Although such an interpretation may seem extraordinary, it is
well documented that individuals who generate an internal model
of the world with which they are content often require overwhelming
contradictory evidence before they are prepared to reassess their
model. This tendency may well be exacerbated when the mental
resources required for such reassessment are limited by, for example,
sleep deprivation or circadian (time of day) effects.
The effects of time of day on many physiological and psychological
variables are heavily researched, the results indicating that
the period between 0300 and 0600 is that during which human performance
is at its lowest ebb. It is likely that such time of day effects
were important both in enabling the Shift Maintenance Manager
to fail to make accurate perceptual discriminations, and in terms
of enabling him to fail to appreciate the significance of cues
with which he was presented. Direct circadian effects are compounded
in this instance with some sleep deprivation. As is common among
those on a first night shift, he had slept normally the night
before his shift, but slept little during the afternoon before
going on shift. Thus, at 0300-0500 he would have had a significant
requirement for sleep as well as being at his circadian low.
These factors may reasonably be regarded as combining to exacerbate
the effects described above.
Problems of Judgement and Work Practice
Items a, b, and e above may be regarded as problems of poor judgement
or work practice. The Shift Maintenance Manager's failure to
use the IPC and stores computer to their best effect, his failure
to heed the storeman's identification of the bolts, and his failure
to take any retrospective action when he realised the following
day that he was using bolts of a different size from those he
had used on the same job the previous day, lead to the conclusion
that he was not working with the degree of care that the job demanded.
What is less clear, however, is whether he was doing the job
in a way that he regarded as being of a standard acceptable to
the system within which he was working, or whether he knew that
his work practices left a good deal to be desired, but chose to
ignore this knowledge in the interests of expediency.
A clue to the solution may be found in the Shift Maintenance Manager's
other behaviour and in the opinions of his colleagues. A consistent
picture emerges from such considerations. He appears to be regarded
as solid and careful by others, and this assessment seems substantiated
by his behaviour on the night in question. Although his shift
did not start until 1030, he was at work 45 minutes early in order
to prepare himself and to get the work of his shift organised.
He also continued to work through his meal break. At interview
he does not give the impression of one who would take his responsibilities
lightly, or behave in a way that he would consciously appreciate
as derelict. One is left with the impression that the Shift Maintenance
Manager behaved in a way that he felt was appropriate to the circumstances
in which he found himself. Overall, his approach to the job could
be summarised as conscientious but pragmatic, rather than conscientious
and meticulous. A good example of this approach concerns his
decision to torque the windscreen bolts to 20 lbf in instead of
the specified 15 lbf in. He plainly did not do this as a matter
of expediency, but because he felt that this was a better way
to do the job. What was missing was an appreciation that such
individual work practices are completely out of place in aircraft
servicing.
This impression is reinforced by conversation with other shift
supervisors. At informal interview, these individuals gave the
general impression of being free to tackle jobs in idiosyncratic
ways, and when informed of the manner in which the Shift Maintenance
Manager behaved on the night in question they did not (except
one individual) regard this as unreasonable or demanding of censure.
It does not seem unreasonable to suggest that the general climate
in the maintenance facility at Birmingham was not one in which
the care and safety awareness exhibited by the staff matched the
criticality of the task. The nature of the maintenance operation
at Birmingham and the setting and checking of operational standards
is therefore examined below.
The Operating Environment
Inspection
A procedure included in many industrial operations that have safety
implications is that of independent inspection of work. It is
possible that independent inspection would have prevented this
accident since the poor fit of the bolt heads in the countersinks
was potentially observable. There are some more important general
points that may be made about the utility of inspection in safety
critical systems:
a. Independent inspection does not have a small effect on the
possibility of a maintenance error going undetected, but reduces
it dramatically. If an individual operator has, say, a .01 chance
of not noticing a fault, then the combined probability of two
such individuals failing to notice the fault becomes only .0001.
b. If an individual has made an error in work that he has carried
out, then (because he has developed a perceptual "set")
he is less likely to detect that error than an individual who
comes to the task both afresh and in a "checking" frame
of mind.
c. The knowledge that work is to be inspected may change the approach
of an operator to his task. It could be argued that the operator
would become less careful if he felt that inspection would pick
up his errors, and would make him feel less trusted and responsible.
For individuals with some pride in their work, however, the knowledge
that their work was to be inspected might well make them more
careful since they would not wish to be found to have made a mistake.
e. Inspection is likely to have a general effect on the individual
operator's perception of the standards and care expected of him
by the system. Inspection of work may serve as a regular reminder
to operators that the work they carry out has safety importance,
and must be carried out meticulously. It is likely that an operator
will perceive the absence of inspection as an indication that
the managers of the system regard the cost saving involved as
more important than the safety benefit, and this may well influence
the Shift Maintenance Manager's general approach to his task.
It is thus suggested that inspection represents an important addition
to the maintenance work practices evident in this accident, and
that it is especially important for work carried out at night,
when errors are more likely to be made, and less likely to be
detected by their perpetrators.
Lastly, it is interesting to note in this context that had this
windscreen been changed in the Royal Air Force, not only would
the work have been inspected, but the aircraft would have been
pressure tested on the ground before flight.
Maintenance of Standards in Working Practices
There appears to be a stark contrast between the procedures adopted
to ensure that pilots adhere to standard operating procedures
and to ensure that they are familiar with good working practice
and those adopted for maintenance personnel. Although the maintenance
environment is checked periodically to ensure, for example, the
calibration of equipment and currency of technical information,
there does not appear to be any checking of the knowledge of,
or techniques used by, the engineers. In the absence of such
checks, and in the apparent absence of any courses, instruction,
or training designed to ensure that aircraft engineers appreciate
the importance of standardised procedures, a meticulous approach
to the job, and the consequences of error, it should not perhaps
be regarded as surprising that experience and familiarity tend
to dull the engineer's conscious appreciation of the critical
nature of his task.It seems that the system operated at Birmingham
relied entirely on the "professionalism" of individual
shift supervisors to ensure that working practices were appropriate.
Whereas it is entirely right to expect a professional approach
from such individuals, the wisdom of leaving the safety of aircraft
entirely to individual judgement without having any systems for
maintaining consistency or for checking that high standards are
maintained must be questionable.
Design Safety
It is obviously highly undesirable that this windscreen assembly
should have been designed such that it could be fitted with bolts
that were very similar to the correct ones, that could be inserted
and engage with the anchor nuts, and yet which failed as soon
as they were loaded. It is not asking too much for considerations
such as this to be made during design, but the awareness that
this type of problem is best obviated at the design stage was
not widespread when this aircraft was conceived. It could also
be argued that this windscreen should have been designed to be
fitted as a plug from the inside of the aircraft - an obviously
safe practice in a pressurised hull.
Poor design is further evidenced by the fact that this aircraft
was already fitted with the wrong bolts (7Ds instead of 8Ds) in
the old windscreen. This is probably because the No 1 and No
3 windscreens are fitted with bolts of slightly different lengths,
yet only the shorter bolt is actually illustrated in the IPC.
It is difficult to believe that it would not have been easily
possible for these windscreens to have been designed so that they
were both fitted with the same size of bolt.
When a new windscreen is fitted, it is customary for the engineers
to fit new bolts only if those removed were damaged or paint clogged.
The relative cost of bolts and windscreen might suggest, however,
that it would not be unreasonable for new bolts to be fitted whenever
a windscreen was changed. If this were so, the windscreen could
be supplied as a kit with a set of correct bolts included.
It may also be observed that, once the type of bolt used on this
windscreen is removed from its packet, it carries no identifier,
compelling it to be identified by its physical characteristics.
It is possible that if its head were stamped with such an identifier
(eg 8D), then the Shift Maintenance Manager may have used
this instead of relying on a physical comparison.