VOLUME 2.

AIR OPERATOR ADMINISTRATION

CHAPTER 40. MAINTENANCE MISTAKES & SYSTEM

SOLUTIONS

OBJECTIVE
The objective of this chapter is to discuss human factors as related to aircraft maintenance.
This Chapter has been adapted from an article written by Alan Hobbs Human performance
investigator, with the Australian Bureau of Air safety Investigation (BASI)

Human factors Is not just about people: it is also about

improving systems. While the focus of this article is on
airline maintenance, there are also lessons for general
aviation.

Most people will say that the common threats to the airworthiness of an aircraft are metal
fatigue, corrosion, and excessive wear of components or other results of ageing and use.

Yet today, as aircraft become increasingly reliable, we have reached the point where the
actions of the maintainers themselves lie at the heart of many airworthiness problems.
According to Boeing, around 15% of major aircraft accidents involve maintenance error.

Human errors, and the frustration, sleepiness, misunderstandings and memory lapses which
produce them, are powerful forces affecting the quality of maintenance and hence the
airworthiness of aircraft.

There is now a worldwide effort to understand more about the human side of maintenance
problems. This article deals with just a few of these issues.

Maintenance errors can have a significant impact not only on safety, but also on the financial
performance of large and small operators alike. A single in-flight turn-back of a Boeing 747,
with the need to accommodate passengers overnight, can easily wipe out $250,000 of profit.
It has been estimated that in the USA, maintenance error could cost airlines one billion US
dollars per year!

The term 'human error' is used throughout this article in recognition of the fact that most
aviation accidents do involve human error at some point in the chain of events. However, we
need to recognise that these errors (or unsafe acts) tend to be just one link in a chain of
events. A useful framework to use when considering human factors issues is the Reason
model of accident causation outlined on the next page.
02/07/25 40-1
 ORGANISATIONAL
PROBLEMS

 Learning from warnings

 Refresher training
 Fatigue management

LOCAL PROBLEMS

 Procedures
 Tools & equipment
 Skills & experience
 Communication
UNSAFE ACTS

 Memory lapses
 Work-arounds
 Situational awareness
 Expertise errors
 Action slips
SAFEGUARDS

 Error tolerance
 Error capture

ACCIDENT
Unsafe acts are not just problems in their own right, but can
be seen as symptoms of wider problems. For example, in March 1994 the number one engine
and pylon of a 747-200 rotated downward during the landing roll and contacted the runway
There were no injuries to passengers or crew. The aft fuse pin on the pylon diagonal brace
had migrated from its fitting and was found loose in the pylon structure. The type of pin fitted
to this aircraft was normally secured in place by two retaining devices, but on this occasion,
neither of these retainers could be found.

Approximately 10 hours after the accident, the missing retainers were found in an unmarked
cloth bag on a work stand near where the aircraft had recently undergone a C-check. The C-
check had included an -inspection of the diagonal brace fuse pin lugs on the two outboard
engines.

It was never established who had made the errors that culminated in the accident; however,
finding the people responsible may not have helped prevent future accidents. The most
important lessons learnt from this accident were not about individuals, but about the way
maintenance was organised and carried out.

02/07/25 40-2
The US National Transportation Safety Board (NTSB) identified a range of system problems
including an error-producing work environment, potentially dangerous scaffolding, poor
lighting, inappropriate storage of parts, a lack of training in company maintenance policies
and inadequate oversight by the US Federal Aviation Administration (FAA). Addressing each
of these upstream problems would not only reduce the chance of the same errors happening
again, but should also help to prevent a host of other quality problems.2

Unsafe acts: What goes wrong?

In order to understand the types of errors made by maintenance engineers, the Bureau of Air
Safety Investigation (BASI) has collected information on over 120 maintenance unsafe acts
from interviews with airline engineering personnel and from incident reports received during
a study of the regional airline industry. Most of the unsafe acts were corrected before the
aircraft flew, or resulted in only minor consequences.
Over 80% of the unsafe acts of maintenance mechanics fell into one of five types.

Memory lapse: 24%

Memory lapses do not generally happen randomly, but often occur when a person is
interrupted to go and do something else. Juggling maintenance tasks on several aircraft is a
common situation which can lead to a memory lapse.
Being the only person on shift, I was responsible for both hangar and line maintenance.
There was a fuel quantity problem on a [….], had to move fuel plumbing to gain access. I
was distracted from my task by heavy commitments with line defects. I forgot to check the
tightness of the B-nuts causing the aircraft to develop a potentially disastrous fuel leak
-De-identified incident report

2. Work-arounds: 23%
Typically, work-arounds involve performing a task without all the necessary equipment, or in
a more convenient manner than in the approved procedures. However, some are more serious,
as in the case of workers faced with time pressure who decide not to document their actions
or decide not to perform all the required steps in a task. On their own, work-arounds may not
necessarily result in an incident, but serious problems can result when other people are not
aware that someone has taken a shortcut, or when a work-around is followed by an error.

It was a Friday afternoon and I was about to knock off for the weekend I decided to do one
last-minute job and tighten the nose-wheel steering cables on a twin-engine aircraft. Not
having an appropriate flagged rig pin I used a bolt through the aircraft floor to hold the
rudder pedals in neutral. It got dark and everyone was anxious to go home, and I was
holding them up. At the end of the job I signed oft the Maintenance Release but forgot to
remove the bolt On the Monday I was asked if the aircraft was ready and I said yes'. The
aircraft was flown for a whole day checking out a pilot with landings every 20 minutes. If
they had feathered an engine or there had been an engine failure they would have been in
teal trouble, as the limited rudder movement was from this bolt flexing in the floor structure.
-De-identifled incident report

Maintenance mechanics are often faced with the pressure of being informed by companies to
follow the procedures, but at the same time are encouraged to get work done to deadlines.
One mechanic summed it up this way: 'Management tell us to follow the procedures to the
letter, but then they tell us not to be obstructive and to use common sense' A recent European
02/07/25 40-3
study found that a third of maintenance tasks involved a deviation from official task
procedures.3

3. Situational awareness: 18%

Situational awareness errors occur when the mechanic starts work without first gaining an
accurate picture of the situation being dealt with. Often, they don't realise that the situation is
different from normal, as when a mechanic activates hydraulics without noticing that cockpit
controls have been moved while the hydraulics were off. In other cases, an engineer may not
be aware of work being done by other workers on the same aircraft.

4. Expertise: 10%
Errors of expertise happen when someone doesn't have the knowledge, skills or experience to
do all aspects of their job. As might be expected, errors of expertise tend to involve less
experienced workers. The fact that 10% of errors are of this kind could indicate deficiencies
in training.

5. Action slips: 9%
Action slips occur when someone accidentally does something unintentionally. Slips tend to
occur on routine, highly familiar tasks.
A mechanic accidentally put engine oil into the hydraulics system of an aircraft. Oil and
hydraulic fluid were stored in nearly identical tins in a dark storeroom.
-De-identified incident report

LOCAL PROBLEMS: WHY DO THINGS GO WRONG?

The BASI analysis of maintenance incident reports found that for incidents which had
airworthiness implications, the most common factors in the work area at the time of the
incident were:

1. Confusion or misunderstandings or differences of opinion about procedures

It is not unusual to find that workers have a fairly limited understanding of a company's
formal policies and procedures and instead follow informal practices developed on the job.
Older, experienced workers will sometimes develop their own practices, which may be
different from the approved procedures. Unworkable or inconvenient procedures prompt the
sort of work-arounds described earlier.

2. Communication breakdowns between people

In a recent survey, senior US maintenance mechanics were asked to describe the most
challenging part of their job. Their most common answer was 'human relations or dealing
with people'4 Performing in a team requires more than technical know-how, and we often
overlook the need to develop these important communication and people skills.

02/07/25 40-4
3. Pressure or haste
Since the early days of aviation maintenance personnel have faced pressures to get aircraft
back into service. However, as aircraft become more complex and operators strive to reduce
the amount of time that aircraft spend in maintenance, pressure is a growing fact of life for
maintenance engineers. A particular risk is that engineers faced with real or self-imposed
time pressures will be tempted to take shortcuts to get an aircraft back into service more
quickly.

Maintenance systems have built-in safeguards such as independent inspections and functional
tests designed to capture errors on critical tasks. By necessity, these error-capturing
safeguards generally occur at the end of jobs, at exactly the time when pressures to get the
aircraft back into service are likely to be greatest and the temptation to leave out or shorten a
procedure is strongest.

In the recent BASI survey, 32% of mechanics reported that there had been an occasion when
they had not done a required functional check because of a lack of time. At the time, such a
decision may have seemed safe and reasonable; however, decisions made under pressure do
not always stand the test of hindsight.

4. Inexperience
Younger personnel need to know about the traps lying in wait for them, yet too often they are
allowed to discover these for themselves.

5. A lack of tools, or equipment, or spares

Many work-arounds occur in response to a lack of appropriate hardware or spares. It is
understandable that airlines will try to reduce their stocks of expensive spares; however) in
some cases relatively inexpensive spares such as 0-rings are nil-stock items. Furthermore, a
lack of major spares can lead to increased cannibalisation of parts from other aircraft, which
in turn doubles the disturbance to systems and increases the potential for human error.

A common theme underlying these problems is that maintenance personnel may need
training in human factors areas such as communication, supervision, and dealing with
pressure and frustration.

The great benefit of human factors training is not only that people change, but that people can
see the opportunities to change the systems in which they work. For this reason, managers,
who have the most power to change things, should not be excluded from human factors
training.

My company ran a human factors course for all mechanics in 1996. It was very informative
and I learnt a lot of things I hadn't even thought about before. As a result I have changed my
attitudes and actions to increase my personal safety and awareness. This course should be
given to all apprentices or new hires. If is invaluable.

-Survey comment

02/07/25 40-5
ORGANISATIONAL FACTORS: WHAT ARE THE WEAKNESSES IN THE
OVERALL SYSTEM?
Maintenance incidents can reflect a range of organisational problems. Three of the most
important of these are dealt with below.

1. Lack of refresher training

The regulations state that maintenance personnel must receive 'proper and periodic
instruction' however, in reality, few maintenance engineers receive refresher training once
they have gained their licences. Without such training, non-standard work practices can
develop or engineers can lose touch with changes in regulations or company procedures. One
senior airline manager put it this way: 'Maintenance engineers are like torque wrenches: they
need to be re-calibrated from time to time'

2. Lack of learning from incidents

The conventional wisdom among safety experts is that for every accident there may be 30 or
more previous minor incidents. When BASI interviewed maintenance engineers about
incidents, it became apparent that before a serious quality lapse occurs, there are usually
earlier incidents which could have acted as warnings of a problem.

Unfortunately we do not always learn the right lessons from these 'warning incidents;
sometimes because they are never reported. It is never easy to admit a mistake; however, it is
even harder when an organisation punishes people who make honest mistakes, perhaps by
docking pay or placing notes on personnel files. A punitive culture within the company or the
regulatory authority creates an atmosphere in which problems are quietly corrected and
places barriers in the way of learning from our mistakes. In the recent BASI survey of
maintenance personnel, 66% of respondents reported that they had corrected an error made
by one of their colleagues without documenting it, in order to avoid getting them into trouble.

One action which managers can take to ensure that they hear about the 'warning incidents' is
to have a clear 'responsibility policy; which outlines how the organisation will respond to
maintenance incidents. Figure 2 illustrates how a responsibility policy might work, although
every operation will need to tailor such a policy to its own requirements. Needless to say, no
policy such as this can be expected to function if the regulatory authority penalises those who
report their mistakes.

Until the regulator’s inspectors move away from the blame culture that is currently
implemented, maintenance defects and incidents will always be covered up and hidden.
-Survey comment

Once an incident has been reported, the focus of an internal investigation should normally be
on identifying system problems, not on identifying personal deficiencies of individuals.

There may be rare times when incidents are related to intentional acts of malice, but the great
majority of maintenance mechanics do their jobs with diligence and integrity and most
incidents reflect system problems which go beyond individual workers.

An internal investigation that only results in recommendations directed at the level of

individuals, (such as reminders to engineers to 'be more careful' or to 'follow procedures more
02/07/25 40-6
closely') are sure signs that the investigation did not identify the system failures which led to
an occurrence. There are now structured methods to help managers identify system failings in
maintenance, such as the Boeing maintenance error decision aid (MEDA) system.6

Figure 2. An example of a ‘responsibility polity’, adapted from James Reason6

NO Were their Did they knowingly Did the person Were their actions
actions No No affected by system
No violate procedures? attempt to cover up
intentional ? their actions ? issues such as time
pressure or fatigue?
Yes Yes Yes No Yes

No
No
Did they intend to Were procedures Error or work- System-induced
compromise safety available, workable around error or work-
? and correct ? around

Yes Yes

Rule violation
Possible criminal
act

Diminishing Culpability

3. Fatigue
There is probably no way to avoid the need for maintenance to be done at
night; however, this does not mean that fatigue levels cannot be managed. Unfortunately,
almost all night-shift workers suffer from a lack of quality sleep.
I
Recent Australian research has shown that moderate sleep deprivation of the kind
experienced by shift workers can produce effects very similar to those produced by alcohol.7
After 18 hours of being awake, mental and physical performance on many tasks is affected as
though the person had a blood alcohol concentration (BAC) of 0.05%. Boring tasks which
require a person to detect a rare problem (like some inspection jobs) are most susceptible to
fatigue effects. After 23 hours of being continuously awake, people perform as badly on these
tasks as people who have a BAC of 0.l2%.8

One in five of the engineering personnel who responded to the recent BASI survey claimed
they had worked a shift of 18 hours or longer in the last year, with some having worked
longer than 20 hours at a stretch. There is little doubt that these people's ability to do their job
would have been degraded. An important point to note is that like people who are intoxicated,
fatigued individuals are not always aware of the extent to which their capabilities have
degraded.

At a time when the dangers of fatigue are being recognised in areas as diverse as medicine
and road transport, we must ask why there are no regulations to control the risks of fatigue
among aircraft mechanics.

4. Time of day
02/07/25 40-7
 Because fatigue was mentioned by many engineers as a problem, it is worth
considering the time at which occurrences occurred. In high-capacity airlines, maintenance
occurrences were most frequent at around 1100, but then reduced in frequency between 1200
and 1300, presumably as workers took meal breaks. The next most frequent time for
occurrences in high-capacity airlines was around 0300. These occurrence patterns do not
reflect variations in the number of workers present, because for high-capacity airlines there
are almost as many workers present at night as during the day.

The time of occurrences in non-airline maintenance showed a different pattern, largely

reflecting the fact that most work is carried out during daylight hours. There were two
definite peaks in occurrence times, one just before 'knock off' time and the other just before
lunch.

Just as there are 'black spots' on our roads, so there are also 'black times' for shift workers.
For maintenance workers on night shift, it seems that 0300 is a black time. Late morning and
early afternoon are also danger times. There is a clear lesson here for those who schedule
maintenance tasks: 0300 is an undesirable time to be carrying out complex or crucial
maintenance tasks.

For those who work more conventional hours, the times immediately before breaks appear to
be danger periods. In particular, the end of the working day can produce a hazardous
combination of pressure and fatigue.

SAFEGUARDS: REDUCING THE CONSEQUENCE: OF MAINTENANCE ERROR:

Minimising the consequences of errors VS 'working without nets'

Functional checks and independent inspections are examples of safeguards designed to
capture errors before they cause harm.

However, there is another approach to managing error which is sometimes overlooked. This
is to acknowledge that errors will occur from time to time and that we need to design
procedures and systems that can minimise the consequences of such errors. Special
maintenance precautions applied to extended-range twin-engine operations (ETOPS) are an
example of such an approach. When an aircraft is being maintained in accordance with
ETOPS procedures, the performance of identical maintenance actions on multiple elements of
critical systems is avoided wherever possible. Engines, fuel system, fire-suppression Systems
and electrical power are examples of ETOPS critical Systems on aircraft such as the B767
and B737.

However, these precautions are not generally applied to aircraft with more than two engines,
or to twin-engine aircraft which are not being maintained in accordance with an ETOPS
maintenance program.

For example, in 1995, a European-operated Boeing 737-400 was forced to divert shortly
after departure following a loss of oil quantity and pressure on both engines. Both of the
aircraft's CFM- 56 engines had been subject to boroscope inspections during the night prior

02/07/25 40-8
to the incident flight. High-pressure rotor drive covers were not refitted on each engine and as
a result, nearly all the oil was lost from the engines during the brief flight.9

Several months after this incident a similar overseas incident occurred on a Boeing 747-400.
Shortly after departing on an over-water flight, the crew noticed reducing oil quantities on the
number one and number two engines. The aircraft was turned back to its departure point,
where it arrived safely without any need for the engines to be shut down in flight After
landing, oil could be seen leaking from the engines.

Boroscope inspections had been carried out on all four of the GE CF6 engines. This
inspection normally involves removing and then refitting the starter motor from each engine,
and in fact the starter motors were removed from the number one and number two engines in
preparation for the job. Because the tool to enable the engines to be turned by the starter drive
could not be found, the starter motors for engines 3 and 4 were not removed and all engines
were turned by an alternative method. A lack of spares had led to a practice of not replacing
0-rings when refitting starter motors. However, on this occasion a mechanic did comply with
documented procedures and removed the 0- rings from the number one and two starters.

The workers who refitted the starters apparently assumed that the situation was 'normal' and
did not notice that the 0-rings were missing 'situational awareness' error.

This incident had a variety of causal factors, such as informal procedures which had evolved
to work around the frequent 'nil stock' state of spares, poor lighting and inadequate leak check
inspections. However, an important point is that because the aircraft had four engines, it was
not protected by ETOPS standards. In essence, the mechanics were 'working without nets'.
Had the job proceeded as originally planned, the starter motors would have been removed
from all four engines, with serious consequences.

The extension of some ETOPS precautions to non-ETOPS operations would help to contain
such maintenance-induced problems.

Boeing has encouraged operators as a general practice 'to institute a program by which
maintenance on similar or dual systems by the same personnel is avoided on a single
maintenance visit'10BA51 has also published the following suggested safety action: 'Where
possible, the simultaneous performance of the same maintenance tasks on similar redundant
systems should be avoided, whether or not the aircraft is an ETOPS aircraft"11

CONCLUSIONS

Unfortunately, advances in aviation technology have not necessarily been matched by

improvements in the way we organise the work of the people who maintain aircraft.

The remarkable aspect about maintenance incidents is that many of them share similar
features. A relatively limited number of unsafe acts, such as work-arounds, memory lapses
and situational awareness errors typically occur in the context of problems such as unclear or
poor procedures, a lack of equipment or spares, communication breakdowns, time pressure
and fatigue. Because unsafe acts are generally symptoms of wider problems, human factors is
not just about focusing on people but on the systems within which people work.

02/07/25 40-9
This article concludes with just five system-level improvements that may help to ensure safer
maintenance:

1. Introduce refresher training, particularly on company policies and procedures.

2. Introduce a clear 'Responsibility Policy' to remove barriers that discourage people

from reporting incidents.

3. Introduce a fatigue management program. This will almost certainly involve ensuring
that workers get adequate sleep opportunities. If 12-hour shifts are being worked, a ban on
extending shifts with overtime may be necessary.

4. Introduce human factors training for management and workers.

5. Minimise the simultaneous disturbance of multiple or parallel systems.

While striving for perfect performance by those maintaining aircraft, we should recognise
that making mistakes is an unfortunate but unavoidable consequence of being human.

02/07/25 40-10
References

1. Marx D. (1998) Learning from our Mistakes: A review of maintenance error

investigation and analysis Systems, FAA.

2. NTSB Special Investigation Report NTSBISIR-94102.

3. Eggerling U. (1998) Airbus Industrie, Human Factors in Maintenance: The Need

for Dialogue and Feedback, Paper Presented to Association of Asia Pacific Airlines
Maintenance Human Factors Conference, Sydney February 1998.

4. Predmore S. and Werner T. Maintenance Human Factors and Error Control Eleventh
FAA Meeting on Human Factors Issues in Aircraft Maintenance and Inspection. Washington,
DC: FAA

5. Reason J. (1997) Managing the Risks of Organizational Accidents Ashgate,

Aldershot.

6. Rankin W and Allen J (1996) Boeing Introduces MEDA: Maintenance Error Decision
Aid Airliner April-June 20-27.

7. Dawson, D. and Reid, K. (1997) Fatigue and Alcohol Intoxication Have Similar
Effects on Performance. Nature, 38, 17 July,
235.

8. Wilhamson A. and Feyer A. Moderate sleep deprivation produces comprehensive

cognitive and motor performance impairments equivalent to legally proscribed levels of
alcohol intoxication.

9. Air Accidents Investigation Branch (1996) Aircraft Accident Report 3/96.

10. Boeing Service Letters Dual System Maintenance Recommendations 17 July 1995.

11. Bureau of Air Safety Investigation (1997) Human factors in airline maintenance: A
study of incident reports.

02/07/25 40-11