News & Comment

B787 GEnx Fan Shaft Failure

Posted by on 11:12 pm in Accidents & Incidents, Design & Certification, Fixed Wing, Safety Management

B787 GEnx Fan Shaft Failure The very day a British Airways Boeing 777-200 G-VIIO suffered an uncontained GE GE90 engine failure and fire at Las Vegas, Nevada, the US National Transportation Safety Board (NTSB) coincidentally published the probable cause of another GE engine failure. The 2012 Failure On 28 July 2012 Boeing 787-8 Dreamliner VT-ANJ, ultimately destined for Air India, experienced a GE GEnx-1B67 contained engine failure (i.e. no debris penetrated the engine casing radially) during a taxi test by Boeing at Charleston International Airport (CHS), South Carolina.  There were no injuries, the airframe received extensive minor damage (from axially ejected debris) and the airfield was temporarily shut after the failure caused a grass fire. The ~8 feet (2.4 m) Fan Mid Shaft (FMS), made in Japan by IHI, which connects the fan and Low Pressure Compressor booster stages to the Low Pressure Turbine (LPT), had failed aft of the forward retaining nut. Consequently the LPT had migrated aft resulting in extensive secondary damage, by design, as the blades contacted the stationary guide vanes (thus preventing a overpseed of the unloaded LPT). The Investigation The NTSB investigation determined that: Examination confirmed separation of the FMS adjacent to the lock nut face located at the aft most full thread root. The fracture exhibited features indicative of multiple failure modes: one progressive, and one instantaneous. About 85 percent of the fracture surface exhibited features consistent with progressive fracture. The remaining fracture surface showed signs consistent with instantaneous failure by overstress. Further examination revealed features consistent with environmentally assisted cracking (EAC) specific to GE 1014 ultrahigh strength steel. The FMS threads and the retaining nut were coated with a dry film lubricant, and grease or engine oil was used as an assembly aid. Although a lead based dry film lubricant was previously used on GE engine fan mid shafts, during development of the GEnx engine, the design was changed to incorporate a lead free dry film lubricant [Everlube 9002], and graphite grease [MolyDag 254] instead of the previously used engine oil as an assembly aid. Testing of specimens taken from the FMS, and comparison to other dry film lubricants used previously on GE 1014 ultrahigh strength steel indicated that the dry film lubricant used on the incident FMS absorbed moisture at a higher rate. Additionally, the combination of dry film lubricant and graphite assembly grease was shown to increase the corrosion rate of GE 1014. The Continued Airworthiness / Safety Action GE expeditiously introduced an Ultrasonic Inspection (UI) to scan the forward end of the FMS in the area of the threads where the fracture had occurred.  A second cracked fan mid-shaft was discovered in mid-August 2012 on another GEnx-1B. The NTSB issued Safety Recommendations A-12-052 and A-12-053 to the Federal Aviation Administration (FAA) on 14 September 2012.  The NTSB Recommendation Letter suggested that AirBridgeCargo 747-8 Freighter VQ-BLR might have experienced a similar FMS failure on one of its GEnx-2B67 engines, resulting in a rejected take-off in Shanghai, China on 11 September 2012.  However within two weeks they had determined that a different LPT failure mode had occurred. Coincidentally Air India took delivery of their second 787 on 19 September 2012. On 21 September 2012, the FAA published Airworthiness Directive (AD) 2012-19-08.  This AD required an initial ultrasonic inspection (UI) of the FMS before further flight and then a repetitive UI every 90 days. The AD applied to all GEnx- l B and GEnx-2B engines with particular part numbers of FMS...

read more

Gulfstream G-IV Take Off Accident & Human Factors

Posted by on 2:59 pm in Accidents & Incidents, Airfields / Heliports / Helidecks, Business Aviation, Design & Certification, FDM / Data Recorders, Fixed Wing, Human Factors / Performance, Safety Culture, Safety Management, Survivability / Ditching

Gulfstream G-IV Take Off Accident & Human Factors (N121JM) The US National Transportation Safety Board (NTSB) has highlighted a number of important human performance issues in a recent Board Meeting held to discuss a Gulfstream G-IV business aircraft accident.  UPDATE 24 September 2015: The full final report is now published. The Accident On 31 May 2014, 3 crew and 4 passengers died when G-IV N121JM, registered to SK Travel LLC, and operated by Arizin Ventures LLC under Part 91 rules, was destroyed at the joint civil/military Hanscom Field (BED) in Bedford, Massachusetts, after a night-time high speed rejected takeoff and runway excursion. Aerossurance discussed the preliminary findings of the investigation in July 2014: Focus on Gust Locks After US GIV accident.  The gust lock system is used to lock the elevator, ailerons and rudder when parked to protect against damage in gusting wind.  Indeed, the failure to unlock the gust locks prior to commencing take off was a critical failure. This NTSB video illustrates the take off: The aircraft overran the 2,137 m (7,011 feet) runway, collided with approach lights and a localizer antenna, went through the perimeter fence and ended up in a small ravine 564 m (1,850 feet) from the end of the runway, where the post crash fire took hold. Among the dead was Lewis Katz, co-owner of the US’s third-oldest daily newspaper. the Philadelphia Inquirer.  Katz died just days after agreeing a $88 million deal, with partner Jerry Lenfesto, be sole owners of the newspaper’s parent company. The flight crew were experienced.  The aircraft commander had >11,000 total flight hours (with > 1,600 hours on the G-IV) and the first officer >18,000 total flight hours (with >3,000 hours on the G-IV).  They had flown together for about 12 years, a fact which is worth noting when we discuss human performance matters below. The NTSB abstract on that accident is here. The NTSB determined that the probable cause of this accident was: … the flight crewmembers’ failure to perform the flight control check before takeoff, their attempt to take off with the gust lock system engaged, and their delayed execution of a rejected takeoff after they became aware that the controls were locked.   Contributing to the accident were the flight crew’s habitual noncompliance with checklists, Gulfstream Aerospace Corporation’s failure to ensure that the G-IV gust lock/throttle lever interlock system would prevent an attempted takeoff with the gust lock engaged, and the Federal Aviation Administration’s failure to detect this inadequacy during the G-IV’s certification. From the NTSB abstract and presentations we observe five human performance aspects to this accident: Human Performance Aspect 1 – Omitting to Disengage Gust Locks During the engine start process, the flight crew didn’t disengage the aircraft’s gust lock sustem.  This omission should not on its own be fatal as there where at other safeguards (one procedural, a status indication and a physical design feature) that should act as further risk controls. Human Performance Aspect 2 – Omitting a Flying Control Check The flight crew failed to perform a flight control check.  This procedural control would have alerted them that the controls remained locked.  It is noteworthy that when the NTSB reviewed flight data from the aircraft’s Quick Access Recorder (QAR), they discovered that this flight crew had failed to perform complete flight control checks before 98% of their previous 175 take offs.  To the NTSB this indicated that this omission was “habitual”. The NTSB comment that: SK Travel [sic – note not Arizin Ventures] flight operations manual required...

read more

Loss of MV Derbyshire 9th September 1980

Posted by on 4:44 pm in Accidents & Incidents, Design & Certification, Safety Management

Loss of MV Derbyshire 9th September 1980 On 9th September 1980 the Bibby Line OBO (oil/bulk/ore) carrier MV Derbyshire sank during Typhoon Orchid in the South China Sea.  All 44 people on board died.  The Derbyshire, at 90,000 gross registered tons, remains the largest UK registered ship ever to be lost at sea. Until 1994 the location of the wreckage was not know and so the initial 1980 inquiry was relatively inconclusive.  Following a survey of the wreck using the latest underwater search technology, a re-opened inquiry concluded in 2000 that a structural failure had occurred.  This removed unfounded accusations of error by the Captain and crew.  It also highlighted that vessels that only complied with the minimum requirements of the International Load Line Convention of 1966 posed an unacceptable risk to safety. This video describes the failure mechanism: UPDATE 9 August 2025: OceanGate Titan: Toxic Culture & Fatal Hubris Aerossurance has extensive safety management and accident analysis experience.  Contact us at: enquiries@aerossurance.com Follow us on LinkedIn and Twitter @Aerossurance for our latest...

read more

HTAWS Technology: Friend or Foe?

Posted by on 12:55 pm in Accidents & Incidents, Design & Certification, Helicopters, Human Factors / Performance, Regulation, Safety Management, Special Mission Aircraft

HTAWS Technology: Friend or Foe? Technology has great potential to reduce aviation risk.  The European Helicopter Safety Team (EHEST) issued a study in October 2014 on the safety value of technology. Terrain Avoidance and Warning Systems (TAWS) have proved highly effective at fixed wing Approach and Landing Accident Reduction (ALAR). On 20 February 2014, the Federal Aviation Administration (FAA) issued an extensive package of changes to Parts 91, 120 and 135 to improve Helicopter Emergency Medical Service (HEMS) safety that includes a requirement for Helicopter TAWS (HTAWS). While the adoption of  HTAWS offers great potential safety benefit, its introduction, like any new technology, needs to be carefully considered. It may be tempting to simply see the introduction of such equipment as an incremental improvement in safety and simply base introductory training, for example, on the avionic manufactures’ technical publications for the equipment.  However, there are wider potential impacts that need to be addressed when risk assessing the unintended consequences of introducing new technology.  For example reducing the risk of one accident type may heighten the risk of another unless additional mitigations are in place. One example of this phenomena has been the introduction of flight deck automation, the subject of a July 2014 the Royal Aeronautical Society Rotorcraft Group conference, Technology: Friend or Foe? which we discussed in a previous article.  A US HEMS accident in 2013 highlights an unintended consequence of HTAWS introduction. The Hospital Wing Accident On 22 October 2013, Airbus Helicopters AS350B3e (H125) helicopter N353HW, operated by the Memphis Medical Center Air Ambulance Service (doing business as Hospital Wing) was 18 minutes into positioning flight to collect a patient for an inter-hospital transfer, when it crashed near Somerville, Tennessee at 06:05 local time.  There was a post crash fire (a subject Aerossurance has discussed recently).  All three persons on board died. Two calls had been turned down during the night due to poor weather.  At an airport about 2 miles from the accident site, a few clouds were observed at 800 feet agl, and a broken ceiling existed at 1,200 feet agl.  As well as Garmin GNS530W TAWS the helicopter was equipped with Night Vision Goggles (NVGs) but was not equipped for operation under Instrument Flight Rules (IFR). In there final report the US National Transportation Safety Board (NTSB) state: …the helicopter was observed in a climb and in a right turn away from the observed course. The last data point indicated that the helicopter was on a course of 146 degrees and at 98 knots ground speed and at an altitude of 1,560 feet above mean sea level (msl) or about 1,116 feet above ground level (agl). A review of the helicopter’s ground track revealed two obstacles in the immediate vicinity, an unlit, nonoperational cellular tower, 140-feet tall, and a water tower, about 115-feet tall. Although recorded HTAWS data was not available, research and flight testing revealed that the pilot may have received an in-flight obstacle alert, prompting a climb. Considering the low clouds and night conditions that probably existed along the last segment of the flight’s track, it is likely that the pilot initiated a climb and inadvertently entered instrument meteorological conditions, where a loss of helicopter control occurred. The NTSB probable cause was: The pilot’s inadvertent encounter with night, instrument meteorological conditions while responding to an obstacle alert, resulting in an in-flight loss of helicopter control. The pilot was described by colleagues as “good pilot”, “well-liked” and “conscientious”. He flew...

read more

The Contrarian Director

Posted by on 6:25 pm in Human Factors / Performance, Resilience, Safety Culture, Safety Management

The Contrarian Director Public companies should appoint a “Contrarian Director” to systematically challenge management recommendations, says Australian corporate lawyer Siobhan Sweeney.  Sweeney won the 2015 Cambridge-McKinsey Risk Prize at the Centre for Risk Studies at University of Cambridge Judge Business School for her paper on the subject: In the current economic climate marked by volatility and uncertainty, risk oversight by boards is increasingly important. The function of boards to ensure a healthy balance between risk-taking and risk avoidance is critical to the success of the company and the stability of the economy. This paper notes the significant failings of boards in this regard. The changes suggested by this paper go directly to improving this position. The paper examines the economic, social and psychological forces propelling directors on boards towards collegial consensus and deterring real independence from each other. The paper offers a highly innovative yet simple solution. It develops the concept of a ‘Contrarian Director’, inspired by the Advocatus Diaboli (‘devil’s advocate’) of 1587 but modelled more closely to the Advocate General of the European Court of Justice. The paper provides a structure and process to appoint and support this director. The result of these proposed changes would be a change to culture on boards and a radical improvement in the risk oversight function by boards. The name derives from the Greek for someone who “habitually opposes or rejects prevailing opinion or established practice”.  The aim of the proposal is to prevent groupthink and rubber-stamping of management decisions by overly-collegial boards by ‘independent’ non-executive directors who are independent in title only.  The Contrarian Director’s role would be to review every recommendation to the board of substance, giving careful consideration to any possible case, if any, against the recommendation. Observations There have been a wide range of scandals in recent years were boards have agreed to flawed proposals without adequate challenge or failed to stop risky or illegal practices, for example the classic tales of: Bearings Bank: Rogue Trader, Enron: The Smartest Guys in the Room, HBOS: Hubris, RBS: Making it Happen, BP: Failure to Learn / Spills and Spin and Olympus: Exposure as well as GM Ignition Switch Debacle and the faked Koito airline seat safety data). So any proposal that enhances corporate governance and engenders a more questioning culture (as recommended by Charles Haddon-Cave QC in the Nimrod Review) is worth attention.  It is perhaps not surprising that a quasi-adversarial solution has been proposed by a lawyer.   Taking a contrarian view of this proposal, an unintended consequence may be that some directors could chose to just compare the proposal with the Contrarian Director’s analysis and simply decide which case is stronger, rather than probe the proposal directly.  It also may mean that every non-objection by the Contrarian Director may expose them to greater personal liability as a director for not identifying a weakness that emerges later.   A single Contrarian Director will also probably be at a disadvantage in being significantly less well resourced than the management team preparing the proposal. Perhaps it would be better to appoint multiple non-executive directors who have the right knowledge to ask challenging questions, identify weaknesses in proposals and opportunities to reduce risk, perhaps supported by a small staff to gather data independently for them. UPDATE 11 September 2015: This article offers a complementary perspective Why Getting Directors on Board with Risk Management Matters.  It also emphasises sharing...

read more

Mid Air Collision Typhoon & Learjet 35

Posted by on 5:51 am in Accidents & Incidents, Fixed Wing, Human Factors / Performance, Military / Defence, Regulation, Safety Management, Special Mission Aircraft

Mid Air Collision Typhoon & Learjet 35 During ‘Renegade’ air interception training a civilian Learjet 35, D-CGFI, collided with a Luftwaffe Eurofighter Typhoon.  The German Federal Bureau of Aircraft Accidents Investigation (BFU) have issued their final report and we attended an excellent briefing by the BFU at the ISASI 2015 conference.  In Germany, as in the UK, air accidents involving both civil and military aircraft are investigated by the civilian accident investigation body. The mid-air collision occurred on 23 June 2014, over Olsberg, North Rhine-Westphalia.  The civilian aircraft crashed and both crew members died. The damaged Typhoon performed an emergency landing at Nörvenich Air Base. The Operator The Learjet was operated by GFD, a German defence contractor that provides target towing and other training services.  The company, founded in 1966, operated 13 civil registered Learjets for military training support.  They gained a German Air Operators Certificate (AOC) in 1989, but that AOC covered passenger and cargo operations (commercial air transport), not their actual training support activity (aerial work). The Flight The Learjet and two Typhoons were involved in an ‘Renegade’ interception exercise (with the Learjet simulating a potentially uncooperative airliner) when the collision occurred between the Learjet and the lead Typhoon. The collision occurred shortly after the intercepted target began to comply with the instructions given (as part of the exercise it initially ‘failed’ to obey). The Learjet Captain was Pilot Monitoring and the Co-Pilot, Pilot Flying.  Both were ex Luftwaffe fighter pilots.  The Captain was using a portable computer, effectively an unapproved Type B Electronic Flight Bag, for navigation purposes throughout the flight. Having started to ‘obey’ the intercepting fighters commands, about 15 seconds prior to the collision the autopilot was disengaged and the Co-Pilot flew the airplane manually to follow the Typhoon into a left-hand turn.  The BFU concluded the slant range of the two aircraft was initially approximately 30 m.  The turn continued, but the Co-Pilot was unable to maintain visual contact with fighter once the Learjet reached a 4° bank angle.  The Learjet was turning more sharply than the fighter and was accelerating.  Control was passed to the Learjet Captain but at this critical moment he had to pass the laptop to the Co-Pilot.  The two aircraft came into contract, 2 seconds later, with the Learjet being catastrophically damaged. Analysis The BFU say: The operator’s safety management had not sufficiently analysed the use of the computer, and the cross cockpit procedure in regard to flight safety risks. The company had issued an Safety Management Handbook on 1 June 2012.  However, at the time of he accident, just over 2 years later, “a concrete hazard and risk analysis had not been conducted in the company”, even though a functioning SMS as required of AOC holders by 28 October 2014.  In this case it appears the SMS was still in development.  In other organisations it has been apparent after accidents that the documented SMS was not an effective, living system but in practice was just ‘shelfware’ (as we recently discussed in the case of Metro-North). Equally the German military procedures for Renegade interceptions “were neither described in detail nor assessed by way of risk analysis”. The BFU concluded that the ‘Immediate Causes’ were: During positioning for the intervention the collision risk due to unexpected manoeuvres of the intercepted airplane was not sufficiently taken into consideration. The Learjet crew did not take into account the risks due to possible limitations of the field of vision and the distraction by using the computer...

read more

Moerdijk Explosion: “Failure to Learn”

Posted by on 5:46 am in Accidents & Incidents, Human Factors / Performance, Oil & Gas / IOGP / Energy, Safety Culture, Safety Management

Shell Moerdijk Explosion: “Failure to Learn” On 3 June 2014 two major explosions and a fire occurred at a Shell petrochemical plant in Moerdijk, Netherlands. Two employees were injured in the explosions that were heard 20 km away.  Debris was found 800 metres away. The Dutch Safety Board has investigated this incident.  Currently only the investigation summary is available in English. UPDATE 10 December 2015: The full report in English is now released.  The article below has been enhanced with extra details. They have also issued a VIDEO. The Explosion The Propylene Oxide-Styrene Monomer 2 (MSPO2) plant had been shut down to replace catalyst granules and was being restarted.  Operators manually increased the warming of the reactors with ethylbenzene.  This triggered an unanticipated reaction, gas formation and a pressure build up.  Fluctuations in pressure did not cause alarm because operators had become used to fluctuations during previous re-starts and considered them normal.  An automatic protection system tripped but had the unintended consequences of preventing the venting of the gas.  The rapid pressure rise in the reactors resulted in their explosion. The Causal Factors The DSB comment that: Shell failed to “identify and control risks associated with plant modifications” and the potential for chemical reaction between ethylbenzene and the new catalyst was not identified Design data and knowledge was not translated into plant operating procedures, resulting in discrepancies that were not identified Opportunities existed to stabilise or halt the process but they were not taken by operators Shell “failed to learn sufficient lessons from a previous incident” at a Shell joint venture facility in Nanhai, China in 2010. Failure to Learn Further to the failure to learn from the event in China, the DSB report also noted a reaction runaway occurred at Moerdijk in 1999, despite repeated prior statements by Shell that such an event could not happen in that reactor.  The DSB note that the 1999 event, that undermined Shell’s earlier technical analysis, did not prompt a fundamental review. The concept of a failure to learn has been raised in relation to BP after the 2005 Texas City refinery explosion for example, prior to the 2010 Macondo / Deepwater Horizon disaster.  It is also the subject of a book of the same title by Australian National University Emeritus Professor Andrew Hopkins.  It also can apply to a failure to learn from accidents to other organisations (as we discussed in the case of a US helicopter operator). In contrast the DSB highlight that the local fire and emergency services had learnt from past emergencies (such as the nearby 2011 fire at the Chemie-Pack facility).  There were areas for improvement though, such as emergency alerting of the local population. In the 2008 book Resilience Engineering Perspectives, Volume 1: Remaining Sensitive to the Possibility of Failure, John Wetherall writes: …one hallmark of a resilient organisation is that it is prepared not only for its own failures those of which it can learn from others – the more resilient it is, the ‘bigger’ are the lessons it has learnt from others. Safety Management and Regulatory Oversight In light of the shortcomings found at the plant, the DSB oddly report they had a “positive view” of the site’s “comprehensive” safety management system (SMS). They are also complimentary about Shell initiatives such as ‘Hearts and Minds‘ and note that the company has been seen as a leader in safety.  However the DSB note that Hearts...

read more

ISASI Seminar 2015 – ‘Independence does not mean Isolation’

Posted by on 4:11 pm in Accidents & Incidents, FDM / Data Recorders, Safety Management

International Society of Air Safety Investigators Seminar 2015 Aerossurance will be attending the 46th annual seminar of the International Society of Air Safety Investigators (ISASI)  24-28 August 2015, in Augsburg, Germany. Organised by the society’s European chapter, the European Society of Air Safety Investigators (ESASI), this year’s theme is ‘Independence does not mean Isolation’. Programme Aerossurance has extensive aviation safety, airworthiness and accident analysis experience.  Contact us at: enquiries@aerossurance.com Follow us on LinkedIn and Twitter @Aerossurance for our latest...

read more

CHIRP – Independent Review

Posted by on 7:11 pm in Fixed Wing, Helicopters, Human Factors / Performance, Maintenance / Continuing Airworthiness / CAMOs, News, Safety Management

CHIRP – Independent Review The results of an independent review on the work of CHIRP (the Confidential Human Factors Incident Report Programme) have just been published by the British charitable trust. CHIRP Chief Executive Ian Dugmore commented that the review: …reaffirmed the requirement for an independent and confidential reporting system for the UK and recommended that CHIRP should continue broadly in its current format for the benefit of the travelling public and the safety of the aviation community. The Review also recognised the importance of safeguarding CHIRP’s reputation as a trustworthy, confidential, credible reporting system. We have already begun to implement the recommendations and will continue to do so over the coming months. The review was conducted between September and December 2014 and as led by Mr Peter Hunt who was formerly a British Airways Captain, Head of Operating Standards Division at the UK Civil Aviation Authority (CAA) and latterly Director of the UK Airprox Board. The panel comprised: Capt. Tim Cheal (Training Manager, Thomas Cook Airlines) Mr Neil Croxford (Head of Compliance & Safety Management, Monarch Airlines) Ms Mary Gooding (Cabin Safety Manager, Virgin Atlantic Airways) Mr Paul Jones (General Manager Air Traffic Services, Gatwick Airport) Mr Geoff Weighell (Chief Executive, British Microlight Aircraft Association [BMAA]). The panel is reported to have consulted widely before producing their report and 13 recommendations.  In particular the panel recommends that: The aviation CHIRP programme continues and that more is done to promote the programme. Further work is done on data analysis. That CHIRP works with CAA to contribute to the new concept of Performance Based Regulation (PBR) and include disidentified reports in the national occurrence database. The trust enhance communication and coordination with CAA to ensure timely ‘outcomes’. The programme is extended to aviation security, ground operations and air displays. The trust exploit synergies with the UK Flight Safety Committee (UKFSC) and the General Aviation Safety Council (GASCo). Aviation security, or more particularly complaints about security searches, have been a major theme in recent years.  However, including aviation security staff in the scheme would include a critical aviation sector that is particularly vulnerable to human factors (HF), the original primary focus of CHIRP. The ground handling sector is another area where HF issues are critical and there are major opportunities for cultural enhancement. The panel’s 13 recommendations: 1. The Review Committee strongly recommends that ‘aviation CHIRP’ should continue broadly in its current format for the benefit of the travelling public and the safety of the aviation community. 2. Safeguard CHIRP’s reputation as a trustworthy, confidential, credible reporting system. 3. Maintain CHIRP’s ‘working methods’ insofar as the handling of reports is concerned, responsive to the needs of reporters. 4. Continue to progress IT developments especially as regards the ability readily to extract value from the stored dataset. 5. Working with CAA, ensure that CHIRP data and information add value to the Performance Based Regulation methods. 6. Working with CAA, ensure that suitably disidentified CHIRP reports are included in the national ECCAIRS database. 7. Improve the flow of information between CHIRP and CAA such that communications are timely and effective as regards ‘outcomes’. 8. CHIRP must continue its policies and methods as regards membership of the Advisory Boards. It is important that Members of these Boards are representative and credible. 9. Following the transition to electronic communications, CHIRP must...

read more

USAF RC-135V Rivet Joint Oxygen Fire

Posted by on 4:09 pm in Accidents & Incidents, Human Factors / Performance, Maintenance / Continuing Airworthiness / CAMOs, Military / Defence, Safety Management, Special Mission Aircraft

USAF RC-135V Rivet Joint Oxygen Fire A US Air Force (USAF) accident investigation has paradoxically determined that a fire that caused  of damage in April 2015 was due to a maintenance error but that no human factors were involved. The Fire On 30 April 2015 RC-135V Rivet Joint reconnaissance aircraft 64-14848 of the 343rd Reconnaissance Squadron, 55th Wing had commenced its take off roll at Offutt Air Force Base, Nebraska on a training flight. As the aircraft passed approximately 45 knots, multiple crew in the rear of the aircraft reported seeing a fire above the galley.  The take off was aborted and all 27 crew evacuated the aircraft (four suffering minor smoke inhalation). The Damage The fire burned a hole through the upper fuselage above the rear galley area, damaging aircraft control and mission systems. The repair cost is estimated to be $62.4mn. The Maintenance History Every 4 years, each RC-135 aircraft  undergoes Programmed Depot Maintenance (PDM) at contractor L-3 Communications in Greenville, Texas.  During PDM, L-3 Communications inspects, cleans and reinstalls the oxygen system in accordance with documents known as Technical Process Specifications (TPS).  This was last done on 64-14848 on 21 August 2013.  No oxygen system maintenance was conducted in the area of the fire since then. The fittings used in the oxygen system are shown below. They includes B-nuts, the subject of one of our recent articles.  The B-nut and sleeve provide a clamping load to create a seal between the tube and fitting. The Investigation Conclusions During investigation it was found that some B-nuts in the oxygen system were finger tight.  The USAF report states: The board president found by preponderance of the evidence that the cause of the mishap was a leak in the high-pressure oxygen system due to poor assembly of the system tubing at depot maintenance. Failure by L3 Communications depot maintenance personnel to tighten a retaining nut connecting a metal oxygen tube to a junction fitting above the galley properly caused an oxygen leak. This leak created a highly flammable oxygen-rich environment that ignited. The resulting fire melted the retaining nut causing the tubing to become detached from the junction fitting, feeding more oxygen to the fire, increasing its size, and causing severe damage to the airframe, galley, and mission equipment onboard the aircraft. However, very oddly the report also says: AFI 91-204, Safety Investigations and Reports, 24 September 2008, Attachment 5, contains the Department of Defense Human Factors Analysis and Classification System [HFACS], which lists potential human factors that can play a role in any mishap. Human factors consider how people’s tools, tasks and working environment systematically influence human performance. There is no evidence that human factors contributed to this mishap. [Emphasis Added] There is a HFACS Maintenance Extension (HFACS-ME), similar to Boeing MEDA, that could have been used to analyse the maintenance circumstances but unfortunately that does not seem to have been applied. The report does erroneously suggests the maintenance personnel did not follow a TPS dated May 2014 – i.e. after the work was actually done(!). The Air Force Times reports that: Air Combat Command said no decision has been made on whether the company would be liable for the aircraft damage, calling it a “complex subject.” “The purpose of this report is to provide a comprehensive look at all of the factors that led to this accident,” ACC said in a statement. “The report does...

read more