AO-2013-008 Boeing 737-300, ZK-NGI, Loss of cabin pressure, near Raglan, Waikato, 30 August 2013

1. On 30 August 2013 a Boeing 737-300 aeroplane operated by Air New Zealand was on a scheduled service between Wellington and Auckland. After the aeroplane began its descent to Auckland, it lost cabin pressure. The pilots commenced the relevant emergency procedures and made a normal landing at Auckland Airport. No-one was injured and the aeroplane was not damaged.
2. The Transport Accident Investigation Commission (Commission) was unable to identify the cause of the depressurisation despite extensive testing and a specialist examination of the pressurisation system. An intermittent defect within the air-conditioning and pressurisation system could not be excluded as the cause.
3. The Commission made findings relating to the following safety issues:

• non-adherence to the published emergency checklists for a loss of cabin pressure
• the training of cabin crew in the use of the emergency oxygen equipment and the cabin depressurisation procedure.

4. The operator acted to correct these issues. Therefore the Commission made no recommendations regarding them.

5. In addition, the inquiry considered the potential for the cabin to be pressurised on the ground following the use of the Cabin Altitude Warning checklist. Boeing subsequently amended the checklist to reduce that risk.

6. The key lessons identified from the inquiry into this occurrence were as follows:

• an unexpected loss of cabin pressure in any aeroplane is a serious event that can cause both passengers and crew to lose consciousness rapidly from a lack of oxygen. In such an event the appropriate emergency actions must be undertaken immediately. Where oxygen masks are fitted, passengers and cabin crew must put on their masks and await further instruction from the flight crew
• the purpose of emergency procedure checklists is to ensure that crew members do not miss an important action at a critical time of high workload. Therefore, unless the captain has an exceptional reason to deviate from a checklist, it should be performed from beginning to end, if possible without interruption, and without omitting any step
• crew members must be thoroughly trained in and familiar with all emergency equipment and procedures, because the equipment and procedures are for their own protection as well as that of the passengers. They need to be alert for emergency situations that differ from the standard scenarios that are practised and demonstrated repeatedly
• an aircraft door will be very difficult to open on the ground while the cabin is still pressurised, and this can delay an evacuation if it is called for. When pilots have been controlling the cabin pressure manually, they must ensure that the cabin is fully depressurised to allow the doors to be opened
• special care must be taken with the maintenance of aircraft emergency equipment, such as oxygen systems.

1. Shortly after the aeroplane landed at Auckland, Air New Zealand Limited (the operator) notified the Transport Accident Investigation Commission (Commission) directly of the incident. The operator promptly quarantined the aeroplane and its flight recorders. The Commission opened an inquiry and notified the Civil Aviation Authority of New Zealand (CAA).
2. In accordance with the protocols of Annex 13 to the Convention on International Civil Aviation, the Commission notified the National Transportation Safety Board (NTSB) of the United States, being the state of the aeroplane manufacturer. The NTSB took part in most communications between the Commission, Boeing Commercial Airplanes Limited (Boeing) and the makers of key pressurisation system components.
3. Two Commission investigators travelled to Auckland on 30 August 2013 to begin the investigation. They were present for the initial fault-finding conducted by the operator, and consulted an investigator from the CAA about potential airworthiness issues.
4. The pilots and two of the cabin crew were interviewed on 31 August 2013, and the third cabin crew member was interviewed on 9 September 2013. Passengers for whom contact details were available were sent a questionnaire on their perspectives of the incident.
5. The Australian Transport Safety Bureau appointed an Accredited Representative and successfully downloaded the cockpit voice recorder at the Bureau’s laboratory in Canberra on 5 September 2013.
6. On 22 October 2013 Commission investigators observed a Boeing 737 flight simulator detail in which the cabin altitude (cabin altitude is the pressure of the air inside an aircraft cabin expressed as the altitude in the atmosphere at which the same pressure would be found. ‘Altitude’ is the height above mean sea level) warning and emergency descent checklists were demonstrated.
7. The completion of the inquiry report was delayed by higher-priority investigations. In addition, it was apparent early in the investigation that the cause was unlikely to be determined.
8. On 27 April 2016 the Commission approved a draft report for circulation to interested persons for comment.
9. Submissions were received from the operator, some of the crew and the aircraft manufacturer. The Commission has considered all submissions and any changes as a result of those submissions have been included in this final report.
10. On 28 July 2016 the Commission approved the report for publication.

Introduction – the need for cabin pressurisation and emergency oxygen

1. Turbine-powered aeroplanes generally fly at high altitudes because their performance is more efficient in the less dense air. As altitude increases the atmospheric pressure decreases. However, above about 10,000 feet (ft) (3,000 metres) (imperial units are still used for vertical distances in most civil aviation jurisdictions), the lower atmospheric pressure is detrimental to people because their lungs do not absorb sufficient oxygen. As the oxygen content of blood decreases, one’s ability to think and act efficiently becomes impaired. In severe cases unconsciousness and death can occur.
2. This problem is avoided for aeroplane passengers by pressurising the aeroplane, using the conditioned air that is pumped into the cabin. Aeroplanes that fly above 10,000 ft will usually be pressurised. The cabin air is normally maintained at a pressure that is equivalent to that found between 5,000 and 8,000 ft in the atmosphere. Therefore, when the cabin is pressurised, the ‘cabin altitude’ is lower than the ‘flight altitude’ (see Figure 1).

1. Civil aviation rules, in general, require pressurised aeroplanes to have emergency oxygen available in case cabin pressure is lost at high altitude. Typically, the emergency oxygen is supplied automatically from units above the seats (and in the toilets) before the cabin pressure decreases to an unsafe level. The pilots have a separate oxygen supply, but the supply for pilots and passengers is limited. Therefore, in the event of a loss of cabin pressure, the aeroplane must descend quickly to an altitude where there is adequate oxygen.
2. A loss of cabin pressure is a rare event, but if mishandled it can cause injury or death. Prompt and correct action on the part of the pilots may mean that control of the cabin pressure is regained and the need for an emergency descent averted. However, if oxygen masks appear in the cabin everyone must fit their mask immediately and keep it on until instructed otherwise.

The incident

1. On Friday 30 August 2013 a Boeing 737-300, registered ZK-NGI, operated a scheduled return flight between Auckland and Wellington. The crew comprised two pilots, both of captain rank, and three cabin crew. For the flight back to Auckland the pilot in command was in the left seat performing ‘pilot monitoring’ duties, and the pilot in the right seat was the ‘pilot flying’ (the ‘pilot flying’ is the pilot actually manipulating the controls; the ‘pilot monitoring’ is the support pilot who, among other duties, makes the radio calls. Typically, pilots alternate these roles after each flight leg). The aeroplane departed Wellington with 76 passengers and climbed to a cruise altitude of 37,000 ft (the aviation industry refers to a cruise altitude of 37,000 ft as ‘flight level 370’, but for the benefit of the general reader the report expresses the altitudes in feet), where it remained for approximately nine and a half minutes.

2. When the aeroplane was passing approximately 30,000 ft on the descent to Auckland, the cabin altitude warning horn sounded and the ‘cabin altitude’ annunciator illuminated. The warnings meant that the cabin pressure was too low (above 10,000 ft equivalent altitude). An indicator on the pressurisation system control panel on the flight deck overhead panel showed that the cabin pressure was decreasing quickly. The pilots confirmed that the air-conditioning and pressurisation systems were set correctly, and saw that no pressurisation system fault lights were illuminated.
3. The pilots put on their oxygen masks, initiated the emergency descent procedure, and advised air traffic control. At about this time the senior flight attendant (designated ‘FA1’ by the operator) called the flight deck on the intercom. She advised that the passenger oxygen masks had deployed and checked that the pilots had put their masks on. When the cabin loses pressure and the cabin altitude exceeds the equivalent of 14,000 ft, passenger masks deploy automatically and a pre-recorded message plays over the public address system, telling passengers to put on the nearest masks. The pilot flying confirmed with FA1 that the cabin pressure had been lost.
4. The pilots commenced the emergency actions for a loss of cabin pressure and an emergency descent (see Appendix 2 for the emergency checklists). The pilot monitoring then silently checked that all of the required actions had been completed correctly.
5. One of the listed actions was to select the passenger oxygen switch to on (the switch was a back-up to the cabin pressure switch that automatically deployed the masks, and its position did not affect the supply of oxygen to the masks (see paragraph 4.5.6)). The pilot monitoring did not do that because the associated annunciator was illuminated, indicating that the passenger masks had already deployed.
6. The cabin crew were preparing the cabin for landing when the masks deployed. FA1 was at about mid-cabin, moving forward; one attendant (FA3) was in the rear galley; and the third (FA2) was pushing a cart to the rear galley (see Figure 2). FA1 continued walking to her normal crew station at the front left entry door and fitted a mask. She said the green flow indicator was visible but the attached reservoir bag was not inflating. She was later uncertain whether oxygen had been flowing. FA1 remained standing by her seat, observing the cabin, until the pilots announced that masks could be removed.

1. FA3 first saw that the masks above the right rear door crew seat had deployed, but not those above the left rear crew seat. When she saw that the masks had also deployed in the cabin, she fitted a mask. FA2 pushed the cart to the galley, where FA3 helped her to stow it. FA2 donned a mask but was unsure whether oxygen was flowing to it. She observed that the reservoir bag was not inflating like the bag on FA3’s mask. FA2 then manually deployed the masks at the left rear door, fitted one and sat down next to FA3.
2. It took approximately four minutes for the aeroplane to descend from 30,000 ft to below 10,000 ft, at which point the flight deck cabin altitude warning ceased. The pilots continued the descent to 5,000 ft and maintained that altitude. Some of the cabin crew and passengers said the cabin seemed hot, and many noticed a chemical smell. The right rear toilet smoke alarm sounded, and later the smoke alarm for the forward toilet sounded. The crew took the appropriate action in response to these alarms, which continued for the rest of the flight (the airport fire service inspected the aeroplane as soon as the engines were shut down and found no sign of fire).
3. While the aeroplane was taxiing to the terminal after landing, the ‘equipment cooling OFF’ light illuminated on the flight deck. The pilots switched to the alternate cooling source, the only action required, but the annunciator remained illuminated.

4. At the terminal FA1 was unable to open the forward entry door because the cabin was still slightly pressurised. The pilots depressurised the aeroplane manually and the doors were then opened to disembark the passengers.

5. The incident occurred in daylight. Some passengers reported ear or sinus discomfort, which for a few persisted for several days. Otherwise there were no injuries.

Personnel information

1. The pilot flying had more than 10,800 hours’ flight experience, including 3,500 hours on the Boeing 737. He was employed in a fleet management role and had been on office or simulator training duties for most of the six days prior to the incident. His most recent day rostered free of duty had been 26 August 2015. On most days he had worked for 10 or 11 hours. He said he had been fit to fly on 30 August 2013.
2. The pilot monitoring had more than 12,000 hours’ flight experience, including 5,200 hours on the Boeing 737. He had returned from annual leave four days before the incident, had worked for two days, and then had had a rostered day off. He said that he had been fit to fly on 30 August 2013.
3. The senior flight attendant, FA1, had been employed by the operator as a flight attendant in 1999 and promoted to purser in 2005. The other two flight attendants had a combined 22 years of flight attendant experience. They all considered themselves familiar with the Boeing 737 and said they had been fit to fly that day.

Aircraft information

1. The Boeing 737-300 is a short- to medium-range, narrow-body aeroplane powered by two turbofan engines. It is a variant of the Boeing 737 family that has been in production since 1967. The normal crew is two pilots and three or four cabin crew. Depending on the cabin configuration, up to 150 passengers can be carried.

2. ZK-NGI had been registered in New Zealand on 20 November 1999. Air New Zealand retired its Boeing 737 fleet in September 2015, but another New Zealand operator continued to use the aeroplane type after that date.

Boeing 737-300 pressurisation

1. The Boeing 737-300 air-conditioning and pressurisation systems are typical for a turbine-powered aeroplane (see Figure 3). The cabin air is supplied by ‘bleed air’ (bleed air is air tapped off one or more compressor stages of a turbine engine and used to supply some other systems) taken from the engines. The air-conditioning system (‘packs’) cools the very hot bleed air, then distributes it at the desired temperature to the cabin. The continuous inflow of conditioned air pressurises the cabin, with excess air being vented back to the atmosphere through the aft outflow valve.
2. Under normal circumstances one of two identical digital pressure controllers regulates the cabin pressure. The controllers maintain the required pressure by adjusting the aft outflow valve. Unintended changes to the cabin pressure can be caused by low air inflow from the engines or air-conditioning system, excessive leakage or a defect in the control system. The pressure controllers detect internal and external failures that affect the control of cabin pressure and, if appropriate, annunciate them on a flight deck panel regardless of whether the faults are intermittent or not.

3. See Appendix 1 for more information on the Boeing 737-300 cabin pressurisation system.

   

Flight recorders

1. The aeroplane was fitted with a cockpit voice recorder with 30 minutes’ recording duration. No useful information about the incident was obtained from the recorder because electrical power was not removed soon enough after the engine shutdown to prevent the incident being over-written. The operator later reminded its pilots that power must be removed from the recorders after landing following a serious incident (the operator’s other jet aeroplanes were fitted with cockpit voice recorders with two-hour recording durations).
2. The aeroplane was fitted with a digital flight data recorder. However, unlike recorders on more modern aeroplanes the recorder did not, and was not required to, record potentially useful parameters such as actual bleed air duct pressures and the outflow valve position.
3. A quick-access recorder was also fitted and that provided some data about the flight path.

Post-incident testing

1. Post-incident testing examined:
   • the cabin pressure controllers
   • whether there was a structural breach that would have allowed air to escape
   • the outflow valve
   • the safety relief valves.

• The operator’s engineering staff, in the presence of Commission investigators, followed the fault-finding procedures (often called ‘troubleshooting’) given in Boeing Service Letter 737-SIL-21-069 Airplane Pressurization – Guidance to Understanding (Issued on 22 May 2006).

Initial inspection

1. Both digital pressure controllers were tested with satisfactory results before the aeroplane was towed from the terminal to a hangar and placed under quarantine. The manufacturer of the controllers later tested them and downloaded their memory chips. These showed that there had been an ‘inflow/leakage fail’ status message just over a minute prior to the cabin altitude aural warning. That status meant there was a low inflow of air or excessive air leakage, or possibly both conditions.
2. The aeroplane was inspected visually for any sign of structural damage or mechanical defect, and the condition of controls and oxygen masks in the flight deck and cabin was recorded before electrical power was applied to the aeroplane to allow further checks.

Test for structural breach

3. To test for a breach in the fuselage the cabin was pressurised on the ground using air from the aeroplane’s auxiliary power unit. When the air supply was stopped the rate of pressure ‘leak-down’ was noted. The recorded leak rate was within limits but close to the maximum allowed. The operator’s engineers considered that the test eliminated the likelihood of a major structural breach in any fuselage areas that were difficult to access for inspection, such as under the tail fin.

Outflow valve tests

4. The memory chips of the digital pressure controllers recorded that the outflow valve had closed appropriately when signalled to do so by the controllers in response to the loss of pressure. As a precaution the outflow valve was replaced and tested by its manufacturer. The valve had minor failures of some incoming test specifications, but the manufacturer said the discrepancies, of which one related to the outflow valve position feedback to the pressure controller, would not have caused the leakage condition recorded by the pressure controllers.

Safety relief valve tests

1. The aeroplane has two cabin pressure safety relief valves, which open in the event of excessive cabin pressure. They remain open until the pressure is relieved, then close. Whether a safety relief valve has opened can be inferred only from data stored in the digital pressure controller memory. There was no evidence that that had happened.
2. One of these valves had been in place since the aeroplane was manufactured in 1999, although it had been subjected to routine maintenance checks. The other valve had been installed in 2012 following overhaul by the vendor.
3. After the incident the operator removed and tested both valves. Neither valve met the functional test requirements for ‘cracking’ pressure, which is the pressure when the valve begins to open, nor the stabilised flow rate after the valve had opened.
4. The manufacturer, UTC Aerospace Systems in the United States, inspected the valves and confirmed the operator’s results. The manufacturer considered that the results, and some observed minor defects, were typical for the time the valves had been in service. The manufacturer advised that such defects were not known to have caused any in-flight incidents and would not have inhibited the correct operation of the valves. Boeing’s analysis concluded that the defects with the cabin pressure relief safety valves would not have caused a cabin depressurisation.

Further testing

1. After the initial fault-finding, the operator’s engineering staff performed another fuselage ‘leak-down’ test with a better result than the first test. Before the aeroplane was returned to service it completed a satisfactory verification flight.
2. Boeing advised that the type of smoke detector fitted was sensitive to cabin pressure spikes that could cause an alarm to activate (this information was included as a note in the Boeing 737 maintenance manual task for performing a cabin pressure leak test, but was not included in flight operation manuals). However, neither Boeing nor the oxygen generator manufacturer (B/E Aerospace of the United States) knew of an oxygen generator having caused a smoke alarm to activate.
3. For a more complete list of the testing and fault-finding carried out, see Appendix 1.

Previous occurrences

1. Between 2000 and 2013 the operator had had four other incidents involving a loss of cabin pressure, although none had involved a rapid loss of pressure or the use of oxygen masks. Three had been similar to the 30 August 2013 incident in as much as the pilots received a cabin altitude warning but no indication of a pressurisation system defect, and the cabin pressure had continued to decrease even though the aft outflow valve was closed.

Introduction

1. Cabin depressurisation events are rare but potentially dangerous. The cabin pressurisation system operated normally on the flight from Auckland to Wellington. On the return flight, shortly after the descent to Auckland began, the cabin pressure began decreasing at a rate equivalent to a climb rate of up to 4,000 ft per minute (the more correct unit for the cabin rates recorded by the pressure controller is ‘sea level feet per minute’. A decrease in the cabin pressure is usually expressed as an increase in the cabin altitude). Pilots would normally detect such a rapid decrease in cabin pressure through physiological changes (for example, ear ‘popping’). However, in this case the cabin rate increase appears to have occurred just prior to the cabin altitude warning horn sounding, which gave no time for the flight crew to take pre-emptive action to control the pressure change.
2. In spite of extensive inspections and a detailed examination of key components of the pressurisation system, no definite cause was found for the loss of cabin pressure. The following analysis discusses a number of technical factors that might have contributed to the cabin depressurising.
3. This analysis also discusses the following three safety issues that were identified in the inquiry:
   • non-adherence to the published emergency checklists for a loss of cabin pressure
   • the training of cabin crew in the use of emergency oxygen equipment and the cabin depressurisation procedure
   • the possibility of the cabin being pressurised on the ground following the use of the Cabin Altitude Warning checklist.

Factors that affect cabin pressure

1. To pressurise the cabin, air is supplied continuously from the engines via the air-conditioning packs. The pressure is regulated by controlling the exit of air from the aft outflow valve. Therefore the cabin pressure is affected by the following factors:
   • the inflow, or supply, of air from the engines to the cabin
   • the controlled (regulated) leakage of air from the cabin
   • any uncontrolled leakage of air from the cabin.

Defects that could cause a reduced air supply

• Key components of the air-conditioning and pressurisation system that are involved in the supply of cabin air are:
  • the engine bleed valves
  • the packs

1. If the high stage (the ‘high stage’ bleed valves are at a later stage of the compressor section. When they open, the higher-pressure air maintains the required air mass flow for air-conditioning pack operation) bleed valve does not open when the engine thrust is reduced to begin a descent, there will be low air flow from that engine. There have been incidents where high stage bleed valves have had intermittent, but unidentifiable, defects. However, neither Boeing nor the operator was aware of a high stage bleed valve defect having caused the cabin altitude to increase at a rate exceeding 2,000 ft per minute.
2. The aeroplane had had various bleed air system defects in the four months preceding this occurrence, including low bleed (or ‘duct’) pressure from the engines. The most recent occurrence had been a low duct pressure during a descent, which occurred six weeks before this incident. The high-pressure (‘high-stage’) bleed valves for both engines had been replaced several times. Defects had occurred with other bleed air system components, mainly those connected with the left engine. There had been no other recorded defects in the six weeks before this incident.
3. On the incident flight the pilots followed the usual procedure of setting both packs to automatic mode. If one pack is providing no flow when the packs are in automatic mode, the other automatically increases its output to high flow. There was no indication of that happening on this flight.
4. The engine bleed valves and the packs tested satisfactorily after the incident.

Defects that could cause an excessive air outflow 

Controlled air outflow

1. The principal components involved with the controlled leakage or outflow of cabin air are:
   • the aft outflow valve
   • the forward outflow valve.
2. According to Boeing and the manufacturer of the outflow valve, the minor defects found with the valve were typical for its time in service. They would not have caused the cabin pressure to decrease at the rate that it did.
3. The pressurisation control system also signals the forward outflow valve to close when the aft outflow valve is fully closed. Because the aft valve remained closed for the rest of the flight, the forward valve would also have stayed closed. This was a normal response of the system and, although it caused the ‘Equipment cooling OFF’ light to illuminate after landing (see paragraph 3.2.9), it did not require any corrective maintenance action.

Uncontrolled leakage

1. Uncontrolled leakage can occur at a number of places: through door seals, where wire bundles and controls penetrate bulkheads, from various drains, skin cracks and ruptures, and as a result of a defect in an air-conditioning or pressurisation system component. A malfunction of one of the aeroplane systems that was a minor user of bleed air would not, on its own, have caused the substantial loss of cabin pressure that occurred (for example, the hydraulic and water systems use bleed air to pressurise the fluid reservoirs).
2. An inspection of the aeroplane prior to the ground test of the pressurisation system found no evidence of a structural factor having contributed to the incident. However, a worn cabin entry door seal was identified and replaced. In the leak-down tests the fuselage met the minimum requirement for retaining pressure.
3. The fuselage was proven to be sufficiently airtight by remaining partially pressurised following the emergency procedure until after the landing.

Safety relief valves

1. Boeing confirmed that there had been cabin depressurisation events caused by safety relief valves activating unnecessarily while in the cruise. However, Boeing said it was unlikely that the cabin differential pressure (differential pressure is the difference between the cabin air pressure and the outside air pressure) in this case had increased to 8.1 pounds per square inch (psi), which was the lower pressure found during the ‘crack’ testing of the safety relief valves fitted to this aeroplane (see paragraph 3.7.9). This conclusion was partly confirmed by the post-incident verification flight, during which a climb was made to 37,000 ft with a flight altitude of 36,000 ft set in the pressure controller (as for the incident flight) (the conclusion was not fully confirmed because other components had been changed after the incident and the cabin pressure on the verification flight might not have been exactly the same as it had been on the incident flight). The differential pressure increased to only 7.9 psi compared with the normal cruise differential of 7.8 psi.

Pressure controller

1. According to Boeing’s description of the pressurisation system, the ‘Auto fail’ annunciator on the overhead panel should illuminate if the pressure controller senses a sustained cabin rate of climb greater than 2,000 ft per minute. That light did not illuminate during this incident, and the pressure controller did not record that it had come on. This suggested that the high climb rate observed by the pilots was of very short duration. Both digital pressure controllers tested satisfactorily after the incident, but both were replaced as a precaution.

Summary

1. No individual component of the cabin pressurisation system was identified as having caused the loss of cabin pressure. The outflow valve, selector panel and cabin pressure controller all have internal, built-in test functions that report any faults affecting the control of cabin pressure, whether intermittent or constant (a constant or steady fault condition is sometimes said to be ‘latched’), to the controller, which records these faults to non-volatile memory. The non-volatile memory data for this incident was examined and no pressurisation system failures were recorded. The tear-down examination of those components revealed no faults. Experience has shown that older pressurisation system components can have intermittent faults that do not show during subsequent testing. A combination of components with low or marginal performance could have caused the incident, but no such combination was identified. Boeing submitted that the cabin pressure continuing to decrease when the outflow valve was closed indicated a root cause that was related to insufficient cabin air inflow or excessive fuselage leakage.

   

Response to the emergency

Flight crew actions

1. Pilots and cabin crew must memorise and frequently practise emergency procedures so that they react promptly and correctly. In particular, crew members must not delay putting on oxygen masks as soon as there is a clear indication of a loss of cabin pressure.
2. The pilot in command may take whatever action is necessary under the circumstances to ensure the safety of everyone on board. That authority extends to varying an emergency checklist if conditions require it. However, an unnecessary deviation from the published emergency procedures is a safety issue if it is done without knowing why the step was in the checklist or the potential consequences of the variation.
3. A loss of cabin pressure is one of the few in-flight conditions that require an immediate, memorised response by pilots. The usual training for this event is a simulated rapid decompression while at cruise altitude. Pilots frequently practise this exercise so the memorised actions counter the surprise and workload of an actual emergency, which could otherwise lead to their making errors. However, this incident differed from the practised scenario because the loss of cabin pressure occurred when the aeroplane was already in a normal descent. It was conceivable that the different circumstances interfered with the pilots’ recall and performance of the memorised actions.
4. Both pilots fitted their oxygen masks immediately after they recognised the loss of cabin pressure. However, their actions varied from the published procedures in the following areas:
   • no cabin announcement was made to warn the cabin crew of the emergency descent
   • the flight deck ‘passenger oxygen’ switch was not selected on
   • the subsequent checklist reviews were not conducted out loud.
5. The pilot flying said that he did not warn the cabin crew of the more rapid descent because the aeroplane was already descending and he had heard the automatic passenger announcement to fit oxygen masks. He concluded that the cabin crew would have realised it was a real emergency. Although the operator concurred with that reasoning, the cabin crew would have had no doubt if the pilot had made the required announcement.
6. The pilot monitoring said he did not turn on the passenger oxygen switch because the light associated with the switch was already illuminated and the automatic passenger announcement was playing, both of which indicated that the masks had deployed. However, there is some risk involved when pilots make their own decisions as to the necessity of a step in an emergency checklist. Oxygen is not generated until a deployed mask is pulled down, so not selecting the flight deck switch did not prevent the supply of oxygen. However, Boeing advised that the flight deck switch is a back-up to the cabin pressure switch that signals the masks to deploy, and it should therefore be selected on. The operator passed that advice to its pilots.
7. When reviewing the emergency checklists, the pilot monitoring did not read the steps out aloud as the operator’s procedures required, although the pilot flying was aware the review was taking place. A different crew made the same omission during a simulator review of the incident conducted for the investigation. The verbal review of a checklist is an important part of the emergency procedures because it is a cross-check that the correct actions have been performed completely. It gives pilots a shared understanding of the situation and any factors to be considered for the rest of the flight.
8. In this case the deviations were of a minor nature and did not affect the safe outcome. Nevertheless, the operator has, during annual training programmes for pilots, emphasised the importance of adhering to published checklists.
9. One of the pre-flight tasks of the pilot sitting in the right seat was to set the planned cruise altitude in the pressure control panel. In this case the pilots left the selected altitude for the flight to Auckland at 36,000 ft, which it had been on the flight to Wellington, and did not reset it to 37,000 ft. The right-seat pilot, who usually flew as a captain from the left seat, had met the operator’s minimum requirements for recent flying in the aeroplane from the right seat. The minor error in setting the cruise altitude could have been made by any pilot who regularly sat in the right seat. However, the operator’s investigation into the incident noted that the error might “indicate a need for a more formalised currency program for pilots with management and administrative responsibilities” (Air New Zealand Investigation Report 13/SI/16, p.21).
10. One of the pilots made a radio call to air traffic control to advise of the emergency descent. He did not begin the message with the words, ‘PAN, PAN, PAN’, which are internationally recognised to mean an aircraft faces an urgent situation. The Commission and other agencies have previously noted the omission of the recognised words by pilots making radio calls to advise of situations of urgency (or distress) (for example, Commission inquiries 06-009 (Boeing 767, ZK-NCK, engine fire, Auckland International Airport, 30 December 2006) and 10-003 (Cessna C208 Caravan ZK-TZR, engine fuel leak and forced landing, Nelson, 10 February 2010)). In an earlier effort to improve pilot compliance with this requirement the CAA had included education on urgency and distress calls in one of its annual pilot education programmes (this programme, called ‘Plane Talking’, was the basis of the 2012 AvKiwi annual education series). The operator used this incident in its 2014 recurrent training programme for pilots as an example of the importance of using urgency and distress calls when appropriate.
11. In view of the improvements made by the operator to pilot training, the Commission made no recommendation regarding any of the above issues.

Response in the cabin

1. The crew members of any pressurised aircraft must be acutely aware of the hazard of a loss of cabin pressure. The ‘time of useful consciousness’ remaining after pressurisation is lost or the oxygen supply is interrupted illustrates the seriousness of the hazard (see Appendix 3). The time available cannot be predicted accurately because it depends on the nature of the event and an individual’s physiology and level of exertion at the time. If a rapid depressurisation occurred at 25,000 ft, the time of useful consciousness could be as little as 90 seconds. However, cognitive performance could be impaired more quickly, in which case the affected person might be unable to recall or take the required actions. Therefore it is imperative that a mask be fitted as soon as possible and remain fitted until the wearer is instructed that it may be removed.
2. An incident in the United States in which a Boeing 737 lost cabin pressure as a result of a structural failure provides an example of the hazard. One of the flight attendants, who thought he could get a lot more done before having to put on a mask, lost consciousness and fell, suffering a fractured nose (NTSB report DCA11MA039, Southwest Airlines, Flight 812, Boeing 737-3H4, N632SW, Yuma Arizona, 1 April 2011). A passenger who was also not wearing a mask tried to help the attendant and also lost consciousness. Both regained consciousness during the descent.
3. On the incident flight to Auckland there was no prior indication, such as a perceptible cabin air pressure change or an announcement by a pilot, that the oxygen masks might deploy. Nevertheless, all passengers followed the standard instructions for fitting masks that are given before every flight. However, two cabin crew members delayed fitting masks. A delay in fitting a mask might lead to cognitive impairment that could endanger the individual and others.
4. The senior flight attendant, FA1, did not know why she had not sat down in the nearest available seat and fitted a mask, as the crew had been told to do. A possible reason was that the limited range of training scenarios had not required her to actually sit down in a passenger seat if necessary. She said that the green flow indicator was visible in the oxygen tubing and she had not felt any lightheadedness.
5. Later inspection showed that the oxygen generator at that position had not been activated. Therefore FA1 had not been supplied with oxygen. It was highly likely that she saw only the edge of the flow indicator, which may be slightly visible even when there is no flow (see Figure 4). The operator’s training for cabin crew had not demonstrated how the indicator becomes fully visible when oxygen is flowing. The operator has since revised its cabin crew training to describe and demonstrate the oxygen system more accurately.

1. Tests by the operator showed that improper packing of the oxygen mask was the likely reason for the generator at the front left door, where FA1 stood, failing to activate. Another test on a different Boeing 737 found some improperly packed passenger oxygen masks. Even though each row of seats had a spare mask, the improper packing or maintenance of equipment that is critical to life support is a potential safety issue on all aeroplane types. The operator reviewed the quality control of the maintenance of oxygen units across its fleets and deemed no further action was necessary. Therefore the Commission made no recommendation on this matter (Air New Zealand subsequently disposed of its Boeing 737 fleet in 2014).
2. When the cabin oxygen masks deployed FA2 continued to push the cart ‘uphill’ to the rear galley. One possible reason for her doing this was the subconscious association of the crew station with safety, because the cabin crew training demonstrations tended to occur at the crew stations rather than in the cabin aisles. This extra effort would have required additional oxygen and delayed her putting on a mask. The correct action would have been to apply the cart brakes, fit the nearest spare mask and, if possible, take a seat and remain seated. Four masks are available for each set of three passenger seats.
3. After the incident both of the rear galley oxygen units were found to have been activated. FA3, who was already in the rear galley, fitted a mask from the unit at the right rear door and had no concern for the oxygen flow. Therefore FA2 might have been mistaken (like FA1) in thinking she was not getting oxygen. Both flight attendants received oxygen from the unit at the left rear door.

Crew training and procedures

1. Crew members must be completely familiar with the emergency equipment installed for the passengers’ and their own safety. FA1’s incorrect interpretation of the oxygen mask flow indicator and FA2’s delay in putting on a mask suggested some unfamiliarity with the equipment and the actions to be taken for a pressurisation incident, which indicated a need to improve the cabin crew training programme and resources.
2. The operator submitted that depressurisation and the associated procedures and equipment were covered in detail during initial and recurrent training for crews. The training involved lectures, videos and practical exercises. However, the operator also submitted that the observed cabin crew procedural non-conformances might have been due to the artificiality of the training scenarios. To reduce the potential for lapses like those seen in this incident, the operator instituted monthly crew briefing questions and assessments of individual competency in the depressurisation drills during the annual line checks.
3. In view of the improvements made by the operator to cabin crew training, the Commission made no recommendation regarding any of the above issues.
4. The cabin crew responded appropriately to the toilet smoke alarms by treating them as genuine alarms. They were unable to silence the alarms in the normal way. Cabin crew are informed during their training that false smoke alarms can occur, but it was not generally known that a spike in the cabin pressure could cause a false alarm.

Cabin Altitude Warning checklist

1. Normally, when the pressurisation system is in automatic mode, the outflow valve opens upon landing to depressurise the cabin fully. After pilots have carried out the Cabin Altitude Warning checklist the pressurisation system will be in the manual mode. Unless the pilots open the outflow valve while in manual mode, the valve will remain closed on landing.
2. The Boeing manuals did not explain that the system configuration after performing the Cabin Altitude Warning checklist could allow the cabin to re-pressurise. The cabin doors were ‘plug’-type doors that moved inwards slightly before opening outwards. If there is any significant cabin pressure, a door cannot be physically opened. Therefore if the cabin is not fully depressurised on the ground, the doors will be difficult or impossible to open, and this would hinder an emergency evacuation if that were needed (for this reason the Ground Evacuation checklist requires pilots to open the aft outflow valve fully manually before giving the ‘Evacuate’ command). In this case the aeroplane was slightly pressurised after landing and the crew were initially unable to open the cabin door after the engine shutdown.
3. The operator said that the re-pressurisation scenario had not been anticipated before this incident, and therefore its Boeing 737 pilots had not been trained for it. The Cabin Altitude Warning checklist did not require pilots to ensure that the aeroplane was depressurised before landing. In contrast, the checklist for another condition for which manual mode is selected, ‘Unscheduled Pressurization Change’, had a ‘Deferred Item’ that called for the aft outflow valve to be opened manually before landing (a deferred item was an emergency checklist action that was performed at a later stage, typically during a routine checklist. In the example cited, the outflow valve would be opened manually prior to the usual Landing checklist).
4. Boeing later advised that it had added the Deferred Items of the ‘Unscheduled Pressurization Change’ checklist to the Cabin Altitude Warning checklist, to direct pilots controlling the aeroplane pressure manually to open the outflow valve upon landing. For this reason the Commission did not make a recommendation regarding the checklist content.

1. The cause of the loss of cabin pressure was not determined.
2. An intermittent defect within the air-conditioning and pressurisation system could not be excluded as the cause of the loss of cabin pressure.
3. The pilots did not follow exactly the emergency checklist actions, which increased the risk of an action being omitted or a required sequence of actions being altered.
4. The actions of some of the cabin crew during the incident showed that their emergency training had not sufficiently stressed the importance of sitting down and fitting a mask without delay, and had not allowed for a range of scenarios or adequately familiarised the crew with the oxygen equipment.

General

1. The Commission classifies safety actions by two types:

   (a) safety actions taken by the regulator or an operator to address safety issues identified by the Commission during an inquiry that would otherwise result in the Commission issuing a recommendation

   (b) safety actions taken by the regulator or an operator to address other safety issues that would not normally result in the Commission issuing a recommendation.

Safety actions addressing safety issues identified during an inquiry

1. The operator took action to improve crew performance in the following areas:
   • the declaration by pilots of an emergency (distress or urgency) situation
   • flight crew adherence to the published emergency checklists
   • cabin crew actions in response to a depressurisation.
2. The operator took action to improve the following aspects of training:
   • oxygen mask training with gas flow, and familiarity with chemical oxygen generators.
3. The operator reviewed the quality control of the packing of oxygen masks across its fleets and deemed that no further action was necessary.
4. On 2 June 2016 Boeing advised that it had added the Deferred Items of the ‘Unscheduled Pressurization Change’ checklist to the Cabin Altitude Warning checklist, to direct pilots controlling aeroplane pressure manually to open the outflow valve upon landing.

Safety actions addressing other safety issues

1. Nil.

General

1. The Commission may issue, or give notice of, recommendations to any person or organisation that it considers the most appropriate to address the identified safety issues, depending on whether these safety issues are applicable to a single operator only or to the wider transport sector. In this case, because of the safety actions taken by the operator and the key lessons identified, no recommendations have been issued.

1. The following lessons were identified during the inquiry into this occurrence:
   • an unexpected loss of cabin pressure in any aeroplane is a serious event that can cause both passengers and crew to lose consciousness rapidly from a lack of oxygen. In such an event the appropriate emergency actions must be undertaken immediately. Where oxygen masks are fitted, passengers and cabin crew must put on their masks and await further instruction from the flight crew
   • the purpose of emergency procedure checklists is to ensure that crew members do not miss an important action at a critical time of high workload. Therefore, unless the captain has an exceptional reason to deviate from a checklist, it should be performed from beginning to end, if possible without interruption, and without omitting any step

   • crew members must be thoroughly trained in and familiar with all emergency equipment and procedures, because the equipment and procedures are for their own protection as well as that of the passengers. They need to be alert for emergency situations that differ from the standard scenarios that are practised and demonstrated repeatedly

   • an aircraft door will be very difficult to open on the ground while the cabin is still pressurised, and this can delay an evacuation if it is called for. When pilots have been controlling the cabin pressure manually, they must ensure that the cabin is fully depressurised to allow the doors to be opened

   • special care must be taken with the maintenance of aircraft emergency equipment, such as oxygen systems.

FAA. (2013). Advisory Circular 61-107B, Aircraft operations at altitudes above 25,000 feet mean sea level or Mach numbers greater than .75. Washington, D.C.: Federal Aviation Administration.

Pressurisation system

1. Bleed air for the cabin air conditioning and pressurisation is supplied from the fifth or ninth compressor stage of the engines (see Figure 3) (the technical information is from the Boeing 737-300/400/500 airplane maintenance manual (revision 77)). The pressure at the fifth stage is adequate except when the engine is at idle or a low thrust setting, in which case the ninth (‘high’) stage valve automatically opens to supply the air. The pressure of the bleed air from each engine is indicated on the flight deck overhead panel. If the bleed air temperature or pressure is excessive, a shut-off valve closes and this is indicated to the pilots.
2. Aeroplane pressurisation control includes the pressurisation control system, pressure relief valves and the indication and warning system. The pressurisation control system is electrically operated and electronically controlled, and comprises a control panel, two digital pressure controllers and the aft outflow valve (see Figure 5).
3. The forward outflow valve shown in Figure 5 is part of the cargo heating system, but the pressure control panel (in automatic or manual mode) signals the valve to close when the aft outflow valve is almost fully closed. This prevents the forward outflow valve adversely affecting the cabin pressure.
4. The pressure control panel, located on the flight deck overhead panel, allows the pilots to select the system mode, enter the flight and landing altitudes, and control the aft outflow valve manually (see Figure 6). System status annunciators (an annunciator is a light that provides information on the state of a system or component), including the cabin altitude warning, are located on the forward and overhead instrument panels. Adjacent to the pressure control panel are a combined cabin altitude and differential pressure gauge and a cabin rate-of-climb gauge.
5. The pressurisation control system has three modes of operation, selected on the control panel:
   • automatic (AUTO) – the normal mode. This requires only that the pilots enter the flight and landing altitudes into the control panel before take-off, and have the correct barometric pressure set for landing
   • alternate – a redundant automatic mode. This mode takes over if the AUTO mode fails
   • manual – for when the AUTO and alternate modes fail. The position of the aft outflow valve is controlled directly by the pilots using a switch on the control panel.

1. Two identical digital pressure controllers located in the underfloor equipment compartment sense the cabin pressure. Interfaces with other aeroplane systems enable the controllers to determine the flight phase. When the system is in automatic mode, one controller is operating and in command of the outflow valve position. The other is on standby, but monitoring the system and mimicking the controller in command. The pressure controllers determine the lowest possible cabin altitude that can be maintained during the flight and create a corresponding schedule of pressure change. The operative controller sends signals to the aft outflow valve to adjust its exhaust area to maintain the schedule.
2. The pressure controllers also limit the rate of change of cabin pressure when climbing and descending, and limit the differential pressure (differential pressure is the difference between the cabin pressure and the outside air pressure. When the cabin is pressurised, the differential pressure is positive. Excessive differential pressure can lead to structural damage). If the pressure controller’s internal limit for differential pressure is exceeded, one or both independent safety relief valves open and prevent the differential exceeding 8.5 psi (the maximum differential pressure for flights above 28,000 ft is 7.8 psi. At lower altitudes it is 7.45 psi). The safety relief valves close when the differential pressure returns to the allowable range. A negative relief valve is also installed to prevent the atmospheric pressure exceeding the cabin pressure.
3. If the cabin altitude exceeds 10,000 ft, an aural warning sounds in the flight deck and a red CABIN ALT (altitude) annunciator illuminates on the forward instrument panel. If the system is in automatic mode, separate pressure sensors on the electric actuators of the aft outflow valve command the valve to close when the cabin altitude exceeds 14,500 ft.
4. When the pressurisation system is in automatic mode, the aft outflow valve is commanded to open after landing so that the cabin pressure equalises with that outside.

Oxygen system

1. Supplemental gaseous oxygen is provided for the pilots.
2. A unit above each row of three seats contains one chemical oxygen generator and four masks. Above each set of cabin crew seats and in each toilet there is one generator with two masks. All units open automatically and deploy the masks if an altitude sensor that is independent of the pressurisation system detects the cabin altitude to be above 14,000 ft, or if the passenger oxygen switch on the flight deck is selected on.
3. Deployed oxygen masks hang approximately 18 centimetres below the service units and each must be pulled down to reach the face of a sitting person. Pulling down any mask releases a safety pin from the associated generator and starts the chemical reaction to produce oxygen. Unwanted reaction products are filtered from the gas that flows to all of the attached masks. When oxygen is flowing a green indicator should be clearly visible in the transparent supply tubing.
4. The operator’s Cabin Safety Manual noted that the chemical reaction produced significant local heat and a ‘hot’ smell. A heat-sensitive tape on the casing of each generator discolours if the generator has activated.

Toilet smoke alarms

5. The toilet smoke detectors were of the ionising type in which a weak radioactive source ionises the air and produces a small electrical current. Smoke particles entering the detector interrupt the current, which sets off the alarm.
6. Newer models of the Boeing 737 use photo-electric detectors that are not affected by pressure spikes, and are better suited to detecting a smouldering fire, which is more typical of a toilet fire.

Post-incident fault finding

7. The manufacturer of the digital pressure controllers (Nord-Micro, in Germany) retrieved the data stored in the controllers. The controllers had no internal faults and had operated correctly in automatic mode. Approximately 90 seconds prior to the cabin altitude warning, when the aeroplane was descending through 34,000 ft, the pressure controller that was in control recorded an ‘inflow/leakage fail’ status. That meant that there was a low inflow of air or an excessive air leakage, or perhaps both conditions. The controller correctly signalled the outflow valve to close to stop any further decrease in the cabin pressure. The cabin altitude exceeded 14,300 ft when the aeroplane was descending through 26,700 ft flight altitude, but the maximum cabin altitude (which would allow the minimum cabin pressure to be determined) was not recorded.
8. The following fault finding was accomplished for the Commission’s inquiry or by the operator:
   • satisfactory tests of both pressure controllers before their removal from the aeroplane
   • replacement of both pressure controllers
   • analysis of data stored in the removed pressure controllers
   • visual inspection of the fuselage, wheel wells, cargo compartments, bulkheads and all openings, for structural defects
   • a worn cabin entry door seal was replaced as a precaution
   • downloads of the cockpit voice recorder, digital flight recorder and quick-access recorder
   • satisfactory check of pitot-static plumbing (the pilot-static system involves dynamic and static air pressures, which are inputs to the pressure controllers).
   • check of relevant electrical wiring
   • replacement of the flight deck pressurisation system control panel
   • replacement of the aft and forward outflow valves
   • replacement of the two safety relief valves
   • examination of the removed safety relief valves and the aft outflow valve by their manufacturers
   • satisfactory check of the engines’ bleed air output pressure
   • satisfactory check of the packs’ output
   • satisfactory ‘leak-down’ check of fuselage pressure retention
   • a review of the maintenance history for this aeroplane and the operator’s Boeing 737 fleet
   • additional checks and component replacements as suggested by Boeing
   • inspection of the packing and function of passenger and crew oxygen masks, and replacement of the oxygen generators
   • satisfactory verification flight prior to release to service.

Time of useful consciousness (TUC)

This is the period of time from interruption of the oxygen supply, or exposure to an oxygen-poor environment, to the time when an individual is no longer capable of taking proper corrective and protective action (this appendix is sourced from the Federal Aviation Administration Advisory Circular 61-107B, Aircraft operations at altitudes above 25,000 feet mean sea level or Mach numbers greater than .75, 29 March 2013. The circular uses the similar term ‘decompression’ rather than depressurisation). The faster the rate of ascent, the worse the impairment and the faster it happens. TUC also decreases with increasing altitude. The table below shows the trend of TUC as a function of altitude. However, a slow depressurisation is as dangerous as or more dangerous than a rapid depressurisation. By its nature, a rapid depressurisation commands attention. In contrast, a slow depressurisation may go unnoticed and the resultant hypoxia (hypoxia is a condition of inadequate oxygen saturation in the blood and tissues) may be unrecognised.

TIMES OF USEFUL CONSCIOUSNESS VERSUS ALTITUDE