Helios Airways Flight 522

Date

14 August 2005

Phase of flight

Climb

Location

Near Grammatiko, about 33 km northwest of Athens International Airport, Greece

Aircraft

Boeing 737-31S (737-300)

Registration

5B-DBY

Operator

Helios Airways

Flight

Helios Airways 522 (HCY522)

Occupants

121

Fatalities

121115 passengers and 6 crew members

Investigating body

Air Accident Investigation and Aviation Safety Board (Hellenic Republic)

Final report

AAIASB 11/2006

Report date

4 October 2006

Report title

Aircraft Accident Report: Helios Airways Flight HCY522, Boeing 737-31S, at Grammatiko, Hellas, on 14 August 2005

On 14 August 2005 Helios Airways flight HCY522, a Boeing 737-300 registered 5B-DBY, took off from Larnaca, Cyprus, for Prague via Athens with 115 passengers and 6 crew members. Its pressurisation system was not in automatic mode, and as the aircraft climbed the cabin climbed with it. The pilots did not recognise the cabin altitude warning, were overcome by hypoxia, and the aircraft flew on under the autopilot and flight management computer until its fuel ran out. It struck hilly terrain near the village of Grammatiko, about 33 km northwest of Athens International Airport, killing everyone on board.

The Hellenic Air Accident Investigation and Aviation Safety Board (AAIASB) traced the accident to a switch left in the wrong position after maintenance, three missed checks, a warning horn with two meanings, and a crew that never diagnosed a pressurisation problem before hypoxia took away their ability to do so. Behind these lay weaknesses in the operator's organisation, in the oversight exercised by the Cyprus Department of Civil Aviation, and in the manufacturer's response to earlier incidents.

The report gives all times in UTC; local time in Greece was UTC + 3 hours.

The flight

5B-DBY was a Boeing 737-31S built in 1998 and acquired by Helios Airways in April 2004. It had CFM56-3C1 engines and 142 seats, and its mass and centre of gravity were within limits. The captain, aged 59 and a German national, had 16,900 hours, 5,500 of them as pilot in command of the 737. The first officer, aged 51, had 7,549 hours, 3,991 of them on the 737. Both were rested. The first officer's training files over five years contained numerous remarks about checklist discipline and standard operating procedures.

On the previous flight, from London Heathrow, the cabin crew had reported that the seal of the right aft service door froze and that hard bangs were heard. After landing at Larnaca at 01:25, a ground engineer inspected the door and ran a cabin pressure leak check, a test that requires the pressurisation mode selector to be set to MAN. The aircraft was released at 03:15.

On the 737 the digital cabin pressure control system has three modes. In AUTO or ALTN a controller moves the outflow valve to follow a pressure schedule. In MAN the valve moves only when a pilot drives it with a toggle switch, and a green MANUAL light shows the mode. Data from the pressure controller's memory showed that on the accident flight the system was in manual mode with the outflow valve fixed at 14.6° open, the position in which its actuator was later found. The Board was led to believe that the selector had stayed in MAN since the leak test, the last known time it had been moved.

The accident

HCY522 took off at 06:07:13. With the outflow valve fixed open, the cabin altitude rose at about 2,000 ft per minute, far faster than in automatic mode.

When the horn sounded, the crew disconnected the autopilot, retarded the thrust levers and then re-engaged the automatics, actions consistent with a take-off configuration warning. At about 17,000 to 18,000 ft the master caution came on and was not cancelled for 53 seconds. At about this time the equipment cooling sensors, reacting to the thinner air, lit the cooling lights, and the passenger oxygen masks deployed, lighting the PASS OXY ON light. The captain discussed the cooling lights with the company's ground engineer, who asked him to confirm that the pressurisation panel was set to AUTO. The captain instead asked where the equipment cooling circuit breakers were, and was told they were behind his seat. The Board found that language difficulties prolonged the exchange while the aircraft kept climbing.

From 06:30 Nicosia and then Athinai controllers called the flight repeatedly without reply. The F-16 pilot reported at 08:32 that the captain's seat was empty, the person in the first officer's seat was slumped over the controls, and passengers could be seen motionless wearing oxygen masks. At about 08:49 he saw a man enter the cockpit and take the captain's seat; he was a cabin attendant who had trained as a pilot. Shortly afterwards the left engine flamed out, and the aircraft descended in a left turn, with fluctuating speed and altitude.

The investigation

A selector left in MAN

The AAIASB found inconsistencies between the maintenance actions reported and the log entries, and noted that the engineer did not brief the flight crew. The Boeing maintenance manual's final step, "Put the Airplane Back to its Initial Condition", listed three actions, none of which was returning the mode selector to AUTO. The Board did not treat leaving the selector in MAN as a formal omission, but considered that it would have been prudent to reset it.

The crew then had three chances to catch the error: the preflight procedure, the Before Start checklist and the After Takeoff checklist. The green MANUAL light should have been seen during preflight, take-off and climb. The AAIASB found that the manufacturer's checklists did not list the selector position explicitly and were "not consistent with good Human Factors principles".

A horn with two meanings

On the 737 the same intermittent horn warned of an unsafe take-off configuration on the ground and of a cabin altitude above 10,000 ft in flight. Most pilots hear it only on the ground, where it is tied, in memory and in muscle memory, to the thrust levers. The Board concluded that the crew, surprised and stressed, reacted to that familiar meaning, and that the horn, never silenced with the cut-out button, became a distraction rather than an alert. Numerous similar confusions had been reported worldwide.

Preoccupation and the master caution

The master caution could have been triggered by the equipment cooling lights or by the passenger oxygen deployment, and because the first was not cancelled, the second did not produce a new alert. The crew became preoccupied with the cooling problem and did not detect the pressurisation problem. The Board believed that the captain possibly left his seat to reach the circuit breakers. Before hypoxia began to affect them, inadequate crew resource management contributed to the failure to diagnose the problem.

Hypoxia and time of useful consciousness

Hypoxia is insidious: it degrades reasoning, particularly in novel situations, before a pilot is aware of it. The Board found that the crew probably lost useful consciousness some time after 06:20:21, about 13 minutes after take-off, and that they did not don their oxygen masks. The report cites these average times of useful consciousness after a sudden loss of oxygen:

The cabin altitude at FL340 was calculated at about 24,000 ft, and between 20,500 and 28,200 ft by Boeing. The passenger oxygen system, designed to last about 12 minutes, allowed at least some occupants to stay conscious during the climb. Three of the four portable oxygen bottles had most likely been used.

The cabin crew

It could not be determined what the cabin crew did after the masks dropped or whether they tried to reach the flight deck. The Board found that no international procedures told cabin crew what to do when the masks deploy and the aircraft keeps climbing without a word from the flight deck. The attendant who reached the cockpit made the MAYDAY calls without pressing the transmit key, and the Board concluded that nobody in his condition could have regained control of a 737 with an engine stopped.

Organisation and oversight

The operator's audits had repeatedly recorded an inadequate quality system, weak operational control and manuals not kept up to date; its After Takeoff checklist had not been updated to Boeing's latest revision. The Cyprus Department of Civil Aviation had lacked resources and qualified staff since at least 1999, and ICAO audits recorded 46.57 % non-implementation of its corrective action plans. Air traffic control's handling of the lost radio contact did not contribute to the accident. At its request, the comments of Cyprus on the draft were appended to the final report.

Probable cause and contributing factors

The AAIASB listed three direct causes:

1. "Non-recognition that the cabin pressurization mode selector was in the MAN (manual) position" during the preflight procedure, the Before Start checklist and the After Takeoff checklist.
2. "Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb."
3. "Incapacitation of the flight crew due to hypoxia, resulting in continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground."

The latent causes were the operator's deficiencies in organisation, quality management and safety culture; the regulatory authority's long-standing inadequate oversight; inadequate application of crew resource management; and the ineffectiveness of the manufacturer's measures after earlier pressurisation incidents. Contributing factors were the failure to return the selector to AUTO after unscheduled maintenance, the lack of international cabin crew procedures for mask deployment during a continuing climb, and the ineffectiveness of international authorities in enforcing corrective action plans after audits.

Safety recommendations and what changed

After interim recommendations, Boeing prepared a new section on the cabin altitude warning for its 737 Flight Crew Training Manuals and inserted a step in the maintenance manual's cabin pressure leak test telling the engineer to move the mode selector to AUTO. Boeing also prepared revised crew procedures for the cabin altitude warning, but responded that changing the colour of the MANUAL indication, as the AAIASB suggested, could mislead crews. The Hellenic area control centre added a radar-label indication for flights without radio contact and a three-minute limit for contacting a flight that has missed a reporting point.

On 22 June 2006 the FAA issued Airworthiness Directive 2006-13-13 for all Boeing 737s. It required the Airplane Flight Manual to state that the pressurisation mode selector should be in AUTO before take-off, and a new procedure: if an intermittent horn sounds in flight, oxygen masks and regulators on at 100 %, establish crew communication, then carry out the cabin altitude warning or rapid depressurisation checklist.

The final report asked EASA and the JAA to require:

• cabin crew to tell the flight crew at once when masks deploy and the aircraft does not level off or descend, and to confirm that the pilots have donned their masks;
• a visual or aural alert, in addition to the horn, when cabin altitude exceeds 10,000 ft;
• practical hypoxia training for flight and cabin crews.

With ICAO, they were asked to consider cockpit voice recorders covering the entire flight, recording of company communications with aircraft, cabin altitude on the flight data recorder and flight deck image recorders, and to track and enforce the findings of international safety audits. The Republic of Cyprus was asked to give its reorganising Department of Civil Aviation the resources it needed.

Lessons for pilots

An intermittent horn in flight means cabin altitude. A take-off configuration warning cannot sound in the climb. Treat an intermittent horn in flight as a cabin altitude warning until proved otherwise: masks on, 100 % oxygen, crew communication, then the checklist. See decompression.

Check the mode, not just the numbers. Know where your aircraft's pressurisation mode, cabin altitude and differential pressure are shown, and confirm them on the After Takeoff check and again in the climb. On the 737, AUTO is the normal mode and MAN is a backup; the 737 pressurisation system and the principles of pressurisation control explain why a fixed outflow valve lets the cabin follow the aircraft up.

Fly first, troubleshoot second. The crew kept climbing while discussing cooling lights on the company frequency. When an unexplained warning appears during the climb, stopping the climb costs nothing and buys time.

Use the whole crew. Good crew resource management would have had one pilot flying and one reading the overhead panel. Cabin crew who see masks deployed while the aircraft is still climbing should tell the flight deck at once.

After maintenance, the flight deck is yours to verify. Switches may not be where the last flight left them. A full preflight scan of the overhead panel, with every selector checked against the normal position, is the defence the AAIASB found missing three times.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.