When will airlines start preparing safety cases?
There are no limits
Join Date: May 2002
Location: Shrewsbury, England.
Age: 66
Posts: 505
Received 0 Likes
on
0 Posts
Top management need to understand they can delegate responsibility, not accountability.
Join Date: Aug 2003
Location: Sale, Australia
Age: 80
Posts: 3,832
Likes: 0
Received 0 Likes
on
0 Posts
Whilst we don't have an explanation as yet for the 757 incident it may be timely to revisit an old incident which on the face of it seemingly has parallels. And it shows the difficulties to be had in managing safety. Bear in mind when reading, the Broome S-92 incident, and the failure to adequately investigate, which had they done so, may have prevented a catastrophic accident.
Investigation into Ansett Australia maintenance safety deficiencies and the control of continuing airworthiness of Class A aircraft
Summary
Australia has an excellent air transport safety record. Major Australian airlines have long been regarded as being among the world's safest, and there have been no fatalities involving an Australian high capacity jet aircraft. This enviable record is due, in part, to an aviation safety culture that recognises the need for constant safety awareness.
Given the commercial pressures facing international aviation, the events described in this report should be seen as a learning experience for the aviation industry, regulatory bodies, and all organisations concerned with continuing airworthiness assurance.
In December 2000 and in April 2001, a number of Ansett Australia (Ansett) Boeing 767 (B767) aircraft were withdrawn from service because certain required fatigue damage inspections of the aircraft structure had been missed. As a result there was uncertainty as to the continuing airworthiness status of the aircraft. In December 2000 the concerns related to possible fatigue cracking in the rear fuselage of the aircraft, and in April 2001 the concerns related to possible fatigue cracking of the engine strut fitting on the wing front spar.
On 11 January 2001, the Australian Transport Safety Bureau (ATSB) commenced an investigation into the circumstances surrounding the withdrawal from service of the Ansett B767 aircraft as the situation was regarded as indicative of a potential safety deficiencyi. On 10 April 2001 the ATSB investigation was extended to include an examination of the continuing airworthiness system for Australian Class Aii aircraft such as the B767.
Action by Ansett and the Civil Aviation Safety Authority (CASA) addressed the potential risks to fare-paying passengers. Although Ansett was subsequently placed into voluntary administration in September 2001, the ATSB continued a detailed systemic investigation because of the importance of the issues involved, both in Australia and internationally.
The international continuing airworthiness system, like all complex and safety-critical activities, is dependent on robustiii systems to maintain high reliability. The circumstances surrounding the withdrawal from service of the Ansett B767 aircraft revealed, among other things, that the reliability of the continuing airworthiness system was threatened by a number of weak defences.
The B767 aircraft type was among the first in the world to be designed and certified under damage tolerance principles. Damage tolerance certification relies heavily on scheduled inspections to ensure continuing airworthiness. The aircraft structure is designed to maintain integrity until any fatigue or corrosion damage can be detected at a scheduled inspection, and appropriate action taken. Therefore, in itself, the presence of fatigue cracks in the Ansett B767 aircraft was not necessarily a cause for undue concern. However, it was critical that there were robust systems to ensure that the required structural inspections were carried out to detect the cracks before they exceeded acceptable limits.
Withdrawal from service of Ansett B767 aircraft in December 2000
Ansett was the sixth airline worldwide, and the first airline outside North America, to operate the B767. Of the nine Ansett B767-200 aircraft, five were first flown in 1983 and two in 1984. The aircraft accumulated a high number of flight cyclesiv because they were mostly flown on comparatively short domestic sectors. Ansett had been working with Boeing on fatigue cracking in the area of the Body Stationv 1809.5 bulkhead outer chord since 1996.
In June 1997, Boeing introduced the Airworthiness Limitations Structural Inspection programvi for the B767. The program was an essential part of the damage tolerance requirements and was designed to detect fatigue cracking in susceptible areas that had been identified through testing and in-service experience. Ansett staff did not initially recognise that some Airworthiness Limitations Structural Inspections were required by 25,000 cycles and a period of almost two and a half years elapsed before that error was identified. At the time that the inspection program was introduced, some Ansett B767 aircraft had already flown more than 25,000 cycles. In June 2000, further 25,000 cycle inspections were introduced, including in the area of the Body Station 1809.5 bulkhead outer chord. Ansett did not initially act on this.
In December 2000, Ansett senior management became aware of the missed inspections and the aircraft were withdrawn from service on 23 December 2000, despite the high commercial cost to the company. At that time, both Ansett and CASA were of the belief that compliance with the missed inspections was mandatory. Subsequent legal advice indicated that the regulatory basis for mandating compliance with the Airworthiness Limitations Structural Inspections for Australian operators was unclear. On 29 December 2000, CASA issued a direction to Ansett specifically mandating the inspections for the Ansett B767 aircraft.
The ATSB investigation found that the Ansett system for the introduction and scheduling of the B767 Airworthiness Limitations Structural Inspections was deficient and vulnerable to human error. A mistake or omission by one or two people could potentially result in continuing airworthiness assurance being compromised. In addition, deficiencies existed in resource allocation and in the supporting information management systems.
From October 1998, Boeing also issued a series of service bulletins in relation to fatigue cracks in the area of the B767 Body Station 1809.5 bulkhead outer chord. Service bulletins are issued by aircraft, component, or engine manufacturers to provide operators with relevant service information. Not all service bulletins are safety-related, and compliance with a particular service bulletin can only be mandated by the State of Registry of an aircraft.
Boeing initially notified operators that the service bulletin requirements were primarily commercial in nature. It was not until November 2001 that Boeing indicated that the service bulletin dealt with a potentially major safety issue. The FAA had mandated action by US operators in relation to the service bulletin in April 2001.
Any action to be taken by Ansett in relation to the Body Station 1809.5 service bulletins issued by Boeing was complementary to requirements under the B767 Airworthiness Limitations Structural Inspection program. It was the failure by Ansett to appropriately incorporate the required Airworthiness Limitations Structural Inspections, issued in June 1997 and updated in June 2000, into the B767 system of maintenance that led to the withdrawal from service of six Ansett B767 aircraft in December 2000.
Withdrawal from service of Ansett B767 aircraft in April 2001
In March 2000, Boeing issued an Alertvii service bulletin to detect and repair fatigue cracks in the wing front spar outboard pitch load fitting of the B767 engine mounting strut. Boeing recommended that the work be carried out within 180 calendar days. A revision to the service bulletin was issued in November 2000. In March 2001, Ansett became aware that they had not acted on either the original or the revised service bulletins.
During the period from 7-9 April 2001, inspections revealed cracks in the pitch load fittings of three of the Ansett B767 aircraft and they were withdrawn from service. On 9 April 2001 CASA required that a further four Ansett B767 aircraft be withdrawn from service, pending inspection. Those inspections were subsequently carried out, and the aircraft were cleared to fly.
Deficiencies in the Ansett engineering and maintenance organisation
The ATSB investigation found that similar deficiencies within the Ansett engineering and maintenance organisation led to the withdrawal from service of the B767 aircraft in December 2000 and April 2001. Those deficiencies were related to:
* organisational structure and change management
* systems for managing work processes and tasks
* resource allocation and workload.
However, the investigation found no evidence to suggest that Ansett had deliberately breached airworthiness regulations.
Ansett had undergone considerable change over a number of years. Many of the Ansett systems had developed at a time when the company faced a very different aviation environment. Over time, efficiency measures were introduced to improve productivity but the introduction of modern robust systems did not keep pace with the relative reduction in human resources and loss of corporate knowledge.
Risk management and implementation of change within the Ansett engineering and maintenance organisation were flawed. Inadequate allowance was made for the extra demand on resources in some key areas during the change period.
The Ansett fleet was diverse and the point had been reached where some essential aircraft support programs were largely dependent on one or two people. Hence it was possible for an error or omission by a particular specialist to go undetected for a number of years.
Resource allocation and workload issues had been evident within some areas of the Ansett engineering and maintenance organisation for a considerable period of time. The investigation found that measures aimed at achieving greater productivity had been introduced throughout the organisation without sufficient regard to the different circumstances and criticality of the different work areas. Insufficient consideration had been given to the possible consequences of resource constraints on the core activities of some safety-critical areas of the organisation.
People and robust systems are two of the prime defences against error. Therefore, a combination of poor systems and inadequate resources has the potential to compromise safety. If a failure by one or two individuals can result in a failure of the system as a whole, then the underlying problem is a deficient system, not simply human fallibility.
The Australian continuing airworthiness system
The ATSB investigation found that based on the Ansett B767 experience, the Australian system for continuing airworthiness of Class A aircraft was not as robust as it could have been, as evidenced by:
* uncertainty about continuing airworthiness regulatory requirements
* inadequate regulatory oversight of a major operators continuing airworthiness activities
* Australian major defect report information not being used to best effect.
The investigation identified a need for the regulatory basis for continuing airworthiness requirements of Class A aircraft to be better defined and disseminated to operators.
No evidence was found to indicate that CASA had given formal consideration to monitoring the introduction of the B767 Airworthiness Limitations Structural Inspection program by Ansett from 1997 onwards.
Prior to December 2000, there was apparently little or no awareness among Ansett senior management or within CASA of the underlying systemic problems that had developed within the Ansett engineering and maintenance organisation. The presence of organisational deficiencies remained undetected. In addition, there were delays in adapting regulatory oversight of Ansett in response to indications that Ansett was an organisation facing increasing risk.
The decision by the then Civil Aviation Authority in the early 1990s to reduce its previous level of involvement in a number of safety-related areas did not adequately allow for possible longer-term adverse effects. This included reducing the work done by Authority specialist staff in reviewing manufacturer's service bulletins relevant to Australian Class A aircraft, and relying on operators' systems and on action by overseas regulators in some airworthiness matters.
CASA's central database for major defect reports was incomplete, partly due to deficiencies in reporting, and the information received was not always fully analysed. In addition, feedback to the initiators of major defect reports, and to other operators, was limited. As a result, the potential safety benefit of the major defect reporting system was not fully achieved.
The FAA and ICAO
Delays by the US Federal Aviation Administration (FAA) contributed to a lack of awareness by Ansett and CASA of required B767 Airworthiness Limitations Structural Inspections. This breakdown in FAA process was acknowledged by the US Secretary of Transportation in August 2001. The FAA did not issue airworthiness directives in relation to the June 1997 Airworthiness Limitations Structural Inspection program, or the service bulletins for the Body Station 1809.5 bulkhead outer chord and the wing front spar outboard pitch load fitting, until after the second Ansett groundings in April 2001.
Different views within the FAA as to the importance of airworthiness directives to mandate continuing airworthiness requirements for damage tolerance aircraft types contributed to a lack of timely action by the FAA. The ATSB report includes recommendations that the FAA ensure that such airworthiness directives are processed and released without undue delay, and that affected parties should be informed when delays do occur. The report also recommends that the FAA ensure that the process for determining grace periods for aircraft to comply with airworthiness directives is both systematic and transparent.
The ATSB report outlines where the existing international continuing airworthiness system, as defined by International Civil Aviation Organization (ICAO) standards and recommended practices, could be enhanced by the application of quality assurance mechanisms to the processing and distribution of safety-related information.
The events outlined in this report indicate that there was a breakdown in the continuing airworthiness system within Ansett, the FAA, and CASA. In addition, the possible safety significance of cracks in the area of the B767 Body Station 1809.5 bulkhead outer chord was not initially highlighted by Boeing.
Safety action
On 12 April 2001, the ATSB released two safety recommendations to CASA. The intent of these recommendations was to enhance the robustness of the systems used to manage the continuing airworthiness of Australian registered aircraft such as the B767 by ensuring that:
* action, or lack of action, by another State did not adversely affect the safety of Australian Class A aircraft
* all service bulletins relevant to Australian Class A aircraft were received, assessed and implemented or mandated as appropriate.
CASA subsequently initiated a comprehensive review of its systems to monitor, assess, and act on service bulletins, to ensure that those critical to safety could be readily identified and acted upon appropriately. Recommendations from that review were addressed in an associated implementation plan that detailed the nature and timing of the actions that CASA would take in response to the recommendations. The ATSB is monitoring the implementation of this important safety action.
In response to the circumstances of the events of December 2000 and April 2001, the FAA has included further checks and balances designed to ensure that all service bulletins issued by US manufacturers are properly reviewed and addressed. In addition, the FAA has established an 'early warning system' to provide non-US airworthiness authorities with information on pending occurrence investigations that may result in mandatory action by the FAA.
The manner in which events developed highlights the need for organisations to be continually mindful of potential threats to safe operations. Periodic review is needed to ensure that existing systems for maintaining air safety keep pace with the changing environment.
Implementation by the relevant organisations of the recommendations made by the ATSB as a result of this investigation should help to ensure that aviation systems, both within Australia and internationally, are strengthened and that air safety for Class A aircraft is enhanced.
Investigation into Ansett Australia maintenance safety deficiencies and the control of continuing airworthiness of Class A aircraft
Investigation into Ansett Australia maintenance safety deficiencies and the control of continuing airworthiness of Class A aircraft
Summary
Australia has an excellent air transport safety record. Major Australian airlines have long been regarded as being among the world's safest, and there have been no fatalities involving an Australian high capacity jet aircraft. This enviable record is due, in part, to an aviation safety culture that recognises the need for constant safety awareness.
Given the commercial pressures facing international aviation, the events described in this report should be seen as a learning experience for the aviation industry, regulatory bodies, and all organisations concerned with continuing airworthiness assurance.
In December 2000 and in April 2001, a number of Ansett Australia (Ansett) Boeing 767 (B767) aircraft were withdrawn from service because certain required fatigue damage inspections of the aircraft structure had been missed. As a result there was uncertainty as to the continuing airworthiness status of the aircraft. In December 2000 the concerns related to possible fatigue cracking in the rear fuselage of the aircraft, and in April 2001 the concerns related to possible fatigue cracking of the engine strut fitting on the wing front spar.
On 11 January 2001, the Australian Transport Safety Bureau (ATSB) commenced an investigation into the circumstances surrounding the withdrawal from service of the Ansett B767 aircraft as the situation was regarded as indicative of a potential safety deficiencyi. On 10 April 2001 the ATSB investigation was extended to include an examination of the continuing airworthiness system for Australian Class Aii aircraft such as the B767.
Action by Ansett and the Civil Aviation Safety Authority (CASA) addressed the potential risks to fare-paying passengers. Although Ansett was subsequently placed into voluntary administration in September 2001, the ATSB continued a detailed systemic investigation because of the importance of the issues involved, both in Australia and internationally.
The international continuing airworthiness system, like all complex and safety-critical activities, is dependent on robustiii systems to maintain high reliability. The circumstances surrounding the withdrawal from service of the Ansett B767 aircraft revealed, among other things, that the reliability of the continuing airworthiness system was threatened by a number of weak defences.
The B767 aircraft type was among the first in the world to be designed and certified under damage tolerance principles. Damage tolerance certification relies heavily on scheduled inspections to ensure continuing airworthiness. The aircraft structure is designed to maintain integrity until any fatigue or corrosion damage can be detected at a scheduled inspection, and appropriate action taken. Therefore, in itself, the presence of fatigue cracks in the Ansett B767 aircraft was not necessarily a cause for undue concern. However, it was critical that there were robust systems to ensure that the required structural inspections were carried out to detect the cracks before they exceeded acceptable limits.
Withdrawal from service of Ansett B767 aircraft in December 2000
Ansett was the sixth airline worldwide, and the first airline outside North America, to operate the B767. Of the nine Ansett B767-200 aircraft, five were first flown in 1983 and two in 1984. The aircraft accumulated a high number of flight cyclesiv because they were mostly flown on comparatively short domestic sectors. Ansett had been working with Boeing on fatigue cracking in the area of the Body Stationv 1809.5 bulkhead outer chord since 1996.
In June 1997, Boeing introduced the Airworthiness Limitations Structural Inspection programvi for the B767. The program was an essential part of the damage tolerance requirements and was designed to detect fatigue cracking in susceptible areas that had been identified through testing and in-service experience. Ansett staff did not initially recognise that some Airworthiness Limitations Structural Inspections were required by 25,000 cycles and a period of almost two and a half years elapsed before that error was identified. At the time that the inspection program was introduced, some Ansett B767 aircraft had already flown more than 25,000 cycles. In June 2000, further 25,000 cycle inspections were introduced, including in the area of the Body Station 1809.5 bulkhead outer chord. Ansett did not initially act on this.
In December 2000, Ansett senior management became aware of the missed inspections and the aircraft were withdrawn from service on 23 December 2000, despite the high commercial cost to the company. At that time, both Ansett and CASA were of the belief that compliance with the missed inspections was mandatory. Subsequent legal advice indicated that the regulatory basis for mandating compliance with the Airworthiness Limitations Structural Inspections for Australian operators was unclear. On 29 December 2000, CASA issued a direction to Ansett specifically mandating the inspections for the Ansett B767 aircraft.
The ATSB investigation found that the Ansett system for the introduction and scheduling of the B767 Airworthiness Limitations Structural Inspections was deficient and vulnerable to human error. A mistake or omission by one or two people could potentially result in continuing airworthiness assurance being compromised. In addition, deficiencies existed in resource allocation and in the supporting information management systems.
From October 1998, Boeing also issued a series of service bulletins in relation to fatigue cracks in the area of the B767 Body Station 1809.5 bulkhead outer chord. Service bulletins are issued by aircraft, component, or engine manufacturers to provide operators with relevant service information. Not all service bulletins are safety-related, and compliance with a particular service bulletin can only be mandated by the State of Registry of an aircraft.
Boeing initially notified operators that the service bulletin requirements were primarily commercial in nature. It was not until November 2001 that Boeing indicated that the service bulletin dealt with a potentially major safety issue. The FAA had mandated action by US operators in relation to the service bulletin in April 2001.
Any action to be taken by Ansett in relation to the Body Station 1809.5 service bulletins issued by Boeing was complementary to requirements under the B767 Airworthiness Limitations Structural Inspection program. It was the failure by Ansett to appropriately incorporate the required Airworthiness Limitations Structural Inspections, issued in June 1997 and updated in June 2000, into the B767 system of maintenance that led to the withdrawal from service of six Ansett B767 aircraft in December 2000.
Withdrawal from service of Ansett B767 aircraft in April 2001
In March 2000, Boeing issued an Alertvii service bulletin to detect and repair fatigue cracks in the wing front spar outboard pitch load fitting of the B767 engine mounting strut. Boeing recommended that the work be carried out within 180 calendar days. A revision to the service bulletin was issued in November 2000. In March 2001, Ansett became aware that they had not acted on either the original or the revised service bulletins.
During the period from 7-9 April 2001, inspections revealed cracks in the pitch load fittings of three of the Ansett B767 aircraft and they were withdrawn from service. On 9 April 2001 CASA required that a further four Ansett B767 aircraft be withdrawn from service, pending inspection. Those inspections were subsequently carried out, and the aircraft were cleared to fly.
Deficiencies in the Ansett engineering and maintenance organisation
The ATSB investigation found that similar deficiencies within the Ansett engineering and maintenance organisation led to the withdrawal from service of the B767 aircraft in December 2000 and April 2001. Those deficiencies were related to:
* organisational structure and change management
* systems for managing work processes and tasks
* resource allocation and workload.
However, the investigation found no evidence to suggest that Ansett had deliberately breached airworthiness regulations.
Ansett had undergone considerable change over a number of years. Many of the Ansett systems had developed at a time when the company faced a very different aviation environment. Over time, efficiency measures were introduced to improve productivity but the introduction of modern robust systems did not keep pace with the relative reduction in human resources and loss of corporate knowledge.
Risk management and implementation of change within the Ansett engineering and maintenance organisation were flawed. Inadequate allowance was made for the extra demand on resources in some key areas during the change period.
The Ansett fleet was diverse and the point had been reached where some essential aircraft support programs were largely dependent on one or two people. Hence it was possible for an error or omission by a particular specialist to go undetected for a number of years.
Resource allocation and workload issues had been evident within some areas of the Ansett engineering and maintenance organisation for a considerable period of time. The investigation found that measures aimed at achieving greater productivity had been introduced throughout the organisation without sufficient regard to the different circumstances and criticality of the different work areas. Insufficient consideration had been given to the possible consequences of resource constraints on the core activities of some safety-critical areas of the organisation.
People and robust systems are two of the prime defences against error. Therefore, a combination of poor systems and inadequate resources has the potential to compromise safety. If a failure by one or two individuals can result in a failure of the system as a whole, then the underlying problem is a deficient system, not simply human fallibility.
The Australian continuing airworthiness system
The ATSB investigation found that based on the Ansett B767 experience, the Australian system for continuing airworthiness of Class A aircraft was not as robust as it could have been, as evidenced by:
* uncertainty about continuing airworthiness regulatory requirements
* inadequate regulatory oversight of a major operators continuing airworthiness activities
* Australian major defect report information not being used to best effect.
The investigation identified a need for the regulatory basis for continuing airworthiness requirements of Class A aircraft to be better defined and disseminated to operators.
No evidence was found to indicate that CASA had given formal consideration to monitoring the introduction of the B767 Airworthiness Limitations Structural Inspection program by Ansett from 1997 onwards.
Prior to December 2000, there was apparently little or no awareness among Ansett senior management or within CASA of the underlying systemic problems that had developed within the Ansett engineering and maintenance organisation. The presence of organisational deficiencies remained undetected. In addition, there were delays in adapting regulatory oversight of Ansett in response to indications that Ansett was an organisation facing increasing risk.
The decision by the then Civil Aviation Authority in the early 1990s to reduce its previous level of involvement in a number of safety-related areas did not adequately allow for possible longer-term adverse effects. This included reducing the work done by Authority specialist staff in reviewing manufacturer's service bulletins relevant to Australian Class A aircraft, and relying on operators' systems and on action by overseas regulators in some airworthiness matters.
CASA's central database for major defect reports was incomplete, partly due to deficiencies in reporting, and the information received was not always fully analysed. In addition, feedback to the initiators of major defect reports, and to other operators, was limited. As a result, the potential safety benefit of the major defect reporting system was not fully achieved.
The FAA and ICAO
Delays by the US Federal Aviation Administration (FAA) contributed to a lack of awareness by Ansett and CASA of required B767 Airworthiness Limitations Structural Inspections. This breakdown in FAA process was acknowledged by the US Secretary of Transportation in August 2001. The FAA did not issue airworthiness directives in relation to the June 1997 Airworthiness Limitations Structural Inspection program, or the service bulletins for the Body Station 1809.5 bulkhead outer chord and the wing front spar outboard pitch load fitting, until after the second Ansett groundings in April 2001.
Different views within the FAA as to the importance of airworthiness directives to mandate continuing airworthiness requirements for damage tolerance aircraft types contributed to a lack of timely action by the FAA. The ATSB report includes recommendations that the FAA ensure that such airworthiness directives are processed and released without undue delay, and that affected parties should be informed when delays do occur. The report also recommends that the FAA ensure that the process for determining grace periods for aircraft to comply with airworthiness directives is both systematic and transparent.
The ATSB report outlines where the existing international continuing airworthiness system, as defined by International Civil Aviation Organization (ICAO) standards and recommended practices, could be enhanced by the application of quality assurance mechanisms to the processing and distribution of safety-related information.
The events outlined in this report indicate that there was a breakdown in the continuing airworthiness system within Ansett, the FAA, and CASA. In addition, the possible safety significance of cracks in the area of the B767 Body Station 1809.5 bulkhead outer chord was not initially highlighted by Boeing.
Safety action
On 12 April 2001, the ATSB released two safety recommendations to CASA. The intent of these recommendations was to enhance the robustness of the systems used to manage the continuing airworthiness of Australian registered aircraft such as the B767 by ensuring that:
* action, or lack of action, by another State did not adversely affect the safety of Australian Class A aircraft
* all service bulletins relevant to Australian Class A aircraft were received, assessed and implemented or mandated as appropriate.
CASA subsequently initiated a comprehensive review of its systems to monitor, assess, and act on service bulletins, to ensure that those critical to safety could be readily identified and acted upon appropriately. Recommendations from that review were addressed in an associated implementation plan that detailed the nature and timing of the actions that CASA would take in response to the recommendations. The ATSB is monitoring the implementation of this important safety action.
In response to the circumstances of the events of December 2000 and April 2001, the FAA has included further checks and balances designed to ensure that all service bulletins issued by US manufacturers are properly reviewed and addressed. In addition, the FAA has established an 'early warning system' to provide non-US airworthiness authorities with information on pending occurrence investigations that may result in mandatory action by the FAA.
The manner in which events developed highlights the need for organisations to be continually mindful of potential threats to safe operations. Periodic review is needed to ensure that existing systems for maintaining air safety keep pace with the changing environment.
Implementation by the relevant organisations of the recommendations made by the ATSB as a result of this investigation should help to ensure that aviation systems, both within Australia and internationally, are strengthened and that air safety for Class A aircraft is enhanced.
Investigation into Ansett Australia maintenance safety deficiencies and the control of continuing airworthiness of Class A aircraft
Join Date: Jul 2008
Location: UK
Age: 69
Posts: 475
Likes: 0
Received 0 Likes
on
0 Posts
Lets be clear on one thing here as there are no parallels with the above.
United DID NOT miss or overlook an AD. They only half implemented it. Yes we should perhaps wait for a proper explanation however it is incredibly serious that the AD was detected, scheduled to be performed within the allowable time frame. yet not fully embodied.
There are a number of failures there which are a cause for serious concern.
If this was simply an AD oversight issue I would have fewer problems with events.
United DID NOT miss or overlook an AD. They only half implemented it. Yes we should perhaps wait for a proper explanation however it is incredibly serious that the AD was detected, scheduled to be performed within the allowable time frame. yet not fully embodied.
There are a number of failures there which are a cause for serious concern.
If this was simply an AD oversight issue I would have fewer problems with events.
Join Date: Aug 2003
Location: Sale, Australia
Age: 80
Posts: 3,832
Likes: 0
Received 0 Likes
on
0 Posts
Lets be clear on one thing here as there are no parallels with the above.
Join Date: Sep 2000
Location: Bielefeld, Germany
Posts: 955
Likes: 0
Received 0 Likes
on
0 Posts
Brian,
I've lost your point in the extensive quote. Is it that communications about complex matters such as the quality of safety-mandated inspections in airlines are less good than they should be?
Frankly, I find the UA event puzzling. Clearly, someone inside the airline detected something of which no one else there had been aware, namely that a certain step, a check step, in an AD had not been complied with. Good for them!
And someone else decided that a very public grounding of all their airplanes of a particular type was the appropriate response. The check step was trivial; it was all over with very quickly and the airplanes were back flying. There had been no in-flight incidents in half a decade related to the AD (this is very different from previous incidents with other airlines, in which the safety of flight was a real consideration). So why not spread the checks over a few days and minimise the disruption?
PBL
I've lost your point in the extensive quote. Is it that communications about complex matters such as the quality of safety-mandated inspections in airlines are less good than they should be?
Frankly, I find the UA event puzzling. Clearly, someone inside the airline detected something of which no one else there had been aware, namely that a certain step, a check step, in an AD had not been complied with. Good for them!
And someone else decided that a very public grounding of all their airplanes of a particular type was the appropriate response. The check step was trivial; it was all over with very quickly and the airplanes were back flying. There had been no in-flight incidents in half a decade related to the AD (this is very different from previous incidents with other airlines, in which the safety of flight was a real consideration). So why not spread the checks over a few days and minimise the disruption?
PBL
Join Date: Jul 2008
Location: UK
Age: 69
Posts: 475
Likes: 0
Received 0 Likes
on
0 Posts
Brian, the work (the SB/AD) was in the hands of maintenance. Now it is not feasible that any qualified individual would perform only half the work and release the aircraft as serviceable due to an oversight.
Even less so on an RVSM aircraft. If I am now to believe that 96 aircraft had their air data hardware modified without tests being performed afterwards that is an extremely serious WHY NOT?
As I doubt very much that only one individual was involved with all 96 aircraft this indicates an extremely serious culture issue.
That is why there are no parallels.
It is also worthy of note that some operators complained to the FAA that the original AD was too work intensive resulting in expensive long ground time. I wonder whether that operator was United.
This AD was deemed as necessary as safety was affected. Either the industry is serious about safety or its serious about making huge sums of money. You can have both but not when tickets are being sold for a few dollars.
It is time for all involved with aviation to wake up. Safety has been eroded due to commercial pressure and it has been going on for some time. The cracks have been ignored and those raising the alarm have been ridiculed.
We are now slowly entering the Payback era. I wish it was otherwise.
Even less so on an RVSM aircraft. If I am now to believe that 96 aircraft had their air data hardware modified without tests being performed afterwards that is an extremely serious WHY NOT?
As I doubt very much that only one individual was involved with all 96 aircraft this indicates an extremely serious culture issue.
That is why there are no parallels.
It is also worthy of note that some operators complained to the FAA that the original AD was too work intensive resulting in expensive long ground time. I wonder whether that operator was United.
This AD was deemed as necessary as safety was affected. Either the industry is serious about safety or its serious about making huge sums of money. You can have both but not when tickets are being sold for a few dollars.
It is time for all involved with aviation to wake up. Safety has been eroded due to commercial pressure and it has been going on for some time. The cracks have been ignored and those raising the alarm have been ridiculed.
We are now slowly entering the Payback era. I wish it was otherwise.
Join Date: Jul 2008
Location: UK
Age: 69
Posts: 475
Likes: 0
Received 0 Likes
on
0 Posts
The check step was trivial
A persistent erroneous warning could confuse and distract the flightcrew and lead to an increase in the flightcrew's workload. Such a situation could lead the flightcrew to act on hazardously misleading information, which could result in loss of control of the airplane. This action is intended to address the identified unsafe condition.
Had an aircraft had an accident immediately after the modification because they were distracted by a persistent erroneous warning the attitude towards that trivial matter of testing the system would be totally different.
System integrity is fundamental to airworthiness after a modification. United have a duty to fare paying passengers to ensure that to the best of their ability the aircraft they are flying in is safe. They failed in 96 cases X number of flights.
I hope this is one of the largest fines ever.
Last edited by Safety Concerns; 23rd Feb 2011 at 08:41.
Join Date: Sep 2000
Location: Bielefeld, Germany
Posts: 955
Likes: 0
Received 0 Likes
on
0 Posts
SC,
there are different meanings to the word "trivial". I meant it in the good old mathematical sense of "easily fulfilled" and I think you took me to be meaning "unimportant". I definitely don't think the verification step is unimportant!
PBL
there are different meanings to the word "trivial". I meant it in the good old mathematical sense of "easily fulfilled" and I think you took me to be meaning "unimportant". I definitely don't think the verification step is unimportant!
PBL
Moderator
the work (the SB/AD) was in the hands of maintenance
My comments are not directed, specifically, to the present discussion but are somewhat generic -
(a) having, at various times, had backgrounds in several bits of the game - design, manufacture, certification, fleet support (both in the [OEM and operator tech services] design and [operator] maintenance areas), and flying - one of the significant things which has become apparent relates to competent assessment of airworthiness documentation.
(b) we all come to the assessment table wearing glasses which are coloured by our particular skill and experience bases. Furthermore, we all tend to have some difficulty with defining the fence location around the paddock which represents our quantitative expertise. As a consequence, to a greater or lesser extent, a small group (often an individual in a small organisation) may run a higher incidence of interpretative errors than that associated with a larger group covering a wider competence base.
(c) provided the small group is conservative, we get away with the deficiency for much of the time. However, if the documentation is not explicitly clear, the risk of inappropriate interpretation can bite us on the tail.
(d) my view is that a multidisciplinary tech information review process generally will come up with a better assessment decision than that arrived at by the one-man band operation - a bit like the CRM principle that the commander is better served by utilising all pertinent resources during the assessment and management of an emergency/abnormal situation.
Some f'instances -
(a) OEM optional SB provided a comparatively low cost option to retract the landing gear doors following an alternate extension. Standard fit presumed that the (hanging) doors would abrade safely during the subsequent landing.
Operator maintenance organisation was a bit parochial and didn't discuss much with either flight standards or the two Industry engineering consultants retained (of which I was one). Maintenance assessment was that the cost/benefit wasn't warranted so the mod was declined without the knowledge of the other groups.
As Murphy would dictate, the abnormal situation arose but, during the recovery landing, the door decided to depart rather than wear down .. BRT overhaul cost was disproportionately higher than the mod cost ...
The CP, following the event, opined that, had he known of the mod, it would have been incorporated at flight standards direction to guard against just this risk....
(b) OEM parts organisation. Reviewed the warehouse stockholdings and decided that it would be a good accounting idea to scrap everything which had not moved during the past five years. This occurred during a period of several months between the previous fleet support manager's leaving to go to a far more interesting overseas flying task (he is a regular in PPRuNe and a fine chap) and my taking up the reins on a fill-in contract position. Pity that a large number of big ticket items, stocked for a mandatory SB coming up not all that far down the calendar path, were destroyed .. and had to be remanufactured to suit the mod requirements..
In that contract role, due to having to fund the design support but having no effective input into design output, I regularly was faced with enquiries from the fleet operators in respect of confusing aspects of SBs etc. Murphy dictates that the guy in the field will often read something the wrong way (ie not as intended) unless all the i's are dotted and t's crossed in a painstaking way.
(c) in my current day job, one of the sideline tasks is to do the final review of documentation relating to maintenance planning. Not infrequently, I reject documents back to the design group for clarification - they hate me but it comes with the territory.
.. and so it goes on. I'm sure that most here within the nuts and bolts fraternity can come up with a host of additional examples.
My comments are not directed, specifically, to the present discussion but are somewhat generic -
(a) having, at various times, had backgrounds in several bits of the game - design, manufacture, certification, fleet support (both in the [OEM and operator tech services] design and [operator] maintenance areas), and flying - one of the significant things which has become apparent relates to competent assessment of airworthiness documentation.
(b) we all come to the assessment table wearing glasses which are coloured by our particular skill and experience bases. Furthermore, we all tend to have some difficulty with defining the fence location around the paddock which represents our quantitative expertise. As a consequence, to a greater or lesser extent, a small group (often an individual in a small organisation) may run a higher incidence of interpretative errors than that associated with a larger group covering a wider competence base.
(c) provided the small group is conservative, we get away with the deficiency for much of the time. However, if the documentation is not explicitly clear, the risk of inappropriate interpretation can bite us on the tail.
(d) my view is that a multidisciplinary tech information review process generally will come up with a better assessment decision than that arrived at by the one-man band operation - a bit like the CRM principle that the commander is better served by utilising all pertinent resources during the assessment and management of an emergency/abnormal situation.
Some f'instances -
(a) OEM optional SB provided a comparatively low cost option to retract the landing gear doors following an alternate extension. Standard fit presumed that the (hanging) doors would abrade safely during the subsequent landing.
Operator maintenance organisation was a bit parochial and didn't discuss much with either flight standards or the two Industry engineering consultants retained (of which I was one). Maintenance assessment was that the cost/benefit wasn't warranted so the mod was declined without the knowledge of the other groups.
As Murphy would dictate, the abnormal situation arose but, during the recovery landing, the door decided to depart rather than wear down .. BRT overhaul cost was disproportionately higher than the mod cost ...
The CP, following the event, opined that, had he known of the mod, it would have been incorporated at flight standards direction to guard against just this risk....
(b) OEM parts organisation. Reviewed the warehouse stockholdings and decided that it would be a good accounting idea to scrap everything which had not moved during the past five years. This occurred during a period of several months between the previous fleet support manager's leaving to go to a far more interesting overseas flying task (he is a regular in PPRuNe and a fine chap) and my taking up the reins on a fill-in contract position. Pity that a large number of big ticket items, stocked for a mandatory SB coming up not all that far down the calendar path, were destroyed .. and had to be remanufactured to suit the mod requirements..
In that contract role, due to having to fund the design support but having no effective input into design output, I regularly was faced with enquiries from the fleet operators in respect of confusing aspects of SBs etc. Murphy dictates that the guy in the field will often read something the wrong way (ie not as intended) unless all the i's are dotted and t's crossed in a painstaking way.
(c) in my current day job, one of the sideline tasks is to do the final review of documentation relating to maintenance planning. Not infrequently, I reject documents back to the design group for clarification - they hate me but it comes with the territory.
.. and so it goes on. I'm sure that most here within the nuts and bolts fraternity can come up with a host of additional examples.
Join Date: Jul 2008
Location: UK
Age: 69
Posts: 475
Likes: 0
Received 0 Likes
on
0 Posts
having reviewed this SB today, one cannot miss the clearly stated required tests.
As I said previously, I feel sure one man did not cover all 96 aircraft so there are a number of serious unanswered questions here
As I said previously, I feel sure one man did not cover all 96 aircraft so there are a number of serious unanswered questions here
Join Date: Jun 1999
Location: Australasia
Posts: 362
Likes: 0
Received 0 Likes
on
0 Posts
Let's not miss the point!
Ghostdancer said it all in one sentence:
Exactly the same could be said for ISO 9000 et seq. In fact, if you look at it with an open mind, both approaches share a great many practical similarities as plain old "good business sense", certainly enough to be considered siblings.
Unfortunately, the implementation of SMS is likely to suffer the same birth defects as was the case for the ISO 9000 family - it was hijacked by commercial interests that turned it into the greatest paper consuming exercise of all time, so focused on minutiae that the strategic gains were obscured or lost. Both of these babies were conceived in simplicity as good management practices and are best born at home with loving parents, not forcibly extracted by huge surgical teams of self-professed experts trying to outdo the annual cost of Medicare/National Health!
Please, let's not miss the point...
Stay Alive,
Ultimately SMS is all about getting the right culture into an organisation.
Unfortunately, the implementation of SMS is likely to suffer the same birth defects as was the case for the ISO 9000 family - it was hijacked by commercial interests that turned it into the greatest paper consuming exercise of all time, so focused on minutiae that the strategic gains were obscured or lost. Both of these babies were conceived in simplicity as good management practices and are best born at home with loving parents, not forcibly extracted by huge surgical teams of self-professed experts trying to outdo the annual cost of Medicare/National Health!
Please, let's not miss the point...
Stay Alive,
Join Date: Aug 2003
Location: Sale, Australia
Age: 80
Posts: 3,832
Likes: 0
Received 0 Likes
on
0 Posts
Meanwhile this story shows the poor and complacent state of aviation safety
Join Date: Jul 2000
Location: London
Posts: 207
Likes: 0
Received 0 Likes
on
0 Posts
@ SM.
You are trying to get an audience about this even when you have been proven to be economical with the facts. (See the Ash thread in R&N)
No Airline has submitted a case for flying in the high concentration ash, but have for flight in the lower concentration areas.
See this CAA document
CAA issues update on Volcanic Ash Arrangements | CAA Newsroom | CAA
Where they say 'many airlines have submitted cases'
Nobody has submitted a case for high concentrations because they cannot prove it is safe to do so.
Stop exaggerating the case.
You are trying to get an audience about this even when you have been proven to be economical with the facts. (See the Ash thread in R&N)
No Airline has submitted a case for flying in the high concentration ash, but have for flight in the lower concentration areas.
See this CAA document
CAA issues update on Volcanic Ash Arrangements | CAA Newsroom | CAA
Where they say 'many airlines have submitted cases'
Nobody has submitted a case for high concentrations because they cannot prove it is safe to do so.
Stop exaggerating the case.
The One Your Mother Warned You About
Join Date: Mar 2007
Location: Wherever they pay me
Posts: 65
Likes: 0
Received 0 Likes
on
0 Posts
smallfry;
SM loves to exagerate a case he/she knows nothing of. On another thread on this forum a pilot asked for SM to be banned, I agree with that pilot. The media read these pages and SM's complete unfamiliarity with aviation practises will eventually cause a surfing journo to take SM's word as gospel.
Like many pilots here I've flown on Shell contracts. The sheer dishonesty of Shell safety beggars belief, the fact that SM thinks it is the worlds greatest tells me that he is as intellectualy dishonest as the real Shell.
SM, I've read the drivel about your "occupation" thankfully my company never wastes money on snake oil salesmen with great buzz words, we prefer to spend it on safety.
Oh, and by the way SM. The ash cloud case was a CAA requirement, most companies who COULD have a problem have applied, how many have the overworked FOIs approved?
Please MODs ban this fool before someone outside aviation takes him seriously.
SM loves to exagerate a case he/she knows nothing of. On another thread on this forum a pilot asked for SM to be banned, I agree with that pilot. The media read these pages and SM's complete unfamiliarity with aviation practises will eventually cause a surfing journo to take SM's word as gospel.
Like many pilots here I've flown on Shell contracts. The sheer dishonesty of Shell safety beggars belief, the fact that SM thinks it is the worlds greatest tells me that he is as intellectualy dishonest as the real Shell.
SM, I've read the drivel about your "occupation" thankfully my company never wastes money on snake oil salesmen with great buzz words, we prefer to spend it on safety.
Oh, and by the way SM. The ash cloud case was a CAA requirement, most companies who COULD have a problem have applied, how many have the overworked FOIs approved?
Please MODs ban this fool before someone outside aviation takes him seriously.
Join Date: Aug 2003
Location: Sale, Australia
Age: 80
Posts: 3,832
Likes: 0
Received 0 Likes
on
0 Posts
Are you really sure you want to take such a generalised and unsupported swipe at one of Europe's largest, most profitable and respected corporations
I would like to say a word on behalf of all the oil companies I've flown for, British and others. Without exception, they all stick absolutely rigidly to each and every safety rule - to the letter.
Until it becomes inconvenient.
This guy is headed in the right direction.
Join Date: Feb 2009
Location: Do I come here often?
Posts: 898
Likes: 0
Received 0 Likes
on
0 Posts
Brian;
I'll stick by FF's words (he and I share an office and I know how angry SM's sort of stupidity makes him), after all I once told the head of Shell what I thought of Shell safety procedures.
I also stick by the request to ban the ridiculous, pilot hating creature who calls himself Shell Management, lets face it, if he knew anything about aviation he would realise that in this case the CAA decided to put the ash cloud scenario in the safety case because most companies were doing just that and that by making it a regulation standardisation could be achieved rather than an alphabet soup of different ideas.
SND
I'll stick by FF's words (he and I share an office and I know how angry SM's sort of stupidity makes him), after all I once told the head of Shell what I thought of Shell safety procedures.
I also stick by the request to ban the ridiculous, pilot hating creature who calls himself Shell Management, lets face it, if he knew anything about aviation he would realise that in this case the CAA decided to put the ash cloud scenario in the safety case because most companies were doing just that and that by making it a regulation standardisation could be achieved rather than an alphabet soup of different ideas.
SND
Last edited by Sir Niall Dementia; 30th May 2011 at 17:46.
Moderator
Just a point on moderating, banning etc.
We don't set out to censor discussion just because we might not agree, like, etc,. the tone or content of a given poster's commentary.
If, however, posts get into overt nastiness, venture into potential legal minefields, have utterly no connection with aviation, etc., then we revisit.
On the positive side, inaccurate, careless, stupid, etc., posts challenge the reader to test his/her own knowledge base and, hopefully, encourages gentle criticism to divert the overall discussion along more appropriate pathways. Doesn't always work but that's the idea ...
However, at the individual's level, one can filter out posts by any other poster as one sees fit so that one's sensibilities are not assaulted by said poster's posts ...
We don't set out to censor discussion just because we might not agree, like, etc,. the tone or content of a given poster's commentary.
If, however, posts get into overt nastiness, venture into potential legal minefields, have utterly no connection with aviation, etc., then we revisit.
On the positive side, inaccurate, careless, stupid, etc., posts challenge the reader to test his/her own knowledge base and, hopefully, encourages gentle criticism to divert the overall discussion along more appropriate pathways. Doesn't always work but that's the idea ...
However, at the individual's level, one can filter out posts by any other poster as one sees fit so that one's sensibilities are not assaulted by said poster's posts ...
The Veloceraptor of Lounge Lizards
Join Date: Jan 2005
Location: From here the view is lovely
Posts: 339
Likes: 0
Received 0 Likes
on
0 Posts
Shell Management;
Like the coroner in this case you have confused an operations manual (and therefore mandatory requirement) with SMS. The crew were not correctly rested, and would have been in breach of European AOC requirements. The only SMS points in these findings were in reality against the airport.
The withdrawl of an AOC for lack of financial means can be taken against any European carrier who does not have the required funds which are mandated to cover maintenance etc.
An airline SMS is a very small document. Nearly everything an AOC holder does is covered by legislation and is in the holder's operations manual, the rest scheme which the coroner discussed will be OPs Manual section 7 (in Europe) and is roughly 30 pages of stringent regulations, before every flight both the ops department and the pilot must ensure he is legal to fly and at the end of every month the ops dept will raise a full record of pilots duty hours. These records are then audited regularly by the controlling authority and the AOC holders quality department.
In certain parts of SE Asia such controls may not exist (I know from personal experience) and the result can be very fatigued crews.
To ask "when will airlines start preparing safety cases?" is the wrong question. Airline safety management has been an organic, growing thing for more years than I care to remember, and certainly for far longer than the 25 years my career has so far lasted, and certainly pre-dates every other SMS out there.
Reading some of your comments you have a serious misunderstanding of us and what we do. An operations manual is mandatory, it cannot be more relaxed than the standards set down by the controlling authority, but can be stricter. When a company puts a requirement in to its' manual that requirement effectively becomes enshrined in law because it is in the manual, and woe betide the person who tries to go against it. Sir Niall Dementia of these pages is well known to some of us as a very knowledgable Head of Flight Safety and has long been involved in keeping people and aircraft in one piece as a union rep and in company management, I would strongly urge you to take heed of people like him and VeeAny who runs a superb safety website before trying to tell us where we are going wrong. The CAA asked carriers to work out a plan on how to deal with volcanic ash the carriers did knowing that the plans would go into the ops manuals and so become mandatory, you appeared to suggest that we were forced into it by legislation, we are never forced, in fact we often lead the push for safety as we are the people who understand our operating environment the best.
Like the coroner in this case you have confused an operations manual (and therefore mandatory requirement) with SMS. The crew were not correctly rested, and would have been in breach of European AOC requirements. The only SMS points in these findings were in reality against the airport.
The withdrawl of an AOC for lack of financial means can be taken against any European carrier who does not have the required funds which are mandated to cover maintenance etc.
An airline SMS is a very small document. Nearly everything an AOC holder does is covered by legislation and is in the holder's operations manual, the rest scheme which the coroner discussed will be OPs Manual section 7 (in Europe) and is roughly 30 pages of stringent regulations, before every flight both the ops department and the pilot must ensure he is legal to fly and at the end of every month the ops dept will raise a full record of pilots duty hours. These records are then audited regularly by the controlling authority and the AOC holders quality department.
In certain parts of SE Asia such controls may not exist (I know from personal experience) and the result can be very fatigued crews.
To ask "when will airlines start preparing safety cases?" is the wrong question. Airline safety management has been an organic, growing thing for more years than I care to remember, and certainly for far longer than the 25 years my career has so far lasted, and certainly pre-dates every other SMS out there.
Reading some of your comments you have a serious misunderstanding of us and what we do. An operations manual is mandatory, it cannot be more relaxed than the standards set down by the controlling authority, but can be stricter. When a company puts a requirement in to its' manual that requirement effectively becomes enshrined in law because it is in the manual, and woe betide the person who tries to go against it. Sir Niall Dementia of these pages is well known to some of us as a very knowledgable Head of Flight Safety and has long been involved in keeping people and aircraft in one piece as a union rep and in company management, I would strongly urge you to take heed of people like him and VeeAny who runs a superb safety website before trying to tell us where we are going wrong. The CAA asked carriers to work out a plan on how to deal with volcanic ash the carriers did knowing that the plans would go into the ops manuals and so become mandatory, you appeared to suggest that we were forced into it by legislation, we are never forced, in fact we often lead the push for safety as we are the people who understand our operating environment the best.
SM
I've been aviation, civil and military, for 35 years; I have acted as a safety officer, a commander, now a professional pilot. You seem to believe that aviation, at all levels, refuse to believe in safety management; that pilots and operations managers ignore risk management; and that upper level management lets it happen.
Have you stopped to consider the relentless reductions in safety performance? Have you considered that there are continuing safety audits and programs like IOSA? SMS requirements by ICAO?
Do you think that the safety record of the airline is an accident despite the idiocy of management and the regulators?
Once, please post some record of your experience in aviation management and operational line performance, just to show some credibility.
GF
I've been aviation, civil and military, for 35 years; I have acted as a safety officer, a commander, now a professional pilot. You seem to believe that aviation, at all levels, refuse to believe in safety management; that pilots and operations managers ignore risk management; and that upper level management lets it happen.
Have you stopped to consider the relentless reductions in safety performance? Have you considered that there are continuing safety audits and programs like IOSA? SMS requirements by ICAO?
Do you think that the safety record of the airline is an accident despite the idiocy of management and the regulators?
Once, please post some record of your experience in aviation management and operational line performance, just to show some credibility.
GF