Australia has an excellent air transport safety record. Major
Australian airlines have long been regarded as being among the
world's safest, and there have been no fatalities involving an
Australian high capacity jet aircraft. This enviable record is due,
in part, to an aviation safety culture that recognises the need for
constant safety awareness.
Given the commercial pressures facing international aviation,
the events described in this report should be seen as a learning
experience for the aviation industry, regulatory bodies, and all
organisations concerned with continuing airworthiness
assurance.
In December 2000 and in April 2001, a number of Ansett Australia
(Ansett) Boeing 767 (B767) aircraft were withdrawn from service
because certain required fatigue damage inspections of the aircraft
structure had been missed. As a result there was uncertainty as to
the continuing airworthiness status of the aircraft. In December
2000 the concerns related to possible fatigue cracking in the rear
fuselage of the aircraft, and in April 2001 the concerns related to
possible fatigue cracking of the engine strut fitting on the wing
front spar.
On 11 January 2001, the Australian Transport Safety Bureau
(ATSB) commenced an investigation into the circumstances
surrounding the withdrawal from service of the Ansett B767 aircraft
as the situation was regarded as indicative of a potential safety
deficiencyi. On 10 April 2001 the ATSB
investigation was extended to include an examination of the
continuing airworthiness system for Australian Class Aii aircraft such as the
B767.
Action by Ansett and the Civil Aviation Safety Authority (CASA)
addressed the potential risks to fare-paying passengers. Although
Ansett was subsequently placed into voluntary administration in
September 2001, the ATSB continued a detailed systemic
investigation because of the importance of the issues involved,
both in Australia and internationally.
The international continuing airworthiness system, like all
complex and safety-critical activities, is dependent on
robustiii systems to maintain high
reliability. The circumstances surrounding the withdrawal from
service of the Ansett B767 aircraft revealed, among other things,
that the reliability of the continuing airworthiness system was
threatened by a number of weak defences.
The B767 aircraft type was among the first in the world to be
designed and certified under damage tolerance principles. Damage
tolerance certification relies heavily on scheduled inspections to
ensure continuing airworthiness. The aircraft structure is designed
to maintain integrity until any fatigue or corrosion damage can be
detected at a scheduled inspection, and appropriate action taken.
Therefore, in itself, the presence of fatigue cracks in the Ansett
B767 aircraft was not necessarily a cause for undue concern.
However, it was critical that there were robust systems to ensure
that the required structural inspections were carried out to detect
the cracks before they exceeded acceptable limits.
Withdrawal from service of Ansett B767 aircraft in
December 2000
Ansett was the sixth airline worldwide, and the first airline
outside North America, to operate the B767. Of the nine Ansett
B767-200 aircraft, five were first flown in 1983 and two in 1984.
The aircraft accumulated a high number of flight cyclesiv because they were
mostly flown on comparatively short domestic sectors. Ansett had
been working with Boeing on fatigue cracking in the area of the
Body Stationv 1809.5 bulkhead outer
chord since 1996.
In June 1997, Boeing introduced the Airworthiness Limitations
Structural Inspection programvi for
the B767. The program was an essential part of the damage tolerance
requirements and was designed to detect fatigue cracking in
susceptible areas that had been identified through testing and
in-service experience. Ansett staff did not initially recognise
that some Airworthiness Limitations Structural Inspections were
required by 25,000 cycles and a period of almost two and a half
years elapsed before that error was identified. At the time that
the inspection program was introduced, some Ansett B767 aircraft
had already flown more than 25,000 cycles. In June 2000, further
25,000 cycle inspections were introduced, including in the area of
the Body Station 1809.5 bulkhead outer chord. Ansett did not
initially act on this.
In December 2000, Ansett senior management became aware of the
missed inspections and the aircraft were withdrawn from service on
23 December 2000, despite the high commercial cost to the company.
At that time, both Ansett and CASA were of the belief that
compliance with the missed inspections was mandatory. Subsequent
legal advice indicated that the regulatory basis for mandating
compliance with the Airworthiness Limitations Structural
Inspections for Australian operators was unclear. On 29 December
2000, CASA issued a direction to Ansett specifically mandating the
inspections for the Ansett B767 aircraft.
The ATSB investigation found that the Ansett system for the
introduction and scheduling of the B767 Airworthiness Limitations
Structural Inspections was deficient and vulnerable to human error.
A mistake or omission by one or two people could potentially result
in continuing airworthiness assurance being compromised. In
addition, deficiencies existed in resource allocation and in the
supporting information management systems.
From October 1998, Boeing also issued a series of service
bulletins in relation to fatigue cracks in the area of the B767
Body Station 1809.5 bulkhead outer chord. Service bulletins are
issued by aircraft, component, or engine manufacturers to provide
operators with relevant service information. Not all service
bulletins are safety-related, and compliance with a particular
service bulletin can only be mandated by the State of Registry of
an aircraft.
Boeing initially notified operators that the service bulletin
requirements were primarily commercial in nature. It was not until
November 2001 that Boeing indicated that the service bulletin dealt
with a potentially major safety issue. The FAA had mandated action
by US operators in relation to the service bulletin in April
2001.
Any action to be taken by Ansett in relation to the Body Station
1809.5 service bulletins issued by Boeing was complementary to
requirements under the B767 Airworthiness Limitations Structural
Inspection program. It was the failure by Ansett to appropriately
incorporate the required Airworthiness Limitations Structural
Inspections, issued in June 1997 and updated in June 2000, into the
B767 system of maintenance that led to the withdrawal from service
of six Ansett B767 aircraft in December 2000.
Withdrawal from service of Ansett B767 aircraft in April
2001
In March 2000, Boeing issued an Alertvii service bulletin
to detect and repair fatigue cracks in the wing front spar outboard
pitch load fitting of the B767 engine mounting strut. Boeing
recommended that the work be carried out within 180 calendar days.
A revision to the service bulletin was issued in November 2000. In
March 2001, Ansett became aware that they had not acted on either
the original or the revised service bulletins.
During the period from 7-9 April 2001, inspections revealed
cracks in the pitch load fittings of three of the Ansett B767
aircraft and they were withdrawn from service. On 9 April 2001 CASA
required that a further four Ansett B767 aircraft be withdrawn from
service, pending inspection. Those inspections were subsequently
carried out, and the aircraft were cleared to fly.
Deficiencies in the Ansett engineering and maintenance
organisation
The ATSB investigation found that similar deficiencies within
the Ansett engineering and maintenance organisation led to the
withdrawal from service of the B767 aircraft in December 2000 and
April 2001. Those deficiencies were related to:
- organisational structure and change management
- systems for managing work processes and tasks
- resource allocation and workload.
However, the investigation found no evidence to suggest that
Ansett had deliberately breached airworthiness regulations.
Ansett had undergone considerable change over a number of years.
Many of the Ansett systems had developed at a time when the company
faced a very different aviation environment. Over time, efficiency
measures were introduced to improve productivity but the
introduction of modern robust systems did not keep pace with the
relative reduction in human resources and loss of corporate
knowledge.
Risk management and implementation of change within the Ansett
engineering and maintenance organisation were flawed. Inadequate
allowance was made for the extra demand on resources in some key
areas during the change period.
The Ansett fleet was diverse and the point had been reached
where some essential aircraft support programs were largely
dependent on one or two people. Hence it was possible for an error
or omission by a particular specialist to go undetected for a
number of years.
Resource allocation and workload issues had been evident within
some areas of the Ansett engineering and maintenance organisation
for a considerable period of time. The investigation found that
measures aimed at achieving greater productivity had been
introduced throughout the organisation without sufficient regard to
the different circumstances and criticality of the different work
areas. Insufficient consideration had been given to the possible
consequences of resource constraints on the core activities of some
safety-critical areas of the organisation.
People and robust systems are two of the prime defences against
error. Therefore, a combination of poor systems and inadequate
resources has the potential to compromise safety. If a failure by
one or two individuals can result in a failure of the system as a
whole, then the underlying problem is a deficient system, not
simply human fallibility.
The Australian continuing airworthiness
system
The ATSB investigation found that based on the Ansett B767
experience, the Australian system for continuing airworthiness of
Class A aircraft was not as robust as it could have been, as
evidenced by:
- uncertainty about continuing airworthiness regulatory
requirements - inadequate regulatory oversight of a major operators continuing
airworthiness activities - Australian major defect report information not being used to
best effect.
The investigation identified a need for the regulatory basis for
continuing airworthiness requirements of Class A aircraft to be
better defined and disseminated to operators.
No evidence was found to indicate that CASA had given formal
consideration to monitoring the introduction of the B767
Airworthiness Limitations Structural Inspection program by Ansett
from 1997 onwards.
Prior to December 2000, there was apparently little or no
awareness among Ansett senior management or within CASA of the
underlying systemic problems that had developed within the Ansett
engineering and maintenance organisation. The presence of
organisational deficiencies remained undetected. In addition, there
were delays in adapting regulatory oversight of Ansett in response
to indications that Ansett was an organisation facing increasing
risk.
The decision by the then Civil Aviation Authority in the early
1990s to reduce its previous level of involvement in a number of
safety-related areas did not adequately allow for possible
longer-term adverse effects. This included reducing the work done
by Authority specialist staff in reviewing manufacturer's service
bulletins relevant to Australian Class A aircraft, and relying on
operators' systems and on action by overseas regulators in some
airworthiness matters.
CASA's central database for major defect reports was incomplete,
partly due to deficiencies in reporting, and the information
received was not always fully analysed. In addition, feedback to
the initiators of major defect reports, and to other operators, was
limited. As a result, the potential safety benefit of the major
defect reporting system was not fully achieved.
The FAA and ICAO
Delays by the US Federal Aviation Administration (FAA)
contributed to a lack of awareness by Ansett and CASA of required
B767 Airworthiness Limitations Structural Inspections. This
breakdown in FAA process was acknowledged by the US Secretary of
Transportation in August 2001. The FAA did not issue airworthiness
directives in relation to the June 1997 Airworthiness Limitations
Structural Inspection program, or the service bulletins for the
Body Station 1809.5 bulkhead outer chord and the wing front spar
outboard pitch load fitting, until after the second Ansett
groundings in April 2001.
Different views within the FAA as to the importance of
airworthiness directives to mandate continuing airworthiness
requirements for damage tolerance aircraft types contributed to a
lack of timely action by the FAA. The ATSB report includes
recommendations that the FAA ensure that such airworthiness
directives are processed and released without undue delay, and that
affected parties should be informed when delays do occur. The
report also recommends that the FAA ensure that the process for
determining grace periods for aircraft to comply with airworthiness
directives is both systematic and transparent.
The ATSB report outlines where the existing international
continuing airworthiness system, as defined by International Civil
Aviation Organization (ICAO) standards and recommended practices,
could be enhanced by the application of quality assurance
mechanisms to the processing and distribution of safety-related
information.
The events outlined in this report indicate that there was a
breakdown in the continuing airworthiness system within Ansett, the
FAA, and CASA. In addition, the possible safety significance of
cracks in the area of the B767 Body Station 1809.5 bulkhead outer
chord was not initially highlighted by Boeing.
Safety action
On 12 April 2001, the ATSB released two safety recommendations
to CASA. The intent of these recommendations was to enhance the
robustness of the systems used to manage the continuing
airworthiness of Australian registered aircraft such as the B767 by
ensuring that:
- action, or lack of action, by another State did not adversely
affect the safety of Australian Class A aircraft - all service bulletins relevant to Australian Class A aircraft
were received, assessed and implemented or mandated as
appropriate.
CASA subsequently initiated a comprehensive review of its
systems to monitor, assess, and act on service bulletins, to ensure
that those critical to safety could be readily identified and acted
upon appropriately. Recommendations from that review were addressed
in an associated implementation plan that detailed the nature and
timing of the actions that CASA would take in response to the
recommendations. The ATSB is monitoring the implementation of this
important safety action.
In response to the circumstances of the events of December 2000
and April 2001, the FAA has included further checks and balances
designed to ensure that all service bulletins issued by US
manufacturers are properly reviewed and addressed. In addition, the
FAA has established an 'early warning system' to provide non-US
airworthiness authorities with information on pending occurrence
investigations that may result in mandatory action by the FAA.
The manner in which events developed highlights the need for
organisations to be continually mindful of potential threats to
safe operations. Periodic review is needed to ensure that existing
systems for maintaining air safety keep pace with the changing
environment.
Implementation by the relevant organisations of the
recommendations made by the ATSB as a result of this investigation
should help to ensure that aviation systems, both within Australia
and internationally, are strengthened and that air safety for Class
A aircraft is enhanced.
i Section 19AD of the
Air Navigation Act 1920 defines a safety deficiency as any
situation related to aviation that can reasonably be regarded as
having the potential to affect adversely the safety of
aviation.
ii Class A refers to
an aircraft with a Certificate of Airworthiness issued in the
transport category, or one that is used for regular public
transport operations.
iii In the context
of this report, a system is robust if, when someone makes an error
or a problem occurs for some other reason, the system can detect
the deviation and recover without any significant negative
effect.
iv A flight cycle is
one completed take-off and landing.
v Body Station number is
the distance in inches from a datum in front of the nose of the
aircraft to a particular point of the aircraft structure.
vi The Airworthiness
Limitations Structural Inspections were in addition to zonal
inspections and scheduled structural inspections that had formed
part of the B767 maintenance program from the time the aircraft
entered service.
vii Boeing service
bulletins are classified into three categories in order of urgency:
Alert, Unusually Significant, and Standard. Alert service bulletins
are issued for safety-related issues that require the immediate
attention of the operator.