The numerous safety deficiencies behind Helios Airways HCY 522 accident

Behind the well-known primary cause of this accident were less-known and less-discussed numerous regulatory and organizational factors that still can be found in many countries and airlines worldwide.

Helios

Lack of political commitment to supply the aviation authority with the resources to carry out fully its safety oversight function, safety regulatory authority not organized and staffed to effectively accomplish its regulatory and safety oversight duties, absence of leadership and oversight, inadequate work climate, operator’s incomplete management structure with qualifications of some managers not corresponding to job descriptions, airline’s philosophy and style of management not conducive to efficient and safe operations with weak work climate, large percentage of staffing with seasonal employees, reactive approach of safety management, quality assurance  not effective and deficiencies in operator’s procedures and training, are some of the factors identified.

Sounds familiar?

It’s a longish reading but worth it. So, get your favorite chair, a very big cup of Colombian coffee and enjoy!

********

Hellenic Republic Ministry of Transport & Communications Air Accident Investigation & Aviation Safety Board (AAIASB), Helios Airways Flight HCY522 Aircraft Accident Report. Boeing 737-31s at Grammatiko, Hellas on 14 August 2005

Published 11 / 2006

Operator: Helios Airways

Owner: Deutsche Structured Finance & Leasing Gmbh & Co

Manufacturer: Boeing Co

Aircraft Type: B 737 – 31s

Nationality: Cyprus

Registration : 5B-DBY

Place of accident: Hilly terrain in the vicinity of Grammatiko village, approximately 33 km northwest of Athens International Airport 38º 13.894’ N, 23º 58.214’ E

Date and time: 14 AUGUST 2005 – 09:03:32 h (Notes: 1. All times in the report are Coordinated Universal Time (UTC) (Local time in Hellas was UTC + 3 h). 2. Correlation of the times used in the radar and radio communication recordings, and the FDR and CVR showed differences of less than 12 seconds. The FDR time was used as the master time in this report.)

SYNOPSIS
On 14 August 2005, a Boeing 737-300 aircraft, registration number 5B-DBY, operated by Helios Airways, departed Larnaca, Cyprus at 06:07 h for Prague, Czech Republic, via Athens, Hellas. The aircraft was cleared to climb to FL340 and to proceed direct to RDS VOR. As the aircraft climbed through 16 000 ft, the Captain contacted the company Operations Centre and reported a Take-off Configuration Warning and an Equipment Cooling system problem. Several communications between the Captain and the Operations Centre took place in the next eight minutes concerning the above problems and ended as the aircraft climbed through 28 900 ft. Thereafter, there was no response to radio calls to the aircraft. During the climb, at an aircraft altitude of 18 200 ft, the passenger oxygen masks deployed in the cabin. The aircraft leveled off at FL340 and continued on its programmed route.
At 07:21 h, the aircraft flew over the KEA VOR, then over the Athens International Airport, and subsequently entered the KEA VOR holding pattern at 07:38 h. At 08:24 h, during the sixth holding pattern, the Boeing 737 was intercepted by two F-16 aircraft of the Hellenic Air Force. One of the F-16 pilots observed the aircraft at close range and reported at 08:32 h that the Captain’s seat was vacant, the First Officer’s seat was occupied by someone who was slumped over the controls, the passenger oxygen masks were seen dangling and three motionless passengers were seen seated wearing oxygen masks in the cabin. No external damage or fire was noted and the aircraft was not responding to radio calls. At 08:49 h, he reported a person not wearing an oxygen mask entering the cockpit and occupying the Captain’s seat. The F-16 pilot tried to attract his attention without success. At 08:50 h, the left engine flamed out due to fuel depletion and the aircraft started descending. At 08:54 h, two MAYDAY messages were recorded on the CVR.
At 09:00 h, the right engine also flamed out at an altitude of approximately 7 100 ft. The aircraft continued descending rapidly and impacted hilly terrain at 09:03 h in the vicinity of Grammatiko village, Hellas, approximately 33 km northwest of the Athens International Airport. The 115 passengers and 6 crew members on board were fatally injured. The aircraft was destroyed.
The Air Accident Investigation and Aviation Safety Board (AAIASB) of the Hellenic
Ministry of Transport & Communications investigated the accident following ICAO practices and determined that the accident resulted from direct and latent causes.

 

map1

 

FACTUAL INFORMATION

Personnel Information

1. Captain

The Captain was male, 59 years old.

He held an Air Transport Pilot License (ATPL) issued on 27 February 1991 in accordance with JAR-FCL by LBA Germany. His ATPL license, his instrument rating category III, and his Boeing 737-300 and -800 ratings were valid until 4 June 2006.

He had attended engineering college in Dresden, East Germany from 1966 to 1970 and graduated as a pilot-engineer. He had held an ATPL issued in 1970 by the Civil Aviation Authority in East Germany.

Medical Certificate: Class A, Medical Certificate issued on 21 March 2005 and valid until 9 October 2005 with the restriction to carry two pairs of corrective lenses.

Last LPC/OPC 4 June 2005

Recurrent Training in STD 4 June 2005

Last Line Check 12 June 2005

CRM training 2 June 2005

Flying experience:

Tabla 1

The Captain had worked for the Operator for two separate time periods. According to interviews of his peers at the Operator, during the first period, he presented a typical “command” attitude and his orders to the First Officers were in command tone. During the second period, his attitude had improved as far as his communication skills were concerned.

According to an oral statement by the next of kin, the Captain was a quiet and professional pilot. His hobby was to construct and fly model aircraft. He used no drugs or medication, and he used alcohol occasionally and with moderation.

2. First Officer

The First Officer was male, 51 years old.

He held an Air Transport Pilot License (ATPL) issued in accordance with JAR-FCL by the United Kingdom. His ATPL license and Boeing 737-300 and -800 ratings were valid until 31 March 2006 and his instrument rating category III was valid until 31 October 2005.

He had attended and graduated from Chelsea College with an Engineering Diploma. He was also trained at Oxford Air Training School to become a pilot.

Medical Certificate: Class A Medical Certificate issued on 25 April 2005 and valid until 29 October 2005 with no restrictions.

Last OPC 9 March 2005

Last Line Check 3 February 2005

Recurrent training in STD 9 March 2005

CRM training 28 February 2005

Flying experience:

Tabla 2

The First Officer spent the day preceding the accident at his summer house with the family. He drove home in the evening, had a normal dinner (no alcohol) and he went to bed at about 23:00 h. He woke up early in the morning and drove to the airport in order to report for duty on time.

According to statements by his next of kin, colleagues, and friends, the First Officer was an optimist, calm, active and a social person. He had expressed his views several times about the Captain’s attitude. He had also complained about the organizational structure of the Operator, flight scheduling and he was seeking another job. He used no drugs or medication and he did not smoke or drink alcohol.

In his last three OPCs, there were the following remarks/recommendations:

9 March 2005 “Standards achieved, but with room for lots of improvement. Some difficulties met in complex tasks. Do not rush through check lists. Recommendation – improve your understanding on the use of AFS”.

3 September 2004 “Overall standard is above average. Very Good LVO recognition of abnormalities. EMERGENCY DESCENT [capital letters used by the TRE] repeated at very good standard. Keep the good work”.

13 April 2004 “Overall performance at standard – Good Manual control, and 1 ENG G/A. –Make positive control is advisory after engine failure on T/OFF not to lose direction. Repeat – OK”.

In addition, the First Officer’s training records were reviewed for the five years he worked for the Operator. The review disclosed numerous remarks and recommendations made by training and check pilots referring to checklist discipline and procedural (SOP) difficulties.

3. Cabin Attendants

There were four cabin crew members on board, all of which met Operator proficiency and medical requirements.

Cabin Attendant number four also held a UK Commercial Pilot License (JAR CPL A/IR) with an issue date of 2 October 2003, and valid until 1 October 2008. His JAA Class 1 Medical Certificate was valid from 15 July 2005 to 17 July 2006.

Medical and Pathological Information

The Captain’s samples (obtained on 18 August 2005) tested negative for major drugs of abuse, volatile poisons, and prescription and over-the-counter medications. Due to the presence of extensive burns, the determination of blood alcohol level was not possible.

The Captain’s heart muscle samples revealed the presence of minor atherosclerosis (40% obstruction) compatible with his age. A histological examination revealed the presence of recent myocardial ischaemia.

The First Officer’s samples (obtained on 15 August 2005) tested negative for carbon monoxide, volatile poisons, major drugs of abuse, and prescription and over-the-counter medications. Although ethanol was detected (34 mg/dl, or 0.034 % weight/volume – also known as blood alcohol content), the toxicological reports stated that “the time period between the death and the collection and the analysis of specimens (24 hours) may have resulted in postmortem ethanol production.” The First Officer’s heart muscle samples revealed the presence of extensive atherosclerosis (90% obstruction in the anterior descendant and circumflex coronary artery). A histological examination revealed the presence of recent myocardial ischemia.

The Department of Cardiology of the Hellenic Air Force Medical Centre predicated that “On the basis of the data that were given to us, such as the height of the flight, the fact of the existing heart function (pump function) upon crashing, and the fact that there is a similar pathologo-anatomical image both in the ‘suffering’ heart (myocardium) of the co-pilot, and in the ‘healthy heart’ of the pilot, we estimate that the brain hypoxia was the dominant and determinant cause that incapacitated the flying crew, with the findings of the heart being the matter of course and epiphenomenon of the prolonged hypoxia.”

ANALYSIS

1. Crew

Based on indubitable evidence, the Board concluded that the pressurization mode selector was in the MAN (manual) position from the time the aircraft was still on the ground and was led to believe that the selector had remained in the MAN (manual) position after the Pressure Leak Test, the last known time the particular selector had been manipulated. When the aircraft departed, the pressurization mode selector remained in the MAN (manual) position (instead of AUTO) and remained there until the aircraft impacted the ground almost three hours later. Naturally, the fact that the mode selector position was not rectified by the flight crew during the aircraft preflight preparations was crucial in the sequence of events that led to the accident.

pressurization

Both the Captain and the First Officer were experienced pilots and had performed the preflight duties numerous times in the past. The Board examined the reasons why they could have made such a crucial omission.

Preflight duties included checking the Equipment Cooling switches, the Cabin Pressurization Panel, and the flight crew oxygen masks. When the pressurization mode selector is positioned to the MAN (manual) position, it is accompanied by an advisory, green light indicating MANUAL. Normally, with the mode selector on AUTO as prescribed by the Preflight Procedure, no illuminated indication should appear on the pressurization panel. Why an experienced crew would have failed to notice the presence of an indication they did not normally expect to see at this location in this phase of flight?

Why an experienced crew would have failed to notice the presence of an indication they did not normally expect to see at this location in this phase of flight?

A typical Preflight Procedure may contain between 40 and 80 actions to be performed by the First Officer, often under the pressure of the impending departure, and in the presence of a Captain who is waiting to call for the ensuing checklist. This procedure is performed from memory, aided by the fact that the actions are organized along the topographical location of panels in the cockpit. Memorization is beneficial for long lists of actions, but has the disadvantage that actions are performed automatically, without conscious effort and attention. This can and has, in the past, led to inadvertent omissions and other types of mistakes.

The Board was also sensitive to the fact that automatic execution of actions was very much affected by assumptions – in the case of performing a large number of verification steps, the assumption that all switches and indications were in the usual, normal for this phase of flight position. A superfluous green indication on the pressurization panel could be easily (inadvertently) overlooked when the perception was biased by the expectation that it should not be present.

Exacerbating this tendency (expectation bias) is the rarity with which switches (especially, and directly relevant to this case, the pressurization mode selector) are in other-than-their-normal position. A pilot automatically performing lengthy verification steps, such as those during preflight, is vulnerable to inadvertently falsely verifying the position of a switch to its expected, usual position (i.e. the pressurization mode selector to the expected AUTO position) – especially when the mode selector is rarely positioned to settings other than AUTO.

The Board was concerned that the overhead panel design was not conducive to safeguarding against these types of inadvertent omissions. Specifically, the color of the illuminated indication (green) does not typically imply something out of the ordinary, as did the amber (caution) or red (warning) – which would have likely attracted the flight crew’s attention that something was out of the ordinary.

After the Preflight Procedure, the crew was expected to orally execute a Preflight Checklist. Per the carrier’s FCOM, this checklist included a check of the pressurization panel:

[item 12 of 25] AIR COND & PRESS ………___PACK(S), BLEEDS ON, SET

The flight crew failed to detect the improper configuration of the pressurization panel during this checklist. Both the Captain and First Officer had repeatedly accomplished this checklist on many flights during their long careers. Their failure to properly accomplish the above checklist prevented them from capturing their earlier mistake. This was the first of two missed opportunities to notice and correct an earlier error. Various factors could have contributed to this failure.

The Board first examined the design of the checklist, and specifically the fact that the challenge part of this action item (“Air Cond & Press”) essentially combined two separate systems (air conditioning and pressurization). While this combination was certainly not random (the two systems used engine bleed air as an energy source), the corresponding response portion of the action item (“Pack(s), Bleeds ON, SET”) contained three different confirmations, only the third of which referred to the pressurization panel. In turn, this third confirmation referred to eight different actions – those that were performed earlier, during the Preflight Procedure. Contrary to the manufacturer’s original intention, however, many pilots informally reported that when performing the checklist and responding “SET” to the pressurization panel, they really only checked that the landing and cruise altitudes had been correctly set in the corresponding indicators.

The performance of checklists in routine, daily flight operations was also examined. In general, checklist items are performed by referencing a printed card. Like procedures, because they are performed repeatedly on the line, they are also performed by memory, typically in time-pressured circumstances (i.e. indirect pressure to maintain on-time departures). For these two reasons, checklists are often performed in a hurried, automatic fashion. From a human factors standpoint, rushing is known to lead to the inadequate allocation of attention to the task at hand – and thus to errors. Furthermore, like procedures, checklists are also vulnerable to “looking without seeing” because they are biased by the assumption that since each item verified an action performed only moments ago, then it must be already in the desired position/set.

Following takeoff, the flight crew was to perform an After Takeoff checklist, the first item of which was to check the pressurization system again and verify its settings. Although this checklist would have directed the flight crew’s attention to the pressurization panel, there was no evidence that the incorrect position of the pressurization mode selector was rectified. This was the second missed opportunity to note and correct an earlier error.

After Takeoff checklist is also usually performed under even more time pressured conditions and at a time when the pilots’ attention is consumed by other, concurrent tasks (e.g. retracting the landing gear and flaps, monitoring the climb, and communicating with ATC). The management of multiple concurrent tasks requires the division of attention resources and is known to force a person to devote insufficient attention to any one of the many tasks.

At an aircraft altitude of about 12 000 ft the cabin altitude warning horn sounded. Eight seconds later, the FDR showed the autopilot being disengaged, and re-engaged four seconds later. Eight seconds later, the FDR showed the auto-throttle being disengaged and the throttles retarded, but like the autopilot it also was re-engaged nine seconds later. Three seconds later, the No.2 radio was used to contact the Helios Airways Dispatcher.

The Board examined the flight crew’s actions to disengage the autopilot and auto-throttle, and to retard the throttles upon onset of the warning horn. Given that the expected reaction to a cabin altitude warning horn would have been to stop the climb (there was no evidence to this effect), the Board considered such actions to signify that the flight crew reacted to the warning horn as if it had been a Takeoff Configuration Warning (the two failures use the same warning horn sound). Similar occurrences had been reported by flight crews worldwide in the past.

Various factors for creating the potential confusion of the two experienced pilots were considered:

  1. In the course of his career, a pilot is generally likely to only hear the warning horn when it is associated with a takeoff and a takeoff configuration problem and most pilots are not very likely to experience a cabin pressurization problem and the associated warning horn at any time during their line flying.
  2. Stress, such as that caused by the onset of a loud, distracting alarm in the cockpit, combined with the element of surprise, is known to lead to automatic reactions. Automatic reactions, in turn, are typically those that result from experience and frequency of encounter and are therefore not always appropriate. The Board considered that the flight crew may have automatically reverted to a reaction based on memory before consciously processing the source and significance of the stress factor. This would also explain why the flight crew failed to realize the improbability of their interpretation of the horn as a takeoff configuration horn and why they failed to move on to gathering information for a new, correct diagnosis of the problem at hand. It is important to note that at no time during this sequence of events was the cabin altitude warning horn canceled.
  3. According to FDR data, at an aircraft altitude of about 17 000 ft, the MASTER CAUTION light was activated and was not canceled for 53 seconds. Two different events occurred at about this time, either one of which would have triggered the MASTER CAUTION light with the accompanying OVERHEAD indication on the Annunciator Panel to draw the attention of the pilots to a situation indicated on the Overhead Panel. The equipment cooling low flow detectors reacted to the decreased air density and one or both of the Equipment Cooling lights illuminated on the Overhead Panel. In addition, the oxygen masks deployed in the passenger cabin, illuminating the PASS OXY ON light, located further aft on the Overhead Panel. The Board was unable to determine which event occurred first and triggered the MASTER CAUTION. However, the fact that the flight crew had not canceled the first MASTER CAUTION meant that the second event did not trigger a second MASTER CAUTION as it was already on. Consequently, there was nothing to prompt the flight crew to look for a second indication on the Overhead Panel.
  4. At the time of onset of the MASTER CAUTION (and the OVERHEAD indication), workload in the cockpit was already high.
  5. Language difficulties between the Captain and the Helios Operations Centre, probably due to the fact that the Captain spoke with a German accent and could not be understood by the British engineer prolonged resolution of the problem, while the aircraft continued to climb. Moreover, the communication difficulties could also have been compounded by the onset of the initial effects of hypoxia.
  6. The Board recognized that from a human factors standpoint, preoccupation with one task (i.e. trouble-shooting the source of the Equipment Cooling problem) at the expense of another (i.e. trouble-shooting the source of the warning horn) was entirely plausible and has happened to experienced pilots.
  7. The combination of hypoxia and distractions generally increases stress levels. Stress is known to render human cognition (e.g. memory, attention, decision-making, risk management, communication skills) particularly vulnerable to errors
  8. The flight crew of HCY522 did not exhibit adequate CRM to help overcome the individual errors and to detect a dangerous situation that deteriorated as the aircraft continued to climb.

Given the ongoing distractions, the Captain, at least, may never have consciously and fully registered the onset of the indications and/or their significance. Unfortunately, although there were partial data to somewhat deduce the Captain’s actions at this time (from his communication exchanges with the Operator’s dispatcher and engineer), there was no possibility to establish the First Officer’s actions during this same time.

The Board evaluated what the cabin crew’s reactions might have been when the aircraft continued to climb and there was no announcement from the flight deck. There was no Operator procedure to address such a contingency. As emphasized by the Cabin Crew Manager in his post-accident statement, however, cabin crews were encouraged to take initiative. The Manager expressed his conviction that the particular cabin crew was well trained and by nature fully bound to have taken the initiative to seek an explanation for the unusual situation they were facing. The Board considered the fact that even if this was the case, it was hard for a cabin crew to assess how long to wait before contacting the flight deck – and in this case, time was of the essence as the hypoxia effects grew increasingly stronger. It was not possible to determine whether any of the cabin crew members attempted to contact the flight crew or enter the flight deck.

Data from the CVR only contained to the last 30 minutes of the accident flight and showed that at least one cabin crew member retained his consciousness for the duration of the flight and entered the flight deck more than two hours after takeoff. At the beginning of the climb phase, this cabin attendant was likely seated next to the aft galley.

In order for him to have moved forward in the aircraft to reach the flight deck, he must have used a portable oxygen bottle.

The Board found the fact that this cabin attendant might not have attempted to enter the flight deck until hours after the first indication that the aircraft was experiencing a nonnormal situation quite puzzling. Of course, in the absence of a longer-duration CVR, it was not possible to know whether this or any other cabin crew member had attempted to or succeeded in entering the flight deck. From the sounds recorded on the CVR, however, the Board could ascertain that this cabin attendant entered the cockpit using the emergency access code to open a locked cockpit door.

2. Operator

2.1 Maintenance

Based on evidence from the Helios Airways Technical Department documents relevant to manpower planning, the front line maintenance task force group consisting of four to five licensed engineers and two to three mechanics, changed, as far as the individual persons of the first group were concerned, by more than 80 % three times within 16 months (oldest EMPLOYMENT DATE: 01/11/2003 – first END DATE: 04/03/2005). The longest stay with Helios Airways up to 14 August 2005 was 21 months and the shortest three days. Both example cases above were licensed engineers and categorized as “Permanent” in the column “Employment Status” of the document. The same column contained another category, “Contract”, reserved for those licensed engineers hired through employment agencies.

Between November 2003 and August 2005 (one week before the accident occurred), 13 licensed engineers (six different European nationalities) were employed by the Helios maintenance department and subsequently left Helios. Six of them were contracted, which meant that they were paid by the employment agency that placed them with the airline. The Board believed that the very high turnover rate of maintenance personnel was not conducive to establishing and maintaining a sense of continuity and teamwork among employs, and this probably worked against setting a good foundation for proactive management and resolution of any issues in the maintenance department.

This situation has been raised as a Non-Conformance Report (NCR) during an audit carried o April 2005. The certifying staff level (number of licensed engineers), not including the Maintenance Manager, was annotated in the NCR as insufficient to meet the requirements of Part 145. The manpower plan appeared to only be a guide and did not fully reflect the current status of manpower usage or requirements. Despite the corrective action to the NCR stated by the Operator’s maintenance management to improve the situation, the responses by airline management continued to prove inadequate to provide the necessary resources and financial support.

The former Technical Manager of the Operator was asked why he resigned in January 2005 after having served the company for more than four years. He answered that the reason for his decision was the mismanagement in cases such as:

a) Staffing of key posts e.g. Quality Manager, Flight Operations Manager, with individuals who either did not have the required qualifications by the Operator’s Policy prerequisites, or did not possess managerial competence;

b) Lack of business planning;

c) Incoherent corporate operations; and

d) Occasional coverage of personnel requirements in all specialties of the corporate operations.

2.2. Crew scheduling

According to the records made available to the Board, the crew duty times were within limits and followed the prescribed standards. However, in view of these records and a number of statements made to the Board, it had reservations on this subject, given that the records submitted required extensive examination to validate flight and duty times for the flight crew. The Board noted that inspectors/auditors in previous audits had annotated comments that the Captain’s Deviation Reports (CDRs) showed flight and duty times that exceeded the approved limits and were not recorded or reported to the DCA.

The Board also noted statements that the scheduling of flights was based on unrealistic flight times for some routes in order to ensure flight planned adherence to flight time limitations which subsequently were exceeded

2.3. Crew Training

According to the Helios Flight Training Manual, the simulator training syllabus included rapid decompression situations, but not gradual decompression (slow loss of pressurization) situations. Consequently, the flight crews were likely not sensitized to monitoring and detecting a more insidious, gradual loss of pressurization situation.

The Board identified a specific requirement for training of both flight and cabin crews on the phenomena associated with hypoxia. However, based on witness statements, the Board was led to believe that this requirement was not fulfilled in practice but remained a requirement “on paper.” The Board noted that this situation was not unique to Helios Airways, because the lack of hypoxia training to sensitize flight crews to detecting an insidious gradual decompression or non-pressurization of the aircraft during climb, was a common situation in the airline industry.

Interviews with a number of cabin crew members (including Cabin Chiefs) revealed a number of deficiencies. In particular, cabin crews appeared confused and responded differently to questions that concerned the number and type of oxygen masks on the B737 flight deck, the availability and exact procedure of means available to open the cockpit door, and whether passenger oxygen masks provided breathable oxygen at high altitude.

Furthermore, deficiencies were also identified in the Operator’s procedures that prescribed actions to be taken in the event that, after passenger oxygen mask activation, the aircraft did not begin to descend or at least to level-off. However, it was also determined that other airlines in Cyprus and in Greece did not have such procedures documented in their manuals.

The Board found training deficiencies and inconsistencies. Although it was determined that some of these issues were probably not implicated in the accident, some aspects of the procedures determined at Helios could be considered unsafe.

3. Organizational Issues

The management structure at Helios Airways at the time of the accident was incomplete, notably the position of the Manager Training Standards. The Flight Operations Manager had assumed the responsibilities of the Manager Training Standards, pending a reorganization of the Operations Division and the arrival of the new Chief Operating Officer at the beginning of August 2005. Furthermore, the Chief Pilot was in a position to deputize for the Training Manager Standards. The qualifications of some of the interviewed managers did not correspond to the qualifications listed in their job descriptions. These deficiencies in management may have been related to the failure of the Operator to recognize and take appropriate corrective actions to remedy the chronic checklist and SOP omissions exhibited by the First Officer and documented in his training records.

The Accountable Manager was characterized as unapproachable, with little regard or concern for safety or for the well-being of the company employees, and whose only interest was the profitability of the Operator.

The Board acquired the sense that the overall philosophy and style of management at Helios Airways was not conducive to efficient and safe operations. This impression was corroborated by the UK inspector’s comments in July of 2004 expressing concern about the potential that flight safety was being compromised due to “the lack of operational management control” and the hesitancy with which some improvements were made, were noted by another inspector a year later.

The Board considered potential implications of the multi-national staff composition at Helios Airways and how they might have affected the safety of flight operations. Multinational teams often led to a weak work climate because people of different cultural groups operated based on a set of values and perceptions unique to their common historical/social/geographical background. These types of differences might lead to communication and collaboration problems.

Another area of concern that arose from the composition of Helios Airways staff stemmed from the large percentage (33%) of staffing with seasonal (part-time) employees. Naturally, this was expected for companies whose operations mainly catered to the tourist industry and were, by definition, seasonal. The short-term hiring of pilots and engineers when the operational tempo and demands were significantly higher in the spring and summer allowed the airline to maintain a skeleton staff to cover the less loaded winter months. Insofar it affected work climate, however, frequent changes in staff composition could be detrimental to the development of professional and personal ties, and did not promote the required level of comfort among employees, and among employees and management, particularly with respect to the submission and discussion of incidents and problems. Employees lacked a sense of continuity, both for their own job as well as that of their colleagues, and cockpit and cabin crew did not have the opportunity to develop operational experience together in various routine and non-routine situations. Employees, finally, did not develop a feeling of ownership and responsibility towards operations and the Operator.

Provisions existed in manuals for an accident prevention/safety management program at Helios Airways. However, it was not at all clear whether the Operator adhered to the standards set forth in the relevant publications. Furthermore, these standards seemed to promote a reactive approach rather than emphasizing the benefits of a more effective, proactive stance to safety management. More important, the standards did not clearly and definitively outline the role and responsibility of management (a key element in any safety management program) in ensuring and maintaining safe operations of the company. The Board found reasons for further concern in the statement by the Chief Operating Officer of Helios Airways. By referring to tight schedules both for employees and aircraft utilization, the Chief Operating Officer appeared to suggest that both resources were utilized to the limits. The Board noted that tight scheduling, work under time pressure and considerable amounts of overtime work were not conducive to maintaining a safe work environment. These conditions were likely a fertile basis for human factor errors in flight operations and aircraft maintenance.

Management pilots appeared to be insufficiently involved in their managerial duties, this led the Board to note that the Operator lacked the mechanism and means to sufficiently and correctly monitor its pilots and to take decisive and corrective action when and as necessary.

Training and duty records were found to be incomplete, with no evidence of any type of a follow-up.

Manuals were found to be in part deficient; they did not always adhere to regulations, and on some issues they were out of date. This suggested that an underlying pressure was prevalent to proceed with little regard for the required formalities (which often equaled an assurance for safety).

Lastly, the Board also reviewed the actions of the Ground Engineer team that conducted maintenance on the aircraft prior to its departure, so as to form an opinion about the operation of the maintenance department at Helios Airways as a whole. The inexplicable inconsistencies in the actions that were or were not performed, the actions recorded, and the actions described as having been performed by Ground Engineer No. 1 on the morning of 14 August 2005 were considered by the Board to confirm the idea that the Operator was not effectively promoting and maintaining basic elements of safety in its culture.

4. Department of Civil Aviation in the Republic of Cyprus

At the time of the accident, the Safety Regulation Unit (SRU) was diachronically not organized and staffed to effectively accomplish its regulatory and safety oversight duties. The main problems that characterized the Unit and each of its three Sections (Operations, Airworthiness, and Licensing) already back in 1999 (the time of the first available audit report) appeared to still persist to this day, as evidenced by the various evaluation reports reviewed. The number of employed personnel was insufficient in relation to the actual workload. The mission and strategy of each Section, including its processes and standard operating procedures, appeared not to be officially laid out in writing. Selection and training criteria and resources, as well as detailed job descriptions, were not available. By extension, the qualifications, training, and hands-on expertise of most employees were probably inadequate. Vital positions (e.g. Head of the Operations Section) remained vacant. Some key functions (e.g. issuance and validation of air transport pilot licenses; issuance and record-keeping of medical certificates) were not performed. Other key functions (e.g. inspections) were possibly not accomplished per schedule because qualified personnel was not readily available and external resources had to be relied on.

This diachronic absence of leadership and oversight both across and within the three Sections presented a major obstacle that hindered the effective work of any one of the Sections. The resulting work climate within the SRU was not conducive to good performance even by qualified personnel; this became apparent in the nature of the oral statements given by the employees that included charges and complaints, as well as direct accusations and finger-pointing. Given the situation within the SRU, it was probably difficult for the Unit to instill a level of esteem from the aviation industry, and specifically in the areas and activities that it was tasked to regulate and oversee.

To accomplish its safety oversight duties, the Unit relied heavily on the UK CAA to furnish (based on a contractual agreement) inspectors to carry out the ICAO and EU required inspections. Based on the contractual agreements between the Cyprus DCA and the UK CAA, the role of the latter was undoubtedly intended to be advisory in nature. In reality, however, the DCA appeared to have been fostering and maintaining a relationship of complete dependence on the UK CAA, and, in most cases, appeared to be simply accepting its services without questioning them and without making an effort to assume ownership and thus build on them. The Board was particularly concerned to find that almost all of the Operator’s audit reports until about the time of the accident were signed by the UK CAA inspectors without any comments and/or a signature by an employee of the Cyprus DCA. Where the situation at the audited Operator seemed to repeatedly yield deficiencies and issues that required often urgent attention, the Board found no evidence that the DCA would actually “step in” and take action to ensure that the Operator complied and took corrective actions and, consequently, was safe and legal to continue its flight operations. As mentioned in the evaluation by a private firm in 2005 “The UK CAA representatives acknowledged that their current role in Cyprus is as advisors. However, this remains unclear since the existing contracts indicate, and records confirmed, that the UK CAA inspectors exercised a more direct, “hands-on” approach.”

The relationship of dependence was also evident from the evaluation by the private firm which found that the DCA had not taken ownership of documents prepared by the UK CAA and which described the internal operations of the Flight Operations and the Airworthiness Sections of the SRU. The SRU appeared to have adopted the manuals without completing missing sections and/or tailoring them to their needs, or trained inspection personnel to use them.

In trying to explain the reasons behind the slow progress in strengthening the DCA capabilities, the Board considered the role of Governmental support and how that may have been affecting the DCA’s ability to evolve and better embrace its safety oversight responsibilities. The Board noted that the 2002 ICAO audit clearly attributed at least part of the situation to the fact that the DCA operated as a functional department of the Ministry of Communications and Works. The 2005 European Commission evaluation directly faulted the absence of the necessary “… political commitment [of the Cypriot Government] to supply this Department [DCA] with the resources to carry out fully its safety oversight function and to reorganize the chain of command in order to give safety the high priority it deserves inside the organization.”

What became apparent from the Board’s consideration of the situation at the Cyprus DCA, and what was evident from the review of the audits/evaluations of DCA, was that the DCA, and the SRU in particular, lacked the required expertise to move forward, become independent, and fulfill the international obligations of Cyprus as contained in the Chicago Convention and its Annexes. Despite numerous action plans since 1999 to ensure the availability of properly trained and qualified inspectors, there were no tangible indications of progress.

A review of the audits and follow up audits of Cyprus DCA performed by ICAO, EASA and JAA, disclosed several important findings, which should have been actioned in the shortest possible time. No records were obtained that would have documented any remedial action considered, initiated or completed. It was of concern to the Board that there was no evidence of actions and enforcement by the international regulatory agencies to require timely implementation of an acceptable action plan, although they had clearly established that Cyprus’ international obligations were not being met.

CONCLUSIONS

1. Findings

1.1 Flight Crew

  1. The flight crew was licensed and qualified for the flight in accordance with applicable regulations.
  2. The flight crew held valid medical certificates and was medically fit to operate the flight.
  3. Although atherosclerosis was found (minor atherosclerosis for the Captain and extensive atherosclerosis for the First Officer), the Hellenic Air Force Aviation Medical Centre estimated that brain hypoxia was the dominant and determinant cause of incapacitation.
  4. The flight crew was adequately rested and their flight and duty times were in compliance with Cyprus DCA and Operator requirements.
  5. During the Preflight procedure, the Before Start and the After Takeoff checklists completion, the flight crew did not recognize and correct the incorrect position of the pressurization mode selector (MAN position instead of AUTO).
  6. The green light indication that the pressurization mode selector was in MAN (manual) position should have been perceived by the flight crew during preflight, takeoff, and climb.
  7. At an aircraft altitude of 12 040 ft and at a cabin pressure that corresponds to an altitude of 10 000 ft, about 5 minutes after takeoff, the Cabin Altitude Warning horn sounded.
  8. The initial actions by the flight crew to disconnect the autopilot, to retard and then again advance the throttles, indicated that it interpreted the warning horn as a Takeoff Configuration Warning.
  9. The incorrect interpretation of the reason for the warning horn indicated that the flight crew was not aware of the inadequate pressurization of the aircraft.
  10. There were numerous remarks in the last five years by training and check pilots on file for the First Officer referring to checklist discipline and procedural (SOP) difficulties.
  11. The flight crew contacted the company Operations Centre Dispatcher and referred to a Takeoff Configuration Warning horn and the Equipment Cooling lights.
  12. Communications between the flight crew and the company Operations Centre Dispatcher were not recorded; nor was there a regulatory requirement to record such communications.
  13. At an aircraft altitude of 17 000 to 18 000 ft, the Master Caution was activated and was not canceled for 53 seconds. The reason for its activation may have been either the inadequate cooling of the Equipment or the deployment of the oxygen masks in the cabin. The activation for either of the above two reasons does not permit identification of the other reason. Independently of the Master Caution indication, there are separate indications for both malfunctions on the overhead panel.
  14. The flight crew possibly identified the reason for the Master Caution to be only the inadequate cooling of the Equipment that was indicated on the overhead panel and did not identify the second reason for its activation, i.e., passenger oxygen masks deployment, that was later also indicated on the overhead panel. The crew became preoccupied with the Equipment Cooling fan situation and did not detect the problem with the pressurization system.
  15. The workload in the cockpit during the climb was already high and was exacerbated by the loud warning horn that the flight crew did not cancel.
  16. The remarks and observations by training pilots and check pilots with respect to the First Officer’s performance explained the omissions of the flight crew in its performance of the Preflight procedures, the Before Start and the After Takeoff checklists, as well as the non-identification of the warnings and reasons for the activations of the warnings on the flight deck during the climb to cruise.
  17. Before hypoxia began to affect the flight crew’s performance, inadequate CRM contributed to the failure to diagnose the pressurization problem.
  18. The flight crew probably lost useful consciousness as a result of hypoxia sometime after their last radio communication on the company frequency at 06:20:21 h, approximately 13 minutes after takeoff.
  19. Histological examinations revealed the presence of recent myocardial ischemia in both pilots, which according to the Hellenic Air Force Aviation Medical Centre (KAI) was likely due to the extended exposure to hypoxia.
  20. The toxicology test measured ethanol (34 mg/dl or 0.034 % weight/volume) in the specimen of the First Officer. The toxicological report stated that in view of the conditions, the finding may have resulted from postmortem ethanol production.

1.2. Cabin Crew

  1. The cabin crew members were trained and qualified in accordance with existing regulations.
  2. The cabin crew members were adequately rested and their duty times were in accordance with existing regulations.
  3. After the deployment of the oxygen masks in the cabin, the cabin crew members would have expected initiation of a descent or at least leveling-off of the aircraft.
  4. It could not be determined what actions were taken by the cabin crew members after deployment of the oxygen masks in the cabin, nor whether any of the cabin crew members attempted to contact the flight crew or enter the flight deck after passenger oxygen masks deployment.
  5. Shortly before flame out of the left engine, a member of the cabin crew was observed by an F-16 pilot to enter the flight deck, to sit in the captain’s seat, and to attempt to gain control of the aircraft.
  6. The above cabin crew member held a Commercial Pilot License.

1.3 Aircraft

  1. The aircraft held a valid Certificate of Airworthiness.
  2. The mass and centre of gravity of the aircraft were within prescribed limits.
  3. The aircraft had been supplied with the required amount of fuel. Fuel was not a factor in this accident.
  4. No deferred maintenance defects had been recorded.
  5. Data retrieved from the non-volatile memory (NVM) of the No. 2 cabin pressurization controller for at least the last 42 flights revealed a pressurization leak or insufficient inflow of air for reasons that could not be determined.
  6. There were nine write-ups related to the Equipment Cooling system in the Aircraft Technical Log from 9 June to 13 August 2005.
  7. The maintenance actions performed in the early morning hours of the day of the accident comprised:
    • A visual inspection of the rear right door (R2), no defects were found;
    • A pressurization test, no leakage was found.
  1. The record of the maintenance actions in the Aircraft Technical Log was incomplete.
  2. After the pressurization test, the pressurization mode selector was not selected to AUTO. Although not a formal omission, it would have been prudent to position the pressurization mode selector back to AUTO.
  3. The first recorded data of the accident flight on the non-volatile memory (NVM) chip in the cabin pressurization controller was at 10 000 ft cabin altitude (12 040 ft aircraft altitude). The data showed that the pressurization system was operating in the manual mode.
  4. The aircraft departed the holding pattern and started descending from FL340 when the left engine flamed out from fuel depletion. The right engine also flamed out from fuel depletion shortly before impact.
  5. The aircraft was structurally intact before impact.
  6. The aircraft was destroyed by the impact.

1.4 Manufacturer

  1. The description in the Boeing AMM for the procedure for the pressurization check (under the heading “Put the Airplane Back to its Initial Condition”) was vague. It did not specify an action item that the pressurization mode selector be returned to the AUTO position after the pressurization check.
  2. The manufacturer’s Preflight procedure and checklists (Before Start and After Takeoff) for checking and verifying the position of controls on the pressurization panel were not consistent with good Human Factors principles and were insufficient to guard against omissions by flight crews.
  3. The manufacturer’s procedures should have contained enough redundancy to ensure that the pressurization system was properly configured for flight. Because the position of the pressurization mode selector was critical for pressurization, the specific action should have been explicitly listed in the checklists referring to the pressurization system (Before Start and After Takeoff).
  1. The use of the same aural warning to signify two different situations (Takeoff Configuration and Cabin Altitude) was not consistent with good Human Factors principles.
  2. Over the past several years, numerous incidents had been reported involving confusion between the Takeoff Configuration Warning and Cabin Altitude Warning on the Boeing 737 and NASA’s ASRS office had alerted the manufacturer and the aviation industry.
  3. Numerous incidents had been reported worldwide involving cabin pressurization problems on the Boeing 737. A number of remedial actions had been taken by the manufacturer since 2000, but the measures taken had been inadequate and ineffective in preventing further similar incidents and accidents.

1.5. ATC

  1. The air traffic controllers in Nicosia and Athens, who handled flight HCY 522 were properly licensed and properly qualified.
  2. The ATC facilities in Nicosia and Athens were appropriately staffed and the communication equipment operated per regulations. There were no communications or navigational aid abnormalities.
  3. Nicosia ACC informed by telephone Athinai ACC that flight HCY 522 was not responding to its radio calls while approaching EVENO, but did not use the formal ICAO procedure (Doc 4444) for the two-way Radio Communication Failure (RCF).
  4. One minute before the flight entered the Athinai FIR, the Athinai ACC controller “accepted” the flight, but did not seek communication with it when it entered the FIR and failed to contact Athinai ACC as prescribed.
  5. The above-mentioned actions by Nicosia and Athinai ACCs did not contribute to the formation of events of the accident.

1.6. EASA, JAA, and ICAO

  1. Despite several EASA, JAA and ICAO audit and follow up audit findings performed on Cyprus DCA, there was no enforcement of implementation of action plans in order to meet its international obligations in the shortest possible time.

1.7. Flight HCY522

  1. When the flight HCY522 was intercepted by the F-16s, the F-16 lead pilot reported that there was no visible damage to the Boeing 737 aircraft, that the Captain’s seat was vacant, the person in the First Officer’s seat was not wearing an oxygen mask and was slumped over the controls, and some seated passengers in the cabin were observed wearing oxygen masks.
  2. Shortly before the aircraft started descending, the F-16 pilot reported that a man wearing clothing of a specific color entered the cockpit and sat down in the Captain’s vacant seat. He did not appear to be wearing an oxygen mask. He seemed to make efforts to gain control of the aircraft. It was determined that this man was a cabin attendant who held a Commercial Pilot License.
  1. When the left engine flamed out due to fuel depletion, the aircraft exited the holding pattern and started a left descending turn, and followed an uneven flight path of fluctuating speeds and altitudes. Shortly before impact, the right engine also flamed out from fuel depletion.
  2. The cabin crew member in the cockpit attempted to transmit a MAYDAY message, which was recorded on the CVR. However, the MAYDAY calls were not transmitted over the VHF radio because the microphone key, as shown by the FDR, was not pressed. The performance of the cabin crew member was very likely impaired by the hypoxic and stressful conditions.
  3. Three of the four portable oxygen cylinders on board the aircraft had most likely been used.
  4. The cabin altitude was calculated to have been about 24 000 ft, while the aircraft was at a cruise level of 34 000 ft (FL340).
  5. The duration (30 minutes) of the CVR installed on the aircraft was insufficient to provide key information that would have clarified the chain of events during the climb phase of the flight. The CVR stopped recording when the engines flamed out.

1.8. Operator

  1. The After Takeoff checklist section referring to the pressurization system in the Operator’s QRH had not been updated according to the latest Boeing revision.
  2. The manuals, procedures, and training of the Operator, and to a large extent of the international aviation industry, did not address the actions required of cabin crew members when the passenger oxygen masks have deployed in the cabin and, during climb to cruise, the aircraft has not start descending or at least leveled off, and no relevant announcement has been made from the flight deck.
  3. The absence of applied hypoxia training at the Operator, and to a large extent at other airlines, for airline transport pilots, increased the risk of accidents because of the insidious nature of incapacitation during climb to cruising altitude as a result of pressurization anomalies or gradual loss of pressurization.
  4. There were organizational safety deficiencies within the Operator’s management structure and safety culture as evidenced by diachronic findings in the audits prior to the accident, including:

a) Inadequate Quality System;

b) Inadequate Operational Management control;

c) Inadequate Quality and Operations Manual;

d) Cases of non-attendance of management personnel at quarterly management quality review meeting, as required;

e) Organization, management, and associated operational supervision not properly matched to the scale and scope of operations;

f) Inadequate monitoring of pilot certificates and training;

g) Insufficient involvement of management pilots in managerial duties, due to lack of time;

h) Incompletely updated training and duty records;

i) Lack of updating of some manuals and in part not fully in compliance with regulations;

j) Key management personnel at time performing the work of two positions;

k) Periods of vacant key management positions;

l) Inadequate remedial actions on audit findings, including level one findings, which could cause suspension of the AOC.

1.9. Cyprus DCA

  1. Organizational safety related deficiencies existed within the Cyprus DCA from at least 1999 and continued to the time of the accident, although some corrective actions were exercised since 2003. These deficiencies prevented the DCA from carrying out its safety oversight obligations within Cyprus, as evidenced by findings in previous audits, including:

a) Lack of resources and qualified personnel, and inability to adequately perform the safety oversight activities as required by ICAO;

b) Over-reliance on the UK CAA;

c) Inadequate on-the-job training for Cypriot inspectors to assume the duties for the DCA;

d) Lack of DCA internal expertise to assess the effectiveness or the technical aspects of the UK CAA inspections and the work performed;

e) Ineffectiveness of the DCA in bringing the Cyprus Civil Aviation legislation and regulations into compliance with the international requirements (ICAO Standards and Recommended Practices);

f) Inadequacy of the structure of the DCA to support safety oversight on current and future operations under the present circumstances;

g) No risk management process;

h) Non-exploitation by the DCA of the full scope of contracted services from the UK CAA, related to on-the-job training of Cyprus Flight Inspectors for reasons beyond the control of the UK CAA;

i) Non-assumption of responsibility of the DCA in directing the UK CAA regarding the accomplishment of its contractual duties;

j) Lack of effective implementation of the corrective action plans from previous audits (ICAO – 46.57 % non-implementation, when an excess of 15% non-implementation generally indicated significant problems in terms of State oversight capability).

2. Causes

2.1 Direct Causes

  1. Non-recognition that the cabin pressurization mode selector was in the MAN (manual) position during the performance of the: a) Preflight procedure; b) Before Start checklist; and c) After Takeoff checklist.
  2. Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb.
  3. Incapacitation of the flight crew due to hypoxia, resulting in the continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground.

2.2. Latent causes

  1. The Operator’s deficiencies in organization, quality management, and safety culture, documented diachronically as findings in numerous audits.
  2. The Regulatory Authority’s diachronic inadequate execution of its oversight responsibilities to ensure the safety of operations of the airlines under its supervision and its inadequate responses to findings of deficiencies documented in numerous audits.
  3. Inadequate application of Crew Resource Management (CRM) principles by the flight crew.
  4. Ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurization incidents in the particular type of aircraft, both with regard to modifications to aircraft systems as well as to guidance to the crews.

2.3. Contributing Factors to the Accident

  1. The omission of returning the pressurization mode selector to AUTO after unscheduled maintenance on the aircraft.
  2. Lack of specific procedures (on an international basis) for cabin crew procedures to address the situation of loss of pressurization, passenger oxygen masks deployment, and continuation of the aircraft ascent (climb).
  3. Ineffectiveness of international aviation authorities to enforce implementation of corrective action plans after relevant audits.

Excerpted from the Hellenic Republic Ministry of Transport & Communications Air Accident Investigation & Aviation Safety Board (AAIASB), Aircraft Accident Report Helios Airways Flight HCY522.

FURTHER READING

  1. The Organizational Influences behind the aviation accidents & incidents
  2. Normalization of Deviance: when non-compliance becomes the “new normal” 
  3. Unstable approach and hard landing. Final report

**********************

minime2By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s