TUI Pressurization Failure Final Report

[Evan]

Not sure if you are talking about the take-off config, cabin altitude, stall, overspeed, autopilot disconnect, or some other of the many warnings.

Don’t forget that the warning is not the first line of defense. You have procedures to be followed, checklists to confirm that the procedures have been followed, indications like cabin alt, diff press and cabinet vert speed, the cabin altitude warning, and then the master caution and corresponding light when the masks are released. And two pilots to catch mistakes from the other.

Also, I think you are cherry picking the parts of the report that support your position. I am not so sure that it was a so honest mistake. There are indications that safety culture may be lacking too, which take us to the previous discussion.

The part I'm "cherry-picking" is the real cherry in the report: the sequence of events. Yes, true, you have procedural lines of defense. They fail, they forget, they space things out, they get sloppy. There has to be something beyond that. I think there should be two things beyond that whenever we are talking about a stealth factor affecting basic life support. Assuming it is within the realm of practicality, which I think this would be. Remember that, as hypoxia creeps in, pilot situational awareness and mental performance goes out the window.

I'm just a bit stunned that this could still happen, that a modern airliner can still take off without cabin pressurization and climb to unsafe altitude in that condition before warning the crew, twenty years after that hard lesson. That's really all I'm saying here.

[Evan]

The idea that some internet schmoe truly thinks that whatever "safety enhancement" he came up with other, much smarter people have not thought of previously fascinates me.

You mean the ones who came up with MCAS?

[ATLcrew]

Alao, I think you are cherry picking the parts of the report that support your position.

Say it ain't so!

[ATLcrew]

The pushback from pilots on the tiniest additional safety measures that might save them (and us) one day does fascinate me.

The idea that some internet schmoe truly thinks that whatever "safety enhancement" he came up with other, much smarter people have not thought of previously fascinates me.

[Gabriel]

There is currently one (1) cockpit warning for a critical and potentially disastrous error. I'm advocating a second one.

Not sure if you are talking about the take-off config, cabin altitude, stall, overspeed, autopilot disconnect, or some other of the many warnings.

Don’t forget that the warning is not the first line of defense. You have procedures to be followed, checklists to confirm that the procedures have been followed, indications like cabin alt, diff press and cabinet vert speed, the cabin altitude warning, and then the master caution and corresponding light when the masks are released. And two pilots to catch mistakes from the other.

Also, I think you are cherry picking the parts of the report that support your position. I am not so sure that it was a so honest mistake. There are indications that safety culture may be lacking too, which take us to the previous discussion.

[Evan]

Maybe then let's add another warning for that warning? And a warning for that warning on top of those first four warnings? The maybe an AD for the spring on the guarded switch? And a guarded switch for that guarded switch? And another AD, just in case?

There is currently one (1) cockpit warning for a critical and potentially disastrous error. I'm advocating a second one. And this is how you respond. The pushback from pilots on the tiniest additional safety measures that might save them (and us) one day does fascinate me. I remember how the introduction of the 'protected aircraft' was simply an outrage.

[ATLcrew]

I think we both agree that the most essential thing is safety culture. Without that, nothing is worth discussing: planes are going to crash and people are going to die. I'm not trying to make the airplane idiot-proof, I'm suggesting a second lline of defense against pilot error in a functional safety culture, where you don't dismiss a cockpit warning because your planes are poorly maintained and you've become used to false warnings, and you certainly don't dismiss a second warning. So, I'm suggesting a warning before takeoff in addition to the cabin altitude warning. An additional line of defense. As it stands, you have a single warning which can and has been missed.

Maybe then let's add another warning for that warning? And a warning for that warning on top of those first four warnings? The maybe an AD for the spring on the guarded switch? And a guarded switch for that guarded switch? And another AD, just in case?

[Evan]

Well, there is a point where, if humans are in the loop at all, an accident will not be able to be avoided.

I mean, pilots have attempted to complete the take-off with the flaps and slats unintentionally left retracted, with the take-off configuration warning sounding immediately as the throttle levers were advanced, and with the crew correctly identifying and acknowledging the warning. Because they thought they had done everything correct so of course it had to be a false warning.

I think we both agree that the most essential thing is safety culture. Without that, nothing is worth discussing: planes are going to crash and people are going to die. I'm not trying to make the airplane idiot-proof, I'm suggesting a second lline of defense against pilot error in a functional safety culture, where you don't dismiss a cockpit warning because your planes are poorly maintained and you've become used to false warnings, and you certainly don't dismiss a second warning. So, I'm suggesting a warning before takeoff in addition to the cabin altitude warning. An additional line of defense. As it stands, you have a single warning which can and has been missed.

TUI has an adequate safety culture. This is what pilot error looks like in that context:

Both pilots recall completing this checklist and were sure that the bleed switch positions were visually verified as being on.

Both pilots made this error, either confirming the checklist item without focusing on it or skipping it altogether. Both are the product of 'repetitive task erosion' as I like to call it. It's human nature. Adding a warning at this point would defend against it.

[bstolle]

Yes, there have been rare cases of these errors. Compare that to all the cases of pilots forgetting or skipping or overlooking a checklist item and you'll see my point.

I dont't agree. As mentioned before, the Helios crash happened almost 20 years ago.
Flaps/Slats/Spoilers/Gear confusions happened way more often than that.

[Gabriel]

"We" is no longer a useful word when it comes to learning. Some can learn. Some can't.

Well, there is a point where, if humans are in the loop at all, an accident will not be able to be avoided.

I mean, pilots have attempted to complete the take-off with the flaps and slats unintentionally left retracted, with the take-off configuration warning sounding immediately as the throttle levers were advanced, and with the crew correctly identifying and acknowledging the warning. Because they thought they had done everything correct so of course it had to be a false warning.

[Evan]

- Have a warning for all bleeds off or all PACKs off that is armed only when the plane is in "clean" configuration.

I thought of that, but I think it is best to have a pre-take-off warning like a flap configuration warning, Because that it where the checklist error occurs. If the bleeds are off (not intentionally off), the airplane is not configured for take-off. Once in the air, aviating, navigating and communicating, a warning is more prone to being missed.

Of course, I wouldn't mind both... it would catch a bleed-off take-off scenario when the bleed-back-on part gets forgotten.

Now, seeing that in this age pilots are not donning their O2 masks after a cabin altitude warning is really concerning. One would think that we already learnt that lesson. But we didn't.

"We" is no longer a useful word when it comes to learning. Some can learn. Some can't.

[Gabriel]

So many factors here... Not trying to make a point below, jut a random collection of random thoughts.

The pressurization system should be set up and checked before take off. That would normally include set the outflow valve to auto and set the target cruise altitude.

I believe that the bleeds must always be set to off initially, and that they are turned on (and checked) after the engine start up. If it's a bleedless take off I think that you still turn the bleeds on after engine start because you need the PACKs to condition the air during taxi, and the PACKs require bleed air, and then turn the bleeds off immediately before the take-off. In this case the bleeds need to be turned on at some point, possibly immediately before or after the reduction from take-off thrust to climb thrust (the need for a bleedless take off may be triggered by runway length, second segment climb or obstacle clearance, so it would be a good idea to wait until thrust reduction to standardize and to keep the cabin as "sterile" as possible during the initial climb which is a quite critical moment).

The plane should still "pressurize" even the bleeds off, (not increase its absolute internal pressure, but increase its differential pressure as the pressure outside goes down), as long as the outflow valve is closed or in "auto". That means that the cabin pressure should climb more slowly than the airplane itself. Now, by how much? That will depend on how well sealed is the plane (how large the leaks), which can be quite variable from plane to plane even within the same type. If the leaks are very small, the outflow valve may even remain a bit open to let the cabin achieve the standard cabin altitude climb rate. If the leaks are on the larger end of the spectrum, the plane with an outflow valve fully closed (without bleed air and PACKs) may still be too leaky as to hold a standard cabin altitude climb rate (the cabin altitude climb rate may be lower than the plane's climb rate, but higher than normal).

Considering all that, it may be a good idea to:
- Have a warning for excessive climb altitude (for example, if > 1000 fpm). That may be not very effective when the bleeds or PACKs are forgotten off but will be effective to catch an outflow valve left open or some other "big hole" preventing the plane from pressurizing.
- Have a warning for all bleeds off or all PACKs off that is armed only when the plane is in "clean" configuration.
- Have corresponding EICAS / ECAM messages for those with corresponding action items. That will of course not be implemented in a 737.

Now, seeing that in this age pilots are not donning their O2 masks after a cabin altitude warning is really concerning. One would think that we already learnt that lesson. But we didn't.

[Evan]

You think so? There have been numerous cases of pilots retracting the flaps instead of the gear after takeoff, extending the flaps instead of the speedbrakes etc.

Yes, there have been rare cases of these errors. Compare that to all the cases of pilots forgetting or skipping or overlooking a checklist item and you'll see my point.

[bstolle]

And the odds of that switch being pressed in error (an active error) are far, far remote than bleed switches being missed altogether (a passive error).

You think so? There have been numerous cases of pilots retracting the flaps instead of the gear after takeoff, extending the flaps instead of the speedbrakes etc.

[Evan]

Besides that, if you forget to turn on the bleed switches, what keeps you from forgetting the "bleeds-off-takeoff switch" as well?

For one thing, I think an open guarded switch is harder to miss in a scan of the overhead. But even if you miss that, there is still the cabin altitude warning. I’m just adding another layer of safety.

But, as guarded switches are forbidden on this forum, there is a better way. Make it a normal switch that resets when transitioning to air mode. The next crew that needs a no-bleeds takeoff will either have the switch on their checklist or will get a config warning and press the switch to silence it. And the odds of that switch being pressed in error (an active error) are far, far remote than bleed switches being missed altogether (a passive error).