Irony of Automation in Aviation

    

These statements are so true!

Computers do those things well that pilots already know how to do well, much better than pilots. But computers do not know how to do those things that a pilot would like to do well.

   In essence, the irony is that pilots are to oversee an automated system, which they do poorly, and take over when there are abnormal conditions, which they may not be very good at either.

-----------------ATPL Book 8 CAE Oxford Aviation Academy

PRESSURISATION SWITCH IN THE WRONG POSITION

HELIOS AIRWAYS FLIGHT 522: 14 AUG 2005: BOEING 737 – 300

SYNOPSIS

On 14 Aug 2005, Helios Airways international Flight 522 departed from Larnaca, Cyprus, at 06:07h for an intermediate stop at Athens, Greece on way to Prague, Czech Republic. The planned flying time was 1 hour and 23 minutes. While climbing through an altitude of 12040 ft, for FL 340, the cabin altitude warning horn sounded at 06:12h. The German captain and the Cypriot co-pilot tried to solve the problem but encountered some problems communicating with each other.

Helios' Boeing 737-300 5B-DBY underwent maintenance on the night prior to the accident. The pressurization system was checked, but after completion of the tests the Pressurization Mode Selector (PMS) was reportedly left in the "Manual" position instead of the "Auto" mode. In manual mode the crew had to manually open or close the outflow valves in order to control the cabin pressure. The outflow valves were one-third in the open position which meant that the cabin would not pressurize after takeoff. The PMS mode was apparently not noted during the pre-departure checks by the crew.

At 06:14h while climbing through an altitude of 15966 ft, the Captain contacted the Company Operations Centre (COC) and informed, “Take off configuration warning ON” and “Cooling equipment Normal and Alternate Offline”. Because of a lack of cooling air another alarm activated, indicating a temperature warning for the avionics bay. 

There were a few communications between the Captain and the COC during the period of 06:14h and 06:20h. On a query from the Captain, “where are my equipment cooling circuit breakers?” The engineer replied, “Behind the Captain’s seat”. These needed to be pulled out to turn off the alarm. The captain got up from his seat to look for the circuit breakers. At 06:20h, the Captain made his last communication, at which time the aircraft was climbing through 28900 ft.

During the communications between the Captain and the COC, at an altitude of approx. 18000 ft, the cabin altitude exceeded 14000 ft, leading to the deployment of oxygen masks in the passenger cabin, as per design.

The crew was not wearing their oxygen masks as their mindset and actions were determined by the preconception that the problems were not related to the lack of cabin pressure. As the airplane was still climbing, the lack of oxygen seriously impaired the flight crew. The captain probably became unconscious when he was trying to find the circuit breaker. The first officer was still in his seat when he also became unconscious. There were no further two way communications with the aircraft after 06:20h.

The aircraft continued to climb and leveled out at FL 340, as programmed. The aircraft continued on track maintaining FL 340 and eventually fed in to a standard instrument approach procedure for runway 03L at Athens International airport, while continuing to maintain FL 340. The approach was followed by a missed approach, and setting up of a holding pattern over KEA VOR, while continuing to maintain altitude.

All efforts by Greek air traffic controllers to contact the pilots were futile. Around 07:00h, two Greek F-16 fighter planes were scrambled to intercept the aircraft. The F-16s intercepted the aircraft on its sixth holding pattern, at about 07:23h. The F-16 pilots reported that they were not able to observe the captain, while the first officer seemed to be unconscious and slumped over the controls. Oxygen masks were reported to be dangling in a dark passenger cabin.

At 08:49h, the F-16's reported a person not wearing an oxygen mask entering the cockpit and occupying the captain's seat. The F-16 pilot tried to attract his attention without success. At 08:50h, the left engine flamed out due to fuel depletion and the aircraft started descending. At 08:54h, two Mayday messages were recorded on the CVR, in a very weak voice. At 09:00h, the right engine also flamed out at an altitude of 7084 ft. The aircraft continued descending rapidly and impacted hilly terrain about 33 kms northwest of Athens, close to Grammatiko village.

All 121 persons on board the aircraft, including 6 crew members and 115 passengers, were fatally injured during the accident.

DIRECT CAUSES

1. Non-recognition that the cabin pressurization mode selector was in the MAN (manual) position during the performance of the:

a) Pre-flight procedure;
b) Before Start checklist; and
c) After Takeoff checklist.

Image Courtesy: Google Images. Pressurisation Mode Selector in Manual Mode

2. Non-identification of the warnings and the reasons for the activation of the warnings (cabin altitude warning horn, passenger oxygen masks deployment indication, Master Caution), and continuation of the climb. (The initial actions by the flight crew to disconnect the autopilot, to retard and then again advance the throttles, indicated that it interpreted the warning horn as a Takeoff Configuration Warning). (At an aircraft altitude of 17 000 to 18 000 ft, the Master Caution was activated and was not cancelled for 53 seconds. The reason for its activation may have been either the inadequate cooling of the Equipment or the deployment of the oxygen masks in the cabin. Independently of the Master Caution indication, there are separate indications for both malfunctions on the overhead panel. The flight crew possibly identified the reason for the Master Caution to be only the inadequate cooling of the Equipment that was indicated on the overhead panel, and did not identify the second reason for its activation, i.e., passenger oxygen masks deployment, that was later also indicated on the Overhead panel. The crew became preoccupied with the Equipment Cooling fan situation and did not detect the problem with the pressurization system. The workload in the cockpit during the climb was already high and was exacerbated by the loud warning horn that the flight crew did not cancel).

3. Incapacitation of the flight crew due to hypoxia, resulting in continuation of the flight via the flight management computer and the autopilot, depletion of the fuel and engine flameout, and impact of the aircraft with the ground. (The incorrect interpretation of the reason for the warning horn indicated that the flight crew was not aware of the inadequate pressurization of the aircraft).

LATENT CAUSES

1. The Operator’s deficiencies in organization, quality management and safety culture, documented diachronically as findings in numerous audits.

2. The Regulatory Authority’s diachronic inadequate execution of its oversight responsibilities to ensure the safety of operations of the airlines under its supervision and its inadequate responses to findings of deficiencies documented in numerous audits.

3. Inadequate application of Crew Resource Management (CRM) principles by the flight crew.

4. Ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurization incidents in the particular type of aircraft, both with regard to modifications to aircraft systems as well as to guidance to the crews.

CONTRIBUTING FACTORS TO THE ACCIDENT

1. Omission of returning the pressurization mode selector to AUTO after un-scheduled maintenance on the aircraft.

2. Lack of specific procedures (on an international basis) for cabin crew procedures to address the situation of loss of pressurization, passenger oxygen masks deployment, and continuation of the aircraft ascent (climb).

3. Ineffectiveness of international aviation authorities to enforce implementation of corrective action plans after relevant audits.

SHUTTING DOWN THE ‘GOOD’ (WRONG) ENGINE

BRITISH MIDLANDS FLIGHT 092: 08 JAN 1989: BOEING 737 – 400

SYNOPSIS

Flight 092 left London for Belfast at 19:52h with a crew of 8, and 118 passengers on board. While climbing through FL283 moderate to severe vibration that was accompanied by ingress of smoke and fumes in to the flight deck were felt, as also fluctuations in the engine parameters of the No. 1 engine. Investigations revealed that these were the result of one of the outer panel of one of the no. 1 engine fan blades getting detached in flight, causing a series of compressor stalls that lead to airframe shuddering.

Believing the No. 2 engine had suffered damage, the crew throttled it back. The shuddering stopped, leading the flight crew to believe that their actions were correct, and they thus shut down the No 2 engine. The No. 1 engine operated normally after the initial severe vibrations, and during the descent in to East Midlands, the diversionary airfield.

The flight was cleared for an approach on to runway 27. The instrument approach on No. 1 engine continued normally, although with a high level of vibrations from the live engine. At 900 feet, 2.4nm from the runway, no. 1 engine suddenly suffered a reduction in power followed by a fire warning on this engine. Attempts to restart No. 2 engine were not successful. As the speed fell below 125 knots, the stick shaker activated and the aircraft struck trees at a speed of 115 knots. The aircraft continued and impacted the western carriageway of the M1 motorway 10 m lower and came to rest against the wooded embankment, 900 m short of the runway.

39 passengers died in the accident, and 8 more died later due to the injuries sustained. Of the remaining 79 occupants, 74 suffered serious injuries.

(Image Courtesy: Google Images: Aerial view of Crash site)

PROBABLE CAUSE

The operating crew shut down the No 2 engine after a fan blade had fractured in the No 1 engine. This engine subsequently suffered a major thrust loss due to secondary fan damage after power had been increased during the final approach to land.

The following factors contributed to the incorrect response of the flight crew

1. The combination of heavy engine vibration, noise, shuddering and an associated smell of fire were outside their training and experience.

2. They reacted to the initial engine problem prematurely and in a way that was contrary to their training. (Either pilot does not remember having noticed the engine parameters like N1, EGT, N2 or Oil Pressures of the engines before throttling back No. 2 engine).

3. They did not assimilate the indications on the engine instrument display before they throttled back the No. 2 engine. (The crew’s familiarity of the newly introduced EIS on the B 737-400 variant could have been a factor. The Captain had 23 hours and the first officer had 53 hours on the B 737-400. Both were given a 1day training session on the EIS, as there was no flight simulator available with the EIS. The variants before the B737-400 had the normal electro-mechanical engine instruments).

4. As the No 2 engine was throttled back, the noise and shuddering associated with the surging of the No 1 engine ceased, persuading them that they had correctly identified the defective engine. (The Auto Throttle system was disengaged while bringing No. 2 engine throttle back to idling. This led to manual control of the engines, and No. 1 engine fuel flow settled as per the prevailing engine conditions, rather than as demanded by the auto throttle to maintain flight parameters).

5. They were not informed of the flames which had emanated from the No.1 engine and which had been observed by many on board, including 3 cabin attendants in the aft cabin. (Inadequate communications between flight and cabin crew – a CRM issue that is greatly emphasised now).