Aeroengine Safety

In line with the shift change(over) a shift handover occurs. During this procedure, but also apart from this, a transfer of tasks (task handover) can take place. A shift changeover should generally go on with a meeting (shift handover meeting). This primarily has to guarantee the task specific information of the concerned shifts and must occur befor the start of the shift. During the shift necessary informations for the following shift or the executing personnel of the next task must be gathered.
Analysis failures and accidents due to communication let suggest at typical deficits and generate so the base, to post rules/norms for a safe communication (Fig. "Effective communication").
There are cases in which a direct verbal communication is not possible. This can be expected in a not permanent two shift operation (only early shift and late shift) whose shift between dropped out. In such a case exists the icreased danger of an unsutable communication.
Besides those for the action necessary informations further can be required in the meeting for the shift changeover. To those belong capacits utilisation, authorisation for a destined approach, outage caused by illness and overtime hours.
The shift handover meeting should at least consist out of 2 parts: A meeting of the supervising persons of the shifts without time pressure. Typical themes are contained in Fig. "Effective communication", 19.1.1-3.1. A meeting notice with all relevant problems , especially unsolved, is obligatoric. A subsequent walkthrough by the supervising persons and the approving persons (certyfying staff), which should serve to insure the informations on site (ill. 19.1.1-3.2). This round tour is carried out best at the place of work, accordant the work cards.
A task handover takes place between two persons. That is especially necessary for tasks and processes out of the routine. Typical are two different situations. A personal or a indirect handover. If the task is interrupted and the continuing person is not yet defined.
The personally handover of a task should be carried out like a walkthrough written and vocal. The task must be adapted with with approptiate hints at all aberrations from the routine and demonstrate distinct the status of the work. The continuing person has to note deviations during the walkthrough. Does the situation not expire appropriate, from experience the increased danger exists, that it is supposed misleadingly the task was carried out accordingly to the instructions (manual, drawings, proceedings, Fig. "Risks of shift change over", -6.2, -6.3 and Fig. "Risk of shift changeover with not accomplished maintenance").
The indirect transfer of a task for a later resumption is not an unnormal situation. He who continues the task will is sign as finshed. Such a procedure is much more risky than the direct information during the handling over of the task. The information as written document isn't redundant, if a request for clarification is not possible. Task cards are not especially produced for such a situation. They depend from the particular
circumstances and therefore not always ideal as transmitting document. This is especially true if the work was interrupted because it deviates from the routine (Fig. "Work cards and plans for special tasks"). In such a case an additional document (e.g., add-on card) with definite affiliation to the workstep is necessary. Is such a amendement of the documents omitted from experience this can lead to a dangerous situation up to an aircraft accident. Therefore is in such cases the management level is committed, to provide sufficient time for the documentation.
There is literature about the difficulties of the communication available which provide an excellent support: „Aviation Maintenance Human Factors“ (JAA JAR145, Lit. 19.1.1-2 available in the internet) of the Civil Aviation Authority (CAA). On these reley the following pages whose illustrations were designed under didactic aspects. Is there the wish to engage deeper with the problematic, the referred literature is qualified. Here important literature references can be found. Significant papers to the theme have been obviously initiated by the DOE (Department of Energy der USA). These naturally apply for a wider circle than the aero engine technology. Therefore exists a certain generality, at least for energy plants/power stations. In the illustrations 19.1.1-2, 19.1.1-3.1 and 19.1.1-3.2 there are guide lines compiled for responsible hierarchy levels of a shift handover.
Basically there are three preconditions for a sufficient shift handover:

• The diverging person is in the position to identify important informations and to communicate with the resuming person.
• The resuming person can receive the information of the diverging person and understand in the intended sense. Thereby it should be clear that there can be communication problems in spite of the received word. That is the case, if the not understood sense triggers unintended respectively unforseen reactions. Thereby the individual, subjective understanding before the background of expectations, hopes and anxieties plays essential role (Fig. "Direct communication influences"). * The communication takes place at an arranged, suitable location.
  

As a further important condition for a suitable communication the „ownership feeling” and the formality were identificated. The exrecise of a task demands the personal adoption of the responsibility. Does this happen, the right and complete closure is a personally wish , even when the task is finished in an other shift by an other person. In contrast to this positive engagement stands „in my shift nothig happened…“. With this any responsibility is rejected. Formalities demand a defined shift handover behind which the management level distinguishable stands. An insufficient engagement of the management realises the maintenance personnel fast. Typical symptomes are unsufficient goals, too little time for a sufficient shift handover, as well as indadequate help and the lack of equipment/facility (e.g., room).

Figure "Direct communication influences" (Lit. 19.1.1-2 and Lit. 19.1.1-12): The from both sides accordant understood message of a communication is important for maintenance work and so for the airplane safety (Fig. "Maintenance resource management MRM" and Fig. "Maintenance failures by language barriers"). Reports of accidents and incidents reveal three types of situations of failure casual communication problems:
A wrong information (upper sketch) can happen aware or unconscious, e.g., mistakable. In the example after a maintenance process a handlamp is missed. It's possible that the lamp was displaced but this is not admitted.
If the situation is not aware, this can lead to a false assessment and actions. For erxample this one who misses the lamp thinks primarily to search for it. The potential danger of a momentous foreign object damage will not be seen by him or underestimated. Also the supervisor understandably does not see in a theft the problem of catastrophic subsequent damages.
The information leads to different estimations respectively models of the situation: contray to the hope/belief to find the missed lamp, stands the awareness of the danger of a foreigen object damage in the engine.

Figure "Effective communication" (Lit. 19.1.1-2): this compilation shows remedies respectively behaviour rules during communication problems in the technical area, especially in line of a shift changeover.

There are very different possibilities to pass a massage. To these belong documents like papers, diagrams or drawings and sketches, speach and gestures (aware or body language). These possibilities can also be combined. Are informations exchanged in more than one manner, the redundancy increases the safety extraordinarily.

An information must be absorbed and assimilated, to capture its meaning. That needs time and demands the constriction at the „key informations” („a“). The possibility of a request promotes the understanding („b, c”). That is also true as well for the listener as also for this one who informs. So he notices if the information is received and well understood.
The process of the shift handover, especially deviations from the routine, needs a common imagination model that contains, the maintenance task, status of the work, concerned devices/tools and surrounding. Such an imagination model can be lost during changes over a longer absence (e.g., illness) or with new colleagues without specific experience. in such situations the management has to provide enough time for the shift handover.

Not to underestimate are communication problems as result of different languages and culture areas. To this belong deviating imaginations of technical terms which lead to interpretation faults. Those possibilities are avoidable with suitable, good understandable and precise manuals (chapter 19.1-2).

Figure "Managing and inspection during shift changeover 1" and 19.1.1-3.2 (Lit. 19.1.1-2): During the shift handover meeting (page 19.1.1-2 and -3) in line with a shift changeover the executive level (management) has to regard at specific points. These must ensure the organisatoric preconditions for the process and safety of the maintenance work.

Fig. "Work cards and plans for special tasks" (Lit. 19.1.1-2): The work outside the routine have from experience a high potential for problems and failures (Page 19.1.1-3). This compilation shall give the originator of the work cards a support in such cases. Contains work/actions features in the left column, it is recommended that during not routine work suitable forms (papers) with enough steps are used.

Figure "Maintenance failures by language barriers" (Lit. 19.1.1-12): Outsourcing of maintenance, overhaul and inspektionen serves primarily the cost minimisation and/or as sales support if aircraft. That leads to an increasing portion of employees, whose native language doesn't comply with that of the OEM, especially not the English language. This is the actual language of the aviation, also in maitenance and overhaul. Aviation maintenance technicians (AMT) have to pass their tests in English. The FAA documentation about approved firms happens also in English. That can mean for persons with an other language a additional workload, increasing time need and more errors. Up to now there is hardly evidence , that this insufficiecy lead in practice to failures (diagram lower left).

Already 1997 however, an analysis of aircraft accident reports showed, in what manner an unsufficient communication can affect safety relevant (Fig. "Direct communication influences"):

• Use of a faulty information.
• Wrong estimation of a situation.
• A common situation model of the participantswill be obviated.
  

To get clearness, an investigation project was started whose first results are contained in the diagrams. Possibilities of the communication up to the transfer into actions in the maintenance process and its problems shows the upper sketch. The most frequent form of communication during work is informal, that means not documented, even not spoken (gestures). It happens synchron. In the sketch typical problems of this communication for maintenance work at the whole airplane are compiled. A documented communication, that means written, is designated as formal. Its problems shows the left frame. Usually it serves a time shifted message transfer (asynchron). This can happen written or by voice recording. The diagram down left shows the failure causes, down right the remedies. The „noise relation“may also refer to speech documents.

Illustrations 19.1.1-6.1 and 19.1.1-6.2 (Lit. 19.1.1-1): This incident with high falure and danger potential, that comparatively got off lightly, stays exemplary for the dangers in causal connection with shift changeovers. An particular danger exists in connection with inspection/maintenance doors and flaps (Fig. "Risk of shift changeover with not accomplished maintenance"), which are not sufficient secured and so can detach during operation.
In the case on hand deficits of the human factors of the shift changeover in the following areas can be identified :

• Documentation of the work
• Communication/information
• Ergonomics for controls/inspections
• Logistic / supply

In Fig. "Maintenance problem and shift changeover" the process of the last maintenance action before the incident with its safety critical phases is described. Those informations were, as far the author understood, extracted from the available accident/incident report.

As far as the engine is concerned in the first shift a return oil pipe had to be changed. This includes also the exchange of the fastening clamps. Of cause the change of the pipe line demanded the opening of the

later separation of the maintenance door. The pipe line could indeed be changed, the obvious necessary clamps where not on site and had been asked for. At the earliest they could be assembled in the next shift. From this resulted the first problem:

„1a”: To guarantee that the clamps are mounted a new work card for the next shift must have established („1c“). But this didn't happen. Instead on the existing work card the whole pipe line change was signed as finished („1b”). Also in the, for the shift handover necessary „handover book“ the outstanding work step was not registered („1d”). So no documentend hint existed. During the shift handover merely verbal the necessity of the clamp fitting was was indicated. The aware recording of this hint was obviously affected by a distraction during the communication at the shift handover. So the clamps were no more fixed. Thereby also the chance was allocated to detect the unsecured maintenance door respectively to carry out the locking after the mountiong of the clamps.

The outstanding mounting of the pipeline clamps was indeed identified in the third shift, the last before the flight approval. But because the clamps wer not yet supplied, this task was shiftet in favor of other maintenence activieies. Later it was mo more executed („1e“).
After the complete pipeline assembly the maintenance door was slam shut, however not secured with the fasteners („2a”). From the point of view of the human factors thereby the doorfasteners were problematic:

In the only closed condition the securing fasteners were very unfavourable controllable with a sight check (Fig. "Dangerous situations by disregarded human factors").

During handover of the second shift (night shift) the unsecured door was not mentioned („2b“). Probably it was supposed, that for the assembly of the missing clamps, the door must be opened again. Than the securing would have happened. Written documents about this deficit were, like already described, not existing and the clamps were not yet supplied. So they were no more mouted and the unsecured door not discovered („2c”).

Also in the third shift because the clamps were still not supplied (see „1c“) a chance was missed to identify the unsecured door („2d”). Because of the unfavourable human factor in the door area the unsecured doors were also not identified during two further inspection tours of the maintenance personnel („2e“) and the prescribed control tour of the pilot before the flight. That this chance could not be used, must be seen in connection with the missing inscription in the „journey logbook”. This should rather contain unfinished work as an information for the pilot („2f“).

Figure "Dangerous situations by disregarded human factors" (Lit. 19.1.1-1): To this the background is described in Fig. "Risks of shift change over". The only slammed but unlocked maintenance cover/door of the engine cowl was torn off during start. It damaged the nascelle and the control surfaces. To the accident contributed, that it was only possible with effort (on the knees, sketch below left) to inspect the locking mechanism. Standing, for example during a control tour of the supervisor or pilot it was not possible to see at the closed door if the fastener/locking lever was correct activated. This was merely possible if the locking lever (ca. 10 cm long) was opened downward. A warning plate on the door above the fastener, that points to the problem, was only easily readable at the opened maintenance door (sketch below right). Such an ergonomic deficit may for example violate the rules of the „human factors design guide” (Lit. 19.1.1-1.9).

Figure "Risk of shift changeover with not accomplished maintenance" (Lit. 19.1.1-8): Expecially for problems in the line of shift changeovers during maintenance work maintenance ports and doors seem especially prone (see also Fig. "Risks of shift change over"). In this case ripped the torn off fuselage sided door of the nacelle from the left engine a big hole into the leading edge of the related wing. It was then ingested by the middle engine which was thereby in- and outside heavily damaged. Possible reason was a failure of the maintenance personnel of the operator.

Two days before the accident at this airplane a maintenance was carried out because of an indication of the locking warning light of the thrust reverser with the following distinctive features:

• The thrust reverser was exchanged, what required the disassembly of the maintenance door of the cowl.
• After the exchange the door was again provisorily fixed. Thereby merely the bolt of the middle hinge was inserted. A securing with the appropriate nut did not occur.
• The following shift was verbal informed about the unfinished work.
• But this shift could dedicate itself not at once to this task, because other airplanes had to be preferred. At the return the supervisors supposed despite the former information, that all three hinge bolts are attatched and secured. They shut the door and secrured the fastener.
• Obviously a documentation about the work at the thrust revreser and the door did not occur in the maintenance lists. This was also not catched up during the approval of the airplane. This went into the air traffic with the in the form papers as open listed work.This process was contrary to the approach defined for inspections, maintenance and modifications, by the operator. This should prevent that an airplane goes into air traffic before the completion of all work:
  
• The organisation manual for the maintenance (maintenance administration manual) defines clearly responsibilities during shift changeovers.
• The manual for checks/inspections (base check manual) of the operator demands the examination of deviations to rule out a annoyance of the flight safety. Especially not normal opened doors and covers/cowls must be opened once again for safety reasons. This is to record in a maintenance attachment (maintenance supplement). In spite of the clear instructions such a record did not happen.

Note:

• Don't leave provisorily conditions, respectively don't deliver those during a shift handover. Verbal informations to the following shift are from experience not sufficient safe. Even open work in the maintenance papers can not avoid surely the flight approval.
  

Figure "Result example of an unsufficient maintenance" (Lit. 19.1.1-6): One day before the accident the constant speed drive (CSD) was disconnected after the oil pressure warning light flashed up. A following flight was cancelled because another maintenance aberration. An executive mechanic introduced the mechanics of the second shift. The exchange of the CSD should be undertaken after 24:00 o'clock. The mechanics decided to determine the failure cause (troubleshooting). Thereto the CSD was befor the engine start mechanically connected. But fhe light of the starting valve did not go out as it schould. Therefore after the shut down of the engine the valve was exchanged, the run repeated and the valve change signed. After the „fault Isolation handbook“ was consulted, it was decided to pull the connector of the cabling. However the replacemen CSD was not jet supplied. The connected CSD and the drawn connector have not been documented (sketch lower right). The recordings at the shift handover contained the deferred CSD maintenance, however not the coupled condition. But a verbal information should have taken place. The leading mechanic wanted to take care for the exchange, but this didn't happen. The coupled CSD with the drawn connector lead to overheating, fire and initial fusing in the CSD region.

Note:

• Verbal informations to the following shift are not sufficient safe.
• Not documented work/actions tend from experience to get „lost” over several shifts.

Figure "Risk of changing responsible personnel" (Lit. 19.1.1-10, see also Fig. "Borescope findings at turbine blades and vanes"): The engine manufacturer (OEM) had already since a longer time problems with failures by thermal fatigue at the nozzle vanes at the entrance to the high pressure turbine. If the crack formation is not identified at the right time with a periodically repeated boreskope inspection, the danger existed that a part of the vane blade breakes away. In this case extensive secondary failures are to be expected.

Parallel to the inspections proceeded the design of an improved guidevane. It schould make the the boreskope inspektionons unnecessary. For the removed cracked vanes a brazing repair (Fig. "Risk potential of brazing repairs") with a modification was developed equivalent to a modification of the newest design.

The OEM engaged the operator at the field testing of thwo repaired guide vane apparatus. The parts were by the OEM appropriate marked. Every 800 operation <U>cycles</U> a borescope inspektion should take place, especially at he endangered vane areas, as far as possible in presence with an OEM engineer. This instruction was changed by the OEM representative into a borescope inspektion all 800 operation <U>hours</U> (!), what only correlates 400 cycles. Especially hints at critical zones of th part were omitted.

The engineers of the operator decided on ground of their experience not to claim the 800 hours inspection and didn't realise the instruction. So, for the testing parts also the hitherto existing periodically borescope inspektion should not be applied. Instead, not agreed by the OEM, not until all 1600 cycles (equal to ca. 3200 operation hours) a borescope inspektion was scheduled.

In this time the, for this program responsible OEM engineer, sent two messages to the OEM representative at the operator. The messages reinforced a borescope inspection all 800 cycles (equal ca. 1600 operation hours) and to document the indications. At this time the OEM representative changed. The first message arrived directly before the change, the second shortly after it:

The significance of the instruction was not realised at the task handover and a transfer to the engineering department of the operator is not traceable.

So the inspection intervals of 1600 cycles that two times occurred persisted. Thereby the critical vane area (konvex bladeside, sketch below right) was not specific surveyed. A documentation of the findings remained also undone.

An analysis after the failure/incident showed, that a break out on the convex side of the blade leads to a dangerous flow disturbance (sketch below left). These triggers in the following turbine rotor blades even at small weak points fatigue fractures with catastrophic results.

Note:

• A change of the technical responsible personnel is afflicted with an especially risk. A sufficient training (time, extent), expertise and experience of the for the suited replacement person must be guaranteed.
• During special actions the necessary agreement/approval of the OEM must be documented together with the interpretation of the instruction.