United Airlines Suffers from Fan Cowl ED (Error Dysfunction)

We have previously discussed a long running series of around 40 events when Fan Cowl Doors (FCD) were lost from Airbus A320 series aircraft, including:

In each case the cowls had inadvertently been left unlatched and this had not been subsequently detected before flight.

Damage to Tigerair Airbus A320-200 9V-TRH (Credit: TSIB)

Damage to Tigerair Airbus A320-200 9V-TRH (Credit: TSIB)

Airbus introduced a modification that would prevent the cowls being opened without inserting a mechanical ‘key’ attached to a long red streamer, that would normally be stowed on the flight deck and that could only be removed when the cowls were fully locked.

But remarkably a US airline fought the proposed Airworthiness Directive (AD).

United Airlines Responses to FAA NPRM

The airline responded as follows for the FAA Notice of Proposed Rulemaking (NPRM) to adopt the exiting EASA AD (AD 2016-0053 on IAE V2500 powered A320s had been issued in March 2016 and was followed by AD 2016-0257 on CFMI CFM56 powered A320s):

United Airlines (UAL) stated that it strongly disagrees with making the new latch keys installation mandatory. UAL stated that each one of the fan cowl door losses during takeoff can be attributed solely to human error.

The implication is that no design improvement is needed after 40 occurrences.

UAL explained that the mechanics are not correctly latching the fan cowl after maintenance and the flight crews are not checking that the latches are secured before departure.

A320 Fan Cowl Doors (Credit: via ANSV)

A320 Fan Cowl Doors (Credit: via ANSV)

This is undoubtedly true, but in a surprisingly they go on to say:

…instead of mandating the modification, UAL stated that more emphasis should be placed on addressing the root cause—not the design, but human error.

James Reason, Professor Emeritus, University of Manchester wrote in his classic 1997 classic Managing the Risks of Organizational Accidents that among some of the problems with error management are:

  • Focusing on the active failures (of people) not the latent conditions
  • Not being informed by current human factors thinking regarding error and accident causation

Human error is not itself a cause, but merely the start of a human factors investigation, as explained by Sidney Dekker in The Field Guide to Understanding Human Error – A Review (discussed in this book review The Field Guide to Understanding Human Error to the RAeS).

United are disappointingly focusing on what Reason called ‘the human condition’ and hoping to change it, something he argued was futile, but that “we can change the conditions under which people work“.

Perhaps United have never heard of the Murphy’s Law from the 1940s either.

United went on to complain that:

…adding another loose piece of equipment to be maintained and stored on the airplane would lead to operational complications.

That is true but in the scheme of operation of a modern airliner it is neither a disproportionate or novel complication.  According to the FAA:

UAL also noted that additional time would be added to accomplishing routine tasks after incorporation of the modification.

UAL contended that additional time would be required to access the cockpit, retrieve the key, and open the fan cowls, which would expose personnel and the airplane to further damage or harm.

They don’t specify what further damage / harm this could involve as non of these tasks are again unique.  More telling:

Mandating the modification, UAL argued, would impose an unnecessary financial and maintenance burden on operators that have proactively implemented alternate procedures.

The alternative being an independent inspection, which of course involves additional maintenance personnel, a cost and complexity that they don’t feel worthy of mentioning.

Its not clear what risk assessment was conducted under United’s Part 5 SMS or what human factors assessment methodology was used as no such assessment was submitted to the FAA, nor was any other data driven substantiation for their claims, according to the FAA.

Furthermore cowls have been lost from US A320s:

FAA Conclusions

From these statements, we infer that UAL was requesting that we withdraw the NPRM.  We do not agree with UAL’s request.

EASA, as the State of Design Authority for Airbus products, has determined an unsafe condition exists after conducting a risk analysis taking into consideration the in-service events in the worldwide fleet. We agree with EASA’s decision to mitigate the risk by mandating a new design that makes it apparent to the flight crew on a pre-flight walk-around that an FCD is not latched.

Regarding the concern about operational complications, we have determined that the safety benefits of the new design outweigh any potential complications.

We reviewed the available data, including the comments received, and determined that air safety and the public interest require adopting this AD with the changes described previously and minor editorial changes.

We have determined that these changes:
- Are consistent with the intent that was proposed in the NPRM for correcting the unsafe condition; and
- Do not add any additional burden upon the public than was already proposed in the NPRM.

Our Observations

The value of human centred design (HCD) is preventing the ability to release an aircraft in an undesired or unsafe condition.  As we have commented previously:

…controls that are entirely training and procedural will one day fail and the most effective way to control a hazard that can be triggered by a human error is to eliminate the potential for error whenever possible.  This may be using mistake-proofing features which the Japanese call ‘poke’-yoke’ (like the new key), or by changing how a task is accomplished…

A poorly argued, data free response that only focuses on the negatives of a mitigation to a frequently repeating event (especially when the negatives are relatively small negatives), that fails to consider contemporary thinking on human factors does not reflect well on an organisation’s approach to safety, and smacks of complacency.

See also:

UPDATE 25 January 2018: The NTSB release their report on Aruba Airlines A320-200, P4-AAA, which lost the outboard fan cowl from the right-hand V2527  engine during takeoff from Miami on 19 September 2016.

Reconstructed Fan Cowl Debris Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)

Reconstructed Fan Cowl Debris Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)

The night prior a routine weekly check was conducted by contracted maintenance organisation Miami Tech Aircraft Maintenance. This included opening the fan cowl doors to inspect the Integrated Drive Generator (IDG). Because the ramp area was dark, the mechanic who completed the work used a flashlight to verify the latches were flush and made sure he heard a click. A second mechanic verified that the latches were flush. The task was signed off in the Technical Log as complete but the Tech Log entry did not explicitly state that the cowls had been opened.   The next morning both an airline maintenance  supervisor and the first officer conducted walkarounds.  Neither noticed any abnormalities. The FO stated he bent down and checked that it was cowling was flush and latched.

Reconstructed Fan Cowl Debris Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)

Reconstructed Fan Cowl Debris Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)

After this occurrence, Aruba Airlines reported to the NTSB that they had taken the following actions:

  1. Embodied modification Goodrich Service Bulletin V2500-NAC-71-0325, a 1999 SB for a hold open device (it surprising that this modification, albeit non-mandatory, was not in place*)
  2. Maintenance personnel now ensure that an entry is made in the aircraft log to notify flight crews that the fan cowl doors were opened and closed to perform maintenance (surprisingly this was not already in place)
  3. Flight crews are now required to perform a close inspection of the latches when they see the log book entry and sign their compliance on the log book.

According to the airlines Director of Maintenance, they had also decided not to embody the more recent March 2016 EASA AD 2016-0053 as:

Aruba Airlines lease their aircraft, and because the aircraft would be returned prior to the 2019 compliance date, they were not going to comply with the AD.

A UK company was contracted to assess ADs for Aruba Airlines. Aruba Airlines received the assessment in July 2016, four months after the AD was published and determined they would not to embody it just 1 day later.

It is noteworthy that the NTSB report is disappointingly lightweight compared to the recent UK AAIB, ANSV and TSIB reports, with very little discussion of the HF aspects (though it could be argued this is a sign of a well understood problem).

Latche from Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)

Latch from Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)

After this report came out ASN issued this list of past occurrences:

UPDATE 21 January 2018: Human Factors of Dash 8 Panel Loss, Maintenance Human Factors in Finnish F406 Landing Gear Collapse  and When Down Is Up: 747 Actuator Installation Incident

UPDATE 11 February 2018: Lost in Translation: Misrigged Main Landing Gear

UPDATE 11 March 2018: EC120 Forgotten Walkaround

UPDATE 24 June 2018: B1900D Emergency Landing: Maintenance Standards & Practices  The TSB report posses many questions on the management and oversight of aircraft maintenance, competency and maintenance standards & practices. We look at opportunities for forward thinking MROs to improve their maintenance standards and practices.

UPDATE 25 August 2018: Crossed Cables: Colgan Air B1900D N240CJ Maintenance Error  On 26 August 2003 a B1900D crashed on take off after errors during flying control maintenance. We look at the maintenance human factor safety lessons from this and another B1900 accident that year.

UPDATE 8 November 2018: A Vueling A320-200, EC-MDZ, lost the cowls from its left hand V2527 on take off from Bilbao.  Debris became stuck in the left main landing gear without affecting retraction or lowering.  Debris also punctured a fuselage fairing (images).

UPDATE 30 November 2018: A Frontier A320-200, N227FR, suffered a left hand CFM56-5B4/P cowling failure shortly after departing from Las Vegas (video).  Of note is the thrust reverser C-duct, further aft, is also open.

frontier cowl


Maintenance Observation Program

Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:

mop

Aerossurance can provide practice guidance and specialist support to successfully implement a MOP.


Aerossurance will be presenting at EASA‘s 11th Rotorcraft Symposium on Cologne on 5 December 2017 on human centred design (HCD) for rotorcraft.  This presentation will be live streamed.

easa logo

 

UPDATE 2 March 2018: An excellent initiative to create more Human Centred Design by use of a Human Hazard Analysis (HHA) is described in Designing out human error

HeliOffshore, the global safety-focused organisation for the offshore helicopter industry, is exploring a fresh approach to reducing safety risk from aircraft maintenance. Recent trials with Airbus Helicopters and HeliOne show that this new direction has promise. The approach is based on an analysis of the aircraft design to identify where ‘error proofing’ features or other mitigations are most needed to support the maintenance engineer during critical maintenance tasks.

The trial identified the opportunity for some process improvements, and discussions facilitated by HeliOffshore are planned for early 2018.

A systems approach in healthcare:


Aerossurance has extensive air safety, operations, airworthiness, human factors, aviation regulation and safety analysis experience.  For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com