You are on page 1of 109


Aviation Safety

This course is designed to study the underlying causes which may result in a well intentioned Aircraft Maintenance Engineer (AME) making a maintenance error. We will also look at what we can do to prevent ourselves from contributing to events which lead to an accident

Maintenance Human Factors States:

No person may be required to complete a maintenance work task within an unrealistic timeframe. This includes any personnel engaged in management, supervision, planning, maintenance, inspection, maintenance release, record keeping and quality audit. No person may be required to perform planning, maintenance, inspection, maintenance release or record keeping without the appropriate tooling, equipment and working instructions. No person may be required to perform planning, maintenance, inspection, maintenance release or record keeping unless their competence in the task has been proven. No person should be pressured to release an aircraft or aircraft component when that person has reason to question the safety standard. No person may be required to release or authorize the release of an aircraft unless that person is able to inspect the aircraft.

Incidents/ Accidents Where Maintenance Error was a Factor

There have been several high profile accidents and incidents which have involved maintenance human factors problems. The hfskyway website lists 24 National Transportation Safety Board (NTSB) accident reports of accidents where maintenance Human Factors problems have been the cause or a major contributory factor. In the UK, there have been three major incidents, details of which can be found on the Air Accident Investigation Branch (AAIB) web site (

NTSB/AAR-84/04. Eastern Airlines, L1011, N334EA, Miami, May 1983

During maintenance, technicians failed to fit O-ring seals on the master chip detector assemblies. This led to loss of oil and engine failure. The aircraft landed safely with one engine. Technicians had been used to receiving the master chip detectors with Oring seals already fitted and informal procedures were in use regarding fitment of the chip detectors. This problem has occurred before, but no appropriate action had been carried out to prevent a reoccurrence.

NTSB/AAR-89/03. Aloha Airlines, B737-200, N73711, Hawaii, April 1988

The Aloha accident involved 18 feet of the upper cabin structure suddenly being ripped away, in flight, due to structural failure. The Boeing 737 involved in this accident had been examined, as required by US regulations, by two of the engineering inspectors. One inspector had 22 years experience and the other, the chief inspector, had 33 years experience. Neither found any cracks in their inspection. Post-accident analysis determined there were over 240 cracks in the skin of this aircraft at the time of the inspection. The ensuing investigation identified many human-factors-related problems leading to the failed inspections.

AAIB/ AAR 2/95, Excalibur Airways, A320-212, G-KMAM, Gatwick, Aug 93

Another incident in August 1993 involved an Airbus 320 which, during its first flight after a flap change, exhibited an undemanded roll to the right after takeoff. The aircraft returned to Gatwick and landed safely. The investigation discovered that during maintenance, in order to replace the right outboard flap, the spoilers had been placed in maintenance mode and moved using an incomplete procedure; specifically the collars and flags were not fitted. The purpose of the collars and the way in which the spoilers functioned was not fully understood by the technicians. This misunderstanding was due, in part, to familiarity of the technicians with other aircraft (mainly 757) and contributed to a lack of adequate briefing on the status of the spoilers during the shift handover. The locked spoiler was not detected during standard pilot functional checks.

AAIB/AAR 1/92, British Airways BAC111, G-BJRT, Didcot, June 1990

In 1990, in the UK, a BAC1-11 was climbing through 17,300 feet on departure from Birmingham International Airport when the left windscreen, which had been replaced prior to flight, was blown out under the effects of cabin pressure when it overcame the retention of the securing bolts, 84 of which, out of a total of 90, were smaller than the specified diameter. The commander was sucked halfway out of the windscreen aperture and was restrained by cabin crew whilst the co-pilot flew the aircraft to a safe landing at Southampton Airport. The Shift Maintenance Manager (SMM), short-handed on a night shift, had decided to carry out the windscreen replacement himself. He consulted the Maintenance Manual (MM) and concluded that it was a straightforward job. He decided to replace the old bolts and, taking one of the bolts with him,a 7D, he looked for replacements. The store man advised him that the job required 8Ds, but since there were not enough 8Ds, the SMM decided that 7Ds would do (since these had been in place previously). However, he used sight and touch to match the bolts and, erroneously, selected 8Cs instead, which were longer but thinner. He failed to notice that the countersink was lower than it should be, once the bolts were in position. He completed the job himself and signed it off, the procedures not requiring a pressure check or duplicated check. There were several human factors issues contributing to this incident, including perceptual errors made by the SMM when identifying the replacement bolts, poor lighting in the stores area, failure to wear spectacles, circadian effects, working practices, and possible organisational and design factors.

AAIB/ AAR 3/96, British Midland, B737-400, G-OBMM, Daventry, Feb 95

In February 1995, a Boeing 737-400 suffered a loss of oil pressure on both engines. The aircraft diverted and landed safely at Luton Airport. The investigation discovered that the aircraft had been subject to borescope inspections on both engines during the preceding night and the high pressure (HP) rotor drive covers had not been refitted, resulting in the loss of almost all the oil from both engines during flight. The line engineer was originally going to carry out the task, but, for various reasons, he swapped jobs with the base maintenance controller. The base maintenance controller did not have the appropriate paperwork with him. The base maintenance controller and a fitter carried out the task, despite many interruptions, but failed to refit the rotor drive covers. No ground idle engine runs (which would have revealed the oil leak) were carried out. The job was signed off as complete.

AAIB Bulletin 5/97, British Airways, B747, GBDXK, Gatwick, Nov 96

The 4L door handle moved to the open position during the climb. The Captain elected to jettison fuel and return to Gatwick. An investigation revealed that the door torque tube had been incorrectly drilled/fitted. The Maintenance Manual required a drill jig to be used when fitting the new undrilled torque tube, but no jig was available. The LAE and Flight Technical Liaison Engineer (FTLE) elected to drill the tube in the workshop without a jig, due to time constraints and the operational requirement for the aircraft. The problem with the door arose as a result of incorrectly positioned drill holes.

Lufthansa A320 incident, 20 Mar 01

During maintenance, two pairs of pins inside one of the elevator/aileron computers were cross connected. This changed the polarity of the Captains side stick and the respective control channels, bypassing the control unit which might have sensed the error and would have triggered a warning. Functional checks post maintenance failed to detect the crossed connection because the technician used the first officers side stick, not the pilots. The pilots pre-flight checks also failed to detect the fault. The problem became evident after take-off when the aircraft ended up in a 21 left bank and came very close to the ground, until the co-pilot switched his sidestick to priority and recovered the aircraft.

To create an awareness of the "Human" aspect of aircraft maintenance and develop safeguards to lessen the "Human Cause" factors in maintenance.
To examine the human role of maintenance that can lead to an aviation occurrence and develop ways to prevent or lessen the seriousness of the occurrence.

What Is Human Factors?

Human Factors is about people: it is about people in their working and living environments, and it is about their relationship with equipment, procedures and the environment. Just as importantly, it is about their relationships with other people. Human Factors involves the overall performance of human beings within the aviation system; it seeks to optimise people's performance through the systematic application of the human sciences, often integrated within the framework of system engineering. Its twin objectives can be seen as safety and efficiency.

The Need to Take Human Factors into Account

Human error is a fixed part of the human condition and therefore cannot be totally eradicated. We all make errors/mistakes every day. Errors serve a useful service in the trial and error learning process. Errors with no bad effects can sometimes be good, but we must not confuse these types of errors with the bad effects of errors. In aviation, we cannot tolerate the bad effects of error. When an error occurs in the maintenance system of an airline, the engineer who last worked on the aircraft is usually considered to be at fault. The engineer may be reprimanded, sent for further training, or simply told not to make the same mistake again. However, to blame the engineers for all of the errors that are committed is perhaps giving them too much credit for their role in the airline's maintenance system. Many errors are, in fact, committed due to other failures inherent in the system and the engineer involved is merely the source of one of the failures. In these cases, it may not matter which engineer is involved at the time of the actual incident, the system encourages particular errors or violations to be committed.

The failures caused by those in direct contact with the system, ie, the engineers who are working on the aircraft, are considered to be active failures. These failures are errors or violations that have a direct and immediate effect on the system. Generally, the consequences of these active failures are caught by the engineer himself, or by the defences, barriers and safeguards built into the maintenance system. Thus, the system must rarely deal with the consequences of active failures. However, when an active failure occurs in conjunction with a breach in the defences, a more serious incident occurs.

Latent failures
These are those failures which derive from decisions made by supervisors and managers who are separated in both time and space from the physical system. For example, technical writers may write procedures for a task with which they are not totally familiar. If the procedure has even one mistake in it, the engineer using the procedure will be encouraged to commit an error. The latent failures can often be attributed to the absence or weaknesses of defences, barriers, and safeguards in the system. Often, latent failures may lie dormant in the system for long periods before they become apparent.

Models Describing Human Factors

In order to simplify the relationship between engineers and the factors which impact upon their every day working lives several models have been produced.

The SHEL Model

This model shows the interfaces between the human, being the L in the centre box and the other elements of the SHEL model, e.g: S for software being the interpretation of procedures, illegible manuals, poorly designed checklists, ineffective regulation, untested computer software etc. H for hardware meaning not enough tools, inappropriate equipment, poor aircraft design for maintainability etc. E for environment meaning your working environment which may involve an uncomfortable workplace, inadequate hangar space, variable temperature, noise etc. and last but by no means least L for liveware meaning poor morale, relationships with other people, shortage of manpower, lack of supervision, lack of support from managers. However, the model also accepts that sometimes the L in the centre box can stand alone, and there can be problems associated with a single individual which are not necessarily related to any of the L-S, L-H, L-E, L-L interfaces.


The British Airways PEEP Model

Here the emphasis is placed upon the interfaces and integration between the engineer and the aspects which affect his/her performance.

PEEP Model

Reason's Swiss Cheese Model

Each slice of Swiss cheese represents an organisation or an activity/department within an organisation. The arrows represent errors and the holes in the cheese inadequate defences within an organisation allowing errors through. Errors not identified at source are usually picked up and rectified by the next or subsequent "slices" in the system. However there are occasions when an error will find its way straight through the system resulting in an accident. The aim therefore of each department/activity within an organisation is to turn their particular slice of "Swiss Cheese" into a slice of best "Farmhouse Cheddar"!!


The Weakest Link

An aircraft flies courtesy of the efforts of many people employing their particular skills on a variety of tasks. Each of these tasks is vital to the safe operation of an aircraft, each task strengthening the link between its departments activities with others departments and eventually the aircraft itself. It is a well known fact that the strongest part of any chain is its weakest link. If a link breaks the aircraft falls out of the sky!! Can you identify any weaknesses in either yourself or your department that could lead to the chain failing?

Fateful Combination
For an incident to occur, latent failures must combine with active failures and local triggering events, such as unusual system states, local environmental conditions, or adverse weather. There must be a precise 'alignment' of all of the 'holes' in all of the defensive layers in a system. (See Reason's Swiss Cheese Model). For example, rain may cause a engineers' foot to be wet, allowing his foot to easily slip off the worn brake pedal in a pushback tug when the engineer becomes distracted. The tug may then lunges forward contacting a parked aircraft. The latent failure in the system is that the brake pedal has no anti-slip surface in place, but the problem does not become an issue until the rainy conditions (a local trigger) cause an incident. It can be seen that if any one of the failures had not occurred (engineer did not become distracted, the tarmac was not wet, or the brake pedal was in better condition), the incident would have been avoided.

An incident similar to this at Edinburgh Airport resulted in the loss of life of an engineer during turnaround when, during the removal of a ground power unit following engine start, the engineer maneuvered within the rotating propeller arc.


In our study of human factors we will be mostly concerned with identifying those aspects of our behaviour that can result in the making of mistakes or errors which could result in accidents. We all have the potential to err. Our capacity to perceive what is going on in our working environment by sight, touch, feel, smell, hearing etc: together with our capacity to remember, process information and act upon it are all relevant in the context of human error.

Types of Error
Basically the types of errors encountered fall into four categories:

Slips Lapses


Slips can be thought of as actions not carried out as intended or planned, e.g. transposing digits when copying out numbers, or carrying out steps in a procedure in the wrong order. Slips typically appear at the execution stage of a process.


Lapses Lapses are identified as missed actions or omissions, ie. The occasion when somebody has failed to do something due to a lapse of memory and/or attention or because they have forgotten something, e.g. forgotten to close and secure the oil cap. Lapses typically occur as a result of failures in our capacity to store and retrieve information from our memory bank.

Mistakes are a specific type of error brought about by a faulty plan or intention, i.e. somebody doing something believing it to be correct when it is, in fact, wrong, e.g. an error of judgment such as selecting the wrong bolts when refitting an aircrafts windscreen. Mistakes typically occur during the planning stages of a process.


Violations sometimes appear to be human errors, but they differ from slips, lapses and mistakes because they are deliberate illegal actions, i.e. somebody doing something knowing it is against the rules, e.g. deliberately failing to follow the proper procedures. AMEs may consider a violation is well intentioned, i.e. taking a short cut in order to get the job done on time. Always remember however that procedures must be followed in the interests of not only safety but also of cost.


Errors which can contribute towards mistakes leading to accidents are incalculable. However, some of them will fall into one or more of the following:

Inadequate information

be it visual or verbal can, does and will lead to people making mistakes. If you think the information you have is inadequate or insufficient do something about it.

Lack of understanding
possibly stemming from inadequate information or maybe lack of training can lead to people making presumptions as to how a particular process or procedure is carried out. This can and does lead to accidents. If you're not sure ask.

Poor design
Can result in the best of intentions turning out wrong. Remember Murphy? If there's a wrong way to do it that's the way you'll do it! If you recognize a Murphy do something about it if it's only telling others about it.

Lapses of attention
can and will allow errors to creep in, especially if its a simple straightforward repetitive task. The lesson here is that the more expert you become at a particular task, the more likely you are to make a mistake, because you think you can afford to allocate less attention to it. Beware the expert both in yourself and in others

Mistaken actions

brought about by the classic situation of doing the wrong thing under the impression that it's right. A classic example of this is the 'short cut' wherein the engineer knows what has to be done but chooses his own method of doing it. Don't take short cuts.

meaning the capacity we have to see what we want to see, hear what we want to hear, feel what we want to feel etc. This factor is particularly relevant to the work of an aircraft engineer in as much as a great many tasks are of a repetitive nature. The lesson here is to be vigilant and on guard against it.

Vision can be adversely affected by certain medications or drugs, alcohol excess, oxygen shortage (hypoxia), injury, e.g. a blow to the head, etc. It can also be affected either temporarily or permanently by medical conditions e.g. migraine, cataracts, inflammation, corneal problems or refractive surgery or by dirty or dehydrated contact lenses or even very dirty spectacles.

Can detrimentally affect human performance in terms of damaging hearing, interfering with speech communication, and affecting concentration and performance. It can also be fatiguing. Effects vary between individuals, and noise of a certain type and level may be good for one individual but bad for another. Noise can affect motivation, reduce tolerance of frustration and reduce levels of aspiration. There may be an impact upon the individual's ability to think. It is almost certainly likely to affect inspection or troubleshooting activities where the strategy used is left to the individual, being primarily assessment - rather than activity-based, possibly reducing the likelihood of successfully thinking laterally under such circumstances. How many of us can recall, when concentrating hard on a task, shouting "Stop that noise; I can't think straight!" In order to understand the effect both vision and hearing have in terms of maintenance it is useful to know a little about the anatomy of both the eye and the ear. Likewise, in order to understand the potential each one of us possesses to make mistakes, it will help to know a little about our ability to receive, store and use information.

Noise Makers..


The eye is the organ which receives light information from the external world and passes it to the brain. The visual cortex area of the brain interprets this information, presenting it as a rational, realistic image. The basic structure of the eye is similar to a simple camera, with an aperture, a lens, and a light sensitive screen, the Retina.

The Function and Structure of the Eye

The Cornea. Light enters the eye through the cornea, a clear window at the front of the eyeball. The cornea acts as a focusing device and is responsible for between 70 and 80% of the total focusing ability of the eye. The Iris. The amount of light entering the eye is controlled by the iris, the coloured part of the eye, which acts as a diaphragm. The Pupil. The amount of light allowed to fall on the retina is governed by the size of the pupil, the clear centre of the iris. The size of the pupil can change rapidly to cater for changing light levels.

The Retina. The retina is a light sensitive screen lying at the back of the eyeball. On this screen are light sensitive cells. The cells are of two types; cones and rods. The cones can only detect colours, the rods can only detect black and white but are much more sensitive at low light levels. This means that in poor light we see only in black or white or varying shades of grey. When light falls on these cells a small electrical charge is generated which is passed onto the brain by the optic nerve. The Optic Nerve. The optic nerve enters the back of the eyeball along with the small blood cells needed to carry oxygen to the cells of the eye.

The Fovea.
The central part of the retina, the Fovea, is composed only of cone cells and only at this part of the retina is vision 20/20 or 6/6. The figures are a means of measuring visual acuity, the ability to discriminate at varying distances. An individual with 20/20 vision should be able to see at 20 feet that which the so-called normal person is capable of seeing at this range. Any resolving power at the fovea drops rapidly as the angular distance from the fovea increases. At as little as 5 from the fovea the acuity drops to 20/40 that is half as good as at the fovea. When the angular displacement increases to 20 the visual acuity will only be one tenth of that at the fovea, that is 20/200. Anything that needs to be examined in detail is automatically brought to focus on the fovea. The rest of the retina fulfils the function of attracting our attention to movement and change,i.e. our peripheral vision, provided by rods.

The Blind Spot.

The point on the retina where the optic nerve enters the eyeball has no covering of light detecting cells. Any image falling at this point will not be detected. This has great significance when considering the detection of objects which are on a constant bearing from the observer. If the eye remains looking straight ahead it is possible for example for a closing aircraft to remain on the blind spot until a very short time before impact. Safe visual scanning demands frequent eye movement with minimal time spent looking in any direction.

Visual Defects.
Most visual defects are caused by distortion of the natural shape of the eyeball. Hypermetropia. Is long sightedness, (Hypermetropia). A shorter than normal eyeball along the visual axis results in the image being formed behind the retina and unless the combined refractive index of the cornea and the lens can combine to focus the image in the correct plane a blurring of the vision will result when looking at close objects. A convex lens will overcome this refractive error. Myopia. Is short-sightedness, (Myopia). The problem is that the eyeball is longer than normal and the image forms in front of the retina. If accommodation cannot overcome this then distant objects are out of focus whilst close up vision may be satisfactory. A concave lens will correct the situation. Astigmatism. This condition is usually caused by a misshapen cornea. Objects will appear irregularly shaped. Modern surgical techniques can reshape the cornea with a scalpel or more easily with laser beams.

Colour Defective Vision

Affecting about 8% of men and 0.5% of women "colour blindness" is usually associated with the inability to differentiate between reds and greens. Other more rare types may involve blues and yellows. There are degrees of colour defective vision, some suffering more than others and ageing of individuals will change their colour perception. Care should be taken not to discriminate personnel from tasks merely because they are "colour blind". Tasks that require positive colour perception must however be carried out by personnel who have been tested to an appropriate standard.

Human Ear

The Ear
The ear performs two quite separate functions: Firstly it is used to receive vibrations in the air (sounds), Secondly it acts as a balance organ and acceleration detector.

Function and Structure of the Ear

The ear is divided into three sections,
The Outer Ear. The outer ear consists of the Pinna, which collects the vibrations of the air which form sounds and a tube, the Meatus, which leads to the eardrum. The sound waves will cause the ear drum to vibrate. The Middle Ear. The ear drum or Tympanum separates the outer and middle ear. Connected to the ear drum is a linkage of three small bones the Ossicles, which transmit the vibrations across the middle ear, which is filled with air

Inner Ear which is filled with liquid. The last of the bones connects to another membrane in the inner ear.

The Inner Ear. The vibrating membrane causes the fluid in the Cochlea to vibrate. Inside the cochlea there is a fine membrane covered with tiny hair like cells. The movement of these small cells will be dependent on the volume and pitch of the original sound. The amount and frequency of displacement is detected by the auditory nerve which leads directly to the brain where the tiny electrical currents are decoded into sound patterns.

Hearing Impairments
. Hearing difficulties are broadly classified into three categories:
Conductive deafness Noise Induced Hearing Loss (NIHL). Presbycusis. (Loss through ageing).

Conductive deafness.
Any damage to the conducting system, the Ossicles or the ear drum, will result in a degradation of hearing. It is possible that perforations of the ear drum will result in scarring of the tissue thus reducing its ability to vibrate freely. A blow to the ear may cause damage to the small bones in the middle ear again limiting the transfer of vibrations. Modern surgery may help in some circumstances.

Noise Induced Hearing Loss (NIHL).

Loud noises can damage the very sensitive membrane in the Cochlea and the fine structures on this membrane. The loss of hearing may at first be temporary but continued exposure to loud noise will result in permanent loss of hearing. The early symptoms are an inability to hear high pitched notes as these notes are normally detected by the finer cells which suffer the greatest damage. The loudness of a noise is measured in Decibels (db). For example a sound proofed room will have a rating of 9 db, an average office 50 db and a busy street corner 70 db. An observer standing by a runway whilst a large jet takes off will experience 100 - 120 db. To cause permanent damage to hearing a noise level of 90 db or more is required. The amount of damage is related to the total noise energy so time of exposure is important. A noise level of 85 db for 8 hours will cause the same damage as exposure to 103 db for 30 minutes or 116 db for 1 minute.

Airport Pekak
The noise level on and around a busy airport can be very high and it is essential that ear defenders are worn by all personnel working in the area of high noise levels. Put on ear muffs

For the younger element the noise level in discos can be excessive and personal stereos can reach above the safety level. Noise Induced Hearing Loss (NIHL) is not treatable at the moment. Recent experiments hold out some hope of a cure as researchers have been able to regrow the fine hair like cells in the cochlea of young rats. The treament involves the use of retinoic acid, made from vitamin A. The treatment in humans is still however a long way off and the only sure way to avoid NIHL is to protect the ears from loud noises.

(Loss through ageing). Hearing deteriorates with advancing age. Young children can hear high pitched noises outside the range of adults. The loss of some hearing is natural as one grows older but if combined with some NIHL there may be a chance of increased impairment.

The Ear and Balance

As well as acting as the organ to detect sounds, the ear is used to detect angular and linear accelerations. Our primary source of spatial orientation is sight but the ear provides a secondary system, particularly if vision is restricted.

Within the inner ear are three Semi-circular canals, tubes filled with liquid and arranged in three planes at 90 degrees to each other. Within these tubes are fine hairs which are bent as the liquid in the tubes moves in relation to the walls of the tubes. The movements of these hairs generates a small electric current which is passed to the brain to be detected as a movement of the head.

The Ear and Balance

The semi-circular canals detect angular movement; linear acceleration is detected by the Otoliths at the base of each of the canals. The Otoliths, literally 'stones in the ears', are fleshy stalks surmounted by a small stone or crystal. Acceleration in any plane causes the stalks to bend and this bending is interpreted by the brain to decide the new position of the head. The Semi-circular canals and the Otoliths together make up the Vestibular apparatus which helps to maintain spatial orientation and control other functions. For example it controls eye movement to maintain a stable picture of the world on the retina even when the head is moved.

The Effects of Alcohol

Alcohol has a lower specific gravity than water. Alcohol in the middle ear may dilute the liquids and cause unfamiliar results for certain movements, leading to disorientation.

Alcohol in the fleshy stalk of the Otolith may persist for days after all traces of alcohol have vanished from the blood. It is not unusual for even small movement of the head to cause disorientation or motion sickness up to three days after alcohol was last consumed.

Information Processing
Information processing can be represented as a model. This captures the main elements of the process, from receipt of information via the senses, to outputs such as decision making and actions. One such model is shown. Information processing is the process of receiving information through the senses, analysing it and making it meaningful.

Information Processing

A Functional Model Of Human Information Processing

Sensory Receptors and Sensory Stores

Physical stimuli are received via the sensory receptors (eyes, ears, etc.) and stored for a very brief period of time in sensory stores (sensory memory). Visual information is stored for up to half a second in iconic memory and sounds are stored for slightly longer (up to 2 seconds) in echoic memory. This enables us to remember a sentence as a sentence, rather than merely as an unconnected string of isolated words, or a film as a film, rather than as a series of disjointed images. Attention and Perception Having detected information, our mental resources are concentrated on specific elements - this is attention.

This can be thought of as the concentration of mental effort on sensory or mental events. Although attention can move very quickly from one item to another, it can only deal with one item at a time. Attention can take the form of: Selective attention, Divided attention, Focused attention Sustained attention.