United Airlines Suffers from Fan Cowl ED (Error Dysfunction)
We have previously discussed a long running series of around 40 events when Fan Cowl Doors (FCD) were lost from Airbus A320 series aircraft, including:
- A319 Double Cowling Loss and Fire – AAIB Report
- ANSV Report on A320 Fan Cowl Door Loss: Maintenance Human Factors
- Tiger A320 Fan Cowl Door Loss & Human Factors: Singapore TSIB Report
In each case the cowls had inadvertently been left unlatched and this had not been subsequently detected before flight.
Damage to Tigerair Airbus A320-200 9V-TRH (Credit: TSIB)
Airbus introduced a modification that would prevent the cowls being opened without inserting a mechanical ‘key’ attached to a long red streamer, that would normally be stowed on the flight deck and that could only be removed when the cowls were fully locked.
But remarkably a US airline fought the proposed Airworthiness Directive (AD).
United Airlines Responses to FAA NPRM
The airline responded as follows for the FAA Notice of Proposed Rulemaking (NPRM) to adopt the exiting EASA AD (AD 2016-0053 on IAE V2500 powered A320s had been issued in March 2016 and was followed by AD 2016-0257 on CFMI CFM56 powered A320s):
United Airlines (UAL) stated that it strongly disagrees with making the new latch keys installation mandatory. UAL stated that each one of the fan cowl door losses during takeoff can be attributed solely to human error.
The implication is that no design improvement is needed after 40 occurrences.
UAL explained that the mechanics are not correctly latching the fan cowl after maintenance and the flight crews are not checking that the latches are secured before departure.
A320 Fan Cowl Doors (Credit: via ANSV)
This is undoubtedly true, but in a surprisingly they go on to say:
…instead of mandating the modification, UAL stated that more emphasis should be placed on addressing the root cause—not the design, but human error.
James Reason, Professor Emeritus, University of Manchester wrote in his classic 1997 classic Managing the Risks of Organizational Accidents that among some of the problems with error management are:
- Focusing on the active failures (of people) not the latent conditions
- Not being informed by current human factors thinking regarding error and accident causation
Human error is not itself a cause, but merely the start of a human factors investigation, as explained by Sidney Dekker in The Field Guide to Understanding Human Error – A Review (discussed in this book review The Field Guide to Understanding Human Error to the RAeS).
United are disappointingly focusing on what Reason called ‘the human condition’ and hoping to change it, something he argued was futile, but that “we can change the conditions under which people work“.
Perhaps United have never heard of the Murphy’s Law from the 1940s either.
United went on to complain that:
…adding another loose piece of equipment to be maintained and stored on the airplane would lead to operational complications.
That is true but in the scheme of operation of a modern airliner it is neither a disproportionate or novel complication. According to the FAA:
UAL also noted that additional time would be added to accomplishing routine tasks after incorporation of the modification.
UAL contended that additional time would be required to access the cockpit, retrieve the key, and open the fan cowls, which would expose personnel and the airplane to further damage or harm.
They don’t specify what further damage / harm this could involve as non of these tasks are again unique. More telling:
Mandating the modification, UAL argued, would impose an unnecessary financial and maintenance burden on operators that have proactively implemented alternate procedures.
The alternative being an independent inspection, which of course involves additional maintenance personnel, a cost and complexity that they don’t feel worthy of mentioning.
Its not clear what risk assessment was conducted under United’s Part 5 SMS or what human factors assessment methodology was used as no such assessment was submitted to the FAA, nor was any other data driven substantiation for their claims, according to the FAA.
Furthermore cowls have been lost from US A320s:
- Spirit Airlines A319 N504NK on 9 November 2013 Photo
- American Airlines A320 N654AW on 13 June 2016 (only weeks after the NPRM was issued for comment making United’s comments even more remarkable) Photo
FAA Conclusions
From these statements, we infer that UAL was requesting that we withdraw the NPRM. We do not agree with UAL’s request.
EASA, as the State of Design Authority for Airbus products, has determined an unsafe condition exists after conducting a risk analysis taking into consideration the in-service events in the worldwide fleet. We agree with EASA’s decision to mitigate the risk by mandating a new design that makes it apparent to the flight crew on a pre-flight walk-around that an FCD is not latched.
Regarding the concern about operational complications, we have determined that the safety benefits of the new design outweigh any potential complications.
We reviewed the available data, including the comments received, and determined that air safety and the public interest require adopting this AD with the changes described previously and minor editorial changes.
We have determined that these changes:
– Are consistent with the intent that was proposed in the NPRM for correcting the unsafe condition; and
– Do not add any additional burden upon the public than was already proposed in the NPRM.
Our Observations
The value of human centred design (HCD) is preventing the ability to release an aircraft in an undesired or unsafe condition. As we have commented previously:
…controls that are entirely training and procedural will one day fail and the most effective way to control a hazard that can be triggered by a human error is to eliminate the potential for error whenever possible. This may be using mistake-proofing features which the Japanese call ‘poke’-yoke’ (like the new key), or by changing how a task is accomplished…
A poorly argued, data free response that only focuses on the negatives of a mitigation to a frequently repeating event (especially when the negatives are relatively small negatives), that fails to consider contemporary thinking on human factors does not reflect well on an organisation’s approach to safety, and smacks of complacency.
See also:
- James Reason’s 12 Principles of Error Management
- Airworthiness Matters: Next Generation Maintenance Human Factors
UPDATE 25 January 2018: The NTSB release their report on Aruba Airlines A320-200, P4-AAA, which lost the outboard fan cowl from the right-hand V2527 engine during takeoff from Miami on 19 September 2016.
Reconstructed Fan Cowl Debris Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)
The night prior a routine weekly check was conducted by contracted maintenance organisation Miami Tech Aircraft Maintenance. This included opening the fan cowl doors to inspect the Integrated Drive Generator (IDG). Because the ramp area was dark, the mechanic who completed the work used a flashlight to verify the latches were flush and made sure he heard a click. A second mechanic verified that the latches were flush. The task was signed off in the Technical Log as complete but the Tech Log entry did not explicitly state that the cowls had been opened. The next morning both an airline maintenance supervisor and the first officer conducted walkarounds. Neither noticed any abnormalities. The FO stated he bent down and checked that it was cowling was flush and latched.
Reconstructed Fan Cowl Debris Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)
After this occurrence, Aruba Airlines reported to the NTSB that they had taken the following actions:
- Embodied modification Goodrich Service Bulletin V2500-NAC-71-0325, a 1999 SB for a hold open device (it surprising that this modification, albeit non-mandatory, was not in place*)
- Maintenance personnel now ensure that an entry is made in the aircraft log to notify flight crews that the fan cowl doors were opened and closed to perform maintenance (surprisingly this was not already in place)
- Flight crews are now required to perform a close inspection of the latches when they see the log book entry and sign their compliance on the log book.
* According to the airline’s Director of Maintenance, they had also decided not to embody the more recent March 2016 EASA AD 2016-0053 as:
Aruba Airlines lease their aircraft, and because the aircraft would be returned prior to the 2019 compliance date, they were not going to comply with the AD.
A UK company was contracted to assess ADs for Aruba Airlines. Aruba Airlines received the assessment in July 2016, four months after the AD was published and determined they would not to embody it just 1 day later.
It is noteworthy that the NTSB report is disappointingly lightweight compared to the recent UK AAIB, ANSV and TSIB reports, with very little discussion of the HF aspects (though it could be argued this is a sign of a well understood problem).
Latch from Aruba Airlines Airbus A320-200 P4-AAA (Credit: NTSB)
After this report came out ASN issued this list of past occurrences:
- 9 February 1992; A320 of Mexicana at Mexico City, Mexico
- 20 January 2000; A320 of Airtours International at London-Gatwick, U.K.
- 12 June 2000; A320 of America West at Las Vegas, USA
- 13 September 2000; A320 of Skyservice at Toronto, Canada
- 11 May 2004; A320 of Iberia at Madrid, Spain
- 13 July 2004; A320 of AirTran at Atlanta, USA
- 22 April 2007; A319 of Frontier at Atlanta, USA
- 9 January 2008; A319 of Northwest Airlines at Detroit, USA
- 6 May 2008; A319 of Spirit Airlines at Detroit, USA
- 19 January 2010; A318 of Mexicana at Cancun, Mexico
- 28 January 2010; A320 of Volaris at Tijuana, Mexico
- 5 April 2010; A320 of JetBlue at Newark, USA
- 27 November 2010; A319 of Air India at Bangalore, India
- 10 December 2010; A320 of Bulgaria Air at Sofia, Bulgaria
- 30 November 2011; A320 of Wizz at Bucharest, Romania
- 19 May 2012; A320 of TAM at Natal, Brazil
- 18 February 2013; A320 of China Southern Airlines at Harbin, China
- 24 May 2013; A319 of British Airways at London-Heathrow, UK
- 12 August 2013; A320 of easyJet at Milan, Italy
- 9 November 2013; A319 of Spirit Airlines at Chicago-O’Hare Airport, USA
- 18 September 2014; A320 of JetBlue at Long Beach, USA
- 26 January 2015; A320 of flynas at Jeddah, Saudi Arabia
- 14 October 2015; A319 of Sky Airline at Santiago, Chile
- 16 October 2015; A320 of Tigerair at Singapore
- 13 June 2016; A320 of American Airlines at Phoenix Sky Harbor, USA
- 19 September 2016; A320 of Aruba Airlines at Miami, USA
- 25 July 2017; A320 of Bangkok Airways at Bangkok, Thailand
Airbus has published guidance on preventing leaving cowls unlatched.
UPDATE 21 January 2018: Human Factors of Dash 8 Panel Loss, Maintenance Human Factors in Finnish F406 Landing Gear Collapse and When Down Is Up: 747 Actuator Installation Incident
UPDATE 11 February 2018: Lost in Translation: Misrigged Main Landing Gear
UPDATE 11 March 2018: EC120 Forgotten Walkaround
UPDATE 24 June 2018: B1900D Emergency Landing: Maintenance Standards & Practices The TSB report posses many questions on the management and oversight of aircraft maintenance, competency and maintenance standards & practices. We look at opportunities for forward thinking MROs to improve their maintenance standards and practices.
UPDATE 25 August 2018: Crossed Cables: Colgan Air B1900D N240CJ Maintenance Error On 26 August 2003 a B1900D crashed on take off after errors during flying control maintenance. We look at the maintenance human factor safety lessons from this and another B1900 accident that year.
UPDATE 8 November 2018: A Vueling A320-200, EC-MDZ, lost the cowls from its left hand V2527 on take off from Bilbao. Debris became stuck in the left main landing gear without affecting retraction or lowering. Debris also punctured a fuselage fairing (images).
UPDATE 30 November 2018: A Frontier A320-200, N227FR, suffered a left hand CFM56-5B4/P cowling failure shortly after departing from Las Vegas (video). Of note is the thrust reverser C-duct, further aft, is also open.
UPDATE 8 April 2020: NTSB Confirms United Airlines Maintenance Error After 12 Years
UPDATE 15 March 2021: ATR 72 Rudder Travel Limitation Unit Incident: Latent Potential for Misassembly Meets Commercial Pressure
FSF Maintenance Observation Programme (MOP)
Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:
Aerossurance can provide practice guidance and specialist support to successfully implement a MOP.
Aerossurance will be presenting at EASA‘s 11th Rotorcraft Symposium on Cologne on 5 December 2017 on human centred design (HCD) for rotorcraft. This presentation will be live streamed.
UPDATE 2 March 2018: An excellent initiative to create more Human Centred Design by use of a Human Hazard Analysis (HHA) is described in Designing out human error
HeliOffshore, the global safety-focused organisation for the offshore helicopter industry, is exploring a fresh approach to reducing safety risk from aircraft maintenance. Recent trials with Airbus Helicopters and HeliOne show that this new direction has promise. The approach is based on an analysis of the aircraft design to identify where ‘error proofing’ features or other mitigations are most needed to support the maintenance engineer during critical maintenance tasks.
The trial identified the opportunity for some process improvements, and discussions facilitated by HeliOffshore are planned for early 2018.
A systems approach in healthcare:
Aerossurance is pleased to be both sponsoring and presenting at a Royal Aeronautical Society (RAeS) Human Factors Group: Engineering seminar Maintenance Error: Are we learning? to be held on 9 May 2019 at Cranfield University.
Recent Comments