A319 Double Cowling Loss and Fire – AAIB Report
The UK Air Accidents Investigation Branch (AAIB) has published their report into an Airbus A319 that lost both engine fan cowlings and suffered an associated fire on take-off from London Heathrow in 2013.
We look at the circumstances of the previous evening’s maintenance on this aircraft, which has lessons for other operators and maintenance organisations. In particular, we look at the maintenance human factors that resulted in the cowlings being left unlatched, including an aircraft ‘swap-error’ and maintainer fatigue / alertness. We had previous discussed the series of incidents with the A320 family cowlings and planned design improvements, in this article: Maintenance Human Factors: The Next Generation.
At 07:16Z on 24 May 2013, British Airways A319 G-EUOE, powered by IAE V2500s, departed runway 27L at London Heathrow. At rotation, the fan cowl doors from both engines detached, damaging the airframe and puncturing a fuel pipe on the right-hand (or Number 2) engine.
The flight crew observed: engine thrust control degradation, the loss of the yellow hydraulic system, and a significant fuel leak. They declared a PAN, with the intention of returning to Heathrow once they had fully assessed the situation using the T-DODAR (Time, Diagnose, Options, Decide, Act/Assign, Review) philosophy.
During the approach to land on runway 27R, a fire developed on the right-hand engine and the crew declared a MAYDAY. Both engine fire extinguisher bottles were discharged and the right-hand engine was shut down (albeit without the normal crew cross-check). The intensity of the fire reduced but it did not abate. The other engine continued to perform normally.
The aircraft landed safely at 07:45Z, coming to rest on the runway where the airport fire service extinguished a small fire on the right-hand engine. The 80 persons on board evacuated in 64 seconds without injury using the left-hand escape slides. There had been a short delay to evacuation however as the left-hand engines had been left running.
The AAIB determined that both engine fan cowlings had been left unlatched after maintenance the previous evening and this that was not spotted prior to take-off. The investigation identified the following causal factors:
The technicians responsible for servicing the aircraft’s [Integrated Drive generators] IDGs did not comply with the applicable [Aircraft Maintenance Manual] AMM procedures, with the result that the fan cowl doors were left in an unlatched and unsafe condition following overnight maintenance. The pre-departure walk-around inspections by both the pushback tug driver and the co-pilot did not identify that the fan cowl doors on both engines were unlatched.
The investigation identified the following contributory factors:
The design of the fan cowl door latching system, in which the latches are positioned at the bottom of the engine nacelle in close proximity to the ground, increased the probability that unfastened latches would not be seen during the pre‑departure inspections. The lack of the majority of the high-visibility paint finish on the latch handles reduced the conspicuity of the unfastened latches. The decision by the technicians to engage the latch handle hooks prevented the latch handles from hanging down beneath the fan cowl doors as intended, further reducing the conspicuity of the unfastened latches.
Maintenance Aspects – Introduction
The AAIB report (both in the main body and Appendix 6, written by a Human Factors Advisor) highlights a number of organisational factors that influenced this accident. These have been addressed by the operator (see page 90 of the report).
Maintenance Aspects – The Team and Tasks
A two man team had been allocated 6 aircraft, including G-EUOE, the previous evening. They were tasked to do a daily inspection on each and a weekly inspection on two of the aircraft (G-EUOE and A321 G-EUXI). This includes checking the IDG oil level. Due to the dynamic nature of line maintenance operations, none of the 6 aircraft were on the stands they were originally expected to have been parked at, necessitating handwritten amendments to the task sheets. These were ordered by the original stand numbers.
During the weekly inspection on G-EUOE the pair found the oil levels were low, but did not have the equipment to top it up in their van.
Maintenance Aspects – Aircraft Misidentification / Swap Errors
Having completed other tasks and been able to locate available equipment (on a second attempt) the technicians intended to return to G-EUOE. In fact they went to G-EUXI without realising their misidentification of both stand and aircraft. They were surprised the cowlings were closed, but assumed another team must have worked on the aircraft in the interim. Finding the oil levels were satisfactory, they mistakenly believed that during the 4 hours since their original inspection, that as the engine had cooled, more oil had returned to the reservoir. They did not realise that they were inspecting a different aircraft (classified as a ‘slip’ by the HF Advisor). The AAIB comment:
The type of error, described in this report as an ‘aircraft swap error’, was classified by the human factors specialist as a ‘slip’, in that the technicians had intended to return to G-EUOE, but their actions did not match the plan. Slips are typically the result of automatic actions – well-practised activities that are not consciously monitored by the human and are therefore vulnerable to being miscued by stimuli in the environment, such as design or layout of signs and interfaces.
The HF Advisor comments that because by this point of the shift the two technicians were travelling independently in different vans, they had less chance to cross-check their paper work and when one stopped at G-EUXI the other pulled in behind him. Both aircraft were coincidentally on relatively rare ‘double stands’, again adding to the potential for confusion. The operator’s occurrence reporting database contained no reports of previous aircraft misidentifications / swap errors. However, during AAIB interviews with 5 maintenance personnel, all had experienced previous cases. They generally attributed these to aircraft not being on the allocated stand and the similar appearance of aircraft in the same fleet. The AAIB analysis is that these matters were not being reported because they were seen as ‘normal’.
Maintenance Aspects – Tech Log Entries
Previous misidentifications had generally been caught when the technicians went to sign the Tech Log. The AAIB commented:
Had an open entry for the required IDG oil uplift been made in G-EUOE’s technical log, as required by the operator’s procedures, it is unlikely that it would have materially affected the outcome in this instance, as the technical log was subsequently removed from the aircraft and taken to the maintenance office in Terminal 5A, where it was eventually completed by Technician A.
The procedure on this fleet was that the Tech Log would be removed for review during each weekly inspection, however no one could explain to the AAIB why the procedure differed on this fleet from other fleets.
Maintenance Aspects – Open Cowlings
Unfortunately the cowlings on G-EUOE had been left open when the oil had been checked earlier in the evening.
AAIB note that:
The fan cowl doors were left unlatched because the technicians intended to return to the aircraft to service the IDGs after collecting the IDG gun and oil from stores. The AMM procedure calls for the hooks to be disengaged, allowing the handles to project lower beneath the cowl, thereby increasing their visibility. The decision by both technicians to leave the latches unlocked but with the latch handle hooks engaged was made because they perceived that, in this configuration, the latch handles do not protrude as far below the cowl, thus reducing the risk of personal injury.
In Appendix 6, the HF Advisor does not mention that occupational safety reason but comments that this was done for ‘efficiency’ and was a routine violation (i.e. a common practice there and in other locations). They also did not place a warning notice in either aircraft’s cockpit as required by the AMM procedure when opening fan cowls. This could have provided a warning to the incoming flight crew. With the benefit of hindsight, the cowlings were visibly open in photographs coincidentally taken during the pre-flight. This was not identified by either the tug driver or by the co-pilot during his external walk-around. The AAIB reports suggests that training was lacking in certain key details.
The operator’s occurrence reporting database contained details on one missed inspection in 2013, two of unlocked cowlings being detected on walk around in 2010 and two other cases in 2007 for which the AAIB provide no further detail. There were no reports that related to non-compliance with the AMM.
Maintenance Aspects – Personnel Fatigue / Alertness
Both technicians were working overtime, in fact 15% of that night shift were working overtime that night. This was not unusual due to under manning which had been occurring for several years. In fact one internal audit in July 2011 had raised the issue of manning level and the management of fatigue and alertness. In response to a finding from that audit on the latter point, the response was that managing fatigue was a shared responsibility and it was stated that (unspecified) ‘limitations’ had been promulgated. At the time of the accident, one technician had worked 70.2 hours over 7 days, the other 55.8 hours. They also had not achieved the rest periods recommended in a CAA sponsored research study (CAA Paper 2002/06 – The Folkard Report). When applying the Health and Safety Executive (HSE) 2006 fatigue and risk index tool to the first technician’s work and rest pattern over the previous 3 weeks, the results were a risk index twice the risk of the standard shift pattern and a 40% chance of “high levels of sleepiness”.
The AAIB comment that routine Human Factors continuing training was not successful at “providing shift planners with effective tools to manage fatigue”. This seems to have applied equally to individual technicians. The European Aviation Safety Agency (EASA) has made proposals on maintenance personnel fatigue risk management (a new rule – Part 145.A.47). The AAIB note that the operator’s procedures already ‘closely aligned’ with the proposed Acceptable Means of Compliance, resulting in a recommendation to EASA for more demanding requirements.
Cowling Design Aspects
Open cowls is not simply an issue of maintenance procedures and practices but also of design. We had previous discussed this aspect in our article: Maintenance Human Factors: The Next Generation. AAIB comment that:
This, and numerous other similar events, shows that Airbus A320-family aircraft have a history of departing with the fan cowl doors unlatched. It is also evident that, in practice, the flight crew walk-around inspection is not entirely effective in detecting unlatched fan cowl doors and therefore a design solution is necessary. Enhanced methods of detection through design solutions are being considered by the aircraft manufacturer.
To date there have been 38 losses of fan cowls in the A320 family, on both V2500 and CFMI CFM-56 engine types. An earlier attempt at a design solution had been to use contrasting paint on the latches. AAIB report:
Inspection of the fan cowl door latches from G-EUOE showed that the latch high visibility paint was mostly missing from the latch handles. That which remained was partially obscured by blue paint overspray. In this condition, the open latch handles would have been significantly less conspicuous than if they had been painted according to SB V2500-NAC-71-0227. Therefore their condition was a contributory factor in reducing the prominence of the open latches.
The AAIB discuss the actions under taken or planned by Airbus an EASA on page 93.
Fire and CRM
The AAIB also discuss the source of the fuel leak, the possibilities for fuel leak detection systems and Crew Resource management issues. The AAIB also discuss that right-hand engine was shut down by the Commander without verification by the Co-Pilot and a non-standard split of workload. These will not be discussed further here.
AAIB Safety Recommendations
As a result of this investigation, five Safety Recommendations have been made concerning (in addition to one that resulted in an Airbus alerts to all operators):
- Fatigue risk management (to EASA);
- Fan cowl door position warnings (to EASA);
- Fan cowl door certification requirements (to EASA);
- In-flight damage assessments by cabin crew (to BA) and
- Aircraft evacuation procedures (to BA).
UPDATE 28 March 2016: EASA issue AD 2016-0053 on V2500 powered A320s for a Fan Cowl Door Latch with Key and Flag Modification.
UPDATE 11 April 2016: AAIB Safety Recommendation Update.
UPDATE 21 July 2016: The AAIB has issued a further update.
There is no reference in the AAIB report to any form of risk assessment having been conducted on aircraft misidentification or cowling latching prior to the accident by the operator (certainly unlatched A320 cowlings had featured in a series of high profile incidents globally before then). The AAIB imply that internal audits were primarily focused on finished work (product audits) rather than examining work underway (process audits). There is also no mention of supervisory oversight of individuals or any means for workforce initiated improvement activities other than by raising safety reports.
An ‘engineering safety culture team’ has since been created by the operator. As described it will “observe…attitude to safety” during on-the-job competence assessments conducted in addition to their internal audit programme. In practice we must assume they will observe (external) ‘behaviour’ rather than (internal) ‘attitudes’. No other details are provided other than, encouragingly, the team will help facilitate improvements.
Some reading this report will also say that safety reporting needs to be improved and indeed it can and should be in every organisation. In fact on the very same day that this report was issued the UK Military Aviation Authority (MAA) issued the Service Inquiry report on a fatal Army Air Corp Lynx AH9 helicopter accident in Afghanistan, which identified lower than expected safety reporting. A previous Service Inquiry on a loss of control incident involving a Royal Air Force A330 Voyager made a similar comment about the lack of reporting of lost articles in the transport fleet.
Traditionally commentators often suggest that under-reporting is due to fear of blame. This is just one factor. Embarrassment rather than fear may be a factor even when there is a just culture. The time or complexity of reporting may be a factor (and certainly overstretched personnel will be less likely to report). Another factor can be scepticism that reports will be acted upon and improvements made (perhaps a factor that will be minimised by the work of the culture team). Noticeably, in this case, the AAIB comment that it was things that were considered ‘normal’ that were not being reported.
The concept of ‘Normalisation of Deviance’ was one of three key factors in Diane Vaughan’s classic analysis of the Challenger Launch Decision. It helped to explain why the unexpected (in that case O-ring damage), when observed frequently, became to be seen as routine rather than a warning sign. Another of Vaughan’s concepts, that of a ‘Culture of Production’ may also be relevant here in a stretched team being relied upon to deliver night after night. Her third factor, ‘Structural Secrecy’, helps to explain how some people (in this case the shift technicians) are aware of data that others (in this case the management team) were apparently are not.
We hope this summary has been of interest but it is still worth reading the AAIB report.
According to press reports a Tigerair Airbus A320, suffered a cowling loss on take off from Singapore on 16 October 2015.
UPDATE 19 October 2015: See our article on enhancing human performance in maintenance: Aircraft Maintenance: Going for Gold?
UPDATE 12 September 2016: Uncontained CFM56-7 Failure: Southwest B737-700 27 August 2016
UPDATE 16 October 2016: BA B747 Landing Gear Failure Due to Omission of Rig Pin During Maintenance
UPDATE 11 December 2016: ANSV Report on EasyJet A320 Cowling Loss: Maintenance Human Factors
UPDATE 16 December 2016: EASA issue AD 2016-0257 on CFM56 powered A320s for the Fan Cowl Door Latch with Key and Flag Modification.
UPDATE 4 December 2017: United Airways Suffers from ED (Error Dysfunction). The US airline shows a strange grasp of human factors principles and argues AGAINST a human centred design change intended to address a long running series of maintenance errors.
UPDATE 21 January 2018: Human Factors of Dash 8 Panel Loss
UPDATE 25 January 2018: The NTSB release their report on Aruba Airlines A320-200, P4-AAA, which lost the outboard fan cowl from the right-hand V2527 engine during takeoff from Miami on 19 September 2016.
The night prior a routine weekly check was conducted by contracted maintenance organisation Miami Tech Aircraft Maintenance. This included opening the fan cowl doors to inspect the Integrated Drive Generator (IDG). Because the ramp area was dark, the mechanic who completed the work used a flashlight to verify the latches were flush and made sure he heard a click. A second mechanic verified that the latches were flush. The task was signed off in the Technical Log as complete but the Tech Log entry did not explicitly state that the cowls had been opened. The next morning both an airline maintenance supervisor and the first officer conducted walkarounds. Neither noticed any abnormalities. The FO stated he bent down and checked that it was cowling was flush and latched.
After this occurrence, Aruba Airlines reported to the NTSB that they had taken the following actions:
- Embodied modification Goodrich Service Bulletin V2500-NAC-71-0325, a 1999 SB for a hold open device (it surprising that this modification, albeit non-mandatory, was not in place)
- Maintenance personnel now ensure that an entry is made in the aircraft log to notify flight crews that the fan cowl doors were opened and closed to perform maintenance (surprisingly this was not already in place)
- Flight crews are now required to perform a close inspection of the latches when they see the log book entry and sign their compliance on the log book.
It is noteworthy that the NTSB report is disappointingly lightweight compared to the recent UK AAIB, ANSV and TSIB reports, with very little discussion of the HF aspects (though it could be argued this is a sign of a well understood problem).
UPDATE 11 March 2018: EC120 Forgotten Walkaround
UPDATE 8 November 2018: a Vueling A320-200, EC-MDZ, lost the cowls from its left hand V2527 on take off from Bilbao. Debris became stuck in the left main landing gear without affecting retraction or lowering. Debris also punctured a fuselage fairing (images).
For expert support you can trust on maintenance human factors, risk assessment, safety culture development and SMS implementation, contact us at: firstname.lastname@example.org
Follow us on LinkedIn and on Twitter @Aerossurance for our latest updates.
Maintenance Human Factors Resources
Aerossurance is proud to have sponsored a recent Royal Aeronautical Society (RAeS) seminar, Maintenance Human Factors: The Next Generation, at Cranfield University. Presentations from that seminar are available here.
Aerossurance has also previously written about a number of human factors / continuing airworthiness issues:
- Professor James Reason’s 12 Principles of Error Management
- How To Develop Your Organisation’s Safety Culture
- Fatal $16 Million Maintenance Errors
- Inadvertent Fire Bottle Discharge During Maintenance
- FOD Damages 737 Flying Controls
- Cessna Citation Excel Controls Freeze
- B767 Engine Fire – Ignition from Misrouted / Chaffed Cables
Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:
Aerossurance can provide practice guidance and specialist support to successfully implement a MOP.
…seeks to provide information on the common causes where maintenance error has been a contributory factor in incidents and occurrences reported to the CAA. The aim is to provide industry with a more up to date set of data which they can review and, where appropriate, use to complement their own analyses as part of their Safety Management Systems and Human Factors Continuation Training Programmes.
Unfortunately, in relation to providing an ‘up to date set of data’, this report, originally due for publication in 2013, was delayed until now and only includes data up to 2011.
UPDATE 16 February 2017: Aerossurance is delighted to be sponsoring an RAeS HFG:E conference at Cranfield University on 9 May 2017, on the topic of Staying Alert: Managing Fatigue in Maintenance. This event will feature presentations and interactive workshop sessions.
UPDATE 24 June 2018: B1900D Emergency Landing: Maintenance Standards & Practices The TSB report posses many questions on the management and oversight of aircraft maintenance, competency and maintenance standards & practices after this serious incident. We look at opportunities for forward thinking MROs to improve their maintenance standards and practices.
UPDATE 25 August 2018: Crossed Cables: Colgan Air B1900D N240CJ Maintenance Error On 26 August 2003 a B1900D crashed on take off after errors during flying control maintenance. We look at the maintenance human factor safety lessons from this and another B1900 accident that year.
Aerossurance is pleased to be supporting the annual Chartered Institute of Ergonomics & Human Factors’ (CIEHF) Human Factors in Aviation Safety Conference for the third year running. We will be presenting for the second year running too. This year the conference takes place 13 to 14 November 2017 at the Hilton London Gatwick Airport, UK with the theme: How do we improve human performance in today’s aviation business?