Whilst we don't have an explanation as yet for the 757 incident it may be timely to revisit an old incident which on the face of it seemingly has parallels. And it shows the difficulties to be had in managing safety. Bear in mind when reading, the Broome S-92 incident, and the failure to adequately investigate, which had they done so, may have prevented a catastrophic accident.
Investigation into Ansett Australia maintenance safety deficiencies and the control of continuing airworthiness of Class A aircraft
Summary
Australia has an excellent air transport safety record. Major Australian airlines have long been regarded as being among the world's safest, and there have been no fatalities involving an Australian high capacity jet aircraft. This enviable record is due, in part, to an aviation safety culture that recognises the need for constant safety awareness.
Given the commercial pressures facing international aviation, the events described in this report should be seen as a learning experience for the aviation industry, regulatory bodies, and all organisations concerned with continuing airworthiness assurance.
In December 2000 and in April 2001, a number of Ansett Australia (Ansett) Boeing 767 (B767) aircraft were withdrawn from service because certain required fatigue damage inspections of the aircraft structure had been missed. As a result there was uncertainty as to the continuing airworthiness status of the aircraft. In December 2000 the concerns related to possible fatigue cracking in the rear fuselage of the aircraft, and in April 2001 the concerns related to possible fatigue cracking of the engine strut fitting on the wing front spar.
On 11 January 2001, the Australian Transport Safety Bureau (ATSB) commenced an investigation into the circumstances surrounding the withdrawal from service of the Ansett B767 aircraft as the situation was regarded as indicative of a potential safety deficiencyi. On 10 April 2001 the ATSB investigation was extended to include an examination of the continuing airworthiness system for Australian Class Aii aircraft such as the B767.
Action by Ansett and the Civil Aviation Safety Authority (CASA) addressed the potential risks to fare-paying passengers. Although Ansett was subsequently placed into voluntary administration in September 2001, the ATSB continued a detailed systemic investigation because of the importance of the issues involved, both in Australia and internationally.
The international continuing airworthiness system, like all complex and safety-critical activities, is dependent on robustiii systems to maintain high reliability. The circumstances surrounding the withdrawal from service of the Ansett B767 aircraft revealed, among other things, that the reliability of the continuing airworthiness system was threatened by a number of weak defences.
The B767 aircraft type was among the first in the world to be designed and certified under damage tolerance principles. Damage tolerance certification relies heavily on scheduled inspections to ensure continuing airworthiness. The aircraft structure is designed to maintain integrity until any fatigue or corrosion damage can be detected at a scheduled inspection, and appropriate action taken. Therefore, in itself, the presence of fatigue cracks in the Ansett B767 aircraft was not necessarily a cause for undue concern. However, it was critical that there were robust systems to ensure that the required structural inspections were carried out to detect the cracks before they exceeded acceptable limits.
Withdrawal from service of Ansett B767 aircraft in December 2000
Ansett was the sixth airline worldwide, and the first airline outside North America, to operate the B767. Of the nine Ansett B767-200 aircraft, five were first flown in 1983 and two in 1984. The aircraft accumulated a high number of flight cyclesiv because they were mostly flown on comparatively short domestic sectors. Ansett had been working with Boeing on fatigue cracking in the area of the Body Stationv 1809.5 bulkhead outer chord since 1996.
In June 1997, Boeing introduced the Airworthiness Limitations Structural Inspection programvi for the B767. The program was an essential part of the damage tolerance requirements and was designed to detect fatigue cracking in susceptible areas that had been identified through testing and in-service experience. Ansett staff did not initially recognise that some Airworthiness Limitations Structural Inspections were required by 25,000 cycles and a period of almost two and a half years elapsed before that error was identified. At the time that the inspection program was introduced, some Ansett B767 aircraft had already flown more than 25,000 cycles. In June 2000, further 25,000 cycle inspections were introduced, including in the area of the Body Station 1809.5 bulkhead outer chord. Ansett did not initially act on this.
In December 2000, Ansett senior management became aware of the missed inspections and the aircraft were withdrawn from service on 23 December 2000, despite the high commercial cost to the company. At that time, both Ansett and CASA were of the belief that compliance with the missed inspections was mandatory. Subsequent legal advice indicated that the regulatory basis for mandating compliance with the Airworthiness Limitations Structural Inspections for Australian operators was unclear. On 29 December 2000, CASA issued a direction to Ansett specifically mandating the inspections for the Ansett B767 aircraft.
The ATSB investigation found that the Ansett system for the introduction and scheduling of the B767 Airworthiness Limitations Structural Inspections was deficient and vulnerable to human error. A mistake or omission by one or two people could potentially result in continuing airworthiness assurance being compromised. In addition, deficiencies existed in resource allocation and in the supporting information management systems.
From October 1998, Boeing also issued a series of service bulletins in relation to fatigue cracks in the area of the B767 Body Station 1809.5 bulkhead outer chord. Service bulletins are issued by aircraft, component, or engine manufacturers to provide operators with relevant service information. Not all service bulletins are safety-related, and compliance with a particular service bulletin can only be mandated by the State of Registry of an aircraft.
Boeing initially notified operators that the service bulletin requirements were primarily commercial in nature. It was not until November 2001 that Boeing indicated that the service bulletin dealt with a potentially major safety issue. The FAA had mandated action by US operators in relation to the service bulletin in April 2001.
Any action to be taken by Ansett in relation to the Body Station 1809.5 service bulletins issued by Boeing was complementary to requirements under the B767 Airworthiness Limitations Structural Inspection program. It was the failure by Ansett to appropriately incorporate the required Airworthiness Limitations Structural Inspections, issued in June 1997 and updated in June 2000, into the B767 system of maintenance that led to the withdrawal from service of six Ansett B767 aircraft in December 2000.
Withdrawal from service of Ansett B767 aircraft in April 2001
In March 2000, Boeing issued an Alertvii service bulletin to detect and repair fatigue cracks in the wing front spar outboard pitch load fitting of the B767 engine mounting strut. Boeing recommended that the work be carried out within 180 calendar days. A revision to the service bulletin was issued in November 2000. In March 2001, Ansett became aware that they had not acted on either the original or the revised service bulletins.
During the period from 7-9 April 2001, inspections revealed cracks in the pitch load fittings of three of the Ansett B767 aircraft and they were withdrawn from service. On 9 April 2001 CASA required that a further four Ansett B767 aircraft be withdrawn from service, pending inspection. Those inspections were subsequently carried out, and the aircraft were cleared to fly.
Deficiencies in the Ansett engineering and maintenance organisation
The ATSB investigation found that similar deficiencies within the Ansett engineering and maintenance organisation led to the withdrawal from service of the B767 aircraft in December 2000 and April 2001. Those deficiencies were related to:
* organisational structure and change management
* systems for managing work processes and tasks
* resource allocation and workload.
However, the investigation found no evidence to suggest that Ansett had deliberately breached airworthiness regulations.
Ansett had undergone considerable change over a number of years. Many of the Ansett systems had developed at a time when the company faced a very different aviation environment. Over time, efficiency measures were introduced to improve productivity but the introduction of modern robust systems did not keep pace with the relative reduction in human resources and loss of corporate knowledge.
Risk management and implementation of change within the Ansett engineering and maintenance organisation were flawed. Inadequate allowance was made for the extra demand on resources in some key areas during the change period.
The Ansett fleet was diverse and the point had been reached where some essential aircraft support programs were largely dependent on one or two people. Hence it was possible for an error or omission by a particular specialist to go undetected for a number of years.
Resource allocation and workload issues had been evident within some areas of the Ansett engineering and maintenance organisation for a considerable period of time. The investigation found that measures aimed at achieving greater productivity had been introduced throughout the organisation without sufficient regard to the different circumstances and criticality of the different work areas. Insufficient consideration had been given to the possible consequences of resource constraints on the core activities of some safety-critical areas of the organisation.
People and robust systems are two of the prime defences against error. Therefore, a combination of poor systems and inadequate resources has the potential to compromise safety. If a failure by one or two individuals can result in a failure of the system as a whole, then the underlying problem is a deficient system, not simply human fallibility.
The Australian continuing airworthiness system
The ATSB investigation found that based on the Ansett B767 experience, the Australian system for continuing airworthiness of Class A aircraft was not as robust as it could have been, as evidenced by:
* uncertainty about continuing airworthiness regulatory requirements
* inadequate regulatory oversight of a major operators continuing airworthiness activities
* Australian major defect report information not being used to best effect.
The investigation identified a need for the regulatory basis for continuing airworthiness requirements of Class A aircraft to be better defined and disseminated to operators.
No evidence was found to indicate that CASA had given formal consideration to monitoring the introduction of the B767 Airworthiness Limitations Structural Inspection program by Ansett from 1997 onwards.
Prior to December 2000, there was apparently little or no awareness among Ansett senior management or within CASA of the underlying systemic problems that had developed within the Ansett engineering and maintenance organisation. The presence of organisational deficiencies remained undetected. In addition, there were delays in adapting regulatory oversight of Ansett in response to indications that Ansett was an organisation facing increasing risk.
The decision by the then Civil Aviation Authority in the early 1990s to reduce its previous level of involvement in a number of safety-related areas did not adequately allow for possible longer-term adverse effects. This included reducing the work done by Authority specialist staff in reviewing manufacturer's service bulletins relevant to Australian Class A aircraft, and relying on operators' systems and on action by overseas regulators in some airworthiness matters.
CASA's central database for major defect reports was incomplete, partly due to deficiencies in reporting, and the information received was not always fully analysed. In addition, feedback to the initiators of major defect reports, and to other operators, was limited. As a result, the potential safety benefit of the major defect reporting system was not fully achieved.
The FAA and ICAO
Delays by the US Federal Aviation Administration (FAA) contributed to a lack of awareness by Ansett and CASA of required B767 Airworthiness Limitations Structural Inspections. This breakdown in FAA process was acknowledged by the US Secretary of Transportation in August 2001. The FAA did not issue airworthiness directives in relation to the June 1997 Airworthiness Limitations Structural Inspection program, or the service bulletins for the Body Station 1809.5 bulkhead outer chord and the wing front spar outboard pitch load fitting, until after the second Ansett groundings in April 2001.
Different views within the FAA as to the importance of airworthiness directives to mandate continuing airworthiness requirements for damage tolerance aircraft types contributed to a lack of timely action by the FAA. The ATSB report includes recommendations that the FAA ensure that such airworthiness directives are processed and released without undue delay, and that affected parties should be informed when delays do occur. The report also recommends that the FAA ensure that the process for determining grace periods for aircraft to comply with airworthiness directives is both systematic and transparent.
The ATSB report outlines where the existing international continuing airworthiness system, as defined by International Civil Aviation Organization (ICAO) standards and recommended practices, could be enhanced by the application of quality assurance mechanisms to the processing and distribution of safety-related information.
The events outlined in this report indicate that there was a breakdown in the continuing airworthiness system within Ansett, the FAA, and CASA. In addition, the possible safety significance of cracks in the area of the B767 Body Station 1809.5 bulkhead outer chord was not initially highlighted by Boeing.
Safety action
On 12 April 2001, the ATSB released two safety recommendations to CASA. The intent of these recommendations was to enhance the robustness of the systems used to manage the continuing airworthiness of Australian registered aircraft such as the B767 by ensuring that:
* action, or lack of action, by another State did not adversely affect the safety of Australian Class A aircraft
* all service bulletins relevant to Australian Class A aircraft were received, assessed and implemented or mandated as appropriate.
CASA subsequently initiated a comprehensive review of its systems to monitor, assess, and act on service bulletins, to ensure that those critical to safety could be readily identified and acted upon appropriately. Recommendations from that review were addressed in an associated implementation plan that detailed the nature and timing of the actions that CASA would take in response to the recommendations. The ATSB is monitoring the implementation of this important safety action.
In response to the circumstances of the events of December 2000 and April 2001, the FAA has included further checks and balances designed to ensure that all service bulletins issued by US manufacturers are properly reviewed and addressed. In addition, the FAA has established an 'early warning system' to provide non-US airworthiness authorities with information on pending occurrence investigations that may result in mandatory action by the FAA.
The manner in which events developed highlights the need for organisations to be continually mindful of potential threats to safe operations. Periodic review is needed to ensure that existing systems for maintaining air safety keep pace with the changing environment.
Implementation by the relevant organisations of the recommendations made by the ATSB as a result of this investigation should help to ensure that aviation systems, both within Australia and internationally, are strengthened and that air safety for Class A aircraft is enhanced.
Investigation into Ansett Australia maintenance safety deficiencies and the control of continuing airworthiness of Class A aircraft