Error Traps: How High-Performing Teams Learn To Avoid Mistakes in Aircraft Maintenance

INTRODUCTION

Hard work is irrelevant without integrity.

—ROLANDO PAULINO, SECTION MANAGER, TECHNICAL SERVICES

WHEN SOMETHING GOES WRONG in aircraft maintenance, the mechanics involved typically go through a miserable time. They get tested for drugs and are possibly suspended from work. They feel guilty that they have let their team down. In extreme cases, they consider resigning or even taking their lives.

And then you look at how things go wrong, and it is often the familiar pattern: People underestimate how easily mistakes can happen in maintenance and how seemingly small mistakes can result in big damage to aircraft and people—in short, how exposed they are every day. And you replace a mechanic with a pilot, planner, or manager and maintenance with any other field, and it could be very similar.

I am writing this with the misery I have seen in mind. As their leader, you suffer with them. Have I done enough to see it coming and mitigate the risk? Obviously not. The situations in which things go wrong seem to have much in common—to an extent which makes the accident or incident appear even more predictable and preventable. I started to look at these situations as error traps. My mission became to find ways to reduce the risk the people in my organization, including myself, are exposed to. The risk of a predictable mistake, which is not on their mind.

In an ideal world, we make things intuitive to use and foolproof, such as the famous Norman doors, which let you know whether to push or pull.¹ There are many examples in aviation where things function intuitively, like the little wheel on the landing gear lever, a guarded switch not to be pushed accidentally, or a built-in self-test of the aircraft systems. However, these features are far from foolproof and there are arguably more examples of less intuitive design. Ideally, systems or processes are designed in a fail-safe way to withstand an erroneous input or at least behave gracefully when parts of them malfunction. There are some good examples, yes, but in general, the remaining exposure is immense.

Starting with the closing of the V2500 fan cowl doors (FCDs), which can easily go wrong, I collected examples of error traps for an internal training program with the same name. In these trainings, I saw that people are surprisingly unaware of the patterns in which things tend to fail. I felt it is my obligation to do more to prepare my colleagues for the possibility that they end up in a life-changing error, which looks totally predictable to the rest of the world—an error trap.

In aviation, an error can cost you your job, or, in extreme cases, your life, and not to mention the lives of others. An error can cost you your job, even if you have not caused damage. Now, what causes what and who or what is to blame is a controversial topic in safety management. Let’s look at an example.

In October 2018, Lion Air Flight 610 crashed and killed all on board—the first fatal accident of a Boeing 737MAX. The investigation report lists twenty-five recommendations without assigning blame or root causes (let alone the one cause).²

The immediate cause, which set the chain of events in motion and distinguished it from a normal flight on a normal day, was the miscalibration of a component (the AOA sensor) in a repair shop in Florida, a type of fault that possibly happens several times per day somewhere in the system without bringing down an airliner. Even within that repair shop, it wasn’t a simple linear chain of events initiated or concluded by a classical human error, but a rather systemic issue to operate test equipment without detailed instruction of use.

No single individual acted outside their envelope of normal performance variation, let alone recklessly. It was an accident waiting to happen. Still, one of the involved actors in the cockpit or on the ground could have managed to avert the catastrophe on the fateful two days after the faulty component was installed. The pilots on the day before the accident especially could have taken into consideration the erratic behavior of the airplane more seriously than making a routine logbook entry about fault messages. That is, of course, speculation, and even more so would be the question of what would have happened then instead. Nobody would say, though, that these pilots have caused the crash. On the contrary, what happened at Lion Air was not remarkable and different from what happens everywhere in the worldwide aviation system without any consequences most of the time.

It is sometimes, arguably always, difficult to say what caused an accident or incident.

It is now widely accepted that Boeing and the FAA have a prominent role in the effort to preclude such a disaster from happening again. Many decisions at Boeing, since the 1990s, have contributed to the design issues which have resulted in an almost inevitable accident.³ This is the field of safety science: the many factors detached in space and time which cause complex socio-technical systems to fail. If safety science is successful, the whole system will see less accidents.

But there is also another perspective: The pilots, especially those on the penultimate flight, and maintenance could have saved this flight. This is not to say they have caused the accident. Saved this flight, but maybe not at the same time another or the second B737MAX crash, Ethiopian Airlines Flight 302, some months later. This is the field of error control. If successful, our own small sphere of influence may see less accidents but not the system as a whole, at least not directly.

Safety science and error control have different ways to look at accidents and their causes, especially when it comes to preserving and further extending the achievements of safety in aviation. The common ground here seems to be the need for capable leadership at all levels.⁴ I think it is fair to say that we don’t blame the pilots or maintenance technicians for Boeing’s shortcomings in the example above, but at the same time, that we accept those shortcomings as a fact of life, at least on our next shift and, thus, expect certain behaviors from pilots and maintenance technicians which take these realities into account.

Our angle here is error control. What can we do in our sphere of influence to avoid mishaps, which is important for two reasons: First, the chain of events ending in damages can be intercepted by certain behaviors flowing from specific attitudes. Second, and this is the very mission of this book, avoiding predictable errors will reduce exposure to become collateral damage in mishaps initiated elsewhere, either as a direct victim of design flaws or other suboptimal decisions, or indirectly like Lion Air’s maintenance. The technicians who released Flight 610 to service were suspended immediately after the accident. It is unknown whether they have been reinstated, but the investigation report also revealed their shortcomings in troubleshooting, whether these errors could be seen as contributing factors or not. I call this exposure. Many people are just not aware of how exposed they are, every day.

This book is about error control. But it’s not so much about techniques and best practices, as the title might suggest. It’s more about this one modest insight that aircraft maintenance (and life in general) is a hostile environment, in which accidents will always look like they were waiting to happen. Which tools you use then to ensure you have done your very best to keep every aircraft you touch as safe as possible for your team on the ground and the pilots and passengers in the air, and how you choose to put in place your defenses, is entirely up to you.

It is my hope that this discussion, based on years of collected knowledge and experience, can in some measure, improve airline safety and reduce the personal liability that every person in the aviation system is exposed to every day.

CHAPTER 1

The Mother of All Error Traps

V2500 FAN COWL DOORS

Why are people having problems? they wonder. You are being too logical, I say. You are designing for people the way you would like them to be, not for the way they really are.

—THE DESIGN OF EVERYDAY THINGS BY DON NORMAN

ROMANIA, NOVEMBER 2011. Bucharest Băneasa International Airport (BBU) is the home base for ten Airbus A320 airplanes of the fast-growing Romanian fleet of a pan-European low-cost carrier. Our team consists of twenty-five Hungarian line maintenance technicians, delegated from our home base in Budapest. Tough guys. Super experienced. It’s minus 10, minus 20 degrees Celsius on this cold, dark Romanian night, and they simply turn up the collars of their jackets and shrug it off.

Tonight is the weekly A-check for one of the ten planes in the fleet. The A-check is a more substantial work package requiring all hands on deck, so that the routine night-stop work can continue in parallel. At least tonight’s A-check can be done in a hangar hosted by a local aerospace company. It’s unheated, so full outdoor gear remains on, but at least it serves as a buttress from the howling winds and blowing snow. The crew works under pressure and mostly alone on their tasks all night, as there is no spare capacity on an A-check. Not having the plane ready for its first flight in the early morning is not an option, and everyone knows they must stay on task to meet the deadline.

Just before 4:00 a.m., all that is left is the final close-up and paperwork before the plane is towed out from the hangar. One of the crew, I’ll call him Gábor, worked on the V2500 engines. He checked the integrated drive generator (IDG) oil level and differential pressure indicator among other tasks requiring him to open FCDs. The FCDs are like the hood of a car; they separate the engine from the elements but theoretically, the plane could fly without them. To open and close them is as simple as closing the hood of the car, with one difference: The FCDs must be secured by four latches underneath the engine. This requires the mechanic to lie on their back beneath the engine and work upward.

Gábor performs the task, locking the FCDs and the plane is ready for tow out.

At 6:00 a.m., the aircraft takes off as scheduled for its first flight of the day. As the plane ascends, screams erupt from the passengers on the left side of the plane as they watch the wind peel back the large FCD and rip it off its hinges. It flies past their windows, smashing against the wing and the tailplane before it soars out of sight. The engine is now fully exposed and begins to billow what looks like smoke. It’s not long before images of the terror appear on social media. A PR nightmare for this growing low-cost carrier in a promising new market.

The plane lands safely back at BBU, but what a disaster. Two million in repairs and $8 million in lost revenues during the six weeks the plane will be grounded for repairs. Besides the FCDs and the damage to