Just a little slip: a tragedy of errors for G-EUOE
The AAIB have released their report on the incident involving Airbus A319-131 G-EUOE at London Heathrow Airport on 24 May 2013. This is one of those reports where I find I’m clenching my teeth as it becomes clear how much has gone wrong.
This incident begins the night before on the 23rd of May. The Airbus A319 registered G-EUOE was parked at Heathrow at Stand 513 for overnight maintenance.
Two British Airways technicians were working the short haul line maintenance shift at Terminal 5 from 18:45 to 06:45. The two technicians were assigned six aircraft. Each aircraft required a Daily Check and two of them required Weekly Checks: Airbus A319 G-EUOE and Airbus A321 G-EUXI. As a part of these checks, the technicians would determine what “defect rectifications” were required and carry them out.
Both were working overtime, it was not their regular shift. There was a shortage of staff at British Airways and so the staff had been putting in a lot of overtime. Although both technicians complied with the BA’s working time policy, the risk of fatigue was high.
They started their shift with a Daily Check on a Boeing 767 at Stand 546. The 767 and the two aircraft requiring Weekly Checks were prioritised as they were most likely to require additional maintenance following the checks.
They then continued to Stand 513 to wait for G-EUOE to arrive. G-EUOE was scheduled for both Daily and Weekly Checks, including a visual inspection of the IDG (Integrated Drive Generator) oil levels on both engines. The technicians split up so that each could check an engine. Fan cowl doors are heavy and cumbersome and it takes two technicians to lift and prop the doors open. However, the IDG oil levels can be checked by just holding the door up, so it is more efficient to split up so each technician can check one engine quickly if they don’t need to prop them open.
The IDG oil level was low on both engines. Both technicians lowered the fan cowl doors, not bothering to latch them as they were going to have to service them.
In order to top up the oil, they needed an IDG oil gun and oil from the maintenance stores. The north store room was being refurbished, which meant driving to the south store room which was about a five-minute drive away. They still had four aircraft to check, so rather than stop to drive to another part of the airport just for the IDG oil gun, they decided to continue on so that they would know how much work they needed to complete for the shift and what other equipment was required.
Technically, if the technicians leave the aircraft, the fan cowl doors should always be propped fully open using the stays or fully re-latched. Also, a warning notice should have been placed in the cockpit and then removed again when the work was complete and the fan cowl doors closed.
Realistically, it is common practice to skip these steps, not just at BA but generally. You can even top up the IDG oil leaving the fan cowl door resting on the hold-open device, so there’s no need to use the stays and they knew they would have the work completed before the end of their shifts.
The technicians made a note in the work allocation sheet to the effect that the IDG oil servicing task was incomplete. One updated the technical log on the aircraft’s flight deck and left an open entry in the technical log for incomplete Weekly Check.
They then moved on to the next aircraft requiring a Weekly Check, an Airbus 320 registration G-EUXI at stand 517. A few years ago, British Airways introduced a local procedure at Terminal 5 for a staff member to take the technical logs from all aircraft undergoing a Weekly Check to the maintenance office, where staff carried out administrative checks. The technical logs were usually removed before midnight and then returned an hour prior to the aircraft’s first flight of the day. By the time they completed the Weekly Check on G-EUXI, the technical logs had been removed for the night and the technical log entries were made later during the shift at the maintenance office.
After their rest break, one of the technicians popped by the south store room to pick up an IDG gun but there were none available. The technicians decided to pick up a second van, so that one technician could go to the Eastern Ancillary Area to see if he could pick up an IDG gun and oil there. They agreed to meet up again at Stand 509, where the final Daily Check of the night was located. From there, they could travel to G-EUOE to finish the Weekly Check. They had two vans so they drove separately southwards along Terminal 5A to complete the oil servicing.
The technician leading the way parked his van under the jet-bridge of the aircraft facing the left engine and the second technician parked alongside. To their surprise, they found that the fan cowl doors on both engines were closed and latched. This was strange but as they’d been away for three hours, they decided that someone else must have noticed the fan cowls left open and closed them. Both engines had cooled down and as they each checked an engine, they both found that the IDG level was now within the green band, which meant that the engines didn’t require servicing. They agreed that as the engines had cooled, residual oil had drained back into the IDG oil sump. They worked together to close and latch the fan cowl doors on both engines and verified each others work to ensure that the latches were correctly fastened. By now, they knew the tech log was at the office. One technician drove to the eastern store to return the IDG gun and oil before meeting his companion at the southern crew room. There, they completed the Weekly Check worksheet for G-EUOE and completed the aircraft technical log. It was just after 2am. They commented to colleagues about finding the fan cowls closed on the aircraft and that the oil levels had raised while the engines had cooled. No one present questioned this.
No one realised that they had serviced the wrong aircraft.
On their way back to complete the oil service, the two technicians drove straight past Stand 513, where G-EUOE was standing, and instead continued on to Stand 517 and G-EUXI, their other Weekly Check of the night. As both were driving, neither cross-checked which stand that they were supposed to go to. If the fan cowl doors had been propped fully open, one or the other might have noticed as they drove past but as it was, nothing seemed amiss.
The A321 is longer than the A319 and the registration is marked in various places on the aircraft, however both technicians were completely convinced that they knew where they were; neither checked the note on the work allocation sheet. The aircraft certainly looked familiar, as they’d worked on it earlier. The log book in the cockpit should have drawn their attention to the fact that it was the wrong plane. At that time of night, however, they had to collect the logbook from the office, so they simply requested the one that they needed and updated G-EUOE’s log to say the oil service wasn’t needed and the Weekly Check was complete.
The entire incident is a textbook example of confirmation bias, where we look for facts to support our assumptions rather than consider the evidence that we may be wrong.
The situation is not yet tragic, however, as the aircraft is still safely parked. All it needs is for someone to notice.
The next morning, the crew reported for duty at 05:45. The pilots and cabin crew met on the aircraft at Stand 513 45 minutes before the scheduled departure time. A British Airways staff member took photographs of the aircraft for use in a ground handling training video. The photograph below shows the latches clearly unlatched.
The two pilots reviewed the aircraft technical log together. Then the commander began preparing the flight deck while the first officer did the external walk-around check. The first officer did not notice anything wrong during the walk-around, despite the fact that all four latches were unlatched.
The pushback tug arrived 15 minutes before the aircraft was due to depart. The tug driver walked around the aircraft in an anti-clockwise direction as a pre-departure inspection. He did not notice anything wrong.
At 06:57, the aircraft was pushed back from the stand with both fan cowl doors unlatched.
At 07:16, G-EUOE was cleared for take-off on Heathrow Runway 27 left. The first officer was Pilot Flying with the commander as Pilot Monitoring. The left wing tanks held 3,687 kg of fuel and the right wing tanks held 3,701 kg.
During the take-off roll, passengers pressed cabin call buttons and shouted at the cabin crew. They saw in the inboard fan cowl doors flapping and one woman believed she saw smoke.
As G-EUOE took off, the fan cowl doors opened and then broke away completely.
From the accident report:
Aerodynamic loads imparted to the engine pylons by the departing fan cowl doors had caused a severe buckle in the primary structure of the right pylon and damage to the forward fairing of the left pylon. The detached fan cowl doors had struck and damaged the inboard leading edge slats, the fuselage skin close to the overwing emergency exits, the overwing fairings, the right inboard flap and the left belly fairing. The impact to the right overwing emergency exit had dislodged the cabin trim cover on its interior handle, causing a
door r emer exitECAM message to be generated. In addition, the right engine’s outboard fan cowl had struck the right wing leading edge at the outboard end of Slat 3, damaging this slat and the inboard end of Slat 4. The outboard flap track fairing on the right wing was punctured and the left horizontal stabiliser leading edge and lower skin were damaged.
The aircraft lining up on the runway after G-EUOE reported that there was significant debris on the runway.
Normally, cabin crew will not contact the flight deck from the point when engine power is applied for take-off until the aircraft is clearly airborne and the landing gear has been retracted. However, the senior cabin crew member was alarmed enough by the passengers reaction that she unstrapped herself from her seat to stand and call the cockpit.
The aircraft was still less than a thousand feet above the ground and the captain needed his full attention on monitoring the aircraft; he decided that he could call back once they were in the climb. The cabin crew member held on for 17 seconds and then gave up. She did not have any concrete information to pass on.
As the aircraft climbed through 1,500 feet, the autothrust disconnected as the engine control system determined a fault with the right engine. The captain checked the Electronic Centralised Aircraft Monitor and tried to make sense of what was happening as the first officer continued the climb at 250 knots to the first cleared altitude of 6,000 feet.
Within a few seconds, a yellow alert warned that the hydraulic system reservoir was low. Hydraulic fluid was leaking out. It was only 90 seconds after take-off when the fuel began to leak as well, coming out of the tanks at a rate of 61 kg per minute.
Just after take-off, a sensor detected that an interior panel had been removed in the right overwing exit, triggering a warning message. Now that they were in the climb, the Senior Cabin Crew Member went down the cabin to find out what was wrong with the right overwing emergency exit. The passengers near the exit were very agitated and told her that the right engine was damaged and leaking fuel. Here’s a photograph taken by a passenger:
She couldn’t see the engine very well from the aisle but the cowling damage was clear. Someone in the cabin crew (it is not clear who) reassured the passenger that the engine was not leaking fuel. The senior cabin crew member rushed back to speak to the flight crew.
As they levelled out at 6,000 feet, the first officer saw damage on the right wing’s leading edge and thought that something had struck the wing.
At 07:20:20, the commander declared a PAN (an urgent situation) to air traffic control, reporting that the aircraft had an engine problem and had lost a hydraulic system. He requested radar vectors for a return to Heathrow.
At 07:22:53, six minutes after her initial attempt to call the cockpit, the Senior Cabin Crew Member rang the flight deck again to tell them that the top of the right engine was “blown open”. The captain replied that they were returning to Heathrow and asked the cabin crew member to make an announcement to the passengers. He would make a further announcement once he had completed his checks.
If the captain had been made aware that fluid was visibly leaking from the engine, they may have identified the fuel leak more quickly. However, although passengers had reported it, the Senior Cabin Crew Member had not seen any fluid herself and so she did not pass this information on.
The first officer followed vectors from Air Traffic Control and reduced the speed to 220 knots. The commander reviewed the information from the Electronic Centralised Aircraft Monitor again.
A fuel imbalance displayed. It had been eleven minutes since the leak had started. “Right, we’ve got a fuel issue here,” said the first officer. “We might have a fuel leak, don’t you think?” They had lost 1,500 kilograms of fuel so far.
The next radio call is in my top three statements I never want to hear from ATC:
“You’ve left multiple engine parts and there was smoke as you left the runway at Heathrow.”
The captain made his announcement to the passengers. He told them that an engine cover had come off and struck one of the doors and he reassured them that both engines were operating normally. He then asked the Senior Cabin Crew Member to come to the flight deck for an emergency briefing.
He told her and another cabin crew member that the aircraft would be landing in about six minutes and to prepare the cabin for a normal landing.
As soon as the cabin crew left the flight deck, the first officer told the captain that he’d calculated that they had lost 100 kg of fuel in two minutes and twenty seconds.
They were 26 nautical miles from touchdown, with a total fuel remaining of 4,200 kg. There was only 1,000 kg left feeding the right engine.
They informed ATC that they may need to shut down the right hand engine and the commander reviewed the fuel imbalance checklist. The first officer re-calculated the fuel leak and realised they were at risk of losing the right-hand engine to fuel exhaustion before they landed. He told the commander that they should shut down the right-hand engine but the commander felt the risk was too great that the left engine might fail. This was a reasonable decision but the first officer remained concerned about the fuel leak.
If the leaking fuel had not ignited, the return to Heathrow could have been relatively straightforward although at the rate of fuel loss, they would have lost the right engine regardless.
The aircraft was cleared to land. When they were 9.5 nautical miles from the runway, the commander recalls that there was a loud bang and the aircraft seemed to swing unexpectedly. The commander said “Right…we’re gonna shut that engine down, shut that engine down, eh. I think its that engine that’s gone”. A moment later, the right engine fire warning activated. He shut down the right engine.
From the accident report:
The main fire initiated 23 minutes after aircraft rotation, as indicated by the engine fire warning at 07:39:27 hrs. However, passenger photographs taken prior to this show sooting already present in the region of the fan case adjacent to the outlet of the ventilation scoop on the nose cowl. It is likely that the hydraulic fluid which leaked in this area immediately after rotation created the correct hydraulic fluid vapour/air mixture to allow ignition by the arcing wiring early in the flight. At this stage of the flight the speed of the airflow over the engine, and the manner in which the leaking fuel was entrained in the airflow over the wing, may not have been favourable for ignition of the fuel. During the approach to land, the aircraft’s airspeed reduced and the leading edge slats were deployed.
These factors may have changed the fuel/air mixture in the region of the fuel leak sufficiently to create the correct ratio to allow ignition, resulting in the large fuel fire which triggered the fire warning. It is possible the source of ignition for the main fuel fire was the burning residue of the hydraulic fluid, or a very limited amount of fuel that had continued to burn within the confined area created behind the large section of fan cowl, but insufficient evidence was available to confirm this.
Inside the cabin, the lighting went orange from the flames and the temperature began to rise.
The greatest risk to the aircraft was now the fire. The commander discharged the first fire extinguisher bottle. The auto-pilot disconnected and the first officer flew the approach manually. The commander declared an emergency to air traffic control and released the second fire extinguisher bottle. At this stage, there was 333 kg of fuel left in the right wing; even without the fire, the fuel supply for the right engine would have run out before they landed.
The right engine warning light continued, which meant that the fire was still burning. The commander took control of the thrust levers, although he was not Pilot Flying, and told the first officer to concentrate on flying the approach. He then took control of the aircraft at just under 500 feet above ground level, 1.4 nautical miles from the touchdown.
The aircraft touched down at 07:43:51. The first officer deployed the reverse thruster and the brake pedals were depressed. One tyre burst as the flight crew got the aircraft under control. The commander then turned the aircraft to the right as it came to a halt, so that the right engine was on the downwind side of the fuselage.
There’s more in the report, to do with the details of the approach, the aircraft braking and the chain of command after the landing. I’m running out of room and the main thing here is that everyone was on the ground and safe.
The aircraft was evacuated without serious injury, although one passenger insisted on taking a large carry-on bag, only to drop it on entering the slide. The bag fell to the ground in the midst of the Airport Fire and Rescue Service personnel but no one was injured.
There’s a lot of human error in this incident but as always, there’s more to it than that.
Afterwards, the first officer described his walk-around and the standard method of checking the fan cowl door latches. He would lean over and look; however in order to get a clear view of the latches, he needed to be on his hands and knees. The Flight Crew Operating Manual procedure for the walk-around specified checking the latches but the walk-around was done from memory and no one had ever tested the first officers walk-around procedure.
The tug driver conducted a limited pre-flight inspection but there was no specific details and the investigators determined that he could not be realistically expected to identify the unlatched fan cowl doors.
In addition, the high visibility paint on the door latch handles was in poor condition; most of the paint was either missing or obscured by blue paint overspray.
Then there were the two technicians were working overtime that night and that this was a regular occurrence. British Airways made a number of changes at London Heathrow as a result of this accident, including recruitment of 26 additional staff to the maintenance team to deal with understaffing.
The end result:
Causal factors
The investigation identified the following causal factors:
1. The techicians responsible for servicing the aircraft’s IDGs did not comply with the applicable AMM procedures, with the result that the fan cowl doors were left in an unlatched and unsafe condition following overnight maintenance.
2. The pre-departure walk-around inspections by both the pushback tug driver and the co-pilot did not identify that the fan cowl doors on both engines were unlatched.Contributory factors
The investigation identified the following contributory factors:
1. The design of the fan cowl door latching system, in which the latches are positioned at the bottom of the engine nacelle in close proximity to the ground, increased the probability that unfastened latches would not be seen during the pre-departure inspections.
2. The lack of the majority of the high-visibility paint finish on the latch handles reduced the conspicuity of the unfastened latches.
3. The decision by the technicians to engage the latch handle hooks prevented the latch handles from hanging down beneath the fan cowl doors as intended, further reducing the conspicuity of the unfastened latches
You can download the full report as a PDF here.
There are 38 instances of fan cowl doors becoming detached on the Airbus A320-family. In every instance, the doors were opened before the flight and then not correctly re-secured. In 69% of the cases, the cowl doors were opened to check or service the IDG with oil.
Human factors caused this accident but adherence to procedures and proper training would do a lot to keep it happening again.
Wow, I was on the edge of my seat reading that! What a catalogue of errors. :( Great write-up, Sylvia.
Thanks! It’s pretty unbelievable how much actually went wrong, definitely a case of all the holes lining up!
My cheap Ford alerts me when the gas filler has been left open, but this airliner has no cockpit indicator that its servicing panel has been left unlocked?
Great report, thanks for posting.
I remember the incident well as LHR is our nearest big airport. Reading your report I was surprised quite how close to disaster they were, with so much fuel loss and the engine fire.
Rather concerning that 2 technicians can not only service the wrong aircraft but service the wrong *type* of aircraft.
So much can go wrong when the cowlings are not properly secured – I am amazed there is not more technology to help prevent it happening.
In my modest £ 7000 six year old Kia car, if I start to drive off with a passenger door not-quite closed, or a front passenger does not have their seatbelt on, an alarm pings and warning symbols flash. Difficult to ignore for long.
An A320 costs around £ 56 million but it has no automatic warning for unlatched engine cowling. Given this has happened 38 times, isn’t it time it did?
Provide a camera & monitor on a stick for the pilot to use during the walk-around to inspect hard-to-reach areas
CCTV cameras attached to the exterior of aircraft would allow pilots to make visual inspection of the exterior in flight. I recall other incidents such as the East Midlands accident in 1989 where passengers looking out of windows had a better picture of the problem than the crew relying on instruments.
Note that a lot of these proposals involve adding extra pieces and extra electronics to aircraft, which are already extremely complicated. Which is not to say that things can’t be added or changed, but it’s not as simple as it might be on a car or even bus. CCTV cameras, for example, would stick out and changing the airflow. Sensors are there on most doors (they got an alarm from the inner door where the cowling struck it) but not for every piece of the aircraft.
It’s complicated to fix issues like this while still avoiding data overload and additional systems which can in themselves go wrong or cause unknown effects.
In light of the unlatched ending cowling, the placement of the latches and the contrasting paint (which had faded and been oversprayed) seems to have made the most difference.
I use cctv on one of my vehicles. The camera is mounted externally but you won’t be able to see why? because its tiny. You wouldn’t even know it was there unless told, even then you have to look very carefully to find it. The camera is a fish eye lens giving a very wide angle view
I’m also reminded by my OH that some aircraft already do have camera’s mounted on the tail facing forward. This allows the crew to monitor much of the aircraft certainly the upper surfaces and engines. Also mounting such a small camera on the lower section of the fuselage would not I think cause any air flow problems
Saw this today and remembered your comment!
Photograph taken from the camera mounted on the tail as described by your OH: http://imgur.com/1RuRJn5
Comedy of errors ! Fortunately without loss of life.
One little mistake or error can initiate a chain of events. Remember the B.A. BAC 1-11 where the front windscreen blew out? The wrong size bolt had been used. This was not easily detectable because the receiving screw holes were in fact slightly oval. When a bolt would be screwed in, this would force the tread apart and lock the bolt in place. But the screws used were of a slightly thinner size. Thus, they only had sufficient grip on the narrow sides. Not really detectable by the mechanic – unless he wondered why the job went a bit more smoothly than expected. But windscreens are not exchanged every day. So the real error was …. haste. Not checking properly and not comparing the part numbers. The mechanic paid the price with his career.
But in the case of an oversight where it involves items that feature on a walk-around, in my experience anyway, the captain will ultimately be held responsible.
Some people remark about the absence of warning lights.
The cowling of a jet aircraft is subject to quite large changes of temperature, airflow, pressure. A warning system is probably going to give more headaches due to frequent false warnings than it solves.
I remember when I flew a King Air B200. We had regular fire warnings just during take-off. More worrying because the aircraft was not fitted with a fire suppression system (extinguishers in laymen’s terms). These warnings always were false. Even so, the system was tested and found fully functional.
Soon we realised that it only occurred at a certain time of the day, at a certain runway. And we (I forgot who, one of the pilots or a mechanic) finally figured it out: The fire warning system was of an optical type. In the event of a fire, flames would illuminate a sort of photo-electric cell and this would trigger the warning. In our case, accelerating during take-off, the cowling would warp sufficiently to allow light from the setting sun (hence the certain time of the day) to enter the nacelle, illuminate the cell and so trigger the warning.
Regarding final responsibility: Many years ago I flew a Cessna 310Q.
The flight was from Amsterdam Schiphol to London Gatwick.
I pre-flighted the aircraft and found that the starboard engine needed an oil top-up. On this particular engine, the oil dipstick was accessible by a little hatch on the left rear of the engine nacelle, but the filler cap was at the top at the front end, in fact not far behind the propeller.
I called the mechanic and whilst he was adding oil, I continued my walk-around and flight preparations. I finished by re-checking the oil level and checking that the access hatches were secure and latched.
Halfway across the North Sea my boss in the right-hand seat drew my attention to the right engine. From under the hatch over the filler cap a large black oil slick was spreading and gradually extending all over the engine nacelle. We discussed the situation. Halfway to our destination and over open sea, a return to base was going to take the same time as returning. My boss had appointments in London. We decided we might as well continue and just keep a constant eye on oil pressure and temperature. Until and unless the oil temperature would rise and the pressure drop we decided to keep the engine running and postpone any further action unless dictated by circumstances. After a normal and uneventful approach and landing we parked at the usual spot in front of the Queen’s Building (I wonder if that still exists) as the G.A. terminal was known. I got rags and cleaned the engine cowling. When I checked the oil level, I found that in spite of the spectacular oil slick the actual loss of oil had in fact been so small that I did not even have to add any. The filler cap was found dangling from it’s chain, I just replaced it, The mechanic had forgotten to replace it but had closed the hatch.
The filler hatch was closed by two screws, the dipstick cover with quick release latches and the two were at opposite ends of the engine.
There were no further repercussions but after I lodged a complaint I was left in no doubt that I, as pilot in command, would carry the blame because I should not just have re-checked only the oil level but also checked the filler cap.
Finally a more amusing story about how events can build up to form a whole chain that ultimately lead to an accident. In the following, nobody was seriously injured:
It took place in the ‘seventies. In those days, all multi-engined aircraft operated under IFR and on an AOC, when registered in the Netherlands, would have to be flown by a minimum of two fully qualified and type-rated pilots. To the anger of Dutch operators because there was nothing to stop a customer to hire a light twin, flown single crew by a rosy-cheeked young novice, not seldom VFR, to come from Germany, Belgium or the UK and get the flight done for a lot less money.
The flight in question was operated by a Dutch air ambulance company. They operated Cessna Titans, cabin class twins, piston-engined.
But on the cowlings the fact that the engines were turbo-charged was proudly displayed.
The flight was to exchange crews from an oil drilling rig somewhere off the French coast. The route was to be from Rotterdam Airport to a small French airport in Normandy or Brittany, perhaps Quimper.
It was New Year’s Eve. The airport would be kept open for the flight and the helicopter used in the transfer but close strictly at midnight. At that time, the control tower would close, the airport fire services shut down and the airport staff would start to celebrate the New Year.
Jan Moerenhout, a G.A. inspector of the “Rijksluchtvaartdienst”, the Dutch C.A.A., decided to join the flight in order to carry out a spot inspection. I heard it from his own mouth and am not committing an indiscretion by re-telling the story.
In his capacity of CAA inspector, Moerenhout had of course full power to join any flight. But the flight would be full. Moerenhout was a qualified pilot himself, rated on type. It was decided to send the F.O. home (on full pay) and the CAA inspector would act as co-pilot.
The operator’s base was Amsterdam. The aircraft would have to be positioned to Rotterdam, a short hop. But at the critical moment a technical problem came up and the aircraft was pulled into the hangar. Mechanics started to work under pressure of losing the charter.
A Rotterdam-based company got word of this. They operated SN 601 “Corvette” light jets and informed the client that they were holding an aircraft on standby to take over. They filed flight plans and contacted Quimper with a request for Jet A1. The other operator – at Amsterdam – knew nothing of this development.
At the very last minute the Cessna was ready, flown to Rotterdam, boarded and departed for France. Since the passengers, both ways, were adults with a lot of luggage, the aircraft had to be refuelled.
Midnight – and closure of the airport – was not far off. The passengers from the oil rig had been waiting, the arrivals left on the helicopter. The captain went to the control tower for the formalities, the CAA inspector supervised the refueling.
A bowser arrived with compartments both for Jet A1 and AVGAS.
The clock was ticking, the co-pilot did the walk-around whilst the aircraft was filled with… you guess it: Jet A1.
The driver had received the request for Jet A1. The actual operator had not know of this and therefore not countermanded it. The bowser carried both types of fuel in two separate compartments. The driver noticed the “Turbo-super-charged” on the nacelles and concluded that it had to be a turbine-powered aircraft.
Now within five minutes before airport closure the captain arrived with the passengers, the co-pilot in a hurry signed the fuel receipt, doors closed and the aircraft took off.
Barely airborne, one engine failed because jet fuel was reaching the injector system. A piston-engine does not run well on kerosene.
The crew had barely started the emergency drill when the second engine failed. They selected a dark area – no houses – to land. It turned out to be a cemetery.
The ATC controller, about to switch all equipment off in the tower, noticed that something had gone wrong. All fire crew were at the airport for the celebrations and the rescue action was started within seconds.
Everyone survived.
Of course, there was great talk amongst the GA aviation community about this and even some hilarity about a GA inspector signing off on jet fuel for a piston-engined aircraft. Especially some who had been on the wrong side of the (aviation) law found it particularly funny, of course.
This event was the direct cause of changing the sizes of fuel nozzles so that those designed for jet fuel will not fit the filling holes on AVGAS powered aircraft.
We can all laugh at something like this but, in all fairness: I challenge any pilot who can truthfully say that, under the same set of circumstances, this would not have happened to him or her.
Very coincidentally, the very same crew in another Titan of the same company wrote off a second aircraft. Or rather, to be truthful, they did not write it off but they were involved in another incident which they neither caused not could avoid.
A few months later they were to depart from Hanover in Germany.
The show was on and the airport was going to be closed for the start of the air show. Many aircraft were lined up on the taxiway. spinner to tail, to meet their departure slot in sequence.
The pilot of a light single, parked on the grass alongside the taxiway, was frantically trying to get his engine running. His battery depleted, he tried to start it by swinging the propeller.
Again, an easy guess as to what happened next: The engine burst into life. Perhaps the throttle was open a bit too far, perhaps the handbrake was not set properly. Anyway, the aircraft started to roll forward and gathered speed.
In desperation, the pilot who had of course jumped out of the way of the propeller, grabbed a wing trying to stop it.
The aircraft swung and headed for our Titan. The single’s propeller sliced through wing and engine and caused considerable damage. I happened to be at Hanover some months later and saw the aircraft in a hangar. I don’t know it it was repairable.
The Dutch RLD (=CAA) subsequently ruled that their inspectors were not to act as crew members on AOC GA flights.
Lessons to be learned: An accident quite often can start with a small, in itself insignificant, event.
Fire warnings without a fire suppression system seems a bit cruel, really!
I have to admit, I left the filler cap off once, but luckily it was just a short flight and no damage done.
Well Sylvia, that was the case in the B200 I flew. The company had two King Air B200, both identical. Engine fire warning but no extinguishers.
The SN601 Corvette had a tailcone overheat warning. In other words: a warning in case of a fire in the tail section. Again, it did trigger a red alert on the CAP but there was no extinguisher in that section.
It was very useful, though: In those days I was – I suppose by default – TRI and TRE on the Corvette. The tailcone warning could be tested by depressing a button on the right side of the cockpit.
When examining a colleague, I would make the arrangement with ATC that the first take-off would be rejected. This to ensure that there would not be any need to inform ATC over the radio. When the speed was not all that far off V-1, all I had to do was push the test button. The red alert would come on without warning. A great way to check out a pilot as it was very realistic. There was no simulator for the Corvette, all training had to be done on the actual aircraft. I had been trained up for the TRI job by a test pilot of Aerospatiale, Capt. Robert Briot. He was a magnificent pilot and one of the greatest instructors I ever had the honour to train with.
Let us not forget the Turkish DC10 accident near Paris in 1974, caused by a luggage hold door not being locked and some 350 people dying.
It was after that accident that passengers began asking what sort of aeroplane they would be flying in.
And when the same thing happened in the U.S. (I think the plane landed safely) the whole fleet was grounded and Laker went out of business.
It just took one lazy sod not bothering to do a proper job, like those two British Airways mechanic clowns seeking shortcuts at every turn.
In the 1970s and 80s, a lot more attention was focused on maintenance and the integrity of the aircraft, making this type of accident a lot rarer, thank goodness. Still should never has happened, of course.
John, just a few corrections … The DC10 crash outside Paris which killed 346 people was not caused by some body not locking the baggage door . There was a serious deficiency in the design of the door locking mechanism, which was bad, but compounding the problem was, all flight controls went through the floor, so a pressurized cabin above and one below, with no blow out panels between. When the door failed pressurized air above the floor buckled the floor jamming controls nosing the aircraft over… the blow out of a door in the U.S. was some time before the accident in France .. But the design fault was not corrected until after the Turkish airlines crash near Paris. The grounding of DC10’s was over the engine pylon failure ( at Chicago ) a very different problem to the door. Laker went out of business for reasons not associated with either problem.
Thanks!
An excellent summary of a complex incident. Lots of food for thought, but it seems to me that a critical point is the technicians’ failure to follow procedure and place a warning notice in the cockpit. It might also be sensible if distinctive warning stickers were required during engine maintenance to provide a failsafe reminder.
To be fair, if the log book had been in the cockpit, it would have worked as a warning notice. The technicians would have immediately seen they were on the aircraft — and if they hadn’t, the pilots would have seen the work was unfinished the following morning. Removing the log books from the aircraft was a major issue.
I think though that a number of changes have been put into place to make sure this particular trap isn’t easily fallen into.
At the Airline I work for as a gate agent, The aircraft is not allowed to push back from the jetbridge without the log books. I’ve had a fully loaded aircraft on a gate hold because MX had the log books for the Aircraft.
That seems a very sensible rule.
I an a retired oil process worker. Always been interested in the follow-up of related incidents, how a catalogue of small errors / omissions / design changes etc can lead to a bigger problem. unfortunately most seem to be down to human involvement.
Yes, this is true. I’ve got a friend in your field and we talk about risk management – there’s a lot of overlap in the two, interestingly. The analysis must always take human failure and how to reduce the likelihood and impact into account.
” human factors” will continue to be a major factor in incidents / accidents, as companies look to cut costs. its easy to blame a person for a mistake on the Tarmac but often it is the result of management decisions to “save money” by reducing the staff numbers, reducing the training, reducing lighting in hangars, lengthening shift times …. Causal factors must be considered and those who made decisions ” up the chain” made to be responsible / accountable for the consequences rather than simply blame the person put into the situation of too many separate jobs, insufficient tools, to many hours on the job … I know from experience of having worked several 24 hour shifts no one is immune from making mistakes, the responsibility is with those who wanted the job done in that time frame without enough staff
Agreed.
Thanks – I am no engineer but neither are air crew Pilots and 1st Officers. Is it not time that the external check be done WITH the maintenance record to hand perhaps by an engineer. Whats the training for walk arounds – is it not the practise for a supervisor to do a walk around or at minimum check the area’s that have been serviced BEFORE an aircraft is deemed airworthy. I am is this an example of complacency taken from RAF processes. Its time that the engineers take ownership and not, excuse the expression, the oil rag!
I have done hundreds of “walk rounds” many pilots trusted me knowing I was always willing to jump on board with them, but ultimate responsibility rests with the pilot in command (PiC) However I feel there have been far to many design faults which have lead to accidents. A latch that looks closed but is not or a latch placed where it’s hard to see. There is one jet engine where wrongly / poorly installed oil tank cap is responsible for 85% of all in flight shut dows. Even holding the tank in my hands in the training room it was a pain to close, so mount it 2 metres off the ground where it’s not in sight, closed by feel you wonder , and I asked the manufacturers representatives “you admit 85% of in flight shut downs are due this cap not being secured properly, why on earth have you not redesigned it during its so far 40 plus years in service and many more years to come? ” there in lies the type of problems aviation faces reluctance to change and reluctance to admit a mistake. No human is perfect so designs should make things easy to see easy to do hard to stuff up.
I didn’t realise this was as bad as it was! 0.0 When I first heard the report on tv about it I thought “eh! The bonnet flew off; what’s all the fuss about?”
I didn’t realise that it had punched a hole in wing! 0.0
KLM operated DC10 and never had a major incident. If I remember correctly, the Dutch Air Lab, which also carried out tests for Fokker, on several design features, warned about the possibility of the floor collapsing in the event of a rapid loss of pressurization in the cargo hold. KLM, I believe, had a modification to enlarge the ventilation openings between the passenger- and cargo compartments.
The actual log books are NEVER carried in the aircraft. On board will be a whole “library”, consisting of certificate of airworthiness, registration, insurance certificate, noise certificate, operating licence, areas or routes the company has approval for, the licences concerning the radio- and navigation equipment, rvsm certificate and of course route manuals (Jeppesen). And, most important: a valid maintenance release. Which is not proof of a daily “walk-around”, but a certificate that all outstanding maintenance and inspections have been carried out and no outstanding “snags” are rendering the aircraft un-airworthy.
The aircraft manual and operating manual are government (CAA) approved documents that specify how the aircraft must be operated in order to stay within safe parameters. Part of it, in a separate folder, will be the check list and emergency check list. The “Deferred Defect List”.:Snags that will not immediately affect the operation will be listed, with the time frame within they must be corrected and possible operating limitations.Then there must be the “loadsheet”.
The log book that is carried on board is the so-called “technical log”. The original, usually white, with carbon-copies, and gives all details about crew, maintenance details, times of departure and arrival, etc. Upon accepting the aircraft, the captain will sign it and a copy (yellow or pink, depending on the operator) will be left on the ground with the handling agent.
Yes, an airline operation generates a lot of paperwork.
But even in a major airline where all this is taken very seriously, human factors are still something that can throw a spanner in the works !
Of course, I left out the “consumables” like the nav plan, briefing documents: met briefing, notams, notoc, dangerous goods declaration and weight and balance.
In an airline it is not usual for an entire Jeppesen manual to be carried, far too much (and heavy !). KLM still used a system uniquely theirs. they do not carry information about all airports, only those that are suitable.
Before flight, the crew log on to a computer with their staff ID, so it also will confirm that hey have actually reported for duty. This step will then generate preparation of all the paperwork. Recommended fuel uplift can be corrected by the captain if (s)he wants to alter it. The other documentation will be adjusted automatically and all the crew has been left to do is call it from the printer and check it. Nifty ! The crew will go to a large cabinet and take out the route bag with the charts and airport info. which also will include performance tables ( also called TL tables) for every runway and per individual type of aircraft.
“Flying the airline way” is a lot more organized than most people realize, for some it also has taken a lot of the fun out of flying. A pilot sometimes is more like a civil servant in a moving office.
The carriage or no carriage of Jeppeson manuals is not linked to this incident – it certainly could be an issue in others. What was established was the airline was reducing costs by placing a very high workload on a couple of people such that to meet deadlines procedures had to be ignored. Something which happens all over the world. Cost pressures over ride safety until there is an accident, and at that point things may get changed, but those who implemented the cost driven changes, reducing staff increasing work loads are usually not held accountable.
Right now some airlines are pushing pilots to very high duty hours per month by redefining ” duty time” to exclude such things as in flight rest periods. If the pilots make a fatigue induced error, of course it’s pilot error, so sack the pilot. If the maintenance staff work excessive hours and make an error, blame the engineers.
Thankfully enlightened companies look at real cause and address that. Sometimes that means changing the aircraft from what the manufacturer delivered. Ruddy suggests KLM did that with the DC10 door. Eastern did that with the Electra wings when TAA rejected the idea of buying the Comet. Those things happen when a company has competent staff who look past the immediate balance sheet. They were made by people who put safety above all else.
I continue to be astonished that cctv has no been used to allow pilots and 1st officers to have sight of wing/flaps/engines and tailplane activity.
When a member of the flight crew has to vacate the flight deck to do a visual inspection from the passenger area there is scope for all sorts of nastiness to result. The mind boggles, surely the idea of a crew of 2 to maintain an aircraft in flight is mandatory! It is time that airlines stopped depending on cabin crew and passengers to tell them there is an issue! Am I being to cynical or is it no essential to keep both flight deck crew in their station during any emegency?
Oh and no I don’t think “wing mirrors” would cover it lol