Tiger A320 Fan Cowl Door Loss & Human Factors: Singapore TSIB Report

Tiger A320 Fan Cowl Door Loss & Human Factors: Singapore TSIB Report

On 16 October 2015 Tigerair Airbus A320-200 9V-TRH lost both fan cowls of its left hand IAE V2500 engine during a night take off from Singapore, bound for Chennai in India.  This is one of a long series of such incidents, numbering close to 40.

This occurred just two months after the UK Air Accidents Investigation Branch (AAIB) published their report into a British Airways A319 G-EUOE that lost both engine fan cowlings and suffered an associated fire on take-off from London Heathrow in 2013.

The Incident Flight and the Damage

The Singapore Transport Safety Investigation Bureau (TSIB) report explains:

After being informed by the cabin crew of the loss of the left engine fan cowls, the flight crew levelled the aircraft off at 8,000ft. They checked and noted that all engine parameters were normal. They then decided to return to Changi Airport.

When landing gears were selected down during the approach to land, a Master Warning came on, indicating that the left main landing gear was not downlocked. The approach was discontinued and the flight crew performed the manual gravity extension procedure but the Master Warning still indicated that the left main landing gear was not downlocked.

The flight crew declared Mayday and flew a holding pattern to burn fuel and reduce the aircraft landing weight. Later, the flight crew performed a low fly-past, and engineers on the ground reported that the left main landing gear appeared to be down. Subsequently the aircraft landed without incident.

Debris of the outboard fan cowl was found on the runway and reconstructed.  The inboard fan cowl was recovered from the sea more or less in once piece by a passing ship.

All the four latches (comprising four hooks at the bottom edge of the inboard fan cowl and four corresponding keepers at the bottom edge of the outboard fan cowl) were recovered. Apart from operational wear, no damage were observed on the four latches.

…each of the four fan cowl latches comprises a handle with hook end at the bottom edge of the inboard fan cowl and a keeper end at the bottom edge of the outboard fan cowl.

Some fan cowl debris had lodged into the left main landing gear door, and damaged the proximity sensor on the left main landing gear

The aerodrome operator supplements its runway inspections with a FOD detection system. It uses multiple panning cameras along the runway to identify possible FOD.  This system did spot fan cowl debris but it was interepreted as being a runway light.  Only the sixth alert gave an adequate image for the duty operator to determined that there was indeed FOD on the runway.

Events Prior to the Flight and Procedures

The TSIB say that the evening before the aircraft had been due Base Layover (BLO) maintenance, which included checking the oil level of the integrated drive generator (IDG) of the left and right engines.

According to the BLO technician, he checked the right engine IDG first. He lifted the outboard fan cowl on the IDG side to visually sight the oil level before closing it. He proceeded to check the left engine. He closed the fan cowls of the left engine and fastened the latches of the fan cowls after checking the IDGs. He said he was not interrupted while closing the fan cowls.

If the fan cowl latches are not fastened, the latch handle will protrude from the surface.

However a trial by TSIB in similar lighting found that “the curvature of the engine nacelle obscures the latches even when they are unfastened, making it difficult to sight the protruding latch handles”.

They could also not be spotted from the Main Landing Gear postion but could just be seen from the Nose Landing Gear.

A Hold-Open Device (HOD) should ensure the cowls do not fully close if unlatched.  A trial by TSIB however found that:

The existing design of the HOD still could allow the fan cowl to be closed flush at the interface, there was minimal difference in flushness whether latches were unfastened or fastened

At that time the key actions in the Aircraft Maintenance Manual (AMM) when opening and closing fan cowls were:

1. Warning notices to be installed in the cockpit prior to working on the fan cowls
2. Red warning flag tool to be installed in position on the HOD
3. Record in the aircraft logbook whenever fan cowls have been opened or closed Maintenance personnel were expected to follow the procedures in the aircraft maintenance manual.

The AMM did not mention crouching to check the latches (which are just 50 cm off the ground).  The maintenance organisation had issued a Quality Notice on 2 March 2009 “to inform its maintenance personnel of the need to bend down or crouch to confirm fan cowl latches are fastened”. A further Quality Notice on 11 May 2015 reminded the “need for aircraft logbook recording whenever fan cowls have been opened or closed and the need for confirming fan cowl latches are fastened”.

The BLO technician was not a recipient of the Quality Notices and neither was he required to read the Quality Notices.

The BLO technician was not aware that the red warning flag tool had to be used when the fan cowls were opened. He was not aware of the [3] key actions for opening and closing fan cowls as described [above]…

The Licensed Aircraft Engineer (LAE) in charge of the BLO performed a walkaround check prior to signing off the BLO.

…the LAE looked at the sides of the fan cowl, he checked that there were no gaps between the surfaces of the fan cowl and the engine nacelle which, from his experience, would indicate an unfastened fan cowl condition. He mentioned that he would normally also squat down and extend his hand to reach under the fan cowl to feel if the latches were secured. However, he did not do so this time.

The BLO LAE ended his walkaround check at the front of the aircraft near the nose landing gear. According to the BLO LAE, while in a squatting position at the front of the aircraft, he inspected visually the engines from his position and he did not notice any protrusion of unfastened latches.

There was no aircraft logbook entry recording the opening or closing of the fan cowls during the BLO before the incident flight. The BLO LAE explained that his understanding at that time was that the logbook entry was to create awareness for other maintenance personnel when there was a handover, and that he did not realise at that time that the intent was to include awareness to the flight crew as well.

The check was finished at 03:00 on 16 October 2015.  The aircraft remained parked during the day.  During afternoon a group of interns on an orientation tour visited the aircrafts. Photographs taken at that time showed that at least three of the four fan cowl latches of the left engine were unfastened.

At 19:00 the aircraft was towed to the departure gate for its first post-BLO flight.

The Airbus Flight Crew Operations Manual (FCOM) describes the exterior walkaround check to be performed by flight crew or maintenance personnel. While it includes a check that the fan cowls are closed and latched before flight it “did not mention that one should crouch to check the latches”.  Airbus had however “published an article in its Safety First Magazine in July 2012 and presented at its forum with operators in March 2014 on the issue of fan cowl loss”.

The Departure LAE performed a walkaround check prior to releasing the aircraft for departure. According to the Departure LAE, he did not squat to sight the condition of the fan cowl latches. He said that he observed the engines from the nose wheel location and did not notice any protrusions at the bottom of the fan cowl which he said would indicate unfastened latches.

…the First Officer (FO) said he performed a walkaround check as required by company procedures. He visually inspected the engines from two positions (from the main landing gear and from the outboard side of the engine). Accordingly to the FO, he stood at these positions and looked downwards at the fan cowls but he did not bend down or squat to check. The FO indicated that he was taught during his training not to bend down or squat to check due to risk of possible injury from sharp edges (e.g. vent pipes on the fan cowl) when standing up.  He did not notice any latch protrusions. Looking at the sides of the engine, the FO also checked that the fan cowl surfaces were flush with that of the engine nacelle and that there was no gap.

TSIB Analysis

On the circumstances:

Evidence shows that at least three of the four latches of the fan cowl of the left engine were not fastened four hours before the incident aircraft took off. Detailed inspection on the recovered latches…showed no damage on the connecting surfaces… This would indicate that there was no mechanical failure or structural damage on the latch hooks and keepers, and would suggest that all latches were likely to be unfastened at the time of take-off.

With fan cowl latches not fastened, the airflow generated during the aircraft’s flight would tear off the fan cowls.

The BLO technician was not aware of the key actions to be performed in the aircraft manufacturer’s instructions for opening and closing fan cowls.  The walkaround procedure adopted by the BLO LAE, the Departure LAE and the FO differed from the procedure provided by the aircraft manufacturer.

TSIB note the cowl closure was (partly) checked by looking for cowl flushness.

Such a flushness assessment is not a method recommended by the aircraft manufacturer.  It is not known how [it became] an acceptable way of ascertaining that the fan cowl latches are fastened, in lieu of bending down or crouching to bring eye level low enough to confirm latches are fastened.

The simulation test showed that a fan cowl with unfastened latches could still appear flush with the engine nacelle.  [Also] at a distance away from the engine, the unfastened latches could be difficult to detect as the curvature of the engine nacelle could obscure the view of the latches.

They comment that:

It is not a reliable method to determine if the fan cowl’s latches had been fastened properly by trying to judge from a distance whether there are protrusions of the latches. The lighting condition and the angle of view may make the judging difficult. The silhouette of the engine drain mast may also obscure the outline of protruding latches.

In short, a better way to ascertain whether the fan cowl latches are fastened is to squat down low enough to sight the latches.

It is noted that, although the aircraft manufacturer has emphasised [this] in its Safety First Magazine, this requirement is not mentioned in the aircraft manufacturer’s FCOM for exterior walkaround check.

Safety Actions

The TSIB mention 5 safety actions:

1. The European Aviation Safety Agency (EASA) issued Airworthiness Directive AD AD 2016-0053 on 14 March 2016 to modify V2500 fan cowls such that a special ‘key’ with an integral flag that has to be used to unlatch the cowls.  The key cannot be removed unless the fan cowl front latch is safely closed.  This follows a long running sequence of similar occurrences.
2. The aircraft operator issued a Flight Staff Instruction to emphasise the requirement for flight crews to bend or squat down when inspecting latches from either side of the engine.
3. The maintenance organisation highlighted again to its staff the two previous Quality Notices and emphasised the importance of following the aircraft manufacturer’s instructions for opening and closing fan cowls in daily briefings (though it is not clear why they believe that would be an effective long term action).
4. The maintenance organisation also now conduct regular checks on logbooks to ensure compliance with their Quality Notices (again a relatively weak action as it focuses on records not the whole process).
5. The aerodrome operator is in the process of upgrading the FOD detection system to incorporate higher definition cameras. This is due to be completed in September 2017.

TSIB Safety Recommendations

1. The aircraft operator remind its flight crew personnel that fan cowl flushness with nacelle is not a reliable method for checking that fan cowl latches are fastened. [TSIB Recommendation RA-2017-028]
2. The aircraft maintenance service provider remind its maintenance personnel that fan cowl flushness with nacelle is not a reliable method for checking that fan cowl latches are fastened. [TSIB Recommendation RA-2017-029]
3. The aircraft manufacturer emphasise, in its maintenance documentation on exterior walkaround check, the need for inspection personnel to bend down or crouch to bring eye level low enough to confirm latches are fastened. [TSIB Recommendation RA-2017-030]

Our Comments

It is very easy to fall for the fundamental attribution error that the personnel in a particular incident were ‘stupid’ or ‘unprofessional’.  You might find these safety / human factors resources of use:

• James Reason’s 12 Principles of Error Management
• Back to the Future: Error Management
• This 2006 review of the book Resilience Engineering by Hollnagel, Woods and Leveson, presented to the RAeS by Aerossurance’s Andy Evans: Resilience Engineering – A Review and this book review of Dekker’s The Field Guide to Understanding Human Error: The Field Guide to Understanding Human Error – A Review

Just like the BA event a new consequential failure mode emerged.  In the BA case a fire, in this case the landing gear sensor damage.

The fan cowl saga highlights the difficultly in effectively raising awareness on a regularly repeating and dramatic type of incident.  Not only was the AAIB  report into the UK event issued just 8 weeks before:

but a Sky Airline Airbus A319-100 CC-AIC suffered a cowling loss just days before.

It shows that even when people are aware of the essential controls (like the BLO LAE) they may not understand the reasoning and may therefore mis-apply or mis-interpret those controls.  They may also routinely do ineffective actions in the belief they are in fact effective.

But above all, controls that are entirely training and procedural will one day fail and the most effective way to control a hazard that can be triggered by a human error is to eliminate the potential for error whenever possible.  This may be using mistake-proofing features which the Japanese call ‘poke’-yoke’ (like the new key), or by changing how a task is accomplished (e.g. by fitting a small access door to allow IDG oil changes without opening the cowls at all.

UPDATE 4 December 2017: United Airways Suffers from ED (Error Dysfunction).  The US airline shows a strange grasp of human factors principles and argues AGAINST a human centred design change intended to address a long running series of maintenance errors.

UPDATE 25 January 2018: The NTSB release their report on Aruba Airlines A320-200, P4-AAA, which lost the outboard fan cowl from the right-hand V2527  engine during takeoff from Miami on 19 September 2016.

The night prior a routine weekly check was conducted by contracted maintenance organisation Miami Tech Aircraft Maintenance. This included opening the fan cowl doors to inspect the Integrated Drive Generator (IDG). Because the ramp area was dark, the mechanic who completed the work used a flashlight to verify the latches were flush and made sure he heard a click. A second mechanic verified that the latches were flush. The task was signed off in the Technical Log as complete but the Tech Log entry did not explicitly state that the cowls had been opened.   The next morning both an airline maintenance  supervisor and the first officer conducted walkarounds.  Neither noticed any abnormalities. The FO stated he bent down and checked that it was cowling was flush and latched.

After this occurrence, Aruba Airlines reported to the NTSB that they had taken the following actions:

1. Embodied modification Goodrich Service Bulletin V2500-NAC-71-0325, a 1999 SB for a hold open device (it surprising that this modification, albeit non-mandatory, was not in place)
2. Maintenance personnel now ensure that an entry is made in the aircraft log to notify flight crews that the fan cowl doors were opened and closed to perform maintenance (surprisingly this was not already in place)
3. Flight crews are now required to perform a close inspection of the latches when they see the log book entry and sign their compliance on the log book.

It is noteworthy that the NTSB report is disappointingly lightweight compared to the recent UK AAIB, ANSV and TSIB reports, with very little discussion of the HF aspects (though it could be argued this is a sign of a well understood problem).

After this report came out ASN issued this list of past occurrences:

• 9 February 1992; A320 of Mexicana at Mexico City, Mexico
• 20 January 2000; A320 of Airtours International at London-Gatwick, U.K.
• 12 June 2000; A320 of America West at Las Vegas, USA
• 13 September 2000; A320 of Skyservice at Toronto, Canada
• 11 May 2004; A320 of Iberia at Madrid, Spain
• 13 July 2004; A320 of AirTran at Atlanta, USA
• 22 April 2007; A319 of Frontier at Atlanta, USA
• 9 January 2008; A319 of Northwest Airlines at Detroit, USA
• 6 May 2008; A319 of Spirit Airlines at Detroit, USA
• 19 January 2010; A318 of Mexicana at Cancun, Mexico
• 28 January 2010; A320 of Volaris at Tijuana, Mexico
• 5 April 2010; A320 of JetBlue at Newark, USA
• 27 November 2010; A319 of Air India at Bangalore, India
• 10 December 2010; A320 of Bulgaria Air at Sofia, Bulgaria
• 30 November 2011; A320 of Wizz at Bucharest, Romania
• 19 May 2012; A320 of TAM at Natal, Brazil
• 18 February 2013; A320 of China Southern Airlines at Harbin, China
• 24 May 2013; A319 of British Airways at London-Heathrow, UK
• 12 August 2013; A320 of easyJet at Milan, Italy
• 9 November 2013; A319 of Spirit Airlines at Chicago-O’Hare Airport, USA
• 18 September 2014; A320 of JetBlue at Long Beach, USA
• 26 January 2015; A320 of flynas at Jeddah, Saudi Arabia
• 14 October 2015; A319 of Sky Airline at Santiago, Chile
• 16 October 2015; A320 of Tigerair at Singapore
• 13 June 2016; A320 of American Airlines at Phoenix Sky Harbor, USA
• 19 September 2016; A320 of Aruba Airlines at Miami, USA
• 25 July 2017; A320 of Bangkok Airways at Bangkok, Thailand

Airbus has published guidance on preventing leaving cowls unlatched.

UPDATE 8 November 2018: a Vueling A320-200, EC-MDZ, lost the cowls from its left hand V2527 on take off from Bilbao.  Debris became stuck in the left main landing gear without affecting retraction or lowering.  Debris also punctured a fuselage fairing (images).

UPDATE 30 November 2018: A Frontier A320-200, N227FR, suffered a left hand CFM56-5B4/P cowling failure shortly after departing from Las Vegas (video).  Of note is the thrust reverser C-duct, further aft, is also open.

UPDATE 5 September 2020: The Spanish air accident investigators, the CIAIAC, have issued their report on the 25 October 2018 loss of cowls from the V2500 powered Vueling A320 EC-MDZ.  The cowl release also resulted in damage to cabling and sensors on the main landing gear leg.  The causes are similar to the previous events.  EASA AD 2016-53 for the fan cowl pin and flag had not been implemented on EC-MDZ at that time (compliance was due by 28 March 2019), although it was planned for November 2018.  The Vueling fleet was fully complaint 2.5 months before the deadline and CIAIAC determined that this AD “significantly reduces the risk of improperly latched cowls in the future.

Safety Resources from Aerossurance

• How To Develop Your Organisation’s Safety Culture
• Critical Maintenance Tasks: EASA Part-M & -145 Change
• Maintenance Human Factors: The Next Generation
• Aircraft Maintenance: Going for Gold?
• Airworthiness Matters: Next Generation Maintenance Human Factors
• James Reason’s 12 Principles of Error Management
• Back to the Future: Error Management

Other Aerossurance A320 Cowling Articles:

• BA A319 Double Cowling Loss and Fire – AAIB Report
• BA A319 Double Cowling Loss and Fire – AAIB Safety Recommendation Update
• ANSV Report on EasyJet A320 Fan Cowl Door Loss: Maintenance Human Factors

Case Studies:

• Fatal $16 Million Maintenance Errors
• Inadvertent Fire Bottle Discharge During Maintenance
• FOD Damages 737 Flying Controls
• Cessna Citation Excel Controls Freeze
• B767 Engine Fire – Ignition from Misrouted / Chaffed Cables
• Loose B-Nut: Accident During Helicopter Maintenance Check Flight
• USAF RC-135V Rivet Joint Oxygen Fire
• The Missing Igniters: Fatigue & Management of Change Shortcomings
• Misassembled Anti-Torque Pedals Cause EC135 Accident
• EC130B4 Accident: Incorrect TRDS Bearing Installation
• Cessna 208 Forced Landing: Engine Failure Due To Re-Assembly Error
• Smoke in Cabin: Anatomy of a Wash Rig Error
• Insecure Pitch Link Fatal R44 Accident
• Bell 429 TR Pitch Change Link Bearing Failure
• Maintenance Human Factors in Finnish F406 Landing Gear Collapse
• A320 Flown on After Damaging Heavy Landing
• A320 Rolls Back on Stand: Incomplete Maintenance Procedures and Ground Handling Deviations
• UPDATE 21 January 2018: Human Factors of Dash 8 Panel Loss
• UPDATE 11 March 2018: EC120 Forgotten Walkaround
• UPDATE 24 June 2018:  B1900D Emergency Landing: Maintenance Standards & Practices  The TSB report posses many questions on the management and oversight of aircraft maintenance, competency and maintenance standards & practices after this serious incident. We look at opportunities for forward thinking MROs to improve their maintenance standards and practices.
• UPDATE 25 August 2018: Crossed Cables: Colgan Air B1900D N240CJ Maintenance Error  On 26 August 2003 a B1900D crashed on take off after errors during flying control maintenance. We look at the maintenance human factor safety lessons from this and another B1900 accident that year.
• UPDATE 10 August 2020: Boeing 737-800 Engine Nacelle Strike and Continued Operation
• UPDATE 25 March 2023: Managing Interruptions: HEMS Call-Out During Engine Rinse
• UPDATE 29 July 2023: Missing Cotter Pin Causes Fatal S-61N Accident

Aerossurance sponsored the 2017 European Society of Air Safety Investigators (ESASI) 8th Regional Seminar in Ljubljana, Slovenia on 19 and 20 April 2017.  ESASI is the European chapter of the International Society of Air Safety Investigators (ISASI).

Aerossurance also sponsored an RAeS HFG:E conference at Cranfield University on 9 May 2017, on the topic of Staying Alert: Managing Fatigue in Maintenance.  

Aerossurance is pleased to be supporting the annual Chartered Institute of Ergonomics & Human Factors’ (CIEHF) Human Factors in Aviation Safety Conference for the third year running.  We will be presenting for the second year running too, this time on Maintenance Observation.  This year the conference takes place 13 to 14 November 2017 at the Hilton London Gatwick Airport, UK with the theme: How do we improve human performance in today’s aviation business?

Aerossurance is pleased to be both sponsoring and presenting at a Royal Aeronautical Society (RAeS) Human Factors Group: Engineering seminar Maintenance Error: Are we learning? to be held on 9 May 2019 at Cranfield University.

---

Aerossurance has extensive air safety, operations, airworthiness, human factors, aviation regulation and safety analysis experience.  For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com

Follow us on LinkedIn and on Twitter @Aerossurance for our latest updates.