At 11:24 on the morning of 14 August 2005, a Greek Air Force F-16 pilot pulled alongside a Boeing 737 orbiting quietly over the Aegean and looked into the cockpit. The first officer was slumped motionless in his seat. The captain’s seat was empty. Behind him, oxygen masks hung from the cabin ceiling.

The aeroplane had been flying itself for two and a half hours. Everyone aboard was already beyond saving, and the chain that put them there began with a switch left in the wrong position and a warning horn that meant two entirely different things.

L'interrupteur

Before the flight, a ground engineer carried out a pressurisation leak check. That requires the pressurisation mode selector to be moved to MANUAL. When he finished, he left it there.

The crew had three opportunities to catch it: the preflight scan, the Before Start checklist and the After Takeoff checklist. All three passed over it. Captain Hans-Jürgen Merten, 59, had 16,900 hours; First Officer Pampos Charalambous, 51, had 7,549. Neither noticed.

Climbing through 12,040 feet, the cabin altitude warning horn sounded.

One horn, two meanings

This is the design decision at the centre of the accident, and it is not a matter of interpretation. On that generation of 737, the intermittent horn that warns of dangerous cabin altitude in flight is the same sound as the horn that warns of an incorrect takeoff configuration on the ground.

The Greek investigation put it plainly: the two failures use the same warning horn sound. The US Federal Aviation Administration, issuing an airworthiness directive years later, referred to the dual purpose of the intermittent cabin altitude and takeoff configuration warning horn.

A crew who has spent a career hearing that noise on the ground, where it always means a configuration problem, will hear it in the climb and reach for the configuration problem. That is exactly what happened. It is also exactly what a US pilot had warned about in an anonymous safety report eight months earlier.

The crew called their operations centre about a takeoff configuration warning. The engineer on the ground asked whether the pressurisation panel was set to AUTO. Merten’s reply — his last transmission — was a question about the location of the equipment cooling circuit breakers.

He was already hypoxic. The question makes sense only as the reasoning of a man whose oxygen-starved brain had locked onto the wrong system and could no longer let go of it.

Two and a half hours

The autopilot flew the programmed route. At 10:40 the aircraft entered the holding pattern at the Kea VOR at 34,000 feet and began to circle. It circled for about seventy minutes.

Two F-16s of the Hellenic Air Force were scrambled at 11:05 and made visual contact on the sixth orbit.

At 11:49 someone entered the cockpit. Andreas Prodromou was a flight attendant who held a British commercial pilot licence, though he was not qualified on the 737. He had kept himself conscious using a portable oxygen bottle — two litres a minute, an endurance of about two and a half hours.

He sat down in the captain’s seat and waved at the fighter alongside. He made three Mayday calls. They were recorded on the cockpit voice recorder and heard by nobody, because the radio was still tuned to Larnaca, hundreds of miles behind.

The left engine flamed out on fuel exhaustion almost immediately after he sat down. The right followed about ten minutes later. The investigators concluded his experience was insufficient to gain control, and it is hard to see what anyone in that seat could have done with two dead engines at that point.

A line pilot’s account of the accident and the warning-horn design that drove it.

What the report said, and what Boeing said

The Greek Air Accident Investigation and Aviation Safety Board published its report in October 2006. Among the latent causes it listed the ineffectiveness and inadequacy of measures taken by the manufacturer in response to previous pressurisation incidents on the type. Among its findings: that using the same aural warning for two different situations was not consistent with good human factors principles.

Boeing’s initial response was to decline. In 2003, asked by Irish investigators about adding a distinguishing light, the company said there were no provisions for such a light and no plans to offer one. In June 2006 it told the Greek board that a colour change could give the flight crew a misleading indication that another failure had occurred.

The fix arrived through regulation rather than goodwill. An FAA airworthiness directive published in February 2011 mandated two warning lights on the overhead panel for the 737 Classic fleet, with compliance required by March 2014. A second directive extended it to the Next Generation. The cost per aircraft was $4,438.

A minute-by-minute reconstruction of the two and a half hours the aircraft flew itself.

Why it still gets taught

Helios 522 is on every human-factors syllabus because it is not a story about incompetence. Two experienced pilots, an ordinary maintenance task and a familiar noise combined into an outcome none of them could reason their way out of — because the very thing that would have let them reason clearly was the thing they were losing.

Hypoxia does not announce itself. It removes judgement first and awareness of the loss along with it. The crew were not fighting for their lives; as far as they knew, they were troubleshooting a nuisance warning.

A single distinguishing light would have ended it in the climb. It cost less than five thousand dollars a set, and it took a hundred and twenty-one deaths and six years to become mandatory.

A full documentary reconstruction of the flight.

Sources: Hellenic Air Accident Investigation and Aviation Safety Board report 11/2006, US Federal Register (FAA ADs 2008-23-07, 2011-03-14, 2013-02-05), Aviation Safety Network, AFP