Olympic Airways Flight 3838 was a flight operating for the Hellenic Air Force that experienced multiple pilot-induced oscillations while over southern Romania on 14 September 1999, killing seven people. The aircraft—a Dassault Falcon 900B flying from Ellinikon International Airport in Athens, Greece—was flying to Bucharest Henri Coandă International Airport in Bucharest, Romania, for the Interbalkan Conference of Foreign Ministers and was carrying Greek deputy foreign minister Giannos Kranidiotis. While descending through 15,000 ft (4,600 m), the autopilot disconnected, causing an unfavorable stabilizer trim situation. In response to the disconnection, the pilot flying attempted to correct the pitch of the aircraft by use of the control column. However, this resulted in ten separate pitch oscillations with g-forces that exceeded the maneuvering load factor for the aircraft. As a result, six of passengers on board, including Kranidiotis, were killed and one additional passenger died three days after the accident. The investigation, conducted by the Romanian Civil Aviation Inspectorate, concluded several factors that led to the accident. As the aircraft was climbing out of Athens, the pilots received a warning related to the aircraft's pitch system. The, the pilots did properly identify and evaluate the failure and used inappropriate checklists only designed for training. As the aircraft was descending, the pilot flying exerted enough force on the control column to disconnect the autopilot. The continued force on the control column led to the beginning of the pilot-induced oscillations and the passengers not wearing their seatbelts during the oscillations resulted in widespread injury.

The aircraft involved in the accident was a 12-year-old Dassault Falcon 900B, with registration SX-ECH and manufacturer serial number 026. It was powered by three Honeywell TFE-731 turbofan engines. The aircraft was registered to the Hellenic Air Force but operated by Olympic Airways on the day of the accident.

The primary flight controls on the Dassault Falcon are hydraulic-powered. Control inputs from the cockpit go through a series of physical rods and bellcranks that cause the movement of servoactuators in the rudder, elevators and ailerons. Artificial flight-control feel on the flight controls is achieved through the artificial-feel unit (AFU). One part of the AFU is the automatic spring-load adjusting system, known as the Arthur Q unit (Arthur unit), which adjusts the artificial feel on the control column depending on the elevator position and airspeed. At low airspeeds, the Arthur unit adjusts the artificial feel to require little force to move the control column and elevators, while at high airspeeds, the Arthur unit adjusts the artificial feel to require high force to move the control column and the elevators. A system called the box Arthur pitch system (BAP) monitors the difference between the position of the Arthur unit actuator and the position of the horizontal stabilizer. If the difference between the two passes a certain threshold, a lock will activate, a "PITCH FEEL" warning light will activate in the cockpit, and the Arthur unit will revert back into the low-speed position. The "PITCH FEEL" light will deactivate when the slats are extended or when the airspeed is less than or equal to 210 kn (390 km/h).

The aircraft was flown by two captains. The pilot-in-command (PIC) and pilot flying was 46-year-old Yiannis Androulakis. Androulakis had 8,239 total flight hours, 270 of which were on the Dassault Falcon. The co-pilot (F/O) and pilot not flying was 44-year-old Grigoris Sinekoglou. Sinekoglou had 7,465 total flight hours, 231 of which were on the Dassault Falcon. Both captains had valid airline transport pilot licences issued by the Hellenic Civil Aviation Authority. Additionally, they had substantially more experience and passed proficiency checks on the Boeing 737-400.

In addition to the two members of the flight crew and the flight attendant, the Dassault Falcon was carrying Giannos Kranidiotis, the deputy foreign minister of Greece. In addition to him was his 23-year-old son, his personal guard, a cameraman from the Hellenic Broadcasting Corporation (ERT), two ERT journalists, the director of the minister's office, a journalist from Vradyni, a minister advisor, the wife of the foreign ministry spokesperson, and an aircraft engineer. All were on board for a flight to the Interbalkan Conference of Foreign Ministers that was to be hosted in Bucharest.

On 14 September 1999, SX-ECH was scheduled to depart Ellinikon International Airport in Athens at 18:00 UTC to arrive in Bucharest Henri Coandă International Airport in Bucharest at 19:18 as OAL 3838, using the Olympic Airways ICAO airline code and the Olympic Airways call sign. Pre-flight checklists started at 16:50 and the passengers started boarding at 17:45. The aircraft then took off from runway 33 at Athens at 18:16, and the autopilot was engaged 1 minute and 30 seconds later. During the climb and after the flaps and slats were retracted, the "PITCH FEEL" warning light illuminated on the cockpit warning panel. Captain Androulakis disengaged the autopilot in response, checked the forces on the control column, and reengaged autopilot. However, the warning light remained on for the rest of the climb and cruise. At 19:03, the flight started its descent from 40,000 ft (12,000 m) to 15,000 ft (4,600 m) with the autopilot engaged in vertical speed mode. During the descent, the airspeed increased from 240 kn (440 km/h) to 332 kn (615 km/h). 12 minutes later, First Officer Sinekoglou requested further descent clearance from air traffic control (ATC) to 5,000 ft (1,500 m). However, soon after passing through 15,000 ft (4,600 m), the autopilot disconnected, and Captain Androulakis assumed manual control of the aircraft. During the next 24 seconds, aircraft experienced 10 pitch oscillations. During the oscillations, the g-forces sustained reached up to +4.7 g and -3.26 g, which exceeded the maneuvering load factor limits on the Dassault Falcon 900 of +2.6 g and -1 g. In the cabin, the passengers without their seatbelts on were thrown out of their seats along with cabin furniture such as tables and armchairs. Collisions with other objects in the cabin and the cabin celling resulted in serious injury and the death of six people, including Kranidiotis. Captain Androulakis was able to recover from the upset after 24 seconds after reducing power to the engines and descending to 13,000 ft (4,000 m). First Officer Sinekoglou declared an emergency to ATC, stating that they had control problems. ATC provided radar vectors for a visual approach to land on runway 08R at Bucharest Airport, where it landed uneventfully at 19:33. The aircraft taxied to the VIP terminal at the airport where emergency services were provided.

Injury type	Passengers	Crew	Total
Fatal	7	0	7
Serious	1	1	2
Minor/None	2	2	4
Total	10	3	13

In addition to Kranidiotis, five other people were killed during the upset. They were Kranidiotis' son Nikolas, ERT journalists Dimitris Pantazopoulos and Nina Asimakopoulou, Kranidiotis' personal guard Nikos Asimakopoulos, and aircraft engineer Michalis Papadopoulos. Three days after the accident, ERT cameraman Panagiotis Poulos died in a hospital in Greece due to head and chest injuries.

The aircraft structure was not damaged with the exception of a crack located in the upper fuselage caused by a catering container being ejected from its usual place in the cabin. In the cockpit, the left armrest on the right-hand (first officer's) seat collapsed, several circuit breakers on the circuit breaker panel broke, and several pushbuttons on the cockpit upper panel had traces of blood. The investigation described the passenger cabin as being destroyed. Interior furnishings such as tables and armchairs were severely damaged. Parts from the luggage compartment and aft lavatory were thrown throughout the cabin, piled up on top of one another. Celling light panels, newspapers, dishes, and cellphones covered the cabin floor. In the right galley, several drawers and doors were detached from their hinges along with sink railings. The passenger oxygen masks were out of their compartments and most of the armrests on the passenger seats were ripped off or broken. Additionally, the floor panels, especially near the back of the cabin, were damaged or destroyed.

The investigation into the accident was led by the Romanian Civil Aviation Inspectorate, as the accident occurred in Romanian territory. Assisting in the investigation was the Hellenic Civil Aviation Authority, representing the state of registration of SX-ECH (Greece), the Bureau of Enquiry and Analysis for Civil Aviation Safety, representing the state where the aircraft was manufactured (France), the National Transportation Safety Board, representing the state where the autopilot was manufactured (United States). Additionally, representatives from Dassault Aviation, Honeywell, and Olympic Airways provided technical assistance to the investigation.

The aircraft was carrying two flight recorders, a cockpit voice recorder (CVR) and a digital flight data recorder (DFDR). Both recorders were sent to the German Federal Bureau of Aircraft Accident Investigation (BFU) for analysis. However, the CVR had several defects, such as the tape being broken in two parts, the tape showing strong abrasion, and the magnetic recording heads being worn out. As a result, the CVR did not record any data and it was determined that the unit was unserviceable and most probably broken long before the day of the accident.

The DFDR was serviceable and was analyzed by the BFU and then the Air Accidents Investigation Branch of the United Kingdom after some erroneous data was analyzed initially. On the DFDR, the autopilot was disengaged at 19:14:45 UTC, although it did not record why it disengaged. At time of the disengagement, the aircraft's indicated airspeed was 332 kn (615 km/h), the altitude was 15,134 ft (4,613 m), and the control column being pushed from 0.72° to -3.06°. Additionally, the horizontal stabilizer position was recorded moving from 0.31° nose up to 0.11° nose down in the preceding four seconds. The DFDR recorded 10 pitch oscillations that occurred in the following 24 seconds.

Information regarding each oscillation according to the DFDR

Oscillation #	Length	Vertical acceleration (g)	Control Column Position	Pitch Angle	Other notes
1	1.5s	2.54 g to -0.79 g to 3.63 g	-3.06° to 14.38°	—	—
2	1.875s	-2.41 g to 4.46 g	-9.98° to 14.35°	-7.3° to 5.3°	—
3	1.875s	-3.14 g to 4.47 g	-9.41° to 17.4°	-9.4° to 6.6°	Oscillation with largest amplitude
4	2.125s	-2.81 g to 4.19 g	-8.31° to 11.83°	-4.8° to 4.7°	18° left bank
5	2.625s	3 g to -3.27 g to 3.97 g	6.2° to 1°	14° to -11°	20° right bank, engines reduced from 60% N1 to 40% N1
6	2.5s	-2.4 g to 3.58 g	-6.7° to 18°	13.3° to 0°	22° left bank
7	3s	-1.03 g to 3.23 g	4° to 5° to 17°	16° to -2.3° to 7.3°	41° left bank to 30° right bank
8	2.875s	-1.52 g to 2.84 g	-1° to 4.6°	12.3° to -4.3° to 14.3°	Aircraft laterally stabilized (0° bank)
9	2.25s	-2.13 g to 2.92 g	-6.6° to 12°	-4.3° to 1°	—
10	3.5s	-1.55 g to 1.79 g	—	—	Control column inputs anti-phase (countering) with oscillations
Source:

The DFDR showed that after the 10th oscillation, the captain was able to recover the aircraft after applying a continuous pull up input on the control column. The aircraft recovered with an airspeed of 225 kn (417 km/h) before the DFDR data was rendered invalid by the reconnection of generator one and the battery, which were accidentally disconnected during the event.

An analysis of the flight guidance computers showed that within a second before the autopilot disconnected, the horizontal stabilizer moved into a nose down trim position. This resulted in the rate of pitch change moving from 0.5° nose up to 2.3° nose down. At this time, the elevator tachometer—which indicates how fast and in what direction the control column moves vertically–indicated that the captain was moving the control column to command a nose up input, which was against the autopilot was commanding. The disconnection of the autopilot and one of the flight guidance computers was supported by the disengagement of the servo mechanism inside the elevator tachometer, which indicated only residual motion inside the cable drums of the instrument and the lack of accurate data measuring. In the last 1.5 seconds before the autopilot disconnection, the autopilot's vertical mode changed from vertical speed to pitch hold mode, the latter being the default vertical mode for the autopilot. The investigation, however, was not able to determine why it changed or what impact it had on the accident.

The investigation questioned whether the pilot's previous experience on the Boeing 737-400 might have played a role in the autopilot disconnection. On the Dassault Falcon, any continuous pitch input on the control column will result in an autopilot disconnection. On the Boeing 737-400, there are two relevant autopilot modes: Control Wheel Steering (CWS) and command mode (CMD). When in CMD, significant longitudinal and/or lateral inputs on the control column will revert to autopilot to CWS into pitch mode or roll mode depending on how CMD was deactivated. As long as only one channel (pitch or roll) is disengaged at once, the autopilot will still remain engaged and counteract any inputs the pilots make. Considering that the autopilot on flight 3838 was disconnected through an input on the control column, the investigation concluded that the pilots reverted back to flying knowledge learned on the Boeing 737-400 and unintentionally disconnected the autopilot using a control input that wouldn't disconnect on the 737-400 but would on the Dassault Falcon.

During the climb out from Athens and after the flaps and slats were retracted, the Aruthur unit failed in the high-speed configuration and moved to the low-speed configuration, as it was designed to do. Captain Androulakis then executed a checklist for verifying the Arthur unit's position. During this time, where he moved the control column to check for the forces he felt, Captain Androulakis described the forces as feeling normal, although he was unable to proper identify that the Arthur unit was in its low-speed configuration. This was a result of the only checklist on the aircraft being designed for training purposes only, not for actually flight situations. Due to the misidentification of the Arthur unit's position, the captain incorrectly believed that it would behave as if it were in the high-speed configuration; as in needing a large amount of force to move the control column and elevators. However, in the low-speed configuration, only light forces on the control column are needed to move the elevators. As a result of the factors mentioned above, Captain Androulakis used high forces on the control column in an aircraft configuration where high forces would result in extreme aircraft oscillations.

The cause of the failure itself was traced back to inadequate maintenance. Between November 1995 and March 1999, eight "PITCH FEEL" warnings and failures of the Arthur unit were recorded. Each time, various maintenance actions were performed (such as the reset of the BAP), but not once was the issued referred back to Dassault Aviation. Additionally, the investigation determined that the risks posed by a "PITCH FEEL" malfunction were assessed improper.

In their final report, the Civil Aviation Inspectorate determined four "casual factors" that led to the fatal accident:

1. Inadequate risk assessments of the PITCH FEEL malfunctions.
2. Overriding of the A/P on the pitch channel by the crew.
3. Inappropriate inputs on the control column at high speed and with Arthur unit failed in “low-speed” mode leading to Pilot Induced Oscillations.
4. Seat-belts not fastened during descent flight phase.

In June 2002, Captain Androulakis was convicted guilty of manslaughter by the Misdemeanor Court of Athens and was sentenced to five years in prison. Two years later, the Athens Court of Appeals reduced his sentence by 25 months and gave a 35-month suspended sentence, although they found him guilty of seven counts of manslaughter and two counts of bodily harm. They stated that he had not flashed the fasten seat belt sign on and did not do enough to prevent injury to the passengers.

• Provincetown-Boston Airlines Flight 1039 (1984) – Crashed after malfunction of pitch system
• China Eastern Airlines Flight 583 (1993) – In-flight upset that killed two passengers due to pilot inputs after slat deployment
• Loganair Flight 6780 (2014) – Serious incident after pilots commanded the aircraft to pitch differently to the autopilot

External image
Pre-accident pictures of aircraft at JetPhotos.com

• News coverage of Kranidiotis' death in Greek on YouTube