|University of Bielefeld - Faculty of technology|
Networks and distributed Systems
Research group of Prof. Peter B. Ladkin, Ph.D.
|Back to Abstracts of References and Incidents||Back to Root|
In August 1993 an A320 taking off experienced an uncommanded roll to the right as it became airborne. Initially the crew thought that this was due to the crosswind, but the handling pilot had to apply full left sidestick to maintain heading. Believing that his sidestick may have been faulty he passed control to the other pilot. The second pilot also found that he had to maintain almost full left sidestick to contain the roll. Because most warnings are inhibited below 1,500 ft radio height, the Ecam (electronic centralised aircraft monitoring) system did not signal any faults until the flaps were retracted at 1,700 ft. It then sounded a repetitive chime indicating a serious fault, displaying messages that flight control had reverted to alternate law and that some of the spoilers were inoperative.
Having contacted ATC, the controller asked the crew to take up a holding pattern 10 nm away. This would have involved a series of left hand turns, therefore the crew were offered, and accepted a holding pattern of radar monitored right hand turns. The first approach was made following Ecam instructions which called for Flaps 3 (22° slat, 20° flap) and a Vref + 10 kt speed with a 20% increase over normal landing distance. Seletion of Flaps 1 on the approach (18° slat, 0° flap - also the takeoff configuration) had minimal effect on roll control while Flaps 2 (22° slat and 15° flap) required full left sidestick and the commander therefore called for a go-around.
The aircraft was reconfigured and ATC was informed that a higher speed, Flaps 1 approach would be made. This proved successful and the aircraft landed 37 mins after takeoff. As the aircraft was taxiing it was noted that several spoilers on the starboard wing were up.
As a result of bird strike damage the aircraft's right hand outboard flap had been replaced before this flight. The work was carried out by a maintenance organisation contracted to do such work by the airline. Although the job was within the organisation's terms of reference it had not previously been performed by the nightshift engineer allocated the task - a licensed aircraft engineer (LAE) with CRS (certificate of release to service) authorisation on the A320 - or any of his assistants.
The flap change was not part of the approved maintenance schedule so there were no prepared stage sheets for the tasks, planning being limited to a job card containing a single reference to a chapter of the maintenance manual and an attempt to provision the special tooling. The nightshift engineer was therefore required to determine the full requirements for the job from the A320 maintenance manual which was in Amtoss (aircraft maintenance task oriented support system), a format which the individual found confusing. This manual was on a film reader and the engineer was given 40 pages which had been printed to determine the tooling requirements. The engineer printed a further 20 pages, which meant that he had sufficient pages to ensure that the significant tasks were either detailed or referenced to.
Company procedures required the engineer to raise aircraft maintenance continuation sheets. These require that as each stage is completed it is certified and stamped by a CRS holder - in this case the nightshift engineer. An aircraft maintenance control and certification sheet was also produced which would be completed when the job was finished. The engineer felt that the completion of these documents was impeded by the manual's layout, with references to subtasks in other parts of the manual and aircraft effectivity references which he did not always interpret correctly. Company procedures placed the responsibility for calling up the re-instatement and duplicate inspections, where required, fully on the person certifying the breakdown of these systems.
The tooling for the job, ordered when it was known that the flap change was required, had come from another airport and was deficient or incorrect in a number of aspects. It did not include collars to lock the spoilers up, in accordance with the spoiler isolation procedure, and the threaded adaptors to assemble the hoist attachments to the flap were also missing. The latter were required as this particular aircraft was of a different build standard to those normally maintained by the maintenance organisation. Alignment tooling for the flap carriage bolts did not fit this aircraft and a number of items were included in the kit for which no obvious purpose was apparent.
Although the nightshift engineer, as a CRS signatory, was totally responsible for the job he had recourse to a foreman or shift manager. He stated that he approached the foreman about the deficient tooling and requested a working party or an engineer with experience in A320 flap removals. He also asked that the allocated time be increased. The foreman did help with the tooling and the time allocation (an extra 3 hr, moving completion from 0700 to 1000) but does not recall being asked for experienced personnel.
When the aircraft arrived at the hangar all the tasks called for prior to lifting off the flap were adhered to except extending and locking the four outboard spoilers. This was because the required tooling, the spoiler collars, was unavailable, and the engineer anticipated that it may not be necessary. At 0300hr local, while preparing the sling for attachment to the flap, the lack of threaded adaptors became apparent. By 0530 these had been delivered to the engineer and the sling was attached to the flap and the weight taken. It was then noticed that the sling was close to the spoilers and damage may occur. As the job was becoming difficult the nightshift engineer and his assistant placed each spoiler actuator in maintenance mode and moved them clear of the sling.
Around this time the nightshift engineer verbally briefed the oncoming dayshift engineer, another LAE with A320 CRS, on the job status. Neither engineer could later remember any specific mention of the spoilers. However, it was pointed out to the nightshift engineer that the stage sheets had been made up on the wrong forms. He then rewrote the removal stage sheets on the correct forms but did not do the same for the refitment stage sheets. Mention was made on the rewritten stage sheets of operating the spoiler maintenance devices in the same wording as used in the maintenance manual. These new sheets and the original versions on the incorrect forms were left as a guide for the dayshift. The latter were subsequently disposed of and were not recovered for the investigation, so is it not known if references to reinstate and function the spoilers were made on the re-fitment sheets. These actions are detailed in the maintenance manual.
When an engineer (an LAE with A320 CRS) who was to carry out the duplicate inspection was briefed, it was recalled that the spoilers were specifically mentioned. However, the brief was understood to mean that there was a danger to the engineers of the spoilers moving if hydraulic power was applied, not that the spoilers were isolated. This would be true of 757s and 767s which are more common in the maintenance organisation, but it is not possible for the A320 spoiler to move under hydraulic pressure when the actuator is in maintenance mode.
The dayshift engineer arranged for the estimated time to service to be changed to 1200hr and later 1500hr. The first attempt to refit the flap was delayed when the sling broke. After it was repaired the job was completed without further problems. The rigging was then checked using the maintenance manual procedure. Rigging boards were placed on the top surface of the wing and it is at this stage that the spoilers are most likely to have been closed. The rigging was satisfactory, so the flap carriage bolts were locked and the dayshift engineer arranged for the duplicate inspection of the carriage bolts, flap drive and asymmetry transducer. The remaining stage sheets were completed, a flap function check was done by the dayshift engineer and duplicate engineer and the work was then certified. A burst of activity then followed to ready the aircraft for 1500hr as the work pack and technical log were completed.
After the incident, when it had been noted that several spoilers on the right hand wing were up, an inspection revealed that the spoiler actuators for Nos 2, 3, 4, and 5 right hand spoilers were in the maintenance mode. These were then placed in operation mode, a duplicate inspection and function check were completed and the aircraft was released to service.
When left roll was demanded, all the indications were normal because the left side roll spoilers deployed and there was no Ecam warning. However, when right roll was demanded, only the ailerons responded. If this demand was held for three seconds or more, an alert sounded and the Ecam displayed amber symbols for Nos 2-5 right hand spoilers plus messages about reversion to alternate flight control laws. Other tests indicated that the right and left ailerons and Nos 4 and 5 spoilers were visible from the corresponding pilot's seat.
The engineers who performed the flap change were widely experienced LAEs with many different aircraft authorisations: neither their experience - gained over many years - nor their ability, was in question. They were also aware of the potentially critical nature of their everyday tasks and they did not act in a deliberately careless manner. They and their assistants showed a commendable degree of professionalism during the investigation. Their approach implied that they believed there were benefits for the organisation if they could successfully circumvent problems and deliver the aircraft on time. They demonstrated that, on occasion, they would work around difficulties, when they arose, without reference to a design authority. This included situations where compliance to the maintenance manual could not be achieved. Unfortunately this placed total responsibility for any consequences squarely on the individuals concerned.
It was clear that the nightshift engineer followed the maintenance manual procedures insofar as he wa able given the tooling deficiencies and his willingness to complete the flap removal. It was not so clear that the dayshift gave as much attention to the written procedures, failing to realise the requirements to reinstate and function the spoilers. This indicates a lack of knowledge of the task as defined in the maintenance manual.
The investigation did not reveal any evidence to suggest that these engineer's attitudes and working practices during the flap change differed significantly from their usual practices. It is difficult to imagine that local management is unaware of such practices even though they may be occasional. In this instance the foreman was approached about the missing collars and should have been aware of the job proceeding without them. Such acceptance by local management would be seen as justification by the engineers. These effects were very subtle and amounted to little more than a failure to insist upon a rigorously procedural approach to working practices and total compliance with the maintenance manual.
The industry, operators and manufacturers alike acknowledge that, although total compliance with approved procedures is a requirement, it is not always achieved. Engineers may in the past have assumed, perhaps without conscious thought, part of the design authority's reponsibilities. However, the engineer, regardless of licences or authorisations, is never permitted or equipped to do so, even with many years of experience. While the potential for error has always existed, even with simple aircraft types, the skill and experience of those faced with day-to-day problems may well have been sufficient to achieve a safe conclusion. With the introduction of aircraft like the A320, A330, A340 and Boeing 777, it is no longer possible for maintenance staff to have enough information about the aircraft and its systems to understand adequately the consequences of any deviation. The avoidance of future unnecessary accidents with high technology aircraft depends on an attitide of total compliance within the industry being developed and fostered. Maintenance staff cannot know the consequences of non-standard operations on the systems.
It is of note that a shift change took place during the flap change which was further complicated by dayshift personnel being allocated, swapped, and finally reassigned to their initial taskings. The nightshift engineer thus completed two handovers, neither of which achieved the intent of the maintenance organisation's published procedures as they did not "ensure an adequate handover of the task was provided". The handover occurred when the nightshift engineer could expect to be tired, with his circadian rhythms desynchronised. The handovers were conducted with incomplete and incorrect stage sheets and verbally. It could also be argued that to "ensure an adequate handover", written notes are necessary on all but the simplest of tasks. These, though, are not required by company procedures. The stage sheets did contain enough information for the dayshift to recognise the spoiler condition, assuming sufficient knowledge of the system.
The duplicate inspection and flap function check seems to have been carried out satisfactorily. The duplicate inspecting engineer also took part in the flap function check as required by the BCARs. It is unlikely, however, that either the dayshift engineer or duplicate inspecting engineer made a check of maintenance manual flap and spoiler functioning requirements. The spoiler function check is the next item on the page after the flap function check in the manual. The duplicate engineer relied on the dayshift engineer's knowledge rather than checking the maintenance manual. This appears to be accepted practice, but if duplicate inspections are only conducted at the request of the engineer primarily responsible for the task and doing the primary inspection, some of the potential benefit of the duplicate inspection is lost.
There were differences in the perceptions of the nightshift engineer and the shift foreman concerning the requests for assistance. Procedures existed for the nightshift engineer to request tooling, labour, experienced support, a revision of th estimated time to service, engineering backup and participation of the Airbus representative. They were only effective in obtaining some tooling and a revised time to service, both of which were essential. The process did not work for non-essential requests and the nightshift engineer did not pursue these requirements rigorously and it appears that he may have felt that only important matters, i.e. those which would delay job completion, should be followed up in this way. If so, this could explain why he did not consult the design authority on how to proceed when the collars were not to hand. This decision, when compounded with the incorrect assumptions made about the purpose of the collars, was crucial. If an engineer is to ensure that the work is carried out correctly without deviating from the manual or other mandatory procedures, the industry must ensure that it has in place effective, rapid support, including usable systems for consultation with the design authority.
The nightshift engineer was confronted with a task for which he had no experience and because the flap change was unscheduled maintenance, planning was minimal. Support was initially limited to assistants similarly inexperienced in A320 flap changes, an incomplete maintenance manual extract (in a confusing format), incorrect tooling and an unrealistic estimated time to service.
Unscheduled maintenance is unpredictable and therefore difficult to support. The staff need to be familiar with a number of different aircraft types, some of which will be seen only rarely. Planning is difficult because of the nature and immediacy of the problem, yet it is this immediacy which pressures the engineer to deliver an aircraft. The work pack may be minimal and provide no guidance to the task, as with this case. But, the engineer holds the same responsibilities as if he were working on fully planned scheduled maintenance. In effect the airworthiness of the aircraft can become dependent solely on the actions or omissions of one individual. Even if duplicate inspections or function tests are called for by the manual, the engineer must realise this and arrange for them to happen. A single path to failure is created, whereas in other areas of the design, maintenance and operation of the aircraft, some redundancy is required. The industry as a whole needs to recognise this problem and support those individuals placed in this position. Also, occasions when significant maintenance is done this way must be minimised.
In ramp maintenance situations, operators often use pre-planned stage sheets which briefly describe each action required. They also give the appropriate maintenance manual reference and provide boxes for an authorised signature. Printed at the bottom is a Certificate of Release to Service. Such documents are general, for example quoting an ATA reference rather than specifically describing an operation, and should never be used in place of the manual. They do provide an invaluable aide-memoire and allow easy confirmation that all critical tasks have been accomplished. This type of pre-planned stage sheet document would be appropriate for tasks such as the removal and replacement of control surfaces, flaps, landing gear and other major components. They would be of considerable benefit in the non-scheduled maintenance environment.
Estimated times to service can be unrealistic leading to further pressure on the engineer to justify delays. Different individuals will react in a variety of ways, but it is easy to see that such pressures could lead to errors of judgement. Clearly the individual responsible for the quality of the work must be given sufficient time to complete the task while adopting a procedural approach and adhering strictly to the maintenance manual and all other mandatory and company practices. This requires the participation of line managers to screen the individual from undue pressure by the negotiation of realistic estimated times to service.
If a spoiler is functioning correctly a green Ecam indication is given on the flight controls page. Abnormal conditions which last for longer than three seconds cause the Ecam indications to turn amber. After five seconds with the selected and achieved spoiler positions being different a chime sounds and the opposite spoiler is signalled to close and is then locked in this position. Hence if the spoiler is non-operational no fault will be shown until a command is made. This then has to last for three seconds for a warning indication. The three second requirement is due to the need to filter spurious false warnings from hydraulic and computing delays.
The actuators have four modes. Active mode allows the spoiler to be deployed and retracted on the demands of the relevant SEC. Biased mode causes the spoiler to retract when no SEC signal is available but hydraulic power is. If hydraulic power is lost, locked mode comes into action in which a closing valve function allows aerodynamic forces to close the spoiler but does not allow it to extend. The last mode is maintenance mode. This is invoked by using a spanner to turn a cam on the actuator, which in turn operates an internal spool valve. The spool isolates hydraulic pressure by allowing the fliud to recirculate freely in the piston ram. This prevents the spoiler from moving even if hydraulic power is applied. To revert to operational mode, the maintenance device has to be manually returned to the operational position.
The visual similarity between the spoiler system of the A320 and that of the Boeing 757 is marked. The manual release cam on the 757's spoiler actuator allows the control surface to be raised by hand. A mechanical lock is them placed around the extended ram of the spoiler actuator. This prevents accidental closure with the potential of injuring personnel.
The A320 maintenance manual has been complemented by a production management database (PMDB) which brings together exhaustive material and planning data only available previously in a number of individual documents. Both the manual and the database are obtainable on computer media (i.e. CD-Rom), microfilm and paper. However, Amtoss and the PMDB are formatted for use with computer based information retrieval systems. An operator using such a system can extract all the required pages and related information by entering a single ATA chapter number or keyword. A user is still required to call up the referenced information, but this is not a problem with computer based systems. If such a system is not available for use with the Amtoss based manuals, information retrieval is difficult and slow. The A320's manual has been the subject of criticism by some engineers, partly because of the Amtoss format. Therefore Airbus is preparing non-Amtoss manuals for those operators which require them.
It should be noted that subtasks are detailed in the body of the main text, while other related tasks are called up near the beginning of the procedure under referenced information. These tasks are found elsewhere in the maintenance manual.
Investigation of this revealed that this was a common problem and that although Airbus had made a number of approaches to Loral regarding the unit, the situation had not improved. Airbus has, since 1989, conducted flight tests with a different make of DFDR and only fitted the F800 on aircraft delivery after having bench tested the unit. AAIB tests with Loral's UK representative revealed that all four of the operator's A320s had DFDR problems - random track jumping, erroneous built-in test equipment (Bite) indications and corruption of recorded data (particularly at takeoff). Track changing and Bite problems were cured by the replacement of an electrically erasable programmable read only memory.
Data corruption causes are more problematical, but investigations indicate that if, on installation, an improved anti-vibration mounting tray was used, data quality would be enhanced significantly.
Every effort has been made to ensure this text is syntactically identical
to the original source.
Peter Ladkin gratefully acknowledges the AAIB and the Royal Aeronautical Society for permission for this use of their material.
|Peter B. Ladkin, 1999-02-08|
by Michael Blume