How Cockpit Inaccessibility Adversely Affects Air Safety
Locked and hardened cockpit doors are an increasingly prevalent security initiative, but evidence is mounting that they entail a safety downside. As is often the case, good intentions are generating unintended consequences.
The Australian Transportation Safety Bureau (ATSB) published a report earlier this month on its investigations into a mounting disquiet among pilots and cabin crew on the subject of the dangers posed by new doors in passenger aircraft with a seating capacity of 30 or more [ tinyurl.com/yupgbt ]. The report cites examples of flight crews getting injured by hardened doors and trapped on their flight decks.
ASW has in the past related stories of electrical locks creating smoke in the cockpit and remote opening failures requiring pilots to leave their seats to open doors. In the Australian context, a lack of consultation and cooperation in 2003 between the country’s Civil Aviation Safety Authority (CASA) and the Office of Transport Security (OTS) allowed the security considerations to far outweigh sensible safety concerns. All in all, it appears to have been analyzed by the ATSB Report as a typical post-9/11 overreaction to an imagined looming threat.
Incidents such as the following, as cited by the ATSB, are becoming typical of the genre:
Prior to starting the second engine on an aircraft with an unserviceable Auxiliary Power Unit (APU), the engine rpm was not increased on the operating engine, as required. Once the start was initiated, the increased load on the operating generator resulted in the operating engine going into a sub-idle condition. The over-fuelled engine then stagnated into a jet-pipe fire, which was reported to the flight crew by a ground handler.
The operating generator also went off-line, leaving the depleted and under load battery as the sole source of electrical power for the aircraft. The cabin crew could not establish communications with the flight crew, who were completing the engine fire drill, and they were unable to open the locked cockpit door via the keypad. With visual indications of an engine fire (i.e., torching from the jetpipe exhaust), the cabin crew initiated an emergency evacuation of the passengers.
The investigation revealed a lack of knowledge of the communications system’s deficiencies under degraded electrical power. The locked cockpit door contributed to a lack of any effective liaison between the flight and cabin crew. Shortly after the incident, the company conducted a review of the communications information within the company manuals and the information provided during training. The incident highlighted the importance of critically reviewing the effects of security requirements on aircraft safety.
The Helios Failure To Pressurize
The story of the last hours of the cabin crew and passengers on Helios Airways Flight HCY 522 is a compelling one of entrapment and isolation. The Greek crash inquiry report makes only guarded references to the dangers of locked cockpit doors.
When published in Athens in October, the report buried within its analysis the disclosure that a key problem was “establishing and maintaining open communication between the cabin and the flight deck”. Information that would have shed more light on the incident was expunged “on security grounds”, a troubling precedent in which so-called security trumps public safety.
Both pilots had gradually slipped into unconsciousness on climbout due to confusion over a familiar aural alarm. In the main cabin, however, the cabin crew suddenly had a quite dramatic indication that something was amiss. The rubber jungle of oxygen masks above the passengers dropped from their stowages automatically as the cabin pressure climbed through 14,000ft.
However, quite incongruously, the 737 continued climbing, instead of carrying out an emergency descent as the cabin crew expected. The flight attendants had portable oxygen bottles with a lengthy duration but were unable to enter the flight deck. If they had, they would have been able to give the pilots crucial information, and the captain would have then realized his mistake and been alerted to don his own oxygen mask.
Instead, both pilots were sealed behind their bullet-proof door, in the grip of a fatal misunderstanding. They thought the avionics compartment was overheating, the captain left his seat to investigate and collapsed due to hypoxia. Neither pilot donned an oxygen mask.
The individual cabin oxygen generators last only 15 minutes, quite sufficient for an emergency descent. But two hours later, as the 737 flew on towards Athens at its pre- programmed cruising altitude with a cargo of unconscious passengers, a Greek F-16 fighter-pilot noted that a male steward had gained access to the cockpit to use a radio. He carried a portable oxygen bottle and was able to operate the keypad on the locked cockpit door. Had he eventually found the combination on the body of the senior steward, the only one permitted to know it? Nobody knows for sure.
That inability to access the flight deck and communicate during the flight turned out to be fatal. But the report’s conclusions on the cause of the Helios disaster solely blamed the pilots’ failure to notice the pressurization controller switch left in the wrong position. Many think that investigator Tsolakis has confused “cause” and “effect” as well as error and omission.
In 2004, British investigators noted that when a fire broke out in the passenger cabin of a British Airways plane taking off from Heathrow, cabin crew spent much time desperately banging on the locked cockpit door trying to attract the pilots’ attention. The U.K. Air Accident Board warned that “both the flight crew and cabin crew were initially hampered in their efforts to deal with the incident promptly due to their inability to communicate with each other through the locked flight deck door.”
The ATSB Report
It was confirmed that, in some 30- to 59-seat aircraft types, pilots were unable to lock or unlock the flight compartment door from either control station, representing a hazard to safety.
For example, in the SAAB 340B, the hardened cockpit security door was cumbersome for one pilot to operate, often requiring both pilots to open it. In that case, pilots were potentially not at the controls when, attempting to reach the door latch, one or both pilots were required to move their seats back beyond the reach of the aircraft’s flight controls.
Similarly, if one of the pilots left the flight compartment, when the remaining pilot was required to open the door to allow for the re-entry of the returning pilot, the pilot flying’s seat often had to be moved back beyond the reach of the flying controls.
In the Embraer Brasilia EMB-120, whenever a pilot had to leave the flight compartment for any reason, the remaining pilot was unable to open the hardened cockpit security door without leaving the aircraft’s controls unattended.
In that circumstance, the operator required that, whenever one of the pilots was absent from the flight compartment, the sole cabin crew member on board the aircraft was to remain locked within the flight compartment. That was in order to open the door for the returning pilot.
The result was that there could be no supervision of the aircraft’s cabin and passengers for the period that the cabin crew member was restricted to being in the flight compartment.
In both aircraft types, it was identified that, if one of the pilots became incapacitated, the remaining pilot may be unable to open the flight compartment door in order for the cabin crew to render assistance. That would also be the case if both pilots were incapacitated.
In addition to the problem of pilot reach from the pilot’s control station in SAAB 340B and Brasilia aircraft, operators of the Dash 8, Fokker F100 and BAE 146 identified that, should the flight crew become incapacitated, the flight deck of those aircraft types was virtually inaccessible.
Even though operators’ concerns are mounting, the FAA has hardened its attitude towards terror-proofing future aircraft designs. In a recent Jan, 2007 Notice of Proposed Rule- making, the FAA’s suggested that, inter alia, reinforced cockpit door standards, implemented in 2003, should now be extended to include the entire bulkhead. So if that’s the way things are heading, and they’re determined to “hard-nose” it, what’s to be done about the death of cabin-cockpit Crew Resource Management (CRM)?
CRM is intended to be interlocutory — i.e., if you have something to say about something relevant to somebody, then that is best said to that somebody’s face. As matters now stand, that intervening door constitutes a breakdown of social norms and values within the traditional crew structure. Helios was the first such accident. One door opens, another closes.