On 12 July 2018, a Boeing Company 737-8FE, VH-VUB, operated by Tiger Airways Australia (Tiger) was being prepared for its flight from Sydney, New South Wales to Melbourne, Victoria. For this flight, a trainee First Officer was the pilot flying (PF) and a training Captain was the pilot monitoring (PM).^[1]

The pilots switched off both air conditioning packs in accordance with the standard operating procedure (SOP) for starting the engines. The before taxi procedure followed engine start and although it included selecting the air conditioning packs to AUTO, the air conditioning packs remained OFF.

The aircraft took off at about 1136 Eastern Standard Time (EST).^[2] After flap retraction at approximately 1137, the crew completed the final component of the take-off procedure, followed by the after take-off checklist. At about the same time, air traffic control (ATC) issued several instructions to the crew. The take-off procedure and after take-off checklist both included a requirement to check the position of the air conditioning packs switches. However, during both the procedure and the checklist, the packs were not identified as being OFF.

At about 1142, while the aircraft was still climbing and passing 13,500 ft, the cabin altitude warning horn sounded. The First Officer identified that both air conditioning packs switches were in the OFF position. Both packs were then immediately switched to AUTO. The Captain took over control of the aircraft and selected altitude hold on the autopilot. The aircraft reached a maximum height of 14,900 ft (at about 1144), whereby the Captain disengaged the autopilot and commenced a descent to 10,000 ft. The warning ceased at about 1146. During this time, both pilots donned oxygen masks in accordance with the cabin altitude warning procedure.

Once level at 10,000 ft, the crew completed the remainder of the cabin altitude warning checklist. As the cabin pressure was now under control and operations were normal, the crew continued the flight to Melbourne.

__________

1. Pilot Flying (PF) and Pilot Monitoring (PM): procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances; such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and the aircraft’s flight path.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) +11 hours.

Pilot information

Captain

The Captain had been operating at Tiger since 2012, having joined as a direct entry Captain on the Airbus A320. He had previous experience as an airline training captain on Fokker F50, Fokker F28 and Airbus A320, a role he subsequently undertook at Tiger. In 2016, he transitioned to the Boeing 737 as part of Tiger’s introduction of the aircraft. The Boeing 737 type rating was completed in October 2016. The Captain completed Tiger line training in January 2017 and commenced instructional duties on type in March 2017.

The Captain’s previous experience included Fokker F50, Fokker F28, Airbus A319/320, Boeing 767 and varied operations including charter and instructional flying. The Captain reported that he had a total 21,511 hours with 949 hours on the Boeing 737. Command time on the Boeing 737 was 946 hours.

The Captain’s last line check was in February 2018 with no major concerns noted.

First Officer

The First Officer was an experienced pilot having been a captain on other types including Boeing 777 and 767. His operational experience included charter, regional, domestic and international flying. Returning to Australia in 2015, he did not fly for two years prior to joining Tiger in 2017.

The First Officer completed the Boeing 737 type rating in June 2017. The Tiger operational conversion course was completed in September 2017. Line training commenced in March 2018 and the occurrence flight was his 12th line training event.

Tiger reported that the First Officer had a total of 18,300 hours of which 14,400 hours was in command of various types. Twenty seven hours were on the Boeing 737.

The First Officer undertook five transition simulator sessions between 31 March 2018 and 7 April 2018. Actual flying training commenced 22 June 2018.

As part of line training, Tiger required the presence of a safety pilot. The safety pilot was to observe the overall operation of the aircraft and ensure that the training captain was aware of any divergence from standard operating procedure (SOP) and any potentially unsafe conditions. This First Officer required a minimum eight sectors to be flown with a safety pilot.

The First Officer had flown the required eight sectors, including two as pilot flying (PF). He had also demonstrated the additional requirements of being able to recall abnormal/emergency memory items and was deemed proficient in the procedure for crew incapacitation. The First Officer was cleared of the requirement for a safety pilot on 7 July 2018.

As the First Officer was yet to be checked to line, further supervision of the First Officer was reliant on the assigned training captain. A training captain was responsible as both the pilot in command and as the instructor and assessor of the trainee.

In the flights following removal of the safety pilot requirement, the First Officer’s training records indicated satisfactory performance. The First Officer had flown with the same Captain on three previous occasions (5, 9 and 11 July 2018) and there was no reason to consider a reintroduction of a safety pilot. There were no issues relating specifically to the before taxi procedures and his pre-flight preparation was recorded as consistently improving.

The Captain reported being satisfied with the First Officer’s performance and held a reasonable level of confidence in his progress potential on the Boeing 737.

Aircraft information

Pressurisation system

Cabin pressurisation is essential to providing a safe and comfortable environment for aircraft occupants flying at high altitude. In an unpressurised cabin at high altitude, aircraft occupants are exposed to the possibility of hypoxia,^[3] which can lead to loss of consciousness and possible loss of life.

Cabin pressurisation utilises air bled from the engines, which is distributed throughout the cabin via two air conditioning packs. A cabin pressurisation controller modulates the cabin pressure via an outflow valve. The controller is normally set to AUTO and it operates independently of the air conditioning packs attempting to modulate cabin pressure regardless of the pack switch setting. Normal operation is for both packs switches to be in AUTO. If the packs are OFF, the outflow valve will drive closed to prevent the escape of cabin air. However, without bleed air via the air conditioning packs, there will be insufficient air to pressurise the aircraft.

The cabin pressurisation controller normally controls the cabin altitude rate of climb as well as the cabin altitude up to a cabin altitude (equivalent) of 8,000 ft at the maximum certified aircraft ceiling of 41,000 ft. The system has both an aural and visual warning for cabin altitude rising above 10,000 ft. Above 10,000 ft, flight crew are required to use supplementary oxygen. The system will also automatically deploy passenger oxygen masks once the cabin altitude rises above 14,000 ft.

The system has a number of other cautions to alert the crew to a malfunction, but there is no warning or caution to alert the flight crew if air conditioning packs are OFF.

Pressurisation system controls

Air conditioning, pressurisation controls and cabin pressure indications are located at the right hand side of the forward overhead panel in the flight deck. The controls use toggle type switches with placards to indicate position. Analogue gauges indicate bleed air duct pressure, cabin altitude, cabin rate of climb and differential pressure.^[4] Digital displays are used to set cruise altitude and destination landing altitude (required for control of cabin pressurisation).

Visibility and accessibility of the controls and cabin pressure indications is most convenient for the right hand seat crew member (First Officer) as the panel is above their seat. The left hand seat crew member (Captain) may have to move in order to adequately view them and avoid any parallax error^[5]. Some placards indicating position are obscured by the switches when viewed from the left hand seat. Figure 1 shows the view that the Captain may have had from the left hand seat.

Figure 1: View of air conditioning packs switches from the Captain’s side

Source: Tiger Airways Australia, annotated by ATSB.

Figure 2: Close-up view of air conditioning pack switches

Source: Tiger Airways Australia, annotated by ATSB.

Aircraft serviceability

The aircraft did not have any technical issues related to the pressurisation system.

Recorded data

The ATSB retrieved data from both the flight data recorder (FDR) and the quick access recorder (QAR). Only the FDR required analysis, which identified:

• Both engine bleed switches were ON from take-off (departure) until time of warning.
• Both air conditioning packs were OFF from time of take-off (departure) until after warning presented.

The data does not record the highest cabin altitude reached. However, considering that the cabin oxygen masks did not deploy, it is unlikely to have exceeded 14,000 ft. There was nil evidence to suggest settings or events that could have affected the aircraft pressurisation, other than the air conditioning pack switches being OFF.

Operating procedures

The Tiger Boeing 737 Flight crew operating manual (FCOM) contained the expanded normal procedures, which were divided according to the phase of flight with separate duties for each crew member. Since the procedures were conducted by memory, a normal checklist was used to verify that critical items within the procedures had been completed. The checklist contained the minimum items needed to operate the aeroplane safely.

Irrespective of who read or responded to each checklist item, both pilots were required to visually verify the switch associated with each item was in the required configuration or that a step had been done.

Pre-flight and engine start procedures

As part of the pre-flight procedure, the air conditioning packs were required to be switched to AUTO or HIGH. The cabin pressurisation panel was also configured at this stage with the cruise altitude and destination altitude set. The pressurisation mode selector is set to AUTO for normal operation. This formed part of the First Officer’s pre-flight procedure and was completed correctly.

In accordance with the engine start procedure, the First Officer turned OFF the air conditioning pack switches. This was the only component of the pressurisation system that requires turning OFF during engine start.

Before taxi procedure

The before taxi procedure was designed to ensure that the aircraft condition and flight deck configuration is correct prior to taxiing for the departure runway. The procedure commenced upon completion of engine start. During the procedure, the air conditioning pack switches were reset to AUTO, a task allocated to the First Officer as per the FCOM procedure (Appendix A, Figure A1). Upon completion of the procedure, the Captain was required to call for the before taxi checklist. The pack switches were not included in the before taxi checklist (Appendix B, Figure B1).

At about the same time as the commencement of the procedure, the Captain recalled that they discussed the method of confirming the ground crew had removed the steering bypass pin. The discussion was in reference to differences between the ground and flight manuals, and that the ground crew expect a certain procedure for confirmation that crew have acknowledged removal of the steering bypass pin. The crew did not recall any other possible distractions or disruptions to the before taxi procedure.

By take-off, the First Officer had not reset the pack switches to AUTO. The crew did not notice the incorrect configuration and packs switches remained OFF.

Take-off procedure

The take-off procedure (shown at Appendix A, Figure A2) included a step for the pilot monitoring (PM) to set or verify that engine bleeds and air conditioning packs were operating. The FCOM did not explain what set or verify meant, however, Tiger training pilots reported that this should be achieved by visually identifying that the switches were in the correct position and viewing the cabin altitude and differential gauges to ensure they were giving expected readings. Following completion of the procedure, the after take-off checklist (shown at Appendix B Figure B1) is required to be called. This checklist included confirmation steps for both the engine bleeds and air conditioning packs.

Appendix A, Figure A2 states that this final part of the procedure is to take place after flap retraction is complete, which in this case was about 1138.^[6] At 1139, air traffic control (ATC) issued the aircraft several instructions, cancelling the SID, directing a turn to 150° and a climb to Flight Level 280 (FL280). At 1140, ATC cleared the aircraft to track direct to Wollongong.

Also during this timeframe, the Captain recalled that he rushed the after take-off checklist in order to discuss the mitigation of traffic threat associated with the noise abatement departure procedure (NADP) being flown, specifically with regard to the high rate of climb induced by the NADP and their initial altitude restriction of 5,000 ft.^[7] The Captain recalled looking at the pack switches and the cabin altitude and differential gauges, but remembered the gauge readings being as expected and did not identify that the pack switches were OFF.

While the PM was required to read and respond to the checklist, both pilots were required to verify each item of the checklist. The First Officer (PF) explained that his workload in flying the aircraft during the busy departure prevented him from checking pressurisation, as would normally be his habit.

Climb procedure

The FCOM climb procedure did not include pressurisation checks. The last formal check was during the after take-off checklist. Boeing reported that following the after take-off checklist, their recommended checks did not include a formal check of pressurisation or aircraft warnings associated with incorrect configuration of the pressurisation system until the cabin altitude warning was triggered at 10,000 ft cabin altitude. If the cabin altitude warning was triggered, the crew were required to conduct the associated immediate action checklist to mitigate the safety risk.

Tiger training captains reported that informal periodic checks of the pressurisation are taught during operational conversion course and line training. Checks included visually identifying switch positions and expected gauge indications based on FCOM guidance for the differential pressure limits at various altitudes. In this case, the Captain specifically mentioned noting that the differential was where he expected it to be based on current situation and previous flights, explaining his habit up until then was to look early in climb for expected readings.

Related occurrences

The following occurrences involving Boeing 737s are recorded in the ATSB database.

ATSB Occurrence 200402855

While on climb, the crew noticed that the pressurisation system was not operating. The aircraft was descended and returned to Melbourne for a landing. The air conditioning packs had not been turned on after engine start.

ATSB Occurrence 200506419

As the aircraft climbed through FL130, the cabin altitude warning horn activated indicating that the cabin altitude was at 10,000 ft. The crew obtained clearance to descend to 9,000 ft. The crew then noticed that the pressurisation mode selector was in manual and selected it to auto. The flight continued normally.

ATSB Occurrence 201104003

During climb, the cabin depressurised and the passenger oxygen masks deployed. The aircraft descended to 10,000 ft and returned to Sydney. Engineering investigation revealed the cause to be incorrect switching of the pressurisation system.

Other occurrences

There are several similar occurrences involving Boeing 737s overseas that departed with an incorrectly configured pressurisation system. In most cases, the error was detected following system warnings with the exception being the Helios Airways accident in 2005. Helios Airways flight HCY522, a Boeing 737-31S departed Larnaca, Cyprus for Prague, Czech Republic. Cabin pressurisation control was in the manual setting for departure and not identified by the crew through procedures or checklists. Whilst the crew heard the cabin altitude warning horn, they believed it to be the take-off configuration warning and commenced trouble shooting for that. Subsequently, the crew succumbed to hypoxia and the aircraft continued the flight on autopilot until it exhausted its fuel supply and crashed, killing all on board.

Whilst being similar in that an incorrect configuration was not identified through multiple procedures and checklists, the crew of Flight TT229 (this occurrence), like those of the other Australian occurrences documented above, did not confuse the cabin altitude warning, quickly identified the issue and corrected it without delay.

__________

3. Hypoxia: a deprivation of oxygen to the body at the tissue level.
4. Differential pressure: the difference in pressure between inside and outside the aircraft cabin. The flight crew operating manual had differential pressure limits based upon selected cruise flight level.
5. Parallax error: an error due to the difference in the apparent position of an object based upon different viewing angles.
6. Flight data at Appendix C, Figure C2 shows flaps in UP position by 1138.
7. The aircraft was initially directed to maintain 5,000 ft shortly after take-off at about 1136, then at 1139, directed to climb to 28,000 ft.

Incorrect configuration

Incorrectly configured air conditioning packs (OFF instead of AUTO) resulted in the cabin altitude rising above 10,000 ft, triggering the cabin altitude warning. There were no technical or performance reasons for the packs to be OFF and once returned to the AUTO selection, the cabin pressurisation returned to normal. Flight data recorder data, supported by crew interviews, confirms that the packs switches being OFF was the only reason for the cabin altitude warning.

Procedure and checklist management

Before Taxi Procedure

The First Officer did not turn the packs to AUTO during the before taxi procedure. This was contrary to the FCOM procedure but there was no evidence to suggest other deviations took place. The Captain did not notice this error.

The First Officer had significant experience on other aircraft types and his training records at Tiger did not show that an error of this type had occurred previously. The lengthy break in flying roles and significant gaps in the training program may not have allowed the First Officer sufficient time to consolidate the procedures to an intuitive level that was resilient to error. Acquired skills decay over time and consistent rehearsal and application are essential for long-term retention. Despite this, the First Officer had demonstrated satisfactory performance thus far in his training, having been assessed as no longer requiring a safety pilot.

The Captain’s discussion of the ground disconnect requirements may have served as a distraction for the First Officer. The Captain could not recall exactly when this discussion occurred, but the procedure position was approximately the same time as the First Officer’s required actions to reconfigure the pack switches following engine start. Distraction can interrupt the procedural sequence. As the before taxi procedure was conducted from memory, pilots were required to remember at what point the interruption occurred in order to recommence the sequence. This may lead to further error if there is not a conscious recognition of that distraction and interruption.

The ATSB noted that the before taxi checklist did not include checks for the correct configuration of pack switches. However, the Boeing 737 has supplementary procedures for a no engine bleed or unpressurised take-off, which required the crew to reconfigure the air bleeds and packs after take-off.  If this was missed or done incorrectly, then the after take-off checklist was designed to capture the error.  According to Boeing, the after take-off checklist is also in place to catch a bleed/pack configuration error made during the before taxi procedure. Consequently, absence of this step in the before taxi checklist was not considered as being contributory.

The ATSB also considered whether the First Officer’s previous experience as a captain, and the recent experience of the crew having flown together contributed to a relaxed level of supervision by the Training Captain. The Captain and First Officer had flown together on three occasions in the previous week. The Captain was well aware of the First Officer’s flying experience and had been satisfied with his previous performance such that he had a reasonable level of confidence in First Officer. The Captain explained that the First Officer had got it right before and that he (Captain) may have relaxed his supervision of the First Officer thus contributing to him not identifying the error at this time. Although a highly experienced pilot, the First Officer was still a trainee on the Boeing 737 and as such, required vigilant supervision of a training captain. This is a crucial defence against error by a trainee pilot.

The combination of relative inexperience, disjointed training, distraction and lapses in supervision appear to have contributed to the omission of the pack switches step during the before taxi procedure.

After Take-off Checklist

The take-off is a high workload phase of flight and Sydney is known to be a busy airport to operate from. The procedures to ensure that the air conditioning packs were correctly configured placed significant reliance on the after take-off checklist to achieve this. The high workload experienced by the crew included the procedural actions required by the departure flown and the training being undertaken. This workload was increased by the operational discussions that took place which appeared to have distracted the crew from correctly completing the procedure and subsequent checklist.

Whilst the Captain reported that he did look at the gauges and switches, he is likely to have had a low level of expectancy of error with regard to the pack switches. His confidence in the First Officer’s performance during training and not knowing the First Officer to have made that same mistake before is likely to have caused him to not perceive the error, despite looking at the switches. This would have been exacerbated by rushing the checklist as he reported.

In this case, the pressurisation controller was correctly set and functioned normally by closing the outflow valve to prevent the escape of cabin air. This likely resulted in a natural lag in cabin altitude rising since the controller closed the outflow valve to prevent the escape of cabin air, but additional air via the air conditioning packs was not available to pressurise the aircraft. The Captain specifically mentioned that when he looked at the gauges, the cabin differential and altitude were as expected. Considering the timing of the check (early stage of climb) and the gauges reading as expected, this probably indicated to him that the pressurisation system was correctly operating and gave him no reason to believe that the pack switches were OFF.

The investigation also considered the effect of viewing the air conditioning and pressurisation panels from the left seat. In this case, the Captain may not have moved enough, or at all, to allow a complete view of all gauges and switches, especially given he described rushing the checklist. It is likely that his low expectation of error was reinforced by the cabin differential and altitude appearing to be as expected.

Workload management and disruption also affected the First Officer’s ability to accurately conduct the checklist while flying the aircraft, especially considering the operational discussion that took place during that time. The operational requirements of ATC are considered normal but in light of the induced additional workload due to discussion and distraction, the First Officer did not check pressurisation as would normally occur.

From the evidence available, the following findings are made with respect to the incorrect configuration of a Boeing Company 737-8FE, registered VH-VUB, that occurred near Sydney, New South Wales on 12 July 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The aircraft did not pressurise due to an incorrectly configured pressurisation system.
• The incorrect configuration was the result of procedures and checklists not being managed appropriately.

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Action taken by Tiger Airways Australia

Tiger Airways Australia (Tiger) advised the ATSB of the following safety actions taken as a result of this occurrence:

• Tiger issued a flight crew notification to flight crew highlighting the need to adhere strictly to standard operating procedure (SOP). The notification explained that on some occasions, the checklist was completed but there had not been conscious verification of the action taken. Tiger reminded flight crew that when conducting checklists, to be mindful to challenge—verify—respond and that verification is to be a very deliberate act undertaken by both the Pilot Flying and Pilot Monitoring.
• A summary of Tiger’s internal investigation was included in a quarterly safety publication.
• Tiger’s flight standards team is undertaking a review of the Boeing 737 checklist and if additional checks of the pressurisation system is required.
• Tiger’s flight training team is undertaking a review of safety pilot requirements.
• The Head of Flight Operations and Head of Safety and Security conducted a road show to present the importance of SOPs and checklist discipline.
• Tiger introduced a flight operations safety assurance program to undertake flight deck observations to identify potential adverse trends in procedural compliance. Tiger advised only minor observations were noted.
• Tiger established a program with Virgin Australia to conduct line training for Boeing 737 pilots in order to ensure crew have continuous training required to embed skills and knowledge.
• Tiger have introduced additional pressurisation event training.

Sources of information

The sources of information during the investigation included:

• Flight crew of VH-VUB
• Flight data recorder from VH-VUB
• Tiger Airways Australia (Tiger)
• Boeing
• Airservices Australia.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the flight crew, Tiger Airways, Boeing, and the Civil Aviation Safety Authority.

Submissions were received from the flight crew, Tiger Airways and Boeing. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Appendix A – B737 FCOM Normal Procedures – Amplified Procedures

Figure A1: Before Taxi Procedure extract

Source: Tiger Airways 737 FCOM

Figure A2: Take-off Procedure extract

Source: Tiger Airways 737 FCOM

Appendix B – B737 Normal Checklist

Figure B1: Before Taxi and After Take-off Checklists

Source: Tiger Airways QRH

Appendix C – Recorded data from the incident flight 12 July 2018

Figure C1: Flight data – Cabin Altitude > 10,000 ft Warning

Source: ATSB

Figure C2: Flight data – Air conditioning pack switch position

Source: ATSB