Part 2 of 2
Quick Disconnect Valve TestsIn an attempt to determine if the flight crew oxygen masks were connected to the oxygen system at the time of impact, testing of exemplar flight crew oxygen mask connections was performed to determine the structural failure modes of these connections when the mask connectors are forcefully separated from their mating oxygen outlet quick disconnect valves (receptacles).
Four separate tests (tensile, shear, bending, and vibration) were performed. Test results indicated that the connectors separated from the valves when exposed to shear and bending loads. During the shear test, a small scratch was observed on the lip of the valve, and during the bending test, minor scuffs were noted on the surface of the valve near one of its retainer pins. In addition, during the shear and bending tests, half of the connector sleeve, which interlocks with the retainer pins of the quick disconnect valve, broke away, and the other half was bent. During the vibration and tensile tests, the connector remained securely installed. Post-test examination revealed no observable damage to the connector or the oxygen outlet valve.
Air Conditioning System
Flow Control ValveFunctional tests of an exemplar flow control valve evaluated the performance of the valve assuming various mechanical failure modes. One possible failure mode assumed the loss of the venturi throat pressure sense line. The functional tests revealed that when the venturi throat pressure sense line was removed, simulating a leak to atmosphere, the flow control valve fully closed when sensing a back pressure27 of 0.5 psi. A closed flow control valve would prevent the supply of bleed air flow to the cabin during normal cabin pressurization.
A second possible failure mode assumed damage to the actuator diaphragm. The functional tests revealed that relatively small areas of damage to the actuator diaphragm, such as a 0.040-inch diameter hole (0.00125 square inches), caused the flow control valve to operate sluggishly and outlet flow to vary significantly with changes in inlet pressure.28 With a back pressure of 8.4 psi, the flow of bleed air through the valve was reduced significantly from its nominal flow rate of 12 ± 1 pounds per minute. Testing revealed that diaphragm damage equivalent to a 0.052-inch diameter hole (0.00212 square inches) prevented the valve from operating at any inlet pressure and further disabled the maximum flow29 function of the valve.
Two additional possible failure modes that would close the flow control valve include blockage at the actuator opening chamber inlet orifice and blockage at the shutoff solenoid bleed port orifice. No determination could be made regarding blockage at either location because of the impact breakup of the valve assembly.
COMPANY INFORMATION
Company HistoryAccording to its president, Sunjet Aviation was a diversified aviation company founded in 1992.30 The company operated a fixed-base operation providing fuel, catering, aircraft detailing, ground transportation, and hotel accommodation arrangements. The company was certified by the FAA as a 14 CFR Part 135 jet charter operator specializing in Learjet and Cessna Citation aircraft. With 70 employees, the company operated a total of six airplanes and also operated a certified maintenance repair station, including an interior refurbishing shop. In addition, Sunjet Aviation managed aircraft for other corporations and had an aircraft sales division, including a fractional ownership program.
Federal Aviation Administration Oversight and Postcrash ActionsThe FAA POI at the time of the accident was assigned to the Sunjet Aviation certificate in October 1998 and held a Learjet type rating that he received in 1989. He stated that he had attended some of Sunjet Aviation's pilot training sessions on a limited basis. He further stated that he had not flown on a Sunjet Aviation airplane; another FAA POI who was current and qualified on the Learjet had flown on Sunjet Aviation's airplanes and monitored its training courses as well. The POI assigned to Sunjet Aviation stated that he did not give pilot checkrides; rather, an approved, designated pilot examiner performed this function. The POI stated that his responsibility included approval for training, procedures, and company manuals. He stated that he had accomplished a "spot inspection" in the spring of 1999 and did not find any problem areas. He indicated that, in the year before the accident, at his request, Sunjet Aviation had "upgraded" all of the manuals except for the General Operations Manual.
On June 11, 1999, the FAA Orlando Flight Standards District Office principal maintenance inspector performed a surveillance inspection of Sunjet Aviation at the company's Sanford, Florida, headquarters. The results were "satisfactory," and the inspection was closed out on the same day. According to the FAA, the June 11, 1999, inspection was the only surveillance of Sunjet Aviation's maintenance functions during the year preceding the accident.
Federal Aviation Administration Special Certification ReviewOn November 4, 1999, the FAA began conducting a Special Certification Review (SCR) of the Learjet Model 35/36 oxygen and pressurization systems as a result of this accident to determine (1) whether the noted systems were properly certificated and (2) whether any unsafe design features existed. The SCR team did not identify issues associated with the oxygen and pressurization systems that would lead to an unsafe condition. Further, the SCR team did not identify any unsafe conditions associated with the oxygen and pressurization system modifications as installed on the accident airplane, but the team made several recommendations. In November 16 and December 1, 2000, memoranda provided to the Safety Board, the FAA indicated that it had already issued Notices of Proposed Rulemaking (NPRM) regarding several airplane models and that it was working with manufacturers to address the recommendations.
In its review, the FAA found that the Learjet Model 35/36 AFM does not have an emergency procedure requiring the flight crew to don oxygen masks immediately after the cabin altitude aural warning is activated. Because the AFM contains an abnormal procedure allowing the flight crew to troubleshoot the pressurization system before donning oxygen masks, the FAA noted that the flight crew may delay donning oxygen masks and become incapacitated.
On June 8, 2000, the FAA issued NPRM "Airworthiness Directives; Learjet Model 35, 35A, 36, and 36A Series Airplanes," which was published in 65 Federal Register (FR) 36391. The NPRM proposed to require revising the AFM to add emergency procedures instructing the flight crew to don oxygen masks when the cabin altitude warning horn is activated.31 In a July 26, 2000, letter, the Safety Board commented on the NPRM, stating the following:
The Safety Board supports the proposed AD and agrees that the flight crew's oxygen masks should be donned immediately on activation of the cabin altitude warning horn. However, the Board notes that the proposed AFM changes instruct the flight crew to perform an emergency descent upon activation of the cabin altitude warning horn, regardless of the existing flight conditions. It is possible for the cabin altitude warning horn to activate during flight conditions that would not require an emergency descent and landing. To further improve the AFM guidance for flight crews, the Board encourages the FAA to identify all flight conditions in which an emergency descent is not required subsequent to donning oxygen masks and clearly present the appropriate instructions in the final rule.
The SCR team recommended that Bombardier Aerospace develop a kit to provide an annunciator light (or the equivalent) to advise the flight crew if the CABIN AIR switch is in the OFF position for Learjet airplanes without automatic emergency pressurization systems.
The SCR team also requested that all aircraft certification offices (ACO) review the AFMs of all transport-category pressurized airplanes certificated for flight above 25,000 feet and ensure they contain information about emergency procedures upon activation of the cabin altitude warning. The SCR team recommended that the flight crew don the oxygen masks immediately after a cabin altitude warning.
In addition, the SCR team requested that all ACOs forward the following recommendation to all manufacturers of transport-, normal-, and commuter-category pressurized airplanes certificated for operation above 25, 000 feet: "Determine if there is a means to annunciate to the flight crew that the pressurization system is selected off or develop a modification to provide an annunciation of the same." (This recommendation would not apply to aircraft with automatic emergency pressurization systems.)
The SCR team also recommended that the FAA review and investigate Learjet Service Bulletin 35/36-21-7, "Inspection of Cabin Pressurization Outflow Valve and Safety Valve," for FAA action, if necessary. In addition, the SCR team recommended that the FAA distribute information to the pilot community, including FAA operations inspectors and examiners, that emphasizes the importance of pressurization and oxygen systems operations and procedures to avoid hypoxia.32
MAINTENANCEThe accident airplane's airworthiness certificate was issued on April 4, 1976, and Sunjet Aviation began operating and maintaining the airplane in January 1999. According to the accident airplane's maintenance records, Sunjet Aviation performed a prepurchase inspection on January 31, 1999, and completed the inspection on February 8, 1999. The last approved aircraft inspection program 300-hour/12-month inspection was completed on June 12, 1999, and 179 flight hours had accumulated since that date. As of October 23, 1999, N47BA had a total flight time of 10,505.8 hours and had 8,043 total landings.
Cabin Pressurization and Oxygen System Maintenance HistoryThe accident airplane's maintenance records revealed that, from 1976 to 1994, the left and right modulation valves, the pressurization system vacuum regulator, the flight crew oxygen masks, and an oxygen pressure gauge capillary line were replaced. The pressurization module was replaced twice.
On April 12, 1995, a prepurchase inspection performed by Learjet at its Wichita, Kansas, facility indicated the following:
Cabin pressure follows throttles - 2,000 feet bump both directions...R/H [right] engine mod...Valve does not shift when power is brought up...when moving cabin air switch to max flow you get no increase of air flow...with cabin pressure at 1 pound in auto, cabin will not up rate when selecting a higher altitude...should up rate depending on where rate knob is at...emergency exit seal...coming loose...main cabin door is smashed at split line area...O2 need serviced.33
Since April 12, 1995, the right and left modulation valves and the copilot's oxygen mask regulator were replaced. A February 9, 1998, report indicated that the cabin occasionally would not hold pressure at low altitudes. The maintenance clearing action noted in the airplane's logbook indicated that the airplane had been operationally checked on the ground and that the problem could not be duplicated. On May 19, 1999, an oxygen pressure gauge capillary line was replaced, and on May 21, 1999, maintenance personnel complied with the Phase A1-6 inspection, which included pressurization system checks.
A Sunjet Aviation pilot reported to Safety Board investigators that on a July 22, 1999, flight in the accident airplane, the pressurization system would not maintain a full pressure differential and that later the cabin altitude "started climbing well past 2,000 feet per minute." In a postaccident statement to the Board, the Sunjet Aviation chief pilot indicated that on July 22, 1999, "at no time was any pressurization problem observed" on the accident airplane. A July 23, 1999, Work Order discrepancy sheet 5895 indicates the following: "Discrepancy: Pressurization check and operation of system." The discrepancy sheet also indicates that maintenance personnel cleaned the outflow valve. No mechanic's signatures or initials (indicating completion of corrective actions) or inspector's signatures or initials (indicating inspection of the completed corrective actions) were found on Work Order 5895. A note on the discrepancy sheet stated the following: "transferred to WO [work order] # 5929 item # 2."34
Before the maintenance work was performed under Work Order 5929, the accident airplane was flown to Aspen, Colorado; however, according to the FAA-approved operations specifications for Sunjet Aviation, the company was not authorized to use a Minimum Equipment List on any of its airplanes. The Sunjet Aviation maintenance supervisor stated to the Safety Board in a November 15, 1999, interview that a pilot gave him a "verbal squawk" (discrepancy) on July 28, 1999, that when retarding the throttles on descent into Aspen "with anti-ice ON," the cabin would "climb." Sunjet Aviation Work Order 5929, which was opened on July 28, 1999, and closed on August 1, 1999, indicates the following: "Problem: Check pressurization system." In addition, according to the accident airplane's maintenance log and Sunjet Aviation Work Order 5929, from July 29 through August 1, 1999, maintenance personnel performed the following actions: "cleaned [the] outflow valve in accordance with Lear maintenance manual chapter 21-30-01...Pressurization test as advertised. O.K. for flight." A Sunjet Aviation maintenance inspector indicated that maintenance personnel also checked the cabin pressurization module for loose connections and conditions.
Two Learjet mechanics from Bombardier Aerospace, Fort Lauderdale, Florida, were at Sunjet Aviation's facilities on October 5, 1999, to work on another airplane. They stated that they were "approached by a [Sunjet] mechanic who asked [them] if [they] knew anything about...Learjet model 35 pressurization systems. [They] informed him that [they] were engine shop specialists and had limited knowledge on [the] airframe pressurization system." Safety Board investigators questioned Sunjet Aviation personnel, who stated that they were unaware that any Sunjet Aviation maintenance personnel made such an inquiry. In addition, the two Learjet mechanics were unable to identify the Sunjet Aviation mechanic who made the inquiry.
On October 7, 1999, Sunjet Aviation maintenance personnel adjusted the left engine's fuel computer to equalize the left and right engines' rotation speeds at takeoff power.
On October 12, 1999, a gasket was replaced at the "V" clamp at the flow control valve. A Sunjet Aviation maintenance inspector stated that he inspected the "V" clamp and checked the torque; no defects were noted.
A Sunjet Aviation maintenance supervisor indicated that on October 22, 1999, maintenance personnel were troubleshooting to correct a staggered throttle condition at takeoff power settings. During an engine run, a maintenance inspector visually checked the left engine modulation valve and found "the spring not functioning." Maintenance personnel ordered a replacement modulation valve that day from Learjet and received it on October 23, 1999; the left modulation valve was then removed and replaced. The repair tag for the modulation valve that was removed from the accident airplane indicated the following: "Reason removed: ITT [interstage turbine temperature] split at altitude and cabin pressurization loss with reduced power setting."
In a statement provided to the Safety Board, the Sunjet Aviation maintenance inspector who had identified the malfunctioning valve indicated that "[a]ll work was performed in accordance with Learjet maintenance manual, 21-30-00, page 201 and 202." These sections of the maintenance manual include an "operational check of the cabin pressurization system," performed on the ground with the engines running and the airplane configured to simulate an in-flight condition. The Sunjet Aviation maintenance supervisor stated that because they were troubleshooting for a power problem, the airplane was not checked in flight. After the airplane was back in service, a pilot flew it on a training flight that afternoon to St. Augustine and stated, "the flight to St. Augustine was flown at altitudes of 12,000 and 13,000 feet. The bleed air and pressurization system were operating normally. Sea level cabin pressure was selected with normal differential indicated."35
Scheduled Pressurization Maintenance ChecksThe maintenance records reviewed, including the pressurization maintenance checks required by Learjet, revealed that the following were the last checks that had been complied with before the accident:
A Pressurization Control System Filters- c/w [complied with] November 13, 1998, 600 hr.
B Cabin air exhaust control valve- c/w August 22, 1997, 1200 hr.
C Cabin altitude limiter inlet screen- c/w November 13, 1998.
D Pressurization control system jet pump- c/w November 18, 1998.
Servicing of the Oxygen Bottle Components and Cockpit Oxygen Pressure GaugeAccording to a Sunjet Aviation official who spoke to the accident captain before takeoff, the captain told him that the oxygen pressure gauge was noted in the green band (1550 to 1850 psi) during preflight checks on the day of the accident. According to maintenance records, the oxygen system was last serviced36 (by Sunjet Aviation) on September 3, 1999. The only written records of servicing of the oxygen system were from Sunjet Aviation;37 a survey of 15 of the fixed-base operators visited by the accident airplane between September 26 and October 20, 1999,38 revealed no charges for oxygen servicing. A flight manifest log indicates that N47BA was flown approximately 104.6 flight hours (90 cycles) between the last time the oxygen system was known to have been serviced and the accident flight. After the accident, the oxygen source used by Sunjet Aviation to service N47BA on September 3, 1999, was tested and was found to be more than 99.8 percent pure oxygen.39
Flight Discrepancy LogA review of the Sunjet Aviation General Operations Manual and interviews conducted on November 15, 1999, with Sunjet Aviation maintenance and operations personnel revealed that, at the time of the accident, Sunjet Aviation had a Flight Discrepancy Log for all flight crewmembers to document maintenance discrepancies. The form consisted of one white page and a duplicate yellow page. According to Sunjet Aviation personnel, one copy was to be kept in the airplane for 3 to 5 days, and the other copy was for maintenance personnel. When the discrepancy was corrected, the yellow copy was to go to operations to be kept on file for an unspecified amount of time. When the Sunjet Aviation operations employee was asked to produce the Flight Discrepancy Logs for N47BA from January 1999 to the date of the accident, he stated that Sunjet Aviation "did not have them." According to Sunjet Aviation, the Flight Discrepancy Logs for the last 5 days were still on the accident airplane at the time of the accident. Maintenance and operations personnel were unable to locate the duplicate (yellow) copy of the Flight Discrepancy Log. In addition, the maintenance supervisor revealed that it was more common for a flight crewmember to verbally tell maintenance personnel about a problem instead of filling out the Flight Discrepancy Log. If no maintenance personnel were available, the problem would be documented on a piece of paper.
ANALYSIS
GENERALThe captain and first officer were properly certificated and qualified in accordance with applicable Federal regulations and company requirements. Their duty time, flight time, rest time, and off-duty activity patterns did not indicate any preexisting medical, behavioral, or physiological factors that might have affected their performance on the day of the accident.
Visual meteorological conditions prevailed along the route of flight, and weather was not a factor in the accident.
The airplane was properly certificated and equipped in accordance with Federal regulations and approved procedures.
No significant preexisting airframe or powerplant problems40 were discovered during a review of available maintenance records and interviews with maintenance personnel and witnesses who observed the airplane just before and during its final descent. There was no evidence in the wreckage of an in-flight fire.
INCAPACITATION OF THE FLIGHT CREWThe flight crew's last communication with air traffic control (ATC) was at 0927:18 eastern daylight time, when the first officer acknowledged an ATC clearance to flight level (FL) 390 and the airplane was climbing through 23,200 feet.41 Her speech was normal, her phraseology was accurate and appropriate, and Safety Board testing indicated that she was not using an oxygen mask microphone for this transmission or those that she had made earlier.42 The flight crew's failure to respond to repeated ATC radio inquiries beginning at 0933:38, when the airplane was climbing through about 36,400 feet, was the first indication of a problem on board the accident flight. As the flight continued, it deviated from its assigned course and failed to level at its assigned altitude (FL 390). There was no evidence that the flight crew attempted to intervene43 over the next 4 hours, as the airplane continued to fly off course, ascending to 48,900 feet, and finally descended to impact.44 These events indicate that the flight crewmembers became incapacitated at some point during the 6 minutes and 20 seconds between 0927:18 and 0933:38.
The continuous sounding of the cabin altitude aural warning during the final 30 minutes of cruise flight (the only portion recorded by the CVR) indicates that the airplane and its occupants experienced a loss of cabin pressurization some time earlier in the flight.45 Further, although the severity of the impact precluded extensive analysis, there was no evidence suggesting any alternative reason for incapacitation.
If the pilots had received supplemental oxygen from the airplane's emergency oxygen system, they likely would have properly responded to the depressurization by descending the airplane to a safe altitude. Therefore, it appears that the partial pressure46 of oxygen in the cabin after the depressurization was insufficient for the flight crew to maintain consciousness and that the flight crewmembers did not receive any, or adequate, supplemental oxygen.
Because this accident would not have occurred without both the loss of cabin pressure and the failure of the flight crew to receive supplemental oxygen, the Safety Board considered possible reasons for both of these key events in the accident sequence.
LOSS OF CABIN PRESSURIZATION
Availability of Bleed AirPostaccident examination of the left and right bleed air shutoff/regulator valves (modulation valves) indicated that they were near their fully closed positions. Because the modulation valves are spring loaded to the open position and require bleed air to close, the nearly closed position of both valves at impact is consistent with a normal and adequate supply of engine bleed air from one or both engines. Further, these nearly closed valve positions indicate that there was a low demand for bleed air by the airplane's air conditioning and anti-icing systems and that both BLEED AIR switches, which were not recovered, would have had to have been selected to the ON position. The nearly closed valve positions also indicate that the airplane's pneumatic system was intact, and, therefore, normal system pressure was being supplied to the air conditioning system flow control valve.
Lack of Bleed Air Supply to the CabinThe flow control valve regulates the flow rate of conditioned bleed air entering the cabin for pressurization and heating. If there is no inlet bleed air, the valve main spring will close the flow control valve completely. Although, as previously discussed, bleed air was available to open the flow control valve, the condition of the flow control valve indicated that it was in its fully closed position at impact. The valve requires several seconds to move from its fully open to fully closed position in normal operation, indicating that the valve was in its closed position before impact. This closed valve would have prevented bleed air from entering the cabin, thereby preventing normal pressurization.47
Closure of the flow control valve on a Learjet Model 35 and the resulting loss of bleed air supply to the cabin would cause the airplane to quickly lose cabin pressure (depressurize) at a rate dependent upon the cabin leakage rate. Computer simulations by Honeywell indicated that if a loss of normal bleed air supply to the cabin occurred at flight altitudes above 25,000 feet, the cabin altitude could ascend to 10,000 feet in about 30 seconds and reach 25,000 feet in about 2 1/2 minutes.
The military pilots who observed the accident airplane in flight before its final descent reported that the accident airplane's windshield was obscured by condensation or frost. Condensation or frost would be consistent with a loss of bleed air supply to the cabin. When bleed air is supplied to the cabin, the cockpit windshield receives a constant flow of warm air that prevents or removes condensation, regardless of the ambient temperature or pressure in the cabin.48 Thus, the windshield would be relatively clear following depressurization from a breach or other undesired outflow from the cabin with continued bleed air supply to the cabin, whereas condensation could form and remain on the windshield following a depressurization caused by a loss of bleed air inflow to the cabin. Therefore, the accident airplane most likely did not have an inflow of bleed air to the cabin.
Possible Explanations for the Closed Flow Control ValveInvestigators considered several possible explanations for the closed flow control valve on the accident airplane. First, Safety Board investigators considered whether the flow control valve might have malfunctioned and closed uncommanded. Investigators identified several mechanical failure modes that might have caused the flow control valve to close, including the loss of the venturi throat pressure sense line, damage to the actuator diaphragm, blockage at the actuator opening chamber inlet orifice, and blockage at the shutoff solenoid bleed port orifice. Because the condition of the wreckage did not allow investigators to determine whether any of these failures occurred on the accident airplane, the Board cannot exclude the possibility that the flow control valve closed uncommanded because of a mechanical malfunction.
Investigators also considered the possibility that the pilots failed to select the CABIN AIR switch to NORM, which activates the air conditioning system (and pressurizes the airplane), before takeoff.49 Even though the Taxi and Before Takeoff checklist specifies, in item 19, "CABIN AIR SWITCH - NORM," the FAA Special Certification Review (SCR) team observed that "there is incentive to leave the pressurization system off during taxi and takeoff in warm weather because inflow air can be hotter than cabin ambient air."50 However, without the cabin air conditioning system, the occupants of the airplane likely would have perceived a high cabin climb rate after takeoff, possibly causing discomfort. At about 10,000 feet cabin altitude, the cabin altitude aural warning should have begun to sound, further alerting the flight crew to the lack of pressurization. Although the pilots could have manually silenced the warning, they would have had to repeat this action every 60 seconds. At about 14,000 feet cabin altitude, deployment of the passengers' oxygen masks would have provided an additional cue that the cabin was not properly pressurized.51 It is unlikely that the flight crew would have continued to climb despite this clear information that the airplane was unpressurized.
In addition, the first officer showed no signs of hypoxia52 in her radio transmission at 0927:18, when the airplane was climbing through 23,200 feet.53 Safety Board tests indicated that with the CABIN AIR switch off at this altitude, the cabin altitude would have been increasing to above 20,000 feet. With a cabin altitude of 20,000 feet, flight crewmembers would very likely have been impaired by hypoxia. Further, the cabin altitude warning was not heard in the background of these radio transmissions. While it is possible that the frequency of the pilot's headset, the airplane's radios, or the ATC recording system may have masked the sound of the cabin altitude warning, the lack of such a sound suggests that the airplane had not depressurized to a cabin altitude greater than 10,000 feet by that time. Therefore, although the Board acknowledges that flight crew failure to activate the cabin air conditioning system before takeoff may be a valid safety concern for the Learjet Model 35,54 it considered this unlikely to have occurred on the accident flight.
Investigators also considered the possibility that the flight crew selected the CABIN AIR switch to OFF (closing the flow control valve) during flight. Step 4 of the Learjet Model 35/36 Aircraft Flight Manual (AFM) Abnormal Procedures checklist for a pressurization loss at altitude instructs pilots to select the WSHLD (windshield) HEAT AUTO/MAN switch to AUTO, thus initiating the emergency bleed air supply to the cabin.55 (The wreckage indicated that the windshield anti-ice [defog] shutoff valve was closed at impact,56 strongly suggesting that the emergency bleed air was not activated.) Step 5 in the Abnormal Procedures checklist instructs pilots to select the CABIN AIR switch to OFF, thereby closing the flow control valve. The accident airplane was not equipped with automatic emergency pressurization;57 consequently, if it had experienced a loss of cabin pressurization, the pilots should have executed this procedure to initiate the alternate, emergency source of bleed air.
There is no evidence that an earlier pressurization problem (such as an outflow valve malfunction or a break in the fuselage) preceded the closing of the flow control valve. However, investigators considered the possibility that the flight crew might have experienced (or thought that they had experienced) such a problem and responded by attempting to execute the abnormal procedure for a loss of pressurization at altitude but omitted step 4 (selecting the WSHLD HEAT AUTO/MAN switch to AUTO) before accomplishing step 5 (selecting the CABIN AIR switch to OFF). Therefore, the closed position of the flow control valve could have been a consequence of the flight crew's attempt to address a pressurization malfunction or failure (cause unknown), rather than its cause.
In summary, as previously discussed, an uncommanded closure of the flow control valve would have been sufficient to depressurize the airplane. However, there was insufficient evidence to determine whether the depressurization was initiated by a loss of bleed air inflow (caused by a malfunction of the flow control valve or by inappropriate or incomplete flight crew action) or by some other event.
Inadequate Maintenance RecordkeepingThe sequence of maintenance actions from July 22 through October 23, 1999, indicate that there were several pressurization-related discrepancies during this period. Maintenance records indicate that Sunjet Aviation personnel attempted to correct the discrepancies by cleaning the pressurization system outflow valve and performing system ground checks. Work on a staggered engine throttle condition, which resulted in the replacement of the left modulation valve on October 23, 1999, was also related to concerns about the pressurization system (as shown by Sunjet Aviation's reference to pressurization on the removed modulation valve's part tag). However, Sunjet Aviation was not able to provide records of pilot-reported discrepancies that led to these maintenance actions.
The investigation did not identify any evidence that the preceding discrepancies were related to the cause of this accident. However, if Sunjet Aviation had maintained pilot discrepancy reports (as required by its General Operations Manual), the Safety Board may have learned additional details about the frequency and nature of the airplane's prior pressurization-related problems and possibly been able to determine whether they were related to a common problem. Further, available records from Sunjet Aviation did not verify whether the discrepancies were corrected before flight. In addition, the investigation revealed that maintenance work performed on the pressurization system under Work Order 5895 was not signed off by mechanics or inspectors and that Sunjet Aviation then operated the accident airplane on revenue trips with deferred maintenance on the pressurization system (without authorization under an FAA-approved Minimum Equipment List). The Board notes that Sunjet Aviation's failure to maintain pilot discrepancy records and its unauthorized operation of flights with deferred maintenance items reflects shortcomings in the company's procedures for identifying, tracking, and resolving repetitive maintenance items and adverse trends.58
FLIGHT CREW'S FAILURE TO RECEIVE SUPPLEMENTAL OXYGENFollowing the depressurization, the pilots did not receive supplemental oxygen in sufficient time and/or adequate concentration to avoid hypoxia and incapacitation. The wreckage indicated that the oxygen bottle pressure regulator/shutoff valve was open on the accident flight. Further, although one flight crew mask hose connector was found in the wreckage disconnected from its valve receptacle (the other connector was not recovered), damage to the recovered connector and both receptacles was consistent with both flight crew masks having been connected to the airplane's oxygen supply lines at the time of impact. In addition, both flight crew mask microphones were found plugged in to their respective crew microphone jacks. Therefore, assuming the oxygen bottle contained an adequate supply of oxygen, supplemental oxygen should have been available to both pilots' oxygen masks.
The Safety Board evaluated several explanations for the flight crewmembers' failure to receive supplemental oxygen, including an inadequate quantity of oxygen or improper servicing of the oxygen bottle and the failure (or inability) of the pilots to don their oxygen masks rapidly enough following the loss of cabin pressure.
Oxygen QuantityInvestigators considered the possibility that there might have been an insufficient quantity of oxygen on board the accident flight to sustain the flight crewmembers while they addressed the depressurization. The oxygen bottle was found empty. Witness marks on the cockpit oxygen pressure gauge caused by the impact were consistent with an indication of no pressure in the oxygen bottle.
A Sunjet Aviation official stated to the Safety Board that the accident captain had reported that the oxygen pressure gauge was in the green zone, indicating adequate pressure of 1,550 to 1,850 psi, during preflight checks on the day of the accident. The airplane's maintenance records indicate that the oxygen bottle was last serviced with oxygen (by Sunjet Aviation) on September 3, 1999. Between this date and the date of the accident flight, Sunjet Aviation operated the airplane for about 104.6 flight hours, on 90 flights. The Board was unable to determine exactly how many of these flight hours were above 35,000 feet,59 but ATC voice tapes from one of the flights60 indicated that the airplane was cleared to FL 370 on one leg. Although no radar data for that flight were available, the Board estimated (using ground speed and distance) that the airplane would have cruised above 35,000 feet for at least 30 to 40 minutes during that round trip flight. The captain from that flight told investigators that when the airplane was above 35,000 feet during that flight, he used supplemental oxygen. Board calculations indicated that the flight crew's reported oxygen usage that day would have depleted the airplane's oxygen supply by up to 14 to 25 percent, depending on which mask was used. Even though oxygen use was required on this flight (and perhaps others) and was reported to have been used, the Board is aware that pilots do not always use oxygen when required by regulation.
The Safety Board contacted fixed-based operators (FBO) at 15 known destination airports visited by the accident airplane between September 26 and October 20, 1999, and none had any record of charges for oxygen servicing of the accident airplane. However, the Board cannot exclude the possibility that the airplane was serviced with oxygen after September 3, 1999, at a different airport or at no charge to Sunjet Aviation61 and that no record was made.62
However, even if the oxygen bottle had been full at the beginning of the accident flight, the oxygen supply would have been completely depleted before impact because the Rogers regulator installed on one of the two flight crew masks would have automatically supplied 100 percent oxygen when the cabin altitude increased beyond 39,000 feet. This oxygen would have been released at 130 liters per minute at a pressure of approximately 0.5 psi even if the mask was not being worn by a flight crewmember, depleting a fully charged oxygen bottle in about 8 minutes. Therefore, the postimpact reading on the oxygen pressure gauge is not necessarily indicative of an inadequate predeparture oxygen supply on the accident flight.
In summary, the Safety Board could not determine the quantity of oxygen that was on board the accident flight.
Oxygen QualityIf the airplane's oxygen bottle had been improperly serviced with air, rather than oxygen, there would have been insufficient partial pressure of oxygen in the supplied mixture to avoid hypoxia at high cabin altitudes after a depressurization. The Safety Board is aware of an accident involving pilot incapacitation from hypoxia as a result of improper servicing of an oxygen bottle with compressed air.63 The oxygen source from which the accident airplane's oxygen bottle was serviced on September 3, 1999, was tested after the accident and found to contain 99.8 percent pure oxygen. However, because of the possibility that the oxygen bottle might have been serviced elsewhere after that, the Board could not rule out the possibility that the oxygen bottle contained air instead of oxygen.
Timeliness in Donning Oxygen MasksAnother possible explanation for the failure of the pilots to receive emergency oxygen is that their ability to think and act decisively was impaired because of hypoxia before they could don their oxygen masks. No definitive evidence exists that indicates the rate at which the accident flight lost its cabin pressure; therefore, the Safety Board evaluated conditions of both rapid and gradual depressurization.
If there had been a breach in the fuselage (even a small one that could not be visually detected by the in-flight observers) or a seal failure, the cabin could have depressurized gradually, rapidly, or even explosively.64 Research has shown that a period of as little as 8 seconds without supplemental oxygen following rapid depressurization to about 30,000 feet may cause a drop in oxygen saturation that can significantly impair cognitive functioning and increase the amount of time required to complete complex tasks.65
A more gradual decompression could have resulted from other possible causes, such as a smaller leak in the pressure vessel or a closed flow control valve. Safety Board testing determined that a closed flow control valve would cause complete depressurization to the airplane's flight altitude over a period of several minutes. However, without supplemental oxygen, substantial adverse effects on cognitive and motor skills would have been expected soon after the first clear indication of decompression (the cabin altitude warning), when the cabin altitude reached 10,000 feet (which could have occurred in about 30 seconds).
Investigations of other accidents66 in which flight crews attempted to diagnose a pressurization problem or initiate emergency pressurization instead of immediately donning oxygen masks following a cabin altitude alert have revealed that, even with a relatively gradual rate of depressurization, pilots have rapidly lost cognitive or motor abilities to effectively troubleshoot the problem or don their masks shortly thereafter. In this accident, the flight crew's failure to obtain supplemental oxygen in time to avoid incapacitation could be explained by a delay in donning oxygen masks of only a few seconds in the case of an explosive or rapid decompression or a slightly longer delay in the case of a gradual decompression.
In summary, the Safety Board was unable to determine why the flight crew could not, or did not, receive supplemental oxygen in sufficient time and/or adequate concentration to avoid hypoxia and incapacitation.
PROBABLE CAUSEThe National Transportation Safety Board determines the probable cause of this accident was incapacitation of the flight crewmembers as a result of their failure to receive supplemental oxygen following a loss of cabin pressurization, for undetermined reasons._______________
Notes:1 The cooler contained soft drinks and wet ice. (The cooler did not contain dry ice.)
2 All altitudes are mean sea level unless noted otherwise.
3 ATC voice tapes indicate that all transmissions from N47BA were made by a female pilot.
4 During a flight test conducted as part of this investigation, a ground communications station recorded pilots transmitting normally and with the use of an oxygen mask. Members of the National Transportation Safety Board Cockpit Voice Recorder Group listened to the flight test transmissions made with the mask on and off and then compared them to the accident airplane's transmissions. All group members unanimously agreed that the first officer on N47BA was not wearing an oxygen mask during those transmissions.
5 The cabin altitude warning is a unique aural warning in the Learjet Model 35/36.
6 A sound spectrum study was completed on the radio transmissions from N47BA recorded by the Jacksonville ARTCC. The transmissions were examined on an audio spectrum analyzer to identify any background sound signatures that could be associated with aural cockpit warning tones or any other aircraft system background noise. No background signature noises could be discerned on the ATC tape; the frequency response of the pilot's headset, the airplane's radios, and the center's recording system may have masked such sounds.
7 About 1010 EDT, the accident airplane crossed from the EDT zone to the CDT zone in the vicinity of Eufaula, Alabama.
8 This interception was at the request of the Jacksonville ARTCC mission coordinator through the USAF.
9 The accident airplane reached a maximum altitude of 48,900 feet.
10 According to the Sunjet Aviation director of operations, on September 21, 1999, the captain was assigned his duty position on the Learjet with Sunjet Aviation.
11 Pressurized aircraft cabins allow physiologically safe environments to be maintained for flight crew and passengers during flight at physiologically deficient altitudes. (At altitudes above 10,000 feet, the reduction in the partial pressure of oxygen impedes its ability to transfer across lung tissues into the bloodstream to support the effective functioning of major organs, including the brain. These altitudes are typically referred to as "physiologically deficient altitudes.") At cruising altitudes, pressurized cabins of turbine-powered aircraft typically maintain a consistent environment equivalent to that of approximately 8,000 feet by directing engine bleed air into the cabin while simultaneously regulating the flow of air out of the cabin. The environmental equivalent altitude is referred to as "cabin altitude."
12 In accordance with 14 CFR 25.1477(c)(2), flight crewmembers must be able to don the oxygen mask within 5 seconds for the mask to be considered quick donning.
13 The single oxygen bottle supplies the pilots and all passengers with emergency oxygen.
14 With the PASS OXY valve in the NORM position, oxygen is available to the passenger oxygen distribution system. With the PASS OXY valve in the NORM position and the PASS MASK valve in the AUTO position, the passenger oxygen masks should drop from their storage compartments if the cabin altitude reaches 14,000 feet; passengers must then don the masks and pull the lanyard, which releases oxygen to the masks.
15 Items "a" through "f" are to be accomplished by the pilot without the aid of the AFM; these are called memory items.
16 According to Learjet, later models of the Learjet Model 35/36 are equipped with an automatic emergency pressurization system.
17 Two airworthiness directives (AD) were applicable to the inspection and replacement of outflow valves on certain Learjet Model 35 airplanes; because of the serial number of the accident airplane's outflow valve, these ADs were not applicable to the accident airplane.
18 One flight crew mask oxygen hose connector was recovered, but it was not attached to either quick disconnect valve. Half of the connector's outer sleeve was broken away and missing, and the remaining half of the outer sleeve was bent inward.
19 In addition, both crew microphone jack panels were recovered. (The flight crew oxygen mask microphones were plugged in.)
20 On October 23, 1999, the left engine modulation valve, S/N P-247, was removed and replaced with one of the modulation valves that was discovered in the wreckage. The functional test of the replaced modulation valve revealed that the flow mixing poppet between the low- and high-pressure stages did not operate (open) at low bleed air pressures.
21 The IN NORMAL/OUT DEFOG knob and its associated check valve were not recovered.
22 The accident flight was cleared to FL 390.
23 The five drugs of abuse tested in postaccident analysis are marijuana, cocaine, opiates, phencyclidine, and amphetamines.
24 The test flight CVR tape was acoustically compared with the accident CVR tape to determine whether the sounds of aircraft pressurization system airflow could be heard on the accident CVR tape; it was not possible to discern such sounds. However, the comparison indicated that the emergency pressurization system was not activated on the accident flight.
25 The cabin altitude aural warning will sound at a cabin altitude of 10,000 ± 500 feet. The cabin altitude aural warning will cease between cabin altitudes of 10,000 and 7,500 feet.
26 The aircraft ascent profile used by Honeywell during each simulation was based on recorded radar data for the accident airplane. During each simulation, a cabin leakage rate of 115 standard cubic feet per minute (scfm) was modeled at a cabin differential pressure equal to 8.0 psi and 28 scfm at 0.5 psi.
27 Normal operation of the cabin pressurization system (outflow valve) maintains a positive differential pressure of 8.7 psi across the fuselage, thereby exerting a back pressure (equal in magnitude to the cabin differential pressure) upon the flow control valve.
28 The flow control valve is designed to operate with an inlet pressure between 7 and 85 psi. A nominal inlet pressure of 35 psi is supplied to the flow control valve by one or both engine modulation valves.
29 When the CABIN AIR switch is placed in the MAX position, the max flow solenoid is energized, thereby causing the flow control valve to open fully, allowing full (unregulated) bleed air flow to the cabin.
30 Sunjet Aviation surrendered its operating certificate to the FAA on July 17, 2000.
31 In addition, on August 30, 2000, the FAA issued an NPRM (65 FR 52677) proposing that the AFM for Lockheed Model 188A and 188C series airplanes be revised to add procedures for donning the flight crew oxygen masks when the cabin altitude warning horn is activated. As with the Learjet Model 35/36, the FAA found that the Lockheed 188A and 188C series AFM did not contain emergency procedures directing flight crews to don oxygen masks upon onset of the cabin altitude warning.
32 Hypoxia is the physiological state of insufficient oxygen in the blood and body tissue.
33 According to Learjet, these items were not corrected per the customer's request.
34 Work Order 5929 refers to maintenance performed after a problem was noted with the accident airplane on July 28, 1999.
35 The airplane's pneumatic and pressurization systems were not required to perform to their maximum limits during this flight. Sea level cabin pressure at 13,000 feet flight altitude would pressurize the cabin to 5.7 pounds per square inch differential pressure (psid); the airplane's maximum differential pressure limit was 8.7 psid.
36 Oxygen servicing is not required to be entered in the aircraft maintenance logbook or accomplished by an airframe and powerplant qualified mechanic.
37 The oxygen system was also serviced by Sunjet Aviation on January 30, 1999, during the prepurchase inspection, and on March 10, May 19, and June 11, 1999.
38 This information is based on "Load Manifest/Aircraft Flight Log" forms provided by Sunjet Aviation.
39 Because the oxygen bottle was empty when it was recovered from the wreckage, the investigation could not positively determine if it contained any oxygen during the accident flight. The possibility that it was filled with air, nitrogen, or some other gas exists.
40 Sunjet Aviation's documentation of aircraft systems discrepancies is discussed later in this analysis.
41 All altitudes are mean sea level unless noted otherwise.
42 Investigators compared radio transmissions made during the accident flight with recordings of transmissions made with normal microphones and with oxygen mask microphones during a test flight and confirmed that the first officer was not wearing an oxygen mask during her transmissions.
43 ATC radar data indicate that the airplane turned slightly to the right at 0930:45 while climbing through an altitude of 30,200 feet. Because the airplane's ground track (and presumably its heading) was maintained for nearly the remainder of the flight, it is likely that this right turn was initiated by human input to the autopilot heading select knob. However, the National Transportation Safety Board was unable to ascertain whether this input was the result of an intentional act.
44 Information on the cockpit voice recorder (CVR) indicated that the airplane's final descent was initiated by an engine ceasing to operate. Considering the length of time that the airplane had been flying, this was most likely caused by fuel exhaustion. (Wreckage examination also indicated that the right engine was not operating at impact.) The CVR further indicated that engine spooldown was followed by aerodynamic stall and disengagement of the autopilot.
45 The Safety Board was unable to conclusively determine whether the cabin altitude warning initiated as designed. (The warning is designed to begin at 10,000 feet cabin altitude ± 500 feet.) However, the aneroid device that initiates the warning functioned properly to terminate the warning as the airplane descended.
46 Partial pressure, which is a function of the concentration of the gas in the atmosphere, represents the amount of total pressure accounted for by a particular gas. For example, at sea level (14.7 pounds per square inch [psi]), there is a 21 percent oxygen concentration, which provides a partial pressure of about 3.1 psi. A 100 percent concentration of oxygen from supplemental oxygen would provide the same partial pressure of oxygen at about 34,000 feet.
47 By interrupting the inflow for cabin pressurization, the closed flow control valve would have reduced the demand for engine bleed air, which is consistent with the nearly closed position in which the modulation valves were found.
48 Condensation occurs when temperature drops to the dew point. At the conditions present in aircraft cabins at normal cabin altitude, the dew point is substantially lower than the normal cabin temperature, and any moisture remains evaporated in the air. When the cabin decompresses, the resulting temperature decrease and reduction in cabin pressure cause the dew point to increase; consequently, moisture in the air will tend to condense out of the cabin air. With a supply of bleed air to the cabin, the constant flow of warm air on the Learjet cockpit windshield would not permit the temperature drop necessary for such condensation to occur on the windshield surface. Any observable condensation is consistent with a lack of bleed air inflow to the cabin.
49 The CABIN AIR switch was not recovered.
50 For more information, see FAA SCR Team Report, Learjet Model 35/36. February 25, 2000. Federal Aviation Administration. p. 9. In addition, many Learjets, including the accident airplane, are equipped with a freon air conditioning system that is useful for ground operations. Anecdotal evidence revealed that some Learjet flight crews have forgotten to activate the cabin air conditioning system before takeoff.
51 No abnormal findings were noted during the Safety Board's examination of the passenger oxygen system components to suggest that the passengers' masks would not have deployed as designed.
52 Hypoxia is the physiological state of insufficient oxygen in the blood and body tissue and may ultimately cause impaired vision, judgment, or motor control; drowsiness; slurred speech; memory decrements; difficulty thinking; and loss of consciousness and death.
53 In contrast, in a January 18, 1990, accident near Ansonia, Ohio, involving a Learjet 23, the flight crewmembers showed signs of hypoxia (including a deterioration in their ability to control the airplane) about 17 minutes after takeoff. They deviated from ATC instructions to enter a holding pattern at FL 220 and displayed confusion about assigned headings and other ATC instructions. The controller noted that the pilot's speech was slurred and that some portions of his transmissions were not understandable. The airplane subsequently climbed above its assigned altitude to FL 291. For more information, see Brief of Accident ATL90MA051.
54 The FAA SCR team recommended that "Bombardier Aerospace (Learjet Inc.) should develop a kit to provide an annunciator light or equivalent to advise the crew if the cabin air switch is in the off position (conditioned air supply off)." FAA SCR Team Report. p. 11. In a November 16, 2000, memorandum provided to the Safety Board, the FAA indicated that Learjet plans to issue service bulletins by September 2001 to address this recommendation.
55 This action initiates emergency bleed air supply to the cabin only if the IN NORMAL OUT DEFOG knob is pushed in. Given the weather conditions during the accident flight, this knob would most likely have been pushed in.
56 Neither WSHLD HEAT switch was recovered from the wreckage.
57 Later models of the Learjet Model 35/36 are equipped with an automatic emergency pressurization system that provides an alternate supply of bleed air to the cabin without pilot action in the event of a decrease in cabin pressurization.
58 Sunjet Aviation surrendered its operating certificate to the FAA on July 17, 2000.
59 Title 14 Code of Federal Regulations 135.89(b)(3) requires that one pilot wear and use an oxygen mask when an airplane is cruising above 35,000 feet.
60 The flight was a round trip from Jacksonville, Florida, to Wheeling, West Virginia, on October 20, 1999.
61 The Safety Board's survey of several FBOs that had recently serviced the accident airplane indicated that none of them provide complimentary oxygen supplies.
62 According to the FAA, oxygen servicing is not required to be entered in the aircraft maintenance logbook.
63 For more information, see Brief of Accident IAD97FA060.
64 Explosive decompressions typically occur in less than 1/2 second and are accompanied by loud noise and fog. Rapid decompressions typically last from 1/2 to 10 seconds, whereas gradual decompressions occur over a longer period of time.
65 Marotte, H.; Toure, C.; Clere, J. M.; and Vieillefond, H. 1990. "Rapid Decompression of a Transport Aircraft Cabin: Protection Against Hypoxia." Aviation, Space, and Environmental Medicine 61: 21-27; Noble, J.; Jones, J G.; and Davis, E. J. 1993. "Cognitive Function During Moderate Hypoxaemia." Anesthesia and Intensive Care 21(2): 180-184.
66 For more information, see Brief of Accident CHI96IA157 and Air Accidents Investigation Branch Bulletin No: 6/99 Ref: EW/C98/8/6.