Loss of Control In-flight incident involving a Royal Air Force A330

A camera jammed between the left armrest and the side –stick unit producing an inadvertent physical input to the Captain’s side-stick assessed as the cause of the event. Several organizational and some design factors were identified as contributory factors

ZZ333 (2)

Photo (C) Stewart Marshall. Jetphotos.net

UK Ministry of Defense and Military Aviation Authority Service Inquiry: incident involving Voyager ZZ333 on 9 February 2014.


On February 9th, 2014, the crew of ZZ333 briefed at 0925 UTC for a non-stop air transport flight from RAF Brize Norton (BZZ) to Camp Bastion Airfield (QOZ), Afghanistan. ZZ333 taxied approx 20 minutes late with a total flight crew of 9, plus 189 passengers. The departure was delayed slightly by a transponder Electronic Centralized Aircraft Monitoring (ECAM) warning just prior to line-up which was quickly resolved.  With a call sign of ISF 63JW, ZZ333 departed BZZ at 1200 UTC for an anticipated 8hr 20min leg to QOZ.

Initially, the flight progressed without incident, with the exception of at least one instance of turbulence, significant enough to warrant the illumination of the seat belt signs. At 1549 UTC (night time), with the aircraft in the cruise at Flight Level (FL) 330 and autopilot 1 engaged, the Co-pilot had left his seat and was in the forward gallery in the vicinity of the forward left passenger door. The Captain (occupying the left-hand flight deck seat) suddenly felt a sensation of weightlessness and being restrained by his harness, accompanied by a rapid pitching down of the aircraft. He attempted to take control by pulling back on his side-stick controller and pressing the autopilot disconnect button but these actions were ineffective.

Immediately prior to pitch-down, the Co-pilot felt a sensation similar to turbulence. Other crew in the cabin reported a similar sensation, describing it as a “jolt”. The Co-pilot then experienced weightlessness and struck the cabin roof but was able to re-enter the flight deck through the open door. He reported a disorderly scene with audio alarms sounding and a violent shaking of the aircraft. He reached down to pull back on the side-stick control. Both pilots reported hearing a “dual input” audio warning, indicating simultaneous inputs by both pilots, on their respective side-sticks. As the aircraft began to recover from the dive, excessive speed was building. The thrust levers were selected to idle and as the aircraft re-established a climb, the speed rapidly reduced. The Captain set Take-off and Go-around (TOGA) power and subsequently re-established a power altitude combination for a straight and level flight at FL310.

The aircraft had lost 4,400 feet n 27 seconds, registering a maximum rate-of-descent of approximately 15,800 feet per minute, before recovering to straight and level flight. The speed had reached 358 knots Indicated Air Speed (KIAS), or Mach 0.9, and g-forces had ranged from minus 0.58 “g” (at the onset of the dive), to plus 2.06 “g” during the recovery. The aircraft was diverted to Incrilik Airbase in southern Turkey without further incident.

The resulting negative “g” forces were sufficient for a significant number of passengers and crew to be thrown towards the cabin roof. Twenty-five passengers and 7 crew reported injuries, and were attended in flight by medical personnel travelling as passengers, and subsequently at the on-base medical facilities. No major injuries were reported at the time of the incident.


Voyager is a modified Airbus A330-243, procured under a comprehensive service delivery contract between the Ministry of Defense and a contractor which owns the aircraft and provides for aircraft, infrastructure, inventory, certain manpower and training services. The aircraft must be able to switch between the Civil Aircraft Register (CAR) and the Military Aircraft Register Hub. Thus, each aircraft must be maintained to civilian standards by an appropriately licensed organization and using licensed staff, therefore the service s administered in the military role and controlled in the civil environment. The Voyager’s key capabilities include probe and drogue air-to-air refuelling (AAR) for all RAF receiver aircraft, plus a carrying capacity of up to 291 passengers and 8 NATO freight pallets.

Flight planning and authorization

The flight on 9 Feb was in support of an operational air-bridge, which provides the military air link between the UK and Afghanistan. The scheduled departure time was 1125 UTC on 9 Feb and the flight was expected to last approximately 8 hours.

The crew of two pilots and eight cabin crew members were scheduled to check in at 0925 UTC on 9 Feb. Accompanying the flight were two Aircraft Ground Engineers (AGE), who would be responsible for ground maintenance on arrival at QOZ.


Start-up and taxi. The aircraft star was normal. On taxi out, the ECAM System displayed a failure of the identification Friend or Foe1 (IFF1) transponder. The crew informed Air Traffic Control (ATC) that they would hold short of the main runway while they addressed the fault. While following the procedure for an IFF reset, the ECAM indicated that IFF2 had also failed. Several resets of both transponders did not remedy the faults and the AGEs were called upon to the flight deck to provide advice. The pIlots were informed that nothing could be done to resolve the faults without taxiing back to the stand and shutting down. While preparing to return to the stand the IFF1 fault cleared, thus satisfying the crew that they could proceed with the flight. Take-off clearance was obtained from ATC.

Take-off. The aircraft was only 0.7 Tones below its Maximum Takeoff Weight (MTOW) and thus required the full length of Runway 26 for take-off. Adopting a standard technique for improving the aircraft’s take-off performance, the crew switched off the air conditioning packs and selected the thrust levers to TOGA power.  The take-off roll was normal and, as the aircraft climbed through 300 ft above ground level, the autopilot was engaged. The rest of the departure was uneventful, following the Standard Instrument Departure (SID) from RAF Brize Norton, before conducting a relatively unrestricted climb to cruising altitude Flight Level (FL) 330 with London ATC.

The cruise. Initially, the flight progressed without incident, with the exception of at least instance of turbulence, significant enough to warrant the switching on the seatbelts signs.  At 1532 UTC, around 18 minutes before the incident, the Co-pilot left his seat for a break. Approximately two and a half minutes later, he returned briefly to the flight deck to deliver refreshment to the Captain before adjourning to the forward galley in the vicinity of the L1 station (forward left passenger door). He remained at this location until the incident took place, talking to the Purser and a former colleague who was on board as a passenger.

While on his own and in his seat, the Captain was taking photographs of the flight deck with his Nikon digital SLR camera. The last photograph was taken at 1546:38 UTC, three minutes and twenty seconds before the incident, and co-incident with the purser entering the flight deck. The purser and the captain had a brief conversation about the progress of the flight before the purser left the flight deck at 1548:04 UTC, one minute and 54 seconds before the incident.

The event

At 1549:58 UTC, the Captain felt a sensation of weightlessness and being restrained by his harness, accompanied by a rapid pitching down of the aircraft. He attempted to take control by pulling back on his side-stick and pressing the autopilot disconnect button, but these actions were ineffective. The captain was unaware of any alarms but reported an increase in cabin ambient noise and a sensation similar to being underwater. In less than ten seconds the aircraft had pitched to 17 degrees nose-down, was descending at 15,800 feet per minute, and was accelerating rapidly through 300 KIAS.

Immediately prior to the nose-down attitude, the co-pilot felt a sensation similar to turbulence. The purser also reported a similar sensation, describing it as a “jolt”. As the aircraft pitched down, the co-pilot was lifted to the cabin roof and, while experiencing weightlessness, re-entered the flight deck through the open door. He described a confused scene with audio alarms and flashing lights, as well as a violent shaking of the aircraft. The captain shouted repeatedly that he could not disengage the autopilot. With his feet on the flight deck roof, the co-pilot reached down and attempted to disengage the autopilot by pulling back on his side-stick; an action which appeared to have no effect. As he resumed his seat and pulled back again on his side-stick, the aircraft began to pitch up. As the aircraft pitched up, “dual input” audio warnings were heard, indicating simultaneous side-stick inputs by both-pilots. By now (around 14 seconds into the incident), excessive speed had built, leading the pilots to reduce the thrust levers to idle. The aircraft began pitching upwards, and as it did so the speed decreased. The co-pilot warned the captain of the decaying airspeed, who consequently set TOGA power as a straight and level flight was re-established at FL310. The crew then re-engaged autopilot 1.

Meanwhile, in the cabin, a large number of passengers and crew had been thrown towards the ceiling. A significant volume of loose articles, including bags, personal effects, teapots, paper cups and bins were flying around the cabin, while some passengers were shouting. As the negative “g” force from the initial pitch-down subsided, and as the aircraft accelerated in the dive, some of the unrestrained passengers and crew were able to find their way towards vacant seats and strap in. As the aircraft recovered to straight and level flight, the purser made a brief check of the flight deck, before beginning a survey of the situation throughout the cabin.

The aircraft had lost 4,400 feet in 27 seconds, registering a maximum rate-of-descent of approximately 15,800 feet per minute, before recovering to straight and level flight. The speed had reaches 358 knots IAS, and “g” forces had ranged from minus 0.58 “g” (at the onset of the dive), to plus 2.06 “g” during the recovery.


Once in level flight, the captain decided to land the aircraft as soon as possible. An initial Mayday call, transmitted by the co-pilot during the event, was followed by another call in which he requested a diversion “to a suitable airfield of our choice”. On the advice of Turkish ATC, the aircraft was turned towards Trabzon, a civilian airfield approximately 60nm away. The captain judged that the close proximity of Trabzon would not allow enough time to descend in good order, and as unsure as to its suitability. Instead, he elected to divert to Istanbul International Airport, some 500nm away. After a few more minutes, however, ATC suggested that they should divert to Incirlik Airbase in southern Turkey, some 340nm from the aircraft’s position at the time. The captain agreed and the aircraft was turned south.

During the diversion the captain and purser addressed the passengers a number of times using the public announcement (PA) system, repeating seat belt instructions, advising on timings and informing them before large attitude or configurations changes. In the immediate aftermath of the incident, the captain used the PA system to inform passengers that the reason for the incident was unknown and that the aircraft was being diverted. He asked all passengers to remain seated with seatbelts fastened. During the purser’s assessment of the rear cabin, it became apparent that one of the passengers was suffering from an acute stress reaction and was attended by a doctor onboard.

The purser checked the cabin crew members to verify their fitness to fly and conducted a second survey of the cabin with one of the AGEs. No external damage was found, the flight crew was updated and the passengers were prepared for landing.

Both pilots remained in their seats and guarded the controls at all times. The aircraft landed at Incirlik Airbase from a straight-in approach without further incident. The aircraft was taxied to an aircraft parking bay and a normal disembarkation was conducted with the emergency services present.

Damage to aircraft

There was no severe damage to the aircraft cabin structure that compromised the function for the landing.

There was no reported damage to the flight deck. The post-occurrence review by Airbus found the side stick received forces beyond its design specification, therefore was deemed unserviceable.

There was no reported damage to the external structure of the aircraft

Post Occurrence Management

As a military aircraft incident, the station lead for post-occurrence management rested with the military chain-of-command.


On landing in Incirlik, the following injuries were identified:

Table 1

The co-pilot and seven cabin crew received minor injuries but were able to conduct their duties; one crew member had suffered a stress reaction but recovered within a few minutes and was able to carry out their duties. 24 passengers received minor injuries and one passenger had suffered an acute stress reaction which resulted in his admission to hospital.


The incident involving Voyager KC Mk 3 (ZZ333) on 9 Feb 14 occurred when the aircraft suddenly pitched down while in the cruise at FL330. The pitch-down command persisted for a total of 33 seconds, during which time the aircraft lost 4,400 ft in height. The aircraft’s self-protection measures initiated a recovery from the dive.

Evidence gathered from the aircraft’s Digital Flight Data Recorder showed that a full pitch-down command had been initiated from the captain’s side-stick, which caused the autopilot to disconnect ante the aircraft to enter a dive. The evidence also showed that the pitch-down command was not the result of a technical malfunction of the side-stick, the control surfaces, the autopilot, the flight control computers, or the aircraft weight and balance. Neither was the pitch-down command the result of turbulence. A detailed examination of the aircraft indicated that there were no pertinent technical faults throughout the flight.

The inquiry established conclusive evidence that the pitch-down command was actually the result of an inadvertent physical input to the captain’s side-stick. Specifically:

  1. Two or three minutes before the event, a Digital Single Lens Reflex (D-SLR) camera was placed directly behind the side-stick, in the space between the side-stick and the captain’s left armrest.
  2. At one minute and 44 seconds before the event, the captain’s seat was moved forward, creating a slight jam of the camera between the front of the armrest ant the rear base of the side-stick.
  3. At the onset of the event, the captain’s seat was moved forward again, forcing the side-stick fully forward and initiating the pitch-down command.
  4. With the captain’s side-stick jammed fully forward, the pitch-down command could not be counteracted initially, as the captain was the only person present on the flight deck.
  5. The resulting forces were sufficient for a considerable number of passengers and crew to be thrown to the ceiling, resulting in a number of injuries.

The panel found that the factors which led to the pitch-down command were influenced principally by the prevailing safety culture with respect to loose articles on the flight deck of RAF air transport aircraft.  The small amount of guidance regarding the treatment of loose articles on flight decks was overwhelmed by an organizational requirement to tale large amounts of equipment and documentation onto the flight deck to support missions and to stores it in ad hoc locations. As a result, the carriage, use, and ad hoc storage of a small number of personal items had become normal practice. The recovery from the pitch-down command was initiated by the aircraft’s own protection laws which prevented the incident from being worse. In the opinion of the panel, the evidence suggests strongly that the clearing of the obstruction from behind the side-stick was achieved by means of a physical manipulation of the camera itself.

The situation in the passenger cabin was managed effectively and had no adverse bearing on the injuries sustained by passengers and cabin crew.

The practical response in the immediate aftermath of the incident was fast, thorough and highly effective.

Determining the cause of the pitch-down command


Comprehensive interviews with the pilots conducted in Incirlik had already established a strong theme that pointed towards a technical malfunction on the aircraft, especially associated with the side-stick and the autopilot.  However, the initial analysis of the DFDR and CVR had revealed no evidence of any pertinent technical malfunctions, particularly with respect to the side-sticks and the autopilot.

A number of concurrent lines of inquiry became necessary in order to rule out a variety of possible causes, including extensive work carried out by independent parties to help isolate the cause of the pitch-down command.


The DFDR showed no indication of indication of system failure, there were no annunciations to the crew of pertinent faults, nor were any relevant fault codes generated that could help explain the incident. The panel assessed this incident to be unique.

At  1548:13 UTC, one minute and 44 seconds prior to the event, the FDR detected a low frequency fluctuating pitch-down command of 0.5 to 0.9 degrees from the captain’s side-stick. This input endured until the onset of the full pitch-down command. This initial forward input was pure in pitch with no discernible lateral input. The force and displacement of the side stick during this command did not disengage the autopilot, because a five deca-Newton force and five-degree displacement in pitch of the side-stick is required to autopilot to disengage. Therefore, the aircraft remained initially in level flight with the autopilot engaged. At 149:57 UTC, a fully-forward input was made by the captain’s side-stick, pure in pitch and at a constant rate, with no discernible lateral input, held for approximately four seconds. This input initiated the pitch-down event.

Early analysis of the CVR identified a distinctive noise on the flight deck at one minute and 44 seconds prior to the event, and at the onset of the event itself. Spectral analysis of the noise identified it, by its frequency of 1900-2000 Hz, as the electric motor used to adjust the flight deck crew seats. In the two minutes prior to the event, the captain was the only person on the flight deck, therefore it was concluded that the motor noise came from the captain’s seat. There was no evidence that the seat had malfunctioned in flight and the functional tests carried out after the event showed that the seat was fully serviceable.

There was an obvious and strong temporal and directional correlation between the seat motor movement and the side-stick movement. The stick and the seat would have to be physically connected, either by the seat’s occupant or by an object.

The pitch input from one minute and forty-four seconds until de onset remain between 0.5 and 0.9 degrees, in a manner inconsistent with human input. The captain was certain that he was not touching the controls prior to the event, and the persistence of the subsequent pitch-down command for around 33 seconds indicated that it was not the product if an inadvertent human input. On the other hand, the lack of roll input on the DFDR trace during the initial pitch-down of the aircraft meant that a hand-flown pitch-down command was unlikely. Therefore, the panel concluded that the captain was not in physical contact with the side-stick immediately prior to or during the onset of the event.

As a result, the panel focusing on the possibility of an object connecting the seat and the side-stick collected the personal effect which had been on the flight deck during the event. It became evident that a Nikon Digital Single Lens Reflex (D-SLR) D5300 Camera belonging to the captain had been present on the flight deck in the minutes leading up to the pitch down event, had been seen on the surface area near the base of the captain’s side-stick and the captain has been seen using it during the flight. In one photograph, the GPS digital clock on the flight deck could be seen, allowing a comparison with the internal time measurement of the camera. 77 photographs were taken during the flight, the last one, taken one minute and thirty-five seconds before the initial pitch event, and three minutes and twenty seconds before the full pitch-down event.

figure 5

The camera was found to have a large linear dent on its right-hand side (Figure 6). The dent extended from the softer hand grip region toward the front of the camera, across a thin part of the main body frame, and across the memory card flap.

figure 6

The profile of the large dent was mapped forensically using surface profilometry and was found to be consistent with the flange of the side-stick. The chemical analysis indicated trace amounts of materials present in a swab from the camera indentation consistent with the material typo of the side-stick. Using binocular microscopy to examine the rubber gaiter at the base of the side-stick some marks were found that considered alongside other smaller witness marks on the camera, it was assessed that the damage was consistent with the side-stick being pulled back forcefully against the body of the camera.

figure 8

The event was reconstructed using the Voyager simulator, placing a camera in the gap between the armrest and the side-stick and moving the seat motor forward until the camera was gently flush against the base of the side-stick. The effect was to push and hold the side-stick fully forward in a manner consistent with the pitch-down command seen on the DFDR. The motion resulted in the grip flange become aligned with a location exactly consistent with the dent in the camera.

figure 9

Using the calculated movement of the seat, the position of the armrest and the location of the camera, the analysis found that it was feasible for the seat movement recorded on the CVR t have caused the movement recorded on the CVR to have caused the movement of the side-stick to the fully forward position.

In the meantime, the panel ruled out a thorough range of other causes (See the original report)

The captain agreed that a physical interference with the side-stick, in the manner suggested above, represented the most probable trigger for the pitch-down command. Therefore, the panel concluded that the cause of the pitch-down event was an inadvertent physical input to the Captain’s side-stick, by means of a physical obstruction (a camera) that jammed between the left armrest and the side –stick unit when the Captain’s seat has motored forward.

Factors leading to the pitch-down command

A series of individual acts took place at the moment before the pitch-down command which was assessed as having contributed to the incident itself. Those individual acts were influenced by the combination of error promoting conditions, organizational influences and breached defenses.

fig 10

Carriage of the camera

The carriage of the camera was considered by the panel as a contributory factor, however, was consistent with normalized behaviour regarding loose articles on flight decks on RAF air transport aircraft. This issue had been the source of considerable debate amongst junior Air Safety staff but it had not been resolved. Aircrews were required to take a large number of items of equipment on board the aircraft for operational flights, result of the nature of the tasking and the associated volume of paperwork necessary to support the mission. However, only some of these items had designated storage, with the rest usually found space around the flight deck, for example on the floor behind the pilot’s seats. It is likely that this situation promoted an attitude that it was generally acceptable to have a large number of items on the flight deck, such that the carriage of a small number of personal effects would not have seemed unreasonable. There was no evidence, however, of official guidance or training related to the carriage and use of these personal items and how they should be stored and positioned on the flight deck, increasing the likelihood that personnel would develop their own norms and practices as a result of experience and advice of others.

fig 11 y 12

Photographs taken on the flight deck of ZZ333 shortly before the incident indicated that there was a number of loss articles placed in areas around the flight deck, some not officially designed for storage. The selection of typical locations used to store items illustrates the challenge imposed by the imbalance between the available storage, the required volume of official equipment and documentation and the carriage of personal items, resulting in items being stored on the floor and in ad hoc areas, including the area around the side-stick.

fig 13

The carriage of personal items may also have been perceived as advantageous as it would provide access to items in flight which could be used to help maintain mental alertness and prevent boredom during times of low work.

The panel assessed that normalized behaviour regarding the carriage and treatment of loose articles was a contributory factor to the incident. Furthermore an incomplete RAF Brize Norton Occurrence Investigation (OSI) opened on April 2013, executed to examine an Air Safety Occurrence Report (ASOR) about a concern of the number of loose articles being found on board one of the fleets and to determine whether the issue was limited to that fleet, and what measures should be taken to address it and which report has not been issued by the time of the incident, was assessed as a contributory factor.

The carriage of the camera on the flight deck was not prohibited by any rules or regulations. Restrictions on the use of such items were only in regard to their transmitting properties during different phases of flight.

Use of the camera in flight

The use of the camera on the flight deck during the flight was considered a contributory factor. However, this was influenced by a number of associated factors.

The use of the camera was not explicitly prohibited by any rules and the restrictions on the use of personal electronic devices were associated with their transmitting properties. However, the Voyager Operations Manual stated that: “Flight crew must refrain from non-relevant duties (e.g. paperwork, casual conversation), in circumstances such as (but not limited to): while the other pilot is away from the active Air Traffic Control (ATC) frequency.”

While on his own, the captain took 28 photographs, approximately eight minutes and three minutes prior to the incident, which were not related to the duties he was carrying out at the time. The panel considered this was not a deliberate and conscious contravention of the rules. However, the use of the camera represented a lack of compliance with the policy regarding non-relevant duties, thus rendering the policy a breached defense.

This lack of compliance with policies was assessed by the panel as highly probably a consequence of boredom and low work load. During a phase of flight when the workload on pilots is low, as in cruise, a high level of automation, as the Voyager’s, can make it even lower, resulting in boredom and complacency. Some individual factors can make an individual more susceptible to boredom. A high level of knowledge, education and ability, be keen for a demanding job, be fatigue or the lack of adaptation to night work make boredom easier to appear. Given the operation conditions, it was highly likely that the crew would take actions to raise their level of alertness and alleviate boredom. Having regular visitors to the flight deck, taking comfort breaks, reviewing in-flight paperwork and using personal items are actions considered as typical to maintain alertness during flight.

Based on all the above the panel assessed that low workload and boredom were contributory factors.

On the other hand, the presence on ZZ333 of only a single person in the flight deck for an extended period of time increased the risk of boredom and under-arousal, thus increasing the likelihood that the Captain would take actions to maintain his general alertness. The panel assessed that the presence of only a single person on the flight deck for an extended period of time was a contributory factor. Moreover, this represented a potential lack of compliance with the policy regarding crew members at their station, although it was possible to apply a wide interpretation to the rule. Nevertheless, as it did not prevent the extended absence of a pilot from the flight deck, the policy regarding crew members at their station was assessed by the panel to be a failed defense.

Placing the camera

The placing of the camera between the armrest and the side-stick created a hazard. This went unrecognized initially, leading directly to the interference with the side-stick and the subsequent pitch-down. As such the panel assessed that the placing of the camera was a contributory factor.

Immediately after the camera was last used, the CVR indicated that the purser entered the flight deck and began a conversation with the captain. This conversation could have drawn the captain’s attention and so reduced his focus on the task of stowing the camera. It cannot be positively determined that the camera was put down at this time, but if it was the case, the panel assessed that distraction of the captain while using the camera was a possible contributory factor.

Likewise, the design of the side-stick area was considered a contributory factor. Interviews with the ZZ333 crew indicated that there was a known issue that inadvertent contact with the side-stick (most commonly by a knee) could result in the autopilot disconnected. Such incidents have been resolved immediately by re-engaging the autopilot. Data from Air Tanker Services indicated that there have been up to 26 incidents since the start of Voyager flying when the autopilot disconnected in the cruise by moving the side stick against the increased force.

Additionally, although when the seat moves the armrest is never less than 50mm from the side-stick, therefore it is no possible for the armrest itself to interfere directly with the side-stick, the operation of the seat when an item of appropriate size is located between the armrest and the side-stick could create a situation in which movement of the seat causes the side-stick to be moved out of the central position while the autopilot is engaged.

The armrest setting was also considered a contributory factor. As both captain and co-pilot had tall upper bodies, their required seat setting for operating the flying controls was lower than that of majority of pilots, that configuration would cause the armrest to have no vertical separation from the side-stick which increased the risk of an item becoming jammed. Moving the seat forward against a camera similar in size to the captain’s with the armrest at different settings din NOT result in the side-stick being held forward.

Other factors

  • A widespread lack of awareness regarding the risk of the side-stick interference was considered as contributory factor. The clean cockpit concept and the rendered regulatory article regarding the carriage of loose articles were the breached defenses that influenced this factor.
  • The lack of reporting regarding inadvertent operations of the side-stick and the lack of a register regarding flight deck control interference as an identified risk were assessed as a contributory factor
  • The movement of the captain’s seat without the interference with the side-stick being noticed, influenced by captain’s low arousal, distraction and cognitive lack of expectation was considered as a contributory factor

Summary of factors

The key factors which made the pitch-down command more likely were summarized as follows:

Individual acts

  1. The carriage of the camera on the flight deck
  2. The use of the camera in flight
  3. The armrest setting
  4. The placing of the camera behind the side-stick
  5. The movement of the captain seat

Error promoting conditions

  1. Low workload
  2. Boredom and low arousal
  3. The presence of only a single person on the flight deck for an extended period of time
  4. Distraction
  5. Cognitive lack of expectation

Organizational Influences

  1.  Normalized behavior regarding the carriage and treatment of loose articles
  2.  The RAF Brize Norton OSI into loose articles
  3.  The design of the side-stick area
  4.  A widespread lack of awareness regarding the risk of side-stick interference
  5.   The lack of reporting regarding inadvertent operations of the side-stick
  6.   The lack of an identified Duty Holder risk regarding flight deck control interference

Breached or failed defenses

  1. The Voyager policy regarding non-relevant duties
  2. The Voyager Operations Manual policy regarding crew members at their station
  3. The Airbus FCTM advice on the “clean cockpit” concept
  4. MAA Regulatory Article 2309 (carriage of loose articles)


The panel made several recommendations to the Royal Air Force, to the Brize Norton Air Base, to AirTanker Services Ltd, to AIRBUS


Service Inquiry: incident involving Voyager ZZ333 on 9 February 2014 Final report. Published 19 March 2014. Last updated 23 March 2015 From UK Ministry of Defense and Military Aviation Authority.


  1. USAF C130J accident in Afghanistan: the Prospective Memory Failure. A hard-shell night vision goggle (NVG) case placed and forgotten forward of the yoke
  2. Normalization of Deviance: when non-compliance becomes the “new normal
  3. Battling the Attraction of Distraction
  4. The Organizational Influences behind the aviation accidents & incidents
  5. Loss of flight crew airplane state awareness
  6. Unrecoverable deviation from the intended flight path


minime2By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day


Some amendments were made to the article, Subsurface Defect on a high-pressure turbine stage 2 disk led to the uncontained engine failure on American Airlines flight 383, Oct. 28, 2016

via Subsurface Defect on a high-pressure turbine stage 2 disk led to the uncontained engine failure on American Airlines flight 383, Oct. 28, 2016

Descent below minimum permitted altitude, final report

Pitch-up illusion during a go-around at night. Again! Release date: 24 November 2017.

A number of autoflight mode selection errors, high workload, non-routine actions of the pilot flying, CRM issues and fixation, identified as contributing factors. Fatigue due to the time of day and time awake may have acted as a factor that increased risk.


Photo (C) Lance C Broad – YBBN Spotters Group 


Near Melbourne Airport, Victoria | 15 May 2015

ATSB Transport Safety Report | Aviation Occurrence Investigation AO-2015-048

Final – 24 November 2017



On the evening of 14 May 2015 an Airbus A319, call-sign Snowbird Two (SND2) departed Perth, Western Australia for Melbourne, Victoria. The aircraft was registered as VH-VCJ and operated by Skytraders Pty Ltd as a passenger charter service with 5 crew and 18 passengers. The aircraft’s flight crew consisted of two captains. The pilot-in-command occupied the left seat and was the pilot flying (PF).1 The other captain occupied the right seat and was performing the pilot monitoring (PM) duties.

As the aircraft was positioning to commence the approach into Melbourne, the PF made a number of inadvertent autoflight mode selections, which led to the autothrust system disengaging and the engines entering the thrust lock condition. The PF’s actions to correct the thrust lock resulted in an unexpected increase in thrust. In response to the thrust increase, the PF made a number of pitchdown inputs and retarded the thrust levers. The pitch-down inputs, when combined with the increased thrust, resulted in the aircraft developing a high rate of descent with an accelerating airspeed. This led to the aircraft descending below the cleared altitude, as well as the triggering of a number of Terrain Avoidance and Warning System (TAWS) alerts. During the subsequent response to these alerts, the aircraft did not commence climbing for about another 10 seconds, and after two further TAWS alerts had activated.

Events leading up to the inadvertent autoflight mode selections Approaching Melbourne and before commencing descent, the flight crew set up the aircraft’s flight management guidance system and then briefed for an expected WENDY 1A standard arrival route (STAR) procedure, with an instrument landing system (ILS) approach to runway 16 for landing (Figure 1). Shortly after, air traffic control (ATC) cleared the aircraft for the WENDY 1A STAR. In the early morning of 15 May 2015, at about 0120 Eastern Standard Time (Coordinated Universal Time (UTC) + 10 hours), the aircraft commenced the descent into Melbourne.

figure 1

The PF commenced the descent with the following autoflight systems and modes selected:

  • Autopilot 1 (AP1) was controlling the aircraft.
  • Lateral navigation was in the ‘navigation’ (NAV) mode, while vertical navigation was in the ‘descent’ mode, both of which were managed modes where the aircraft follows a pre-planned horizontal and vertical flight path loaded in the flight management guidance computer.
  • Autothrust system was on, with the thrust levers at the managed thrust position—the climb thrust detent that equated to a thrust lever angle of 22.5 degrees.

At 0128, SND2 called ATC and advised that the aircraft was on descent to a cleared altitude of 9,000 ft and that they had received ATIS information Romeo.

As SND2 approached waypoint KIKEX (Figure 1) at 0134:25, ATC cleared the aircraft to descend to 3,000 ft and for the ILS approach to runway 16. The PF set 3,000 ft into the altitude function of the aircraft’s flight control unit (FCU). At that time, the aircraft was passing 5,900 ft at an indicated airspeed of 253 kt.

Approaching waypoint NEFER, at 0135:30 and passing about 4,700 ft, SND2 commenced a left turn towards BOL (Figure 1). At 0136:38 the PF requested, and the PM selected, flap 1. The flaps reached this setting two seconds later. At 0136:39, the aircraft had completed the turn and rolled level on the NEFER to BOL track.

The inadvertent autoflight mode selections and following events

The following sequence of events, covering the next 39 seconds of flight, was drawn from the aircraft’s digital flight data recorder (DFDR), cockpit voice recorder (CVR) and crew interviews. This period can be divided into three distinct phases:

  • inadvertent FCU selections
  • thrust increases and the PF’s responses
  • recovery.

The sequence of events from 0136:35 is graphically presented in a data plot at Figure 2. Specific points on that data plot are identified to enable a clearer understanding of the rapidly changing events.

Figure 2

Inadvertent FCU selections

As the aircraft descended through 3,600 ft at 0136:39, the PF announced an intent to ‘arm the approach’. This required the PF to press the APPR (approach) pushbutton on the FCU. Instead, the PF pressed the EXPED (expedite) pushbutton (see Figure 3), resulting in the autoflight vertical mode changing from the open descent mode8 to the expedite descent mode9 (point 1). Over the next 5 seconds, the vertical descent rate increased from around 800 ft/min to around 1600 ft/min, while the airspeed remained stable at around 220 kt.

Figure 3

After a few seconds, the PM identified that the vertical mode had changed to expedite descent and announced this change to the PF. At 0136:44, upon recognising the incorrect mode selection the PF, in an apparent attempted to correct the error, pressed the A/THR (autothrust) pushbutton (to off) (point 2). Pressing the A/THR pushbutton had a number of effects:

  • The autothrust system disengaged and the engines’ thrust was locked at the thrust level prior to disconnection—idle thrust, which was the commanded thrust at that time (the thrust lock condition).
  • The master caution light and aural alert (a single chime) triggered.
  • The electronic centralised aircraft monitoring system THR LK message (thrust lock) was displayed, with an associated procedure.
  • A yellow flashing THR LK message was displayed in the flight mode annunciator on both pilots’ primary flight displays.

Almost immediately, at 0136:47, the PM recognised and announced the thrust lock condition. At about the same time, the autoflight system’s vertical mode transitioned to altitude acquire – ALT* on the vertical mode section (Figure 4), identifying that the autoflight system had captured the 3,000 ft target altitude.

Figure 4

At 0136:51, the PM announced that the aircraft had captured the target altitude. At about the same time the PF recognised the thrust lock condition and pressed the ‘instinctive disconnect’ buttons on both the side stick and thrust levers (see Figure 3). The PF later recalled that the intent behind that action was to reduce the aircraft’s airspeed and to retard the thrust levers. The use of the instinctive disconnect pushbuttons had the following effects:

  • The action of pressing the instinctive disconnect pushbutton on the sidestick disconnected the autopilot (point 3 in Figure 2), which in turn triggered the autopilot disconnect aural alert (‘CAVALRY CHARGE’). The CAVALRY CHARGE sounded for 1 second.
  • The pressing of the thrust lever instinctive disconnect pushbutton caused the thrust lock condition to disengage. It also removed the THR LK message from the electronic centralized aircraft monitoring system and the pilots’ flight mode annunciators. As the thrust levers remained set to the climb detent, the commanded thrust changed from idle to climb.

Thrust increases and the PF’s responses

At 0136:53 the engines began to respond to the commanded thrust change by rapidly increasing thrust (point 4). At about the same time, the PF reconnected the autopilot (point 5) but left the autothrust system disconnected. The PF responded to the rapidly increasing thrust by applying pitch-down inputs on the sidestick (point 6). The PF did not recall applying pitch-down input during post-occurrence interviews but did recall thinking that the aircraft was pitching up.

As a result of the PF’s pitch-down inputs on the side stick, at 0136:58 the autopilot disengaged (point 7). This disconnection again triggered the autopilot disconnect aural (CAVALRY CHARGE) alert, which sounded for 1 second. At the same time, the PF rapidly moved the thrust levers to idle (point 8). At this point, the aircraft’s airspeed was 240 kt and increasing, and the PM asked if the flaps should be retracted. The PF responded in the affirmative.

The PF’s pitch-down inputs, coupled with the aircraft’s high thrust level and the now downward flight vector, resulted in the aircraft’s airspeed and vertical rate of descent rapidly increasing (point 9). At 0137:00 the altitude warning (C CHORD aural alert) commenced. It continued to sound for 15 seconds. As the engine thrust reduced (from the thrust levers being moved back to idle) the PF transitioned from pitch-down to pitch-up inputs on the side stick (point 10). As a result, the rate of descent stabilised and then decreased.

At 0137:02, the first of the terrain avoidance and warning system (TAWS) alerts triggered. This alert, a ground proximity warning system Mode 1 SINK RATE caution, repeated twice. The PF responded by rapidly placing the thrust levers fully forward (point 11) and instructed the PM to advise ATC that they were ‘going around’. At 0137:05 the engines began to respond to the commanded thrust change and rapidly increased thrust (point 12). At the same time the second TAWS alert, an enhanced ground proximity warning system TERRAIN AHEAD, PULL UP, TERRAIN AHEAD warning activated, which ended after 3 seconds. The PF again responded to the rapidly increasing thrust by reducing the pitch-up inputs and then commencing pitch-down inputs (point 13). This reduced the rate at which the aircraft’s rate of descent was decreasing, which had the effect of prolonging the period that the aircraft was descending.


At 0137:08 the PF began to introduce pitch-up commands, which further reduced but did not arrest the aircraft’s rate of descent (point 14). At 0137:13 the third TAWS alert, a ground proximity warning system Mode 2 TERRAIN TERRAIN PULL UP warning activated, ending after 2 seconds.

The PF responded with increasing pitch-up commands (point 15), which began to arrest the rate of descent. At 0137:15, the PM advised ATC that the aircraft was ‘going around’.

The lowest altitude attained by the aircraft during the occurrence, as recorded by the digital flight data recorder (DFDR), was 2,280 ft at 0137:17. At the same time, the flaps were recorded as being fully retracted. The lowest recorded height above ground level recorded by the radio altimeter was 1,100 ft. The aircraft’s maximum speed while the flaps were in the process of retracting was 314 kt.

At 0137:17, the ATC minimum safe altitude warning13 alert activated for SND2 at the ATC workstation. ATC data identified that the aircraft was descending through 2,300 ft at that time. The lowest recorded altitude by ATC was 2,200 ft. As the aircraft began to climb, ATC cleared the aircraft to climb to 4,000 ft and notified SND2 that a low altitude safety warning had triggered. The aircraft was cleared to and continued to climb to 5,000 ft. The flight crew requested vectors to intercept the ILS approach for runway 16. The aircraft landed on runway 16 at 0150 without further incident.



The Airbus A320 aircraft is a twin-engine, narrow body, short to medium range commercial passenger aircraft. The Airbus A320 family of aircraft comprises the A318, A319, A320 and A321 variants. Based on the original A320, the A319 is a shorter variant.

The air operator’s certificate authorised passenger charter operations using the Airbus A319. The operator used an A320 based simulator for training and proficiency checks.

Personnel information

Pilot recollection of the occurrence

The PM later recalled an impression that there was a lot of button pressing, as well as disconnecting and reconnecting of the autopilot during the event. The PM did not recall any TAWS alerts and neither pilot recalled hearing the altitude alert.

Cockpit voice recorder data identified that the PF did not verbalise any intention to change flight mode selections or other actions during the occurrence, other than the initial call identifying an intention to arm the approach.

The PM commented on the low lighting levels set for the flight instruments, which he considered may have resulted in a difficulty in identifying what selections the PF was making on the FCU.

The pilot flying

The pilot flying (PF) held an Air Transport Pilot (Aeroplane) Licence (ATP(A)L) and had accumulated about 17,250 hours of aeronautical experience. Of these, approximately 2,835 hours were on Airbus A320 type aircraft. In the 90 days preceding the occurrence, the PF had logged 69.5 hours, of which 57.1 were on A319.

The PF held a current Class 1 medical certificate, and as a condition of that certificate was required to wear distance vision correction and have available reading correction. These vision requirements were determined to have not influenced the occurrence.

About three months prior to the occurrence, the PF had completed a recurrent training session to a satisfactory standard in an A320 simulator, and in April 2015 a line check in an A319. The PF was current with all training requirements. The PF’s training reports identified that he had satisfactorily completed the required competency checks and was properly trained and proficient on the A320; however, of the 10 training records available that preceded the occurrence, there were two that contained reports of an occasional tendency to rush actions, and that this led to procedural lapses.

The PF was one of three flight crew employed by the operator authorised to conduct instrument training and checking on the A320 aircraft family. The PF was cross-trained on the operator’s other aircraft type, the CASA 212, and was also authorised to conduct training and checking on that type. Additionally, the PF held a management role, although the time required to conduct this role was reducing.

A significant proportion of the PF’s recent flight hours leading up to the occurrence were assigned to conducting check flights on the A319, rather than as the primary operating crewmember. The PF’s training and checking reports did not identify any recency or skill detriment resultant from the PF’s management and/or training roles. However, as the records were limited to approximately five years there was insufficient evidence to assess this further.

The pilot monitoring

The pilot monitoring (PM) held an ATP(A)L with a current Class 1 medical certificate and had accumulated about 12,290 hours of aeronautical experience, of which about 2,200 hours were on an Airbus A320 type aircraft. The PM was also a check and training captain. Prior to the occurrence, the PM had completed a recurrent training session in an Airbus A320 simulator in February 2015 and a line check in July 2014.

Human performance related information

As part of this investigation, several human factors-related aspects were considered in the context of the flight crew’s actions during the descent. These included the:

  • PF experiencing pitch-up illusions with thrust changes
  • PF inadvertently pressing the EXPED pushbutton and what could be considered other inadvertent actions by the PF
  • effect of fatigue
  • role of workload on both crew.

The pitch-up illusion

Pitch-up illusions are a vestibular misperception of acceleration, confused with a climb, and is amplified when visual cues are absent. Given that it was night-time, there would have been very limited visual cues outside the aircraft available to the pilots. The pitch-up illusion is also referred to as a somatogravic effect when referring to what the pilot experiences and is explained by Stott (2011) as follows:

…forward acceleration of the aircraft produces an equal inertial acceleration acting backwards on the pilot and increasing the sense of pressure from the back of the seat….The sensory information provided by the otolithic system is exactly similar to the…sensation of backward tilt…Thus from nonvisual sensations, a pilot is unable to distinguish between an actual backward tilt associated with the climb and an illusory sense of tilt associated with forwarding acceleration.

The pilot’s pitch-down inputs during the descent are consistent with this type of pitch-up illusion event.

Airbus perspective on pitch-up illusions

Airbus has identified the all-engine go-around as a specific manoeuvre where the pitch-up illusion can adversely affect the outcome of a normal procedure. In July 2011, Airbus published a procedural review of the all-engine go-around manoeuvre in their Safety First magazine.

The review was initiated as a result of a number of poorly handled all-engine go-arounds. Most real-world go-arounds were conducted at light weights and with high thrust. It was found that the likely consequence of not maintaining the correct pitch attitude during the go-around is acceleration towards the flap limit speed—when autothrust is not active, there is no speed protection to prevent a flap limit speed exceedance. A representation of the pitch-up, or what Airbus termed the false climb illusion, is shown in Figure 7.

Figure 7

The review included the following points pertinent to the second event, where the PF introduced pitch-down inputs while conducting the go-around manoeuvre:

All pilots must know the required initial pitch target for their aircraft BEFORE commencing a missed approach. They must maintain that pitch target by following the [speed reference system] commands in manual flight. With the autopilot engaged, they should use this knowledge to confirm the autopilot behaviour.

The go-around pitch target for the A320 was quoted as 15 degrees nose up, the importance of which was highlighted as follows:

During a manual Go Around, if the required pitch is not reached or maintained, linear acceleration will result. Research has shown that this may cause a “false climb illusion”. The false climb illusion may lead a pilot to believe that the aircraft is already above the required pitch. Consequently, a pilot may respond with an opposite and dangerous pitch-down input.

Inadvertent pilot actions

Regarding the PF’s inadvertent selection of the EXPED pushbutton, Reason (1990) stated that A slip is a type of error which results from some failure in the execution stage of an action sequence…These slips could arise because, in a highly routinized set of actions, it is unnecessary to invest the same amount of attention in the matching process….with oft-repeated tasks it is likely that [they] become automatized to the extent that they accept rough rather than precise approximations to the expected inputs.

Additionally, consideration was given to the outcome when similar objects (in this case, the pushbuttons A/THR, EXPED and APPR) were confused for each other. Perceptual confusion is a type of attentional slip and on that, Wickens and Hollands (2000) stated the following:

Perceptual confusions occur because a person may recognise a match for the proper object with an object that looks like it, is in the expected location or does a similar job…

The pushbuttons on the FCU were the same colour and size. Colour coding and placement of objects has an effect on perception, in the sense that if two items are the same colour, then using colour-coding can tie together items that are spatially separated on the display (Wickens and Hollands, 2000). Additionally, two items on a cluttered display will be more easily integrated or compared if they share the same colour (different from the clutter), but the shared colour may disrupt the ability to focus attention on one while ignoring the other.

In addition to considering objects of similar size and shape, the effect of flight deck lighting was also considered. Woodson and Conover (1964) described several important factors that should be considered in the design of any lighting system:

  • suitable brightness for the task at hand
  • uniform lighting for the task at hand
  • suitable brightness contrast between task and background
  • lack of glare from either the light source or the work surface
  • suitable quality and colour of illumination and surfaces.

With regard to the FCU pushbutton layout, lighting and colour coding (see Figure 5), the physical similarities (shape, size, and colour) and close proximities between the A/THR, EXPED and APPR pushbuttons on the FCU could have contributed to any perceptual confusion.

Decision making and conscious automaticity

Wickens and Hollands (2000) outline that when undertaking a task, we must translate the information that is perceived about the environment into an action and this action may be either an immediate response or based on a more thorough, time-consuming evaluation.

In relation to the PF’s reaction to the thrust lock condition, the limitations of decision making were considered, as was the concept of automatic actions. As outlined by Klein and Klinger (1991) cited in Harris (2011), naturalistic decision making is characterised by ‘dynamic and continually changing conditions, real-time reactions to these changes, ill-defined tasks, time pressure, significant consequences for mistakes’.

In instances where actions that have become well-learned, ‘it is as though practice leads to a mental repackaging of our behaviour…that can be set off with only a brief conscious thought…’ (Wheatley and Wegner, 2001). In this case, the PF pressing the instinctive disconnect buttons was achieved without any time-consuming conscious elements.


The International Civil Aviation Organization (ICAO 2016) defined fatigue as:

A physiological state of reduced mental or physical performance capability resulting from sleep loss, extended wakefulness, circadian phase, and/or workload (mental and/or physical activity) that can impair a person’s alertness and ability to perform safety-related operational duties.

Fatigue can have a range of adverse influences on human performance. These include:

  • slowed reaction time
  • decreased work efficiency
  • increased variability in work performance
  • lapses or errors of omission (Battelle Memorial Institute 1998).

Time of day can be important for determining whether an individual is in a circadian low or high.

Human circadian rhythm is partially determined by the environmental light-dark cycle (Duffy, Kronauer, & Czeisler, 1996). The challenge can be for people to maintain alertness during the night-time hours and reduced sleepiness during the daytime rest break.

The Civil Aviation Safety Authority (2012) stated the following:

The circadian cycle has two periods of sleepiness, known as the circadian trough and the circadian dip. The circadian trough occurs typically between 0200 and 0500 hours (or dawn). During the circadian trough the body’s temperature is at its lowest level and mental performance, especially alertness, is at its poorest.

In the context of time on duty, Goode (2003) identified numerous studies that show an empirical relationship between work patterns and deteriorating performance. In accidents where fatigue was attributed, 20 percent occurred in the tenth (or more) hour of duty.

Caldwell (2003) stated that ‘the primary determinant of the level of fatigue is the time awake since the last sleep period.’ Russo and others (2005) found that ‘significant visual perceptual, complex motor and simple reaction time impairments began in the 19th hour of continuous wakefulness.’ As part of an NTSB study of short-haul domestic air carrier accidents from 1978 to 1990, ‘time since awake’ was a predominant factor, and often related to ‘ineffective decision making’.

The following data was relevant to the PF’s fatigue assessment. The PF:

  • usually obtained about 7 hours of sleep a night between 2300 and 0600
  • had conducted two flights over the previous 3 days (one of which was a positioning flight)
  • duty ended at 2115 the previous day, resulting in a 17-hour break prior to starting duty on the day of the occurrence
  • woke at about 0600 and commenced duty in Melbourne at 1415
  • reported feeling well rested
  • positioned to Perth, before operating the occurrence flight
  • recalled feeling ‘okay’ around the time of the occurrence, but had been awake for about 19.5 hours.

The occurrence took place at about 0130, which was 11 hours and 15 minutes after the PF’s duty commenced. However, the descent was taking place close to a known window of circadian low.

Along with the night conditions, with a relatively low-level of lighting in the flight deck, this may have contributed to feelings of sleepiness.

The ATSB evaluated the PF’s level of fatigue using two biomathematical models, Fatigue Avoidance Scheduling Tool (FAST) and System for Aircraft Fatigue Evaluation (SAFE). These models are decision aids designed to assess and forecast performance changes induced by sleep restriction and time of day.

Both models indicated a moderate level of fatigue. The FAST results indicated that at the time of the occurrence, there was a moderate likelihood that the PF was experiencing a level of fatigue known to have a demonstrated effect on performance. The SAFE results predicted that the PF would have felt ‘moderately tired, let down’ at the time of the occurrence, and in a moderate to high-risk category for experiencing the effects of fatigue.

The following data was relevant to the PM’s fatigue assessment. The PM:

  • usually obtained about 7.5 hours sleep a night between 2300 and 0630
  • was on a rostered period of leave in the two weeks prior to the occurrence
  • was in Perth on the day of the occurrence and woke at about 0630 Western Standard Time and had therefore been awake for about 17 hours at the time of the occurrence
  • commenced duty in Perth at 1800
  • reported feeling well rested and having adequate sleep the night before the occurrence
  • did not report any fatigue-related concerns associated with the occurrence flight.

Operator fatigue management

Organisations holding an Air Operator Certificate are generally required to comply with the Civil Aviation Orders Part 48 Flight Time Limitations (CAO 48). However, the Civil Aviation Safety Authority had granted the operator an exemption from CAO 48, under a specific instrument. This exemption was in force at the time of the occurrence. In place of the CAO 48 limitations, the operator was required to observe specific flight and duty limits contained in schedules to the instrument. With respect to this occurrence, the following flight and duty limits were relevant:

  • where the previous duty period did not exceed 12 hours, the time free of duty shall be 10 hours
  • the maximum hours per flight duty period for a local start time between 1300 and 1459, with one or two sectors, was 13 hours
  • flight deck duty limits for operations involving two crew was 10 hours.


In the context of aviation, workload has been described as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’ (Orlady and Orlady, 1999). A person experiences workload differently, based on their individual capabilities and the local conditions at the time. These conditions can include the following:

  • training and experience in the situation at hand
  • the operational demands during that phase of flight
  • if the person is experiencing the effects of fatigue
  • level of automation in use, and the mental requirements in interpreting their actions.

Research on unexpected changes in workload during flight has found that pilots who encounter abnormal or emergency situations experience a higher workload with an increase in the number of errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983).

Additionally, Holmes and others (2003) outline that high workload and distractions can result in a pilot scanning fewer instruments and checking each instrument less frequently.

Pilot recency and skill decay

The Civil Aviation Safety Regulations CASR 1998 Part 61: Flight Crew Licencing outlines that recent experience, or recency, refers to undertaking particular flight operations in the past 90 days. These flying experiences include take-off and landings, or instrument approaches, for example. Recency will generally be measured by flight hours (Haslbeck and others, 2014) or sectors flown (Ebattson, and others, 2010).

The concept of maintaining recency is important to reduce flight skill decay. In a commercial aviation context, Childs and Spears (1986) suggest that cognitive and procedural elements of flying skills decay more rapidly than control-oriented skills. Pilots were observed to have difficulty correctly identifying cues and classifying situations, although once a situation was correctly classified, they remembered what to do. Therefore, they propose that flying training should focus on pilot monitoring skills and recognition of different situations.

Despite the PF having management responsibilities, the PF had almost 70 hours in the previous 90 days, albeit with a significant training duty component. As a result, there was insufficient evidence to determine whether recency and/or skill decay had any influence on the flight crew’s actions.


Photo (C) Victor Pody 


While conducting an arrival procedure, prior to commencing an approach into Melbourne, Victoria on 15 May 2015, the Skytraders Airbus A319 descended to about 2,200 ft, which was below the ATC-assigned altitude of 3,000 ft. The crew broke off the arrival procedure and climbed to the new ATC cleared altitude of 5,000 ft before returning to land at Melbourne.

During the descent below 3,000 ft, the aircraft’s Terrain Avoidance and Warning System (TAWS) initiated a number of warning alerts, the speed limit for the aircraft flaps was exceeded, and the Minimum Safe Altitude Warning System (MSAW) initiated an alert to the ATC controller. Critically, during the 26 seconds from the time that the PF pressed the instinctive disconnect pushbutton on the thrust levers to when the aircraft reached its minimum altitude, the aircraft descended just over 1,000 ft and increased speed by about 100 kt.

The event was initiated by an inadvertent switch selection by the pilot flying (PF). This was followed by a combination of errors, rapidly changing events, high workload and an apparent response to a pitch-up illusion, resulting in the aircraft quickly developing a very high rate of descent and increasing airspeed.

Inadvertent FCU selections

As the aircraft was approaching the localiser for Melbourne runway 16, the PF recalled intending to arm the aircraft’s autoflight system (AFS) to capture the localiser for the approach. This required the PF to press the APPR pushbutton on the Flight Control Unit (FCU). Instead, the PF mistakenly pressed the EXPED pushbutton and the AFS entered the expedite descent mode. In an apparent attempt to cancel the expedite descent mode, the PF inadvertently pressed the A/THR pushbutton, which was adjacent to the EXPED pushbutton.

The acts of pressing the EXPED and then the A/THR pushbuttons were both predicated by a prior intention to act, but neither action went as planned. In this case, this prior intention was the pressing of the APP push button, which was part of a routine set of actions. Routine actions are generally characterised as requiring less attention.

The pressing of the A/THR was an apparent instinctive reaction to realising that an error had been made. Both selections were consistent with unintentional slips. Furthermore, the similar size, shape and colour of the EXPED and APPR buttons on the FCU, as well as their close proximity, may have contributed to the error. The lighting conditions on the flight deck may have increased the difficulty for the pilot monitoring (PM) to monitor the actions of the PF.

Reaction to ‘thrust lock’ condition

After the PF inadvertently pressed the A/THR pushbutton on the FCU, the Flight Mode Annunciator and Electronic Centralised Aircraft Monitor (ECAM) identified that the autothrust system had disengaged and the thrust locked at the existing setting, which was idle. The ECAM notified the flight crew of this change by displaying the THR LK caution message, as well as an associated procedure. The flight warning computer simultaneously sounded the caution aural alert, while the FMA’s autothrust column displayed the changed mode. The PM immediately identified this changed autothrust condition and verbally notified the PF of the change. It could not be determined whether this call was in response to the ECAM notification with associated master caution aural alert or the FMA change.

Normal procedure for disconnecting the autothrust system was to press the autothrust instinctive disconnect (I/D) pushbutton, but this procedure first required the pilot to match the position of the thrust lever with the actual thrust setting. The thrust lever angle indicator assisted in this process.

The aim of the THR LK ECAM procedure was to remove the engines’ locked thrust condition. That procedure also included matching the thrust lever position to the actual thrust setting.

On becoming aware that the engines’ thrust had been locked, the PF reacted by pressing the autopilot and autothrust instinctive disconnect pushbuttons, thereby removing the thrust lock condition. The likely intent of disconnecting both autopilot and autothrust was to revert to a fully manual flight mode. This is supported by the simultaneous disconnection of the autopilot and autothrust systems through the use of the instinctive disconnect buttons, an automatic action to complete the apparent intent.

However, in disconnecting the autothrust, the PF did not match the thrust levers to the current power or set the desired power. This was likely to be a lapse, which is ‘simply omitting to perform one of the required steps in a sequence of actions’ (Harris, 2011). As to why this lapse occurred, the PF’s incomplete response to the ‘thrust lock’ condition may have been a result of a response consistent with a perceived urgency to handle an undesirable state, particularly as the instinctive disconnect pushbuttons were designed for a quick response

High thrust with pitch-down attitude

As a result of not matching the thrust lever angle to the locked thrust setting when disengaging the thrust lock condition, the thrust increased to the climb setting at which the thrust levers were positioned. This resulted in a significant, unexpected thrust increase. The PF responded by applying pitch-down inputs on the side stick and a few seconds later retarded the thrust levers to idle. The pitch-down attitude with high thrust—the engines did not respond to the commanded thrust reduction for a further few seconds—resulted in the aircraft adopting a rapidly accelerating downward vector. At about this time the altitude alert began to chime and, shortly thereafter, the aircraft descended through its clearance limit altitude.

As the aircraft passed through the clearance limit altitude, the first of the TAWS alerts triggered. The PF responded with a declared intent to go-around and rapidly positioned the thrust levers to full power. However, the PF did not raise the aircraft’s pitch attitude to the recommended 15 degrees nose up for the conduct of a go-around. While the PF commenced some pitch-up commands, the aircraft’s attitude remained well below the horizon, resulting in a continuation of the accelerating airspeed and high rate of descent.

Just as the engines began to increase thrust, the second TAWS alert triggered. The procedural response to this second alert was to apply full backstick and maintain that position while setting the thrust to maximum power. However, the PF again responded to the increasing engine thrust with pitch-down commands, resulting in a continuation of the aircraft’s downward flight path. The PF arrested the descent after about 10 seconds, during which time a further TAWS alert triggered.

The flap overspeed

During the period of high thrust, the PM selected the flaps from 1 to UP as the aircraft was accelerating through 260 kt. The slats were not fully retracted for a further 12 seconds, by which time the aircraft had accelerated to more than 310 kt. The limit speed for flap 1 was 230 kt.

The effect of pitch-up illusions during rapid thrust increases

The PF did recall applying pitch-down side stick input during the rapid thrust increases and did not identify the increasing rate of descent, resulting from the nose-down attitude. The PF did, however, recall thinking that the aircraft was pitching up. Throughout the occurrence, the night conditions and operations within cloud resulted in the absence of a natural horizon. It was therefore likely that the PF’s pitch-down side stick inputs were in response to pitch-up (somatogravic) illusions caused by the unexpected and rapid increase in thrust. The PF’s susceptibility to the effects of pitch-up illusions was possibly exacerbated by also experiencing a high workload, which would likely reduce monitoring of flight instruments.

The effect of the pitch-up illusion influenced the breach of altitude, the EGPWS alerts, and the exceedance of the flap limit speed.

The PM’s ability to influence the events

The primary role of the PM is to monitor the aircraft’s flight path and performance and immediately bring any concern to the PF’s attention. However, Dismukes and Berman (2010) have shown that, while flight crew monitoring is an important defence that is performed appropriately in the vast majority of cases, it does not always catch flight crew errors and equipment malfunctions. They also noted:

…even though automation has enhanced situation awareness in some ways…it has undercut situation awareness by moving pilots from direct, continuous control of the aircraft to managing and monitoring systems, a role for which humans are poorly suited.

When considering whether the PM was likely to be able to identify and therefore influence the events that led to the flap overspeed and the breaching of the cleared altitude, the following factors were considered. The:

  • PM verbally identified the expedite descent mode change and the appearance of the ‘thrust lock’ condition
  • PM had difficulty in identifying the PF’s actions, being unable to see the PF selections on the FCU
  • lighting levels in the flight deck were low
  • reduced communication between the flight crew—specifically, the PF did not communicate an intended response to the expedite descent mode engagement, THR LK ECAM message, or the various autopilot disconnections and reconnections
  • PF did not announce mode changes annunciated on the FMA as required by the standard operating procedures, those changes being resultant from FCU and autoflight system inputs made by the PF
  • PF’s response to the thrust lock condition was contrary to normal procedure
  • PM’s attention was probably focused on the flap speed when the aircraft started to rapidly accelerate early in the occurrence. By the time that the PM had selected the flap up, the aircraft had developed a very high rate of descent and descended through the clearance limit altitude
  • PM recalled that there was ‘a lot of button pressing’ throughout the occurrence and that the autopilot was disengaged several times.

The period of time from the inadvertent FCU selections through to the aircraft returning to a positive rate of climb was short but characterised by rapidly changing events with multiple visual and aural alerts. The PM’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine nature of the event, actions of the PF, reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Crew workload

Pilots who encounter abnormal or emergency situations experience a higher workload with an increase in performance errors compared to pilots who do not experience these situations (Johannsen and Rouse, 1983). During the occurrence, the attention of the flight crew was likely divided between a number of different information cues and task requirements, from the time the PF made the inadvertent selections on the FCU, through to when the aircraft began to climb.

These included:

  • multiple aural warnings and alerts
  • identifying and responding to mode changes, including appropriate actions to address the THR LK ECAM message
  • disengagements and re-engagement of the autopilot
  • focus on airspeed (mostly by the PM)
  • interactions with ATC towards the end of the occurrence sequence.

At the time, the aircraft was in the descent phase, which inherently has a higher workload. The PM recalled that the workload became very high after the inadvertent FCU selections occurred. The high workload experienced by the PM was demonstrated in the use of an incorrect call sign during

ATC communications, as the aircraft started to climb out.

The degree of recollection from both crew after the occurrence also indicated that they experienced a high workload over a short period of time, as details including the numerous aural warnings (including the EGPWS), one of the inadvertent FCU selections and autopilot changes were not recalled. Overall, the high workload the flight crew experienced appeared to have limited their capacity to identify mode changes, such as autopilot disconnections, and to respond to the aircraft’s undesired high rate of descent.

Crew fatigue

The PF awoke at a normal time of 0630, signed on at Melbourne and did not report receiving any rest before or during the operation from Perth to Melbourne. It is reasonable to conclude that, due to time awake, time on duty and the time of day, the PF was probably experiencing a level of fatigue known to have at least some effect on performance. This was predicted by biomathematical fatigue models. There was, however, insufficient evidence to indicate that fatigue contributed to the occurrence. The ATSB also did not ascertain any systemic issues associated with the operator’s management of fatigue.


From the evidence available, the following findings are made with respect to the descent below minimum permitted altitude involving an A319, VH-VCJ, near Melbourne Airport, Victoria on 15 May 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance.

A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

  • The pilot flying inadvertently selected the EXPED pushbutton instead of the APPR pushbutton, and, in an attempt to correct the error, pressed the A/THR pushbutton, creating a thrust lock condition.
  • In attempting to remove the thrust lock condition, the pilot flying pressed the instinctive disconnect pushbutton but did not move the thrust levers to match the locked thrust setting. As the thrust was locked at idle while the thrust levers were set to climb thrust, this resulted in an unexpected, significant thrust increase.
  • The pilot flying likely experienced pitch-up illusions during two rapid thrust increases and responded to these illusions with pitch-down sidestick input.
  • Pitch-down inputs by the pilot flying, combined with a very high thrust setting, resulted in a very high rate of descent with rapidly increasing airspeed. This led to the breach of the cleared minimum descent altitude, as well as triggering a number of Enhanced Ground Proximity Warning System alerts.
  • The rapidly changing aircraft state led to the crew experiencing a high workload. This was likely to have limited their capacity to identify mode changes and to respond to the aircraft’s undesired high airspeed and rate of descent.
  • The pilot monitoring’s ability to identify and influence the rapidly changing situation was likely affected by the non-routine actions of the pilot flying, the reduced communication between the flight crew and an apparent focus on the flap speed exceedance as the aircraft started to accelerate.

Other factors that increased risk

  • At the time of the occurrence, the pilot flying was likely experiencing a level of fatigue known to have a demonstrated effect on performance, predominantly due to the time of day and time awake.
  • The aircraft’s rapidly increasing airspeed resulted in the limit speed for the extension of the aircraft slats being significantly exceeded.

SOURCE: Australian Transport Safety Bureau. Excerpted from  Descent below minimum permitted altitude involving Airbus A319, VH-VCJ. Aviation Occurrence Investigation AO-2015-048. Final report – 24 November 2017 


  1. The Head-Up Illusion: do you remember it?
  2. Armavia A320 crash during go-around at night in poor meteorological conditions
  3. Tatarstan B735 crash during go-around at night. Learning from the recent past
  4. Going around with all engines operating
  5. Speaking of going around
  6. Loss of flight crew airplane state awareness 
  7. Let’s go around
  8. Flydubai accident Interim Report


minime2By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day 

Intersection takeoffs? maybe you shouldn’t

By reducing the amount of runway used during takeoff, pilots have less runway available to them in the event of a system or engine malfunction during takeoff, to abort the takeoff or to perform an emergency landing. This increases the risk of injury, death and aircraft damage.


Photo NTSB

NTSB Safety Alert. 071-17. September 2017

Do Your Takeoff Homework; Runway Length Matters. Understanding the Potential Hazards of Intersection Takeoffs

The problem

Typically used to save time, intersection takeoffs are a common practice in aviation, especially in general aviation operations. However, pilots may not fully understand the potential risks associated with conducting intersection takeoffs.

If an aircraft experiences a problem while conducting an intersection takeoff, the available runway remaining to abort the takeoff or perform an emergency landing is reduced or eliminated, resulting in greater risk of injury or aircraft damage.

Related accidents

The National Transportation Safety Board (NTSB) has investigated several accidents involving pilots who were conducting intersection takeoffs, including the following:

1. Instead of using the full runway length of 6,179 ft for takeoff, the pilot of a Monnett Sonex experimental amateur-built airplane chose to conduct an intersection takeoff with about 2,570 ft of available runway. Shortly after takeoff, the airplane lost engine power and impacted parked vehicles near the departure end of the runway during the pilot’s attempt to turn back for an emergency landing (figure 1 shows the airplane’s takeoff and flightpath). Had the pilot used the entire runway for takeoff, there likely would have been sufficient available runway remaining to land the airplane following the loss of engine power. (CEN15FA249)

Fig 1

Figure 1. Map showing Monnett Sonex airplane’s flightpath

2. A sport pilot of a Luscombe 8A and his flight instructor initiated takeoff from a runway intersection, eliminating nearly 700 ft of usable runway. About 100 ft above the runway, the engine lost partial power.

With insufficient runway remaining on which to land and obstacles at the end of the runway that made a straight-ahead, off-airport landing hazardous, the flight instructor attempted to maneuver toward the ramp area adjacent to the runway. The airplane experienced an aerodynamic stall, impacted the runway in a nosedown attitude, and came to rest inverted (figure 2 shows the main wreckage). In addition, the airplane was 68 pounds over its maximum gross weight and density altitude was over 2,000 ft, which affected the airplane’s performance. The flight instructor sustained serious injuries and the sport pilot sustained fatal injuries. (ERA12FA491)

Fig 2

Figure 2. Main wreckage of Luscombe 8A

3. For schedule expedience, the pilot of a Piper PA-32 airplane, operated as a 14 Code of Federal Regulations Part 135 flight, chose to conduct an intersection takeoff using 5,550 ft of an 8,700-ft-long runway (figure 3 shows an overview of the runway environment). After takeoff, the airplane experienced a partial loss of engine power. The airplane stalled at a low altitude during the pilot’s attempt to return to the runway and impacted airport property. One passenger died, five sustained serious injuries, and one person sustained minor injuries. Based on the accident flightpath, the additional 3,150 ft of runway likely would have been sufficient to enable a straight-ahead landing on the runway after the power loss rather than a turnback. (WPR13LA045)

Fig 3

Figure 3. Runway overview

What can you do?

  • Allow adequate time for preflight preparations and taxiing to eliminate time pressure to conduct an intersection takeoff.
  • Do your homework. Know your aircraft’s takeoff and landing performance limitations based on gross weight, density altitude, and other considerations in the event of a malfunction that would require an aborted takeoff or emergency landing.
  • Communicate the plan. Ensure your pretakeoff briefing to yourself and/or your crew addresses potential emergency situations.
  • If you do perform an intersection takeoff, clearly communicate your intention to conduct an intersection takeoff, your position, and planned departure, via local air traffic control procedures to alert potential conflicting traffic.
  • Do not feel obligated to accept an intersection takeoff if it is offered to you by air traffic control.
  • For most takeoffs, use all available runway length to increase your margin of safety. Recognize that using anything less than the full length of the runway is accepting a higher level of risk.
  • In the event you need to return to the airport or runway, remember that an aerodynamic stall can occur at any airspeed, at any attitude, and with any engine power setting.

The companion video to this safety alert

Interested in more information?

  • The FAA’s “Airplane Flying Handbook” (FAH-H-8083-3B), chapter 5, “Takeoffs and Departure Climbs,” provides guidance regarding proper takeoff procedures. Takeoffs may seem simple but often present the most hazards of any phase of flight.
  • The FAA’s “Pilot’s Handbook of Aeronautical Knowledge” (FAA-H-8083-25B), chapter 2, “Aeronautical DecisionMaking,” provides pilots a systematic approach to determine the best course of action in response to a given set of circumstances.
  • An article in the July 2004 issue of Flight Training Magazine, an Aircraft Owners and Pilots Association publication, discusses the importance of alerting potentially conflicting traffic of the intent to conduct an intersection takeoff.
  • NTSB report AAR-08/03/SUM discusses a 2006 fatal accident in which a de Havilland DHC-6-100 being operated as a local parachute operation flight lost power in the right engine shortly after an intersection takeoff.

The reports for the accidents referenced in this safety alert are accessible by NTSB accident number from the Aviation Accident Database link, and each accident’s public docket is accessible from the Accident Dockets link for the Docket Management System. Safety Alert Prevent Aerodynamic Stalls at Low Altitude (SA-019) can be accessed from the Aviation Safety Alerts link.

SOURCE: Excerpted from NTSB Safety Alert. 071-17. September 2017


minime2By Laura Duque-Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day 

Eastern Air Lines Runway Excursion at La Guardia, final report

Several failures in close succession by a jetliner’s flight crew were the probable cause of Oct. 27, 2016, runway excursion at La Guardia Airport, according to the National Transportation Safety Board’s final report issued September 21, 2017. Some recurrent training issues were identified as contributing factors.


Photo (C) ABC news


History of Flight

Landing-flare/touchdown:  Landing area overshoot

Landing-landing roll:  Runway excursion (Defining event)

On October 27, 2016, about 1942 eastern daylight time, Eastern Air Lines flight 3452, a Boeing 737-700, N923CL, overran runway 22 during the landing roll at LaGuardia Airport (KLGA), Flushing, Queens, New York. The airplane travelled through the right forward corner of the engineered materials arresting system (EMAS) at the departure end of the runway and came to rest off the right side of the EMAS. The 2 certificated airline transport pilots, 7 cabin crewmembers, and 39 passengers were not injured and evacuated the airplane via airstairs.

The airplane sustained minor damage. The charter flight was operating under the provisions of 14 Code of Federal Regulations Part 121. Night instrument flight rules conditions prevailed at the airport at the time of the incident, and an instrument flight rules flight plan was filed for the flight, which originated at Fort Dodge Regional Airport (KFOD), Fort Dodge, Iowa, about 1623 central daylight time.

The first leg of the trip began on October 14, 2016, and the captain and first officer were paired from then to the incident. In post-incident statements, the flight crew indicated that the captain was the pilot monitoring (PM) for the incident flight, and the first officer was the pilot flying (PF). The first officer reported that the autopilot and autothrottles were engaged beginning about 2,500 ft after their takeoff from KFOD. Both pilots stated that the en route portion of the flight and the descent into the terminal area were uneventful but they encountered moderate to heavy rain during the final 15 minutes of the flight.

According to information from the airplane’s cockpit voice recorder (CVR), the first officer partially briefed the instrument landing system (ILS) approach for runway 13 beginning about 1848, indicating an autobrake setting of 3 and a 30º flap setting. ATIS information “Bravo” was current at that time and indicated visibility 3 miles in rain, ceiling 1,500 ft broken, overcast at 2,200 ft, wind from 130º at 9 knots, and that braking action advisories were in effect. About 1852, the first officer began briefing the ILS approach for runway 22 after the captain clarified, based on the ATIS recording, that runway 13 was being used for departures.

About 1902, as the airplane descended through 18,000 ft msl, the flight crew completed the approach briefing for runway 22, with the same autobrake and flap setting as indicated earlier, as well as the decision altitude and visibility required for the approach, the touchdown zone elevation, and a reference speed (Vref) of 137 knots. ATIS information “Charlie” was current at that time and indicated visibility 3 miles in rain, ceiling 900 ft broken, overcast at 1,500 ft, and wind from 120º at 9 knots.

The flight crew also discussed the captain manually deploying the speed brakes (the airplane’s automatic speed brake module had been deactivated 2 days before the incident and deferred in accordance with the company’s minimum equipment list (MEL), with corrective action scheduled for November 4, 2016). In reference to the manual deployment of the speed brakes, the captain stated at 1902:44.5 “you’re gonna do these. I’m gonna do this” to which the first officer replied “[that] is correct.”

About 1927, the flight was provided vectors to the final approach course for the ILS approach to runway 22. About 1936, the flight was cleared for the approach. The first officer then called for the landing gear to be extended and the flaps set at 15º. About 1937, the captain stated that the localizer and glideslope were captured. About 1938, as the airplane neared the final approach fix, the flight crew completed the landing checklist and configured the airplane for landing, with flaps set to 30º.

The CVR indicates that the captain pointed out the approach lights about 1939. The first officer reported, and flight data recorder (FDR) data indicate, that about 1940:12, he disconnected the autopilot when the airplane’s altitude was about 300 ft radio altitude, as required by Eastern Air Lines standard operating procedure. FDR data indicate that the first officer disconnected the autothrottles about 1940:19.

FDR data indicate that, shortly after the first officer disconnected the autopilot and autothrottles (about 300 ft radio altitude), the airplane began to increasingly deviate above the glideslope beam and crossed the threshold at a height consistent with the threshold crossing height of the VGSI, which was not coincident with the glide slope beam. CVR data indicate that between 1940:35 and 1940:46, the enhanced ground proximity warning system alerted the decreasing altitude in increments of 10, beginning at 50 ft. The pitch attitude started to increase in the flare from 2.8° at a radio altitude of about 38 ft. After the 20-ft alert, the captain stated “down” at 1940:43.3. After the 10-ft alert, the captain stated, “down down down down you’re three thousand feet remaining” at 1940:46.6. There was no callout of spoilers or thrust reversers during the rollout on the CVR.

FDR data and performance calculations indicate that the airplane crossed the runway threshold at a radio altitude of 66 ft, with an increasing glideslope deviation and a descent rate of about 750 ft per minute. When the airplane had travelled about 2,500 ft beyond the runway threshold, its descent rate decreased to near zero, and it floated before touching down. The captain later reported that the descent to the touchdown zone was normal until the flare. He stated that the airplane floated initially in the flare, which prompted the captain to tell the first officer to “get it down.”

The first officer recalled hearing the captain’s instruction to “put [the airplane] down” during the flare but was not certain how far down the runway the airplane touched down. FDR data indicate that at 1940:51.8, the airplane’s main landing gear touched down; maximum manual wheel brakes were applied at main gear touchdown. The throttles were not fully reduced to idle until about 16 seconds after the flare was initiated, and after the airplane had touched down.

The touchdown point was about 4,242 ft beyond the threshold of the 7,001-ft-long runway. The nose gear initially touched down about 2 seconds after the main landing gear but rebounded into the air due to aft control column input. The nose gear touched down a second and final time at 1940:56.8.

The captain reported that, as briefed, he manually deployed the speed brakes, which FDR data indicate were manually extended to full at 1940:56.3, about 4.5 seconds after the main landing gear touched down and the airplane had travelled about 1,250 ft farther down the runway from the touchdown point. At 1940:59.8, when the airplane had travelled about 1,650 ft down the runway from the touchdown point (and 5,892 ft from the threshold), maximum reverse thrust was commanded. The captain reported that he saw the end of the runway approaching and began to apply maximum braking, as well as right rudder because he thought it would be better to veer to the right rather than continue straight to the road beyond the end of the runway.

The first officer reported that the captain did not, as required in the operator’s procedures, tell him that he was attempting to brake and steer the airplane during the landing rollout, and no such callout is recorded on the CVR. The first officer stated that the airplane was pulling to the right “really hard,” which prompted him to apply left rudder. He reported that the left rudder input was counter to his expectation due to a 9-knot crosswind from the left, which he expected to counteract with right rudder input. He attempted to maintain alignment with the runway centerline by applying left rudder and overriding the autobrakes with pressure on the brake pedal.

At 1941:08.3, the CVR recorded the sound of rumbling, consistent with the airplane exiting the runway. The airplane then entered the EMAS about 35 knots groundspeed and came to rest 172 ft beyond the end of the runway and to the right of the EMAS. Review of the CVR recording revealed that, after the airplane came to a stop, the first officer twice remarked that they should have conducted a go-around, and the captain agreed. The first officer later reported that he did not believe the approach or landing were abnormal at the time. The captain later stated that he should have called for a go-around when the airplane floated during the flare.


Photo (C) REUTERS Lucas Jackson

Flight Crew Information

Pilot 1

Pilot 2

Meteorological Information and Flight Plan


At 1851 EDT, (ASOS) at KLGA reported the wind from 090° true at 9 knots, visibility of 3 statute miles (sm), moderate rain, ceiling broken at 900 ft agl, overcast clouds at 1,500 ft agl, temperature of 13°C and a dew point temperature of 11°C, and altimeter setting of 30.14 inches of mercury. Remarks included: surface visibility of 4 sm, precipitation accumulation of 0.14 inch since 1751 EDT.

At 1951 EDT, KLGA ASOS reported the wind from 100° true at 10 knots with gusts to 15 knots, visibility of 3 sm, moderate rain, mist, ceiling overcast at 1,000 ft agl, temperature of 13°C and a dew point temperature of 12°C, and an altimeter setting of 30.10 inches of mercury. Remarks included: surface visibility of 4 sm, precipitation accumulation of 0.32 inch since 1851 EDT, precipitation accumulation of 0.61 inch during previous 3 hours.

Wreckage and Impact Information

Crew:  11 Injuries: None

Passenger: 37 Injuries: None

Ground Injuries: N/A

Total 48 Injuries: None

Aircraft Damage: Minor

Aircraft Fire: None

Aircraft Explosion: None

Latitude, Longitude: 40.769167, -73.885000

As a result of the airplane’s travel through the EMAS, pulverized EMAS material (a gray, powdery residue) was noted on portions of the airplane’s exterior during postincident examination. The lower and forward portions of the airplane—fuselage, landing gear, and antennas—were coated with a dried residue resulting from the mixture of the EMAS material and rainwater. In addition, pieces of a matting material used in the EMAS were found in various locations on the airplane.

No damage or anomalies were noted during the visual examination of the nosewheel landing gear and associated assemblies. A preliminary visual examination of the main landing gear strut, doors, assemblies, associated hydraulic lines, and antiskid components did not reveal evidence of physical damage. However, after the airplane was cleaned of EMAS debris and the main landing gears were retracted, damage was noted on the underside of each gear strut. The operator indicated that the lower wire bundle support brackets for the left and right main landing gear were both damaged, as well as the wire conduit sleeve on the left main landing gear.

Each of the four main wheel tires showed cut damage in addition to normal wear. None of the observed cuts were deep enough to reach the tire treads. No flat spots or other evidence of hydroplaning was noted on any of the tires. Examination of the four brake assemblies found no evidence of damage or hydraulic leaks. No evidence of a hydraulic power malfunction or damage to any of the visible hydraulic lines was noted.

Both engines showed evidence of EMAS material and matting on the engine inlet and internal components. The No. 1 engine sustained fan blade damage, including four blades bent in the direction opposite of rotation, at the tip corner. No visible blade damage was noted on the No. 2 engine. Visual examination of the thrust reversers found no preincident anomalies. The operator later reported that, after cleaning and deploying the thrust reversers, damage was found on the inboard thrust reverser sleeves and blocker doors for both engines.


Photo (C) NTSB

Examination of the speed brake control components on the incident airplane noted the speed brake handle positioned full forward. All spoiler panels, including the ground spoilers, were found in the down or retracted position. No damage was noted to any of the ground spoilers.


No problems with communications equipment were reported.

Flight Recorders

The airplane was equipped with a cockpit voice recorder (CVR) and a flight data recorder (FDR). Both recorders were removed from the airplane and retained by the NTSB for further examination and readout at the NTSB’s Recorder Laboratory in Washington, DC. The recorders showed no signs of damage.

Cockpit Voice Recorder

The CVR, a Honeywell 6022, serial number 3452, was a solid-state CVR that recorded 120 minutes of digital audio. It was played back normally without difficulty and contained excellent quality audio information. The recording was transcribed in two parts focusing on the en route approach briefing and the approach, landing, and events thereafter until the end of the recording. Part one began at 18:48:06 EDT, when flight 3452 was en route at FL390, and continued until 1902:52 EDT. Part two began at 1918:01 EDT and ended at 1948:32 EDT (the end of the recording

Flight Data Recorder

The FDR, a Honeywell 4700, serial number SSFDR-16936, recorded airplane flight information in digital format using solid-state flash memory as the recording medium. The FDR could record a minimum of 25 hours of flight data and was configured to record 256 12-bit words of digital information every second. The FDR was designed to meet the crash survivability requirements of Technical Standard Order C-124.

Data from the FDR were extracted normally. The event flight was the last flight of the recording, and its duration was about 2 hours and 19 minutes.

Medical And Pathological Information

Eastern Air Lines conducted drug and alcohol testing for both pilots about 6 hours after the incident. Test results were negative for alcohol and major drugs of abuse.

Organizational And Management Information

Company Overview and Management Organization

Eastern Air Lines, Inc., received certification to operate as a Part 121 supplemental carrier on May 15, 2015. Subsequently, Eastern Air Lines began scheduled charter services to Havana and four other cities in Cuba. Before the incident, the airline also launched charter service to other Latin American and Caribbean destinations. The airline’s sole base of operations was at Miami International Airport, Miami, Florida, at the time of the incident. It employed 64 pilots and had a fleet of five Boeing 737 airplanes, including the incident airplane; the other four airplanes were Boeing 737-800 series.

The airline’s vice president of flight operations was responsible for the flying operations of the airline, flight crew training, the operations control center (OCC), and ground operations. The chief pilot, manager of flight operations training, director of inflight, OCC director, manager of flight standards, and manager of charter operations all reported to the vice president of flight operations.

At the time of the incident, Eastern Air Lines’ director of safety and security reported directly to the chief executive officer and was the only staffed position in the safety department. The director of safety and security had been hired about 2 weeks before the incident and was in the process of being trained by his predecessor, who had held the position from 2013 until September 2016. While he was being trained, the vice president of regulatory compliance served as the acting director of safety and security.

According to the vice president of flight operations and the manager of flight operations training, the Boeing 737 Flight Crew Training Manual and the Boeing 737 Flight Crew Operations Manual were used as the airline’s systems training material and procedures manual, respectively.

Safety Management

The FAA approved Eastern Air Lines’ safety management system (SMS) implementation plan in February 2016. The first segment of implementation included administering the SMS implementation plan and developing a tool (Aviation Resource Management Solutions) that was designed to help the company with safety risk assessment, assurance, and risk management. The former director of safety and security stated that, at the time of the incident, the first segment of the implementation was not fully realized and they were working toward an October 30, 2016, full implementation date.

Crew Resource Management (CRM) and EMAS Training

The manager of flight operations training at the time of the incident was also a check airman. He had been manager of training for about 1.5 years and had been with the company for 2 years.

The airline provided three courses on CRM: new hire, captain’s upgrade, and recurrent. The new hire CRM course consisted of a 2-hour segment covering CRM background, communications processes and decision behavior, team building and leadership, workload management and situational awareness, individual factors and stress reduction, and error management. The upgrade training included 1 day of ground school in which 1 hour was dedicated to CRM. Upgrade training also incorporated a captain’s leadership course that included content on the captain’s authority, briefings, workload management, and sterile cockpit procedures in accordance with 14 CFR 121.542, “Flight Crewmember Duties.” The recurrent training included a 3.5-day ground school for captains and first officers in which 1 hour was devoted to CRM training. All courses were taught using presentation slides, open discussion, and videos created by contracted training organizations.

The captain reported after the incident that he believed he and the first officer were working well as a crew during the trip. He stated that he did not call for a transfer of controls during the landing rollout and that, in hindsight, he should have. He further mentioned that he thought it was “OK” for both crewmembers to be applying brakes. The first officer reported a “lack of communication” during the landing rollout because the captain did not say that he was taking control of the airplane. Another Eastern Air Lines first officer who had flown with the captain before the incident described the captain’s CRM as “good.”

At the time of the incident, EMAS training was not part of Eastern Air Lines’ pilot training program. The captain stated during postincident interviews that he had forgotten that an EMAS was installed at the end of runway 22, that he had read about the systems, but had not had any training on them.

FAA Oversight

The former FAA principal operations inspector (POI) stated that he had been assigned to Eastern Air Lines before the company received its operating certificate. He stated that his duties included, most critically, surveillance and reviewing the airline’s manuals, including any changes to the manuals. He traveled to the airline’s headquarters about once or twice a week.

He also stated that he interacted most with the operations management, director of safety and security, and the CEO.

The former director of safety and security stated that during his time at Eastern Air Lines, he “seldom” interacted with the FAA POI or other FAA personnel. Other management personnel stated they interacted with the FAA daily or multiple times per week, via telephone, e-mail, or in person at the FAA’s office or at Eastern Air Lines’ office. The manager of flight operations training stated that he did not directly interact with the POI and usually went through the vice president of flight operations or the chief pilot. The vice president of flight operations stated that they had been assigned a new POI 5 months before the incident and that the interaction with the new POI was “really great.”

The FAA POI at the time of the incident reported that he mostly communicated with Eastern Air Lines’ director of flight operations and chief pilot but had also communicated with the director of flight training. He categorized the communication as “very good.” He added that Eastern Air Lines was the only certificate he managed and that FAA resources were limited such that they only had one person in the office who was able to conduct checkrides in the Boeing 737. He estimated that he was at Eastern Air Lines’ operations a “couple of times a week;” however, he had not taken part in Eastern Air Lines’ pilot training. He also stated that the training in the manual for a go-around was similar to the syllabus used by other airlines, and he “assumed” that they did some go-around training in the flare and some training in low visibility. The POI stated that, following the incident, he and Eastern Air Lines management had discussed training go-arounds once the airplane was on the ground and that further discussion was needed.

Additional Information

Sterile Cockpit Regulations

The CVR also contained conversation between the flight crew during the descent and approach below 10,000 ft that was not pertinent to the flight. Title 14 CFR 121.542, “Flight Crewmember Duties” states, in part, the following:

No flight crewmember may engage in, nor may any pilot in command permit, any activity during a critical phase of flight which could distract any flight crewmember from the performance of his or her duties or which could interfere in any way with the proper conduct of those duties. Activities such as…engaging in nonessential conversations within the cockpit and nonessential communications between the cabin and cockpit crews…are not required for the safe operation of the aircraft.

…critical phases of flight include all ground operations involving taxi, takeoff and landing, and all other flight operations conducted below 10,000 feet, except cruise flight.

Runway Condition Reports from Other KLGA Arrivals

Flight crews from four flights that landed on runway 22 within 10 minutes of the incident flight reported braking as “good” or “fair.” One crew reported noticing their airplane’s antiskid brake system pulsating during the landing rollout. Others reported that there was no hydroplaning or decrease in braking performance.


Automatic terminal information service (ATIS) “Bravo” was current when the first officer, who was the pilot flying, began to brief the instrument landing system approach for runway 22. The ATIS indicated visibility 3 miles in rain, ceiling 1,500 ft broken, overcast at 2,200 ft, wind from 130º at 9 knots, and that braking action advisories were in effect. The approach briefing included the decision altitude and visibility for the approach and manual deployment of the speed brakes by the captain, with the captain stating “you’re gonna do these. I’m gonna do this” to which the first officer replied “[that] is correct.” (The airplane’s automatic speed brake module had been deactivated 2 days before the incident and deferred in accordance with the operator’s minimum equipment list, which was appropriate).

The flight crew completed the approach briefing after descending through 18,000 ft mean sea level and completed the landing checklist when the airplane was near the final approach fix.

The airplane was configured for landing with the autobrake set to 3 and the flaps set to 30º.

ATIS information “Charlie” was current at that time and indicated visibility 3 miles in rain, ceiling 900 ft broken, overcast at 1,500 ft, and wind from 120º at 9 knots.

Flight data recorder (FDR) data and postincident flight crew statements indicate that the airplane was stabilized on the approach in accordance with the operator’s procedures until the flare. The airplane crossed the runway threshold at 66 ft radio altitude at a descent rate of 750 ft per minute. When the airplane had traveled about 2,500 ft beyond the runway threshold, its descent rate decreased to near zero, and it floated during the flare. Its pitch attitude started to increase in the flare from 2.8° at a radio altitude of about 38 ft, which is high compared to the 20 ft recommended by the Boeing 737 Flight Crew Training Manual. Further, the first officer didn’t fully reduce the throttles to idle until about 16 seconds after the flare was initiated and after the airplane had touched down. The initiation of the flare at a relatively high altitude above the runway and the significant delay in the reduction of thrust resulted in the airplane floating down the runway, prompting the captain to tell the first officer to get the airplane on the ground, stating “down down down down you’re three thousand feet remaining.”

The airplane eventually touched down 4,242 ft beyond the runway threshold. According to the operator’s procedures, the touchdown zone for runway 22 was the first third of the 7,001-ftlong runway beginning at the threshold, or 2,334 ft. Touchdown zone markers and lights (the latter of which extended to 3,000 ft beyond the threshold) should have provided the flight crew a visual indication of the airplane’s distance beyond the threshold and prompted either pilot to call for a go-around but neither did. The point at which the airplane touched down left only about 2,759 ft remaining runway to stop. The airplane’s groundspeed at touchdown was 130 knots.

The captain manually deployed the speed brakes about 4.5 seconds after touchdown and after the airplane had traveled about 1,250 ft down the runway. Maximum reverse thrust was commanded about 3.5 seconds after the speed brakes were deployed, and, with fully extended speed brakes and maximum wheel brakes (which were applied at main gear touchdown) the airplane achieved increasingly effective deceleration. Its groundspeed was about 35 knots when it entered the EMAS. With the effective deceleration provided by the fully extended speed brakes, maximum wheel brakes, and reverse thrust, the flight crew would have been able to safely stop the airplane if it had touched down within the touchdown zone.

The captain later stated that he had considered calling for a go-around before touchdown but the “moment had slipped past and it was too late.” He said that “there was little time to verbalize it” and that he instructed the first officer to get the airplane on the ground rather than call for a go-around. He reported that, in hindsight, he should have called for a go-around the moment that he recognized the airplane was floating in the flare. The first officer said that he did not consider a go-around because he did not think that the situation was abnormal at that time.

Training and practice improve human performance and response time when completing complex tasks. In this case, the operator’s go-around training did not include any scenarios that addressed performing go-arounds in which pilots must decide to perform the maneuver rather than being instructed or prompted to do so. Thus, the incident flight crew lacked the training and practice making go-around decisions, which contributed to the captain’s and first officer’s failure to call for a go-around.

Following the incident, the operator incorporated go-around training scenarios in which flight crews must decide to go around rather than being instructed to do so. The company’s director of operations also stated that the company has incorporated scenarios in which go-arounds are initiated from idle power and rejected landings are performed after touchdown with the automatic speed brake inoperative. It also added a training module emphasizing that “if touchdown is predicted to be outside of the [touchdown zone], go around” and intended to require a go-around if landing outside of the touchdown zone were predicted. The operator also intended to incorporate go-around planning into the approach briefing. Flight crews would determine the cues for the touchdown zone using the airport diagram and decide at which point they would initiate a go-around if the airplane had not touched down.

Given the known wet runway conditions and airplane manufacturer and operator guidance concerning “immediate” manual deployment of the speed brakes upon landing, the captain’s manual deployment of the speed brakes was not timely. NTSB analysis of FDR data for previous landings in the incident airplane determined an average of 0.5 second for manual deployment of the speed brakes. Using the same touchdown point as in the incident, post incident simulations suggest that, if the speed brakes had been deployed 1 second after touchdown followed by maximum reverse thrust commanded within 2 seconds, the airplane would have remained on the runway surface. Therefore, the captain’s delay in manually deploying the speed brake contributed to the airplane’s runway departure into the EMAS.

During the landing roll, the captain did not announce that he was assuming airplane control, contrary to the operator’s procedures, and commanded directional control inputs that countered those commanded by the first officer. The captain later reported that he had forgotten that an EMAS was installed at the end of runway 22 and attempted to avoid the road beyond the runway’s end by applying right rudder because he thought it would be better to veer to the right. However, the first officer applied left rudder to maintain alignment with the runway centerline and to counter the airplane pulling “really hard” to the right because of the captain’s inputs. The breakdown of crew resource management during the landing roll and the captain’s failure to call for a go-around demonstrated his lack of command authority, which contributed to the incident.

At the time of the incident, EMAS training was not part of the operator’s pilot training program, but such training was added after the incident. The circumstances of this event suggest that the safety benefit of EMASs could be undermined if flight crews are not aware of their presence or purpose.


The National Transportation Safety Board determines the probable cause(s) of this incident to be:

The first officer’s failure to attain the proper touchdown point and the flight crew’s failure to call for a go-around, which resulted in the airplane landing more than halfway down the runway. Contributing to the incident were, the first officer’s initiation of the landing flare at a relatively high altitude and his delay in reducing the throttles to idle, the captain’s delay in manually deploying the speed brakes after touchdown, the captain’s lack of command authority, and a lack of robust training provided by the operator to support the flight crew’s decision-making concerning when to call for a go-around.


Aircraft Landing flare – Not specified (Factor)

Personnel issues Use of policy/procedure – Copilot (Cause)

Use of policy/procedure – Flight crew (Cause)

Lack of action – Flight crew (Cause)

Delayed action – Copilot (Factor)

Delayed action – Pilot (Factor)

Decision making/judgment – Pilot (Factor)

Organizational issues Recurrent training – Operator (Factor)

Excerpted from National Transportation Safety Board Aviation Incident Final Report  DCA17IA020


  1. Let’s go around
  2. The Organizational Influences behind the aviation accidents & incidents
  3. Speaking of going around
  4. Going around with all engines operating


minime2By Laura Duque-Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day 


The numerous safety deficiencies behind Helios Airways HCY 522 accident

Behind the well-known primary cause of this accident were less-known and less-discussed numerous regulatory and organizational factors that still can be found in many countries and airlines worldwide.


Lack of political commitment to supply the aviation authority with the resources to carry out fully its safety oversight function, safety regulatory authority not organized and staffed to effectively accomplish its regulatory and safety oversight duties, absence of leadership and oversight, inadequate work climate, operator’s incomplete management structure with qualifications of some managers not corresponding to job descriptions, airline’s philosophy and style of management not conducive to efficient and safe operations with weak work climate, large percentage of staffing with seasonal employees, reactive approach of safety management, quality assurance  not effective and deficiencies in operator’s procedures and training, are some of the factors identified.

Sounds familiar?

It’s a longish reading but worth it. So, get your favorite chair, a very big cup of Colombian coffee and enjoy!


Hellenic Republic Ministry of Transport & Communications Air Accident Investigation & Aviation Safety Board (AAIASB), Helios Airways Flight HCY522 Aircraft Accident Report. Boeing 737-31s at Grammatiko, Hellas on 14 August 2005

Published 11 / 2006

Operator: Helios Airways

Owner: Deutsche Structured Finance & Leasing Gmbh & Co

Manufacturer: Boeing Co

Aircraft Type: B 737 – 31s

Nationality: Cyprus

Registration : 5B-DBY

Place of accident: Hilly terrain in the vicinity of Grammatiko village, approximately 33 km northwest of Athens International Airport 38º 13.894’ N, 23º 58.214’ E

Date and time: 14 AUGUST 2005 – 09:03:32 h (Notes: 1. All times in the report are Coordinated Universal Time (UTC) (Local time in Hellas was UTC + 3 h). 2. Correlation of the times used in the radar and radio communication recordings, and the FDR and CVR showed differences of less than 12 seconds. The FDR time was used as the master time in this report.)

On 14 August 2005, a Boeing 737-300 aircraft, registration number 5B-DBY, operated by Helios Airways, departed Larnaca, Cyprus at 06:07 h for Prague, Czech Republic, via Athens, Hellas. The aircraft was cleared to climb to FL340 and to proceed direct to RDS VOR. As the aircraft climbed through 16 000 ft, the Captain contacted the company Operations Centre and reported a Take-off Configuration Warning and an Equipment Cooling system problem. Several communications between the Captain and the Operations Centre took place in the next eight minutes concerning the above problems and ended as the aircraft climbed through 28 900 ft. Thereafter, there was no response to radio calls to the aircraft. During the climb, at an aircraft altitude of 18 200 ft, the passenger oxygen masks deployed in the cabin. The aircraft leveled off at FL340 and continued on its programmed route.
At 07:21 h, the aircraft flew over the KEA VOR, then over the Athens International Airport, and subsequently entered the KEA VOR holding pattern at 07:38 h. At 08:24 h, during the sixth holding pattern, the Boeing 737 was intercepted by two F-16 aircraft of the Hellenic Air Force. One of the F-16 pilots observed the aircraft at close range and reported at 08:32 h that the Captain’s seat was vacant, the First Officer’s seat was occupied by someone who was slumped over the controls, the passenger oxygen masks were seen dangling and three motionless passengers were seen seated wearing oxygen masks in the cabin. No external damage or fire was noted and the aircraft was not responding to radio calls. At 08:49 h, he reported a person not wearing an oxygen mask entering the cockpit and occupying the Captain’s seat. The F-16 pilot tried to attract his attention without success. At 08:50 h, the left engine flamed out due to fuel depletion and the aircraft started descending. At 08:54 h, two MAYDAY messages were recorded on the CVR.
At 09:00 h, the right engine also flamed out at an altitude of approximately 7 100 ft. The aircraft continued descending rapidly and impacted hilly terrain at 09:03 h in the vicinity of Grammatiko village, Hellas, approximately 33 km northwest of the Athens International Airport. The 115 passengers and 6 crew members on board were fatally injured. The aircraft was destroyed.
The Air Accident Investigation and Aviation Safety Board (AAIASB) of the Hellenic
Ministry of Transport & Communications investigated the accident following ICAO practices and determined that the accident resulted from direct and latent causes.





Personnel Information

1. Captain

The Captain was male, 59 years old.

He held an Air Transport Pilot License (ATPL) issued on 27 February 1991 in accordance with JAR-FCL by LBA Germany. His ATPL license, his instrument rating category III, and his Boeing 737-300 and -800 ratings were valid until 4 June 2006.

He had attended engineering college in Dresden, East Germany from 1966 to 1970 and graduated as a pilot-engineer. He had held an ATPL issued in 1970 by the Civil Aviation Authority in East Germany.

Medical Certificate: Class A, Medical Certificate issued on 21 March 2005 and valid until 9 October 2005 with the restriction to carry two pairs of corrective lenses.

Last LPC/OPC 4 June 2005

Recurrent Training in STD 4 June 2005

Last Line Check 12 June 2005

CRM training 2 June 2005

Flying experience:

Tabla 1

The Captain had worked for the Operator for two separate time periods. According to interviews of his peers at the Operator, during the first period, he presented a typical “command” attitude and his orders to the First Officers were in command tone. During the second period, his attitude had improved as far as his communication skills were concerned.

According to an oral statement by the next of kin, the Captain was a quiet and professional pilot. His hobby was to construct and fly model aircraft. He used no drugs or medication, and he used alcohol occasionally and with moderation.

2. First Officer

The First Officer was male, 51 years old.

He held an Air Transport Pilot License (ATPL) issued in accordance with JAR-FCL by the United Kingdom. His ATPL license and Boeing 737-300 and -800 ratings were valid until 31 March 2006 and his instrument rating category III was valid until 31 October 2005.

He had attended and graduated from Chelsea College with an Engineering Diploma. He was also trained at Oxford Air Training School to become a pilot.

Medical Certificate: Class A Medical Certificate issued on 25 April 2005 and valid until 29 October 2005 with no restrictions.

Last OPC 9 March 2005

Last Line Check 3 February 2005

Recurrent training in STD 9 March 2005

CRM training 28 February 2005

Flying experience:

Tabla 2

The First Officer spent the day preceding the accident at his summer house with the family. He drove home in the evening, had a normal dinner (no alcohol) and he went to bed at about 23:00 h. He woke up early in the morning and drove to the airport in order to report for duty on time.

According to statements by his next of kin, colleagues, and friends, the First Officer was an optimist, calm, active and a social person. He had expressed his views several times about the Captain’s attitude. He had also complained about the organizational structure of the Operator, flight scheduling and he was seeking another job. He used no drugs or medication and he did not smoke or drink alcohol.

In his last three OPCs, there were the following remarks/recommendations:

9 March 2005 “Standards achieved, but with room for lots of improvement. Some difficulties met in complex tasks. Do not rush through check lists. Recommendation – improve your understanding on the use of AFS”.

3 September 2004 “Overall standard is above average. Very Good LVO recognition of abnormalities. EMERGENCY DESCENT [capital letters used by the TRE] repeated at very good standard. Keep the good work”.

13 April 2004 “Overall performance at standard – Good Manual control, and 1 ENG G/A. –Make positive control is advisory after engine failure on T/OFF not to lose direction. Repeat – OK”.

In addition, the First Officer’s training records were reviewed for the five years he worked for the Operator. The review disclosed numerous remarks and recommendations made by training and check pilots referring to checklist discipline and procedural (SOP) difficulties.

3. Cabin Attendants

There were four cabin crew members on board, all of which met Operator proficiency and medical requirements.

Cabin Attendant number four also held a UK Commercial Pilot License (JAR CPL A/IR) with an issue date of 2 October 2003, and valid until 1 October 2008. His JAA Class 1 Medical Certificate was valid from 15 July 2005 to 17 July 2006.

Medical and Pathological Information

The Captain’s samples (obtained on 18 August 2005) tested negative for major drugs of abuse, volatile poisons, and prescription and over-the-counter medications. Due to the presence of extensive burns, the determination of blood alcohol level was not possible.

The Captain’s heart muscle samples revealed the presence of minor atherosclerosis (40% obstruction) compatible with his age. A histological examination revealed the presence of recent myocardial ischaemia.

The First Officer’s samples (obtained on 15 August 2005) tested negative for carbon monoxide, volatile poisons, major drugs of abuse, and prescription and over-the-counter medications. Although ethanol was detected (34 mg/dl, or 0.034 % weight/volume – also known as blood alcohol content), the toxicological reports stated that “the time period between the death and the collection and the analysis of specimens (24 hours) may have resulted in postmortem ethanol production.” The First Officer’s heart muscle samples revealed the presence of extensive atherosclerosis (90% obstruction in the anterior descendant and circumflex coronary artery). A histological examination revealed the presence of recent myocardial ischemia.

The Department of Cardiology of the Hellenic Air Force Medical Centre predicated that “On the basis of the data that were given to us, such as the height of the flight, the fact of the existing heart function (pump function) upon crashing, and the fact that there is a similar pathologo-anatomical image both in the ‘suffering’ heart (myocardium) of the co-pilot, and in the ‘healthy heart’ of the pilot, we estimate that the brain hypoxia was the dominant and determinant cause that incapacitated the flying crew, with the findings of the heart being the matter of course and epiphenomenon of the prolonged hypoxia.”


1. Crew

Based on indubitable evidence, the Board concluded that the pressurization mode selector was in the MAN (manual) position from the time the aircraft was still on the ground and was led to believe that the selector had remained in the MAN (manual) position after the Pressure Leak Test, the last known time the particular selector had been manipulated. When the aircraft departed, the pressurization mode selector remained in the MAN (manual) position (instead of AUTO) and remained there until the aircraft impacted the ground almost three hours later. Naturally, the fact that the mode selector position was not rectified by the flight crew during the aircraft preflight preparations was crucial in the sequence of events that led to the accident.


Both the Captain and the First Officer were experienced pilots and had performed the preflight duties numerous times in the past. The Board examined the reasons why they could have made such a crucial omission.

Preflight duties included checking the Equipment Cooling switches, the Cabin Pressurization Panel, and the flight crew oxygen masks. When the pressurization mode selector is positioned to the MAN (manual) position, it is accompanied by an advisory, green light indicating MANUAL. Normally, with the mode selector on AUTO as prescribed by the Preflight Procedure, no illuminated indication should appear on the pressurization panel. Why an experienced crew would have failed to notice the presence of an indication they did not normally expect to see at this location in this phase of flight?

Why an experienced crew would have failed to notice the presence of an indication they did not normally expect to see at this location in this phase of flight?

A typical Preflight Procedure may contain between 40 and 80 actions to be performed by the First Officer, often under the pressure of the impending departure, and in the presence of a Captain who is waiting to call for the ensuing checklist. This procedure is performed from memory, aided by the fact that the actions are organized along the topographical location of panels in the cockpit. Memorization is beneficial for long lists of actions, but has the disadvantage that actions are performed automatically, without conscious effort and attention. This can and has, in the past, led to inadvertent omissions and other types of mistakes.

The Board was also sensitive to the fact that automatic execution of actions was very much affected by assumptions – in the case of performing a large number of verification steps, the assumption that all switches and indications were in the usual, normal for this phase of flight position. A superfluous green indication on the pressurization panel could be easily (inadvertently) overlooked when the perception was biased by the expectation that it should not be present.

Exacerbating this tendency (expectation bias) is the rarity with which switches (especially, and directly relevant to this case, the pressurization mode selector) are in other-than-their-normal position. A pilot automatically performing lengthy verification steps, such as those during preflight, is vulnerable to inadvertently falsely verifying the position of a switch to its expected, usual position (i.e. the pressurization mode selector to the expected AUTO position) – especially when the mode selector is rarely positioned to settings other than AUTO.

The Board was concerned that the overhead panel design was not conducive to safeguarding against these types of inadvertent omissions. Specifically, the color of the illuminated indication (green) does not typically imply something out of the ordinary, as did the amber (caution) or red (warning) – which would have likely attracted the flight crew’s attention that something was out of the ordinary.

After the Preflight Procedure, the crew was expected to orally execute a Preflight Checklist. Per the carrier’s FCOM, this checklist included a check of the pressurization panel:

[item 12 of 25] AIR COND & PRESS ………___PACK(S), BLEEDS ON, SET

The flight crew failed to detect the improper configuration of the pressurization panel during this checklist. Both the Captain and First Officer had repeatedly accomplished this checklist on many flights during their long careers. Their failure to properly accomplish the above checklist prevented them from capturing their earlier mistake. This was the first of two missed opportunities to notice and correct an earlier error. Various factors could have contributed to this failure.

The Board first examined the design of the checklist, and specifically the fact that the challenge part of this action item (“Air Cond & Press”) essentially combined two separate systems (air conditioning and pressurization). While this combination was certainly not random (the two systems used engine bleed air as an energy source), the corresponding response portion of the action item (“Pack(s), Bleeds ON, SET”) contained three different confirmations, only the third of which referred to the pressurization panel. In turn, this third confirmation referred to eight different actions – those that were performed earlier, during the Preflight Procedure. Contrary to the manufacturer’s original intention, however, many pilots informally reported that when performing the checklist and responding “SET” to the pressurization panel, they really only checked that the landing and cruise altitudes had been correctly set in the corresponding indicators.

The performance of checklists in routine, daily flight operations was also examined. In general, checklist items are performed by referencing a printed card. Like procedures, because they are performed repeatedly on the line, they are also performed by memory, typically in time-pressured circumstances (i.e. indirect pressure to maintain on-time departures). For these two reasons, checklists are often performed in a hurried, automatic fashion. From a human factors standpoint, rushing is known to lead to the inadequate allocation of attention to the task at hand – and thus to errors. Furthermore, like procedures, checklists are also vulnerable to “looking without seeing” because they are biased by the assumption that since each item verified an action performed only moments ago, then it must be already in the desired position/set.

Following takeoff, the flight crew was to perform an After Takeoff checklist, the first item of which was to check the pressurization system again and verify its settings. Although this checklist would have directed the flight crew’s attention to the pressurization panel, there was no evidence that the incorrect position of the pressurization mode selector was rectified. This was the second missed opportunity to note and correct an earlier error.

After Takeoff checklist is also usually performed under even more time pressured conditions and at a time when the pilots’ attention is consumed by other, concurrent tasks (e.g. retracting the landing gear and flaps, monitoring the climb, and communicating with ATC). The management of multiple concurrent tasks requires the division of attention resources and is known to force a person to devote insufficient attention to any one of the many tasks.

At an aircraft altitude of about 12 000 ft the cabin altitude warning horn sounded. Eight seconds later, the FDR showed the autopilot being disengaged, and re-engaged four seconds later. Eight seconds later, the FDR showed the auto-throttle being disengaged and the throttles retarded, but like the autopilot it also was re-engaged nine seconds later. Three seconds later, the No.2 radio was used to contact the Helios Airways Dispatcher.

The Board examined the flight crew’s actions to disengage the autopilot and auto-throttle, and to retard the throttles upon onset of the warning horn. Given that the expected reaction to a cabin altitude warning horn would have been to stop the climb (there was no evidence to this effect), the Board considered such actions to signify that the flight crew reacted to the warning horn as if it had been a Takeoff Configuration Warning (the two failures use the same warning horn sound). Similar occurrences had been reported by flight crews worldwide in the past.

Various factors for creating the potential confusion of the two experienced pilots were considered:

  1. In the course of his career, a pilot is generally likely to only hear the warning horn when it is associated with a takeoff and a takeoff configuration problem and most pilots are not very likely to experience a cabin pressurization problem and the associated warning horn at any time during their line flying.
  2. Stress, such as that caused by the onset of a loud, distracting alarm in the cockpit, combined with the element of surprise, is known to lead to automatic reactions. Automatic reactions, in turn, are typically those that result from experience and frequency of encounter and are therefore not always appropriate. The Board considered that the flight crew may have automatically reverted to a reaction based on memory before consciously processing the source and significance of the stress factor. This would also explain why the flight crew failed to realize the improbability of their interpretation of the horn as a takeoff configuration horn and why they failed to move on to gathering information for a new, correct diagnosis of the problem at hand. It is important to note that at no time during this sequence of events was the cabin altitude warning horn canceled.
  3. According to FDR data, at an aircraft altitude of about 17 000 ft, the MASTER CAUTION light was activated and was not canceled for 53 seconds. Two different events occurred at about this time, either one of which would have triggered the MASTER CAUTION light with the accompanying OVERHEAD indication on the Annunciator Panel to draw the attention of the pilots to a situation indicated on the Overhead Panel. The equipment cooling low flow detectors reacted to the decreased air density and one or both of the Equipment Cooling lights illuminated on the Overhead Panel. In addition, the oxygen masks deployed in the passenger cabin, illuminating the PASS OXY ON light, located further aft on the Overhead Panel. The Board was unable to determine which event occurred first and triggered the MASTER CAUTION. However, the fact that the flight crew had not canceled the first MASTER CAUTION meant that the second event did not trigger a second MASTER CAUTION as it was already on. Consequently, there was nothing to prompt the flight crew to look for a second indication on the Overhead Panel.
  4. At the time of onset of the MASTER CAUTION (and the OVERHEAD indication), workload in the cockpit was already high.
  5. Language difficulties between the Captain and the Helios Operations Centre, probably due to the fact that the Captain spoke with a German accent and could not be understood by the British engineer prolonged resolution of the problem, while the aircraft continued to climb. Moreover, the communication difficulties could also have been compounded by the onset of the initial effects of hypoxia.
  6. The Board recognized that from a human factors standpoint, preoccupation with one task (i.e. trouble-shooting the source of the Equipment Cooling problem) at the expense of another (i.e. trouble-shooting the source of the warning horn) was entirely plausible and has happened to experienced pilots.
  7. The combination of hypoxia and distractions generally increases stress levels. Stress is known to render human cognition (e.g. memory, attention, decision-making, risk management, communication skills) particularly vulnerable to errors
  8. The flight crew of HCY522 did not exhibit adequate CRM to help overcome the individual errors and to detect a dangerous situation that deteriorated as the aircraft continued to climb.

Given the ongoing distractions, the Captain, at least, may never have consciously and fully registered the onset of the indications and/or their significance. Unfortunately, although there were partial data to somewhat deduce the Captain’s actions at this time (from his communication exchanges with the Operator’s dispatcher and engineer), there was no possibility to establish the First Officer’s actions during this same time.

The Board evaluated what the cabin crew’s reactions might have been when the aircraft continued to climb and there was no announcement from the flight deck. There was no Operator procedure to address such a contingency. As emphasized by the Cabin Crew Manager in his post-accident statement, however, cabin crews were encouraged to take initiative. The Manager expressed his conviction that the particular cabin crew was well trained and by nature fully bound to have taken the initiative to seek an explanation for the unusual situation they were facing. The Board considered the fact that even if this was the case, it was hard for a cabin crew to assess how long to wait before contacting the flight deck – and in this case, time was of the essence as the hypoxia effects grew increasingly stronger. It was not possible to determine whether any of the cabin crew members attempted to contact the flight crew or enter the flight deck.

Data from the CVR only contained to the last 30 minutes of the accident flight and showed that at least one cabin crew member retained his consciousness for the duration of the flight and entered the flight deck more than two hours after takeoff. At the beginning of the climb phase, this cabin attendant was likely seated next to the aft galley.

In order for him to have moved forward in the aircraft to reach the flight deck, he must have used a portable oxygen bottle.

The Board found the fact that this cabin attendant might not have attempted to enter the flight deck until hours after the first indication that the aircraft was experiencing a nonnormal situation quite puzzling. Of course, in the absence of a longer-duration CVR, it was not possible to know whether this or any other cabin crew member had attempted to or succeeded in entering the flight deck. From the sounds recorded on the CVR, however, the Board could ascertain that this cabin attendant entered the cockpit using the emergency access code to open a locked cockpit door.

2. Operator

2.1 Maintenance

Based on evidence from the Helios Airways Technical Department documents relevant to manpower planning, the front line maintenance task force group consisting of four to five licensed engineers and two to three mechanics, changed, as far as the individual persons of the first group were concerned, by more than 80 % three times within 16 months (oldest EMPLOYMENT DATE: 01/11/2003 – first END DATE: 04/03/2005). The longest stay with Helios Airways up to 14 August 2005 was 21 months and the shortest three days. Both example cases above were licensed engineers and categorized as “Permanent” in the column “Employment Status” of the document. The same column contained another category, “Contract”, reserved for those licensed engineers hired through employment agencies.

Between November 2003 and August 2005 (one week before the accident occurred), 13 licensed engineers (six different European nationalities) were employed by the Helios maintenance department and subsequently left Helios. Six of them were contracted, which meant that they were paid by the employment agency that placed them with the airline. The Board believed that the very high turnover rate of maintenance personnel was not conducive to establishing and maintaining a sense of continuity and teamwork among employs, and this probably worked against setting a good foundation for proactive management and resolution of any issues in the maintenance department.

This situation has been raised as a Non-Conformance Report (NCR) during an audit carried o April 2005. The certifying staff level (number of licensed engineers), not including the Maintenance Manager, was annotated in the NCR as insufficient to meet the requirements of Part 145. The manpower plan appeared to only be a guide and did not fully reflect the current status of manpower usage or requirements. Despite the corrective action to the NCR stated by the Operator’s maintenance management to improve the situation, the responses by airline management continued to prove inadequate to provide the necessary resources and financial support.

The former Technical Manager of the Operator was asked why he resigned in January 2005 after having served the company for more than four years. He answered that the reason for his decision was the mismanagement in cases such as:

a) Staffing of key posts e.g. Quality Manager, Flight Operations Manager, with individuals who either did not have the required qualifications by the Operator’s Policy prerequisites, or did not possess managerial competence;

b) Lack of business planning;

c) Incoherent corporate operations; and

d) Occasional coverage of personnel requirements in all specialties of the corporate operations.

2.2. Crew scheduling

According to the records made available to the Board, the crew duty times were within limits and followed the prescribed standards. However, in view of these records and a number of statements made to the Board, it had reservations on this subject, given that the records submitted required extensive examination to validate flight and duty times for the flight crew. The Board noted that inspectors/auditors in previous audits had annotated comments that the Captain’s Deviation Reports (CDRs) showed flight and duty times that exceeded the approved limits and were not recorded or reported to the DCA.

The Board also noted statements that the scheduling of flights was based on unrealistic flight times for some routes in order to ensure flight planned adherence to flight time limitations which subsequently were exceeded

2.3. Crew Training

According to the Helios Flight Training Manual, the simulator training syllabus included rapid decompression situations, but not gradual decompression (slow loss of pressurization) situations. Consequently, the flight crews were likely not sensitized to monitoring and detecting a more insidious, gradual loss of pressurization situation.

The Board identified a specific requirement for training of both flight and cabin crews on the phenomena associated with hypoxia. However, based on witness statements, the Board was led to believe that this requirement was not fulfilled in practice but remained a requirement “on paper.” The Board noted that this situation was not unique to Helios Airways, because the lack of hypoxia training to sensitize flight crews to detecting an insidious gradual decompression or non-pressurization of the aircraft during climb, was a common situation in the airline industry.

Interviews with a number of cabin crew members (including Cabin Chiefs) revealed a number of deficiencies. In particular, cabin crews appeared confused and responded differently to questions that concerned the number and type of oxygen masks on the B737 flight deck, the availability and exact procedure of means available to open the cockpit door, and whether passenger oxygen masks provided breathable oxygen at high altitude.

Furthermore, deficiencies were also identified in the Operator’s procedures that prescribed actions to be taken in the event that, after passenger oxygen mask activation, the aircraft did not begin to descend or at least to level-off. However, it was also determined that other airlines in Cyprus and in Greece did not have such procedures documented in their manuals.

The Board found training deficiencies and inconsistencies. Although it was determined that some of these issues were probably not implicated in the accident, some aspects of the procedures determined at Helios could be considered unsafe.

3. Organizational Issues

The management structure at Helios Airways at the time of the accident was incomplete, notably the position of the Manager Training Standards. The Flight Operations Manager had assumed the responsibilities of the Manager Training Standards, pending a reorganization of the Operations Division and the arrival of the new Chief Operating Officer at the beginning of August 2005. Furthermore, the Chief Pilot was in a position to deputize for the Training Manager Standards. The qualifications of some of the interviewed managers did not correspond to the qualifications listed in their job descriptions. These deficiencies in management may have been related to the failure of the Operator to recognize and take appropriate corrective actions to remedy the chronic checklist and SOP omissions exhibited by the First Officer and documented in his training records.

The Accountable Manager was characterized as unapproachable, with little regard or concern for safety or for the well-being of the company employees, and whose only interest was the profitability of the Operator.

The Board acquired the sense that the overall philosophy and style of management at Helios Airways was not conducive to efficient and safe operations. This impression was corroborated by the UK inspector’s comments in July of 2004 expressing concern about the potential that flight safety was being compromised due to “the lack of operational management control” and the hesitancy with which some improvements were made, were noted by another inspector a year later.

The Board considered potential implications of the multi-national staff composition at Helios Airways and how they might have affected the safety of flight operations. Multinational teams often led to a weak work climate because people of different cultural groups operated based on a set of values and perceptions unique to their common historical/social/geographical background. These types of differences might lead to communication and collaboration problems.

Another area of concern that arose from the composition of Helios Airways staff stemmed from the large percentage (33%) of staffing with seasonal (part-time) employees. Naturally, this was expected for companies whose operations mainly catered to the tourist industry and were, by definition, seasonal. The short-term hiring of pilots and engineers when the operational tempo and demands were significantly higher in the spring and summer allowed the airline to maintain a skeleton staff to cover the less loaded winter months. Insofar it affected work climate, however, frequent changes in staff composition could be detrimental to the development of professional and personal ties, and did not promote the required level of comfort among employees, and among employees and management, particularly with respect to the submission and discussion of incidents and problems. Employees lacked a sense of continuity, both for their own job as well as that of their colleagues, and cockpit and cabin crew did not have the opportunity to develop operational experience together in various routine and non-routine situations. Employees, finally, did not develop a feeling of ownership and responsibility towards operations and the Operator.

Provisions existed in manuals for an accident prevention/safety management program at Helios Airways. However, it was not at all clear whether the Operator adhered to the standards set forth in the relevant publications. Furthermore, these standards seemed to promote a reactive approach rather than emphasizing the benefits of a more effective, proactive stance to safety management. More important, the standards did not clearly and definitively outline the role and responsibility of management (a key element in any safety management program) in ensuring and maintaining safe operations of the company. The Board found reasons for further concern in the statement by the Chief Operating Officer of Helios Airways. By referring to tight schedules both for employees and aircraft utilization, the Chief Operating Officer appeared to suggest that both resources were utilized to the limits. The Board noted that tight scheduling, work under time pressure and considerable amounts of overtime work were not conducive to maintaining a safe work environment. These conditions were likely a fertile basis for human factor errors in flight operations and aircraft maintenance.

Management pilots appeared to be insufficiently involved in their managerial duties, this led the Board to note that the Operator lacked the mechanism and means to sufficiently and correctly monitor its pilots and to take decisive and corrective action when and as necessary.

Training and duty records were found to be incomplete, with no evidence of any type of a follow-up.

Manuals were found to be in part deficient; they did not always adhere to regulations, and on some issues they were out of date. This suggested that an underlying pressure was prevalent to proceed with little regard for the required formalities (which often equaled an assurance for safety).

Lastly, the Board also reviewed the actions of the Ground Engineer team that conducted maintenance on the aircraft prior to its departure, so as to form an opinion about the operation of the maintenance department at Helios Airways as a whole. The inexplicable inconsistencies in the actions that were or were not performed, the actions recorded, and the actions described as having been performed by Ground Engineer No. 1 on the morning of 14 August 2005 were considered by the Board to confirm the idea that the Operator was not effectively promoting and maintaining basic elements of safety in its culture.

4. Department of Civil Aviation in the Republic of Cyprus

At the time of the accident, the Safety Regulation Unit (SRU) was diachronically not organized and staffed to effectively accomplish its regulatory and safety oversight duties. The main problems that characterized the Unit and each of its three Sections (Operations, Airworthiness, and Licensing) already back in 1999 (the time of the first available audit report) appeared to still persist to this day, as evidenced by the various evaluation reports reviewed. The number of employed personnel was insufficient in relation to the actual workload. The mission and strategy of each Section, including its processes and standard operating procedures, appeared not to be officially laid out in writing. Selection and training criteria and resources, as well as detailed job descriptions, were not available. By extension, the qualifications, training, and hands-on expertise of most employees were probably inadequate. Vital positions (e.g. Head of the Operations Section) remained vacant. Some key functions (e.g. issuance and validation of air transport pilot licenses; issuance and record-keeping of medical certificates) were not performed. Other key functions (e.g. inspections) were possibly not accomplished per schedule because qualified personnel was not readily available and external resources had to be relied on.

This diachronic absence of leadership and oversight both across and within the three Sections presented a major obstacle that hindered the effective work of any one of the Sections. The resulting work climate within the SRU was not conducive to good performance even by qualified personnel; this became apparent in the nature of the oral statements given by the employees that included charges and complaints, as well as direct accusations and finger-pointing. Given the situation within the SRU, it was probably difficult for the Unit to instill a level of esteem from the aviation industry, and specifically in the areas and activities that it was tasked to regulate and oversee.

To accomplish its safety oversight duties, the Unit relied heavily on the UK CAA to furnish (based on a contractual agreement) inspectors to carry out the ICAO and EU required inspections. Based on the contractual agreements between the Cyprus DCA and the UK CAA, the role of the latter was undoubtedly intended to be advisory in nature. In reality, however, the DCA appeared to have been fostering and maintaining a relationship of complete dependence on the UK CAA, and, in most cases, appeared to be simply accepting its services without questioning them and without making an effort to assume ownership and thus build on them. The Board was particularly concerned to find that almost all of the Operator’s audit reports until about the time of the accident were signed by the UK CAA inspectors without any comments and/or a signature by an employee of the Cyprus DCA. Where the situation at the audited Operator seemed to repeatedly yield deficiencies and issues that required often urgent attention, the Board found no evidence that the DCA would actually “step in” and take action to ensure that the Operator complied and took corrective actions and, consequently, was safe and legal to continue its flight operations. As mentioned in the evaluation by a private firm in 2005 “The UK CAA representatives acknowledged that their current role in Cyprus is as advisors. However, this remains unclear since the existing contracts indicate, and records confirmed, that the UK CAA inspectors exercised a more direct, “hands-on” approach.”

The relationship of dependence was also evident from the evaluation by the private firm which found that the DCA had not taken ownership of documents prepared by the UK CAA and which described the internal operations of the Flight Operations and the Airworthiness Sections of the SRU. The SRU appeared to have adopted the manuals without completing missing sections and/or tailoring them to their needs, or trained inspection personnel to use them.

In trying to explain the reasons behind the slow progress in strengthening the DCA capabilities, the Board considered the role of Governmental support and how that may have been affecting the DCA’s ability to evolve and better embrace its safety oversight responsibilities. The Board noted that the 2002 ICAO audit clearly attributed at least part of the situation to the fact that the DCA operated as a functional department of the Ministry of Communications and Works. The 2005 European Commission evaluation directly faulted the absence of the necessary “… political commitment [of the Cypriot Government] to supply this Department [DCA] with the resources to carry out fully its safety oversight function and to reorganize the chain of command in order to give safety the high priority it deserves inside the organization.”

What became apparent from the Board’s consideration of the situation at the Cyprus DCA, and what was evident from the review of the audits/evaluations of DCA, was that the DCA, and the SRU in particular, lacked the required expertise to move forward, become independent, and fulfill the international obligations of Cyprus as contained in the Chicago Convention and its Annexes. Despite numerous action plans since 1999 to ensure the availability of properly trained and qualified inspectors, there were no tangible indications of progress.

A review of the audits and follow up audits of Cyprus DCA performed by ICAO, EASA and JAA, disclosed several important findings, which should have been actioned in the shortest possible time. No records were obtained that would have documented any remedial action considered, initiated or completed. It was of concern to the Board that there was no evidence of actions and enforcement by the international regulatory agencies to require timely implementation of an acceptable action plan, although they had clearly established that Cyprus’ international obligations were not being met.


1. Findings

1.1 Flight Crew

  1. The flight crew was licensed and qualified for the flight in accordance with applicable regulations.
  2. The flight crew held valid medical certificates and was medically fit to operate the flight.
  3. Although atherosclerosis was found (minor atherosclerosis for the Captain and extensive atherosclerosis for the First Officer), the Hellenic Air Force Aviation Medical Centre estimated that brain hypoxia was the dominant and determinant cause of incapacitation.
  4. The flight crew was adequately rested and their flight and duty times were in compliance with Cyprus DCA and Operator requirements.
  5. During the Preflight procedure, the Before Start and the After Takeoff checklists completion, the flight crew did not recognize and correct the incorrect position of the pressurization mode selector (MAN position instead of AUTO).
  6. The green light indication that the pressurization mode selector was in MAN (manual) position should have been perceived by the flight crew during preflight, takeoff, and climb.
  7. At an aircraft altitude of 12 040 ft and at a cabin pressure that corresponds to an altitude of 10 000 ft, about 5 minutes after takeoff, the Cabin Altitude Warning horn sounded.
  8. The initial actions by the flight crew to disconnect the autopilot, to retard and then again advance the throttles, indicated that it interpreted the warning horn as a Takeoff Configuration Warning.
  9. The incorrect interpretation of the reason for the warning horn indicated that the flight crew was not aware of the inadequate pressurization of the aircraft.
  10. There were numerous remarks in the last five years by training and check pilots on file for the First Officer referring to checklist discipline and procedural (SOP) difficulties.
  11. The flight crew contacted the company Operations Centre Dispatcher and referred to a Takeoff Configuration Warning horn and the Equipment Cooling lights.
  12. Communications between the flight crew and the company Operations Centre Dispatcher were not recorded; nor was there a regulatory requirement to record such communications.
  13. At an aircraft altitude of 17 000 to 18 000 ft, the Master Caution was activated and was not canceled for 53 seconds. The reason for its activation may have been either the inadequate cooling of the Equipment or the deployment of the oxygen masks in the cabin. The activation for either of the above two reasons does not permit identification of the other reason. Independently of the Master Caution indication, there are separate indications for both malfunctions on the overhead panel.
  14. The flight crew possibly identified the reason for the Master Caution to be only the inadequate cooling of the Equipment that was indicated on the overhead panel and did not identify the second reason for its activation, i.e., passenger oxygen masks deployment, that was later also indicated on the overhead panel. The crew became preoccupied with the Equipment Cooling fan situation and did not detect the problem with the pressurization system.
  15. The workload in the cockpit during the climb was already high and was exacerbated by the loud warning horn that the flight crew did not cancel.
  16. The remarks and observations by training pilots and check pilots with respect to the First Officer’s performance explained the omissions of the flight crew in its performance of the Preflight procedures, the Before Start and the After Takeoff checklists, as well as the non-identification of the warnings and reasons for the activations of the warnings on the flight deck during the climb to cruise.
  17. Before hypoxia began to affect the flight crew’s performance, inadequate CRM contributed to the failure to diagnose the pressurization problem.
  18. The flight crew probably lost useful consciousness as a result of hypoxia sometime after their last radio communication on the company frequency at 06:20:21 h, approximately 13 minutes after takeoff.
  19. Histological examinations revealed the presence of recent myocardial ischemia in both pilots, which according to the Hellenic Air Force Aviation Medical Centre (KAI) was likely due to the extended exposure to hypoxia.
  20. The toxicology test measured ethanol (34 mg/dl or 0.034 % weight/volume) in the specimen of the First Officer. The toxicological report stated that in view of the conditions, the finding may have resulted from postmortem ethanol production.

1.2. Cabin Crew

  1. The cabin crew members were trained and qualified in accordance with existing regulations.
  2. The cabin crew members were adequately rested and their duty times were in accordance with existing regulations.
  3. After the deployment of the oxygen masks in the cabin, the cabin crew members would have expected initiation of a descent or at least leveling-off of the aircraft.
  4. It could not be determined what actions were taken by the cabin crew members after deployment of the oxygen masks in the cabin, nor whether any of the cabin crew members attempted to contact the flight crew or enter the flight deck after passenger oxygen masks deployment.
  5. Shortly before flame out of the left engine, a member of the cabin crew was observed by an F-16 pilot to enter the flight deck, to sit in the captain’s seat, and to attempt to gain control of the aircraft.
  6. The above cabin crew member held a Commercial Pilot License.

1.3 Aircraft

  1. The aircraft held a valid Certificate of Airworthiness.
  2. The mass and centre of gravity of the aircraft were within prescribed limits.
  3. The aircraft had been supplied with the required amount of fuel. Fuel was not a factor in this accident.
  4. No deferred maintenance defects had been recorded.
  5. Data retrieved from the non-volatile memory (NVM) of the No. 2 cabin pressurization controller for at least the last 42 flights revealed a pressurization leak or insufficient inflow of air for reasons that could not be determined.
  6. There were nine write-ups related to the Equipment Cooling system in the Aircraft Technical Log from 9 June to 13 August 2005.
  7. The maintenance actions performed in the early morning hours of the day of the accident comprised:
    • A visual inspection of the rear right door (R2), no defects were found;
    • A pressurization test, no leakage was found.
  1. The record of the maintenance actions in the Aircraft Technical Log was incomplete.
  2. After the pressurization test, the pressurization mode selector was not selected to AUTO. Although not a formal omission, it would have been prudent to position the pressurization mode selector back to AUTO.
  3. The first recorded data of the accident flight on the non-volatile memory (NVM) chip in the cabin pressurization controller was at 10 000 ft cabin altitude (12 040 ft aircraft altitude). The data showed that the pressurization system was operating in the manual mode.
  4. The aircraft departed the holding pattern and started descending from FL340 when the left engine flamed out from fuel depletion. The right engine also flamed out from fuel depletion shortly before impact.
  5. The aircraft was structurally intact before impact.
  6. The aircraft was destroyed by the impact.

1.4 Manufacturer

  1. The description in the Boeing AMM for the procedure for the pressurization check (under the heading “Put the Airplane Back to its Initial Condition”) was vague. It did not specify an action item that the pressurization mode selector be returned to the AUTO position after the pressurization check.
  2. The manufacturer’s Preflight procedure and checklists (Before Start and After Takeoff) for checking and verifying the position of controls on the pressurization panel were not consistent with good Human Factors principles and were insufficient to guard against omissions by flight crews.
  3. The manufacturer’s procedures should have contained enough redundancy to ensure that the pressurization system was properly configured for flight. Because the position of the pressurization mode selector was critical for pressurization, the specific action should have been explicitly listed in the checklists referring to the pressurization system (Before Start and After Takeoff).
  1. The use of the same aural warning to signify two different situations (Takeoff Configuration and Cabin Altitude) was not consistent with good Human Factors principles.
  2. Over the past several years, numerous incidents had been reported involving confusion between the Takeoff Configuration Warning and Cabin Altitude Warning on the Boeing 737 and NASA’s ASRS office had alerted the manufacturer and the aviation industry.
  3. Numerous incidents had been reported worldwide involving cabin pressurization problems on the Boeing 737. A number of remedial actions had been taken by the manufacturer since 2000, but the measures taken had been inadequate and ineffective in preventing further similar incidents and accidents.

1.5. ATC

  1. The air traffic controllers in Nicosia and Athens, who handled flight HCY 522 were properly licensed and properly qualified.
  2. The ATC facilities in Nicosia and Athens were appropriately staffed and the communication equipment operated per regulations. There were no communications or navigational aid abnormalities.
  3. Nicosia ACC informed by telephone Athinai ACC that flight HCY 522 was not responding to its radio calls while approaching EVENO, but did not use the formal ICAO procedure (Doc 4444) for the two-way Radio Communication Failure (RCF).
  4. One minute before the flight entered the Athinai FIR, the Athinai ACC controller “accepted” the flight, but did not seek communication with it when it entered the FIR and failed to contact Athinai ACC as prescribed.
  5. The above-mentioned actions by Nicosia and Athinai ACCs did not contribute to the formation of events of the accident.

1.6. EASA, JAA, and ICAO

  1. Despite several EASA, JAA and ICAO audit and follow up audit findings performed on Cyprus DCA, there was no enforcement of implementation of action plans in order to meet its international obligations in the shortest possible time.

1.7. Flight HCY522

  1. When the flight HCY522 was intercepted by the F-16s, the F-16 lead pilot reported that there was no visible damage to the Boeing 737 aircraft, that the Captain’s seat was vacant, the person in the First Officer’s seat was not wearing an oxygen mask and was slumped over the controls, and some seated passengers in the cabin were observed wearing oxygen masks.
  2. Shortly before the aircraft started descending, the F-16 pilot reported that a man wearing clothing of a specific color entered the cockpit and sat down in the Captain’s vacant seat. He did not appear to be wearing an oxygen mask. He seemed to make efforts to gain control of the aircraft. It was determined that this man was a cabin attendant who held a Commercial Pilot License.
  1. When the left engine flamed out due to fuel depletion, the aircraft exited the holding pattern and started a left descending turn, and followed an uneven flight path of fluctuating speeds and altitudes. Shortly before impact, the right engine also flamed out from fuel depletion.
  2. The cabin crew member in the cockpit attempted to transmit a MAYDAY message, which was recorded on the CVR. However, the MAYDAY calls were not transmitted over the VHF radio because the microphone key, as shown by the FDR, was not pressed. The performance of the cabin crew member was very likely impaired by the hypoxic and stressful conditions.
  3. Three of the four portable oxygen cylinders on board the aircraft had most likely been used.
  4. The cabin altitude was calculated to have been about 24 000 ft, while the aircraft was at a cruise level of 34 000 ft (FL340).
  5. The duration (30 minutes) of the CVR installed on the aircraft was insufficient to provide key information that would have clarified the chain of events during the climb phase of the flight. The CVR stopped recording when the engines flamed out.

1.8. Operator

  1. The After Takeoff checklist section referring to the pressurization system in the Operator’s QRH had not been updated according to the latest Boeing revision.
  2. The manuals, procedures, and training of the Operator, and to a large extent of the international aviation industry, did not address the actions required of cabin crew members when the passenger oxygen masks have deployed in the cabin and, during climb to cruise, the aircraft has not start descending or at least leveled off, and no relevant announcement has been made from the flight deck.
  3. The absence of applied hypoxia training at the Operator, and to a large extent at other airlines, for airline transport pilots, increased the risk of accidents because of the insidious nature of incapacitation during climb to cruising altitude as a result of pressurization anomalies or gradual loss of pressurization.
  4. There were organizational safety deficiencies within the Operator’s management structure and safety culture as evidenced by diachronic findings in the audits prior to the accident, including:

a) Inadequate Quality System;

b) Inadequate Operational Management control;

c) Inadequate Quality and Operations Manual;

d) Cases of non-attendance of management personnel at quarterly management quality review meeting, as required;

e) Organization, management, and associated operational supervision not properly matched to the scale and scope of operations;

f) Inadequate monitoring of pilot certificates and training;

g) Insufficient involvement of management pilots in managerial duties, due to lack of time;

h) Incompletely updated training and duty records;

i) Lack of updating of some manuals and in part not fully in compliance with regulations;

j) Key management personnel at time performing the work of two positions;

k) Periods of vacant key management positions;

l) Inadequate remedial actions on audit findings, including level one findings, which could cause suspension of the AOC.

1.9. Cyprus DCA

  1. Organizational safety related deficiencies existed within the Cyprus DCA from at least 1999 and continued to the time of the accident, although some corrective actions were exercised since 2003. These deficiencies prevented the DCA from carrying out its safety oversight obligations within Cyprus, as evidenced by findings in previous audits, including:

a) Lack of resources and qualified personnel, and inability to adequately perform the safety oversight activities as required by ICAO;

b) Over-reliance on the UK CAA;

c) Inadequate on-the-job training for Cypriot inspectors to assume the duties for the DCA;

d) Lack of DCA internal expertise to assess the effectiveness or the technical aspects of the UK CAA inspections and the work performed;

e) Ineffectiveness of the DCA in bringing the Cyprus Civil Aviation legislation and regulations into compliance with the international requirements (ICAO Standards and Recommended Practices);

f) Inadequacy of the structure of the DCA to support safety oversight on current and future operations under the present circumstances;

g) No risk management process;

h) Non-exploitation by the DCA of the full scope of contracted services from the UK CAA, related to on-the-job training of Cyprus Flight Inspectors for reasons beyond the control of the UK CAA;

i) Non-assumption of responsibility of the DCA in directing the UK CAA regarding the accomplishment of its contractual duties;

j) Lack of effective implementation of the corrective action plans from previous audits (ICAO – 46.57 % non-implementation, when an excess of 15% non-implementation generally indicated significant problems in terms of State oversight capability).

2. Causes

2.1 Direct Causes

  1. Non-recognition that the cabin pressurization mode selector was in the MAN (manual) position during the performance of the: a) Preflight procedure; b) Before Start checklist; and c) After Takeoff checklist.
  2. Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb.
  3. Incapacitation of the flight crew due to hypoxia, resulting in the continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground.

2.2. Latent causes

  1. The Operator’s deficiencies in organization, quality management, and safety culture, documented diachronically as findings in numerous audits.
  2. The Regulatory Authority’s diachronic inadequate execution of its oversight responsibilities to ensure the safety of operations of the airlines under its supervision and its inadequate responses to findings of deficiencies documented in numerous audits.
  3. Inadequate application of Crew Resource Management (CRM) principles by the flight crew.
  4. Ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurization incidents in the particular type of aircraft, both with regard to modifications to aircraft systems as well as to guidance to the crews.

2.3. Contributing Factors to the Accident

  1. The omission of returning the pressurization mode selector to AUTO after unscheduled maintenance on the aircraft.
  2. Lack of specific procedures (on an international basis) for cabin crew procedures to address the situation of loss of pressurization, passenger oxygen masks deployment, and continuation of the aircraft ascent (climb).
  3. Ineffectiveness of international aviation authorities to enforce implementation of corrective action plans after relevant audits.

Excerpted from the Hellenic Republic Ministry of Transport & Communications Air Accident Investigation & Aviation Safety Board (AAIASB), Aircraft Accident Report Helios Airways Flight HCY522.


  1. The Organizational Influences behind the aviation accidents & incidents
  2. Normalization of Deviance: when non-compliance becomes the “new normal” 
  3. Unstable approach and hard landing. Final report


minime2By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day

Emirates B773 accident on 03 August 2016, Interim Statement

There were no aircraft systems or engine abnormalities up to the time of the Accident


Air Accident Investigation Sector
General Civil Aviation Authority
The United Arab Emirates
Accident – First Interim Statement –
AAIS Case No: AIFN/0008/2016
Runway Impact During Attempted Go-Around

Operator: Emirates
Make and Model: Boeing 777-31H
Nationality and Registration: The United Arab Emirates, A6-EMW
Place of Occurrence: Dubai International Airport
State of Occurrence: The United Arab Emirates
Date of Occurrence: 3 August 2016

Occurrence Brief  (See: Going around with no thrust. Emirates B773 accident at Dubai on August 3rd, 2016, interim report)
Occurrence Reference : AIFN/0008/2016
Occurrence Category : Accident
Name of the Operator : Emirates
Manufacturer : The Boeing Company
Aircraft Model : 777-31H
Engines : Two Rolls-Royce Trent 892
Nationality : The United Arab Emirates
Registration : A6-EMW
Manufacture Serial Number : 32700
Date of Manufacture : 27 March 2003
Flight Hours/Cycles : 58169/13620
Type of Flight : Scheduled Passenger
State of Occurrence : The United Arab Emirates
Place of Occurrence : Runway 12L, Dubai International Airport
Date and Time : 3 August 2016, 0837 UTC
Total Crewmembers : 18 (two flight and 16 cabin)
Total Passengers : 282
Injuries to Passengers and Crew : 30, four serious, 26 minor (The number of injured has been updated since the Preliminary Report was published)
Other Injuries : One firefighter (fatal)
Nature of Damage : The Aircraft was destroyed

Investigation Objective
This Investigation is performed pursuant to the United Arab Emirates (UAE) Federal
Act No. 20 of 1991, promulgating the Civil Aviation Law, Chapter VII ̶ Aircraft Accidents,
Article 48. It is in compliance with Part VI, Chapter 3 of Part VI, Chapter 3, of the Civil Aviation Regulations (CARs) of the United Arab Emirates, and in conformity with Annex 13 to the Convention on International Civil Aviation.
The sole objective of this Investigation is to prevent aircraft accidents and incidents.
It is not the purpose of this activity to apportion blame or liability.
This first anniversary Interim Statement gives a brief of the Investigation progress
and should be read in conjunction with the Preliminary Report number AIFN/0008/2016 that was published on 5 September 2016.

This Interim Statement is released in accordance Standard 6.6 of ICAO Annex 13
and paragraph 7.4 of UAE CAR Part VI, Chapter 3.
Later Interim Statements/Reports, or the Final Report, may contain altered
information in case of new evidence becoming available during the ongoing investigation.

Investigation Process
The occurrence was classified as an Accident and the Air Accident Investigation
Sector (AAIS) of the United Arab Emirates assigned an Accident Investigation File Number AIFN/0008/2016 for the case.
The AAIS formed the Investigation team led by the investigator-in-charge (IIC) and
members from the AAIS for the relevant investigation aspects. The National Transportation Safety Board (NTSB) of the United States, being the State of the Manufacture and Design, and the Air Accidents Investigation Branch (AAIB) of the United Kingdom, being the State of Manufacture of the engines, were notified of the Accident and both States assigned Accredited Representatives assisted by Advisers from Boeing and Rolls-Royce. In addition, the Operator assigned an Adviser to the IIC. The AAIS is leading the Investigation and will issue a Final Report.
This Interim Statement is publicly available at:

Interim Statement
This first anniversary Interim statement gives a brief account of the progress of the
Investigation into the subject Accident. The statement is released in accordance Standard 6.6 of ICAO Annex 13 and paragraph 7.4 of UAE CAR Part VI, Chapter 3.
The Accident occurred on 3 August 2016 and involved an Emirates Boeing 777-300
Aircraft, registration A6-EMW, operating a scheduled passenger flight EK521, that had
departed Trivandrum International Airport (VOTV), India, at 0506 UTC for Dubai International Airport (OMDB), the United Arab Emirates. At approximately 0837:38 UTC, the Aircraft impacted the runway during an attempted go-around at Dubai International Airport.
The Aircraft sustained substantial structural damage as a result of the impact and its
movement along the runway and was eventually destroyed by fire. Twenty-one passengers, one flight crewmember, and four cabin crewmembers sustained minor injuries. Four cabin crewmembers sustained serious injuries. Approximately nine minutes after the Aircraft came to rest, a firefighter was fatally injured as a result of the explosion of the center wing fuel tank.
Regarding the operation of the flight the Investigation is working to determine and
analyze the human performance factors that influenced flight crew actions during the landing and attempted go-around.
In addition, the Investigation has reviewed and has identified safety enhancements
related to the validity of weather information that was passed to the flight crew, and
communication between air traffic control and the flight crew.
A detailed examination was performed of the Aircraft evacuation systems, including
the operation of emergency escape slides in a non-normal aircraft resting position, and the effects of wind on the escape slides.
A large number of aircraft systems were tested with the assistance of the manufacturers and analysis of the data downloaded indicates that there were no Aircraft systems or engine abnormalities up to the time of the Accident.

The UAE GCAA Air Accident Investigation Sector continues to collaborate with the
State authorities and other organizations involved in areas of interest including flight
operations, human performance, training standards, procedures, aircraft systems, passenger evacuation and airport emergency response.

This Interim Statement is issued by:
The Air Accident Investigation Sector
General Civil Aviation Authority
The United Arab Emirates
P.O. BOX 6558, Abu Dhabi.
Email: ACCID@gcaa.gov.ae


1. United Arab Emirates, General Civil Aviation Authority, Air Accident Investigation Sector. Accident – First Interim Statement -AAIS Case No: AIFN/0008/2016


  1.  Going around with no thrust. Emirates B773 accident at Dubai on August 3rd, 2016, interim report
  2. When the error comes from an expert: The Limits of Expertise
  3. Let’s go around
  4. Speaking of going around
  5. Going around with all engines operating
  6. Multitasking in Complex Operations, a real danger
  7. The Organizational Influences behind the aviation accidents & incidents 


minime2By Laura Duque-Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day