Study For Task 145-020 - Work Card System

FINALREPORT
EASA EuropeanAviationSafetyAgency
Aeronautics&SpaceDirection
SpecificationsN:EASA/2006/OP/25 On demand of the European Aviation Safety Agency (EASA), BUREAU VERITAS conducted a Study on the need of a common worksheet / work card system from JanuarytoNovember2007. Thepresentdocumentpresentstheresultsofthisstudy.
Studyontheneedofacommonworksheet/workcardsystem FortheEuropeanAviationSafetyAgency(EASA)
CONTENTS
1 INTRODUCTION ................................................................................... 7
1.1 1.2 1.3 1.4 2.1 2.2 3.1 3.2 3.3 Regulatorycontextofthestudy ................................................................................ 7 Reasonsofthestudy................................................................................................ 8 Contentofthestudy ................................................................................................. 9 Reportofthestudy ................................................................................................. 10 ECCAIRSassessment............................................................................................ 11 Analysisofincidents/accidentsreportsandstatistics.............................................. 13 Ourmethodology.................................................................................................... 17 Theresults.............................................................................................................. 19 Conclusions............................................................................................................ 27
2 ANALYSISOFINCIDENTS/ACCIDENTS.......................................... 11 3 ANALYSISOFCOMMONPRACTICES ............................................ 17
4 DATAANALYSIS............................................................................... 28 5 RECOMMENDATIONS ....................................................................... 31

5.1 5.2 Recommendationsasconcernstheregulatorytexts............................................... 31 RecommendationsasconcernsthesafetypolicyandHFtraining .......................... 32
6 CONCLUSION..................................................................................... 34 7 ANNEXES........................................................................................... 36
AnnexAOccurrencesrecordedbytheBEArelatingtomaintenancedocumentation............ 37 AnnexBAccidentofaircraftA330,registrationCGITS,on24/08/2001............................... 41 AnnexCIncidentofaircraftA340,registrationFGTUB,on19/04/2002............................... 60 AnnexDListofincidents/accidentsrelatedtomaintenancedocumentation.......................... 65 AnnexERiskassessment .................................................................................................... 75 AnnexFModeltoimplementasafetyprocessinamaintenanceorganisation...................... 89
2/93
10December2007 Ref:ASD/M&S/HEMA/MSN/2006/467
FINALREPORT
INDEXOFTABLES
Table1:Roughdataresultingfromtheselectiontask.................................................................15 Table2:Distributionofthe15Europeanoperatorswhoansweredourquestions .......................18 Table3:Distributionofthe9EuropeanMROswhoansweredourquestions ..............................18 Table4:ResultsofthesurveyaboutOption1oftheRulemakingTaskn145.20........................22 Table5:ResultsofthesurveyaboutOption2oftheRulemakingTaskn145.20........................24 Table6:ResultsofthesurveyaboutOption3oftheRulemakingTaskn145.20........................25 Table7:ResultsofthesurveyaboutOption4oftheRulemakingTaskn145.20........................26 Table8:IdentifiedscenariosofrelationshipbetweenoperatorsandMROs ................................28 TableD1:Listofincidents/accidentsrelatedtomaintenancedocumentation .............................67 TableE1:Risksrelatedtoscenarios1&2betweenoperatorsandMROs.................................76 TableE2:Risksrelatedtoscenarios3&4betweenoperatorsandMROs.................................77 TableE3:Risksrelatedtoscenarios5&6betweenoperatorsandMROs.................................80 TableE4:RisksrelatedtoOptions2,3&4oftheRulemakingTaskn145.20...........................82
3/93
FINALREPORT
ABBREVIATIONS&ACRONYMS
AAIB AAIU AD ADREP ADRES AFM AIB AIBN AMC AME AMM AMP ANS AOC AOL AOT ATA ATL ATP ATR BAE BEA BN CAA CAMO CAR CD CDL CIR CIRCA CMM CRS CS DGAC DHC EASA EC ECAM ECCAIRS ED EIPC ERP EU FAA FCOM GPIAA HAESL HF ICAO IFA AirAccidentInvestigationBranch(UK) AirAccidentInvestigationUnit(Ireland) AirworthinessDirective Accident/IncidentDataReporting AirbusDocumentationRetrievalSystem AircraftFlightManual AccidentInvestigationBoards AccidentInvestigationBoardNorway AcceptableMeansofCompliance AircraftMaintenanceEngineer AircraftMaintenanceManual AircraftMaintenanceProgram AirNavigationService AirOperatorCertificate AllOperatorLetter AllOperatorsTelex AirTransportAssociation AircraftTechnicalLogbook AdvancedTurboProp AvionsdeTransportRegional BritishAerospace BureaudEnquteetdAnalysepourlascuritdelaviationcivile(France) BrittenNorman CivilAviationAuthorities ContinuingAirworthinessManagementOrganisation CanadianAviationRegulations CompactDisc ConfigurationDeviationList CleaningInspectionandRepair Communication&InformationResourceCentreAdministrator ComponentMaintenanceManual CertificateforReleasetoService CertificationSpecifications DirectionGnraledelAviationCivile (France) DeHavillandCanada EuropeanAviationSafetyAgency EuropeanCommission ElectronicCentralizedAircraft Monitoring EuropeanCoordinationCentreforAviationIncidentReportingSystems ExecutiveDirectorofEASA EngineIllustratedPartsCatalog EnterpriseResourcePlanning EuropeanUnion FederalAviationAdministration(US) FlightCrewOperatingManual GabinetedePrevenoeInvestigaodeAcidentescomAeronaves(Portugal) HongKongAeroEngineServicesLimited HumanFactors InternationalCivilAviationOrganization InternationalFederationofAirworthiness
4/93
FINALREPORT
IPC JAA JAR MCC MCM MEDA MEL MLG MMEL MOE MPD MRB MRO MSM N/A NAA PC POCV QC QEC RIA SB SHEL SIL SMM SMS SOOC SOP SP STC TC TC TSM TTU UK US VAC WDM
IllustratedPartsCatalog JointAviationAuthorities JointAviationRequirements MaintenanceControlCentre MaintenanceControlManual MaintenanceErrorDecisionAid MinimumEquipmentList MainLandingGear MasterMinimumEquipmentList MaintenanceOrganisationExposition MaintenancePlanningDocument MaintenanceReviewBoard Maintenance,RepairandOverhaul MaintenanceSafetyManager NotApplicable NationalAviationAuthorities PersonalComputer PackOutletCheckValve QualityControl QuickEngineChange RegulatoryImpactAssessment ServiceBulletin SoftwareHardwareEnvironmentLiveware ServiceInformationLetter SafetyManagementManual SafetyManagementSystem SystemOrganizationOperationsCentre StandardOperatingProcedure SafetyPolicy SupplementalTypeCertificate TransportCanada TypeCertificate TroubleShootingManual ToleranceTakeUp UnitedKingdom UnitedStates VoltsAlternatingCurrent WiringDiagramManual
5/93
FINALREPORT
SUMMARY
The European Regulation 2042/2003 Annex II (Part 145) recommends that The [maintenance] organisationshallprovideacommonworkcardorworksheetsystemtobeusedthroughoutrelevantparts oftheorganisation.145.A.45(e) TheEuropeanAviationSafetyAgency(EASA)entrustedBUREAUVERITASwiththeStudyontheneed ofacommonworksheet/workcardsystemtoassesswhetheranoncommondocumentation(thatiswork cards coming from various sources), shared by both the operator (AOC holder) and the maintenance, repair and overhaul organisation (MRO), increases risks in terms of human factors when carrying out maintenance. TheresultsofthestudyshallgiveEASAusefulhighlightstodecidewhethertheRulemakingTask145.020 scheduledtostartin2008mightbepostponedormovedforwardforsafetyreasons. TheRulemakingTaskn145.20examinesfouroptions: 1. Donothing:keepthesituationasitstands. CommonlytheoperatorprovidesmaintenancedatatotheMRO,sometimesafewdaysbeforethe maintenanceperformance. 2. Operatorsjobcardsystem:theoperatorprovidestheMROwithajobcardsystem. The operator prepares maintenance data that meets the Part 145 requirements. The contract shouldreflectthisoption. 3. MROsjobcardsystem:theMROusesonlyitsinternaljobcardsystem. TheoperatorshouldusethejobcardscomingfromtheMRO.Thosejobcards shouldreflectthe currentstatusoftheaircraft.Thecontractshouldreflectthisoption. 4. Combinedjobcardsystem:adifferenceismadebetweenlineandbasemaintenance. Base maintenance mandates the MROs job card system and line maintenance allows the operatorsjobcardsystem. BUREAUVERITAScarriedoutthestudyfromJanuarytoNovember2007. Thisstudyaimsatprovidingfurtherinsightsontheuseofdocumentation,thecommonpracticesinplace betweenoperatorsandmaintenanceorganisationsandtoassesswhethercurrentrulesandpracticesmay contribute to incidents / accidents. It should give substantial additional data to execute rulemaking task 145020,possiblyprovidingnewoptionsandmakingsafetyrecommendations. Analyzing the results of the collected data, we concluded that none of thefour options examined by the RulemakingTask n 145.20 seems to be likely to have an effectiveimpact on aviation safety in Europe, and that the best option seems to be the first one: Keep the situation as it stands. Nonetheless, this optionstatesthatnothingneedstobedonetoensureabettercontrolofthehumanfactorconcernwhen carryingoutmaintenance,whichisnotthecase. The study of common maintenance practices showed that Regulation 2042/2003 (including Part M ContinuingAirworthiness,Part66CertifyingStaff,Part145MaintenanceOrganisationApprovals,and Part 147 Training Organisation Requirements) should be revised in the aim of reducing the number of accidents or incidents related to maintenance documentation. We proposed three recommendations to improvethePart145Regulation.Wealsomadearecommendationfortheimplementationofamodelto implementthesafetyprocessinthemaintenanceorganisations,intheaimtoobtainmorepositiveresults anddecreaseoferrorsparticularlythoserelatedtothedocumentation.
6/93
FINALREPORT
1 I N T R O D U C T I O N I N T R O D U C T I O
1. .1 1 Re eg gu ul la at to or ry yc co on nt te ex xt to of ft th he es st tu ud dy y 1 R
Asan agencyoftheEuropeanCommunity,the EuropeanAviationSafetyAgency(hereinafterEASAor the Agency) helps the European Commission to shape new rules for aviation safety, in various areas including the approval of organisations and personnel engaged in the maintenance of aeronautical products,andapprovalofairoperations. Among others, the Agency is responsible for the following rulemaking activities: preparation of guidance material for the application of Community law, and amendments to the Basic Regulation or its implementingrules. The Commission Regulation (EC) No 2042/2003 Annex II Part 145 Maintenance Organisation Approvalsrecommendsthat: The [maintenance] organisation shall provide a common work card or worksheet system to be used throughoutrelevantpartsoftheorganisation.Inaddition,theorganisationshalleithertranscribeaccurately themaintenancedata()ontosuchworkcardsorworksheetsormakeprecisereferencetotheparticular maintenancetaskortaskscontainedinsuchmaintenancedata.() Wherethe[maintenance]organisationprovidesamaintenanceservicetoanaircraftoperatorwhorequires theirworkcardorworksheetsystemtobeused,thensuchworkcardorworksheetsystemmaybeused.In this case, the organisation shall establish a procedure to ensure correct completion of the aircraft operatorsworkcardsorworksheets.145.A.45(e)Maintenancedata TheEDDecisionNo2003/19/RMAnnexIIAcceptableMeansofCompliancetoPart145explainsthat: 1. Relevant parts of the organisation means with regard to aircraft base maintenance, aircraft line maintenance, engine workshops, mechanical workshops and avionic workshops. Therefore,for example, engineworkshopsmayhaveacommonsystemthroughoutsuchengineworkshopsthatcanbedifferentto thatusedinaircraftmaintenance. 2. The work cards should differentiate and specify, when relevant, disassembly, accomplishment of task, reassemblyandtesting.Inthecaseofalengthymaintenancetaskinvolvingasuccessionofpersonnelto completesuchtasks,itmaybenecessarytousesupplementaryworkcardsorworksheetstoindicatewhat wasactuallyaccomplishedbyeachindividualperson.AMC145.A.45(f)Maintenancedata The Commission Regulation (EC) No 2042/2003 Annex I Part M Continuing Airworthiness requires that: Allmaintenanceshallbeperformedbyqualifiedpersonnel,followingthemethods,techniques,standards andinstructionsspecifiedintheM.A.401maintenancedata.Furthermore,anindependentinspectionshall becarriedoutafteranyflightsafetysensitivemaintenancetaskunlessspecifiedbyPart145oragreedby thecompetentauthority.M.A.402(a)Performanceofmaintenance Inthisregulatorycontext,theAgencyrecallsthefollowingprocesses: The engineering department inside the maintenance organisation shall develop its own maintenancedocumentationwhenthereisaneed,issuingworkcardsadaptedtothenatureofthe workbeingundertaken. Where the Part145 organisation provides a maintenance service to an aircraft operator who requirestheirworkcardorworksheetsystemtobeused,thensuchworkcardorworksheetsystem maybeused.Inthiscase,thePart145organisationshallestablishaproceduretoensurecorrect completionoftheaircraftoperatorsworkcardsorworksheets. A difference may be made between line and base maintenance. For line maintenance and non regular operations, the operator has to provide line maintenance organisation with its documentationatoutstations.
7/93
FINALREPORT
1. .2 2 Re ea as so on ns so of ft th he es st tu ud dy y 1 R
Ontheonehand,theAgencyreceivedfromAviationInvestigationBoardssomeSafetyRecommendations related to incidents and accidents where the documentation had been a contributingfactor. EASA noted that: Aviation history shows that some incidents or accidents are directly orindirectly due to maintenance errors involving either a misinterpretation or a poor understanding of the documentation or a non adapteddocumentation.EASAcitestheexampleofthetwofollowingevents: o AccidentofaircraftAirbusA330243,registrationCGITS,atLajesAirport,TerceiraIslandsin the Azores, on 24 August 2001 (Report Ref. 22/ACCID/2001 of GPIAA, the Portuguese AviationAccidentsPreventionandInvestigationDepartment). o IncidentofaircraftAirbusA340,registrationFGTUB,atReunionIsland,intheIndianOcean, 1 on19April2002(registeredintheECCAIRS database). Consequentstudiesdemonstratedthatoneofthebestsolutionstoavoidincidents/accidentsrelated tojobcardsistohaveacommondocumentationthroughoutthecompanyandtoprovidewithaparallel tooperationsbyensuringconsistencywiththechecklistusedbythecrewmembers. Theworsecasescenarioinhumanfactorterms,isanoncommondocumentationsharedbyboththe operatorandthemaintenanceorganisation(workcardscomingfromvarioussources)attheverylast timewithacontractputtingpressureonontimedelivery(atthelevelofthemaintenanceorganisation).
On the other hand, the Agency noticed discrepancies among practices in the field, regarding the regulationsmentionedabove.EASAnotedthat:
2 Infact,theabovedescribedprocesses seemnottobealwaysimplemented:
o Thecontractsbetweentheoperatorandthemaintenanceorganisationgenerallydonotinclude therelatedprovisions. o ExperienceshowsthattheorganisationdoesrarelyintroduceinitsMaintenanceOrganisation Exposition a procedure to ensure correct completion of the aircraft operators work cards or worksheets. o Trainingtothedocumentationisbarelyachieved. o Correctcompletionoftheworksheetsisrarelychecked. Experience and audits show that some operators only provide the Part 145 organisation with the documentationataverylatestage.Itmayevenhappenthatthecontractbetweentheoperatorandthe Part 145 organisation is signed at the very last moment and the maintenance documentation is not provided on time consequently the Part 145 uses its own documentation, which may not be fully adaptedtothetechnicalstatusoftheaircraft(airworthinessstatus,repairs,modifications,etc).
Consequently,theAgency,inliaisonwiththeindustry,feltnecessarytoevaluatetheneedforensuringa better control of the human factor elements when carrying out maintenance. The task called n145.020 shouldstartin2008andexaminefouroptions: 1. Do nothing: keep the situation as it stands. Commonly the operators provide maintenance data to thePart145organisation,sometimesafewdaysbeforethemaintenanceperformance 2. Operator work card / work sheet system: the operator provides the maintenance organisation with documentationthatmeetsthePart145workcard/worksheet systemtheoperatorwillpreparethe documentationandthecontractshouldreflectthisoption Maintenanceworkcard/worksheetsystem:theoperatorshouldonlyusethejobcardsystemcoming from the maintenance organisation and reflecting the current technical status of the aircraft the contractshouldreflectthisoption Combined work sheet system: A difference is made between line and base maintenance. Base maintenance mandates the 145 maintenance work card /work sheet system and line maintenance openstheoptionstousetheoperatorworkcard/worksheetsystem.
3.
4.
1 2
EuropeanCoordinationCentreforAviationIncidentReportingSystems(Cf.2.1ECCAIRSassessment). See1.1Regulatorycontextofthestudy 8/93
FINALREPORT
1. .3 3 Co on nt te en nt to of ft th he es st tu ud dy y 1 C
EASA entrusted BUREAU VERITAS with the Study on the need of a common worksheet / work card systemtoevaluatetheimpactofmaintenancedocumentationontheHumanFactorconcern. Thisstudyaimsatprovidingfurtherinsightsontheuseofdocumentation,thecommonpracticesinplace betweenoperatorsandmaintenanceorganisationsandtoassesswhethercurrentrulesandpracticesmay contribute to incidents / accidents. It should give substantial additional data to execute rulemaking task 145020,possiblyprovidingnewoptionsandmakingsafetyrecommendations. Among other results, the study should produce a list of incidents/accidents related to the use of maintenancedocumentation.Someoutstandingeventsareexpectedtobedetailedwhereitisproventhat thedocumentationwasdirectlyorindirectlyacontributingfactortotheincident/accident. Morespecifically,EASAaskedBUREAUVERITAStoanalysethetwoeventscitedabove(i.e.accidentof aircraftA330243,registrationCGITS,atLajesAirport,on24August2001,andincidentofaircraftA340, registrationFGTUB,atReunionIsland,on19April2002)andevaluatethelessonslearnedinrelationwith thestudy.Themainpointistoassesswhethercontributingfactorsofsuchevents,intermsofimpactofthe maintenancedocumentation,arestillatstake. Furthermore,thestudyshallprovidethenecessaryinstrumentsfordefiningpolicyorientations.Basedon the conclusions of the report, EASA should be in a position to evaluate the risks of the use of documentationaccordingtothecurrentpracticesthroughoutEuropeandassessthedecisionstobetaken. Recommendationsshallbemade.Amongothers,specialrecommendationsshallbeprovidedinthelightof thefollowingconcerns: Staffing issues. Guidance whenever possible about minimum technical staff quality and qualification for both the operator (or a CAMO) and the MRO to appropriately manage maintenancedocumentationandcontracts(writing,signature,followup). Contracts specifications. Amendment to the instructions about maintenance documentation. An estimationofhowlonginadvancedocumentationshouldbeprovidedisexpected.Proposalson thetrainingorontheproceduretoensurea safecompletionoftheworkcard/sheetsystemare alsoexpected. Thebestscenarioformanagingthemaintenancedocumentationandcontrollingthehumanfactor elementswhencarryingoutmaintenance:Whatkindofregulatoryprecautionsshouldbetakento enhancesafetyifnecessary? Asarsum,thegeneralobjectivesofthestudyareto: 1) Bring out statistic figures and detailed reports on accidents/incidents related to maintenance documentation. 2) Gather and analyze data about current rules and common practices in place between operators andmaintenanceorganisationsthroughoutEurope 3) Assesswhethertheserulesandpracticesmaycontributetoincidentsoraccidents 4) Provide recommendations that mitigate risks related to third party maintenance, from the preparationofaccuratecontractsspecificationstothecontroloftheirsafecompletion 5) Make suggestion to enhance safety in terms of documentation management and human factors controlwhencarryingoutmaintenance 6) Provide conclusions necessary for EASA to make a decision concerning scheduling of the RulemakingTask145.020 7) Collectdataandprepareframeworkfortheexecutionofthisrulemakingtask,alongwiththefuture RegulatoryImpactAssessment(RIA).
9/93
FINALREPORT
1. .4 4 Re ep po or rt to of ft th he es st tu ud dy y 1 R
Thepresentreportdescribesthe resultsoftheStudyonthe needofacommonworksheet/ workcards systemconductedbyBUREAUVERITASfromJanuaryuntilNovember2007. Thefirstpartofourstudyaimedatanalysingoccurrencesestablishingarelationshipbetweenthe useof the maintenance documentation and some air incidents or accidents (See 2 Analysis of Incidents/Accidents). WegaveaspecificattentiontothetwoaccidentsnoticedbytheAgency. Analysisofthesetwoeventsis presented in Annex B: Accident of aircraft A330, registration CGITS, on 24 August 2001 and in AnnexC:incidentofaircraftA340,registrationFGTUB,on19April2002. In the second part of the study, we collected and analysed data about the common practices in place betweenoperatorsandmaintenanceorganisations,inthepurposeofhighlightingthecurrentrulesrelating to the use of the maintenance documentation, and to assess whether these rules and practices may contributetoincidentsoraccidents.(See3AnalysisofCommonPractices). Ouranalysisofthecollecteddataispresentedinnextparagraph(See4.DataAnalysis). Ourrecommendationsarepresentedinparagraph5Recommendations. We also contacted the International Federation of Airworthiness (IFA), the French DirectionGnrale de lAviationCivile(DGAC)andAirbus,forthecollectionofstatisticaldataandtheunderstandingofcommon practices.Wereceivednoansweronthedatewedeliveredthisreport.
10/93
FINALREPORT
2 A N A L Y S I SO FI N C I D E N T S / A C C I D E N T S A N A L Y S I O I N C I D E N T S / A C C I D E N T S
Thispartofthestudyconsistedofthetwofollowingmaintasks,presentedinnextparagraphs: Assessment of the European ECCAIRS database that shall define whether it can be used to gatherdataonincidentsoraccidentsrelatedtomaintenancedocumentation (2.1ECCAIRSassessment) Collectionandanalysisofreportsandstatisticsonincidentsandaccidentsrelatedtomaintenance documentation (2.2Analysisofincidents/accidentsreportsandstatistics)
2. .1 1 EC CC CA AI IR RS Sa as ss se es ss sm me en nt t 2 E
AEuropeancentralreportrepositoryexistswhichistheEuropeanCoordinationCentreforAviationIncident Reporting Systems (ECCAIRS). The objective of ECCAIRS is to integrate information from aviation occurrencereportingsystemsrunninginthedifferentEUmemberstates. Therefore, BUREAU VERITAS performed a preliminary study to determine to what extent the ECCAIRS databasecontainsaccuratedatasothatwecoulduseitintheframeworkofourstudy. TheassessmentofECCAIRShadtodetermineif: TheECCAIRSdatabaseisfullyimplemented TheECCAIRSdatabaseiseasilyaccessible Alistofincidents/accidentsrelatedtodocumentationmaybeproducedfromthisdatabase The ECCAIRS data are complete enough to bring out statistical figures upon incidents/accidents relatedto maintenancedocumentation BUREAUVERITASmaybeauthorizedtoaccess(directlyorindirectly)totheECCAIRSdatabase.
In order to carry out this assessment, BUREAU VERITAS contactedmembers ofthe ECCAIRS steering committee,askingfordetailsabouttheECCAIRSdatabase. WereceiveanswersfromarepresentativeoftheECCAIRSsteeringcommittee,whoisalsoamemberof theFrenchBureaudEnquteetdAnalysepourlascuritdelaviationcivile(BEA). Thesummationofourquestionsandassociatedanswersisthefollowing: IstheECCAIRSdatabasefullyimplementedthroughoutEurope?
AsECCAIRSissoftwareimplementingadatabase,itisanotreallyacentraldatabase.Inpractice,each Agency/StateoftheEuropeanUnion(EU)hasindividualinstallationsofECCAIRS,eachusingthetoolto maintain its own set of data while, on request, exchanging data with other ECCAIRS users. ThelistoforganisationsusingECCAIRSisavailableon:http://eccairswww.jrc.it/InTheField/Default.htm In addition, the European Union is in a startup phase for an integrated occurrence database under European Directive 2003/42/EC on occurrence reporting in civil aviation, but this central repository for occurrence data, although operational from a technical point of view, is not fully operational (as the requiredinputfrommanyStatesoftheEUhasnotyetbeenprovided). Isiteasilyaccessible?
AccesstothecentralrepositoryissubjecttotheRegulationondisseminationwhichhasnotyettheforceof law.Thus,evenifthereisdataathand,nolegalwayallowsaccessingitforthemoment.
11/93
FINALREPORT
May the ECCAIRS database produce a list of detailed incidents/accidents related to documentation? Is it complete / accurate enough to bring out statistical figures upon incidents/accidentsrelatedtoan"improper"useofthedocumentationthroughoutEurope?
The issue of jobcards does not form part of the taxonomy. Issues related to documentation can be captured, but it would seem there are not very many reports which have this information in terms of accidents/seriousincidents. At national level, in terms of accidents/serious incidents, BEA is maintaining an ECCAIRS database for France. Some results based on a specific query are provided as an attachment (See Annex A: OccurrencesrecordedbytheBEArelatingtomaintenancedocumentation). In terms of reports on occurrences according to the European Directive 2003/42/EC 2003/42, the EuropeanCommissionhasnotyetprovidedalegalbaseforsuchaccess. As an aside, the ADREP 2000 taxonomy which is implemented in ECCAIRS is currently under review maintenanceisanareathatshouldbebettercoveredinthenextrevision. MaytheECCAIRSdatabasebeaccessedbyBUREAUVERITASwithrequiredauthorizations?
ECCAIRS is the name given to the current suite of software applications that can be used by aviation authorities, accidentinvestigation bureaus and ANS providers to collect, exchange and analyse accident andincidentinformation.ECCAIRSisalsousedbyInternationalorganisationssuchasICAOandEASA. The European Commission believes that under certain conditions, and in the interest of aviation safety, usagebyoperators/serviceproviderscanbeallowed.
Conclusions
Asstatedabove: TheECCAIRSdatabaseisnotfullyoperational(astherequiredinputfrommanyStatesoftheEU hasnotyetbeenprovided). Issue of jobcards does not form part of the taxonomy. Issues related to documentation can be captured,butfewreportsseemtohavethisinformationintermsofaccidents/seriousincidents. We concluded that the ECCAIRS database contains no accurate data which may be used to bring out statistics,anddetailedreportsonincidentsoraccidentsrelatedtomaintenancedocumentation. The ECCAIRS assessment reveals that the ECCAIRS database cannot produce a list of incidents or accidents related to an improper use of maintenance documentation by selecting appropriate data. Furthermore,theECCAIRSdatabaseisnotfullyoperational,becauseofalackofinputfrommanyStates oftheEU.Nostatisticalfigures,whereincidentsoraccidentsarerelatedtomaintenancedocumentation, can be brought out from this database. This assessment confirmed us in our position that we had to exploreotheravailablesources.Thisexplorationispresentedhereafter. Furthermore, when analysing the results of the specific query made by the BEA concerning nine occurrences (accidents or incidents) related to maintenance documentation, we noted that only two occurrences were linked to the publictransport, among which only one occurred since the publication of the relevant European legislation in the matter of maintenance organisation approvals (at the end of November2003). The two maintenancerelated occurrences recorded by the BEA and linked to the public transport, are presented as an annex to the present document (See Annex A: Occurrences recorded by the BEA relatingtomaintenancedocumentation). TheanalysisoftheincidentofaircraftAirbusA340,registrationFGTUB,atReunionIsland,intheIndian Ocean, on 19 April 2002 is presented in Annex C: Incident of aircraft A340, registration FGTUB, on 19/04/2002. The serious incident of aircraft ATR 42300, registration EIBYO, en route to Cork Airport, on 5 August 2005, is described and analysed with other events selected from other sources (See Annex D: List of incidents/accidentsrelatedtomaintenancedocumentation).
12/93
FINALREPORT
2. .2 2 An na al ly ys si is so of fi in nc ci id de en nt ts s/ /a ac cc ci id de en nt ts sr re ep po or rt ts sa an nd ds st ta at ti is st ti ic cs s 2 A
The first part of the study consisted in listing and analysing incidents and accidents related to an improperuseofmaintenancedocumentation. Maintenancedocumentationincludes,butisnotlimitedto: AircraftMaintenanceProgram(AMP) AirworthinessDirectives(AD) AircraftMaintenanceManual(AMM) IllustratedPartsCatalog(IPC) WiringDiagramManual(WDM) TroubleShootingManual(TSM) MinimumEquipmentList(MMEL)/ConfigurationDeviationList(CDL) FlightCrewOperatingManual(FCOM) AircraftFlightManual(AFM).
Improperuseofmaintenancedocumentationmeansoneormoreofthefollowing: Nouseofdocumentation Lateuseofdocumentation Partialuseofdocumentation Misreadingofdocumentation Norespectofdocumentationcontent Useofincorrectdocumentation.
Incorrectdocumentationrefersto: Missingdocumentation Latedocumentation Obsoletedocumentation Incompletedocumentation Ambiguousdocumentation Erroneousdocumentation Complexdocumentation Inadequatedocumentation.
On the one hand, the relevant European legislation in the matter ofmaintenance organisation approvals (RegulationNo2042/2003)waspublishedattheendofNovember2003.Thisnewregulationrequiresthe developmentofasafetyculture,andincludesthehumanfactorconcernderivedfrompaststudiesofmain contributingfactorstoincidentsoraccidents,thusamendingthepreviouslegislation(JAR145)asregards themainhumanfactorsissues.BUREAUVERITASdecidedtotakeintoaccountthoseimprovements,not turningourattentiononpasteventsthatoccurredunderthepreviousregulation. On the other hand, approved maintenance organisations are regularly audited by National Aviation Authorities (NAA) to assess their compliance with the current regulation. Then, taking for granted that maintenanceactivitiesaremostoftenperformedinaccordancewiththerelevantlegislation,wetriedtofind occurrences showing whether those maintenance activities, when performed in accordance with the relevantlegislation,maycontributetoincidents/accidents.Morespecifically,wetriedtofindaccidentsor incidentsbringingintoplaytheapproved maintenancedocumentationunderthecurrentregulation.
13/93
FINALREPORT
For those reasons, we focused our search on events which occurred under the new regulation (since January2004)tofindevidenceofgapsinthisregulation. Furthermore,accordingtotheTermsofReferencesoftheinvitationtotender(Basedontheconclusions ofthereport,EASAshouldbeinapositiontoevaluatetherisksoftheuseofdocumentationaccordingto thecurrentpracticesthroughoutEuropeandassessthedecisionstobetaken.),wefocusedoursearchon occurrencesbringingintoplayeitherEuropeanoperatorsorEuropeanmaintenanceorganisations.
SelectionofEASAreports
Further to our ECCAIRS assessment results, the Agency proposed to ease our search of data from the ECCAIRSdatabase: 1CollectingallrelevantdataintheECCAIRSdatabase(SafetyAnalysis). 2CollectingallSafetyRecommendationsrelatedtothesubjectandtheirreports(AccidentInvestigation). 3 3ProvidinguswithadatapackageontheCIRCA website. EASA gave BUREAU VERITAS an access to its Aviation Investigation directory on the CIRCA website whichisaCommunication&InformationResourceCentreAdministrator. We analysed the six occurrences related to Safety Recommendations in the matter of maintenance documentation,putatourdisposalbyEASAontheCIRCAwebsite.Wenotedthatfouroccurrenceswere linked to the public transport, among which only two occurred since the publication of the relevant Europeanlegislationinthematterofmaintenanceorganisationapprovals(attheendofNovember2003). Thus,weretainthefollowingaccidentsthatwedescribeandanalysewithothereventsselectedfromother sources(SeeAnnexD:Listofincidents/accidentsrelatedtomaintenancedocumentation): AccidentofaircraftATR42320,registrationOYJRJ,atBergenAirport,on31January2005 Accident of aircraft Fairey BN2A Mark III2 Trislander, registration GBEVT, at Guernsey Airport, on23July2004. AccordingtotheAgencysrequest,wealsoanalysedtheaccidentofaircraftAirbusA330243,registration CGITS, at Lajes Airport, TerceiraIslands in theAzores, on 24 August 2001 (See Annex B: Incident of aircraft A330, registration CGITS, on 24/08/2001), together with the incident aircraft Airbus A340, registrationFGTUB,atReunionIsland,intheIndianOcean,on19April2002(SeeAnnexC:Incidentof aircraftA340,registrationFGTUB,on19/04/2002).
SelectionofEuropeanAIBreports
WealsosearchedreportsinreportingsystemsofthefollowingAccidentInvestigationBoards(AIB),asthey publishseveralreportsinEnglishorinFrenchversion:
3
STATE: Denmark CzechRepublic France Finland Germany Ireland Netherlands Norway Sweden UnitedKingdom
AIBWEBSITE: http://www.havarikommissionen.dk http://www.uzpln.cz/ http://www.bea.aero http://www.onnettomuustutkinta.fi http://www.bfuweb.de http://www.aaiu.ie http://www.safetyboard.nl http://www.aibn.no http://www.havkom.se/indexeng.html http://www.aaib.gov.uk/
Communication&InformationResourceCentreAdministrator 14/93
FINALREPORT
WescannedthoseEuropeanAccidentInvestigationBoardswebsites,usingtheavailableselectionoptions tofilterinoccurrencesrelatedtothepublictransportandtomaintenance,asavailable.Somewebsitesdo notoffersuchpossibilitiesofselection,sothatwehadtoacquaintourselveswithsomereportsbeforewe couldconsideriftheywererelevantornotforourstudy. Thus, we read around two hundred available reports written in English or in French and relating to accidentsorincidentsthatoccurredinEuropeoverthelastfouryears,from2004untilnow. Wefound121occurrenceswhichtookplaceinEuropefrom2004until2006andwhichconcernthepublic transport. We selected 14 events related to maintenance documentation and bringing into play either EuropeanoperatorsorEuropeanmaintenanceorganisations.Theselectedevents(addingtwoeventswe selected for year 2007) are listed and analysed in Annex D: List of incidents/accidents related to maintenancedocumentation. WeoutlinetheresultsofourselectionsfromAIBwebsites(excludingthetwoeventsforyear2007)inthe followingtable,asaroughindication(Cf.Table1:Roughdataresultingfromtheselectiontask). Table 1:Roughdataresultingfromtheselectiontask Year Numberofreports Numberofevents relatedtothepublic relatedtomaintenance transportinEurope documentation 2004 2005 2006 TOTAL 45 37 39 121 7 4 3 14
Rateofeventsrelatedto maintenance documentation 15.6% 10.8% 7.7% 11.6%
This shows a trend towards decrease in incidents or accidents related to maintenance documentation throughout Europe. We searched reliable data to confirm or deny this result. BUREAU VERITAS made search of statistic data from sources available on the Internet and on other relevant media (CD, paper, etc.):existingstatisticalreports,publicorprivatedatabases,withoutsuccess. Themainreasonsofthissetbackarethefollowing: As the publication of the relevant European legislation in the matter of maintenance organisation approvalsis quite recent, notangible results of its implementation already exist as regards the safety concern. TheEuropeancentralrepositoryforoccurrencedataisnotfullyoperational(astherequiredinputfrom manyStatesoftheEUhasnotyetbeenprovided). WhenwesearchedothernonEuropeanstatisticalreportsshowingthepresentstateofaffairsinmatterof incidentsoraccidentsrelatedtomaintenancedocumentationthroughouttheworld,wefoundnoevidence corroboratingatrendtowardsdecreaseinoccurrencesrelatedtomaintenanceactivitiesordocumentation, asstudiesdonottakeintoaccountthecontributingfactorslinkedtothemaintenancedocumentation.
Conclusions
Firstly,astheobjectiveoftheEuropeancentralreportrepositoryECCAIRSistointegrateinformationfrom aviation occurrence reporting systems running in the different EU member states, a complete implementationoftheECCAIRSdatabasethroughout Europe(includingthenewADREP2000taxonomy whichisintendedtobetterhandlethemaintenancearea) wouldbeprobablythebestmeanstobringout statistic figures on accidents/incidents related to maintenance documentation. Thus, it would help to measure the real progress brought by the regulation inforce,concerning safetyinmaintenance activities throughoutEurope. ThatisthereasonwhyEASAmemberstatesshouldbeencouragedtooperatefullytheECCAIRSsystem, takingastepbeyondexistinglegal,proceduralorculturalproblems.
15/93
FINALREPORT
4 ThecurrentICAOADREP2000taxonomydated12January2006 containsthoroughreferencestohuman 5 factorsdetailed accordingto the SHELmodel of ICAO: see the topic Events of the ADREP taxonomy, sectionSequenceofEvents,entryExplanatoryfactorsubject(Id:392),proposingapredefinedvaluelist 6 of human factors . Moreover, the ADREP taxonomy is under revision, and should take into account the maintenancearea.Inthiscontext,BUREAUVERITASexpressesasingleremark:
In the topic Aircraft of the ADREP taxonomy, the section Aircraft Status contains an entry to describethestatusoftheMaintenancedocuments,i.e.uptodateornot(Id:174).Thisentryproposes thefollowingpredefinedvaluelist: Current(Themaintenancedocumentswereuptodate.) 1 Notcurrent(Themaintenancedocumentswerenotuptodate.) Other(Somemaintenancedocumentswereuptodateotherswerenot.) Unknown(Whetherthemaintenancedocumentswerecurrentisunknown.) 2 98 99
Our remark is that two other entries should be added to describe the status of the Manufacturers documents, as well as the status of Operators documents that refers to national rules, operational conditions,etc. Secondly, the result of our analysis of occurrences (incidents or accidents), related to maintenance documentationandbringingintoplayeitherEuropeanoperatorsorEuropeanmaintenanceorganisations, shows an origin upstream of the maintenance workshop (See Annex D: List of incidents/accidents relatedtomaintenancedocumentation). Our selection resulted in 16 events where the maintenance activities have been recognised as a contributingfactororadirectcauseofanincidentoraccident.Butadeeperanalysisofthoseoccurrences shows clearly that the quality ofthe manufacturers documentation isin question. Not saying that it took systematically a direct part in the scenario of the event, but that a better quality of the manufacturers documentationmayhavehelpedtopreventthehappeningoftheevent. This result is reinforced by the analysis of the two accidents noticed by the Agency (See Annex B: Incident of aircraft A330, registration CGITS, on 24/08/2001, Annex C: Incident of aircraft A340, registration FGTUB, on 19/04/2002, Annex D: List of incidents/accidents related to maintenance documentation). Based on the study of incidents/accidents reports, there are no tangible results showing that Regulation 2042/2003(includingPartMContinuingAirworthiness,Part66CertifyingStaff,Part145Maintenance OrganisationApprovals,andPart147TrainingOrganisationRequirements)shouldberevisedintheaim ofreducingthenumberofaccidentsorincidentsrelatedtomaintenancedocumentation.
4 5
Seehttp://www.icao.int/anb/aig/Taxonomy/R4LDICAO.pdf
SoftwareHardwareEnvironmentLiveware This model outlines that Human Factors deal with the relations between INDIVIDUAL (Liveware) and DATA (Software),MATERIALS(Hardware),ENVIRONMENTandtheotherINDIVIDUALS.
6
Seehttp://www.icao.int/anb/aig/Taxonomy/R4CDExplanatoryFactors.pdf 16/93
FINALREPORT
3 A N A L Y S I SO FC O M M O NP R A C T I C E S A N A L Y S I O C O M M O P R A C T I C E
3. .1 1 Ou ur rm me et th ho od do ol lo og gy y 3 O
The second part of the study consisted in collecting and analysing common maintenance practices and rules which are actually in place in the European industry. The objective was to provide a good understanding of common practices and inherent difficulties between the operators and the maintenance organisations,includingsomestatisticaldataaboutthecontractandaboutfinancialpenalties. Asstatisticaldatawereexpectedasaresultofthestudy,theneedtogetintouchwithalargenumberof EuropeanoperatorsandmaintenanceorganisationsledBUREAUVERITAStoconductasurveytocollect datathatarenecessarytobringoutstatisticsfromarepresentativecrosssection. BUREAU VERITAS constituted a working group of internal fulltime or partialtime experts working in aeronauticalmaintenance,airworthinesscertification,quality,aircraftoperations...withathoroughpractice of the ground (airline pilots, aircraft mechanics, Part66 engineers, Part145 quality auditors and human factors trainers...). Those experts were got together for several meetings (brainstorming) to identify relevant questions and write questionnaires, in accordance with the expectations of EASA. Our main concernwastodrawoutquestionnaireseasilyandquicklyunderstandabletogetaccurateanswers,forthe purpose of collecting relevant items ofmaintenance contract,maintenance procedures and maintenance working rules/habits, addressing each aspect of the contracted maintenance in terms of communication, control,cost,delay,documents,monitoring,performance,planning,responsibility,training,technicalskills, andworks,forbothparties(i.e.operatorsandmaintenanceorganisations). BUREAUVERITAScreatedtwoquestionnairestogetvaluabledataaboutcommonpracticesandcurrent rules in place between AOC holders (operators), continuing airworthiness maintenance organisations (CAMO) and maintenance repair & overhaul stations (MRO),in theframework of maintenance sourcing. One questionnaire was dedicated to the operators and the other one was dedicated to the Part145 organisations. It is a fact that, when reading the Specifications attached to the Invitation to Tender No. EASA/2006/OP/25,theresultsexpectedovertakewidelythetitleofthestudy.Nevertheless,asEASAtitled itssupportletterwiththetitleofthestudy,wetitledourquestionnairesinthesameway. BUREAUVERITASgatheredcontacts,fromfeepayingdatabases,andotherofourfavouredcontacts.We sentour questionnairesto140operators andanotheroneto 46MROthroughout26Europeancountries (EASAmembers),independentlyoftheirfleetsizeornumberofstaff.Wepresentedourquestionnairesas an opportunity to get dataintouch with the industrialreality, which required individual answers.We also ensuredthatallanswers wouldremainconfidential sothattheaddressees wouldfeelfreetoanswerour questions. Depending on the results of the consultation, some further information might be necessary. Thus, we asked the addressees to indicateif they were allowing us to ask themforfurther questions by tickingaboxandprovidinguswithsomecontactdetails.Evenifthesecontactdetailsweretobefilledinas part of the questionnaires, according tothe will ofthe addressees, BUREAU VERITAS decidedfrom the beginning not to communicate these detailed data to the Agency, as we had undertaken solemnly to ensureconfidentiality. WesendourquestionnaireswithanEASAaccreditationletteronMarch2007.Wethenpostedareminder onApril2007.Asaresult,andinspiteoftheaccreditationletterthatweenclosedtoeachofourmailand recalls,fewoperatorsandmaintenanceorganisationsfilledandsentbacktheirquestionnaire. Themainreasonswhywereceivedfewrepliesare: The reluctance on the part of the industry to undergo changes in their practices and rules, as EASAinformedusduringthekickoffmeetinginCologneonFebruary2007 Theexcessivenumberofquestions(about40)weaskedinthesefirstquestionnairesonbehalfof EASA Alackofunderstandingabouttherelationbetweentheaskedquestionsandthetitleofthestudy Some questionnaires never reached the relevant addressees, due to a lack of accurate, direct contact.
17/93
FINALREPORT
Forthosereasons,BUREAUVERITASdecidedtocreatetwosimplifiedquestionnairesthatpresentclearly the four options of the Rulemaking Task n145.020 and briefly ask the operators and the maintenance organisations direct questions about their opinion about these options. These new questionnaires were shorter. We limited the number of questions (10 questions for maintenance organisations and only 8 questions for operators), as a result of which statistical data about the contract and especially about financialpenaltiescanbebroughtoutfromthesequestionnairesaswesuppressedtherelatedquestions. BUREAUVERITASalsotookbenefitoftheParisAirShow(SalonLeBourget)totakemoreaccurateand directcontactsnearoperatorsandmaintenanceorganisation. WesendoursimplifiedquestionnaireswiththeEASAaccreditationletteronendofJune2007.Wenoticed less reluctance on the part of the industry to answer these new questionnaires, getting rapidly answers from some other operators and MROs, in a quite short time following the sending. Nonetheless, we receivednomoreanswers,inspiteofrecallactionswithasimplifiedaccreditationletterprovidedbyEASA. Withthisnewsupportletter,theaddresseesweresupposedtobetterunderstandthenatureofthesurvey thatBUREAUVERITASconductedonbehalfoftheAgency. BUREAU VERITAS made some visits on the premises of European operators and MROs to get further information,accessundiscloseddata,andenhancecomprehensionoftheiranswerstothequestionnaires. WeplanedthesevisitsfrommidAugustuntilthebeginningofOctober,accordingtotheavailabilityofthe representativesofeachorganisation. As a result, we received answers from 15 operators out of 140 contacted operators and from 9 maintenance organisations (MRO) out of 46 contacted MRO. That corresponds to return rates of 10.7 percentforoperatorsand19.6percentformaintenanceorganisations. Thefollowingtablesshowsthedistributionofthe15Europeanoperatorsand9maintenanceorganisations whoansweredourquestions,accordingtotheclassificationschosenbyBUREAUVERITASinordertoget the largest point of view about common practices between the operators and the maintenance organisations(SeeTable2:Distributionofthe15Europeanoperatorswhoansweredourquestions andTable3:Distributionofthe9EuropeanMROwhoansweredourquestions.) Table 2:Distributionofthe15Europeanoperatorswhoansweredourquestions Fleetsize OperatorsnotPart145 OperatorsnotPart145 approvedforbase approved maintenance <10aircrafts <60aircrafts >60aircrafts 2operators 1operator 1operator 2operators 5operators 1operator
OperatorsPart145 approvedwithexternal overhaulcontracts 1operator 1operator 1operator
Table 3: Distributionofthe9 EuropeanMROs whoansweredourquestions Staffsize MROsnotconnectedtoan MROsconnectedtoanoperator havingoverhaulcontractswith operator otherEuropeanoperators <200people Between200and1000people >1000people 2maintenanceorganisations 1maintenanceorganisation 1maintenanceorganisation 3maintenanceorganisations Nil 2maintenanceorganisations
18/93
FINALREPORT
3. .2 2 Th he er re es su ul lt ts s 3 T
Thanks to our questionnaires and visits on premises, BUREAU VERITAS collected valuable data about common practices and current rules in place throughout Europe between the different stakeholders of maintenance sourcing: AOC holders (operators), continuing airworthiness maintenance organisations (CAMO)andmaintenancerepair&overhaulstations(MRO). Weidentifiedthefollowingscenariosbetweenthestakeholders,intheframeworkofmaintenancesourcing: TheMROisconnectedtoorsubsidiaryofanoperator(calledhereafterassociatedoperator): o TheMROprovideshisassociatedoperatorwithafullintegratedservice(activitiesrelated to PartM and Part145 regulations): the MRO uses the approved documentation of the operator o TheMROprovidesotheroperatorswithafullintegratedservice(activitiesrelatedtoPart MandPart145regulations):theMROusestheapproveddocumentationofitsassociated operator o TheMROprovidesotheroperatorswithaturnkeyservice(activitiesrelatedtothePart145 regulation): the operator provides the MRO with the Aircraft Maintenance Manual and a work order (i.e. a list of scheduled maintenance tasks, referring to the AMM). The MRO transcribes the customer's aircraft maintenance programme onto its maintenance managementsystem,andusesitsowndocuments(headedwiththeMRO'slogo) o TheMROprovidesotheroperatorswithaliaisonengineeringservice(activitiesrelatedto the Part145 regulation): the MRO appends one or more coversheets to the customers documents (because the customer asks the MRO for "dirty fingers" on the provided documentation) TheMROisindependent(i.e.neitherconnectedtonorsubsidiaryofanoperator): o The MRO provides the operator with a turnkey service (activities related to the Part145 regulation): the operator provides the MRO with the Aircraft Maintenance Manual and a work order (i.e. a list of scheduled maintenance tasks, referring to the AMM). The MRO appendsoneormorecoversheetstothecustomersdocuments o TheMROprovidestheoperatorwithaliaisonengineeringservice(activitiesrelatedtothe Part145 regulation): the operator provides the MRO with a Job Cards Manual (copied fromthemanufacturer'staskcards).TheMROappendsone ormorecoversheetstothe customersdocuments o Fornonroutine/outofphaseinspectionsandmodifications,theoperatorprovidesthejob cards.Forallroutinetasks,theMRO'sjobcardsareused(whentheMROownsajobcard system,otherwisethemanufacturer'sjobcardsareused) Caseofengineoverhaul: o The MRO provides the operator with a turnkey service (activities related to the Part145 regulation):theoperatorprovidestheMROwithalistoftasks.TheMROusestheEngine ShopManual Caseoflinemaintenance: o TheoperatorprovidestheMROwithjobcards.TheMROstaffistrainedbytheoperator. Contractsbetweentheoperatorsandthemaintenanceorganisationsarenotavailableforcommercialand competition reasons. Nonetheless, during discussions we had with operators and maintenance organisations,wenoticedthat: Somecontractsrequireadeliveryofthemainpackageatleastsixweeksbeforethebeginningof theworks Somecontractsrequiretheprovision,attheendofthejob,ofadocumentwhichlistssignaturesof peoplewhoperformedthetasks(toenablethecontrolofthecorrectcompletionofthetasks).
19/93
FINALREPORT
AboutthemomentwhenthedocumentationisgiventotheMRO,wenoticedthat: Inmostcases,themainpackageisdeliveredatleasttwoweeksbeforethebeginningoftheworks: uptosixweeksforanheavycheck(formerly"Ccheck"),andeightmonthsfortheheaviestcheck (formerly"Dcheck") Veryrarely(noslotavailable,orchangeintheschedule),theworkpackageisdeliveredlate Fewlowcostairlinesdosomeshopping:theydiscussthepriceswithdifferentcompetitorsuntilthe beginningofthejob.Inthatcase,jobcardsaredeliveredattheverylasttime.
Aboutthewayprovisionsontheuseofdocumentationareusuallycarriedout,BUREAUVERITASnoticed that,inmost cases, the operators presents its work package, and expectations on how to fillit, during a briefingwhichtakesplaceatleasttwoweeksbeforethebeginningoftheworks. Usual procedure to ensure correct completion of the aircraft operators work cards or worksheets, when providedbytheoperator,isthefollowing: TheMROappendsoneormorecoversheetstotheoperator'sworkcards.Thesecoversheetsare formattedaccordingtotheproceduresspecifiedintheMaintenanceOrganisationExposition.They contain the MRO's steering information, the accounting information and adding columns for signatures,stamps,etc.(Technicalpointsaretakenintoaccountviathejobcardswhileprocedural aspectsareaddressedbythecoversheet) AcopyoftheAircraftMaintenanceManualisattachedtothejobcard Anoperator'srepresentative(ahighdegreeengineer)stays ontheMROpremisesforthefollow upofthejob.
No provisions about the financial penalties or statistical data about aircraft leaving the hangar beyond scheduleareavailableforcommercialandcompetitionreasons.Nevertheless,someoperatorscomplains aboutthehardnessofthemarketleadingsomeMROstomakeupcausesofthelatedeliveryofanaircraft, pretendingthattheoperator'sresponsibilityisinvolvedwheretherealcauseisduetofindingsonanother aircraftorduetostaffshortageorpartsshortage. AboutthetechnicalhumanresourcesattheengineeringdepartmentforboththeoperatorandtheMRO,in chargeofthedocumentation,wecollectedthefollowingdata Some MROs have strong requirements as regards staff training and qualification, implementing systematicallyatrainingmoduleforsubcontractors ConcerningthetraininginEnglish,someMROspromotesthefollowingmeasures: o QualificationleveldependingontheproficiencyinEnglish o Trainingprogrammesupportedbyincentivebonuses o Use of a simplified technical English (to improve understanding and use of job cards writteninEnglish). AboutthedocumentationusuallyprovidedeitherbytheoperatororbytheMRO,wenoticedthat: The maintenance documentation provided by the MRO or by the operators is based on the manufacturer'smaintenancedocumentation:AMM,CMM,IPC,MEL,etc. TheoperatoroftentransmitstherevisedAircraftMaintenanceManualtotheMROonCD.MRO's engineersprintnecessarycopies TheMROproducestheextrataskscardsrelatedtothepreparationofthejob.
Other data we collected about actual practices throughout European contracted maintenance are the following: SomeactivitiesdedicatedtotheassociatedoperatorcontainsometaskssubcontractedtoaPart 145 organisation located outside the European Union. In that case, the MRO does not systematically control the contractor. The MRO relies on the contractor's Part145 approval. Nevertheless, the MRO selects people who are proficient in English. In some rare cases of uncertaintyaboutagivencontractor,theMROgoestoinvestigatehim
20/93
FINALREPORT
Occurrencesreportingis performedaccordinglytothePart145regulation.Mostofthemarenot givenananswerbythemanufacturer Engineersmostoftenworkwithpaperdocuments(papertasks) SomeMROsarepositioningthemselvesonthemarketofurgentchecks(differedbecauseofslot unavailabilitythelatterbeingoftenduetostaffshortage) MROsandoperatorsaresubjectedtodifferencesintermsofculturesandsupervisionauthorities. TheNAA'spointofviewisthefinalcontrol ManyMROshavenoaccesstothemanufacturer'smaintenancedata Many organisations notice that the number of aircraft increases while the number of available maintenanceengineersisdecreasing TheoperatorchoosesaMROwiththeadequateairframe/enginecapabilityforthedemandedlevel of check. Then, the MRO is considered as being competent to understand the operator's documentation(whichisoftenquitethesameasthemanufacturer'sdocumentation) When asked if they had noted eventsrelated to job cards, we were answered that the only rare incidentsrelatedtojobcardswereduetotheiruse(problemsofnegligence),independentlyoftheir contentororigin(noproblemofcomprehension) Somestatisticsoninternalerrors(drawnbyoperators)showthatproblemsrelatedtotheuseofjob cardsaredueto: o Complexity of the manufacturer's documentation (Aircraft Maintenance Manual). As an example, the change of wheel on landing gear corresponds to 70 pages in the AMM, amongwhichlegaltermsrepresentthegreatestpart o Complacency (the engineer does not refer tothe documentation because he deems that heknowsitoffbyheart) o Discrepancy in the handover process (no recording of the works done before a task interruption)
Labour shortage is more and more at stake, so that maintenance works are more frequently differed before being rescheduled in other slots. In these cases, the operators approved documentation is lately transmitted to the maintenance organisation. As a result, engineers are latelytrainedontheoperatorsdocumentsandhavelesstimetodigesttheirstructureandcontents beforethebeginningoftheworks.
Furthermore,BUREAUVERITASconsideredthatoperatorsandmaintenanceorganisationsopinionabout theoptionsexaminedbytheRulemakingTask145.020wasavaluableinputforourstudy,astheyarein touchwiththeindustrialreality.
21/93
FINALREPORT
Option1:Donothing
Thisoptionproposestokeepthesituationasitstands.Commonlytheoperatorprovidesmaintenancedata totheMRO,sometimesafewdaysbeforethemaintenanceperformance. TherawresultsofthesurveyaboutOption1oftheRulemakingTaskn145.20(i.e.keepthesituationasit stands)arepresentedinthefollowingtablebesidecorrectedresultsweobtainafterinterviews withsome operators and maintenance organisations (Cf. Table 4: Results of the survey about Option 1 of the RulemakingTaskn145.20). Table 4:ResultsofthesurveyaboutOption1oftheRulemakingTaskn145.20 Op pi in ni io on no of fo op pe er ra at to or rs sa an nd dm ma ai in nt te en na an nc ce eo or rg ga an ni is sa at ti io on ns s Rawresults O ab bo ou ut tO Op pt ti io on n1 1o of ft th he eR Ru ul le em ma ak ki in ng gT Ta as sk kn n 1 14 45 5. .2 20 0 a Agree Disagree (i i. .e e. .k ke ee ep pt th he es si it tu ua at ti io on na as si it ts st ta an nd ds s) ) ( 7 5 % 7 5 % 7 5 % OpinionofOperators 25% 7 5 % 7 5 % 7 5 % OpinionofMaintenanceOrganisations(MRO) 25% TOTAL 7 5 % 7 5 % 7 5 % 25%
Correctedresults Agree 8 0 % 8 0 % 8 0 % 8 6 % 8 6 % 8 6 % 8 2 % 8 2 % 8 2 % Disagree 20% 14% 18%
Most operators and maintenance organisations agree with this option because they have already implemented compromise solutions between different existing scenarios of work and the regulatory requirements. Some operators are opposed to this option because the current regulation contains the following gaps andshortcomings: Concerningthetaskcards: o Someissuesrelatedtotaskcardsarethefollowing: Colourcodingdisappearsinablackandwhitecopy Somemanufacturers'taskcardsarewritteninEnglishbypeoplewhoseEnglishis a foreign language. This leads to an ambiguous wording, meaningless phrases, etc. Taskcardsare partiallydecipheredandinterpreted,ratherthanentirelyreadand wellunderstood o Standardizationofthetaskcards(dependingoneachtypeofaircraft),andofprocedures onhowtofillthosetaskcardsin(using stampsor signatures),mayhelpoperators when controllingthecorrectcompletionofthetasks o Formatoftaskcards(dependingoneachtypeofaircraft),andofproceduresonhowtofill thosetaskcardsin(usingstampsorsignatures),shouldbestipulated o Differentformatswithdifferentcontentsaremanageable.Differentformatswiththesame content are acceptable. Same formats with same contents are beneficial. Same formats withdifferentcontentsaredangerous o As regards the content of task cards, numerous difficulties come from application of limitations by operators. Especially as concern definition and detection of defects, which maydifferfromanoperatortoanother,andbetweentheoperatorandtheMRO Concerningthetrainingconcern: o ItwouldbedesirablethattheMROistrainedinbothaircraftsystemsandmanufacturer's documentationin theframework of the corresponding aircraft qualification (this is not the 7 case since the manufacturer's documentation is only provided to aircraft owners ). This trainingshouldbecompletedwithatraininginSTCowner'sdocumentation
7
NotefromEASA:RegulationNo1702/2003AnnexPart21statesthatTheholderofthetypecertificateorrestricted typecertificate shall () make those instructions [for continued airworthiness, comprising descriptive data and accomplishmentinstructions]availableonrequesttoany()personrequiredtocomplywithanyofthetermsofthose instructions.21.A.61(a)Instructionsforcontinuedairworthiness. Onrequestshouldmeanforfree. 22/93
FINALREPORT
o Somelicensedengineers(Part66)feelbettereducated,anddevelopanexcessivefeeling ofselfconfidence(complacency),notconsultingnecessarydata o It is more and more difficult to find experienced licensed engineers (Part 66) on some giventypeofaircraft,inEurope Concerningthesupervisionconcern: o Asdifferentsupervisionauthoritiesdonotinterprettheregulatorytextinthesameway,all Europeanoperatorsarenotsubjectedtosameregulatoryconstraints.Itleadstoproblems ofunfaircompetition.Examplesofdiscrepanciesarethefollowing: authorisationorinterdictionoframpchecks,withouttheuseofahangar necessitytosigneachitemoronlyeachtask necessitytosigneachjobcardoronlythecoversheet etc.
Some maintenance organisations are opposed to this option because the current regulation contains thefollowinggapsandshortcomings: Concerningthetaskcards: o Standardizationofthetaskcards(dependingoneachtypeofaircraft),andofprocedures on how to fill those task cards in (using stamps or signatures), may help maintenance engineerstobetterunderstandhowtoperformthetasks o StandardizationofthetaskcardsshouldbethesameforoperatorsandMROsothatthose cardswouldbeeasilyusablewhoeverprovidethem o As no specific format exists to design work sheets and work cards, engineers have to manage different formats, which may bother them, thus increasing the number of errors duringpreparationoftheworks o Standardizationofthetaskcardswouldleadtothestandardizationoftheworkconstraints among all maintenance workshops, creating same conditions of competition for all (for example,samerateofworkpreparation) o Standardization of manufacturer's task cards may help creating homogeneity among operators'andauthorities'requirements.Manufacturers'taskcardsshouldindicate: Taskswhicharecriticalforthesafetyconcern MinimumPart66qualificationrequiredtoperform,control,ordeliveraCRSfor,a giventask Indication on the moment when the control should be performed (end of task, aircraftCRS,etc.) Etc. o Manufacturer'staskcardsshouldbewrittenusingasimplifiedtechnicalEnglish(toprevent errorsofunderstandingoroftranslation) o Manufacturer's documents should present legal terms and task cards separately (to simplifyandencouragetheiruse). Concerningthesupervisionconcern: o Asdifferentsupervisionauthoritiesdonotinterprettheregulatorytextinthesameway,all Europeanmaintenanceorganisationsarenot subjectedtosameregulatoryconstraints.It leadstoproblemsofunfaircompetition.Examplesofdiscrepanciesarethefollowing: Taskswhicharecriticalforthesafetyconcern MinimumPart66qualificationrequiredtoperform,control,ordeliveraCRSfor,a giventask Indication on the moment when the control should be performed (end of task, aircraftCRS,etc.) Etc. o It is quite easy to address discrepancies between Aviation Authorities. Itis more difficult whendiscrepanciesexistbetweenoperatorsunderthesameAuthority.
23/93
FINALREPORT
Option2:Operatorsjobcardsystem
ThisoptionproposesthattheoperatorprovidestheMROwithajobcardsystem.Theoperatorprepares maintenancedatathatmeetsthePart145requirements.Thecontractshouldreflectthisoption. TherawresultsofthesurveyaboutOption2oftheRulemakingTaskn145.20(i.e.theoperatorprovides the MRO with ajob card system) are presented in thefollowing table beside corrected results we obtain afterinterviewswithsomeoperatorsandmaintenanceorganisations(Cf.Table5:Resultsofthesurvey about Option 2 of the Rulemaking Task n 145.20). While opinion of MROs seemed to be equally divided between agreement and disagreement when we analysed the answers to our questionnaires, interviewsinthefieldrevealedthatsomemaintenanceorganisationshadmisunderstoodthisoption.Infact mostmaintenanceorganisationswereagainstthisoption. Table 5: ResultsofthesurveyaboutOption2oftheRulemakingTaskn145.20 Op pi in ni io on no of fo op pe er ra at to or rs sa an nd dM MR RO Oa ab bo ou ut tO Op pt ti io on n2 2o of ft th he e Rawresults O Ru ul le em ma ak ki in ng gT Ta as sk kn n 1 14 45 5. .2 20 0( (i i. .e e. .t th he eo op pe er ra at to or rp pr ro ov vi id de es s R Agree Disagree th he eM MR RO Ow wi it th ha aj jo ob bc ca ar rd ds sy ys st te em m) ) t 7 5 % 7 5 % 7 5 % OpinionofOperators 25% 5 0 % 5 0 % 5 0 5 0 % 5 0 % 5 0 % OpinionofMaintenanceOrganisations(MRO) TOTAL 6 7 % 6 7 % 6 7 % 23% Correctedresults Agree 7 0 % 7 0 % 7 0 % 29% 5 3 % 5 3 % 5 3 % Disagree 30% 7 1 % 7 1 7 1 % 42%
Mostoperatorsagreewiththisoptionbecausetheoperatorisresponsibleforcontinuousairworthinessof itsaircraft,whichincludesdeliveryofworkordersformaintenanceactivities.Sohemustprovideajobcard system. Otheroperatorsareopposedtothisoption,duetothefollowingissues: Thisoptionisincompatiblewiththepossibilitygiventotheoperatortosubcontractthecontinuous 8 airworthinessmanagementofitsaircraft If the MRO's job card system is compatible with the operator's requirements, then it should be possibletousetheMRO'sjobcardsystem. Considering this option (the operator provides the MRO with a job card system), operators raised the followingissues: The person who is in charge of the AMP needs to be familiar with maintenance processes and procedures.Theoperatordoesnotalwayshavetheexperienceneededtocreatethejobcardsfor examplebasemaintenanceorevennonroutinecards TheoperatordoesnotalwaysfeelenoughcompetenttotraintheMROonitsjobcardssystem(i.e. onthemanufacturer'sjobcardssystem) Anyway,thePartMorganisation(generallytheoperator)hasthepossibilitytocheckandconfirm that all the tasks applicable and due are performed in accordance with the Aircraft Maintenance Program(AMP),evenifthejobcardsarepreparedbytheMRO. SomeMROsagreewiththisoptionbecause,inspiteofmanyrecordandworkcardsystems,aslongas workcardscontainthesamedataandareproducedinastandardisedformat,engineershavenodifficulty inusingdifferentsystems. MostMROsareopposedtothisoption,duetothefollowingissues: The person who is in charge of the AMP needs to be familiar with maintenance processes and procedures.Theoperatordoesnotalwayshavetheexperienceneededtocreatethejobcardsfor examplebasemaintenanceorevennonroutinecards The operator does not have the experience needed to adapt the manufacturer's task cards in accordance with maintenance processes and procedures (specifying who performs the job, who controlsthejob,whoreleasesthejob,etc.) Forlogisticalandplanningpurposes,someMROprefertohavetheirownjobcardssystem(ERP). Fromthegenerationoftheworkpackageintheacquisitionphase ofthecontract,theproduction
Note from EASA: the regulation allows operators to subcontract some activities of the continuous airworthiness managementofanaircraftonlyundertheoperatorsqualitysystems.Fullcontrolandactiveinvolvementisrequiredby theCommercialAirTransportoperator. 24/93
FINALREPORT
documentationcanbeputtogetherinaccordancewiththeworkorderofthecustomer Operator's job card system may not be suitable for processes (e.g. production control) in maintenanceorganisationsandmayaswellnotsuitMRO'squalificationstructure Some operators don't have base maintenance job cards because they never do the base maintenancebythemselves The operator does not have the knowledge needed to create the job cards that fit into the maintenanceorganisation The operator does not always have the experience needed to create the job cards for example basemaintenanceorevennonroutinecards.
Option3:MROsjobcardsystem
ThisoptionproposesthattheMROusesonlyitsinternaljobcardsystem.Theoperatorshouldusethejob cardscomingfromtheMRO.Thosejobcardsshouldreflectthecurrentstatusoftheaircraft.Thecontract shouldreflectthisoption. TherawresultsofthesurveyaboutOption3oftheRulemakingTaskn145.20(i.e.theoperatorshould usethejobcardscomingfromtheMRO)arepresentedinthefollowingtablebesidecorrectedresultswe obtain afterinterviews with some operators and maintenance organisations(Cf.Table 6: Resultsof the surveyaboutOption3oftheRulemakingTaskn145.20). Table 6: ResultsofthesurveyaboutOption3oftheRulemakingTaskn145.20 Op pi in ni io on no of fo op pe er ra at to or rs sa an nd dM MR RO Oa ab bo ou ut tO Op pt ti io on n3 3o of ft th he e Rawresults O Ru ul le em ma ak ki in ng gT Ta as sk kn n 1 14 45 5. .2 20 0( (i i. .e e. .t th he eo op pe er ra at to or rs sh ho ou ul ld d R Agree Disagree us se et th he ej jo ob bc ca ar rd ds sc co om mi in ng gf fr ro om mt th he eM MR RO O) ) u 1 0 0 % 1 0 0 % 1 0 0 % OpinionofOperators 0% OpinionofMaintenanceOrganisations(MRO) TOTAL 25% 9% 7 5 % 7 5 % 7 5 % 9 1 % 9 1 % 9 1 % Correctedresults Agree 0% 14% 6% Disagree 1 0 0 % 1 0 0 % 1 0 0 % 8 6 % 8 6 8 6 % 9 4 % 9 4 % 9 4 %
Alloperatorsareopposedtothisoption,duetothefollowingissues: ThisoptionrulesthattheoperatormakesthechoicetocontractitsPartMsubpartGactivitiesout 9 totheMRO.Thisisnotalwaysinkeepingwiththeoperator'sglobalstrategy Astheoperatorisresponsibleforcontinuousairworthinessofitsaircraft,heshouldretaincontrolof theuseddocumentation(especiallyincaseoflinemaintenance) Onlytheoperatorhasthefullknowledgeofthestatusoftheaircraft Using the same task cards, whatever the status of the aircraft can be, may lead to inattention (dangerofconfusion) The operator is responsiblefor the maintenance programme and is therefore responsible forthe content of each task. It is the responsibility of the MRO to carry out the tasks that the operator requires Astheoperatorisresponsiblefortherecords,holdingcompletedworkcardsofthesamelayoutis theeasiestoption,especiallywhenseveraldifferentMROsarecontracted FromthePartMregulationpointofview,theoperatorhastheresponsibilityoftheairworthinessof thefleetandshouldhavethefullmasteryofthedocumentationused Some operators use a combination of job cards: for nonroutine/outofphase inspections and modifications,theoperatorprovidesthejobcards.Forallroutinetasks,theMRO'sjobcardsare used(whentheMROownsajobcardsystem,otherwisethemanufacturer'sjobcardsareused) IftheMRO'sjobcardsystemisnotcompatiblewiththeoperator'srequirements,thenitshouldbe possibletousetheoperator'sjobcardsystem
NotefromEASA:Option3oftheRulemakingTaskn145.020isnotmeanttoallowtheoperatortocontractoutthe PartMsubpartGactivitiesbecausetheoperatorhasalwaysthefinalresponsibilitytocheckthatjobcardspreparedby themaintenanceorganisationMROcoverstheAircraftMaintenanceProgramme(AMP).(Sameaspreviousfootnote.) 25/93
FINALREPORT
Sometasksmayresultoutfromreliabilityexperiences,whichistheresponsibilityoftheoperator.It istheoperatorwhoshouldcreatecardsforthesekindoftasks ThisoptionwouldonlysuitiftheMROismanagingtheoperator'sfleetundercontract.TheMRO should then be responsible for ensuring that the maintenance package is complete, including all relevantmandatorytasksandinspections Thejobcardsshouldcomefromtheonewhotransmitstheworkorder(theoperator).
Consideringthisoption(theoperatorshouldusethejobcardscomingfromtheMRO),operatorsraisedthe followingissues: The operator needs maintenance data feedback in the paperwork system compatible with its recordssystem.TheoperatorshouldprovidetrainingtotheMROintheuseofhispaperwork IftheMROonlyprovideshisownpaperwork,thismayresultinsignificantextracostandpossibility oftranscriptionerrorintransferringtheinformationintotheoperator'srecordssystem.
MostMROsareopposedtothisoption,duetothefollowingissues: ThisoptionmayresultinsignificantextradelayswhilsttheMROproducesthetaskcards ThisoptionmayresultinsignificantextracostfortheMROwho wouldhavetopayanaccessto themanufacturer'sdocumentation ThisoptionmayresultinsignificantextracostandtimefortheMROwhenthemanufacturer'stask cards are not suitable for the MRO processes (e.g. production control) or the MRO qualification structureortheaircraftstatus Some operators introduce additional or changed tasks to the Maintenance Program content, to dealwithnationalrules,operationaltasks,localconditions,etc.whichmaynotbecontainedinthe MROsystem Someoperatorsinsistontheuse oftheirjobcards(sometimesforcedbytheirlegalsystem:e.g. FAA).MROsometimeshavetomakecrossreferencesfromtheirownjobcardstotheoperator's jobcardstosatisfythoserequests Theoperatorsareresponsibleforthecontentofthetaskcards.Thebasisforthetaskcardsisin most cases the MRB/MPD or an operator's request. Aim should be to use them everywhere to have a unified standardized task card system, for line and base maintenance activities (same layout).
Option4:Combinedjobcardsystem
This option proposes a difference be made between line and base maintenance. Base maintenance mandatestheMROsjobcardsystemandlinemaintenanceallowstheoperatorsjobcardsystem. TherawresultsofthesurveyaboutOption4oftheRulemakingTaskn145.20(i.e.adifferenceismade between line and base maintenance) are presented in the following table beside corrected results we obtain afterinterviews with some operators and maintenance organisations(Cf.Table 7: Resultsof the surveyaboutOption4oftheRulemakingTaskn145.20). Table 7: ResultsofthesurveyaboutOption4oftheRulemakingTaskn145.20 Op pi in ni io on no of fo op pe er ra at to or rs sa an nd dM MR RO Oa ab bo ou ut tO Op pt ti io on n4 4o of ft th he e Rawresults O Ru ul le em ma ak ki in ng gT Ta as sk kn n 1 14 45 5. .2 20 0( (i i. .e e. .a ad di if ff fe er re en nc ce ei is sm ma ad de e R Agree Disagree be et tw we ee en nl li in ne ea an nd db ba as se em ma ai in nt te en na an nc ce e) ) b 5 0 % 5 0 % 5 0 5 0 % 5 0 % 5 0 % OpinionofOperators 7 5 % 7 5 % 7 5 % OpinionofMaintenanceOrganisations(MRO) 25% TOTAL 42% 5 8 % 5 8 % 5 8 % Correctedresults Agree 40% 14% 29% Disagree 6 0 % 6 0 % 6 0 % 8 6 % 8 6 8 6 % 7 1 % 7 1 % 7 1 %
Someoperatorsagreewiththisoptionbecauseaclearsegregationbetweenbaseandlinemaintenance wouldbeachieved. Mostoperatorsareopposedtothisoption,duetothefollowingissues: ThisoptionshowssamedrawbacksthanOption3,asconcernsbasemaintenance
26/93
FINALREPORT
For line maintenance, the operator's technical log and individual work requests should be accomplished on the operator's paperwork system. For base maintenance, the option of using eithertheMRO'soroperator'sjobcardsshouldbepermitted(definedbycontract) Astheoperatorisresponsiblefortherecords,holdingcompletedworkcardsofthesamelayoutis theeasiestoption,especiallywhenseveraldifferentMROsarecontracted FromthePartMregulationpointofview,theoperatorhastheresponsibilityoftheairworthinessof thefleetandshouldhavethemasteryofthedocumentationused Thisislikelytoleadtoconfusionandpossibleerrors Keepingthesamelayoutforagivenprocedurewouldavoidincomprehension.
SomeMROsagreewiththisoptionbecauselineworkcardstendtobeusedbydedicatedlinestaff.Then, itisimportantthattheworkcardsfittheenvironment. MostMROsareopposedtothisoption,duetothefollowingissues: ThisoptionshowssamedrawbacksthanOption3,asconcernsbasemaintenance To have one system is better to prevent possible administrative deficiencies within the performance of MRO. Line maintenance is often registered in the Aircraft Technical Log book (ATL),sothiswillbenoproblematall Thisoptionisnotflexibleenough Thereshouldbenodifferencebetweenlineandbasemaintenancetaskcards.Inmostcases,the maintenance personnel perform tasks for both line and base maintenance. To reduce human errors,thearchitectureofbothtaskcardssystemsshouldbethesame.
3. .3 3 Co on nc cl lu us si io on ns s 3 C
None of the four options examined by the Rulemaking Task 145.020 fully satisfy the regulatory, organisational, economical constraints that operators and maintenance organisations are faced with. Nevertheless,asstakeholdershavealreadyimplementedcompromisesolutionsbetweendifferentexisting scenarios of work and the regulatory requirements, in the framework of their PartM and Part145 agreement,thebestoptionseemstobethefirstone:Keepthesituationasitstands.Nonetheless,this optionstatesthatnothingneedstobedonetoensureabettercontrolofthehumanfactorconcernwhen carryingoutmaintenance,whichisnotthecase. The study of common maintenance practices shows that Regulation 2042/2003 (including Part M ContinuingAirworthiness,Part66CertifyingStaff,Part145MaintenanceOrganisationApprovals,and Part 147 Training Organisation Requirements) should be revised in the aim of reducing the number of accidentsorincidentsrelatedtomaintenancedocumentation.Thisanalysisispresentedinnextparagraph (See4.DataAnalysis).
27/93
FINALREPORT
4 D A T AA N A L Y S I S D A T A N A L Y S I S
The third part of the requested study consisted of analyzing the collected data. The objective was to highlightthecriticalorweakpointsofscenariosthatmaycurrentlyexistthroughoutEurope. Analyzing the data we collected, BUREAU VERITAS identified six different scenarios that describe different relationships that exist between operators and maintenance organisations. The six scenarios synthesizethescenariosweidentifiedbetweenthestakeholdersintheframeworkofmaintenancesourcing (Seetopofparagraph3.2Theresults).Thosescenariosarepresentedinthefollowingtable(SeeTable 8:IdentifiedscenariosofrelationshipbetweenoperatorsandMROs). Table 8:IdentifiedscenariosofrelationshipbetweenoperatorsandMROs TheoperatorprovidestheMRO Theoperatordemandsthatthe Identifiedscenario withalistoftaskslinkedtothe MROusestheoperator'stask betweenoperatorsand AMM cards maintenance (Theoperatorhasnoengineering (Theoperatorhasan organisations department) engineeringdepartment) TheMROhasajobcard systemconnectedtothe operator (Theoperatorhasno engineeringdepartment) Scenario1:TheMROprintsthetask cardsfromtheoperator'sAMM byusingtherelatedjobcardsystem
N/A
Scenario2:TheMROprintsthetask cardsfromtheconnectedoperator's TheMROisconnectedto AMM anoperator(witharelated byusingtherelatedjobcardsystem jobcardsystem)andis contractedbyanother Scenario3:TheMROprintsthetask operator cardsfromtheoperator'sAMM byusingitsownjobcardsystem TheMROhasan independentjobcard system TheMROhasnospecific jobcardsystem Scenario3:TheMROprintsthetask cardsfromtheoperator'sAMM byusingitsownjobcardsystem Scenario5:TheMROprintsthetask cardsfromtheoperator'sAMM
Scenario4:TheMROusesthe operator'staskcardsinaddition withitsownjobcardsystem
Scenario4:TheMROusesthe operator'staskcardsinaddition withitsownjobcardsystem Scenario6:TheMROusesthe operator'staskcards
Using the collected data, we assessed the risks linked to each of these six scenarios, together with the risks related to four options examined by the Rulemaking Task n 145.20. The results of the risk assessment,proposingsolutionstomitigatetherisks,areannexedtothepresentdocument(see Annex E:Riskassessment). AllofthefouroptionsexaminedbytheRulemakingTaskn145.20showsgapsandshortcomingswithout any effective positive impact on aviation safety. Risks exist for the different scenarios that describe the relationshipbetweentheoperatorsandthemaintenanceorganisations,nomatteriftheyreflecttheactual existingpractices(Scenarios1to6)orenvisagedfuturepractices(Options2,3and4oftheRulemaking Task). Nevertheless, concerning the four options considered by the Rulemaking Task, BUREAU VERITAS considers that, for economical, organisational and safety reasons, Options 2, 3 and 4 do not satisfy the Agencys objectiveto enhance aviation safetythroughout Europe. As concerns Option 1,it is acceptable ontheconditionthatthefollowingsolutionsareimplemented:
28/93
FINALREPORT
SolutionA:Standardizationofthetaskcardsandofproceduresonhowtofillthem,including: o Part145requirements o Specific tags to introduce operators specific tasks and requirements related to the status of theaircraftandtothelocalconditionsofoperation o SpecifictagstointroducespecifictasksandrequirementsrelatedtotheMROsprocessesand procedures.
Solution B: Standardization of the interpretation of the regulatory text that is allowed by the supervisionauthorities. SolutionC: Raisingconsciousnessonrisksrelatedtocomplacencyduringcontinuoushumanfactorstraining.
Thus,BUREAUVERITASbringsoutthefollowingrecommendations fromeachabovesolution: Recommendation1:Thejobcards(includingthemanufacturersjobcards) shouldbe standardized, asregardsthelayoutandtheprocedureonhowtofillthem.Thisstandardizationshould: o DescribethePart145requirements: Taskswhicharecriticalforthesafetyconcern Minimum Part66 qualification required to perform, control, or deliver a CRS for, a giventask Indicationonthemomentwhenthecontrolshouldbeperformed(endoftask,aircraft CRS,etc.) Etc.
o Contain specific tags to introduce operators specific tasks and requirements related to the statusoftheaircraftandtothelocalconditionsofoperation o Contain specific tags to introduce specific tasks and requirements related to the MROs processesandprocedures. o Be written using a simplified technical English (to prevent errors of understanding or of translation) o Presentlegaltermsandtaskcardsseparately(tosimplifyandencouragetheiruse). Recommendation 2: Explicit guidance should be given to standardize the interpretation of the regulatorytexts forallsupervisionauthorities.Thisstandardizationshould: o ClarifythePart145requirements: Taskswhicharecriticalforthesafetyconcern Minimum Part66 qualification required to perform, control, or deliver a CRS for, a giventask Indicationonthemomentwhenthecontrolshouldbeperformed(endoftask,aircraft CRS,etc.) Authorisationorinterdictionoframpchecks Necessitytosigneachitemoronlyeachtask Necessitytosigneachjobcardoronlythecoversheet Etc.
Recommendation 3: Consciousness on risks related to complacency should be better developed duringcontinuoushumanfactorstraining.
Recommendation3isalsoconnectedtothedatawecollectedinthefield.Infact,ourstudyrevealedthat twohumanfactorsstillcreatediscrepanciesbetweentheintendedactivitiesandtherealacts,intheuseof documentation.
29/93
FINALREPORT
Thesetwohumanfactorissuesarethefollowing: Complacency:documentationisnotconsultedbecauseitisconsideredasbeingwellknown. Absence of changeover / handover documentation: asthey are inherent to their activity, workers donotformalizeallmomentaryinterruptions.
Thesetwohumanfactorsarealreadyaddressedduringthecontinuoushumanfactorstraining,asrequired by the Human Factors Training Syllabus (document titled GUIDELINES OF SAFETY SYSTEM AND HUMAN FACTORS APPROACH FOR PART 145 MAINTENANCE ORGANISATIONS), in paragraph 7 Communication (7.1 Shift / Task handover) and paragraph 9 Professionalism and Integrity (9.2 Error provokingbehaviour). Specialattentionshouldbegiventothesetwosubjects,especiallyduringmandatoryrefreshingsessions. Otherresultsofourcollectionofdataarethefollowing: Time pressure is an aggravating factor for confusing tasks (unclear task cards, ambiguous instructions, etc.). Nonetheless, time pressure is an economical reality. It is due to numerous factorslikestaffshortage,orpartsshortage. Some operators and maintenance organisations complain for shortcomings as concern the manufacturersdocumentationquality: o The Part21 regulation does not address the whole human factor concern CS25 addressesonlythepilotingergonomics(flightdeckandpilotinginstruments) o The AMM (general overview) are not approved inthe same way than the MOE (detailed reviewofthecontent)bytheNAA. AllthesegapsforcesoperatorsandMROtoimplementreplacementsolutions(lessefficientforthe safetyconcernthanarootaction).
30/93
FINALREPORT
5 R E C O M M E N D A T I O N S R E C O M M E N D A T I O N
5. .1 1 Re ec co om mm me en nd da at ti io on ns sa as sc co on nc ce er rn ns st th he er re eg gu ul la at to or ry yt te ex xt ts s 5 R
Recommendation1
ConcerningRecommendation1proposedinparagraph4DataAnalysis: (a) Regulation N2042/2003 Annex II Part 145 and/or the related ED Decision No 2003/19/RM Annex II AcceptableMeansofCompliancetoPart145shouldbeamendedtorequireastandardizedlayoutforthe jobcards,andstandardizedproceduresonhowtofillthem. (b) Regulation N1702/2003 Annex Part 21 and/or the related AMC should be amended to require a standardizedlayoutforthemanufacturersjobcards,andstandardizedproceduresonhowtofillthem.
Recommendation2
ConcerningRecommendation2proposedinparagraph4DataAnalysis: Regulation N2042/2003 Section B Procedure for Competent Authorities and/or the related ED Decision No 2003/19/RM Section B should be amended to require a standardized interpretation of the regulatorytexts forallsupervisionauthorities.
Recommendation3
ConcerningRecommendation3proposedinparagraph4DataAnalysis: Regulation N2042/2003 paragraph 145.A.47(c) Production Planning and the related ED Decision No 2003/19/RMparagraphAMC145.A.47(c)shouldbeamendedtotakeintoaccountallhandoverissues. Wordsunderlinedinboldinthefollowingtextsshouldberevisedtotakeintoaccountthecases where a single worker faces momentary interruptions. In this case, the regulatory text should stress that the outgoingandincomingpersonnelmaybethesameperson. RegulationN2042/2003 145.A.47Productionplanning (c)Whenitisrequiredtohandoverthecontinuationorcompletionofmaintenancetasksforreasonsofa shift or personnel changeover, relevant information shall be adequately communicated between outgoingandincomingpersonnel. EDDecisionNo2003/19/RM AMC145.A.47(c)Productionplanning Theprimaryobjectiveofthechangeover/handoverinformationistoensureeffectivecommunicationatthe point of handing over the continuation or completion of maintenance actions. Effective task and shift handoverdependsonthreebasicelements: Theoutgoingpersonsabilitytounderstandandcommunicatetheimportantelementsofthejobortask beingpassedovertotheincomingperson. The incoming persons ability to understand and assimilate the information being provided by the outgoingperson. A formalised process for exchanging information between outgoing and incoming persons and a plannedshiftoverlapandaplaceforsuchexchangestotakeplace.
31/93
FINALREPORT
5. .2 2 Re ec co om mm me en nd da at ti io on ns sa as sc co on nc ce er rn ns st th he es sa af fe et ty yp po ol li ic cy ya an nd dH HF Ft tr ra ai in ni in ng g 5 R
Recall
v Humanfactors/errormanagementthroughtheregulation: Facilityrequirements145.A.25 Manpower/manhourplan145.A.30(d) Competenceinhumanfactors145.A.30(d) Humanfactorstrainingforcertifyingstaff145.A.35(d) Humanfactorstrainingforallstaff145.A.30(e) Humanfactorstrainingsyllabus145.A.30(e) Availabilityofequipmentandtools145.A.40(a) Procedureforreportingpoororinaccuratemaintenance145.A.45(c) Availabilityofmaintenancedata145.A.45(f) Productionplanning145.A.47 Productionplanningtakingintoaccountfatigue145.A.47(b) Taskandshifthandover145.A.47(c) Occurrencereportingandinvestigation145.60(b) SafetyandQualitypolicy145.A.65(a)145.A.70(a) Procedurestotakeintoaccounthumanfactors145.A.65(b) Designandpresentationofprocedures145.A.65(b) Errorcapturing145.A.65(b) Signingofftasks145.A.65(b) MOEadditions145.A.70 Whilst the training requirement for competent authorities does not specifically itemise human factors training,theimplicationisthatsuchtrainingwouldneedtobeincludedsincetherequirementsstatesthat staff should "be appropriately qualified and have all necessary knowledge, experience and training to performtheirallocatedtasks"(Part145.B.10). v SafetyManagementSystems: The safety policies of a company define the senior managements intentions in safety matters. These policies document the fundamental approach to be taken by staff and contractors towards safety. The policies should be based on a clear and genuine Boardlevel commitment that, for the company, the management of aviation safety is paramount. To this is added a commitment to best practice and compliancewithaviationregulations.Theachievementofthepoliciescanbeimplementedthroughsuitable organisationalarrangementsandmanagementsystems.Theseprovidethefocusforallstafftoenacttheir managementspolicies.TheadministrativearrangementsthatareinplaceforQualityManagementshould beusedtoprovidetheauditandfollowupprocessesrequiredbysafetymanagement.
32/93
FINALREPORT
ImpactofmaintenancedocumentationontheHumanFactorconcern
During this study, it was identifiedthatthe humanfactors and the safety policy were inthe centre ofthe maintenanceerrors: Shift/taskhandoverprocedures Procedures for notification of maintenance data inaccuracies and ambiguities to the Type Certificate(TC)holder Humanfactorstrainingprocedure. 10 ThisisexplainedbyICAOthroughtheSHELmodel . BUREAU VERITAS thinks the best recommendation in this matter is to help MROs to implement a safetypolicyprocess. Presently in most of cases, the Human Factors and Safety Policy (chapter 1.2 of the M.O.E.) are an administrativeanswerandinthebestMROagoodinformationfortheirpeople.Inthemajority,theMRO haven'tunderstoodthatHumanFactors(HF)&SafetyPolicy(SP)arethebaseofthemaintenancesafety cultureandthemainbasetodeveloptheSafetyManagementSystem(SMS). Finally,weproposeamodel toimplementthesafetyprocessinthemaintenanceorganisationstoobtain more positive results and the decrease of errors particularly in documentation (See Annex F: Model to implementasafetyprocessinamaintenanceorganisation). Remark:ItcouldbeinterestingtotraintheCivilAviationAuthorities(CAA)inspectorsaboutHFandSMS. It's one of the waysto have a good understanding about these basic safety concepts through a specific training. Presently there is too much interpretation of the regulation for example the signature by the certifying staff is only required on the cover sheet for some CAA, while for other all tasks must be "signed"... TheimplementationofsafetypolicyandthehumanfactorstrainingshouldbemoredevelopedintheMRO. TheobjectiveistohaveabestapproachoftheSafetyManagementSystem.
10
SoftwareHardwareEnvironmentLiveware This model outlines that Human Factors deal with the relations between INDIVIDUAL (Liveware) and DATA (Software),MATERIALS(Hardware),ENVIRONMENTandtheotherINDIVIDUALS.
33/93
FINALREPORT
6 C O N C L U S I O N C O N C L U S I O N
To meet the objectives of the present study, we firstly assessed the European ECCAIRS database to define to what extent it could be used to gather data on incidents or accidents related to maintenance documentation.Weconcluded that theECCAIRS database cannot yet produce such data. Nevertheless, EASAmemberstatesshouldbeencouragedtooperatefullytheECCAIRSsystem,asavaluablemeansto measuretherealprogressbroughtbytheregulationinforce,concerningsafetyinmaintenanceactivities throughoutEurope. Secondly,wecollectedandanalyzedreportsandsearchedstatisticsonincidentsandaccidentsrelatedto maintenance documentation, throughout Europe. Our analysis showed an origin upstream of the maintenanceworkshop,clearlyputtinginquestionthequalityofthemanufacturersdocumentation. Itisimportanttonotethatpreventivemeasuresaremoreefficientwhentheyaretakenearlyinscenarios leadingtoanaccident/incident.Then,asourresultsshowthatthemanufacturersactivitiesplayadirector indirect part in accidents or incidents related to maintenance documentation, we can conclude that a 11 revision of the Regulation 1702/2003 Part 21 should be undertaken. Otherwise, modifications in Regulation 2042/2003 would constitute patches that compensate for shortcomings in Regulation 1702/2003. In such a case, operators and maintenance organisations would have to support additional measurestocompensateforprobableshortcomingsinmanufacturersactivities(anddocumentation). Revision of Regulation 1702/2003 Part 21 seems to be necessary to guarantee that a minimum level of safetyisrequiredconcerningmanufacturersdocumentation,includinghumanfactorissues. Inthesecondpartofthestudy,wecollectedandanalyzedcommonmaintenancepracticesandruleswhich are actually in place in the European industry. The objective was to provide a good understanding of common practices and inherent difficulties between the operators and the maintenance organisations, includingsomestatisticaldataaboutthecontractandaboutfinancialpenalties. We noticed reluctance on the part of the industry to disclose information about their current working practices. Then, BUREAU VERITAS decided to establish a more casual contact with operators and maintenanceorganisations,consideringthattheiropinionabouttheoptionsexaminedbytheRulemaking Task145.020wasavaluableinputforourstudy,astheyareintouchwiththeindustrialreality. Analyzing the results of the collected data, we concluded that neither Options2, 3 & 4 examined by the RulemakingTaskn145.20seemtobelikelytohaveaneffectiveimpactonaviationsafetyinEurope,and thatthebestoptionseemstobethefirstone:Keepthesituationasitstands.Nonetheless,thingsneedto bedonetoimprovecontrolofthehumanfactorconcernwhencarryingoutmaintenance. The study of common maintenance practices showed that Regulation 2042/2003 (including Part M ContinuingAirworthiness,Part66CertifyingStaff,Part145MaintenanceOrganisationApprovals,and Part 147 Training Organisation Requirements) should be revised in the aim ofreducing the number of accidents or incidents related to maintenance documentation. We proposed three recommendations to improvethePart145Regulation. As aviation is a human activity, any aviation operation (including maintenance activities) can lead to an accident. ICAO, Eurocontrol, the European Commission, and even the States, promote safe operations among aviationorganizationsthroughstatutoryandlocalregulations. ICAOgoesfurther,promotinganadaptiveapproachtosafety,throughanSMSimplementation.Arapidly expandingindustryandlimitedresourcesatoversightauthoritiesmakeitincreasinglydifficulttoefficiently and effectively sustain a prescriptive approach to the management of safety based upon regulatory complianceexclusively. Given the nature of the maintenance function, the working environment for AMEs [Maintenance Engineer/Mechanic/Technician], and the many Human Factors issues which may compromise their
11
CommissionRegulation(EC)No1702/2003AnnexPart21Certificationofaircraftandrelatedproducts,partsand appliances,andofdesignandproductionorganisations 34/93
FINALREPORT
expected performance, a systematic approach to safety is called for, i.e. a safety management system (SMS).(ICAODoc9859SafetyManagementManual,19.2.1) Preparing the questionnaires, our experts described a lot of bad practices (likely to lead to an accident) theyhaveobservedinthefieldofmaintenance,inspiteofexistingregulations.Reasonsaremoreoftena lackofsafetyculture,atanyleveloftheorganizations. Safemaintenanceorganizationsfostertheconscientiousreportingofmaintenanceerrors,especiallythose that jeopardize airworthiness, so that effective actioncan be taken. This requires a culture in which staff feelscomfortablereportingerrorstotheirsupervisoroncetheerrorsarerecognized.(ICAODoc9859 SafetyManagementManual,19.3.4) Evenifaccidents(andincidents)costmoney,thosecostsareoftennottakeninaccount,astheyarenotas tangible as costs of production. The same problem was encountered few years ago with costs of non quality. Evenmore,as welldescribedbyICAOinitsSafetyManagementManual,jobcards(andmoregenerally maintenancedocumentation)isnotthesoleissuewhenconsideringmaintenancesafety. Themaintenanceworldincorporatesacombinationofsafetydefences,includingmultipleredundanciesof aircraft systems, to strengthen the system. These defences also include such things as certification of maintenanceorganizations,licensingofAMEs[MaintenanceEngineer/Mechanic/Technician],airworthiness directives, detailed SOPs [Standard Operating Procedures], job cards, inspection of work, and signoffs andrecordsofworkcompleted.(ICAODoc9859SafetyManagementManual,19.1.3) Risk potentialmay be created by the conditions under which maintenance is often conducted, including such variables as organizationalissues, work site conditions and human performanceissues pertinent to aircraftmaintenance.(ICAODoc9859SafetyManagementManual,19.1.4) MaintenanceerrorsareoftenfacilitatedbyfactorsbeyondthecontroloftheAME,forexample: a)informationrequiredtodothejob b)equipmentandtoolsrequired c)aircraftdesignlimitations d)jobortaskrequirements e)technicalknowledgeorskillrequirements f)factorsaffectingindividualperformance(i.e.SHELfactors) g)environmentalorworkplacefactors h)organizationalfactorssuchascorporateclimateand i)leadershipandsupervision.(ICAODoc9859SafetyManagementManual,19.3.3) There is no doubt that maintenance documentation is linked to a significant number of incidents and accidents. Some occurrences are also avoided thanks to documentation review. Such a good practice shouldbeunited,togetherwithothergoodpractices BUREAU VERITAS is more and more convinced that the safety concern must be addressed as a performancebasedapproach,asmuchformaintenanceactivitiesasforallotherfieldsinaeronautics. Seamless management systems, such as the Safety Management System (SMS), give already good resultsforAirNavigationProviders. As a conclusion, operators and Part 145 organisations should be encouraged to implement a minimum SMS,dependingontheirsize,tobestmanagethemaintenancedocumentation,andcontrolhumanfactors whencarryingoutmaintenance.Forthosereasons,wealsorecommendtheimplementationofamodelto implementthesafetyprocessinthemaintenanceorganisations,intheaimtoobtainmorepositiveresults anddecreaseoferrorsparticularlythoserelatedtothedocumentation.
Blagnac,10December 2007
JeanPierreBATIGNE
HlneMARTEAU
HubertROUX
35/93
FINALREPORT
7 A N N E X E S A N N E X E S
36/93
FINALREPORT
Annex A Occurrences recorded by the BEA relating to maintenance documentation
37/93
FINALREPORT
38/93
FINALREPORT
39/93
FINALREPORT
40/93
FINALREPORT
Annex B Accident of aircraft A330, registration CGITS, on 24/08/2001
41/93
FINALREPORT
Date:
AircraftType:
AircraftRegistration:
24/08/2001
Location:
AirbusA330240
Injuriestopersons:
CGITS
Damagestoaircraft:
LajesAirport,Azores
Sixteenminorinjuriesand twoseriousinjuries,during theemergencyevacuation
Structuraldamagetofuselage andmainlandinggear
Facts:ACCIDENT
Emergencyallenginesoutlandingasaresultoffuelexhaustion.
Causes:
Useofmismatchedfuelandhydrauliclinesduringtherightenginechange,causinganin flightfuelleakageduetotheruptureofthehighpressurefuelpumpinletfueltube,which failedasaresultofhardcontactwiththehydraulicline.
Summaryofrelatedenginemaintenanceevents
Source:GPIAA,PortugueseAviationAccidentsPreventionandInvestigationDepartment,ReportRef.22/ACCID/2001
On 15 August 2001, during a routine inspection of the Airbus 330243, metal chips were found on the masterchipdetectorintheoilsystemoftheright(Number2)engine(RollsRoyceRB211Trent772B).On 17August2001,therewasasecondincidenceofmetalparticlesintheoilsystem,andbecausetheorigin of themetal could not beidentified,the operator decided to replacethe engine.Operators spare engine was not available consequently, a RollsRoyce loaned engine, previously positioned at the operators facilities,wasused. Theenginechange,whichcommencedatmidnighton17August2001,proceedednormallyuptothepoint whenitwasdiscoveredthattherearhydraulicpump,takenfromtheremovedengine,couldnotbefitted ontothereplacementengineduetoaninterferencewiththehighpressurefuelpumpinlettubealreadyon thereplacementengine. AsearchthroughtheAirbusIllustratedPartsCatalogue(IPC)revealedtheexistenceofaServiceBulletin SB.29C625.Itwasthenrealizedthattheloanedengine,lastcertifiedbyHongKongAeroEngineServices Limited (HAESL), was in a preSB configuration, and the engine being replaced was in a postSB configuration. The technician leading the engine change could not access the SBs from the available computerterminals,andacceptedadvicefromthemaintenanceengineeringdepartmentthatonlytherear fuel tube from the engine being replaced needed to be used. According to the technicians, a clearance betweenthefuelandtheadjacenthydraulictubewasobtained. Uponcompletionoftheenginereplacement,inspections wereconductedbyboththeleadtechnicianand another technician and no discrepancies were noted. The engine was successfully ground run and the aircraft was released for flight with a postSB hydraulic pump, a postSB.29C625 fuel tube and a pre SB.29C625hydraulicline. An examination of the aircraft following the accident determined that both engines stopped due to fuel exhaustion,whichwasprecipitatedbyaruptureofthehighpressurefuelpumpinletfueltubeontheright engine,whichfailedasaresultofhardcontactwiththehydraulicline.Theenginehadaccumulated67.5 flighthourssincetheengineinstallation. Nota:
Theleasestatusoftheaircrafthadnobearingonthecontroloftheaircraft.Themaintenanceof theaircraftwastheresponsibilityoftheairoperator. TheaircrafthadavalidCertificateofAirworthinessissuedon28April1999whentheaircraftwas registeredtotheoperator.
42/93
FINALREPORT
Technicalpersonnelinformation
EngineController
EachenginemodelofthisoperatorisassignedtoanEngineController,wholiaiseswiththemanufacturer to obtain additional expertise as needed. The controllers responsibility centres on the offwing maintenanceoftheengine.TheoperatorsTrentEngineControllerwasassignedtothispositionbecause of his previous experience with RollsRoyce engines. He did not hold an Aircraft Maintenance Engineer (AME)licence,norwasherequiredto. TheTrentEngineControllerworkedMondaytoFriday,andwasoncallduringtheweekendthattheengine wasbeingreplaced.
MaintenanceTechnicians
Theenginechangewascarriedoutbydifferentcrewsoffourtosixtechnicians.Eachcrewhadatleastone A330rated technician, and the crews worked normal 8hours shifts. The technicians normally worked a sequenceof4daysonthen3daysoff.Someworkedanextradaywithovertimecompensation. ThecrewswereleadbyaleadtechnicianholdinganAMElicenceendorsedontheA330aircraft.Hehad beenselectedtosupervisetheenginechangebecauseofhispreviousexperiencewiththreeA330engine changeswithinthelastyear.TheleadtechniciannormallyworkeddayshiftMondaytoFriday.OnFriday, 17August2001,hewascalledathomearound19:00hoursandaskedtoleadanenginechangethenext day.HereportedtoworkonSaturdayat06:30andworkeduntil19:00hours.Hewasbacktoworkthenext morningat06:30hoursandleftuponcompletionoftheenginechangeat17:30hours.
InhouseRollsRoyceRepresentative
A provision of the aircraft leasing agreement was that the aircraft lessor would position a RollsRoyce representative with the operator. The representative functioned mainly as a facilitator, assisting the operatorandprovidingadirectcommunicationlinkwiththeenginemanufacturer.Therepresentativecould offeradvice,butwasnotpartof,norresponsiblefordecisionmaking.
MaintenanceControlCentre
The Maintenance Control Centre (MCC) is located in the companys System Organization Operations Centre (SOOC) which operates 24/7 and coordinates all airline operations. The MCC is manned by two aircraft technicians, who analyse anomalies reported by the flight crew and coordinate maintenance resourceswhereandwhenrequired.TheMCCtechnicianskeeptheSOOCinformedoftimeofcompletion onongoingmaintenance.Ifrequested,andiftimeisavailable,thetechnicianscanalsoprovidetechnical supporttomaintenancecrews. Duringtheenginechange,bothAMEsondutyatMCCwereendorsedontheA330.
QualityControl
The quality ofmaintenance carried outis monitored by the Quality Control(QC)manager and delegated inspectors whoarealllicensedAMEs.Theaccuracy andqualityofworkisensuredbytwomethods:the firstis by physical inspection of work done on aircraft and the second is through the review of logbooks anddocumentationforaccuracy,completenessandvalidityofcertification. There was no QC person on site during the time that the engine was replaced, nor there was a requirementforonespecifiedintheMaintenanceControlManual(MCC).Atthetimeoftheaccident,the staffworkedMondaytoFriday. Designated supervisors do the daytoday quality control of work being done. In addition, following the completionofmajormaintenancetasks,independentinspectionsarecarriedout.
43/93
FINALREPORT
Rightengineinformation
RightEngineHistory
Therightengineunderwentapostlease(offwing)shopvisitatHongKongAeroEngineServicesLimited (HAESL),whichisaRollsRoyceapprovedfacilityand,on31July2000,theenginewascertifiedto772& 772Brating. Correspondence with HAESL and RollsRoyce indicated that the plan was to embody SB.29C625, modifying the engine dressing of this engine. However, this modification was not done due to parts shortage.Uponcompletionoftheshopvisit,theenginewastestrunwithoutthehydraulicpumpsinstalled, whichisanacceptedpractice. Following the HAESL shop visit, the engine was shipped to, and stored at the Air Canada facilities in TorontoattheendofJuly2000.On1August2001,inresponsetoarequestfromtheA330operatorthata spare engine be made available at its facilities in Mirabel, Quebec, the engine was sent to the A330 operator. Included in the documentation forwarded with the engine from HAESL were the Rework SummarySheet,theCarryForwardItemsListandtheEngineLogBook. AsrequestedbyRollsRoyce,theenginewasstoredinarestrictedareatoensureitsintegrityintheevent thatiturgentlywasrequiredbyanotherairline,becausethiswastheonlyavailableloanedengineinNorth America. Access to the engine required notifying the inhouse RollsRoyce representative. Because the enginehadtoremainavailabletootherworldwideusers,itwaskeptinanasreceivedstatus.
ReworkSummarySheet
The Rework Summary Sheet recorded several modifications that were embodied during the postlease shop visit. It also detailed modifications found embodied, but not documented by the last operator. The ReworkSummarySheetonlyaddressedtheSBsforwhichsomeactionhadbeentakenplaceduringthe shopvisit.TheReworkSummarySheetdidnotcontainanyreferencetoSB.29C625,showingthatithad notbeenembodiedduringtheshopvisit. There was no requirement onthe part of HAESL tocomply with an Airbus recommendationthat SBs be embodiedattheearliestopportunity,norarequirementforHAESLtoadvisepotentialusersoftheengine aboutanySBsthathadnotbeenembodied.TheFrenchBEAnotesthatinfact,itisarequirementforthe airlinewhoinstallsthecoreenginetocheckitsconfigurationandreceiptandensurethatitcomplieswith themanufacturersspecifications.
CarryforwardItemsList
Typically, owneroperated and leased engines are forwarded without some accessories, such as starter andhydraulicpumps.TheseaccessoriesareoftenreferredtoasaQuickEngineChange(QEC)kit.The CarryForwardItemsListindicatedthat60additionalcomponentswouldberequiredwhentheenginewas installedonanaircraft.Thelistprovidedpertinentcomponentinformation,suchastheAirTransportation Association(ATA)number,thepartnumber,thepartnameordescription,andthequantityrequired. The60componentsonthelistincluded13majorparts, withtheremainingcomponentsrequiredfortheir installation.Items58and61ontheCarryForwardItemsListattachedtotheloanedengine showedthat both front and rear hydraulic pumps required for the installation were postmodificationmodel hydraulic pumps(ofanewPartNumbertype).Becausetheenginedressing wasnotchangedduringthelastshop visit at HAESL, the engine was in the premod configuration, which required a premodificationmodel hydraulicpump(ofsomepreviousPartNumbertype).
EngineLogBook
Regulationsrequirethattechnicalrecordsbemaintainedonmajoraircraftcomponents,such asengines. The technical record that accompanied engine received from HAESL was the Engine Log Book, which containedarecordofallmaintenanceperformedontheengine,includingtheSBsembodied.TheEngine Log Book, which is the primary document for the engine, accurately reflected the configuration of the engine.
44/93
FINALREPORT
EngineFuelTubeRupture
The initial inspection of the right engine following the accident uncovered the presence of an Lshaped crackontheinletfueltubewall.Inaddition,thehydraulicoutlettube(pressure)fortherearhydraulicpump wasfoundtobeinhardcontactwiththefueltube.Thecrackingonthefueltubeextendedtobothsidesof amechanicallyworn(chafed)areawherethetubescameintocontact.Itwasevidentthattheinterference andchafingoccurredduetothemismatchedinstallationofthepostmodfueltubeandpremodhydraulic tube. The hydraulic and fuel tubes were sent to the RollsRoyce Laboratory in Derby, England, for further analysis under the supervision of the United Kingdom Air Accidents Investigation Branch (AAIB). The analysisconcludedthatthefuelandhydraulictubesfullymatchedthedrawingcharacteristicsformaterial, form and shape. The examination concluded that the fuel tubefractured in high cyclefatigue at multiple initiation sites in the bore and the outside diameter, due to combination of vibratory stresses being superimposed on the tube deformation. Also noted were some scratches and deep scores around the chafedlocationonbothtubes.Areportstatedthatthesemarksarebelievedtohavebeenmadeatthetime ofinstallationoftheenginebecausethiswastheonlytimethepostSBfuellineandpreSBhydrauliclines were mounted adjacent to one another. The report concluded that the scratches and scores were directionallyalignedandthattheycouldhavebeencausedfromrepeatedcontactfromabluntinstrument, suchasascrewdriverbeinginsertedbetweenthetubesinordertoforceclearancebetweenthem.There werenocracksinitiatedfromthescoreorscratchmarks.
Maintenanceandtechnicalfactors
Reviewof ServiceBulletins
AirTransport Association (ATA) Specification 100 specifies that Service Bulletins (SBs) shall bethe only document used by manufacturers to notify operators of recommendations and modifications to their products. An SB is to be used for actions that require a record of accomplishment. If the SB has an airworthiness implication, the regulatory authorities of the country of manufacture generate an AirworthinessDirective(AD)ontherelatedmattertomandatetheembodimentoftheSB. SBs carried out or embodied must be documented in the pertinent log book (airframe, engine and/or appliance). SBs determined to be unrelated to a given airframe, engine or component, and those not embodiedarenotdocumented. WhenamodificationassociatedwithanSBisembodiedduringproduction, theannotationprovidedinlogbookbyAirbuswillbethemodificationnumberwithabriefdescriptionofthe modificationthedescriptiondoesnotreferencetheSBnumber. On21April1999,inreactiontoseveralcasesofhydraulicfluidleakageatthehydraulicpumporattached hydrauliclines,AirbuspublishedanoptionalSBofferingamodifiedhydraulicpump. Because the pump was mounted on the engine, RollsRoyce issued the following two SBs (from 15 January1999):anoptionalSBdetailingthereplacementofthehydraulicpumpandSB.29C625detailing modifications to the engine dressing to accommodate the widened pump housing and the resulting interference with the adjacent fuel line. Modification of the dressing consisted of the replacement of the threefueltubesandtwohydraulictubesforthefrontandrearhydraulicpumps.TheoptionalSBoutlined therequirementthatSB.29C625befittedpriortoorconcurrentlywithitsembodiment.SB.29C625stated thatitwasessentialthatthetubesbefittedasaset. The two RollsRoyce SBs were not incorporated at the time of manufacture of the loaned engine, nor duringthelastshopvisitduetotheunavailabilityofparts.TheA330aircraftinvolvedintheeventwaspost mod status when acquired by the operator. Embodiments of the SB are documented by Airbus in the airframelogasmodification. Thecommonmethodusedbymaintainerstodeterminethecurrentstatusofanaircraftistocomparethe pertinentairframe,engineorcomponentlogbooksagainstthelistpublishedbythemanufacturer.Thereis norequirementtoreexaminethecontentoftheSBsthatarerecordedasbeingembodied. Themostthoroughmethodofconfirmingparitybetweenanenginebeingremovedandtheonereplacingit istomirroreachenginelogbookagainstoneanother.Inaddition,theSBmainindexlistwouldhavetobe scrutinizedforeveryunmatchedSBtoassessthepossibilityofconcurrentrequirements.
45/93
FINALREPORT
Thismethodwouldhaverequiredthecomparisonof167SBsinthecaseofthereplacementengine. An alternative method, suggested after the accident by the engine manufacturer as a quicker means of establishing SB parity, would be to inspect the major components that are to be installed, against the EngineIllustratedPartsCatalogue(EIPC)tocheckforanyassociatedSB.Thismethod,inthecaseofthe loanedengine,wouldhavereducedthenumberofSBstobecheckedforapplicabilityfrom167to13. IfandwhenanSBisfoundtoapply,itwouldhavetobereviewedforotherpartnumberapplicabilityand foranyconcurrentrequirement. Because of the airworthiness implication, Transport Canada (TC) audits the lists of ADs and mandatory SBs,as wellasthecompletenessoftheirembodiment.RecommendedoroptionalSBsarenotgiventhe samelevelbytheoperator,noraretheyauditedbyTransportCanada. Nonmandatory SBs (having an optional or recommended compliance) are not reviewed by the maintenance supervisors of the A330 operator. The operators Engineering Section leads these reviews with senior management.Althoughmaintenance crews may be aware of specific SBs, the crews are not partoftheembodimentdecisionmakingprocess. None of the two RollsRoyce SBs went through the reviewing process of the A330 operator, specifically becauseitsA330aircraft,includingtheoneinvolvedintheevent,werepostSBmodstatuswhenacquired. This situation also meant that the operators maintenance management had not been exposed to these preSBaircraftortotheassociatedSBs.
Reviewof IllustratedPartsCatalogues
An Illustrated Parts Catalogue (IPC) is a document that is intended for use in identifying, provisioning, requisitioning, storing and issuing line replacement aircraft parts and units. An IPC includes all parts for whichamaintenancepracticehasbeenprovided. TherearetwoIPCsthatcanbereferencedbytechnicianswhenperformingmaintenanceontheTren772 enginedressing:theAirbusA330IPC,andtheRollsRoyceEngineIllustratedPartsCatalogue(EIPC). The Airbus IPC, also referred to as ADRES (Airbus Documentation Retrieval System) specifies the configuration status of each aircraft by serial number. It lists the current aircraft parts applicability and includesanoteinformingthereaderoftheembodiedSB. TheRollsRoyceEIPC fortheTrent772BengineseriesalsocontainsrelevantSBs. TheAirbusIPC,RollsRoyceEIPCandassociatedSBsareavailableonthecompanycomputernetwork. ThesedocumentsarealsoavailableonstandalonePCsandCDsattheMCCstationandintheoperators TechnicalLibrary.Additionally,apapercopyofeachSBisheldintheoperatorsTechnicalLibrary,under controlled access, in order to preserve its integrity.Technicians rarely,if ever, access either the librarys hardcopyorthestandaloneCDsmaintenancemanagementmorecommonlyusesthem. Neither the Airbus IPC, nor RollsRoyce EIPC was referenced at the time of engine receipt, or during review by engineering prior to the engine installation. The Airbus IPC was referenced by the lead technicianduringtheengineinstallation.
ReceiptandInventoryofEngines
Subpart571.13ofCanadianAviationRegulations(CARs)requiresthatnopersonshallinstallapartonan aeronautical product unless the part is inspected and its accompanying documentation verified in accordancewithaprocedurethatensuresthatthepartconformstoitstypedesign,asisindicatedbythe maintenancerelease. In this regard, the operators Maintenance Control Manual (MCM) contains a procedure that requires incomingpartsandmaterialsbesubjectedtoareceivinginspectioninordertoverifythatthesubjectitems areacceptableforuseoncompanyaircraft. Whentheloanedenginearrivedattheoperatorsfacility,theenginecontrollercomparedthestatusofthe engine to the Rework Summary Sheet and the CarryForward Items List. He was satisfied that the components on the CarryForward Items List were available either in stock, or off any engine that might requirereplacement.Thereviewofdocumentationandreceivinginspectiondidnotdetectthattheengine conditionwasinthepremod(SB.29C625)configuration.
46/93
FINALREPORT
EngineChangePlanning
Maintenance falls into two major categories: scheduled routine maintenance and unscheduled defect rectification. Thepresenceofmetalparticlesonthe originalrightengineon17August2001requiredan unscheduled enginechange.Variousoptionsfortheenginereplacementwereconsidered,includingoutsidecontracting. Notwithstanding,afterconfirmingtheavailabilityofexperiencedoperatortechnicians,itwasdecided,late Fridayafternoon,thattheworkcouldbedoneusinginhouseresources,withtheworkstartingatmidnight thesameday. To support the work requiredfor the enginechange, the relevant workcard package was extractedfrom the Airbus ADRES. The package contained all applicable references to the Maintenance Manual. As per the maintenance procedure of the Maintenance Control Manual (MCM), the installation of the carried forwarditemswastobedocumentedonadditionalworksheets. These sheets were to be completed during the course of the engine change. Because the premod configurationoftheenginehadnotbeenidentified,noworksheetswereissuedtoaddresstheapplicable SBs.
RightEngineReplacement
Subpart 571.02 of Canadian Aviation Regulations (CARs) requires that a person who performs maintenance or elementary work on an aeronautical product shall use the most recent methods, techniques,practices,parts,materials,tools,equipmentandtestapparatuses,asfollows: Those that are specified for the aeronautical product in the most recent maintenance manual or instructions for continued airworthiness developed by the manufacturer of that aeronautical product Thosethatareequivalenttothosespecifiedbythemanufacturerofthataeronauticalproductinthe mostrecentmaintenancemanualor, Thoseinstructionsforcontinuedairworthiness,orinaccordancewithrecognizedindustrypractices atthetimethemaintenanceorelementaryworkisperformed.
Subpart 571.13 of CARs requires the inspection of a part to be installed and verification of the accompanyingdocumentationtothattheparttoensurethatitconformstoitstypedesign,asisindicated bythemaintenancerelease.Subpart571.08(1)(a) statesthattheserequirementsdonotapplyforused parts which are removed serviceable from an aircraft and which are immediately installed on another aircraft.Notwithstanding,Subpart571.08appliestocomponentsofidenticalpartnumbertheIPCmustbe referencedineveryothercase. The engine change started around midnight on Friday, 17 August 2001, with the removal of accessories from the engine being removed. It was assessed that the work could be completed by Sunday, noon to meet the commitment of the aircraft for the scheduled flight and commitment of the hangar space for anotheruse.OnSaturdaymorning,at06:30,18August2001,theleadtechnicianmetwiththenightcrew forashifthandoverbriefing. Somedelayswereincurredaroundmiddayduetothelatearrivalofaleasedjackingpad.TheRollsRoyce representativevisitedthehangarduringthedaytokeepupdatedontheprogressoftheenginechange.At the end of the day, the lead technician handed over the hanging of the replacement engine to the night shift. Even though the work had progressed at a somewhat slower pace than planned, no remarkable difficultieswereencountered. TheleadtechnicianreturnedtoworkearlyonSundaymorning.Shortlyaftercommencinghisshift,hewas advised that the rear hydraulic pump could not be fitted due to interference with the highpressure fuel pumpinlettube.AsearchthroughtheAirbusIPCrevealedtheexistenceof SB.29C625andofpreand postSBconfigurations.Atthistime,theleadtechnicianrealizedthatthereplacementenginewasinapre SBconfiguration,whiletheremovedenginewaspostSB. TheleadtechnicianattemptedtoaccesstheSBfromRollsRoyceEIPCCDinstalledonthenetworkusing threedifferentcomputerstations.Allattemptsresultedinaccessbeingdenied,asaresultofacomputer networkmalfunction.
47/93
FINALREPORT
TheleadtechnicianthencontactedtheMCC,whointurnpagedtheoperatorsTrentEngineControllerfor advice.While waitingfor the Trent Engine Controller to return the call,the MCC technician attempted to access the RollsRoyce EIPC and the SBs through the computer network, but was also denied access. WhileMCChaditsownstandalonemaintenanceEIPCCDs,includingtheSBs,theywerenotused. The use of the EIPC CDs was not considered by the lead technician because he was not aware of this capabilityintheMCC.TheuseoftheCDsbytheMCCtechnicianswasnotconsideredbecausetheirrole in providing technical assistance to maintenance crews was to locate resources and not to provide technicalassistanceinsearchingfortechnicalreferences. WhentheTrentEngineControllercalledback,hereadilyrecalledtherationaleforthepumpmodification asbeingexcessvibration.Healsorecalledthatthemodifiedpumpinterferedwiththefuellines,andthat these would need to be replaced. Hefurther advisedthe leadtechnicianto confirm that, when the pump andlineswereinstalled,adequateclearancesexistedbetweenlinesandcomponents.Theleadtechnician queriedthepossibilitiesofusingapremodpumptosavetime,becausetheworkwasalreadyrunninglate. Basedonhisknowledgethatall operatorsaircraftwereofpostmodstatus,aswereallotherRollRoyce poweredA330flowninCanadabyotheroperators,theEngineControllerinformedtheleadtechnicianthat suchapumpwasnotavailableonshortnotice.Bothagreedthattherewasnochoiceotherthantoreplace thefueltubes.Indiscussingtheestimatedtimerequiredtocompletethetransferofthetubes,thecontroller suggestedthatthetimeoutlinedintheSBshouldbeused. Atthistime,thecontrollerwastold,inpassing,thatthecrewhadnotbeenabletoaccesstheSB.Whilethe difficultyinaccessingtheSBinitiallywasaconcern,thediscussionquicklyrevertedtothetimerequiredto completethework,withoutfurtherdiscussionoftheSB.Thecontrollerwasadvisedthathewouldbekept informedofthesituation. Both segmentsofthe postSBfueltube assembly were takenfrom the removed engine andinstalled on the replacement engine. The different shape and routing of the new fuel line overcame the earlier difficulties encountered in installing the hydraulic pump. The preSB hydraulic tube, received with the loanedengine,wasretained.Theinstallingtechnicianrecalledthat,duringtheinstallationofthehydraulic linewhentryingtoachievetherequiredseparationbetweenthefuelandhydraulicline,thehydraulicline had a tendency to spring back. Notwithstanding, according to the technician who did the installation, clearance between components was easily obtained by positioning and holding the hydraulictube, while applyingtorquetotheBnut.Healsostatedthatatoolwasnotusedtoforcetheseparationbetweenthe fuelandhydraulictubes.Therewasnoadditionalinstallationdifficultiesreported. TheRollsRoycerepresentativetelephonedMCCduringtheengineinstallationonSundaytoinquireabout the work progress and to offer help if required. He was informed that the premod status of the loaned (right) engine did not permit installation of the hydraulic pump and was informed that the fuel tube was being changed overfrom the removed engine to theloaned (right) engine to allow the pumpinstallation. TheRollsRoycerepresentativewasunawareoftheenginedressingSBmodificationstatusoftheloaned engineandofthestatusoftheoperatorsenginefleet.TheRollsRoycerepresentativewasnotspecifically toldofthedifficultiesinaccessingtheSBsnorwashespecificallyaskedtoconsulthisdocumentation.His offertoattendonsiteifrequiredwasnottakenup. The installation of the postmod hydraulic pump, the premod hydraulic tube and the postmod fuel tube assemblyresultedinamismatchbetweenthefuelandhydraulictubes. Whentheenginechangewascompleted,theleadtechnicianarrangedforanindependentinspection.
PressureLineInstallation
Bothendsofthehydrauliclineconnectingthepumptothepylonarerigidthemiddlesectionisflexibleto assist in dampening hydraulic pump pulsations. The line routing includes a 90degree bend near the hydraulicpumpconnector. Duringtheinstallationofthelineontheloanedengine,pullingtopositionthelineawayfromthefueltube wouldhaveresultedinsomerotationofthehydraulictubeflangeundertheBnut.TorquingoftheBnut would have provided force on the flanges to counteract the tendency for the flange to rotate back to its normalposition.Pressurizingthehydrauliclinewould resultinaforcetostraightentheline,which would result inforce to rotate theflange to a position that would eliminate the separation between the fuel and hydrauliclines.
48/93
FINALREPORT
The standards and procedures for installing hydraulic lines built with middle, flexible portion are not specified in the training manuals. The issue also is not addressed in widely known technical aviation reference manuals. All these manuals treat rigid tubing and flexible hoses as different issues. The illustrationprovidedinthesemanualsforflexiblehosesindicatesthataslightbowisdesirabletoallowfor shorteningwhenpressurized. A visit to a governmentsponsored regional aerospace training school in Canada also revealed that, although training covers the installation of both rigid and flexible lines, training is not given on the installationofmixedconstructionlinessimilarthehydrauliclineontheTrentengine.Thecriteriafortraining programsandpracticaltestsdonotcommentontherisksofusingtorqueasameansofpositioningsuch linesduringcomponentinstallation. Tubes constructed of both rigid andflexible sections are used throughout the aviationindustry.They are used extensively in many airframe and engine combinations for a variety of hydraulic fluid, oil, or fuel systemapplications.
DocumentationofWorkDone
OperatorsMCMsection1.4.3outlinesthattherectificationofdefectsmustbeappropriatelyenteredinthe log.Consequently,theswitchingofthetubesfromtheremovedenginetotheloaned(right)engineshould havebeenrecordedinboth,theremovedandinstalledenginelogs. Areviewofthelogbook,aftertheaccident,showedthatentriesforallexpectedcomponentschangedover to the installed right engine had been properly made, signed and countersigned by the supervisor however,therecordingoftheunexpectedreplacementofthefueltubeswasnotdocumented.
QualityControl
Followingcompletionoftheenginechange,theleadtechnicianinspectedalltheworkdoneandthetasks documented on the work cards and additional work sheets. The inspection was to ensure that the work wascomplete,withintolerancesandsecured.Hisinspectiondidnotuncoveranyanomalywiththeengine installation. Another inspection called the independent inspection was done by a qualified technician, who had not beeninvolvedwiththeworkbeinginspected.Theindependentinspectionwasdonetoensurethatengine controlsareproperlyconnectedandsecured.Thisscopeofthisinspectionwasnotintendedtoincludethe fuelorhydraulicsystemcomponents. Followingtheseinspections,theenginewasgroundrun,withoutproblems,andwasreleasedforflight. ThecompanyMCMspecifiesarequirementforaqualitycontrolinspectionofthedocumentationafteran engineinstallationhowever,companymanualsdonotspecifyatimeframeforthisinspection.Therewas noQCrepresentativeonsiteontheweekendoftheengineinstallation.Thecompanyplanwastodothe document verification when preparing the removed engine for shipment for repair. As of the occurrence date,24August2001,theenginechangedocumentationhadnotyetbeenreviewedbythequalitycontrol staff.
Analysisoftechnicalissues
General
Theinvestigationdeterminedthatthedoubleengineflameoutwascausedbyfuelexhaustion,whichwas precipitatedbyafuelleakdevelopingintherightengineastheresultoftheuseof mismatchedfueland hydrauliclinesduringtheinstallationofthehydraulicpump. Themaintenancemanagers,supervisorsandtechniciansresponsibleforthereceipt,planning,installation andassociatedinspectionswerequalifiedtodotheirassignedresponsibilities. Part of the GPIAA analysis focused on determining why the aircraft maintenance organisation did not detect the mismatch in engine configurations prior to starting the engine change then why, once the configurationdifferencewasdetectedduringtheenginechange,theinstallationofthehydraulicpumpand hydraulicandfuellineswasnotcompletedinaccordancewithmanufacturersspecifications.
49/93
FINALREPORT
EngineReceipt
When the spare engine arrived at the companys premises on 1 August 2001, it was processed in accordance with the operators MCM procedures. The process only involved an inventory check and verification that the parts on the CarryForward Items List were available. Because the engine was positionedatMirabel,solelyasacontingencymeasure,andtherewerenoimmediateplanstoinstallthe engine on a company aircraft, the engine remained under the control of the engine manufacturers representative.NeithertheMCM,norCanadianregulations,requireSBstobecheckedaspartofthistype ofinventorycheck. ThischeckwasbasedonacomparisonofthespareengineagainsttheReworkSummarySheetandthe CarryForward Items List provided by the company that had completed the last shop visit of the engine. Basedontheavailableinformationandavisualinspectionoftheconditionoftheengine,itwasassessed that the required parts were available if and when an engine change to one of the companys A330 becamenecessary.Ofimportancetothisoccurrence,theenginereceivingprocessdidnotidentifythatthe configuration of the loaned engine did not match the configuration of the other A330 engines at the company. Thefollowingfactorsmayhaveinfluencedthisincorrectassessment: Because all the A330 engines in use at the company were in the postSB configuration and the company personnel had never been involved with preSB configured engines, there was no information that would have caused a heightened concern regarding the configuration of the loanedengine. The physical appearance of the preSB and postSB configurations are similar and cannot be identifiedthroughacursoryinspectionsuchasisconductedduringenginereceipt. The part number of the hydraulic pump, as documented in the carryforward list, was incorrectly identifiedasapostSBhydraulicpump,withapostSBPartNumberand Hydraulicpump,withapostSBPartNumber,wasinstalledonothercompanyA330aircraft.
EngineChangePlanning
ATAidentifies SBs as the only means for themanufacturer to notify operators of a productmodification. ComparingthestatusofnonmandatorySBsoncomponentsofthesamepartnumber,suchasanengine, isnotamethodgenerallyusedtoassureinterchangeability,forthefollowingreasons: Thereisnoregulatoryrequirementtodoso TheabsenceofdocumentationonnonmandatorySBsdoesnotconstitutearisktosafety The number of nonmandatory SBs that may apply to a major aircraft component may be very large,andconductingthecomparisonwouldbetimeconsumingand TheIPCcontainsalltheinformationregardingtheapplicabilityofSBs.
AcomprehensivecomparisonofSBsembodiedontheenginesisthefullestguaranteetoconfirmthelack of disparities during planning phases. Such a check would only be reasonable once it is known which engineistobereplaced. TheTCapprovedMCMdidnotrequirethatnonmandatorySBsbecheckedwhenplanningforanengine changeconsequently,acomparisonofSBswasnot carriedoutatthetimeofenginereceipt,norduring theplanningoftheenginechange. Although the spare engine had been positioned at the companys Mirabellocation tofacilitate an engine change to one of the companys A330 aircraft, there was no immediate intent to use the engine. Consequently,planningfortheenginechangedidnotcommenceuntilafterthemetalparticleswerefound in the engine oil system of the occurrence aircraft and the decision was made to replace the engine in house. Becausethecompanymaintenanceplanners werenotawareofthedifferencesinconfigurationbetween the two engines, the only work cards that were generated were those associated with a normal engine change.Additionalworksheetsfortheinstallationofthecarryforwarditemsweretobecompletedduring thecourseoftheenginechange.
50/93
FINALREPORT
The fact that the differences in engine configuration were not identified during the receipt and planning phases,resultedinasituationwhereintheresponsibilitytodetecttheincompatibilitybetweenthehydraulic pumpandthefuelandhydrauliclineswasdeferredtothetechniciansdoingtheenginechange.
EngineInstallation
v InitialDetectionoftheConfigurationProblem Duringthecourseoftheenginereplacement,theinterferencenoticedbetweenthehydraulicpumpandthe fueltubewasthefirstindicationofaproblemwiththechangeoverofthehydraulicpumptotheenginethat wasbeinginstalledontheoccurrenceaircraft. Onceitwasrealisedthatthedifficultywiththehydraulicpumpinstallationcouldberelatedtothediffering SB status, the lead technician attempted to view the SB. However, he could not access the SB on the RollsRoyce EIPC CDfrom his work station due to a network problem. Not being able to access the SB through the network, the lead technician sought engineering guidance via MCC as per the MCM procedures.NeithertheleadtechniciannortheMCCconsideredaccessingtheSBthroughtheTrentEIPC onastandalonecomputer.HadtheTrentEIPCbeenused,accesstotheSBwouldhavebeenachieved. AccesstotheSB wouldhaverevealedthatthereweretwointerrelatedSBsthatrequiredreplacementof thefueltubeandthehydraulicline,aswellasotherassociatedcomponents. When the lead technician contacted the Engine Controller, the Engine Controllers knowledge of the SB anditsbackgroundcomfortedtheleadtechnicianintofeelingthattheEngineControllerhadagoodgrasp of the problem at hand. Acknowledgement by the Engine Controller that the fuel tube needed to be replacedconfirmedtheleadtechniciansmentalmodelthatthiswastheonlyrequirementforcompletionof theinstallation.TheconfirmationwasreinforcedbythefactthattheEngineControllerwasassociatedwith the engineering department, which had the responsibility for resolving unexpected or nonroutine maintenanceissues. During discussions on the estimated time for completing the engine change, the Engine Controller was made aware that the lead technician had been unable to access the SB. Although both individuals acknowledged that the unavailability of the SBs was of concern, the discussion reverted to the issue of workcompletiontime,andnofurtherdiscussionoftheSBtookplace.Effectively,theEngineControllerand theleadtechnicianagreedtothefueltubetransferwithnofurtherreferencetotheSB. Therewasalsothetimepressurefactortocompletetheworkintimeforascheduledflightandtoclearthe hangar for an upcoming event. This pressure also may have played a role in reliance on direct and personalinformationabouttheSB,ratherthantryingtoresolvetheexistingproblemof notbeingableto accesstheSBs. With the solution at hand, being behind schedule, and having spoken to the Engine Controller, the lead technicianfeltconfidentthatthefueltubereplacementwastheonlyremainingrequirementtocompletethe hydraulicpumpinstallation. v FuelTubeInstallation Exchangingthefueltubewasconsideredbytheleadtechniciantobeamaintenanceactionsimilartothe changingoverofothercomponentsontheCarryForwardItemsList.Hebelievedthatthereplacementof thefueltubewouldestablishtheengineconfigurationinthepostmodstatus. Although it was recognized that thefuel tubefromthe replaced engine was differentfrom the one being removedfromtheenginebeinginstalled,theaircraftIPCentrywasnotreferenced. Adequateclearancebetweenthefuelandhydrauliclinesreportedlywasachievedduringtheinstallationof the hydraulic pump line by applying some force to position the line and holding the line while applying torquetotheBnut.Thisclearancesubsequentlywasverifiedbytheleadtechnician. Althoughitisnotabnormalthatalinebepositionedtoachieveclearancesinthismanner,ifclampingisnot used, the tendency is for a flexible line to straighten when pressurised. This is particularly critical when there is a 90 bend in the tube adjacent to the B nut, as was the case for this installation. The risk associated with the application of force while installing mixed construction lines is not well known in the maintenancecommunity,andisnotcoveredinthetrainingofmaintenancetechnicians. Althoughthemarksonthefuelandhydraulictubessuggestthatsomeimplementmayhavebeenusedto assistinestablishingclearancebetweenthetubes,techniciansdeniedthattoolswereusedinthismanner. Theinvestigationcouldnotresolvethisissue.
51/93
FINALREPORT
Thepressurizationofthehydrauliclinewouldhavebeensufficienttocausethehydrauliclinetomoveback toitsnaturalpositionandcomeincontactwiththefuelline,whichresultedinthechafingandfailureofthe fuelline.
QualityControlIssues
v Maintenanceinspection Postinstallation inspections of the engine change were done both by the lead technician and another independent inspector. However, the inspections were limited to ensuring that engine controls were properly connected and secured, and that the remaining work was complete, was within tolerances and was secured. The methods used for these inspections would not very likely detect a mismatch in components,andfortheoccurrenceenginedidnotdetecttheincompatibilityofthefuelandhydrauliclines thatexisted. v QualityAssuranceDocumentationChecks Neithertheaircraftnortheenginelogrecordedthefuellinechangebecausethetechnicianforgottomake theentry.Inadditiontheverificationofthedocumentationassociatedwiththeenginechangecompletedon 18 August 2001 was not done before the occurrence flight. Consequently, the opportunityfor the quality assurancereviewofthedocumentationtodetecttheinstallationerrorwasnegated. Notwithstanding,becauseitislimitedtoverifyingthatthedocumentationiscomplete,thequalityassurance verificationoftheaircraftandenginemaintenancelogswouldlikelynothavedetectedthattheinstallation ofthehydraulicpumpandfuellinewasnotinaccordancewithapplicableSBs. Ratherthanrelyingonapostmaintenancereviewoftheenginedocumentation,thepresenceofaquality controlrepresentativeduringtheengineinstallationmayhavefacilitatedtheresearchintotheinterference problemandthefullimplementationoftheSBpriortothereleaseoftheaircraft. v ConfigurationControl TheinvestigationdeterminedthattheenginewasreceivedinanunexpectedpreSBconfigurationtowhich theoperatorhadnotpreviouslybeenexposed.Also,theidentificationofacomponentisfirstandforemost carriedoutthroughitspartnumbering.Thedocumentationattachedtotheloanedengine,inusingapart number for a postSB hydraulic pump, may have masked the preSB engine configuration until near completionoftheenginechange.Typicallycomponentsofdifferentconfigurationsareidentifiedviaapart number prefix, suffix or dash number however, this is not practical for complex components, such as modernaircraftengines. Nonmandatory SBs may not directly impact on airworthiness when embodied on their own. However, when two or more interrelated nonmandatory SBs, with interacting components, are not carried out in tandemtheyhavethepotentialtodegradeairworthiness,asseeninthisoccurrence. AlthoughtheuseofSBs wastheonlyviablemethodfordeterminingthecompatibilityof thereplacement engine with the engine being removed, the comparison of SBs is not a commonly used means of configurationcontrol,asevidencedinthisoccurrence. Even though aircraft configuration is affected by SBs, there is no airworthiness requirement to review all nonmandatorySBsonacomponentpriortoitsinstallationnoristhereasysteminplacetofacilitatethe checkingofSBparity.AlthoughTransportCanadaauditsincludethescrutinyoftheimplementationofSBs, the management of SBs (assessment of applicability, implementation time frame, embodiment and recording)islefttothecarriersdiscretion. IntheabsenceofarequirementtoconductanSBparitycheck,andofaneasytousemethodofcarrying this check out, there is a risk that incompatible components may be installed on aircraft and not be detectedbyexistingmaintenanceplanningprocesses.
52/93
FINALREPORT
Conclusionsrelatedtomaintenanceevents
FindingsastoCausesandContributingFactors
1. ThereplacementenginewasreceivedinanunexpectedpreSBconfigurationtowhichtheoperator hadnotpreviouslybeenexposed. 2. Neither the enginereceipt nor the enginechange planning process identified the differences in configurationbetweentheenginebeingremovedandtheenginebeinginstalled,leavingcomplete reliancefordetectingthedifferencesuponthetechniciansdoingtheenginechange. 3. The lead technician relied on verbal advice during the engine change procedure rather than acquiringaccesstotherelevantSB,whichwasnecessarytoproperlycompletetheinstallationof thepostmodhydraulicpump. 4. The installation of the postmod hydraulic pump and the postmod fuel tube with the premod hydraulictubeassemblyresultedinamismatchbetweenthefuelandhydraulictubes. 5. Themismatchedinstallationofthepremodhydraulictubeandthepostmodfueltuberesultedin thetubescomingintocontactwitheachother, which resultedinthefractureofthefueltubeand thefuelleak,theinitiatingeventthatledtofuelexhaustion. 6. AlthoughtheexistenceoftheoptionalRollsRoyceSBRB.21129C625becameknownduringthe enginechange,theSBwasnotreviewedduringorfollowingtheinstallationofthehydraulicpump, whichnegatedasafetydefencethatshouldhavepreventedthemismatchedinstallation. 7. Althoughaclearancebetweenthefueltubeandhydraulictubewasachievedduringinstallationby applying someforce,the pressurization ofthe hydrauliclineforced the hydraulic tube backto its naturalpositionandeliminatedtheclearance.
FindingsastoRisk
1. The carryforward items list that accompanied the replacement engine listed a postmodification hydraulicpumpmodel,whereasthefuelandhydraulictubesinstalledontheenginewerepremod. 2. Time pressures, difficulties in accessing the SB and the apparent knowledge of the engine specialist influenced the lead technician to curtail his search for the SB and to rely on verbal advice. 3. Thepostinstallationqualitycontrolchecksfollowingtheenginechangedidnotspecificallyrequire checkingtheinstallationofthehydraulicpump,hydraulictubeandthefueltube. 4. Intheabsenceofarequirementtoconductapreinstallation,configuration(SB)paritycheck,and of a commonly accepted method of carrying out this check, there is a risk that incompatible components may be installed on aircraft and not be detected by existing maintenance planning processes. 5. TheCDonthecompanysnetworkcontainingtheRollsRoyceEIPCfortheTrent772Bandrelated SBscouldnotbeaccessedduetoacompanycomputersystemfault.
OtherFindings
1. There is not a readily available, effective, commonly accepted method to compare the SB (configuration) status of engines, placing reliance on other processes to detect configuration differences. 2. The logbook entry detailing the installation of the fuel line from the replaced engine was not recorded. 3. Theriskassociatedwiththeapplicationofforcewhileinstallingmixedconstructionlinesisnotwell known in the maintenance community, and is not covered in the training of maintenance technicians.
53/93
FINALREPORT
SafetyActionrelatedtomaintenanceevents
ActionTaken
v ActionTakenbyTransportCanada On 24 August 2001, Transport Canada initiated a Special Purpose Audit of the companys maintenanceandoperations.Noneofthefindingsofthisauditplayedaroleinthisfuelexhaustion occurrence. On28August2001,atTransportCanadasrequest,Canadianairoperatorsinspectedall oftheir A330 aircraft to ensure that the same mechanical conditions that may have contributed to the consideredemergencylandingdidnotexistonotheraircraft. Transport Canada recommended that a Human Performancein Aviation Maintenance course be given to the companys maintenance personnel. The company provided this training through the BoeingAircraftCorporation. Transport Canada provided regulatory guidance and assistance in the development of the companyssafetymanagementsystem(SMS). In November 2003, Transport Canada performed a regulatory assessment of the SMS to determinethecompanysprogressandtheeffectivenessoftheprogram.
v ActionTakenbytheCompany Thecompanyinitiatedacomprehensivereviewofthesafetyoftheirmaintenanceandoperations program.Thecompanyalsoestablishedacorrectiveactionplanthatwillimprovetheperformance of maintenance activity, including the hiring of additional maintenance and quality assurance personnel.Itinstitutedhumanfactorstrainingforalltechnicalpersonnelreviewedandenhanced quality assurance and quality control procedures and, introduced a system for detecting and analyzingmaintenanceerrors.
v ActionTakenbyAirbus On29August2001,AirbusissuedanAllOperatorsTelex(AOT)A33073A3033requiringaone timevisualinspectiontoverifythatnointerferenceexistsbetweenthefuelandhydrauliclineson allA330aircraftequippedwithRollsRoyce700seriesengines.
v ActionTakenbyRollsRoyce On 29 August 2001, RollsRoyce issued a World Wide Communication (DBY/CS/00697/2001), advisingoperators,inpart,tocheckallenginestoensurethatadequateclearanceexistsbetween thefuelandhydrauliclines. On 29 August 2001, RollsRoyce issued a NonMandatory Service Bulletin 73D578 recommendingtheinspectionoftheclearancebetweenthefuelandhydrauliclines.
ActionRequired
v MajorComponentChangePlanning Current regulations and industry standards do not mandate that the configuration of major components, suchasanengine,bedeterminedpriortothecomponentsbeinginstalledontheaircraft.Inparticular,the currentmethodusedforassigningapartnumbertoanengineresultsinapartnumberthatdoesnotreflect whichservicebulletinshaveandwhichservicebulletinshavenotbeenembodied.Theoverallnumberof involved service bulletins complicates the task of determining parity between similar major components. Becausethereisnotarequirementforamajorcomponentchangeplanningprocess,norarequirementto determine the precise configuration of the component during such a process, the responsibility for detectingdifferencesinconfigurationisdeferredtosubsequentstagesofthemaintenanceprocess. For this occurrence, the differences in configuration between the engine being removed and the engine beinginstalledwerenotdetectedpriortothestartoftheenginechange.
54/93
FINALREPORT
Asaresult,determiningpartparityandensuringintegrityoftheinstallationoftherightenginerestedsolely withthelevelofthetechnicianresponsiblefortheenginechange.Effectively,therewasonlyonedefence layerthatcouldensurethesafetyoftheinstallation.Theintegrityoftheenginechangedhingedonusing theIllustratedPartsCatalogueandthereferencedservicebulletinstoverifythecompatibilityofeachpart beingchanged withassociated/adjacentlinesandcomponents.Theincompatibilityofthehydraulicpump with the adjacent fuel pipe was eventually detected and lead to reference being made to the catalogue. However, difficulty in accessing the SBs, time pressures, primefocus on completing the installation, and otherfactorscausedthisonelevelofdefencetobeineffectiveinpreventinganimproperinstallation. Therefore,itisrecommendedthatTransportCanada,andDirectionGenraledelAviationCivileofFrance (DGAC), and the Civil Aviation Authority of the United Kingdom, as well as the EASA and civil aviation authoritiesofotherstatesresponsibleforthemanufactureofaircraftandmajorcomponents: Review applicable airworthiness regulations and standards, as well as aircraft, engines and component maintenance manuals, to ensure that adequate defences exist in the preinstallation, maintenance planning process to detect major configuration differences and to establish the requiredsupportresourcesfortechniciansresponsibleforthework. SAFETYRECOMMENDATIONAK/2004 ItisalsorecommendedthatTransportCanada,DirectionGenraledelAviationCivileofFrance,andthe CivilAviationAuthorityoftheUnitedKingdom,aswellastheEuropeanAviationSafetyAuthorityandcivil aviationauthoritiesofotherstates,inconjunctionwithaircraftandmajorcomponentmanufacturers: Review the adequacy of the current standards for identifying the configuration and modification statusofmajorcomponentstoensurethatdifferencesbetweenmajorcomponentsofsimilarpart numberscanbeeasilyidentified. SAFETYRECOMMENDATIONAL/2004
BureauVeritasanalysis
Historyoffacts
On 15/01/1999, RollsRoyce issued SB.29C625 detailing modifications to the engine dressing. Rolls RoyceanticipatedtheissuanceofanAirbusServiceBulletin(SB),dated21/04/1999,offeringamodified hydraulicpump(inreactiontoseveralcasesofhydraulicfuelleakage). Modificationofthedressingconsistedofthereplacementofthethreefueltubesandtwohydraulictubes forthefrontandrearhydraulicpumps. On 28/04/1999, the aircraft Airbus A330 was registered to the operator. This aircraft was in a postmod (SB.29C625)status. On 31/07/2000, a postlease shop visit at HongKongAero Engine Services Limited (HAESL) planned to embody SB.29C625 (modification of the engine dressing) in a loaned engine. This embodiment wasnot doneduetopartsshortage. TheloanedEnginewasstoreduntil01/08/2001atanoperatorsfacilitiesinToronto,inapreSB.29C625 configuration,with: AReworkSummarySheetnotreferencingthenecessitytoembodySB.29C625 ACarryForwardItemsListrequiringpostSB.29C625frontandrearhydraulicpumps AnEngineLogBookreflectingtheactualpreSB.29C625configurationoftheengine.
Theloanedenginewasstoreduntil17/08/2001inarestrictedareaattheA330operatorsfacilities,inan asreceivedstatus(thatisavailabletootherNorthAmericanusers). When the loaned engine arrived at the operators facility, the review of documentation and receiving inspectiondidnotdetectthattheengineconditionwasinthepremod(SB.29C625)configuration.
55/93
FINALREPORT
ThepresenceofmetalparticlesontheA330originalrightengine,onFriday17August2001,requiredan unscheduled engine change. It was decided that the work could be done using inhouse resources, with theworkstartingatmidnightthesameday. To support the work requiredfor the enginechange, the relevant workcard package was extractedfrom the Airbus Documentation Retrieval System (ADRES). Because the premod configuration of the engine hadnotbeenidentified,noworksheetswereissuedtoaddresstheapplicableSBs. Therightenginereplacementoftheaircraftbeganaroundmidnighton17/08/2001. On 19/08/2001 morning, it was established that the rear hydraulic pump could not be fitted due to interference with the highpressure fuel pump inlet tube. A search through the Airbus IPC revealed the existenceofSB.29C625andofpreandpostSBconfigurations.Atthistime,theleadtechnicianrealized thatthereplacementenginewasinapreSBconfiguration,whiletheremovedenginewaspostSB. All attemptstoaccesstheSBfromRollsRoyceEIPCCDinstalledonthenetworkfailed,asaresultofa computernetworkmalfunction. Beingpagedforadvice,theTrentEngineControllerrecalledthatthemodifiedpumpinterferedwiththefuel lines, and that these would need to be replaced. He confirmed that, when the pump and lines were installed, adequate clearances existed between lines and components. The lead technician queried the possibilitiesofusingapremodpumptosavetime,becausetheworkwasalreadyrunninglate.TheEngine Controllerinformedthe leadtechnician that such a pump was not available on short notice. Both agreed thattherewasnochoiceotherthantoreplacethefueltubes. Both segments ofthe postSBfueltube assembly were takenfrom the removed engine andinstalled on the replacement engine. The preSB hydraulic tube, received with the loaned engine, was retained. Clearancebetweencomponentswasobtainedbypositioningandholdingthehydraulictube,whileapplying torquetotheBnut. TheRollsRoycerepresentativetelephonedMCCduringtheengineinstallationonSundaytoinquireabout the work progress and to offer help if required. He was informed that the premod status of the loaned (right) engine did not permit installation of the hydraulic pump and was informed that the fuel tube was being changed overfrom the removed engine to theloaned (right) engine to allow the pumpinstallation. TheRollsRoycerepresentativewasunawareoftheenginedressingSBmodificationstatusoftheloaned engineandofthestatusoftheoperatorsenginefleet.TheRollsRoycerepresentativewasnotspecifically toldofthedifficultiesinaccessingtheSBsnorwashespecificallyaskedtoconsulthisdocumentation.His offertoattendonsiteifrequiredwasnottakenup. The installation of the postmod hydraulic pump, the premod hydraulic tube and the postmod fuel tube assemblyresultedinamismatchbetweenthefuelandhydraulictubes. Following completion of the engine change on 19/08/2001 evening,the lead technician inspected all the workdoneandthetasksdocumentedontheworkcardsandadditionalworksheets.Theinspectionwasto ensure that the work was complete, within tolerances and secured. His inspection did not uncover any anomalywiththeengineinstallation. Another inspection called the independent inspection was done by a qualified technician, who had not beeninvolvedwiththeworkbeinginspected.Theindependentinspectionwasdonetoensurethatengine controlsareproperlyconnectedandsecured.Thisscopeofthisinspectionwasnotintendedtoincludethe fuelorhydraulicsystemcomponents. Followingtheseinspections,theenginewasgroundrun,withoutproblems,andwasreleasedforflight. Therewasno QualityControl(QC)representativeon siteonthe weekendoftheengineinstallation.The company plan was to do the documentverification when preparing the removed engine for shipmentfor repair. Asoftheoccurrencedate,24August2001,theenginechangedocumentationhadnotyetbeenreviewed bythequalitycontrolstaff. Areviewofthelogbook,aftertheaccident,showedthatentriesforallexpectedcomponentschangedover to the installed right engine had been properly made, signed and countersigned by the supervisor however,therecordingoftheunexpectedreplacementofthefueltubeswasnotdocumented.
56/93
FINALREPORT
Analysisoffacts
v DetectionandAdjustmentoftheLoanedEngineConfiguration The loaned engine has been kept stored over one year under the control of the engine manufacturers representative,withoutanyembodimentofSB.29C625. AsallotherRollsRoycepoweredA330flowninCanadawereofpostmodstatus,thiscreatedasensible gapbetweentheloanedengineconfigurationandtheinserviceengineconfigurations. Ontheonehand,keepingtheloanedengineina preSBconfigurationjeopardizeditsinterchangeability withanyinserviceengine.Furthermore,asnopremodpumpwasavailableonshortnotice,keepingthe loanedengineinapreviousconfigurationwasacontributingfactortoanincorrectenginereplacement. On the other hand, the detection of the preSB configuration of the loaned engine wasrendered difficult because: There was no information that would have caused a heightened concern regarding the configurationoftheloanedengine. The physical appearances of the preSB and postSB configurations are similar and cannot be identifiedthroughacursoryinspection. The part number of the hydraulic pump, as documented in the CarryForward Items List, was incorrectlyidentifiedasapostSBhydraulicpump,withapostSBPartNumber.
Thus, the existence of such preSB configuration was in itself a contributing factor to the incorrect assessmentoftheloanedengineconfiguration. Neither the Airbus IPC, nor RollsRoyce EIPC was referenced at the time of engine receipt, or during review by engineering prior to the engine installation. The approved MCM did not require that non mandatorySBsbecheckedwhenplanningforanenginechangeconsequently,acomparisonofSBswas notcarriedoutatthetimeofenginereceipt,norduringtheplanningoftheenginechange. IntheabsenceofarequirementtoconductanSBparitycheck,andofaneasytousemethodofcarrying thischeckout,therewasariskforincompatiblecomponentstobeinstalledonaircraftandnotbedetected bymaintenanceplanningprocesses.Then,determiningpartparityandensuringintegrityoftheinstallation oftherightenginerestedsolelywiththelevelofthetechnicianresponsiblefortheenginechange. The engine change was expected to last 36 hours. As the preconfiguration of the loaned engine was detected more than 30 hours after the beginning of the works, the timepressure factor to complete the workintimeforascheduledflightandtoclearthehangarforanupcomingeventmayhaveplayedarolein the incorrect engine replacement. Considering this matter of fact, there is no certainty that a successful access to the SBs would have prevented the decision that the fuel tube replacement was the only remainingrequirementtocompletethehydraulicpumpinstallation. Nevertheless, the presence of a quality control representative during the engine installation may have promptedthefullimplementationoftheSBpriortothereleaseoftheaircraft. v TrainingtoLinesInstallation Adequate clearance between the fuel and hydraulic lines was achieved during the installation of the hydraulicpumplinebyapplyingsomeforcetopositionthelineandholdingthelinewhileapplyingtorqueto the B nut. As there was a 90 bend in the tube adjacent to the B nut, and as a flexible line tends to straightenwhenpressurised,thismannertoachieveadequateclearancewascritical:thepressurizationof thehydrauliclinewouldhavebeensufficienttocausethehydrauliclinetomovebacktoitsnaturalposition andcomeincontactwiththefuelline,whichresultedinthechafingandfailureofthefuelline. The risk associated with the application of force while installing mixed construction lines was not well knowninthemaintenancecommunity,andwasnotcoveredinthetrainingofmaintenancetechnicians. v QualityControl Neithertheaircraftnortheenginelogrecordedthefuellinechangebecausethetechnicianforgottomake theentry.Inadditiontheverificationofthedocumentationassociatedwiththeenginechangecompletedon 18 August 2001 was not done before the occurrence flight. Consequently, the opportunityfor the quality assurancereviewofthedocumentationtodetecttheinstallationerrorwasnegated.
57/93
FINALREPORT
The presence of a quality control representative during the engine installation may have facilitated the research into the interference problem and the full implementation of the SB prior to the release of the aircraft.
Conclusions
The fact that the loaned engine was kept one year long in a preSB configuration with a CarryForward ItemsListreferencingpostSBparts,undertheresponsibilityofthemanufacturer,wasacontributingfactor toitswronginstallation. Furthermore,whenkeptundertheresponsibilityofthemanufacturer,theloanedenginewasneitherstored withanyinformationheighteningconcernregardingitspreSBconfiguration,normodifiedinawayallowing the visual detection of its configuration. Keeping the loaned engine in a preSB configuration, which physical appearance is similar to the postSB configuration and cannot be identified through a cursory inspection,wasacontributingfactortothewrongassessmentofitsconfiguration. In this case, the operator and the maintenance organisation are a sole company. A clear, accurate and consistent documentation was necessary to prevent that integrity and safety of an installation rest solely withthelevelofthetechnicianresponsibleforthetask.Nomatterifthejobcardsystemwasprovidedby the operator or by the maintenance organisation, the source documentation was the manufacturers documentation. Thus, nonquality of the manufacturers documentation was a contributing factor to non qualityofthetask. Nevertheless, the operator was required to perform a receipt inspection, to check the loaned engine configurationandensurethatitcomplieswiththemanufacturersspecifications. For those reasons, GPIAA, the Portuguese Aviation Accidents Prevention and Investigation Department, putforwardthefollowingsafetyrecommendation: Review applicable airworthiness regulations and standards, as well as aircraft, engines and component maintenance manuals, to ensure that adequate defences exist in the preinstallation, maintenance planningprocesstodetectmajorconfigurationdifferencesandtoestablishtherequiredsupportresources fortechniciansresponsibleforthework.SafetyRecommendationAK/2004 ThisrecommendationisimplementedinthePart145andPartMregulationsasfollows:
ThePart145Regulationrecommendsthat:Priortoinstallationofacomponent,theorganisation shallensurethattheparticularcomponentiseligibletobefittedwhendifferentmodificationand/or airworthinessdirectivestandardsmaybeapplicable.145.A.42(b)AcceptanceofComponents The Acceptable Means of Compliance (AMC) to Part 145 specifies that: The EASA Form 1 identifiestheeligibilityandstatusofanaircraftcomponent.Block13"Remarks"ontheEASAForm One in some cases contains vital airworthiness related information which may need appropriate and necessary actions. The receiving organisation should be satisfied that the component in questionisinsatisfactoryconditionandhasbeenappropriatelyreleasedtoservice.Inaddition,the organisation should ensure that the component meets the approved data/standard, such as the required design and modification standard. This may be accomplished by reference to the manufacturer'spartscatalogueorotherapproveddata(i.e.ServiceBulletin).Careshouldalsobe exercisedinensuringcompliancewithapplicableairworthinessdirectivesandthestatusofanylife limitedpartsfittedtotheaircraftcomponent.AMC145.A.42(b) ThePartMRegulation,inSectionASubpartEdedicatedtoComponents,recommendsthat:Prior toinstallationofacomponentonanaircraftthepersonorapprovedmaintenanceorganisationshall ensure that the particular component is eligible to be fitted when different modification and/or airworthinessdirectiveconfigurationsmaybeapplicable.M.A.501(b)Installation TheAcceptableMeansofCompliance(AMC)toPart145specifiesthat: 1. The EASA Form 1 identifies the airworthiness and eligibility status of an aircraft component. Block 13 "Remarks" on the EASA Form 1 in some cases contains vital airworthiness related information(seealsoPartMAppendixII)whichmayneedappropriateandnecessaryactions. 2. The fitment of a replacement components/material should only take place when the () maintenance organisation is satisfied that such components/material meet required standards in respectofmanufactureormaintenance,asappropriate.
58/93
FINALREPORT
3.The()approvedmaintenanceorganisationshouldbesatisfiedthatthecomponentinquestion meetstheapproveddata/standard,suchastherequireddesignandmodificationstandards.This may be accomplished by reference to the TC holder or manufacturer's parts catalogue or other approveddata(i.e.SB).CareshouldalsobeexercisedinensuringcompliancewithapplicableAD andthestatusofanyservicelifelimitedpartsfittedtotheaircraftcomponent.AMCM.A.501(b) Training to lines installation is taken into account by the Part 66 Regulation that establishes the basic 12 knowledge requirements for licensed maintenance personnel: the certified personnel should have a general knowledge of the theoretical and practical aspects of the subject, and an ability to apply that knowledge,concerning: Identificationof,andtypesofrigidandflexiblepipesandtheirconnectorsusedinaircraft Standardunionsforaircrafthydraulic,fuel,oil,pneumaticandairsystempipes. QualitycontrolissueistakenintoaccountbythePart145Regulation,statingthat: Theorganisationshallestablishaqualitysystemthatincludesthefollowing: 1. Independent audits in order to monitor compliance with required aircraft/aircraft component standards andadequacyoftheprocedurestoensurethatsuchproceduresinvokegoodmaintenancepracticesand airworthy aircraft/aircraft components. In the smallest organisations the independent audit part of the quality system may be contracted to another organisation approved under this Part or a person with appropriatetechnicalknowledgeandprovensatisfactoryauditexperienceand 2. A quality feedback reporting system () that ensures proper and timely corrective action is taken in responsetoreportsresultingfromtheindependentauditsestablishedtomeetparagraph(1).
145.A.65(c)Safetyandqualitypolicy,maintenanceproceduresandqualitysystem.
Causes and contributing factors that were attributable to the operator and to the maintenance organisationsarecoveredbythePart145andPartMregulations.Then,theonlymeanstopreventsuch anaccidentistoensurecompliancewiththecurrentregulatoryrequirements,togetherwithimprovingthe qualityofthemanufacturersdocumentation.
12
AppendixI ofthePart66regulation
59/93
FINALREPORT
Annex C Incident of aircraft A340, registration FGTUB, on 19/04/2002
60/93
FINALREPORT
Date:
AircraftType:
19/04/2002
Location:
AirbusA340
Injuriestopersons:
FGTUB
Damagestoaircraft:
ReunionIsland
Facts:INCIDENT
None
None
Emergencyreturnandlandingbecauseofsmokeinthecabin.
Causes:
Malfunction of an optocoupler in a lighting controller which led to overheating in the transformer, due to the installation of an overcalibrated fuse in the lighting controller. Overheatingofthelightingcontrollercasingcausedsmokeinthecabin.
Fumeenpostedepilotage(avril2002)
Source: http://www.beafr.org/itp/events/fumeepostepilotage/fumeepostepilotage.html(Novembre2007)
Droulementduvol Aprs une heure trente de vol, alors que l'avion, un A340, est en croisire au niveau de vol 310, l'quipagesentl'odeurcaractristiqued'uncourtcircuitlectriquepuisaperoitdelafume.Ilappliquela procdured'urgenceSMOKE/AVIONICSSMOKEetfaitdemitourversl'arodromededpart. Quelquesminutesplustard,lemessageCircuitBreakerTrippedIntegratedLight5LF(systmed'clairage intgr des panneaux et des instruments) s'affiche l'ECAM. La fume se dissipe. Aprs avoir vidang quarantetroistonnesdekrosne,l'quipageseposesansautreproblme. Au sol, il est constat dans la soute avionique que le disjoncteur 5LF INTG LT s'est dclench. Ce disjoncteur a pour fonction d'isoler le rseau en cas de dfaut sur la ligne d'alimentation entre la barre d'alimentationetl'entredesdeuxcontrleursd'clairagedupostedepilotage2LFet6LF(voirschmaci aprs).IlestgalementconstatquelefusibleAd'alimentationdubotierlightingcontroller2LF(botierde contrled'unepartiedel'clairageintgrdupostedepilotage)estd'unampragenettementsuprieur celuirequis(6,3Aaulieude0,4A)lefonddubotierprsenteunecouluredesurfaceimportanteetles paroislatralesetsuprieuresmontrentdestracesd'chauffement. Renseignementscomplmentaires Originedelafume L'examendel'quipementamontrquelafumeprovenaitd'unesurchauffeinternedutransformateurde puissance,surchauffeduel'alimentationsimultane,intempestiveetrptededeuxdesenroulements dutransformateur.L'anomaliedecommandedesenroulementsestissued'unedrivedefonctionnement del'undesoptocoupleursTIL188delacartedegestionlectroniqueducontrleurd'clairage2LF.Cette driveintervientdemanirealatoireenvieillissementsurcemodled'quipement. Comme il n'y a pas eu coupure dans les dix secondes, contrairement la spcification du fusible A du contrleur d'clairage 2LF, la surchauffe a entran une dtrioration profonde des enroulements, le processusdedgradationprogressantjusqu'cequeleseuildedclenchementdudisjoncteur5LF(3A) soitatteint. Nonconformitdufusible Lebotierd'clairage2LFavaitfaitl'objetd'unevolutiondestandardle23juin2000.Alasuited'incidents similaires celui d'avril 2002 (odeurs de brl et missions de fume), un Bulletin Service statut recommand avait prvu le renforcement du circuit imprim et l'adjonction d'un fusible de protection sur l'alimentation(fusibleA).Cebulletinavaittappliqul'avion.Nilabotedefusiblesderechangedans
61/93
FINALREPORT
l'avionnilestockdefusiblesderechangedel'organismed'entretienn'avaienttactualissilfautnoter queleBulletinServicenementionnaitpascetteactualisationdanslesdispositionsprendre. Un marquage spcifique sur le botier indiquant le calibre des fusibles avait t introduit sur les quipementsdlivrsaprsjuin2000pourfairesuiteauxerreursconstatesrgulirementlorsduretour d'quipements chez le fabriquant. Toutefois les documents de rfrence, l'exception de l'Aircraft Maintenance Manual, n'ayant pas encore t mis jour ne reprsentaient pas ces marquages additionnels. Remarque:lesindicationsgravessurlesfusiblescorrespondentauxspcificationsmaissontdifficiles dchiffrer de plus, elles sont diffrentes de la rfrence de pice (part number) figurant dans la documentationladispositiondel'intervenant. UneSIL(ServiceInformationLetter),rappelantauxexploitantslesstandardsexclusifsemployerlorsde remplacements des fusibles, avait t mise par le constructeur le 29 mars 2002, mais elle n'aurait t reueparl'exploitantquele5juin,soitpostrieurementl'incident. Il n'existe aucune trace dans les documents de maintenance quant une ventuelle intervention sur le fusibleA.Toutefois,ilyavaiteuuneinterventionenlignedixjoursavantl'incidentlorsdelaquelle,lesdeux fusiblesdubotier2LFavaienttvrifisencontinuit,positionaprsposition.cetteoccasion,lefusible Javaittconstatdfectueux,avecuncalibrede0,4Aaulieude6,3,etremplacparcroisementavec le fusible N du lighting controller 6LF. Le vol avait ensuite t effectu en tolrance technique. Cette interventionimpliquantaussiquelefusibleAavaittcontrletconsidrcommeconforme,onnepeut exclurequ'unesubstitutionsesoitproduiteparerreurcetteoccasion. Parailleurs,l'exploitantavrifiausolquelatenued'unfusibledecalibrage0,4AenpositionJn'taitpas affecte par la mise en fonctionnement du systme en consommation maximum, mme pendant une dure significative ceci conduit penser que l'origine de la nonconformit de cefusible pouvaitmme remonter la fabrication avec un montage selon la configuration croise observe (fusibles de 6,3A en positionAet0,4AenpositionJ). Ainsi, il n'est pas possible de dater le montage du fusible non conforme.Il est clair toutefois que les oprationsd'entretienn'ontjamaismisenvidencel'inadquationducalibredufusibleA. Remarquessurlapropagationdelafume. Iln'yapaseud'alarmededtectiondefume,bienquelasouteavioniquesoitquipededtecteurs ionisation au niveau de ses arations[1] . La courte dure d'mission de la fume, ainsi que la probable dilutiondecelleciparleflotd'airdelaconduited'aration,peuventexpliquercenondclenchementdes alarmes. Il convient de noter que la philosophie de conception d'Airbus en matire de lutte contre le feu exclut l'utilisation de matriaux inflammables dans la soute avionique. Une fume dans cette zone ne pourrait doncprovenirqued'unfeulectriquencessairementlimit. Enseignements A la suite de l'vnement, une campagne de vrification de conformit du standard des fusibles a t effectueparl'exploitantauseindesaflotted'A340.Deplus,lesTIL188,deconceptionancienne,ontt remplacspardesMOC8050. Lescirconstancesdecetincidentneconduisentpas remettreencauselescaractristiquestechniques del'avionoulaprocdureappliqueparl'quipage.Enrevanche,cetvnementamisenvidence,une nouvellefois,lerledetouslescomposantsd'unavionenmatiredescurit:ilestdoncindispensable que les documents et procdures d'entretien soient prcis et complets et que le systme de retour d'exprienceyveilleenpermanence,audeldessimplesmodificationsdedtail.
[1]
Cesdtecteursnesontpasobligatoires.
62/93
FINALREPORT
63/93
FINALREPORT
BureauVeritasanalysis
Historyoffacts
On23/06/2000,wasissuedaServiceBulletin(SB)detailingmodificationstotheLightingController2LF(in reactiontoseveralcasesofsmellofburningandsmoke). Modification of the lighting controller consisted of the reinforcement of the printed circuit, and of the additionofaprotectingfuse(fuseA)ontheelectricitysupply. ThisSBwasembodiedintheA340aircraft,withoutupdatingthesparefuseboxesintheaircraftandinthe maintenanceworkshop.SuchrequirementwasnotmentionedintheSB. After June 2000, the manufacturer added a specific marking on the lighting controller casing, clearly indicating fuse calibres (in reaction to several cases of errors). Except the Aircraft Maintenance Manual, otherreferencedocumentswerenotupdatedwiththisadditionalmarking. Indications engraved on fuse corresponded to specifications, but were hard to decipher. Moreover, they differedfromthepartnumberappearingintheavailabledocumentation. NomaintenanceoperationhighlightedtheincorrectcalibreoffuseA. On29/03/2002,themanufacturerissuedaServiceInformationLetter(SIL)tooperators,recallingstandard requirementsforthefusereplacement. TheA330operatorreceivedthisletteron05/06/2002,aftertheincidentwhichoccurredon19/04/2002.
Analysisoffacts
This event highlights the role played by all aircraft components to ensure safety: a clear, accurate and consistentdocumentationisnecessarytopreventthatintegrityandsafetyofaninstallationrestsolelywith thelevelofthetechnicianresponsibleforamaintenancetaskoramaintenancecheck. No matter if the job card system was provided by the operator or by the maintenance organisation, the source documentation was the manufacturers documentation. Thus, nonquality of the manufacturers documentationwasacontributingfactortononqualityofthetask.
Conclusions
Causes and contributing factors that were attributable to the operator and to the maintenance organisationsarecoveredbythePart145andPartMregulations.Then,theonlymeanstopreventsuch anaccidentistoensurecompliancewiththecurrentregulatoryrequirements,togetherwithimprovingthe qualityofthemanufacturersdocumentation.
64/93
FINALREPORT
Annex D List of incidents/accidents related to maintenance documentation
65/93
FINALREPORT
BUREAU VERITAS selected fourteen events which took place from 2004 until 2006, in the field of the Europeanpublicairtransport,andwhicharerelatedto themaintenancedocumentation. Theselectedevents(includingtwoeventsforyear2007)arethefollowing: 1occurrencefromtheCzechAIBwebsite(http://www.uzpln.cz): v Incident of aircraft Airbus A320200, registration FGKXJ, at Prague/Ruzyne Airport, on12February2006(FinalReportRef.No040/06/ZZ). 1occurrencefromtheGermanAIBwebsite(http://www.bfuweb.de): v AccidentofaircraftFokkerF28Mark0070,nearMunichAirport,on5January2004(Investigation ReportRef.NoAX0010/04). 1occurrencefromtheNorwegianAIBwebsite(http://www.aibn.no): v Accident of aircraft ATR 42320, registration OYJRJ, at Bergen Airport, on 31 January 2005 (ReportRef.SLRAP.:8/2006). Note:ThisreportwasalsoputatourdisposalbyEASAontheCIRCAwebsite. 1occurrencefromtheSwedishAIBwebsite(http://www.havkom.se/indexeng.html): v Accident of aircraft Piper PA 31310, registration SEGIT, at Umeaa Airport, on 13 March 2006 (ReportRef.RL2007:8e). 8occurrencesfromtheUKAIBwebsite(http://www.aaib.gov.uk/): v AccidentofaircraftBoeing73759D,registrationGBVKC,atCardiffAirport,on21February2004 (ReportRef.EW/C2004/02/03). v Incident of aircraft Boeing 777236, registration GYMME, at London/Heathrow Airport, on10June2004(ReportRef.EW/C2004/06/01FormalReportNo2/2007). v Accident of aircraft Fairey BN2A Mark III2 Trislander, registration GBEVT, at Guernsey Airport, on23July2004(ReportRef.EW/C2004/07/06FormalReportNo1/2006). Note:ThisreportwasalsoputatourdisposalbyEASAontheCIRCAwebsite. v Incident of aircraft Fokker F28 Mark 0100, registration GBXWE, at London/Heathrow Airport, on14August2004(ReportRef.EW/C2004/08/01). v Incident of aircraft BAE ATP, registration GJEMC, 10 miles southeast of Isle of Man Airport, on23May2005(ReportRef.EW/C2005/05/05FormalReportNo1/2007). v Incident of aircraft Avro 146RJ100, registration GCFAA, at Birmingham Airport, on26September2006(ReportRef.EW/G2006/09/26). v Incident of aircraft BAE Systems Jetstream 4100, registration GMAJI, at Durham Tees Valley Airport,on26February2007(ReportRef.EW/G2007/02/11). v Accident of aircraft DHC6 Twin Otter Series 310, registration GBZFP, at Glasgow Airport, on22March2007(ReportRef.EW/G2007/03/10). 4occurrencesfromtheIrishAIBwebsite(http://www.aaiu.ie): v Incident of aircraft Airbus A321200, registration EICPD, en route London to Dublin, on26January2004(ReportNo2005020). v Incident of aircraft Airbus A330301, registration EIJFK, at Dublin Airport, on 4 June 2004 (ReportNo2006006). v Incident of aircraft ATR 42300, registration EIBYO,en route to Cork Airport, on 5 August 2005 (ReportNo2006029). Note:ThisreportwasalsoputatourdisposalbytheECCAIRSsteeringcommittee(BEA). v IncidentofaircraftAirbusA300301,registrationEICRK,atShannonAirport,on18August2005 (ReportNo2007011).
Facts,causesanddamageslinkedtotheselectedoccurrencesaresummarizedinthefollowingtable.(See Table D 1: List of incidents/accidents related to maintenance documentation.)We have added our conclusionsregardingthecauses(andthepossiblesafetyrecommendations),whichhavebeendrawnby theAccidentInvestigationBoards.
66/93
FINALREPORT
TableD1:Listofincidents/accidentsrelatedtomaintenancedocumentation
Date: AircraftType: AircraftRegistration: Location: Injuriestopersons: Damagestoaircraft:
05/01/2004
Facts:ACCIDENT
FokkerF28Mk0070
Notreported
NearMunichAirport
Causes:
Threeminorinjuries
Fuselageseverelydamaged
Emergencylandingbecauseofheavyvibrationsontheright handengineandunusualnoisescomingfromtherearofthe airplaneduringtheapproach.

BUREAUVERITASconclusions:
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningapplicable,clearinstructions forthebondingoftheiceimpactpanels.
Thevibrationsontherighthandengineandnoisesintherearoftheairplaneweretobe attributedtoiceformationonthefan.Improperpreparationofthebondingsurfaces,ingress ofmoistureandpoorelasticityoftheadhesivecausedthebondedjointsoftheiceimpact panelstoprogressivelyfailoveranextendedperiodoftime.Theinstructionoftheengine manufacturerforthebondingoftheiceimpactpanelswasdifficulttoaccomplishand unclearconcerningthepreparationofthebondingsurfaces. Aftertheconclusionoftheinvestigation,theGermanFederalBureauofAircraftAccidents Investigationhasissuedthefollowingsafetyrecommendation: Recommendationno.09/2005:TheLuftfahrtBundesamtresponsibleforthetypesupport oftheRollsRoyceTAY62015engineshouldcheck: Iftheenginemanufacturereliminatedtheerrorsanddeficiencies,asrevealedbythe investigation,inthemanufacturersinstructionsfortheimplementationoftheiceimpact panelmodification Ifthedeficienciesfoundinthemanufacturersinstructionsareattributabletofundamental deficienciesoftheenginemanufacturer'squalityassurancesystem.
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
26/01/2004
Facts:INCIDENT
AirbusA321200
EICPD
EnrouteLondontoDublin
Causes:
None
None
EmergencydescentanddiversiontoCardiffAirportbecauseof TheflightcrewreportedanoisefromtheforwardholdareaontheinboundflighttoLondon. rapiddepressurisation. FollowinganormallandingatHeathrowablowoutpanelwasfoundopen.Asaninspection revealednothingabnormal,thepanelwasclosed.Amoreexhaustivesearchontheground BUREAUVERITASconclusions: couldhaverevealedtheloosebellowsandbrokenclamp.ThemanufacturersTrouble Acorrectmanufacturersdocumentationmayhavehelpedto ShootingManualdirectspersonnel,onfindingablowoutpanelintheopenposition,to preventthisincident,mentioningdetailedinstructionsto examinethepackoutletbellowsforcorrectcondition. inspectthebellowswhenablowoutpanelisfoundopen. TheTroubleShootingManual(TSM)wasamendedinMay2004andtheAircraft MaintenanceManual(AMM)inMay2005andnowincludesadirectionandmethodfora detailedinspectionofthePackOutletCheckValve(POCV)flappersaspartofageneral inspectionofthebellowswhenablowoutpanelisfoundopen.
67/93
FINALREPORT
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
21/02/2004
Facts:ACCIDENT
Boeing73759D
GBVKC
CardiffAirport
Causes:
None
Damagetoleftmainlanding gear
Steeringdifficultiesandshimmyingduringbrakingaftera normallanding.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningclearinstructionstoprevent anexcessiveplayintheantitorquelinksapexjoint.
Theshimmyingresultedfromexcessivewearofthetorsionlinkapexjointthatreducedthe effectivenessoftheshimmerdamper.Maintenancerecordsindicatedthatthemainlanding gear(MLG)hadbeenmaintainedinaccordancewiththemanufacturersrecommendations, butitwasconsideredthatrelevantAircraftMaintenanceManual(AMM)procedurescould bedifficulttofollow. Asaresult,AAIBconsideredthatmeasures,includinganassessmentoftheneedfor improvedmethodsofcheckingforexcessiveplayinthetorsionlinkapexjointandan increasedcheckfrequency,improvementtorelevantsectionsoftheAMMandassessment oftheneedformodificationofthejoint,needtobeimplemented. Thefollowingsafetyrecommendationhasbeenmade: SafetyRecommendation2004103:TheFederalAviationAuthorityandtheBoeing CommercialAirplaneGroupshouldtakeeffectivemeasuresaimedatpreventingfurther casesofBoeing737mainlandinggearshimmyandresultanttorsionlinkfracturingbrought aboutbyexcessiveplayintheantitorquelinksapexjoint.
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
04/06/2004
Facts:INCIDENT
AirbusA330301
EIJFK
DublinAirport
Causes:
None
None
EmergencyreturnandlandingwithNo2engineinoperative becauseofafirealarminthisengine.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,directingattentiontotheTTUwirelocking andductlengthadjustment.
Thetolerancetakeup(TTU)adjustmentsleeveshadseparatedanditsinnerductsuffered distortion.Tensionloadinginthe14thStageManifold,duetotheunsupportedduct,initiated afatiguefractureinthecoupling,whichthenfailed.AVbandclampatthe14thStage Manifoldlowerengineportdetached,allowinghotair(greaterthan600C)tobleedintothe enginecorecompartment. Onthe10thFebruary2005theManufacturerissuedanAllOperatorLetter(AOLCF680E NAC012)advisingoperatorsofarequirementtoinspectthelockwireinstallationonthe TTUduct.AServiceBulletin(CF680E1NAC71039)wasalsoissuedwhich,besides directingattentiontotheTTUwirelockingandductlengthadjustment,alsoprovides recommendedmaintenanceproceduresandadjustmentcheckstotheenginebleedsystem hardwareinstallation.
68/93
FINALREPORT
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
10/06/2004
Facts:INCIDENT
Boeing777236
GYMME
London/HeathrowAirport
Causes:
None
None
Emergencyreturnandlandingbecauseoffuelleakingfrom thecentrewingfueltank.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningcrossreferenceswithinthe AMMaboutthepurgedoor.
Thefuelleakwascausedbyfuelescapingfromthecentrewingtankthroughtheopen purgedoor.ThepurgedoorwasremovedfromGYMMEduringbasemaintenance, between2Mayand10May2004,andnotreinstalledpriortodeparture.Contrarytothe maintenanceorganisationsprocedures,theremovalofthepurgedoorwasnotrecordedon adefectjobcard. Thecentrewingtankleakcheckdidnotrevealtheopenpurgedoorbecause: a.ThepurgedoorwasnotmentionedwithintheAMMproceduresforpurgingandleak checkingthecentrewingfueltank. b.Withnorecordofthepurgedoorremoval,thevisualinspectionforleaksdidnotinclude thepurgedoor. c.Thefuelquantityrequiredtoleakcheckthepurgedoorwasincorrectlystatedinthe AMM. AwarenessoftheexistenceofapurgedoorontheBoeing777waslowamongthe productionstaffworkingonGYMME,dueinparttoanabsenceofcrossreferenceswithin theAMM.
Location: Injuriestopersons: Damagestoaircraft:
Date:
AircraftType:
23/07/2004
Facts:ACCIDENT
FaireyBN2AMarkIII2 Trislander
GBEVT
GuernseyAirport
Causes:
Twosevereinjuries
Substantiallydamaged
Emergencyreturnandlandingbecauseofinjuredpassengers andabrokencabinwindow.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,stressingtheimportanceofthefiller.
Theaccidentwascausedbytheseparationofadeicerbootfromtheleftpropellerduring takeoff.Thedeicerbootseparatedduetopeelstressesgeneratedbyforcesonthe propeller.Thepeelstressesarosebecauseofphysicalorcontaminationdamagetothe adhesivebondwhichoccurredbecausetherequiredfillermaterialwasnotusedattheroot ofthedeicerboot. Thepropelleroverhaulagencyhadoverhauledapproximately100propellerswithoutusing therequiredfiller.Thisinvestigationhasnotdeterminedthereasonwhyfillerwasnot appliedotherthanthatitwasprobablyrelatedtoarealorperceivedsupplydifficulty.The importanceofthefillermaynothavebeenrealisedfully,sincesomedeicerbootswithshort leadstrapsareinstalledwithoutthefiller.
69/93
FINALREPORT
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
14/08/2004
Facts:INCIDENT
FokkerF28Mk0100
GBXWE
London/HeathrowAirport
Causes:
None
None
Landingcommittedwithanoselandinggearunsafeindication. ThenoselandinggearwasreplacedinJune2003,followingatowingincident.Theaircraft experiencedanoselandinggearunsafeconditiononapproachon26September2003.No BUREAUVERITASconclusions: anomalieswerefoundduringtroubleshootingafterthiseventandthefollowingonein August2004. Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningclearinstructionstoobtainan OnreviewingtheAircraftMaintenanceManual(AMM)procedureforcheckingthedownlock accuratemeasurementofthedownlockplungerclearance. plungerclearance,theairline'sEngineeringQualityDepartmentnotedthattheprocedure wasambiguous,inthatitdidnotmakeitclearthatitisnecessarytoapplyarearwardforce onthenoselandinggearwhencheckingthedownlockplungerclearance.Failingtodoso willresultinanincorrectmeasurementbeingobtained. Inresponsetotheairline'srecommendation,theaircraftmanufacturerhasagreedtoamend AMMtoincludeasteptoclarifythatasecondpersonisrequiredtoapplyarearwardforce tothenosegearwhenmeasuringthedownlockplungerclearance,inordertoobtainan accuratemeasurement.
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
31/01/2005
Facts:ACCIDENT
ATR42320
OYJRJ
BergenAirport
Causes:
None
Damagetotherightelevator
Immediatereturnandemergencylandingduetocontrol problemsrelatedtotheelevatorfunction.
Theselflockingnutshavenotbeentightenedwiththerequiredtorquewhentheelevator wasfitted,followingamajorserviceandrepaintoftheaircraftin1999. Thefollowingsafetyrecommendationhasbeenmade: Incorrectinstallationofthenutsonthehingeboltsontheelevatorwasnotdiscovered. Themanufacturersmaintenancedocumentationdoesnotspecifythatinstallationof elevatorsmustbedoublechecked. Themaintenanceorganisationhasresponsibilityforidentifyingwhichmaintenancetasks andprocessesarecriticaltosafetyandrequirespecialmeasuresfordiscoveringand correctinganyerrorsfound.
70/93
FINALREPORT
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisaccident,mentioningthatinstallationofelevators mustbedoublechecked.
Atthesametime,theoperatorisresponsibleforspecifyingwhatmaintenanceworkshould becarriedout,andtowhatstandarditshouldbecarriedout,whenitpurchases maintenanceservicesfromamaintenanceorganisation. IntheopinionoftheAIBNthisdivisionofresponsibilitymayleadtothesystematic assessmentandspecificationofwhichtasksshouldbedoublecheckednottakingplace. Forthisreason,theAIBNrecommendsthatJAA/EASAconsiderwhethertheregulations shouldbeamendedinorderthatsystemsthatarecriticaltosafetyaredoublechecked followingmaintenancework. Specialconsiderationshouldbemadeastowhetherthemanufacturershouldbegivena responsibilityonthismatter. (AIBNrecommendation12/2006).
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
23/05/2005
Facts:ACCIDENT
BAEATP
GJEMC
10milessoutheastofIsleof ManAirport
Causes:
None
Emergencyreturnandlandingbecauseofmistinginthe forwardsectionofthecabin.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisaccident,mentioninginspectionorchecks requiredontheairstairsoperatingsystem.

Date: AircraftType: AircraftRegistration:
Thefailureofthehydraulicsealassociatedwiththeairstairsoperatingmechanismoccurred inflightthisresultedinthefluidcontentsofthemainhydraulicsystembeingdischargedas afinemistintothepassengercabin.Atthetimeoftheincident,therewerenoperiodic inspectionormaintenancechecksrequiredontheairstairsoperatingsystem.
Location:
Injuriestopersons:
Damagestoaircraft:
05/08/2005
Facts:INCIDENT
ATR42300
EIBYO
EnroutetoCorkAirport
Causes:
None
None
Abnormalparametersduringtheflightandtheapproachdue tofromNo1engineprogressivelossofpower.
FuelleakedfromthefuelflowdividerofNo.1engineduringflightcausingalossofengine power.Anutonthefuelflowdividerwasincorrectlywirelockedandallowedthenuttoback off,therebycausingthefuelleakage. TheOperatorfoundthatanincorrectthrustpinconfigurationmaybefoundduetoanerror intheengineshopCleaningInspectionandRepairManual(CIR). TheaboveCIRManual720920page901/902wasamendedbytheenginemanufacturer on25November2005.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioninginstructionstoensurea correctthrustpinconfigurationonthefuelflowdivider.
71/93
FINALREPORT
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
18/08/2005
Facts:INCIDENT
AirbusA300301
EICRK
ShannonAirport
Causes:
None
None
Immediateturn,emergencydescentandoverweightlanding becauseofpressurisationproblems.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningclearinstructionsandusing clearmarkingsfortheinstallationoftheaftcargodoorseal.
Theabsenceofadequatepressurisationwasduetoafaultyinstallationoftheaftcargodoor seal.Thedoorsealhadnotbeencorrectlyinstalledastheaircraftmanufacturerintended. SafetyRecommendationsweremade: 1.TheaircraftmanufacturershouldreviewtheinstructionsgivenintheAMMinorderto makethemlessambiguous. 2.Theaircraftmanufacturershouldimprovethemarkingsonthesealinordertoidentifyits orientationinthedoorretainerduringinstallation.
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
12/02/2006
Facts:INCIDENT
AirbusA320200
FGKXJ
Prague/RuzyneAirport
Causes:
None
None
Immediatereturnandemergencylandingbecauseofalossof powerontherighthandengineaftertakeoff.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningproperchecksinthe maintenanceprocedureofaircraftwithgiventypesofengines.
ThePS3sensorhosehadbeendamagedduetocontactwiththestarterairsupplytube. Thelastrepairinthisplacewascarriedouton21January2006.Thelikelycauseofthe failurewasthatclearancebetweenthePS3sensorhoseandthestarterlowerairsupply ducthadnotbeenadjustedproperlywhenassemblingthehose.Thatmadethehose comesincontactwiththeairtubeduringengineoperation,leadingtodamageofthehose thatwasdifficulttodetectvisually. Thefollowingsafetyrecommendationhasbeenmade: Basedonwhattheaircraftoperatorlearnedfromthehosedamage,anumberofaircraft withCFM56engineswerecheckedforenoughspacebetweenthePS3sensorhoseand thestarterlowerairsupplyducttomakesurethehosewillnotcomeincontactwiththeair tube. TheCivilAviationAuthorityshouldverifyifthereareproperchecksinthemaintenance procedureofaircraftwithCFM56B4enginesinoperationtomakesurethePS3hoseand thestarterlowerairsupplyductwillnotgetincontact.
72/93
FINALREPORT
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
13/03/2006
Facts:ACCIDENT
PiperPA31310
SEGIT
UmeaaAirport
Causes:
None
Emergencylandingbecauseofafailureontheleftmain landinggearduringtheapproach.
Thelandinggeardoorhadfatiguedamagesandhadbrokenduringthegearextension.The incidentwascausedbyaninadequatedirectivefromthemanufacturerinrespectofcrack inspectionoftheinboardmainlandinggeardoorfrontsuspensionarrangement. SwedishAIBrecommendedthatEASAtakesactionsothatthehingeassembliesofthis particulartypeareinspectedatsuitableintervalsinrespectofcrackgeneration. (RL2007:08eR1).
Asthisaccidentwascausedbyaninadequatedirectivefrom themanufacturer,acorrectmanufacturersdocumentation mayhavehelpedtopreventthisaccident.

Date: AircraftType: AircraftRegistration:
Location:
Injuriestopersons:
Damagestoaircraft:
26/09/2006
Facts:INCIDENT
Avro146RJ100
GCFAA
BirminghamAirport
Causes:
None
None
Immediatereturnandemergencylandingbecauseofsmokein Theoilcontaminationoftheairconditioningsystemoccurredduringthepreviousflight,due thecabindeck. tointernaldamagetoNo2engine.Itsremovalhadnotbeencarriedoutsuccessfullyduring themaintenanceactivities.Groundrunningfollowingthereplacementoftheenginedidnot BUREAUVERITASconclusions: involvefullfunctioningoftheairconditioningsystem. Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningfullfunctioningoftheair conditioningsystemafterthereplacementoftheengine.
Date: AircraftType: AircraftRegistration: Location: Injuriestopersons: Damagestoaircraft:
26/02/2007
Facts:INCIDENT
BAESystems Jetstream4100
GMAJI
DurhamTeesValleyAirport
Causes:
None
None
Priortotakingoff,whenconductingthefullandfreeflight controlchecks,arestrictionwasfeltintheelevatorcircuit.
Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningappropriatefrequencyof lubricationoftheflightcontrolsgustlocksystem.

73/93
Examinationrevealedthattherewasalackofappropriatelubricationofthegustmechanism associatedwithanelevatorcircuit.Asaresultofthisfinding,theoperatornowapplies lubricationonanannualbasis,insteadofonceeveryfouryears,andthemanufacturer is amendingtheMaintenanceScheduletoincreasethefrequencyoflubricationoftheflight controlsgustlocksystem.
FINALREPORT
Date:
AircraftType:
Location:
Injuriestopersons:
Damagestoaircraft:
22/03/2007
Facts:ACCIDENT
DHC6TwinOtter Series310
GBZFP
GlasgowAirport
Causes:
None
Damagetonoselegand fuselageskin
Whilsttaxiingafterlanding,thelowersectionofthenose landinggear,includingthewheel,detachedformthenoseleg.
Thisresultedfromcorrosiondamagetothescrewthreadsofalocknutusedtosecurethe wheelforktothelowerextremityoftheslidingelementoftheoleostrut. Asaresultofthisaccident,theoperatorhasreviseditsmaintenanceproceduresasfollow:
1.InlightofthecompanysfrequentoperationoftheTwinOtterfrombeachlandingstrips: a.Theaircraftsmaintenanceprogramhasbeenamendedtoincludedisassemblyand Acorrectmanufacturersdocumentation mayhavehelpedto inspectionoftheshockstrutpistontubeandlocknutassembly,tocheckfor preventthisaccident,givingguidanceaboutcorrosion corrosion,aspartoftheannualinspection. inspectionsandcorrectcapfitting. b.Theoperatorhasobtainedapprovalfromthemanufacturerforwetassemblyofthe locknuttothepistontube,usinganapprovedprimer,inaccordancewithprocedures laiddowninthemanufacturersCorrosionPreventonManual. Acorrectdocumentationrefersto: c.Theintervalbetweeninspectionsofthetorquelinkshasbeenreducedfrom2,400 existingdocumentation hoursto200hours. intimedocumentation 2.Norubbersealingdisc(oranyotherpartnotcalledupintheappropriatedocumentation) ispermittedtobeinstalled,andaqualityandsafetynoticehasbeenissuedstressing updateddocumentation adherencetotheCMM. completedocumentation 3.Themanufacturersattentionhasbeendrawntothelackofguidanceinthemaintenance accuratedocumentation manualregardingtheneedtoensurethatthecapfittingatthelowerattachmenttothe fuselageisinstalledthecorrectwayup.Themaintenancemanualinstructionscalledsimply erroneousdocumentation forthecaptoberefitted,andcontainednocautionhighlightingthepossibility,orthe simpledocumentation implications,ofitbeingfittedupsidedown.Whilstawaitingaresponsefromthe manufacturer,theoperatorhasissuedadditionalguidance,inaccordancewithitsown adequatedocumentation. internalprocedures,whichsupplementthemaintenancemanualinstructionsinthisregard.
74/93
FINALREPORT
Annex E Risk assessment
75/93
FINALREPORT
Through the analysis of collected data on common practices between operators and maintenance organisations throughout Europe, BUREAU VERITAS identified six scenarios that describe existing relationshipsbetweenoperatorsandmaintenanceorganisations(See4DataAnalysis).Risksrelatedto these scenariosarepresentedinthefollowingtables(SeeTableE1:Risksrelatedtoscenarios1&2 betweenoperatorsandMROs,TableE2:Risksrelatedtoscenarios3&4betweenoperatorsand MROs,andTableE3:Risksrelatedtoscenarios5&6betweenoperatorsandMROs). Thissixscenarioscorrespondtotheexistingsituation,whichcorrespondstotheDonothingOption1of theRulemakingTaskn145.020.RisksrelatedtotheotheroptionsofthisRulemakingTaskarepresented inTableE4:RisksrelatedtotheOptions2,3and4oftheRulemakingTaskn145.020. Solutionstomitigatetherisksareproposedundereachrisk,inthisway. TableE 1:Risksrelatedtoscenarios1&2 betweenoperatorsandMROs Scenario1: Scenario2: TheMROprintsthetaskcards TheMROprintsthetaskcardsfromthe fromtheoperator'sAMMby connectedoperator'sAMMbyusingthe usingtherelatedjobcard relatedjobcardsystem system Significantextracostmayresultforthe operatortoensurethatthemaintenance packageiscomplete,includingallrelevant mandatorytasksandinspections S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrollingthe correctcompletionofthetasks Significantextratimemayresultforthe operatortoensurethatthemaintenance packageiscomplete,includingallrelevant mandatorytasksandinspections S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrollingthe correctcompletionofthetasks Theoperatormayfacedifficultiestoensure thatthemaintenancepackageiscomplete, includingallrelevantmandatorytasksand inspections S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrollingthe correctcompletionofthetasks Thenotionanddetectionofdefectsmay differfromanoperatortoanother,creating discrepancieswiththeexpectedresultsfor theoperator(asregardsitssupervision authoritysrequirements) S2:Standardizationoftheinterpretation oftheregulatorytextthatisallowedby thesupervisionauthoritiesmayhelpto preventdiscrepancieswiththeexpected results
Financialrisksforthe operator
Organisationalrisks fortheoperator
Safetyrisksonthe operator'sside
76/93
FINALREPORT
Safetyrisksonthe MRO'sside
TheMROworkersmayfeel TheMROmayomittocarryoutarequired overconfidentbecauseofawell taskrelatedtothestatusoftheaircraft knowndocumentation(riskofno S4:Standardizationofthetaskcards consultationofthe includingspecifictagstointroduce documentation) operatorsspecifictasksand S3:Raisingconsciousness requirementsmayhelpMROstopay onrisksrelatedto attentiontosuchdata complacencyduring continuoushumanfactors trainingmayhelptoprevent suchhumanerror
TableE 2:Risksrelatedtoscenarios3&4 betweenoperatorsandMROs Scenario3: Scenario4: TheMROprintsthetaskcardsfrom TheMROusestheoperator'stask theoperator'sAMMbyusingits cardsinadditionwithitsownjobcard ownjobcardsystem system Significantextracostmayresultfor theoperatorwhentheMROprovides maintenancedatafeedbackwitha paperworkwhichisnotcompatible withtheoperatorssystem S1:Standardizationofthetask cardsandofproceduresonhow tofillthemmayhelpoperators whentransferringthefeedback informationintheirrecordsystem Significantextracostmayresultfrom theplanningprocessfortheMRO,when theoperator'staskcardsarenotsuitable fortheMROprocesses(e.g.production control)ortheMROqualification structure S5:Standardizationofthetaskcards includingPart145requirementsmay helpMROstointroduce(under specifictags)specifictasksand requirementsrelatedtotheir processesandprocedures
Financialrisksfor theoperator
Financialrisksfor theMRO
Significantextratimemayresultfor theoperatorwhentheMROprovides maintenancedatafeedbackwitha paperworkwhichisnotcompatible Organisationalrisks withtheoperatorssystem fortheoperator S1:Standardizationofthetask cardsandofproceduresonhow tofillthemmayhelpoperators whentransferringthefeedback informationintheirrecordsystem
77/93
FINALREPORT
Scenario3: Scenario4: TheMROprintsthetaskcardsfrom TheMROusestheoperator'stask theoperator'sAMMbyusingits cardsinadditionwithitsownjobcard ownjobcardsystem system Significantextratimemayresultfrom theplanningprocessfortheMRO,when theoperator'staskcardsarenotsuitable fortheMROprocesses(e.g.production control)ortheMROqualification structure S5:Standardizationofthetaskcards includingPart145requirementsmay helpMROstointroduce(under specifictags)specifictasksand requirementsrelatedtotheir processesandprocedures Theoperatormayfacedifficultiesto Thenotionanddetectionofdefectsmay differbetweentheoperatorandthe recordseveraldifferentMRO'swork MRO,creatingdiscrepancieswiththe cardswhichlayoutsaredifferent expectedresultsfortheoperator(as S1:Standardizationofthetask cardsandofproceduresonhow regardsitssupervisionauthoritys requirements) tofillthemmayhelpoperators whentransferringthefeedback informationintheirrecordsystem Theoperatormayfacedifficultiesto ensurethatthemaintenancepackage iscomplete,includingallrelevant mandatorytasksandinspections S1:Standardizationofthetask cardsandofproceduresonhow tofillthemmayhelpoperators whencontrollingthecorrect completionofthetasks Safetyrisksonthe operator'sside Atranscriptionerrormayoccurwhen transferringmaintenancedata feedbackintotheoperator'srecords system S1:Standardizationofthetask cardsandofproceduresonhow tofillthemmayhelpoperatorsto preventsucherrorwhen transferringthefeedback informationintheirrecordsystem Thenotionanddetectionofdefects maydifferbetweentheoperatorand theMRO,creatingdiscrepancieswith theexpectedresultsfortheoperator (asregardsitssupervisionauthoritys requirements) S2:Standardizationofthe interpretationoftheregulatory textthatisallowedbythe supervisionauthoritiesmayhelp topreventdiscrepancieswiththe expectedresults
78/93
Organisationalrisks fortheMRO
S2:Standardizationofthe interpretationoftheregulatorytext thatisallowedbythesupervision authoritiesmayhelptoprevent discrepancieswiththeexpected results Theoperatormaynothavetherequired experiencetoadaptitsjobcardsystemin accordancewithmaintenanceprocesses andprocedures S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance processesandprocedures
FINALREPORT
Scenario3: Scenario4: TheMROprintsthetaskcardsfrom TheMROusestheoperator'stask theoperator'sAMMbyusingits cardsinadditionwithitsownjobcard ownjobcardsystem system TheMROworkersmayfeel TheMROworkersmayfeeldisturbed complacencysothattheycouldforget becauseofdifferenceswithanusualway operator'sspecifictasks ofworking S1:Standardizationofthetaskcards S3:Raisingconsciousnesson andofproceduresonhowtofillthem risksrelatedtocomplacency mayhelpMROworkerswhen duringcontinuoushumanfactors performingthetasks trainingmayhelptopreventsuch humanerror Adefectmaybeaddedduringthe integrationoftheoperator'staskcardsin TheMROmayomittocarryouta requiredtaskrelatedtothestatusof theMROjobcardsystem,duetoan incompatibilityoftheoperator'stask theaircraft cardswiththeMROjobcardsystem S4:Standardizationofthetask cardsincludingspecifictagsto S5:Standardizationofthetaskcards introduceoperatorsspecifictasks includingPart145requirementsmay andrequirementsmayhelp helptopreventanincompatibilityof MROstopayattentiontosuch theoperator'staskcardswiththe data MROjobcardsystem TheMROmayomittocarryoutan TheMROmayomittocarryouta additionaltaskrelatedtothelocal requiredtaskrelatedtothestatusofthe conditionsofoperationoftheaircraft aircraft S4:Standardizationofthetask S4:Standardizationofthetaskcards cardsincludingspecifictagsto includingspecifictagstointroduce introduceoperatorsspecifictasks operatorsspecifictasksand andrequirementsmayhelp requirementsmayhelpMROstopay MROstopayattentiontosuch attentiontosuchdata data TheMROmayomittocarryoutan additionaltaskrelatedtothelocal conditionsofoperationoftheaircraft S4:Standardizationofthetaskcards includingspecifictagstointroduce operatorsspecifictasksand requirementsmayhelpMROstopay attentiontosuchdata
79/93
FINALREPORT
TableE 3:Risksrelatedtoscenarios5&6 betweenoperatorsandMROs Scenario5: Scenario6: TheMROprintsthetaskcardsfrom TheMROusestheoperator'stask theoperator'sAMM cards Significantextracostmayresultfor theMROwhentheoperatorstask cards(derivedfromthe manufacturer'staskcards)arenot suitablefortheMROprocesses(e.g. productioncontrol)ortheMRO qualificationstructure S6:Standardizationofthe manufacturerstaskcards includingPart145requirements maycompensateforthe operatorslackofexperienceas concernsmaintenanceprocesses andprocedures Significantextracostmayresultfrom theplanningprocessfortheMRO,when theoperator'staskcardsarenotsuitable fortheMROprocesses(e.g.production control)ortheMROqualification structure S5:Standardizationofthetaskcards includingPart145requirementsmay helptopreventanincompatibilityof theoperator'staskcardswiththe MROjobcardsystem
Significantextratimemayresultfor theMROwhenthetaskcardsarenot suitablefortheMROprocesses(e.g. productioncontrol)ortheMRO qualificationstructure Organisationalrisks S6:Standardizationofthe fortheMRO manufacturerstaskcards includingPart145requirements maycompensateforthe operatorslackofexperienceas concernsmaintenanceprocesses andprocedures Theoperatormaynotfeel competenttotraintheMROonits documentationwhenitisderivedfrom themanufacturer'sdocumentation S6:Standardizationofthe manufacturerstaskcards includingPart145requirements maycompensateforthe operatorslackofexperienceas concernsmaintenanceprocesses andprocedures
Significantextratimemayresultfrom theplanningprocessfortheMRO,when theoperator'staskcardsarenotsuitable fortheMROprocesses(e.g.production control)ortheMROqualification structure S5:Standardizationofthetaskcards includingPart145requirementsmay helptopreventanincompatibilityof theoperator'staskcardswiththe MROjobcardsystem Theoperatormaynothavetherequired experiencetoadaptitsjobcardsystemin accordancewithmaintenanceprocesses andprocedures S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance processesandprocedures Theoperatormaynotfeelcompetentto traintheMROonitsjobcardsystem(as itisoftenproducedfromthe manufacturer'sdocumentation) S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance processesandprocedures
80/93
FINALREPORT
Scenario5: TheMROprintsthetaskcardsfrom theoperator'sAMM TheMROworkersmayfeel disturbedbecausetheyhavetocope simultaneouslywithmanydifferent layouts S1:Standardizationofthetask cardsandofproceduresonhow tofillthemmayhelpMRO workerswhenperformingthe tasks TheMROworkersmaynotbe familiarwiththemanufacturer's documentation S6:Standardizationofthe manufacturerstaskcards includingPart145requirements maycompensatefortheMRO workerslackofexperienceas concernssomemanufacturers documents TheMROmayomittocarryouta requiredtaskrelatedtothestatusof theaircraft S4:Standardizationofthetask cardsincludingspecifictagsto introduceoperatorsspecifictasks andrequirementsmayhelp MROstopayattentiontosuch data Anerrormayoccurduringthe implementationofthetaskcardsas manufacturer'staskcardsneverfulfil thehowtodorequirement S6:Standardizationofthe manufacturerstaskcards includingPart145requirements mayaddressthehowtodo requirement
Scenario6: TheMROusestheoperator'stask cards TheMROworkersmayfeeldisturbed becausetheyhavetocope simultaneouslywithmanydifferent layouts S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpMROworkerswhen performingthetasks Anerrormayoccurduringthe implementationoftheoperator'stask cardsastheMROhasalimited knowledgeoftheoperator'sjobcard system S1:Standardizationofthetaskcards andofproceduresonhowtofillthem maycompensatefortheMROlack ofexperienceasconcernssome operatorsdocuments
81/93
FINALREPORT
TableE 4:Risksrelatedto Options2,3&4oftheRulemakingTaskn145.20 Option2: Option3: theoperatorprovidestheMROwitha theMROusesonlyitsinternaljobcard jobcardsystem system Significantextracostmayresultforthe operatortogettheexperienceneededto createandmaintainajobcardsystemthat meetsthePart145requirements S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance processesandprocedures Significantextracostmayresultfora smalloperatortogettheexperience neededtoadaptitsjobcardsystemin accordancewiththestatusoftheaircraftor withthelocalconditionsofoperation S8:Othercommercialarrangements shouldbeallowedbetweenthe operatorandanMRO Significantextracostmayresultforthe operatortocheckcompletenessofvarious maintenancepackagewithdifferent layouts S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks
Option4: adifferenceismadebetweenlineand basemaintenance Significantextracostmayresultforthe operatortocheckcompletenessofvarious maintenancepackagewithdifferent layouts S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks
Financialrisksfor theoperator
82/93
FINALREPORT
Option2: theoperatorprovidestheMROwitha jobcardsystem Significantextracostmayresultforthe MROtoadapttheoperator'staskcardsin accordancewiththespecificprocesses describedinitsMOE S5:Standardizationofthetaskcards includingPart145requirementsmay helpMROstointroduce(underspecific tags)specifictasksandrequirements relatedtotheirprocessesand procedures
Option3: theMROusesonlyitsinternaljobcard system Significantextracostmayresultforthe MROtointroducespecificoperator'stasks initsjobcardsysteminaccordancewith thestatusoftheaircraftorwiththelocal conditionsofoperation S7:Standardizationofdocuments relatedtothestatusoftheaircraftand tothelocalconditionsofoperationmay helptheMROtoaddoperators specifictasksandrequirements Significantextracostmayresultforthe MROwhenadditionalmanufacturer's documentationmustbesearched S8:Othercommercialarrangements shouldbeallowedbetweenthe operatorandtheMRO
Option4: adifferenceismadebetweenlineand basemaintenance Significantextracostmayresultforthe MROtointroducespecificoperator'stasks initsjobcardsysteminaccordancewith thestatusoftheaircraftorwiththelocal conditionsofoperation S7:Standardizationofdocuments relatedtothestatusoftheaircraftand tothelocalconditionsofoperationmay helptheMROtoaddoperators specifictasksandrequirements Asconcernsbasemaintenance, significantextracostmayresultforthe MROwhenadditionalmanufacturer's documentationmustbesearched S8:Othercommercialarrangements shouldbeallowedbetweenthe operatorandtheMRO
83/93
FINALREPORT
Option2: theoperatorprovidestheMROwitha jobcardsystem Significantextratimemayresultforthe operatortodevelopandmaintainajob cardsystemthatmeetsthePart145 requirements S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance Organisationalrisks processesandprocedures fortheoperator Significantextracostmayresultfora smalloperatortogettheexperience neededtoadaptitsjobcardsystemin accordancewiththestatusoftheaircraftor withthelocalconditionsofoperation S8:Othercommercialarrangements shouldbeallowedbetweenthe operatorandanMRO
Option3: theMROusesonlyitsinternaljobcard system Significantextratimemayresultforthe operatortocheckcompletenessofvarious maintenancepackagewithdifferent layouts S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks
Option4: adifferenceismadebetweenlineand basemaintenance Significantextratimemayresultforthe operatortocheckcompletenessofvarious maintenancepackagewithdifferent layouts S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks
84/93
FINALREPORT
Option2: theoperatorprovidestheMROwitha jobcardsystem Significantextratimemayresultforthe MROtoadapttheoperator'staskcardsin accordancewiththespecificprocesses describedinitsMOE S5:Standardizationofthetaskcards includingPart145requirementsmay helpMROstointroduce(underspecific tags)specifictasksandrequirements Organisationalrisks relatedtotheirprocessesand fortheMRO procedures
Option3: theMROusesonlyitsinternaljobcard system Significantextratimemayresultforthe MROtointroducespecificoperator'stasks initsjobcardsysteminaccordancewith thestatusoftheaircraftorthelocal conditionsofoperation S7:Standardizationofdocuments relatedtothestatusoftheaircraftand tothelocalconditionsofoperationmay helptheMROtoaddoperators specifictasksandrequirements Significantextratimemayresultforthe MROwhenadditionalmanufacturer's documentationmustbesearched S8:Othercommercialarrangements shouldbeallowedbetweenthe operatorandtheMRO
Option4: adifferenceismadebetweenlineand basemaintenance Significantextratimemayresultforthe MROtointroducespecificoperator'stasks initsjobcardsysteminaccordancewith thestatusoftheaircraftorthelocal conditionsofoperation S7:Standardizationofdocuments relatedtothestatusoftheaircraftand tothelocalconditionsofoperationmay helptheMROtoaddoperators specifictasksandrequirements Asconcernsbasemaintenance, significantextratimemayresultforthe MROwhenadditionalmanufacturer's documentationmustbesearched S8:Othercommercialarrangements shouldbeallowedbetweenthe operatorandtheMRO
85/93
FINALREPORT
Option2: theoperatorprovidestheMROwitha jobcardsystem Theoperatormaynothavetherequired experiencetoadaptitsjobcardsystemin accordancewithmaintenanceprocesses andprocedures S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance processesandprocedures Asmalloperatormaynothavethe requiredknowledgetoadaptitsjobcard systeminaccordancewiththestatusofthe aircraftorwiththelocalconditionsof operation S7:Standardizationofdocuments relatedtothestatusoftheaircraftand tothelocalconditionsofoperationmay helptheoperatortomanagespecific tasksandrequirements
Option3: theMROusesonlyitsinternaljobcard system Theoperatormayfacedifficultiesto recordseveraldifferentMRO'sworkcards whichlayoutsaredifferent S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhenrecordingthe completionofthetasks Theoperatormayfacedifficultiesto ensurethatthemaintenancepackageis complete,includingallrelevantmandatory tasksandinspections S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks Atranscriptionerrormayoccurwhen transferringmaintenancedatafeedback intotheoperator'srecordssystem S1:Standardizationofthetaskcards andofproceduresonhowtofillthem maypreventoperatorsfromerrorwhen recordingthecompletionofthetasks
Option4: adifferenceismadebetweenlineand basemaintenance Theoperatormayfacedifficultiesto recordseveraldifferentMRO'sworkcards whichlayoutsaredifferent S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhenrecordingthe completionofthetasks Asconcernsbasemaintenance,the operatormayfacedifficultiestoensurethat themaintenancepackageiscomplete, includingallrelevantmandatorytasksand inspections S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks Asconcernsbasemaintenance,a transcriptionerrormayoccurwhen transferringmaintenancedatafeedback intotheoperator'srecordssystem S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpoperatorswhencontrolling thecorrectcompletionofthetasks
86/93
FINALREPORT
Option2: theoperatorprovidestheMROwitha jobcardsystem TheMROworkersmayfeeldisturbed becausetheyhavetocopesimultaneously withmanydifferentlayouts S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpMROworkerswhen performingthetasks
Option3: theMROusesonlyitsinternaljobcard system TheMROmaynothavetherequired knowledgetoadaptitsjobcardsystemin accordancewiththestatusoftheaircraftor withthelocalconditionsofoperation S7:Standardizationofdocuments relatedtothestatusoftheaircraftand tothelocalconditionsofoperationmay helptheMROtoaddoperators specifictasksandrequirements TheMROmayomittocarryouta requiredtaskrelatedtothestatusofthe aircraft S4:Standardizationofthetaskcards includingspecifictagstointroduce operatorsspecifictasksand requirementsmayhelpMROstopay attentiontosuchdata TheMROmayomittocarryoutan additionaltaskrelatedtothelocal conditionsofoperationoftheaircraft S4:Standardizationofthetaskcards includingspecifictagstointroduce operatorsspecifictasksand requirementsmayhelpMROstopay attentiontosuchdata
Option4: adifferenceismadebetweenlineand basemaintenance TheMROworkersmayfeeldisturbed becauseofdifferencesbetweenlineand basemaintenancetaskcards S1:Standardizationofthetaskcards andofproceduresonhowtofillthem mayhelpMROworkerswhen performingthetasks Forbasemaintenance,theMROmaynot havetherequiredknowledgetoadaptits jobcardsysteminaccordancewiththe statusoftheaircraftorwiththelocal conditionsofoperation S6:Standardizationofthe manufacturerstaskcardsincluding Part145requirementsmay compensatefortheoperatorslackof experienceasconcernsmaintenance processesandprocedures Forbasemaintenance,theMROmay omittocarryoutarequiredtaskrelatedto thestatusoftheaircraftortothelocal conditionsofoperationoftheaircraft S4:Standardizationofthetaskcards includingspecifictagstointroduce operatorsspecifictasksand requirementsmayhelpMROstopay attentiontosuchdata
87/93
FINALREPORT
Thisassessmentshowstheeightfollowingsolutions: S1:Standardizationofthetaskcardsandofproceduresonhowtofillthem S2: Standardization of the interpretation of the regulatory text that is allowed by the supervision authorities S3:Raisingconsciousnessonrisksrelatedtocomplacencyduringcontinuoushumanfactorstraining S4:Standardizationofthetaskcardsincludingspecifictagstointroduceoperatorsspecifictasksand requirements S5:StandardizationofthetaskcardsincludingPart145requirements S6:StandardizationofthemanufacturerstaskcardsincludingPart145requirements S7: Standardization of documents related to the status of the aircraft and to the local conditions of operation S8:OthercommercialarrangementsshouldbeallowedbetweentheoperatorandanMRO
Foreconomical,organisationalandsafetyreasons,theeighthsolutionS8shouldbeallowed,whichbelies Options2,3and4oftheRulemakingTaskn145.020.Thus,BUREAUVERITASconsidersthatOptions2, 3 and 4 of the Rulemaking Task do not satisfy the Agencys objective to enhance aviation safety throughoutEurope. ConsideringOption1(oftheRulemakingTaskn145.020),itisacceptableontheconditionthatsolutions S1toS6areimplemented.Thosesolutionscanberegroupedintothreebroadsolutionsthatarediscussed in4DataAnalysis: SolutionA(groupingsolutionsS1,S4,S5,andS6): Standardizationofthetaskcardsandofproceduresonhowtofillthem,including: o Part145requirements o Specific tags to introduce operators specific tasks and requirements related to the status of theaircraftandtothelocalconditionsofoperation o SpecifictagstointroducespecifictasksandrequirementsrelatedtotheMROsprocessesand procedures. SolutionB(correspondingtosolutionS2): Standardizationoftheinterpretationoftheregulatorytextthatisallowedbythesupervisionauthorities SolutionC(correspondingtosolutionS3): Raisingconsciousnessonrisksrelatedtocomplacencyduringcontinuoushumanfactorstraining
88/93
FINALREPORT
Annex F Model to implement a safety process in a maintenance organisation
89/93
FINALREPORT
BUREAU VERITAS proposed the following model to implement the safety process in the maintenance organisations, in the purpose of obtaining more positive results and decrease of errors particularly in documentation.
Generalapproach
Detectionandcorrectionofmaintenanceerrorsareessentialelementscontributingtotheimprovementof safetyintheaeronauticalfield.Recentstatisticsshowthat70%upto80%aircraftaccidentsaredueto humanfactors,andina significantpart,amaintenanceerroris one ofthemaincausesor acontributing factoratleast. The Henrich ratio or iceberg scheme demonstrates that we only see what is visible. In fact for 1 fatal accidentthereare10accidents,andweneverseethe30reportableincidentsand600incidents. Thecauseofanaccidentistobefoundinwhateveritwasthatinterferedwiththeaviationmaintenance specialistsperformanceatacriticalmoment,theoutcomeofwhichwasamaintenanceerror. Thecommonerrorsinmaintenanceare: Omissionforgetastep,apart,etc.56% Incorrectinstallation30% Wrongpart8% Other(groundhandling,etc.)6% Source:ICAOHumanFactorsCircular12HumanFactorsinAircraftMaintenanceDigest Theinformationexchangeenablestoreduceorevenavoidthecausesofincidentsandaccidents.Totake human factors into account is essential, as to develop the safety net which includes the Awareness, KnowledgeandResources.
Objectives
Theobjectiveistoidentifythefactorscontributingtotheseeventsbyestimatingalltheknowninformation, whileimplicatingandencouragingthepersonneltospontaneouslyreport,induetime,thepotentialcauses oferrorstheyareinvolvedorwitnessedto.Thisinordertoavoidtheriskoferrorandinorderthesystem beresistanttosimilarerrors.
Sourcesofinformationandmeansofdetection
Resultsofscheduledandnonscheduledaudits, ReportsofAuthorities,externalaudits,contractedoperators,etc. Analysisofreportsrelativetoground,flightincidents,flightandgroundUturns,delays,TechnicalLog Booketc. Failuresfoundduringmaintenance:(MaterialIncidentReport2.18MOE) Anerrorobservedbythepersonnel:EVENTREPORT(seepart5ofMOE). Othersources.
Internalreportofaninternalevent
Anypersonnel who,throughhispositionintheMaintenanceOrganization,canfindorisimplicatedtoan eventlikelytoaffectthesafety,iscompelledtomentionitwithregardtotheprofessionalandmoralethics. Inordertoencouragehimtodoso,hecanfulfilaformentitledEVENTREPORTandsenditassoonas possible to the Quality Division, to the attention of Maintenance Safety Department. It is possible to mention,atthebottomofthisform,proposalsofimprovementofsafetyorquality. Thewayofwritingorspellingisnotimportantthemostimportantistonotifytheeventinduetimeinorder to start the necessary corrective action and in order to avoid the incident and the reproduction of such cases.
90/93
FINALREPORT
The Maintenance Organization is committed not to inappropriately sanction any person spontaneously declaringanerroronduetime. The Organization is committed to guarantee anonymity and immunity for any person spontaneously declaringanerror. Means: TheMaintenanceSafetyDepartmentholdsatdisposal: Formsentitled:EVENTREPORT Letterboxes set at level of the different activities on base and of the emaintenance sites are identified: EVENTREPORTBOX.
Reportanalysis
Fromtheinformationcollectedintheindividualnotifications,thecontrolreports,auditreports,incidentand delayreports,andanyothersource,theMaintenanceSafetyDepartmentdealswiththeeventontheform EventHandlingForm: Analyses,classifiesanddeterminestheerrorsoriginsandthefactorscontributingto. Requestsorrecommendstotheconcernedentity,thecorrectiveactiontobedone. Willvaluetheefficiencyofthecorrectiveactionandwillproceedtotheclosureoftheform.
Acquisitionofthecollectedinformation
A status is established and followed by the Maintenance Safety Manager (MSM) in order to enable the collectedinformationmanagement. TheMSMcandelegatethemanagementofthisfollowupstatus.TheMSMsroleismentionedinchapter 1.4.4.of the MOE. If needed, the interim can be performed by a maintenance safety referringmember whoisappointedbytheMSM. AlistofthereferringmembersisvalidatedbytheManagingDirectorandisupdatedbytheMSM.
Investigations
In accordance with the urgency and the nature of the collected information, the necessary and sufficient investigations can be performed either only with the Event Handling Form, or with the Investigations Reportasacomplement.TheInvestigationsReportformisinpart5oftheMOE. Withsolepurposeofinvestigations,theuseofthesafetyform(forexample:MEDA,MaintenanceError DecisionAid,developedbythemanufacturerBoeing)enablesthemaintenancesafetyreferringmembers (safetyinvestigator)toremainobjective,independentandimpartial.
Maintenancesafetyevaluationandreviewofundertakenactions
DirectingreviewsoftheMaintenanceOrganizationarereleasedbytheManagingDirector,duringwhicha reviewofaccidents,incidents,eventslinkedtothemaintenancesafetywillbeperformed. Conclusions of the directing reviews and any other investigation can be used by the MSM to release safety evaluations. For this purpose, he will designate one or some maintenance safety referring member(s)notinvolvedintheevaluatedfield.
Distributionofconclusions
Themaintenancesafetydepartmentwillsend,accordingtothecase,anEventBulletinrelatingconclusions relativetotherecordedevent,totheconcernedpeopleandgenerallywithintheOrganization.
Feedback
ThesebulletinsaretransmittedbytheMaintenanceSafetyDepartmenttotheTrainingDepartmentinorder to be integrated in the framework of the continuous training upon the Maintenance Organization proceduresanduponhumanfactors.(MOE3.4,3.13and3.14).
91/93
FINALREPORT
Disciplinarypolicy
Errorsareeitherdeliberateactscalledviolations,orunintentionalactscalledhumanerrors.Thelatterare oftwotypes:errorsofintention(mistakes)anderrorsofexecution(slips,lapses). Violationsneedtobe punishedtoavoidthespread ofundesirablepractices.Thedisciplinarypolicymust bothprovidefairdisciplinarysanctionsdependingonthegravityofeachviolationact,andofferimmunityto persons who spontaneously declare errors. Such policy establishes a socalled just culture, which is recalled by the Part 145 regulation as follows: An occurrence reporting system should enable and encouragefreeandfrankreportingofany(potentially)safetyrelatedoccurrence.Thiswillbefacilitatedby the establishment of a just culture. An organisation should ensure that personnel are not inappropriately punished for reporting or cooperating with occurrence investigations. AMC 145.A.60(b)(2) Occurrence
reporting
The internal policymust include a disciplinary policy that clearly describesthe sanctions and the related cases of application, together with conditions to be granted immunity.This policymust be wellknown by eachemployee. Any proposal of disciplinary sanction, administrative or else, is compulsorily submitted to the MSMs opinion.Thisoneperformsananalysisofstandards,systemandfactsonthebasisofhumanfactorsand safetyformlikeMEDAorother.TheMSMmakesarecommendationtotheManagingDirectorandtothe proposalemitter. Theviolationact,togetherwiththeappliedsanction,shallbedisplayedasarecalloftheexistenceofthe disciplinary policy. Moreover, any proposal of sanction can be dealt with by the MSM as a source of informationtostarttheprocessdescribedinthepresentprocedure. Whenimplementingadisciplinarypolicy,theManagingDirectormustdecide: Toestablishthetrulyblamefreesystem,tellingtheemployeesthatunlesstheyintendedthedamage (e.g.asananswertopressurefromsuperiormanagement),nodisciplinaryactionwillbetakenagainst them if they report their error (spontaneously and within reasonable delays) and participate to its investigation Nottocontinuewithpunitivesystems.Thosesystemsessentiallyoutlawhumanerror,leadingtoresign oneself to the fact that employees will never selfreport, and to restrict ones learning to only those errorsthatcannotbehidden Whilecreatingconfidentialreportingsystemstocollecterrordata,nottoleavetheemployeestofend forthemselvesunderpunitivedisciplinarypolicies Nottodrawalineinthesand,educatingtheworkforcetoknowwherethelineisandaskforreporting bythosewhohavenotcrossedtheline.
Conclusion
In an organization, individual attitude of each member of the staff is influenced by the structure of this organization. Inasystem,consequencesofanerroraredeterminedbythehardnessofthissystem. Proceduresandcultureofanorganizationdeterminethelevelofsafetyofthisorganization. Securityofanorganizationisdirectlylinkedwithcapacitytoimplementedrelevantrule.
Profilesandduties
Note:Inthefuture,a"MaintenanceSafetyOfficer"willbeappointed.Hewillhavetomeet,inparticular,the profile of the dedicated personnel and to have a specific role with the MRO Accountable Manager and Qualitymanager. Its independence will have to be demonstrated. The Maintenance Safety Officer is the keymanforinternalandexternalSafetyandHumanFactorsmatters. v ProfileofHumanFactorstrainers. Qualifiedtrainerwith3yearsexperience, EmployedinaMaintenanceOrganizationatleast3years, BasichumanfactorsKnowledge, Reallyrecognizedinthecompanyandtoholdacertainlegitimacy,
92/93
FINALREPORT
Volunteer, Motivated, Independentfromtraineesworkingactivities. v DutiesofHumanFactorstrainers. Thetraineristheleaderinthesuccessoftheimplementationofthecompanyhumanfactorsprocess.He must: BeconvincedintheinterestofHFapproachforagoodtransferofknowhow, Analysespecificevents(incidents/accidents)relatedtomaintenanceerrors, Change the approach and the behaviour of individuals within the organisation more than to transmit detailedknowledgeonagivenfield, Beinvolvedinthesubject,credible,respected,torecognizeitsownlimitsanditsownerrors, InculcatetheHumanFactorsconcepttothepersonnelbypersuadingthemthatanindividual,voluntary andcontinueparticipationwillallowastrongcontributiontotheimprovementofthesafety, Besensitivetotraineesrequest, Beawareofanyevents(incidents/accidents)arisingintheorganizationregardingHF, Befamiliarwiththetrainingneedsofeachindividualinthismatter. v ProfileofHumanFactorsdedicatedpersonnel. Managers(linestation,maintenancebase,workshops,.)orskilledpersonnel.Theymust: BereallynotoriousintheOrganisationandholdcertainlegitimacy, HavebasicknowledgeaboutHFandsafetypolicy, Beimpartialandneutral, Have appropriate skills in communication, interview as well as collection, analysis and compilation of information, Bevolunteer, Haveapersonalmotivationandinvolvement. v DutiesofSafetyPolicy/HumanFactorsdedicatedpersonnel. Focalpointofmanagementofmajorsafetyevents(followup,investigation,), Risksanalysis, HFconceptcoordinationandfollowup, FeedbackinformationofsafetyeventstotheAccountableManager, PromotetheSafetyPolicywithintheorganization, FieldmanagementofeventsrelatedtoSafety, Befamiliarwiththetrainingneedsofeachindividualinthismatter, Beawareofanyevents(incidents/accidents)arisingintheorganizationregardingHF, Beallowedtomeetanyindividualatanytimewithintheorganisation, Getaccesstoanydocumentsneededforeventsinvestigation, Have enough skills to understand aircraft systems, related technical documentation and the maintenanceproceduresinforceintheorganisation, Beappointedfortheanalysisorparticipationoftheanalysisofmaintenanceerrors.
93/93
FINALREPORT

Study For Task 145-020 - Work Card System

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Study For Task 145-020 - Work Card System

Uploaded by

Copyright:

Available Formats

FINALREPORT

2 ANALYSISOFINCIDENTS/ACCIDENTS.......................................... 11 3 ANALYSISOFCOMMONPRACTICES ............................................ 17

4 DATAANALYSIS............................................................................... 28 5 RECOMMENDATIONS ....................................................................... 31

EuropeanCoordinationCentreforAviationIncidentReportingSystems(Cf.2.1ECCAIRSassessment). See1.1Regulatorycontextofthestudy 8/93

Improperuseofmaintenancedocumentationmeansoneormoreofthefollowing: Nouseofdocumentation Lateuseofdocumentation Partialuseofdocumentation Misreadingofdocumentation Norespectofdocumentationcontent Useofincorrectdocumentation.

Incorrectdocumentationrefersto: Missingdocumentation Latedocumentation Obsoletedocumentation Incompletedocumentation Ambiguousdocumentation Erroneousdocumentation Complexdocumentation Inadequatedocumentation.

Rateofeventsrelatedto maintenance documentation 15.6% 10.8% 7.7% 11.6%

OperatorsPart145 approvedwithexternal overhaulcontracts 1operator 1operator 1operator

Furthermore,BUREAUVERITASconsideredthatoperatorsandmaintenanceorganisationsopinionabout theoptionsexaminedbytheRulemakingTask145.020wasavaluableinputforourstudy,astheyarein touchwiththeindustrialreality.

Correctedresults Agree 8 0 % 8 0 % 8 0 % 8 6 % 8 6 % 8 6 % 8 2 % 8 2 % 8 2 % Disagree 20% 14% 18%

NotefromEASA:Option3oftheRulemakingTaskn145.020isnotmeanttoallowtheoperatortocontractoutthe PartMsubpartGactivitiesbecausetheoperatorhasalwaysthefinalresponsibilitytocheckthatjobcardspreparedby themaintenanceorganisationMROcoverstheAircraftMaintenanceProgramme(AMP).(Sameaspreviousfootnote.) 25/93

Someoperatorsagreewiththisoptionbecauseaclearsegregationbetweenbaseandlinemaintenance wouldbeachieved. Mostoperatorsareopposedtothisoption,duetothefollowingissues: ThisoptionshowssamedrawbacksthanOption3,asconcernsbasemaintenance

Scenario4:TheMROusesthe operator'staskcardsinaddition withitsownjobcardsystem

Scenario4:TheMROusesthe operator'staskcardsinaddition withitsownjobcardsystem Scenario6:TheMROusesthe operator'staskcards

Recommendation 3: Consciousness on risks related to complacency should be better developed duringcontinuoushumanfactorstraining.

Recommendation3isalsoconnectedtothedatawecollectedinthefield.Infact,ourstudyrevealedthat twohumanfactorsstillcreatediscrepanciesbetweentheintendedactivitiesandtherealacts,intheuseof documentation.

CommissionRegulation(EC)No1702/2003AnnexPart21Certificationofaircraftandrelatedproducts,partsand appliances,andofdesignandproductionorganisations 34/93

Annex A Occurrences recorded by the BEA relating to maintenance documentation

Annex B Accident of aircraft A330, registration CGITS, on 24/08/2001

Sixteenminorinjuriesand twoseriousinjuries,during theemergencyevacuation

Useofmismatchedfuelandhydrauliclinesduringtherightenginechange,causinganin flightfuelleakageduetotheruptureofthehighpressurefuelpumpinletfueltube,which failedasaresultofhardcontactwiththehydraulicline.

Theleasestatusoftheaircrafthadnobearingonthecontroloftheaircraft.Themaintenanceof theaircraftwastheresponsibilityoftheairoperator. TheaircrafthadavalidCertificateofAirworthinessissuedon28April1999whentheaircraftwas registeredtotheoperator.

Thepressurizationofthehydrauliclinewouldhavebeensufficienttocausethehydrauliclinetomoveback toitsnaturalpositionandcomeincontactwiththefuelline,whichresultedinthechafingandfailureofthe fuelline.

v ActionTakenbyAirbus On29August2001,AirbusissuedanAllOperatorsTelex(AOT)A33073A3033requiringaone timevisualinspectiontoverifythatnointerferenceexistsbetweenthefuelandhydrauliclineson allA330aircraftequippedwithRollsRoyce700seriesengines.

Annex C Incident of aircraft A340, registration FGTUB, on 19/04/2002

Annex D List of incidents/accidents related to maintenance documentation

Emergencylandingbecauseofheavyvibrationsontheright handengineandunusualnoisescomingfromtherearofthe airplaneduringtheapproach.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningapplicable,clearinstructions forthebondingoftheiceimpactpanels.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningclearinstructionstoprevent anexcessiveplayintheantitorquelinksapexjoint.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,directingattentiontotheTTUwirelocking andductlengthadjustment.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningcrossreferenceswithinthe AMMaboutthepurgedoor.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisaccident,mentioningthatinstallationofelevators mustbedoublechecked.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisaccident,mentioninginspectionorchecks requiredontheairstairsoperatingsystem.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioninginstructionstoensurea correctthrustpinconfigurationonthefuelflowdivider.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningclearinstructionsandusing clearmarkingsfortheinstallationoftheaftcargodoorseal.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningproperchecksinthe maintenanceprocedureofaircraftwithgiventypesofengines.

Asthisaccidentwascausedbyaninadequatedirectivefrom themanufacturer,acorrectmanufacturersdocumentation mayhavehelpedtopreventthisaccident.

Acorrectmanufacturersdocumentationmayhavehelpedto preventthisincident,mentioningappropriatefrequencyof lubricationoftheflightcontrolsgustlocksystem.

Thisresultedfromcorrosiondamagetothescrewthreadsofalocknutusedtosecurethe wheelforktothelowerextremityoftheslidingelementoftheoleostrut. Asaresultofthisaccident,theoperatorhasreviseditsmaintenanceproceduresasfollow:

Annex E Risk assessment

Annex F Model to implement a safety process in a maintenance organisation

You might also like