole base of operations was at Miami International Airport, Miami, Florida, at the time of the incident. It employed 64 pilots and had a fleet of five Boeing 737 airplanes, including the incident airplane; the other four airplanes were Boeing 737-800 series.

The airline’s vice president of flight operations was responsible for the flying operations of the airline, flight crew training, the operations control center (OCC), and ground operations. The chief pilot, manager of flight operations training, director of inflight, OCC director, manager of flight standards, and manager of charter operations all reported to the vice president of flight operations.

At the time of the incident, Eastern Air Lines’ director of safety and security reported directly to the chief executive officer and was the only staffed position in the safety department. The director of safety and security had been hired about 2 weeks before the incident and was in the process of being trained by his predecessor, who had held the position from 2013 until September 2016. While he was being trained, the vice president of regulatory compliance served as the acting director of safety and security.

According to the vice president of flight operations and the manager of flight operations training, the Boeing 737 Flight Crew Training Manual and the Boeing 737 Flight Crew Operations Manual were used as the airline’s systems training material and procedures manual, respectively.

Safety Management

The FAA approved Eastern Air Lines’ safety management system (SMS) implementation plan in February 2016. The first segment of implementation included administering the SMS implementation plan and developing a tool (Aviation Resource Management Solutions) that was designed to help the company with safety risk assessment, assurance, and risk management. The former director of safety and security stated that, at the time of the incident, the first segment of the implementation was not fully realized and they were working toward an October 30, 2016, full implementation date.

Crew Resource Management (CRM) and EMAS Training

The manager of flight operations training at the time of the incident was also a check airman. He had been manager of training for about 1.5 years and had been with the company for 2 years.

The airline provided three courses on CRM: new hire, captain’s upgrade, and recurrent. The new hire CRM course consisted of a 2-hour segment covering CRM background, communications processes and decision behavior, team building and leadership, workload management and situational awareness, individual factors and stress reduction, and error management. The upgrade training included 1 day of ground school in which 1 hour was dedicated to CRM. Upgrade training also incorporated a captain’s leadership course that included content on the captain’s authority, briefings, workload management, and sterile cockpit procedures in accordance with 14 CFR 121.542, “Flight Crewmember Duties.” The recurrent training included a 3.5-day ground school for captains and first officers in which 1 hour was devoted to CRM training. All courses were taught using presentation slides, open discussion, and videos created by contracted training organizations.

The captain reported after the incident that he believed he and the first officer were working well as a crew during the trip. He stated that he did not call for a transfer of controls during the landing rollout and that, in hindsight, he should have. He further mentioned that he thought it was “OK” for both crewmembers to be applying brakes. The first officer reported a “lack of communication” during the landing rollout because the captain did not say that he was taking control of the airplane. Another Eastern Air Lines first officer who had flown with the captain before the incident described the captain’s CRM as “good.”

At the time of the incident, EMAS training was not part of Eastern Air Lines’ pilot training program. The captain stated during postincident interviews that he had forgotten that an EMAS was installed at the end of runway 22, that he had read about the systems, but had not had any training on them.

FAA Oversight

The former FAA principal operations inspector (POI) stated that he had been assigned to Eastern Air Lines before the company received its operating certificate. He stated that his duties included, most critically, surveillance and reviewing the airline’s manuals, including any changes to the manuals. He traveled to the airline’s headquarters about once or twice a week.

He also stated that he interacted most with the operations management, director of safety and security, and the CEO.

The former director of safety and security stated that during his time at Eastern Air Lines, he “seldom” interacted with the FAA POI or other FAA personnel. Other management personnel stated they interacted with the FAA daily or multiple times per week, via telephone, e-mail, or in person at the FAA’s office or at Eastern Air Lines’ office. The manager of flight operations training stated that he did not directly interact with the POI and usually went through the vice president of flight operations or the chief pilot. The vice president of flight operations stated that they had been assigned a new POI 5 months before the incident and that the interaction with the new POI was “really great.”

The FAA POI at the time of the incident reported that he mostly communicated with Eastern Air Lines’ director of flight operations and chief pilot but had also communicated with the director of flight training. He categorized the communication as “very good.” He added that Eastern Air Lines was the only certificate he managed and that FAA resources were limited such that they only had one person in the office who was able to conduct checkrides in the Boeing 737. He estimated that he was at Eastern Air Lines’ operations a “couple of times a week;” however, he had not taken part in Eastern Air Lines’ pilot training. He also stated that the training in the manual for a go-around was similar to the syllabus used by other airlines, and he “assumed” that they did some go-around training in the flare and some training in low visibility. The POI stated that, following the incident, he and Eastern Air Lines management had discussed training go-arounds once the airplane was on the ground and that further discussion was needed.

Additional Information

Sterile Cockpit Regulations

The CVR also contained conversation between the flight crew during the descent and approach below 10,000 ft that was not pertinent to the flight. Title 14 CFR 121.542, “Flight Crewmember Duties” states, in part, the following:

No flight crewmember may engage in, nor may any pilot in command permit, any activity during a critical phase of flight which could distract any flight crewmember from the performance of his or her duties or which could interfere in any way with the proper conduct of those duties. Activities such as…engaging in nonessential conversations within the cockpit and nonessential communications between the cabin and cockpit crews…are not required for the safe operation of the aircraft.

…critical phases of flight include all ground operations involving taxi, takeoff and landing, and all other flight operations conducted below 10,000 feet, except cruise flight.

Runway Condition Reports from Other KLGA Arrivals

Flight crews from four flights that landed on runway 22 within 10 minutes of the incident flight reported braking as “good” or “fair.” One crew reported noticing their airplane’s antiskid brake system pulsating during the landing rollout. Others reported that there was no hydroplaning or decrease in braking performance.

ANALYSIS

Automatic terminal information service (ATIS) “Bravo” was current when the first officer, who was the pilot flying, began to brief the instrument landing system approach for runway 22. The ATIS indicated visibility 3 miles in rain, ceiling 1,500 ft broken, overcast at 2,200 ft, wind from 130º at 9 knots, and that braking action advisories were in effect. The approach briefing included the decision altitude and visibility for the approach and manual deployment of the speed brakes by the captain, with the captain stating “you’re gonna do these. I’m gonna do this” to which the first officer replied “[that] is correct.” (The airplane’s automatic speed brake module had been deactivated 2 days before the incident and deferred in accordance with the operator’s minimum equipment list, which was appropriate).

The flight crew completed the approach briefing after descending through 18,000 ft mean sea level and completed the landing checklist when the airplane was near the final approach fix.

The airplane was configured for landing with the autobrake set to 3 and the flaps set to 30º.

ATIS information “Charlie” was current at that time and indicated visibility 3 miles in rain, ceiling 900 ft broken, overcast at 1,500 ft, and wind from 120º at 9 knots.

Flight data recorder (FDR) data and postincident flight crew statements indicate that the airplane was stabilized on the approach in accordance with the operator’s procedures until the flare. The airplane crossed the runway threshold at 66 ft radio altitude at a descent rate of 750 ft per minute. When the airplane had traveled about 2,500 ft beyond the runway threshold, its descent rate decreased to near zero, and it floated during the flare. Its pitch attitude started to increase in the flare from 2.8° at a radio altitude of about 38 ft, which is high compared to the 20 ft recommended by the Boeing 737 Flight Crew Training Manual. Further, the first officer didn’t fully reduce the throttles to idle until about 16 seconds after the flare was initiated and after the airplane had touched down. The initiation of the flare at a relatively high altitude above the runway and the significant delay in the reduction of thrust resulted in the airplane floating down the runway, prompting the captain to tell the first officer to get the airplane on the ground, stating “down down down down you’re three thousand feet remaining.”

The airplane eventually touched down 4,242 ft beyond the runway threshold. According to the operator’s procedures, the touchdown zone for runway 22 was the first third of the 7,001-ftlong runway beginning at the threshold, or 2,334 ft. Touchdown zone markers and lights (the latter of which extended to 3,000 ft beyond the threshold) should have provided the flight crew a visual indication of the airplane’s distance beyond the threshold and prompted either pilot to call for a go-around but neither did. The point at which the airplane touched down left only about 2,759 ft remaining runway to stop. The airplane’s groundspeed at touchdown was 130 knots.

The captain manually deployed the speed brakes about 4.5 seconds after touchdown and after the airplane had traveled about 1,250 ft down the runway. Maximum reverse thrust was commanded about 3.5 seconds after the speed brakes were deployed, and, with fully extended speed brakes and maximum wheel brakes (which were applied at main gear touchdown) the airplane achieved increasingly effective deceleration. Its groundspeed was about 35 knots when it entered the EMAS. With the effective deceleration provided by the fully extended speed brakes, maximum wheel brakes, and reverse thrust, the flight crew would have been able to safely stop the airplane if it had touched down within the touchdown zone.

The captain later stated that he had considered calling for a go-around before touchdown but the “moment had slipped past and it was too late.” He said that “there was little time to verbalize it” and that he instructed the first officer to get the airplane on the ground rather than call for a go-around. He reported that, in hindsight, he should have called for a go-around the moment that he recognized the airplane was floating in the flare. The first officer said that he did not consider a go-around because he did not think that the situation was abnormal at that time.

Training and practice improve human performance and response time when completing complex tasks. In this case, the operator’s go-around training did not include any scenarios that addressed performing go-arounds in which pilots must decide to perform the maneuver rather than being instructed or prompted to do so. Thus, the incident flight crew lacked the training and practice making go-around decisions, which contributed to the captain’s and first officer’s failure to call for a go-around.

Following the incident, the operator incorporated go-around training scenarios in which flight crews must decide to go around rather than being instructed to do so. The company’s director of operations also stated that the company has incorporated scenarios in which go-arounds are initiated from idle power and rejected landings are performed after touchdown with the automatic speed brake inoperative. It also added a training module emphasizing that “if touchdown is predicted to be outside of the [touchdown zone], go around” and intended to require a go-around if landing outside of the touchdown zone were predicted. The operator also intended to incorporate go-around planning into the approach briefing. Flight crews would determine the cues for the touchdown zone using the airport diagram and decide at which point they would initiate a go-around if the airplane had not touched down.

Given the known wet runway conditions and airplane manufacturer and operator guidance concerning “immediate” manual deployment of the speed brakes upon landing, the captain’s manual deployment of the speed brakes was not timely. NTSB analysis of FDR data for previous landings in the incident airplane determined an average of 0.5 second for manual deployment of the speed brakes. Using the same touchdown point as in the incident, post incident simulations suggest that, if the speed brakes had been deployed 1 second after touchdown followed by maximum reverse thrust commanded within 2 seconds, the airplane would have remained on the runway surface. Therefore, the captain’s delay in manually deploying the speed brake contributed to the airplane’s runway departure into the EMAS.

During the landing roll, the captain did not announce that he was assuming airplane control, contrary to the operator’s procedures, and commanded directional control inputs that countered those commanded by the first officer. The captain later reported that he had forgotten that an EMAS was installed at the end of runway 22 and attempted to avoid the road beyond the runway’s end by applying right rudder because he thought it would be better to veer to the right. However, the first officer applied left rudder to maintain alignment with the runway centerline and to counter the airplane pulling “really hard” to the right because of the captain’s inputs. The breakdown of crew resource management during the landing roll and the captain’s failure to call for a go-around demonstrated his lack of command authority, which contributed to the incident.

At the time of the incident, EMAS training was not part of the operator’s pilot training program, but such training was added after the incident. The circumstances of this event suggest that the safety benefit of EMASs could be undermined if flight crews are not aware of their presence or purpose.

PROBABLE CAUSE AND FINDINGS

The National Transportation Safety Board determines the probable cause(s) of this incident to be:

The first officer’s failure to attain the proper touchdown point and the flight crew’s failure to call for a go-around, which resulted in the airplane landing more than halfway down the runway. Contributing to the incident were, the first officer’s initiation of the landing flare at a relatively high altitude and his delay in reducing the throttles to idle, the captain’s delay in manually deploying the speed brakes after touchdown, the captain’s lack of command authority, and a lack of robust training provided by the operator to support the flight crew’s decision-making concerning when to call for a go-around.

Findings

Aircraft Landing flare – Not specified (Factor)

Personnel issues Use of policy/procedure – Copilot (Cause)

Use of policy/procedure – Flight crew (Cause)

Lack of action – Flight crew (Cause)

Delayed action – Copilot (Factor)

Delayed action – Pilot (Factor)

Decision making/judgment – Pilot (Factor)

Organizational issues Recurrent training – Operator (Factor)

Excerpted from National Transportation Safety Board Aviation Incident Final Report DCA17IA020

FURTHER READING

**********************

_______________________

The numerous safety deficiencies behind Helios Airways HCY 522 accident

Behind the well-known primary cause of this accident were less-known and less-discussed numerous regulatory and organizational factors that still can be found in many countries and airlines worldwide.

Helios

Lack of political commitment to supply the aviation authority with the resources to carry out fully its safety oversight function, safety regulatory authority not organized and staffed to effectively accomplish its regulatory and safety oversight duties, absence of leadership and oversight, inadequate work climate, operator’s incomplete management structure with qualifications of some managers not corresponding to job descriptions, airline’s philosophy and style of management not conducive to efficient and safe operations with weak work climate, large percentage of staffing with seasonal employees, reactive approach of safety management, quality assurance not effective and deficiencies in operator’s procedures and training, are some of the factors identified.

Sounds familiar?

It’s a longish reading but worth it. So, get your favorite chair, a very big cup of Colombian coffee and enjoy!

********

Hellenic Republic Ministry of Transport & Communications Air Accident Investigation & Aviation Safety Board (AAIASB), Helios Airways Flight HCY522 Aircraft Accident Report. Boeing 737-31s at Grammatiko, Hellas on 14 August 2005

Published 11 / 2006

Operator: Helios Airways

Owner: Deutsche Structured Finance & Leasing Gmbh & Co

Manufacturer: Boeing Co

Aircraft Type: B 737 – 31s

Nationality: Cyprus

Registration : 5B-DBY

Place of accident: Hilly terrain in the vicinity of Grammatiko village, approximately 33 km northwest of Athens International Airport 38º 13.894’ N, 23º 58.214’ E

Date and time: 14 AUGUST 2005 – 09:03:32 h (Notes: 1. All times in the report are Coordinated Universal Time (UTC) (Local time in Hellas was UTC + 3 h). 2. Correlation of the times used in the radar and radio communication recordings, and the FDR and CVR showed differences of less than 12 seconds. The FDR time was used as the master time in this report.)

SYNOPSIS
On 14 August 2005, a Boeing 737-300 aircraft, registration number 5B-DBY, operated by Helios Airways, departed Larnaca, Cyprus at 06:07 h for Prague, Czech Republic, via Athens, Hellas. The aircraft was cleared to climb to FL340 and to proceed direct to RDS VOR. As the aircraft climbed through 16 000 ft, the Captain contacted the company Operations Centre and reported a Take-off Configuration Warning and an Equipment Cooling system problem. Several communications between the Captain and the Operations Centre took place in the next eight minutes concerning the above problems and ended as the aircraft climbed through 28 900 ft. Thereafter, there was no response to radio calls to the aircraft. During the climb, at an aircraft altitude of 18 200 ft, the passenger oxygen masks deployed in the cabin. The aircraft leveled off at FL340 and continued on its programmed route.
At 07:21 h, the aircraft flew over the KEA VOR, then over the Athens International Airport, and subsequently entered the KEA VOR holding pattern at 07:38 h. At 08:24 h, during the sixth holding pattern, the Boeing 737 was intercepted by two F-16 aircraft of the Hellenic Air Force. One of the F-16 pilots observed the aircraft at close range and reported at 08:32 h that the Captain’s seat was vacant, the First Officer’s seat was occupied by someone who was slumped over the controls, the passenger oxygen masks were seen dangling and three motionless passengers were seen seated wearing oxygen masks in the cabin. No external damage or fire was noted and the aircraft was not responding to radio calls. At 08:49 h, he reported a person not wearing an oxygen mask entering the cockpit and occupying the Captain’s seat. The F-16 pilot tried to attract his attention without success. At 08:50 h, the left engine flamed out due to fuel depletion and the aircraft started descending. At 08:54 h, two MAYDAY messages were recorded on the CVR.
At 09:00 h, the right engine also flamed out at an altitude of approximately 7 100 ft. The aircraft continued descending rapidly and impacted hilly terrain at 09:03 h in the vicinity of Grammatiko village, Hellas, approximately 33 km northwest of the Athens International Airport. The 115 passengers and 6 crew members on board were fatally injured. The aircraft was destroyed.
The Air Accident Investigation and Aviation Safety Board (AAIASB) of the Hellenic
Ministry of Transport & Communications investigated the accident following ICAO practices and determined that the accident resulted from direct and latent causes.

map1

FACTUAL INFORMATION

…

Personnel Information

1. Captain

The Captain was male, 59 years old.

He held an Air Transport Pilot License (ATPL) issued on 27 February 1991 in accordance with JAR-FCL by LBA Germany. His ATPL license, his instrument rating category III, and his Boeing 737-300 and -800 ratings were valid until 4 June 2006.

He had attended engineering college in Dresden, East Germany from 1966 to 1970 and graduated as a pilot-engineer. He had held an ATPL issued in 1970 by the Civil Aviation Authority in East Germany.

Medical Certificate: Class A, Medical Certificate issued on 21 March 2005 and valid until 9 October 2005 with the restriction to carry two pairs of corrective lenses.

Last LPC/OPC 4 June 2005

Recurrent Training in STD 4 June 2005

Last Line Check 12 June 2005

CRM training 2 June 2005

Flying experience:

Tabla 1

The Captain had worked for the Operator for two separate time periods. According to interviews of his peers at the Operator, during the first period, he presented a typical “command” attitude and his orders to the First Officers were in command tone. During the second period, his attitude had improved as far as his communication skills were concerned.

According to an oral statement by the next of kin, the Captain was a quiet and professional pilot. His hobby was to construct and fly model aircraft. He used no drugs or medication, and he used alcohol occasionally and with moderation.

2. First Officer

The First Officer was male, 51 years old.

He held an Air Transport Pilot License (ATPL) issued in accordance with JAR-FCL by the United Kingdom. His ATPL license and Boeing 737-300 and -800 ratings were valid until 31 March 2006 and his instrument rating category III was valid until 31 October 2005.

He had attended and graduated from Chelsea College with an Engineering Diploma. He was also trained at Oxford Air Training School to become a pilot.

Medical Certificate: Class A Medical Certificate issued on 25 April 2005 and valid until 29 October 2005 with no restrictions.

Last OPC 9 March 2005

Last Line Check 3 February 2005

Recurrent training in STD 9 March 2005

CRM training 28 February 2005

Flying experience:

Tabla 2

The First Officer spent the day preceding the accident at his summer house with the family. He drove home in the evening, had a normal dinner (no alcohol) and he went to bed at about 23:00 h. He woke up early in the morning and drove to the airport in order to report for duty on time.

According to statements by his next of kin, colleagues, and friends, the First Officer was an optimist, calm, active and a social person. He had expressed his views several times about the Captain’s attitude. He had also complained about the organizational structure of the Operator, flight scheduling and he was seeking another job. He used no drugs or medication and he did not smoke or drink alcohol.

In his last three OPCs, there were the following remarks/recommendations:

9 March 2005 “Standards achieved, but with room for lots of improvement. Some difficulties met in complex tasks. Do not rush through check lists. Recommendation – improve your understanding on the use of AFS”.

3 September 2004 “Overall standard is above average. Very Good LVO recognition of abnormalities. EMERGENCY DESCENT [capital letters used by the TRE] repeated at very good standard. Keep the good work”.

13 April 2004 “Overall performance at standard – Good Manual control, and 1 ENG G/A. –Make positive control is advisory after engine failure on T/OFF not to lose direction. Repeat – OK”.

In addition, the First Officer’s training records were reviewed for the five years he worked for the Operator. The review disclosed numerous remarks and recommendations made by training and check pilots referring to checklist discipline and procedural (SOP) difficulties.

3. Cabin Attendants

There were four cabin crew members on board, all of which met Operator proficiency and medical requirements.

…

Cabin Attendant number four also held a UK Commercial Pilot License (JAR CPL A/IR) with an issue date of 2 October 2003, and valid until 1 October 2008. His JAA Class 1 Medical Certificate was valid from 15 July 2005 to 17 July 2006.

…

Medical and Pathological Information

…

The Captain’s samples (obtained on 18 August 2005) tested negative for major drugs of abuse, volatile poisons, and prescription and over-the-counter medications. Due to the presence of extensive burns, the determination of blood alcohol level was not possible.

The Captain’s heart muscle samples revealed the presence of minor atherosclerosis (40% obstruction) compatible with his age. A histological examination revealed the presence of recent myocardial ischaemia.

The First Officer’s samples (obtained on 15 August 2005) tested negative for carbon monoxide, volatile poisons, major drugs of abuse, and prescription and over-the-counter medications. Although ethanol was detected (34 mg/dl, or 0.034 % weight/volume – also known as blood alcohol content), the toxicological reports stated that “the time period between the death and the collection and the analysis of specimens (24 hours) may have resulted in postmortem ethanol production.” The First Officer’s heart muscle samples revealed the presence of extensive atherosclerosis (90% obstruction in the anterior descendant and circumflex coronary artery). A histological examination revealed the presence of recent myocardial ischemia.

The Department of Cardiology of the Hellenic Air Force Medical Centre predicated that “On the basis of the data that were given to us, such as the height of the flight, the fact of the existing heart function (pump function) upon crashing, and the fact that there is a similar pathologo-anatomical image both in the ‘suffering’ heart (myocardium) of the co-pilot, and in the ‘healthy heart’ of the pilot, we estimate that the brain hypoxia was the dominant and determinant cause that incapacitated the flying crew, with the findings of the heart being the matter of course and epiphenomenon of the prolonged hypoxia.”

ANALYSIS

…

1. Crew

Based on indubitable evidence, the Board concluded that the pressurization mode selector was in the MAN (manual) position from the time the aircraft was still on the ground and was led to believe that the selector had remained in the MAN (manual) position after the Pressure Leak Test, the last known time the particular selector had been manipulated. When the aircraft departed, the pressurization mode selector remained in the MAN (manual) position (instead of AUTO) and remained there until the aircraft impacted the ground almost three hours later. Naturally, the fact that the mode selector position was not rectified by the flight crew during the aircraft preflight preparations was crucial in the sequence of events that led to the accident.

pressurization

Both the Captain and the First Officer were experienced pilots and had performed the preflight duties numerous times in the past. The Board examined the reasons why they could have made such a crucial omission.

Preflight duties included checking the Equipment Cooling switches, the Cabin Pressurization Panel, and the flight crew oxygen masks. When the pressurization mode selector is positioned to the MAN (manual) position, it is accompanied by an advisory, green light indicating MANUAL. Normally, with the mode selector on AUTO as prescribed by the Preflight Procedure, no illuminated indication should appear on the pressurization panel. Why an experienced crew would have failed to notice the presence of an indication they did not normally expect to see at this location in this phase of flight?

Why an experienced crew would have failed to notice the presence of an indication they did not normally expect to see at this location in this phase of flight?

A typical Preflight Procedure may contain between 40 and 80 actions to be performed by the First Officer, often under the pressure of the impending departure, and in the presence of a Captain who is waiting to call for the ensuing checklist. This procedure is performed from memory, aided by the fact that the actions are organized along the topographical location of panels in the cockpit. Memorization is beneficial for long lists of actions, but has the disadvantage that actions are performed automatically, without conscious effort and attention. This can and has, in the past, led to inadvertent omissions and other types of mistakes.

The Board was also sensitive to the fact that automatic execution of actions was very much affected by assumptions – in the case of performing a large number of verification steps, the assumption that all switches and indications were in the usual, normal for this phase of flight position. A superfluous green indication on the pressurization panel could be easily (inadvertently) overlooked when the perception was biased by the expectation that it should not be present.

Exacerbating this tendency (expectation bias) is the rarity with which switches (especially, and directly relevant to this case, the pressurization mode selector) are in other-than-their-normal position. A pilot automatically performing lengthy verification steps, such as those during preflight, is vulnerable to inadvertently falsely verifying the position of a switch to its expected, usual position (i.e. the pressurization mode selector to the expected AUTO position) – especially when the mode selector is rarely positioned to settings other than AUTO.

The Board was concerned that the overhead panel design was not conducive to safeguarding against these types of inadvertent omissions. Specifically, the color of the illuminated indication (green) does not typically imply something out of the ordinary, as did the amber (caution) or red (warning) – which would have likely attracted the flight crew’s attention that something was out of the ordinary.

After the Preflight Procedure, the crew was expected to orally execute a Preflight Checklist. Per the carrier’s FCOM, this checklist included a check of the pressurization panel:

[item 12 of 25] AIR COND & PRESS ………___PACK(S), BLEEDS ON, SET

The flight crew failed to detect the improper configuration of the pressurization panel during this checklist. Both the Captain and First Officer had repeatedly accomplished this checklist on many flights during their long careers. Their failure to properly accomplish the above checklist prevented them from capturing their earlier mistake. This was the first of two missed opportunities to notice and correct an earlier error. Various factors could have contributed to this failure.

The Board first examined the design of the checklist, and specifically the fact that the challenge part of this action item (“Air Cond & Press”) essentially combined two separate systems (air conditioning and pressurization). While this combination was certainly not random (the two systems used engine bleed air as an energy source), the corresponding response portion of the action item (“Pack(s), Bleeds ON, SET”) contained three different confirmations, only the third of which referred to the pressurization panel. In turn, this third confirmation referred to eight different actions – those that were performed earlier, during the Preflight Procedure. Contrary to the manufacturer’s original intention, however, many pilots informally reported that when performing the checklist and responding “SET” to the pressurization panel, they really only checked that the landing and cruise altitudes had been correctly set in the corresponding indicators.

The performance of checklists in routine, daily flight operations was also examined. In general, checklist items are performed by referencing a printed card. Like procedures, because they are performed repeatedly on the line, they are also performed by memory, typically in time-pressured circumstances (i.e. indirect pressure to maintain on-time departures). For these two reasons, checklists are often performed in a hurried, automatic fashion. From a human factors standpoint, rushing is known to lead to the inadequate allocation of attention to the task at hand – and thus to errors. Furthermore, like procedures, checklists are also vulnerable to “looking without seeing” because they are biased by the assumption that since each item verified an action performed only moments ago, then it must be already in the desired position/set.

Following takeoff, the flight crew was to perform an After Takeoff checklist, the first item of which was to check the pressurization system again and verify its settings. Although this checklist would have directed the flight crew’s attention to the pressurization panel, there was no evidence that the incorrect position of the pressurization mode selector was rectified. This was the second missed opportunity to note and correct an earlier error.

After Takeoff checklist is also usually performed under even more time pressured conditions and at a time when the pilots’ attention is consumed by other, concurrent tasks (e.g. retracting the landing gear and flaps, monitoring the climb, and communicating with ATC). The management of multiple concurrent tasks requires the division of attention resources and is known to force a person to devote insufficient attention to any one of the many tasks.

At an aircraft altitude of about 12 000 ft the cabin altitude warning horn sounded. Eight seconds later, the FDR showed the autopilot being disengaged, and re-engaged four seconds later. Eight seconds later, the FDR showed the auto-throttle being disengaged and the throttles retarded, but like the autopilot it also was re-engaged nine seconds later. Three seconds later, the No.2 radio was used to contact the Helios Airways Dispatcher.

The Board examined the flight crew’s actions to disengage the autopilot and auto-throttle, and to retard the throttles upon onset of the warning horn. Given that the expected reaction to a cabin altitude warning horn would have been to stop the climb (there was no evidence to this effect), the Board considered such actions to signify that the flight crew reacted to the warning horn as if it had been a Takeoff Configuration Warning (the two failures use the same warning horn sound). Similar occurrences had been reported by flight crews worldwide in the past.

Various factors for creating the potential confusion of the two experienced pilots were considered:

In the course of his career, a pilot is generally likely to only hear the warning horn when it is associated with a takeoff and a takeoff configuration problem and most pilots are not very likely to experience a cabin pressurization problem and the associated warning horn at any time during their line flying.
Stress, such as that caused by the onset of a loud, distracting alarm in the cockpit, combined with the element of surprise, is known to lead to automatic reactions. Automatic reactions, in turn, are typically those that result from experience and frequency of encounter and are therefore not always appropriate. The Board considered that the flight crew may have automatically reverted to a reaction based on memory before consciously processing the source and significance of the stress factor. This would also explain why the flight crew failed to realize the improbability of their interpretation of the horn as a takeoff configuration horn and why they failed to move on to gathering information for a new, correct diagnosis of the problem at hand. It is important to note that at no time during this sequence of events was the cabin altitude warning horn canceled.
According to FDR data, at an aircraft altitude of about 17 000 ft, the MASTER CAUTION light was activated and was not canceled for 53 seconds. Two different events occurred at about this time, either one of which would have triggered the MASTER CAUTION light with the accompanying OVERHEAD indication on the Annunciator Panel to draw the attention of the pilots to a situation indicated on the Overhead Panel. The equipment cooling low flow detectors reacted to the decreased air density and one or both of the Equipment Cooling lights illuminated on the Overhead Panel. In addition, the oxygen masks deployed in the passenger cabin, illuminating the PASS OXY ON light, located further aft on the Overhead Panel. The Board was unable to determine which event occurred first and triggered the MASTER CAUTION. However, the fact that the flight crew had not canceled the first MASTER CAUTION meant that the second event did not trigger a second MASTER CAUTION as it was already on. Consequently, there was nothing to prompt the flight crew to look for a second indication on the Overhead Panel.
At the time of onset of the MASTER CAUTION (and the OVERHEAD indication), workload in the cockpit was already high.
Language difficulties between the Captain and the Helios Operations Centre, probably due to the fact that the Captain spoke with a German accent and could not be understood by the British engineer prolonged resolution of the problem, while the aircraft continued to climb. Moreover, the communication difficulties could also have been compounded by the onset of the initial effects of hypoxia.
The Board recognized that from a human factors standpoint, preoccupation with one task (i.e. trouble-shooting the source of the Equipment Cooling problem) at the expense of another (i.e. trouble-shooting the source of the warning horn) was entirely plausible and has happened to experienced pilots.
The combination of hypoxia and distractions generally increases stress levels. Stress is known to render human cognition (e.g. memory, attention, decision-making, risk management, communication skills) particularly vulnerable to errors
The flight crew of HCY522 did not exhibit adequate CRM to help overcome the individual errors and to detect a dangerous situation that deteriorated as the aircraft continued to climb.

Given the ongoing distractions, the Captain, at least, may never have consciously and fully registered the onset of the indications and/or their significance. Unfortunately, although there were partial data to somewhat deduce the Captain’s actions at this time (from his communication exchanges with the Operator’s dispatcher and engineer), there was no possibility to establish the First Officer’s actions during this same time.

The Board evaluated what the cabin crew’s reactions might have been when the aircraft continued to climb and there was no announcement from the flight deck. There was no Operator procedure to address such a contingency. As emphasized by the Cabin Crew Manager in his post-accident statement, however, cabin crews were encouraged to take initiative. The Manager expressed his conviction that the particular cabin crew was well trained and by nature fully bound to have taken the initiative to seek an explanation for the unusual situation they were facing. The Board considered the fact that even if this was the case, it was hard for a cabin crew to assess how long to wait before contacting the flight deck – and in this case, time was of the essence as the hypoxia effects grew increasingly stronger. It was not possible to determine whether any of the cabin crew members attempted to contact the flight crew or enter the flight deck.

Data from the CVR only contained to the last 30 minutes of the accident flight and showed that at least one cabin crew member retained his consciousness for the duration of the flight and entered the flight deck more than two hours after takeoff. At the beginning of the climb phase, this cabin attendant was likely seated next to the aft galley.

In order for him to have moved forward in the aircraft to reach the flight deck, he must have used a portable oxygen bottle.

The Board found the fact that this cabin attendant might not have attempted to enter the flight deck until hours after the first indication that the aircraft was experiencing a nonnormal situation quite puzzling. Of course, in the absence of a longer-duration CVR, it was not possible to know whether this or any other cabin crew member had attempted to or succeeded in entering the flight deck. From the sounds recorded on the CVR, however, the Board could ascertain that this cabin attendant entered the cockpit using the emergency access code to open a locked cockpit door.

2. Operator

2.1 Maintenance

Based on evidence from the Helios Airways Technical Department documents relevant to manpower planning, the front line maintenance task force group consisting of four to five licensed engineers and two to three mechanics, changed, as far as the individual persons of the first group were concerned, by more than 80 % three times within 16 months (oldest EMPLOYMENT DATE: 01/11/2003 – first END DATE: 04/03/2005). The longest stay with Helios Airways up to 14 August 2005 was 21 months and the shortest three days. Both example cases above were licensed engineers and categorized as “Permanent” in the column “Employment Status” of the document. The same column contained another category, “Contract”, reserved for those licensed engineers hired through employment agencies.

Between November 2003 and August 2005 (one week before the accident occurred), 13 licensed engineers (six different European nationalities) were employed by the Helios maintenance department and subsequently left Helios. Six of them were contracted, which meant that they were paid by the employment agency that placed them with the airline. The Board believed that the very high turnover rate of maintenance personnel was not conducive to establishing and maintaining a sense of continuity and teamwork among employs, and this probably worked against setting a good foundation for proactive management and resolution of any issues in the maintenance department.

This situation has been raised as a Non-Conformance Report (NCR) during an audit carried o April 2005. The certifying staff level (number of licensed engineers), not including the Maintenance Manager, was annotated in the NCR as insufficient to meet the requirements of Part 145. The manpower plan appeared to only be a guide and did not fully reflect the current status of manpower usage or requirements. Despite the corrective action to the NCR stated by the Operator’s maintenance management to improve the situation, the responses by airline management continued to prove inadequate to provide the necessary resources and financial support.

The former Technical Manager of the Operator was asked why he resigned in January 2005 after having served the company for more than four years. He answered that the reason for his decision was the mismanagement in cases such as:

a) Staffing of key posts e.g. Quality Manager, Flight Operations Manager, with individuals who either did not have the required qualifications by the Operator’s Policy prerequisites, or did not possess managerial competence;

b) Lack of business planning;

c) Incoherent corporate operations; and

d) Occasional coverage of personnel requirements in all specialties of the corporate operations.

2.2. Crew scheduling

According to the records made available to the Board, the crew duty times were within limits and followed the prescribed standards. However, in view of these records and a number of statements made to the Board, it had reservations on this subject, given that the records submitted required extensive examination to validate flight and duty times for the flight crew. The Board noted that inspectors/auditors in previous audits had annotated comments that the Captain’s Deviation Reports (CDRs) showed flight and duty times that exceeded the approved limits and were not recorded or reported to the DCA.

The Board also noted statements that the scheduling of flights was based on unrealistic flight times for some routes in order to ensure flight planned adherence to flight time limitations which subsequently were exceeded

2.3. Crew Training

According to the Helios Flight Training Manual, the simulator training syllabus included rapid decompression situations, but not gradual decompression (slow loss of pressurization) situations. Consequently, the flight crews were likely not sensitized to monitoring and detecting a more insidious, gradual loss of pressurization situation.

The Board identified a specific requirement for training of both flight and cabin crews on the phenomena associated with hypoxia. However, based on witness statements, the Board was led to believe that this requirement was not fulfilled in practice but remained a requirement “on paper.” The Board noted that this situation was not unique to Helios Airways, because the lack of hypoxia training to sensitize flight crews to detecting an insidious gradual decompression or non-pressurization of the aircraft during climb, was a common situation in the airline industry.

Interviews with a number of cabin crew members (including Cabin Chiefs) revealed a number of deficiencies. In particular, cabin crews appeared confused and responded differently to questions that concerned the number and type of oxygen masks on the B737 flight deck, the availability and exact procedure of means available to open the cockpit door, and whether passenger oxygen masks provided breathable oxygen at high altitude.

Furthermore, deficiencies were also identified in the Operator’s procedures that prescribed actions to be taken in the event that, after passenger oxygen mask activation, the aircraft did not begin to descend or at least to level-off. However, it was also determined that other airlines in Cyprus and in Greece did not have such procedures documented in their manuals.

The Board found training deficiencies and inconsistencies. Although it was determined that some of these issues were probably not implicated in the accident, some aspects of the procedures determined at Helios could be considered unsafe.

3. Organizational Issues

The management structure at Helios Airways at the time of the accident was incomplete, notably the position of the Manager Training Standards. The Flight Operations Manager had assumed the responsibilities of the Manager Training Standards, pending a reorganization of the Operations Division and the arrival of the new Chief Operating Officer at the beginning of August 2005. Furthermore, the Chief Pilot was in a position to deputize for the Training Manager Standards. The qualifications of some of the interviewed managers did not correspond to the qualifications listed in their job descriptions. These deficiencies in management may have been related to the failure of the Operator to recognize and take appropriate corrective actions to remedy the chronic checklist and SOP omissions exhibited by the First Officer and documented in his training records.

The Accountable Manager was characterized as unapproachable, with little regard or concern for safety or for the well-being of the company employees, and whose only interest was the profitability of the Operator.

The Board acquired the sense that the overall philosophy and style of management at Helios Airways was not conducive to efficient and safe operations. This impression was corroborated by the UK inspector’s comments in July of 2004 expressing concern about the potential that flight safety was being compromised due to “the lack of operational management control” and the hesitancy with which some improvements were made, were noted by another inspector a year later.

The Board considered potential implications of the multi-national staff composition at Helios Airways and how they might have affected the safety of flight operations. Multinational teams often led to a weak work climate because people of different cultural groups operated based on a set of values and perceptions unique to their common historical/social/geographical background. These types of differences might lead to communication and collaboration problems.

Another area of concern that arose from the composition of Helios Airways staff stemmed from the large percentage (33%) of staffing with seasonal (part-time) employees. Naturally, this was expected for companies whose operations mainly catered to the tourist industry and were, by definition, seasonal. The short-term hiring of pilots and engineers when the operational tempo and demands were significantly higher in the spring and summer allowed the airline to maintain a skeleton staff to cover the less loaded winter months. Insofar it affected work climate, however, frequent changes in staff composition could be detrimental to the development of professional and personal ties, and did not promote the required level of comfort among employees, and among employees and management, particularly with respect to the submission and discussion of incidents and problems. Employees lacked a sense of continuity, both for their own job as well as that of their colleagues, and cockpit and cabin crew did not have the opportunity to develop operational experience together in various routine and non-routine situations. Employees, finally, did not develop a feeling of ownership and responsibility towards operations and the Operator.

Provisions existed in manuals for an accident prevention/safety management program at Helios Airways. However, it was not at all clear whether the Operator adhered to the standards set forth in the relevant publications. Furthermore, these standards seemed to promote a reactive approach rather than emphasizing the benefits of a more effective, proactive stance to safety management. More important, the standards did not clearly and definitively outline the role and responsibility of management (a key element in any safety management program) in ensuring and maintaining safe operations of the company. The Board found reasons for further concern in the statement by the Chief Operating Officer of Helios Airways. By referring to tight schedules both for employees and aircraft utilization, the Chief Operating Officer appeared to suggest that both resources were utilized to the limits. The Board noted that tight scheduling, work under time pressure and considerable amounts of overtime work were not conducive to maintaining a safe work environment. These conditions were likely a fertile basis for human factor errors in flight operations and aircraft maintenance.

Management pilots appeared to be insufficiently involved in their managerial duties, this led the Board to note that the Operator lacked the mechanism and means to sufficiently and correctly monitor its pilots and to take decisive and corrective action when and as necessary.

Training and duty records were found to be incomplete, with no evidence of any type of a follow-up.

Manuals were found to be in part deficient; they did not always adhere to regulations, and on some issues they were out of date. This suggested that an underlying pressure was prevalent to proceed with little regard for the required formalities (which often equaled an assurance for safety).

Lastly, the Board also reviewed the actions of the Ground Engineer team that conducted maintenance on the aircraft prior to its departure, so as to form an opinion about the operation of the maintenance department at Helios Airways as a whole. The inexplicable inconsistencies in the actions that were or were not performed, the actions recorded, and the actions described as having been performed by Ground Engineer No. 1 on the morning of 14 August 2005 were considered by the Board to confirm the idea that the Operator was not effectively promoting and maintaining basic elements of safety in its culture.

4. Department of Civil Aviation in the Republic of Cyprus

At the time of the accident, the Safety Regulation Unit (SRU) was diachronically not organized and staffed to effectively accomplish its regulatory and safety oversight duties. The main problems that characterized the Unit and each of its three Sections (Operations, Airworthiness, and Licensing) already back in 1999 (the time of the first available audit report) appeared to still persist to this day, as evidenced by the various evaluation reports reviewed. The number of employed personnel was insufficient in relation to the actual workload. The mission and strategy of each Section, including its processes and standard operating procedures, appeared not to be officially laid out in writing. Selection and training criteria and resources, as well as detailed job descriptions, were not available. By extension, the qualifications, training, and hands-on expertise of most employees were probably inadequate. Vital positions (e.g. Head of the Operations Section) remained vacant. Some key functions (e.g. issuance and validation of air transport pilot licenses; issuance and record-keeping of medical certificates) were not performed. Other key functions (e.g. inspections) were possibly not accomplished per schedule because qualified personnel was not readily available and external resources had to be relied on.

This diachronic absence of leadership and oversight both across and within the three Sections presented a major obstacle that hindered the effective work of any one of the Sections. The resulting work climate within the SRU was not conducive to good performance even by qualified personnel; this became apparent in the nature of the oral statements given by the employees that included charges and complaints, as well as direct accusations and finger-pointing. Given the situation within the SRU, it was probably difficult for the Unit to instill a level of esteem from the aviation industry, and specifically in the areas and activities that it was tasked to regulate and oversee.

To accomplish its safety oversight duties, the Unit relied heavily on the UK CAA to furnish (based on a contractual agreement) inspectors to carry out the ICAO and EU required inspections. Based on the contractual agreements between the Cyprus DCA and the UK CAA, the role of the latter was undoubtedly intended to be advisory in nature. In reality, however, the DCA appeared to have been fostering and maintaining a relationship of complete dependence on the UK CAA, and, in most cases, appeared to be simply accepting its services without questioning them and without making an effort to assume ownership and thus build on them. The Board was particularly concerned to find that almost all of the Operator’s audit reports until about the time of the accident were signed by the UK CAA inspectors without any comments and/or a signature by an employee of the Cyprus DCA. Where the situation at the audited Operator seemed to repeatedly yield deficiencies and issues that required often urgent attention, the Board found no evidence that the DCA would actually “step in” and take action to ensure that the Operator complied and took corrective actions and, consequently, was safe and legal to continue its flight operations. As mentioned in the evaluation by a private firm in 2005 “The UK CAA representatives acknowledged that their current role in Cyprus is as advisors. However, this remains unclear since the existing contracts indicate, and records confirmed, that the UK CAA inspectors exercised a more direct, “hands-on” approach.”

The relationship of dependence was also evident from the evaluation by the private firm which found that the DCA had not taken ownership of documents prepared by the UK CAA and which described the internal operations of the Flight Operations and the Airworthiness Sections of the SRU. The SRU appeared to have adopted the manuals without completing missing sections and/or tailoring them to their needs, or trained inspection personnel to use them.

In trying to explain the reasons behind the slow progress in strengthening the DCA capabilities, the Board considered the role of Governmental support and how that may have been affecting the DCA’s ability to evolve and better embrace its safety oversight responsibilities. The Board noted that the 2002 ICAO audit clearly attributed at least part of the situation to the fact that the DCA operated as a functional department of the Ministry of Communications and Works. The 2005 European Commission evaluation directly faulted the absence of the necessary “… political commitment [of the Cypriot Government] to supply this Department [DCA] with the resources to carry out fully its safety oversight function and to reorganize the chain of command in order to give safety the high priority it deserves inside the organization.”

What became apparent from the Board’s consideration of the situation at the Cyprus DCA, and what was evident from the review of the audits/evaluations of DCA, was that the DCA, and the SRU in particular, lacked the required expertise to move forward, become independent, and fulfill the international obligations of Cyprus as contained in the Chicago Convention and its Annexes. Despite numerous action plans since 1999 to ensure the availability of properly trained and qualified inspectors, there were no tangible indications of progress.

A review of the audits and follow up audits of Cyprus DCA performed by ICAO, EASA and JAA, disclosed several important findings, which should have been actioned in the shortest possible time. No records were obtained that would have documented any remedial action considered, initiated or completed. It was of concern to the Board that there was no evidence of actions and enforcement by the international regulatory agencies to require timely implementation of an acceptable action plan, although they had clearly established that Cyprus’ international obligations were not being met.

CONCLUSIONS

1. Findings

1.1 Flight Crew

The flight crew was licensed and qualified for the flight in accordance with applicable regulations.
The flight crew held valid medical certificates and was medically fit to operate the flight.
Although atherosclerosis was found (minor atherosclerosis for the Captain and extensive atherosclerosis for the First Officer), the Hellenic Air Force Aviation Medical Centre estimated that brain hypoxia was the dominant and determinant cause of incapacitation.
The flight crew was adequately rested and their flight and duty times were in compliance with Cyprus DCA and Operator requirements.
During the Preflight procedure, the Before Start and the After Takeoff checklists completion, the flight crew did not recognize and correct the incorrect position of the pressurization mode selector (MAN position instead of AUTO).
The green light indication that the pressurization mode selector was in MAN (manual) position should have been perceived by the flight crew during preflight, takeoff, and climb.
At an aircraft altitude of 12 040 ft and at a cabin pressure that corresponds to an altitude of 10 000 ft, about 5 minutes after takeoff, the Cabin Altitude Warning horn sounded.
The initial actions by the flight crew to disconnect the autopilot, to retard and then again advance the throttles, indicated that it interpreted the warning horn as a Takeoff Configuration Warning.
The incorrect interpretation of the reason for the warning horn indicated that the flight crew was not aware of the inadequate pressurization of the aircraft.
There were numerous remarks in the last five years by training and check pilots on file for the First Officer referring to checklist discipline and procedural (SOP) difficulties.
The flight crew contacted the company Operations Centre Dispatcher and referred to a Takeoff Configuration Warning horn and the Equipment Cooling lights.
Communications between the flight crew and the company Operations Centre Dispatcher were not recorded; nor was there a regulatory requirement to record such communications.
At an aircraft altitude of 17 000 to 18 000 ft, the Master Caution was activated and was not canceled for 53 seconds. The reason for its activation may have been either the inadequate cooling of the Equipment or the deployment of the oxygen masks in the cabin. The activation for either of the above two reasons does not permit identification of the other reason. Independently of the Master Caution indication, there are separate indications for both malfunctions on the overhead panel.
The flight crew possibly identified the reason for the Master Caution to be only the inadequate cooling of the Equipment that was indicated on the overhead panel and did not identify the second reason for its activation, i.e., passenger oxygen masks deployment, that was later also indicated on the overhead panel. The crew became preoccupied with the Equipment Cooling fan situation and did not detect the problem with the pressurization system.
The workload in the cockpit during the climb was already high and was exacerbated by the loud warning horn that the flight crew did not cancel.
The remarks and observations by training pilots and check pilots with respect to the First Officer’s performance explained the omissions of the flight crew in its performance of the Preflight procedures, the Before Start and the After Takeoff checklists, as well as the non-identification of the warnings and reasons for the activations of the warnings on the flight deck during the climb to cruise.
Before hypoxia began to affect the flight crew’s performance, inadequate CRM contributed to the failure to diagnose the pressurization problem.
The flight crew probably lost useful consciousness as a result of hypoxia sometime after their last radio communication on the company frequency at 06:20:21 h, approximately 13 minutes after takeoff.
Histological examinations revealed the presence of recent myocardial ischemia in both pilots, which according to the Hellenic Air Force Aviation Medical Centre (KAI) was likely due to the extended exposure to hypoxia.
The toxicology test measured ethanol (34 mg/dl or 0.034 % weight/volume) in the specimen of the First Officer. The toxicological report stated that in view of the conditions, the finding may have resulted from postmortem ethanol production.

1.2. Cabin Crew

The cabin crew members were trained and qualified in accordance with existing regulations.
The cabin crew members were adequately rested and their duty times were in accordance with existing regulations.
After the deployment of the oxygen masks in the cabin, the cabin crew members would have expected initiation of a descent or at least leveling-off of the aircraft.
It could not be determined what actions were taken by the cabin crew members after deployment of the oxygen masks in the cabin, nor whether any of the cabin crew members attempted to contact the flight crew or enter the flight deck after passenger oxygen masks deployment.
Shortly before flame out of the left engine, a member of the cabin crew was observed by an F-16 pilot to enter the flight deck, to sit in the captain’s seat, and to attempt to gain control of the aircraft.
The above cabin crew member held a Commercial Pilot License.

1.3 Aircraft

The aircraft held a valid Certificate of Airworthiness.
The mass and centre of gravity of the aircraft were within prescribed limits.
The aircraft had been supplied with the required amount of fuel. Fuel was not a factor in this accident.
No deferred maintenance defects had been recorded.
Data retrieved from the non-volatile memory (NVM) of the No. 2 cabin pressurization controller for at least the last 42 flights revealed a pressurization leak or insufficient inflow of air for reasons that could not be determined.
There were nine write-ups related to the Equipment Cooling system in the Aircraft Technical Log from 9 June to 13 August 2005.
The maintenance actions performed in the early morning hours of the day of the accident comprised:
- A visual inspection of the rear right door (R2), no defects were found;
- A pressurization test, no leakage was found.

The record of the maintenance actions in the Aircraft Technical Log was incomplete.
After the pressurization test, the pressurization mode selector was not selected to AUTO. Although not a formal omission, it would have been prudent to position the pressurization mode selector back to AUTO.
The first recorded data of the accident flight on the non-volatile memory (NVM) chip in the cabin pressurization controller was at 10 000 ft cabin altitude (12 040 ft aircraft altitude). The data showed that the pressurization system was operating in the manual mode.
The aircraft departed the holding pattern and started descending from FL340 when the left engine flamed out from fuel depletion. The right engine also flamed out from fuel depletion shortly before impact.
The aircraft was structurally intact before impact.
The aircraft was destroyed by the impact.

1.4 Manufacturer

The description in the Boeing AMM for the procedure for the pressurization check (under the heading “Put the Airplane Back to its Initial Condition”) was vague. It did not specify an action item that the pressurization mode selector be returned to the AUTO position after the pressurization check.
The manufacturer’s Preflight procedure and checklists (Before Start and After Takeoff) for checking and verifying the position of controls on the pressurization panel were not consistent with good Human Factors principles and were insufficient to guard against omissions by flight crews.
The manufacturer’s procedures should have contained enough redundancy to ensure that the pressurization system was properly configured for flight. Because the position of the pressurization mode selector was critical for pressurization, the specific action should have been explicitly listed in the checklists referring to the pressurization system (Before Start and After Takeoff).

The use of the same aural warning to signify two different situations (Takeoff Configuration and Cabin Altitude) was not consistent with good Human Factors principles.
Over the past several years, numerous incidents had been reported involving confusion between the Takeoff Configuration Warning and Cabin Altitude Warning on the Boeing 737 and NASA’s ASRS office had alerted the manufacturer and the aviation industry.
Numerous incidents had been reported worldwide involving cabin pressurization problems on the Boeing 737. A number of remedial actions had been taken by the manufacturer since 2000, but the measures taken had been inadequate and ineffective in preventing further similar incidents and accidents.

1.5. ATC

The air traffic controllers in Nicosia and Athens, who handled flight HCY 522 were properly licensed and properly qualified.
The ATC facilities in Nicosia and Athens were appropriately staffed and the communication equipment operated per regulations. There were no communications or navigational aid abnormalities.
Nicosia ACC informed by telephone Athinai ACC that flight HCY 522 was not responding to its radio calls while approaching EVENO, but did not use the formal ICAO procedure (Doc 4444) for the two-way Radio Communication Failure (RCF).
One minute before the flight entered the Athinai FIR, the Athinai ACC controller “accepted” the flight, but did not seek communication with it when it entered the FIR and failed to contact Athinai ACC as prescribed.
The above-mentioned actions by Nicosia and Athinai ACCs did not contribute to the formation of events of the accident.

1.6. EASA, JAA, and ICAO

Despite several EASA, JAA and ICAO audit and follow up audit findings performed on Cyprus DCA, there was no enforcement of implementation of action plans in order to meet its international obligations in the shortest possible time.

1.7. Flight HCY522

When the flight HCY522 was intercepted by the F-16s, the F-16 lead pilot reported that there was no visible damage to the Boeing 737 aircraft, that the Captain’s seat was vacant, the person in the First Officer’s seat was not wearing an oxygen mask and was slumped over the controls, and some seated passengers in the cabin were observed wearing oxygen masks.
Shortly before the aircraft started descending, the F-16 pilot reported that a man wearing clothing of a specific color entered the cockpit and sat down in the Captain’s vacant seat. He did not appear to be wearing an oxygen mask. He seemed to make efforts to gain control of the aircraft. It was determined that this man was a cabin attendant who held a Commercial Pilot License.

When the left engine flamed out due to fuel depletion, the aircraft exited the holding pattern and started a left descending turn, and followed an uneven flight path of fluctuating speeds and altitudes. Shortly before impact, the right engine also flamed out from fuel depletion.
The cabin crew member in the cockpit attempted to transmit a MAYDAY message, which was recorded on the CVR. However, the MAYDAY calls were not transmitted over the VHF radio because the microphone key, as shown by the FDR, was not pressed. The performance of the cabin crew member was very likely impaired by the hypoxic and stressful conditions.
Three of the four portable oxygen cylinders on board the aircraft had most likely been used.
The cabin altitude was calculated to have been about 24 000 ft, while the aircraft was at a cruise level of 34 000 ft (FL340).
The duration (30 minutes) of the CVR installed on the aircraft was insufficient to provide key information that would have clarified the chain of events during the climb phase of the flight. The CVR stopped recording when the engines flamed out.

1.8. Operator

The After Takeoff checklist section referring to the pressurization system in the Operator’s QRH had not been updated according to the latest Boeing revision.
The manuals, procedures, and training of the Operator, and to a large extent of the international aviation industry, did not address the actions required of cabin crew members when the passenger oxygen masks have deployed in the cabin and, during climb to cruise, the aircraft has not start descending or at least leveled off, and no relevant announcement has been made from the flight deck.
The absence of applied hypoxia training at the Operator, and to a large extent at other airlines, for airline transport pilots, increased the risk of accidents because of the insidious nature of incapacitation during climb to cruising altitude as a result of pressurization anomalies or gradual loss of pressurization.
There were organizational safety deficiencies within the Operator’s management structure and safety culture as evidenced by diachronic findings in the audits prior to the accident, including:

a) Inadequate Quality System;

b) Inadequate Operational Management control;

c) Inadequate Quality and Operations Manual;

d) Cases of non-attendance of management personnel at quarterly management quality review meeting, as required;

e) Organization, management, and associated operational supervision not properly matched to the scale and scope of operations;

f) Inadequate monitoring of pilot certificates and training;

g) Insufficient involvement of management pilots in managerial duties, due to lack of time;

h) Incompletely updated training and duty records;

i) Lack of updating of some manuals and in part not fully in compliance with regulations;

j) Key management personnel at time performing the work of two positions;

k) Periods of vacant key management positions;

l) Inadequate remedial actions on audit findings, including level one findings, which could cause suspension of the AOC.

1.9. Cyprus DCA

Organizational safety related deficiencies existed within the Cyprus DCA from at least 1999 and continued to the time of the accident, although some corrective actions were exercised since 2003. These deficiencies prevented the DCA from carrying out its safety oversight obligations within Cyprus, as evidenced by findings in previous audits, including:

a) Lack of resources and qualified personnel, and inability to adequately perform the safety oversight activities as required by ICAO;

b) Over-reliance on the UK CAA;

c) Inadequate on-the-job training for Cypriot inspectors to assume the duties for the DCA;

d) Lack of DCA internal expertise to assess the effectiveness or the technical aspects of the UK CAA inspections and the work performed;

e) Ineffectiveness of the DCA in bringing the Cyprus Civil Aviation legislation and regulations into compliance with the international requirements (ICAO Standards and Recommended Practices);

f) Inadequacy of the structure of the DCA to support safety oversight on current and future operations under the present circumstances;

g) No risk management process;

h) Non-exploitation by the DCA of the full scope of contracted services from the UK CAA, related to on-the-job training of Cyprus Flight Inspectors for reasons beyond the control of the UK CAA;

i) Non-assumption of responsibility of the DCA in directing the UK CAA regarding the accomplishment of its contractual duties;

j) Lack of effective implementation of the corrective action plans from previous audits (ICAO – 46.57 % non-implementation, when an excess of 15% non-implementation generally indicated significant problems in terms of State oversight capability).

2. Causes

2.1 Direct Causes

Non-recognition that the cabin pressurization mode selector was in the MAN (manual) position during the performance of the: a) Preflight procedure; b) Before Start checklist; and c) After Takeoff checklist.
Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb.
Incapacitation of the flight crew due to hypoxia, resulting in the continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground.

2.2. Latent causes

The Operator’s deficiencies in organization, quality management, and safety culture, documented diachronically as findings in numerous audits.
The Regulatory Authority’s diachronic inadequate execution of its oversight responsibilities to ensure the safety of operations of the airlines under its supervision and its inadequate responses to findings of deficiencies documented in numerous audits.
Inadequate application of Crew Resource Management (CRM) principles by the flight crew.
Ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurization incidents in the particular type of aircraft, both with regard to modifications to aircraft systems as well as to guidance to the crews.

2.3. Contributing Factors to the Accident

The omission of returning the pressurization mode selector to AUTO after unscheduled maintenance on the aircraft.
Lack of specific procedures (on an international basis) for cabin crew procedures to address the situation of loss of pressurization, passenger oxygen masks deployment, and continuation of the aircraft ascent (climb).
Ineffectiveness of international aviation authorities to enforce implementation of corrective action plans after relevant audits.

EXCERPTED FROM

Hellenic Republic Ministry of Transport & Communications Air Accident Investigation & Aviation Safety Board (AAIASB), Aircraft Accident Report Helios Airways Flight HCY522.

FURTHER READING

**********************

_______________________