Helios Crash Report Highlights Hypoxia Born Of Human Error
Akrivos Tsolakis, head of Greece’s National Aviation Safety Board, has now passed his 230 page report on the August 2005 Helios 737 tragedy to the Greek and Cypriot governments. As expected, human error looms large in the report. However, there are sins of both omission and commission, in the shape of direct causes and indirect causes.
The two deceased pilots of the Cypriot 737-300 get a special mention for their failure to competently operate controls regulating cabin pressure, misinterpreting a subsequent warning horn, consequently failing to don oxygen masks and continuing to climb until anoxia claimed them. They also missed a warning showing that the cabin oxygen masks had dropped.
The engineers who conducted the aircraft’s final fateful pressurization ground-test get a dishonorable mention for failing to restore the critical pressurization switch (the cabin outflow valve control) to its standard AUTO position per their test checklist. Engineers consulted by the perplexed pilot via company radio were also less than helpful. The Cypriot Regulator gets a drubbing for being lax and ineffectual in its oversight. The airline itself comes off no better.
Hiss And Myth
In Greek mythology, Helios was imagined as a handsome god crowned with the shining aureole of the sun, who drove a four-horse chariot across the sky. The best known story involving Helios is that of his son Phaeton, who attempted to drive his father’s chariot but lost control and set the earth on fire. Well, the sun has now set on Helios; as an airline in disgrace, it is no more. It has identity-changed its name to Ajet and it’s still featuring in the news on competency grounds. It has been recently barred from landing in fog, after authorities deemed the airline could not guarantee safety in such conditions. This was confirmed on October 1, by Civil Aviation director Leonidas Leonidou, who said the airline’s license to land in low-visibility conditions — known as Cat II & III — had been revoked as of the last week in September.
European Aviation Safety Agency (EASA) had arrived at the same conclusion during an inspection last May. According to its report, the airline lacked the adequate equipment, pilot training and experience to prove it could operate its jets safely for automated approaches and low visibility landings. Ajet’s name is also on a list being considered by the EU for adding to its other illustrious “carriers non grata” listing.
On December 16, 2004, during a flight from Warsaw, the ill-fated 5B-DBY had suffered a loss of cabin pressure and three passengers were rushed to hospital on arrival in Larnaca. The mother of the first officer killed in the crash of Flight 522 claimed that her son had repeatedly complained to Helios about the aircraft getting cold. Passengers have also reported problems with air conditioning on Helios flights.
Over the two months before the crash, 5B-DBY’s air conditioning and pressurization system had required repair on five occasions. Early on the day of the crash, after the aircraft arrived at Larnaca on a flight from the United Kingdom, the cabin crew complained about a rear door seal hissing. Inspection by Helios engineers disclosed no apparent problem and the aircraft was permitted to take off without any repairs.
In hindsight, the hissing was consistent with a faulty door sealing that would allow gradual decompression of cabin air as the aircraft gained altitude, resulting in an initially subtle but increasing cognitive dysfunction for the pilots. That outcome is in the insidious nature of slow depressurization but also of any failure to properly pressurize at a set rate in the climb. It’s worth noting here that the emphasis during flight simulator drills is on the more dramatic explosive and rapid decompressions that can result from, say, a bomb or a cargo door blowing out.
Insidious hypoxia is a much greater threat because of its effect upon situational awareness and an inherent inability to recognize its onset. Its gradual insinuation is not easily simulated, although sudden single pilot incapacitation is. Hypoxia tends to claim everybody at once, although younger and fitter individuals will succumb last of all. Think of it as a reverse gassing. Life in a vacuum drains quickly.
Horn-Swoggled
Maintenance tests performed on the aircraft had left the pressurization control on a “manual” setting in which the aircraft would not pressurize automatically during its climb; the pre-takeoff check had not discovered nor corrected this. It’s an easily missed switch position — and also one that’s rarely repositioned. As the aircraft passed 10,000 feet (3,000 m), the cabin altitude alert horn sounded. That same horn also sounds on the ground if the aircraft is not properly configured for take off, e.g. flaps not set, and thus it was assumed to be a false warning.
The aircrew found their lack of a common language and inadequate English a hindrance in solving the problem. Passing 16,000ft, the pilot called maintenance to ask how to disable the horn, and he was told where to find the circuit-breaker. Increasingly muddled thought processes caused the pilot to leave his seat to locate the circuit breaker and both pilots lost consciousness shortly afterwards. “Several communications between the captain and the Operations Center had taken place over eight minutes and this exchange ended abruptly as the aircraft climbed through 28,900 feet to its cruising level of Flight Level 340. Thereafter, there was no response to radio calls to the aircraft,” the report said. The aircraft continued its pre-programmed course until it entered a self-administered holding pattern over Athens, courtesy of its flight management computer.
Greek ATC was very slow to react to the unresponsive jet as it plowed across the Mediterranean towards them. Eventually, a pair of Greek F-16’s intercepted and oversaw the last dramatic act of this Greek tragedy. They saw the passenger oxygen masks swinging from the cabin ceiling and two flight attendants, on the last gasps of their portable oxygen, break into the cockpit.
Despite them sending a futile Mayday and attempting to control the aircraft, the flame-out of an engine wrote finis to the 737’s autonomous sortie. Most of those on board were killed by the crash impact, not by hypoxia.
However, even if they had survived, the protracted anoxia would have left many severely disabled. Almost a year after the accident, there were reports that the remains of some “still missing” passengers had been found under wreckage at the crash site.
Making The Least Of It
Also featuring bleakly in the report is the 737’s manufacturer Boeing. It took “ineffective” measures in response to previous pressurization incidents in the 737 type, the report said. The record is replete with precursors to the Helios event and the crying need to plug the pressurization safety hole.
However, the Greek AAIASB Report’s overview only blandly notes: “Issues related to handling by the International Authorities of precursor incident information so as to implement preventive measures in a timely manner.” Recommendations always get emasculated during the final participatory revision of the draft. (The Helios precursor events listing is at tinyurl.com/qb3bc)
In 1999, a Learjet 35 carrying golfer Payne Stuart crashed near Mina, South Dakota after a depressurization event. The NTSB issued a safety recommendation that the Federal Aviation Administration (FAA) take action to address some paramount safety issues:
“The adequacy of existing guidance on time of useful consciousness at altitude, the need for hypoxia awareness training, the adequacy of existing guidance on preflight procedures for aircraft with supplemental oxygen systems, the adequacy of emergency procedures and checklists for cabin altitude warnings, …. ”
The FAA fired off a quiver full of airworthiness directives applicable to nearly all transport category aircraft mandating aircraft flight manual changes instructing pilots to immediately don oxygen masks at the first sign of a cabin pressurization problem. Such homilies failed miserably to address the root causes. NASA’s Aviation Safety Reporting System (ASRS) database is full of instances where there was confusion or delay in interpreting the proper meaning of the warning horn and suggesting that the warning horn be augmented with a visual alert.
After another such event in 2001, the Norwegian safety agency (HSL) urged the airline Braathens and the Norwegian CAA to take up the matter of horn confusion with the FAA and Boeing. Boeing’s feedback was: “Boeing advises that, based on an increased number of corresponding incidents with Boeing 737 operators, an optional modification will possibly be forthcoming.
However, any such modification will be at least 2-3 years’ off.” The CAA noted that “Boeing has not specified whether the modification will only be available to new aircraft, or whether it will be possible to modify existing air fleets.” Nothing happened. In the absence of a newsworthy disaster and its subsequent acrimony, nobody was extrapolating the scenario for its accident potential.
The Irish Air Accidents Investigation Unit (AAIU), reacting to a similar Sept. 2001 Ryanair case, wrote directly to Boeing, pointing out the need for a cabin pressure warning light. Boeing sluggishly responded in July 2003 with the advice that: “There are no provisions for such a light nor are there any plans to offer such a light on the 737.”
Post Flt ZU522’s crash, in June 2006 the FAA issued airworthiness directive 2006-13-13 which stipulated a Flight Manual change emphasizing that the horn meant one thing on the ground and another thing entirely in the air. It has always been apparent that the FAA considers hypoxia and its deadly effects to be a theory subject for the classroom only. Hypoxia’s ramifications for pilot judgment, recall and decision-making just aren’t factored into any of their airmanship equations.
A pulsing red/amber light would have saved the Helios Flt 522’s 121 souls. Why a pulsing light? In an Australian study (see tinyurl.com/qjk2s) it’s pointed out that out of 517 instances (Jan. ’75 to March ’06) of depressurization, there had been only one fatal accident (the so-called “ghost flight” involving the fatalities of the pilot and seven passengers of a Beech Super King Air 200 VH-SKC on Sept. 4 2000 (see ATSB’s BO/200003771 released in March 2001).
The inference is that the aviation community has been lulled into a false sense of security by the vast majority of pressurization failures being “some” (easily detected) slow loss of cabin pressure at height and not the more insidious failure to pressurize in the climb. In these latter cases, it has become obvious that a very attention-getting sensory alert is required.
As the Australian Safety Board (ATSB) says: “In addition to the ATSB recommendations associated with reports BO/199902928 and BO/200003771, the ATSB is sponsoring a research project on aural warnings for depressurization.” This conclusion was reached after it was resolved that the pilot of VH-SKC could not have seen his steady non-pulsing (and night-flight dimmable) cabin altitude warning light because of the angle of the sun at that time of day. Obviously a distinctive horn, buzzer, siren or warbler plus a pulsing light are needed to get the unique message of imminent peril across. Unfortunately, the ATSB initiative went nowhere and the installation of a distinctive aural alarm never happened. The VH-SKC report can be read here (tinyurl.com/zelvb).
It’s doubtful whether Boeing will now implement any hardware changes. Its perverse defence may well be that the Helios event has now sufficiently re-emphasized their warning horn’s duality. Nevertheless, the Helios tragedy was a wake-up call and its portents figure in the SAFEE project now underway to enable ground-based intervention in the event of a suicidal hijacker assuming control of an airliner (see July 31 ASW, “The RoboLander Agenda”).
According to the SAFEE information brochure (tinyurl.com/g7uwa) there are five sub-projects. One of them is “flight reconfiguration: …includes an Emergency Avoidance System (EAS) and a study of an automatic guidance system to control the aircraft for a safe return.”
If the sought after intervention and robolanding capability ever comes to pass, ghost-flights such as Helios flight 522 can be brought back to earth before catastrophe strikes. In the meantime, oxy porta-bottle carrying cabin crews with access rights are the only wake-up call available for hypoxically vulnerable pilots sequestered by their reinforced cockpit doors.