Aviation Investigation Report A00P0101

WestJet Flight 35, a Boeing 737-200, serial number 20196, was en route from Calgary, Alberta, to Abbotsford, British Columbia, at about 1740 mountain daylight time. The aircraft climbed to the planned cruise altitude of flight level 310, at which time the auxiliary power unit was shut down. Within minutes, there was a loss of cabin pressurization. The aircraft descended and diverted to Kelowna, British Columbia. The passenger oxygen masks automatically deployed when the cabin altitude reached 14 000 feet above sea level. The cabin altitude subsequently reached about 24 000 feet above sea level before pressurization was re-initiated. The aircraft landed in Kelowna, without further incident, so the oxygen system could be serviced. No injuries were reported.

The mechanical condition of the aircraft was not a factor in this occurrence. Maintenance action was carried out at Kelowna to restow the passenger oxygen masks and replenish the oxygen bottles, as required, before the flight continued. The weather conditions at Calgary, Kelowna, and along the route were good.

The captain held a valid Canadian airline transport pilot licence - aeroplane (ATPL-A), endorsed with a Boeing 737 rating. He had about 17 500 hours' total flight time, including 1500 hours on Boeing 737 aircraft, of which 800 hours were as captain. In the previous 90 days, the pilot had logged about 180 hours' flight time. The day of the occurrence was the pilot's first day of work after 11 days off.

The first officer held a valid Canadian ATPL-A, endorsed with a Boeing 737 rating. He had about 16 000 hours' total flight time, including 200 hours on Boeing 737 aircraft. In the previous 90 days, the first officer had logged about 180 hours' flight time. In the previous 24 hours, he had recorded 11.7 hours' duty time.

WestJet Flight 35 departed Calgary at 1721 mountain daylight time^{Footnote 1} and levelled off at the cruise altitude of flight level 310 about 17 minutes later. The ambient conditions at Calgary, in combination with the aircraft weight, required the take-off to be carried out with the engine bleeds off. This procedure involves closing the engine compressor bleed valves to make sufficient engine power available for a single-engine climb should a loss of power from one engine occur. Normally, some of the engine power (via bleed air) is used for cabin pressurization and air conditioning.

When a "bleeds-off take-off" is conducted, the auxiliary power unit (APU) may be (and was) used to provide the initial cabin pressurization and air conditioning functions, limited to 17 000 feet and below. Conducting a bleeds-off take-off is an exception. Although the operator's normal Before Start and Before Take-off checklists presented opportunities for the crew to brief on the use of this procedure, there is no specific method in the sequence of normal checklists to alert the crew that a non-routine procedure is being applied. The importance of checklist items is evident in the operator's flight operations manual (FOM), which states: "Normal checklists contain only items that, if omitted, would have a direct and adverse impact on normal operations." The operator's FOM contains a supplementary checklist that prescribes the procedure to be followed for a bleeds-off take-off.

Shortly after the take-off, the After Take-off checklist was initiated. In accordance with the operator's standard operating procedures (SOPs), once airborne (with certain exceptions) checklists are to be completed unilaterally by the pilot not flying (PNF). A geographic flow method is accomplished through memory by calling the items aloud as they are actioned. The hard-copy checklist is then read silently to confirm that all items have been completed. After completing all items, the PNF will advise the pilot flying (PF) that the applicable checklist is complete. This checklist included the following two items:

Air Conditioning and Pressurization - Set

APU - As Required

During this procedure, the cabin pressurization was checked and confirmed to be normal. However, during the departure, the check was interrupted when air traffic control modified the aircraft's departure clearance because of conflicting traffic. Even though the After Take-off checklist item of setting the air conditioning and pressurization is only a few words, it signifies a procedure that requires several steps to complete. After the interruption, the pressurization equipment was not reconfigured for normal flight (the engine bleeds were not turned on), and the APU was not unloaded or shut down.

The Normal Procedures section of the operator's Boeing 737-200 FOM prescribes a memory check that is conducted independently by the PNF on climbing through 10 000 feet. The following direction is included:

If the APU is still running at 10,000 ft, confirm Air Conditioning Panel and Electronics correctly configured and shut down APU.

These items were not accomplished. Upon reaching the cruise altitude of flight level 310, another memory check, conducted by the PNF, is prescribed. At this time, the APU was observed to be running and, without a determination as to why it was still running, it was shut down. Within two minutes, the cabin altitude warning horn sounded, indicating that the cabin altitude had exceeded 10 000 feet. The cabin altitude rate-of-climb indicator showed a climb of about 1000 feet per minute, and the "auto fail" light on the pneumatics panel was illuminated. The pressurization mode selector was then switched to the "standby" position and the Auto Fail or Unscheduled Pressurization Change checklist was consulted. The operator's Boeing 737 FOM contains two different checklists regarding pressurization: the Auto Fail or Unscheduled Pressurization Change checklist and the emergency quick reference checklist Cabin Altitude Warning / Rapid Depressurization.

The PF donned his oxygen mask, requested an air traffic control clearance to a lower altitude, and commenced a descent. When queried by air traffic control as to whether there was a problem, the crew indicated that they required a lower altitude but did not declare an emergency. When the cabin altitude reached 14 000 feet, the passenger oxygen masks deployed automatically. Completion of the Auto Fail or Unscheduled Pressurization Change checklist had not controlled the loss of pressurization, and the PNF donned his oxygen mask. A company deadheading captain on board was asked to assist. When he arrived on the flight deck, the aircraft and cabin altitudes were both at 24 000 feet. It was immediately discovered that the engine bleeds were not configured for flight.

The Cabin Altitude Warning / Rapid Depressurization checklist was then consulted. Completion of this checklist, which included turning the engine bleed switches on, was successful in regaining cabin pressurization. A readout of data retrieved from the flight data recorder indicates that the cabin altitude climbed 14 000 feet in about 3 minutes 50 seconds, which equates to an average rate of climb of 3650 feet per minute. The aircraft descended from flight level 310 to 14 000 feet in 5 minutes 4 seconds, which equates to an average rate of descent of 3350 feet per minute. The descent was briefly interrupted twice while waiting for air traffic control clearance to lower altitudes.

During the descent after the passenger oxygen masks were deployed, one of the flight attendants observed a mother having difficulty placing an oxygen mask on her infant. The flight attendant obtained a portable oxygen bottle, donned the mask attached to it, and went to assist. It was decided to use a portable oxygen mask for the infant. A spare mask was retrieved from another location to be attached to the second outlet of the flight attendant's oxygen bottle. Portable passenger oxygen bottles provided on the aircraft were each equipped with two compatible masks per bottle; however, many different types of connector fittings are manufactured.

On the incident aircraft, one of the two bottles used was equipped with bayonet-style connectors, and the other with a straight plug-on style. A second portable bottle and mask were obtained for the infant. Although the operator's cabin safety checks included inspection of the condition of each portable oxygen bottle and the associated masks, the incompatibility of masks to bottles in different storage locations went undetected. The Canadian Aviation Regulations (CARs) do not require standardized connectors for all portable oxygen masks and all portable oxygen bottles throughout an individual aircraft or fleet of aircraft operated by one operator.

CARs 705.73 and 705.74 mention that an aircraft carrying more than 20 passengers is required to be equipped with an interphone and a PA system. However, the CARs Standards, Division V - Aeroplane Equipment Requirements, state that currently no standards are published for this division.

Although this occurrence did not pose a danger to life, it created a heavy workload for the flight crew. Some passengers were very concerned that the crew did not make announcements during the descent, and the passengers' confusion and anxiety increased because they did not know whether the situation was under control. The first announcement was made after the aircraft levelled off at 14 000 feet; the PNF made a public address (PA) announcement informing the passengers that the situation was under control, that they could remove their oxygen masks, and that they would be landing in Kelowna. Some passengers, particularly at the back of the aircraft, did not hear or could not understand the PA announcements made from the flight deck, and the flight attendants could not provide information that they themselves did not possess. The PA system on the B737-200-series aircraft does not have a manual control or an emergency selection to provide for higher PA volume when required.

Some passengers received post-traumatic stress counselling after the flight. Of 118 passengers on board, 9 did not reboard the aircraft for the continuation of the flight to Abbotsford. The flight crew had not declared an emergency, and they did not receive the benefits of priority handling by air traffic control or the attendance of medical personnel at Kelowna to assist passengers.

The drop-down, passenger oxygen masks (Scott part number 289-701-27) provide supplemental oxygen to enrich the ambient air supply to the recipient. Some passengers were concerned about the operation of the oxygen masks: the reservoir bag below the masks did not inflate, and the passengers were convinced that oxygen was not flowing. The masks incorporate a reservoir bag below the mask but do not incorporate a flow indicator in the supply hose. The flow of oxygen to the masks is automatically regulated according to the pressure altitude within the aircraft cabin; the higher the pressure altitude, the greater the flow of oxygen. The flow of oxygen affects the inflation of the reservoir. At high pressure-altitudes, the reservoir will inflate fully, while at lower pressure-altitudes, the reservoir may not inflate at all, even though the regulated (required) amount of oxygen is still being provided.

This occurrence resulted from a response to symptoms of an apparent malfunction that was, in fact, initiated by the omission of a checklist item. There was no malfunction identified, and the aircraft and its components performed in a predictable manner.

Because the After Take-off checklist was not completed after an interruption, the pressurization equipment was not reconfigured for flight. Throughout the climb, normal checklist procedures did not result in the checklist sequence being resumed (at several opportunities), situational awareness on the flight deck was not maintained, and events were not prioritized in accordance with SOPs. Therefore, the focus of this analysis will relate to four system components: checklists, training, passenger care, and cabin emergency equipment.

Although a bleeds-off take-off procedure is a normal procedure, it is not routine. The After Take-off checklist included the normal pressurization items but did not include non-routine pressurization items. The need to address non-routine items, such as reconfiguring from a bleeds-off take-off, is stored in short-term memory. Due to the limitations of this memory and human vulnerability to distracting events, the likelihood of this item being omitted is relatively high.^{Footnote 2} Reconfiguration was not completed during the after take-off check, upon climbing through 10 000 feet, or on reaching cruise altitude, times when checks should have alerted the crew to set up the pressurization as required. The lack of timeliness in reconfiguring the pneumatic system may have resulted in the assessment that checklists were further along than they actually were, and these opportunities were again missed.

The crew's response to the simultaneous cabin altitude warning horn, auto fail caution light, and climb in the cabin altitude was to refer to the Auto Fail or Unscheduled Pressurization Change checklist rather than the Cabin Altitude Warning / Rapid Depressurization checklist. The auto fail caution light is not problematic itself; it is merely an advisory that some aspect of the pressurization system is beyond acceptable parameters and that a diagnosis of other information is required to identify the nature of the problem. Actions described in the Auto Fail or Unscheduled Pressurization Change checklist only address the operation and control of the outflow valve. When completion of this checklist did not correct the problem, further diagnosis was not successful until the travelling company pilot arrived on the flight deck. This suggests that the flight crew, at the time, were not aware of the differences between the two checklists or that the auto fail caution light could be symptomatic of a wider range of problems. Company pilot training did not include operator-induced (bleeds-off) loss-of-pressurization scenarios. Because the crew had not encountered a similar situation, through experience or training, they likely lacked awareness of the limitations of the Auto Fail or Unscheduled Pressurization Change checklist.

NASA-sponsored research suggests that the practice of completing checklists alone may have become a common method of managing the workload. This practice can contribute to a lower level of situational awareness when one crew member is removed from the operational loop. A vital cross-checking function is eliminated, and the operation then becomes vulnerable to any error committed during the "one-man show". Errors in checklist execution can be reduced by incorporating redundancy (both pilots cross-checking items) and reducing ambiguity (requiring verbal responses stating the actual value or status of an item). Research on checklist design indicates that critical items should be placed first on a checklist: the probability of successfully completing the first items on a checklist is the highest. (Asaf Degani and Earl L. Wiener, Human Factors of Flight-Deck Checklists: The Normal Checklist, NASA contract #NCC2-377, May 1990, pp. 26 and 31.)

Existing defences - consisting of but not limited to SOPs, dual pilots, training, and checklists - were in place to prevent such an event from developing. The investigation identified some departures from SOPs, inadequate pilot cross-checks, lack of effective communications, and preoccupation as some of the items that demonstrate a loss of situational awareness by either or both crew members. Without adequate communication practices, a form of "built-in" action cross-check is by-passed, subjecting individuals to their own errors or omissions when completing tasks alone. This may result in situational awareness not being assured among the crew, thereby losing the defence of redundancy by having two pilots. Crew resource management (CRM) practices help crew members communicate better, which can affect their interaction and greatly enhance their situational awareness during all aspects of a flight. Situational awareness is a function of CRM, and CRM must support and be supported by procedural practices. This operator's practice is to have the PNF complete some prescribed checklists or items alone. The pressurization item was placed at the beginning of the After Take-off checklist and, therefore, should have been least vulnerable to omission, yet both pilots missed it on several occasions.

Because the crew did not declare an emergency, the flight was deprived of priority handling by air traffic control and medical services at Kelowna. The operator's operations manual does require the crew to check on the condition of the passengers and the crew during or following an emergency event. However, it is unlikely that a typical crew would have the expertise to recognize anything but the most serious symptoms of traumatic stress.

The incompatible equipment on the occurrence aircraft went undetected because of the number of different oxygen equipment fittings available and the absence of a standard requiring commonality between portable oxygen equipment within an aircraft cabin. Consequently, there was a delay, although not serious, in supplying oxygen to the infant passenger.

The inflation of the passenger oxygen mask reservoir was a concern to many passengers because of a lack of passenger knowledge. The masks functioned in accordance with the design.

Normal PA volume from the flight deck may not be adequate to ensure that cabin occupants receive important instructions or information during emergency events. In this situation, failure to understand PA messages from the flight deck, when crew workload prevented the relay of messages through the flight attendants, resulted in confusion.

Findings as to causes and contributing factors

1. The After Take-off checklist was not completed after an interruption. Consequently, the air conditioning and the pressurization system were not reconfigured for flight after a bleeds-off take-off.
2. The 10 000-foot memory check was not completed, the air conditioning and pressurization system were not reconfigured, and the auxiliary power unit was not shut down.
3. The pressurization irregularity was not detected during the memory check upon reaching cruise altitude.
4. The auxiliary power unit was shut down at flight level 310 without verifying why it was running. The shutdown resulted in cabin depressurization.
5. The crew did not comply with standard operating procedures and normal procedures in response to the cabin altitude warning horn and depressurization. This delayed their regaining control of cabin pressurization.

Findings as to risk

1. Completing checklist tasks alone, without the participation of the other pilot, eliminates error tolerances. Consequently, situational awareness may not be assured.
2. The crew did not declare an emergency. Consequently, the flight was deprived of beneficial services from air traffic control and, if required, the immediate assistance of airport emergency services and medical attention.

Other findings

1. Portable passenger oxygen masks for one oxygen bottle in the aircraft cabin were not compatible (interchangeable) with the other portable passenger oxygen bottles in the same cabin.
2. The public address (PA) announcement from the cockpit could not be heard or was not intelligible to some passengers, particularly those in the rear of the aircraft. The PA system does not have a manual or emergency volume selection.
3. Passengers were not aware that supplemental oxygen mask reservoirs may not inflate when the regulated (required) amount of oxygen is provided.

Safety action taken

The operator has modified the passenger pre-flight emergency briefing to inform passengers that the masks will supply oxygen even though the reservoir may not be inflated. The operator has also taken action to enhance pilot training regarding pressurization problems.

The operator has complied with an internal supplemental maintenance order requiring the fleet-wide standardization of fittings between portable oxygen bottles and portable masks.

On 26 April 2001, the TSB forwarded Aviation Safety Information Letter A010005-1 to Transport Canada. The letter encouraged consideration of methods to ensure that operators do not unknowingly combine incompatible portable passenger oxygen equipment within an aircraft cabin. Transport Canada's reply recognized the need to apprise air operators of the reported anomaly. Transport Canada is assessing options to identify the most appropriate method to communicate the issue to the industry.

As a result of this investigation, Boeing has revised the Auto Fail or Unscheduled Pressurization Change checklist applicable to all Boeing 737 models. The first two items on the revised checklist prescribe the actions of ensuring that the bleed-air and air conditioning "pack" switches are in the ON positions. The revision is scheduled to be disseminated by May 2002.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 04 December 2001.