An Overview of Human

Insert document title Factors

in Aviation Maintenance

Location | Date

ATSB Transport Safety Report

Research
Investigation
[Insert Mode]
Aviation Research
Occurrence
and Analysis
Investigation
XX-YYYY-####
AR-2008-055
Final December 2008
 ATSB TRANSPORT SAFETY REPORT
Aviation Research and Analysis Report
AR-2008-055
Final

An Overview of Human Factors

in Aviation Maintenance

Alan Hobbs Ph.D.

- iii -
Published by: Australian Transport Safety Bureau
Postal address: PO Box 967, Civic Square ACT 2608
Office location: 62 Northbourne Ave, Canberra City, Australian Capital Territory
Telephone: 1800 020 616; from overseas + 61 2 6274 6440
Accident and incident notification: 1800 011 034 (24 hours)
Facsimile: 02 6247 3117; from overseas + 61 2 6247 3117
E-mail: [email protected]
Internet: www.atsb.gov.au

Commonwealth of Australia 2008.

This work is copyright. In the interests of enhancing the value of the information contained in this
publication you may copy, download, display, print, reproduce and distribute this material in
unaltered form (retaining this notice). However, copyright in the material obtained from other
agencies, private individuals or organisations, belongs to those agencies, individuals or
organisations. Where you want to use their material you will need to contact them directly.
Subject to the provisions of the Copyright Act 1968, you must not make any other use of the
material in this publication unless you have the permission of the Australian Transport Safety
Bureau.
Please direct requests for further information or authorisation to:
Commonwealth Copyright Administration, Copyright Law Branch
Attorney-Generals Department, Robert Garran Offices, National Circuit, Barton ACT 2600
www.ag.gov.au/cca

ISBN and formal report title: see Document retrieval information on page vii.

- iv -
CONTENTS
THE AUSTRALIAN TRANSPORT SAFETY BUREAU ............................... viii

Introduction ............................................................................................................ 1
The cost of maintenance error........................................................................... 1
Unique human factors issues in aviation maintenance ..................................... 2
Examples of Accidents Related to Maintenance............................................... 3
Japan Airlines Boeing 747, 1985.......................................................... 3
Eastern Airlines L-1011, 1983 ............................................................. 4
Aloha Airlines Boeing 737, 1988 ......................................................... 6
British Airways BAC-111, 1990 .......................................................... 7
Air Midwest, Beech 1900D, 2003 ........................................................ 7

A model of accident and incident causation ......................................................... 9

Individual actions .............................................................................................. 9
Physical descriptions of errors............................................................ 10
Psychological descriptions of errors ................................................... 10
Local Conditions ............................................................................................. 17
Time pressure ..................................................................................... 17
Maintenance procedures and documentation ..................................... 17
Teamwork ........................................................................................... 18
Shift handover .................................................................................... 20
Group norms ....................................................................................... 22
Fatigue ................................................................................................ 22
Lack of system knowledge ................................................................. 24
Equipment deficiencies ...................................................................... 24
Design for maintainability .................................................................. 24
Risk controls ................................................................................................... 26
Organisational influences on maintenance error ............................................. 27

Managing the risk of maintenance error ............................................................ 29

Error management systems ............................................................................. 29
Incident reporting programs in maintenance ...................................... 29
Human Factors Training ..................................................................... 30
Learning from incidents ..................................................................... 31
Incident Investigation Systems ........................................................... 31

- v -
Conclusion ............................................................................................................. 33

Resources and further reading ............................................................................ 34

References ............................................................................................................. 35

- vi -
DOCUMENT RETRIEVAL INFORMATION

Report No. Publication date No. of pages ISBN

AR-2008-055 December 2008 43 978-1-921490-93-4

Publication title
An overview of human factors in aviation maintenance

Author
Hobbs, A.

Prepared by Reference No.

Australian Transport Safety Bureau Dec2008/ INFRA-08352
PO Box 967, Civic Square ACT 2608 Australia
www.atsb.gov.au
Abstract
Maintenance is essential to aviation safety, yet improper maintenance contributes to a significant
proportion of aviation accidents and incidents. This is because a small percentage of maintenance
tasks are performed incorrectly or are omitted due to human error. Examples include parts
installed incorrectly, missing parts, and the omission of necessary checks. While precise statistics
are unavailable, it is likely that the great majority of maintenance errors are inconsequential,
however, a small proportion present significant safety threats. In comparison to many other threats
to aviation safety, the mistakes of maintenance personnel can be more difficult to detect, and have
the potential to remain latent, affecting the safe operation of aircraft for longer periods of time.
While acknowledging that maintenance personnel are responsible for their actions, it must also be
recognised that, in many cases, the errors of maintenance technicians are the visible manifestation
of problems with roots deep in the organisation. A careful examination of each error, combined
with a preparedness to inquire into why the error occurred, can help to identify underlying
organisational problems. Effective countermeasures to maintenance error require a systemic
approach, not only towards issues at the level of the technician and their work environment, but
also to organisational factors such as procedures, task scheduling and training. Some
countermeasures to the threat of maintenance error are directed at reducing the probability of error
through improvements to training, equipment, the work environment and other conditions. A
second, complementary, approach is to acknowledge that despite the best efforts, it is not possible
to eliminate all maintenance errors, and countermeasures must be put in place to make systems
more resilient to those residual maintenance errors that are not prevented.
Aviation organisations are increasingly introducing safety management systems (SMS) that go
beyond legal compliance with rules and regulations, and instead emphasise continual
improvement through the identification of hazards and the management of risk. The activities
involved in managing the risk of maintenance error can be appropriately included within the SMS
approach. Key activities include internal incident reporting and investigation systems, human
factors awareness for maintenance personnel, and the continual identification and treatment of
uncontrolled risks.

- vii -
THE AUSTRALIAN TRANSPORT SAFETY BUREAU
The Australian Transport Safety Bureau (ATSB) is an operationally independent
multi-modal bureau within the Australian Government Department of
Infrastructure, Transport, Regional Development and Local Government. ATSB
investigations are independent of regulatory, operator or other external
organisations.
The ATSB is responsible for investigating accidents and other transport safety
matters involving civil aviation, marine and rail operations in Australia that fall
within Commonwealth jurisdiction, as well as participating in overseas
investigations involving Australian registered aircraft and ships. A primary concern
is the safety of commercial transport, with particular regard to fare-paying
passenger operations.
The ATSB performs its functions in accordance with the provisions of the
Transport Safety Investigation Act 2003 and Regulations and, where applicable,
relevant international agreements.
Purpose of safety investigations
The object of a safety investigation is to enhance safety. To reduce safety-related
risk, ATSB investigations determine and communicate the safety factors related to
the transport safety matter being investigated.
It is not the object of an investigation to determine blame or liability. However, an
investigation report must include factual material of sufficient weight to support the
analysis and findings. At all times the ATSB endeavours to balance the use of
material that could imply adverse comment with the need to properly explain what
happened, and why, in a fair and unbiased manner.
Developing safety action
Central to the ATSBs investigation of transport safety matters is the early
identification of safety issues in the transport environment. The ATSB prefers to
encourage the relevant organisation(s) to proactively initiate safety action rather
than release formal recommendations. However, depending on the level of risk
associated with a safety issue and the extent of corrective action undertaken by the
relevant organisation, a recommendation may be issued either during or at the end
of an investigation.
The ATSB has decided that when safety recommendations are issued, they will
focus on clearly describing the safety issue of concern, rather than providing
instructions or opinions on the method of corrective action. As with equivalent
overseas organisations, the ATSB has no power to implement its recommendations.
It is a matter for the body to which an ATSB recommendation is directed (for
example the relevant regulator in consultation with industry) to assess the costs and
benefits of any particular means of addressing a safety issue.
About ATSB investigation reports: How investigation reports are organised and
definitions of terms used in ATSB reports, such as safety factor, contributing safety
factor and safety issue, are provided on the ATSB web site www.atsb.gov.au.

- viii -
INTRODUCTION
Without the intervention of maintenance personnel, equipment used in complex
technological systems such as aviation, rail and marine transport, and medicine
would drift towards a level of unreliability that would rapidly threaten efficiency
and safety.
Despite the essential contribution of maintenance to system reliability, maintenance
is also a major cause of system failure. The rate of power station outages increases
shortly after maintenance, maintenance quality is a major concern in the chemical
industry, and in aviation there is evidence that maintenance is contributing to an
1
increasing proportion of accidents. As automated systems become increasingly
common, humans are performing less direct manual control of equipment and
systems. As a result, maintenance is becoming a major remaining point of direct
interaction between people and technology, where human capabilities and
limitations can have a significant impact on system safety and reliability.
Understanding the human factors in maintenance is more necessary than ever if we
are to improve safety and reliability in aviation.
Modern technological systems in industries such as manufacturing, transport and
healthcare comprise equipment, procedures, and of course people. In most cases,
we have a fairly good understanding of the performance characteristics of the
engineered equipment that form parts of these systems. Aircraft come with manuals
that specify their performance envelopes and capabilities. Procedures too, have
been created by people and can be documented and understood. But when it comes
to people, we are faced with a system element that comes with no operating manual
and no performance specifications, and that occasionally performs in ways not
anticipated by the system designers. Some of these failures can be easily explained,
an arithmetic error for example, while others are harder to predict. Although
individuals differ, researchers have discovered general principles of human
performance that can help us to create safer and more efficient systems. The focus
of this paper is on the functioning of people as elements of maintenance systems in
aviation.

The cost of maintenance error

Since the end of World War II, human factors researchers have studied pilots and
the tasks they perform, as well as air traffic control and cabin safety issues. Yet
until recently, maintenance personnel were overlooked by the human factors
profession. Whatever the reason for this, it is not because maintenance is
insignificant. Maintenance is one of the largest costs facing airlines. It has been
estimated that for every hour of flight, 12 man-hours of maintenance occur. Most
significantly, maintenance errors can have grave implications for flight safety.
Accident statistics for the worldwide commercial jet transport industry show
maintenance as the primary cause factor in a relatively low four per cent of hull
loss accidents, compared with flight crew actions that are implicated as a primary
2
cause factor in more than 60 per cent of accidents. Yet primary cause statistics
may tend to understate the significance of maintenance as a contributing factor in
accidents. In 2003, Flight International reported that technical/maintenance
failure emerged as the leading cause of airline accidents and fatalities, surpassing
controlled flight into terrain, which had previously been the predominant cause of

- 1 -
 3
airline accidents. According to former NTSB Board member John Goglia,
4
deficient maintenance has been implicated in 7 of 14 recent airline accidents.
Maintenance errors not only pose a threat to flight safety, but can also impose
significant financial costs through delays, cancellations, diversions, and other
schedule disruptions. For example, in the case of a large aircraft such as a Boeing
747-400, a flight cancellation can cost the airline around USD $140,000, while a
5
delay at the gate can cost an average of USD $17,000 per hour. In this context it
can be seen that even simple errors such as gear pins left in place, requiring a return
to gate, can involve significant costs. Even a small reduction in the frequency of
maintenance-induced schedule disruptions can result in major savings.

Unique human factors issues in aviation maintenance

Maintenance personnel are confronted with a set of human factors unique within
aviation. Maintenance technicians work in an environment that is more hazardous
than most other jobs in the labour force. The work may be carried out at heights, in
confined spaces, in numbing cold or sweltering heat. The work can be physically
strenuous, yet it requires clerical skills and attention to detail. Maintenance
technicians commonly spend more time preparing for a task than actually carrying
it out. Dealing with documentation is a key activity, and maintenance engineers
typically spend nearly as much time wielding a pen as they do holding a
screwdriver. The work requires good communication and coordination, yet verbal
communication can be difficult due to noise levels and the use of hearing
protection. The work frequently involves fault diagnosis and problem solving in
the presence of time pressures, particularly at the gate.
Maintenance personnel also face unique sources of stress. Air traffic controllers
and pilots can leave work at the end of the day knowing that the days work is
complete. In most cases, any errors they made during their shift will have either had
an immediate impact or no impact at all. In contrast, when maintenance personnel
leave work at the end of their shift, they know that the work they performed will be
relied on by crew and passengers for months or years into the future. The emotional
burden on maintenance personnel whose work has been involved in accidents is
largely unrecognised outside the maintenance fraternity. On more than one
occasion, maintenance personnel have taken their own lives following aircraft
accidents caused by maintenance error.
From a human factors perspective, maintenance personnel have more in common
with doctors than with pilots. We know from medicine that iatrogenic, or doctor-
6
caused, injury can be a significant threat to patient health. Medical errors include
surgical instruments sewn up inside patients, disorders being misdiagnosed, and
very occasionally, surgeons operating on the wrong limb. Most aircraft maintenance
personnel will be familiar with these types of errors. Opening up a healthy patient at
regular intervals to check that organs are functioning normally would not be an
appropriate strategy in health care, yet preventative maintenance in aviation often
requires us to disassemble and inspect normally functioning systems, with the
attendant risk of error.
Just as medicine can be about preventing or responding to a condition, so
maintenance can be divided into two categories. These are scheduled and
unscheduled maintenance. The distinction between these two categories has
significant implications for maintenance human factors.

- 2 -
Scheduled maintenance tasks are typically preventative. Many preventative tasks
are performed regularly, and so are familiar routines for maintenance personnel.
Experienced personnel will be unlikely to make mistakes related to a lack of
knowledge or skills on a familiar preventative task. Maintenance discrepancies on
familiar tasks are more likely to involve breakdowns in teamwork, everyday absent
minded mistakes such as forgetting to install components, and action slips where a
person absent-mindedly performs a routine action that they had not intended to
7
perform.
Unscheduled tasks are usually corrective in nature, and are performed in response
to unplanned events such as aircraft damage or component failure. Although some
unscheduled tasks are minor, others require extensive system knowledge, problem
solving and specialised skills.

Examples of Accidents Related to Maintenance

As is often the case in aviation safety, a series of tragic accidents has drawn
attention to the human aspects of maintenance. Each accident highlighted a
different set of maintenance issues.
Japan Airlines Boeing 747, 1985
In August 1985, the worlds worst single-aircraft accident claimed the lives of 520
people when a Boeing 747-100, operated by Japan Airlines, became uncontrollable
and crashed into a mountain. The aircraft had departed Tokyo on a short flight to
Osaka. As the aircraft reached its cruising altitude of 24,000 ft, the cabin suffered a
sudden decompression due to the failure of the rear pressure bulkhead. The
escaping air caused serious damage including the separation of most of the vertical
stabiliser and rudder. In addition, hydraulic lines were breached and hydraulic
pressure was lost from all four systems.
The flight crew attempted to steer the aircraft using engine power, however, they
were unable to maintain control and after about 30 minutes the aircraft crashed into
a mountain north-west of Tokyo.
The investigators found that the rear pressure bulkhead had failed in flight due to a
fatigue fracture in an area where a repair had been made years previously, after the
aircraft had sustained a tail scrape. The repair had included replacing the lower half
of the bulkhead. The new lower half should have been spliced to the upper half
using a doubler plate extending under three lines of rivets. However, part of the
splice was made using two plates instead of a single plate as intended, as shown in
Figure 1. As a result, the join relied on only a single row of rivets.
After the repair, the aircraft flew over 12,000 flights and underwent six C check a
8
before the accident occurred. The accident highlighted the potential for
maintenance errors to remain dormant for long periods before having their effect.

a A C check is a major maintenance visit consisting of an extensive set of inspections and

maintenance activities. In the case of the JAL 747SR, C checks were required to be performed
within 3,000 flying hours, and took up to 12 days to complete. The check included visual
inspections of the airframe, including the rear pressure bulkhead.

- 3 -
Figure 1: The repair to the rear pressure bulkhead as specified in the repair
instructions (at left), and repair as actually carried out (on right).

9
Source: Kobayashi & Terada (2006)

Eastern Airlines L-1011, 1983

The Lockheed L-1011 with 10 crewmembers and 162 passengers on board was on a
flight from Miami, US to Nassau, Bahamas. During the descent into Nassau, the
low oil pressure light on the centre engine illuminated. The engine was shut down,
and the captain decided to return to Miami on the two remaining engines.
The aircraft was cleared for the return and began a climb to flight level 200
(20,000 ft). While en route to Miami, the low oil pressure lights for the two wing-
mounted engines illuminated. Then, 15 minutes after the centre engine had been
shut down, the right engine flamed out. Five minutes later, while the flight crew
were attempting to restart the centre engine, the left engine flamed out. The aircraft
began a descent without power from 13,000 ft, and the passengers were instructed
to don lifejackets in preparation for a ditching. At about 4,000 ft, the crew managed
to restart the centre engine. The aircraft made a one-engine landing at Miami
International Airport 30 minutes after the emergency had begun. There were no
injuries to the occupants.
The investigation revealed that on all three engines, magnetic chip detectors had
10
been installed without O rings, allowing oil to leak from the engines in flight.
Figure 2 shows a representation of the magnetic chip detector system on the
RB-211 engine. Although the engine problems were clearly the result of
maintenance errors, the investigation uncovered deeper organisational issues.
Eighteen months prior to the accident, the airline had begun a practice of removing
and inspecting magnetic chip detectors (MCDs) at 22-hour intervals whenever the
aircraft over-nighted at an Eastern Airlines maintenance station. Each removed

- 4 -
MCD would then be inspected for the presence of metal particles which would be
an early warning of engine failure. Since the Rolls Royce recommendation had
been implemented, airline maintenance personnel had changed over 100,000 chip
detectors, and it was estimated that the average line maintenance engineer would
have performed the task at least 100 times. Other major airlines in the US that were
also performing these checks had decided to leave the O ring seals on each chip
detector in place, unless they were damaged or worn. Eastern Airlines, however,
decided to fit new O rings each time the MCDs were replaced.
At 1:30 AM on the morning of the accident, two airframe and powerplant engineers
were assigned the routine task of changing the MCDs on all three of the aircrafts
engines. Previously, MCDs had always been obtained from the foremans office, so
one of the engineers went to the foremans office to pick up three MCDs to replace
the three that would be removed. On this occasion, however, no MCDs were
available in the foremans office, so he went to the stock room and obtained three
MCDs, each of which was in a semi-transparent bag with a serviceable tag attached.
This engineer then replaced the MCDs on the wing-mounted engines, using the
headlights of a tug to provide illumination. To replace each MCD, he had to reach
about 12 centimetres inside the oil service door on each engine, and with no direct
view of the task, he performed the replacement entirely by feel. He did not check
for the presence of O rings because he assumed that each MCD was serviceable,
having come with a serviceable tag, and because in his experience MCDs had
always come with O rings fitted. The second engineer, also knowing that the
MCDs had come with serviceable tags attached, and assuming that they were ready
to be fitted, used a lift truck to reach the tail-mounted centre engine. After the
MCDs were replaced, all three engines were motored on the starter for about 10
seconds to check for oil leaks. This standard check did not reveal any leaks.
The accident flight was not the first time that the airline had experienced problems
with the installation of MCDs. Over a period of 20 months prior to the accident, the
airline had experienced 12 separate incidents involving in-flight engine shutdowns
and unscheduled landings due to problems with O ring seals and magnetic chip
detector installation problems. As the US National Transport Safety Board (NTSB)
reported: In every incident ... management investigated the circumstances and
concluded that the problem was with the mechanics [engineers] and not with the
maintenance procedure. Rather than addressing the wider system problems such as
poor procedures and undocumented norms, the incidents resulted in individual
disciplinary action and training. The accident highlighted the potential for
preventative maintenance to introduce risk, and how a single error could be carried
across multiple systems.

- 5 -
Figure 2: The magnetic chip detector plug and housing on the RB-211-22B
engine

11
Source: Marx & Graeber (1994)

Aloha Airlines Boeing 737, 1988

In April 1988, an Aloha Airlines Boeing 737-200 en-route from Hilo, Hawaii to
Honolulu, experienced an explosive decompression in which approximately 18 feet
of cabin skin and structure aft of the cabin entrance door and above the passenger
floorline separated from the aircraft. A flight attendant who was standing in the
aisle was immediately swept overboard. The flight diverted to Maui where an
emergency landing was made (See Figure 3).
The NTSB concluded that the accident was caused by the failure of Aloha Airlines
to detect the presence of significant disbonding and fatigue damage that ultimately
12
led to the failure of the lap joint and the separation of part of the fuselage. As a
result of the accident, the human factors of inspection became a major issue of
concern, particularly in the United States.

Figure 3: The Aloha Airlines 737 shortly after the emergency landing.

- 6 -
British Airways BAC-111, 1990
In June 1990, a windscreen of a British Airways jet blew out as the aircraft was
climbing to its cruising altitude, partially ejecting the pilot through the open
window. During the previous night shift, the windscreen had been installed by a
maintenance shift manager. The night shift was short-staffed and the manager was
attempting to help out by performing the work himself. He did not thoroughly
check the maintenance manual before performing the task and did not refer to the
illustrated parts catalogue to confirm the type of bolts required to hold the
windscreen in place. He selected the bolts by attempting to physically match them
against a bolt that had been fitted to the old windscreen, assuming that the old bolt
was the correct type, and ignoring the advice of a stores supervisor who had tried to
tell him the correct bolt specifications for the job. In the event, most of the bolts he
used to secure the windscreen were approximately 0.026 inches (0.66 mm) smaller
in diameter than the required bolts.
The managers errors did not occur in isolation, however. The mobile stand set up
at the aircraft did not give easy access to the windscreen and the shift manager had
to stretch to install the bolts, giving him a poor view of his work. Partly as a result
of this, he did not notice the excessive amount of countersink left unfilled by the
small bolt heads. He used a torque limiting screwdriver to fasten the bolts, but the
clicks he obtained appear to have been from the bolt thread slipping in the anchor
nuts, not from the torque limiting mechanism of the screwdriver. To make matters
worse, there was no requirement in the maintenance manual for a pressure check or
13
duplicate inspection. Some of the issues highlighted by this accident were parts
storage, night shift issues, staffing levels and the involvement of supervisors in
hands-on maintenance work. As with the Eastern Airlines occurrence described
above, it also highlighted how a single maintenance error could compromise the
safety of an aircraft.

Air Midwest, Beech 1900D, 2003

On 8 January 2003, Air Midwest flight 5481 crashed shortly after takeoff from
Charlotte, North Carolina, killing the two crewmembers and all 19 passengers
14
aboard. The NTSB established that after takeoff, the pilots had been unable to
control the pitch of the aircraft. There were two reasons for this. First, the aircraft
was overloaded and had an aft centre of gravity that exceeded limits. Second, the
elevator control system did not have the full range of nose-down travel, due to
incorrect rigging that had occurred during a maintenance visit just over 24 hours
prior to the accident. The accident flight was the aircrafts tenth flight after the
maintenance work, yet the previous nine flights all involved lower passenger loads
and a centre of gravity that was further forward.
On the night of 6-7 January, the aircraft had undergone a scheduled maintenance
check that included checking the tension of the elevator control cables. The
engineer was performing this task for the first time, and was receiving on-the-job
training from a quality assurance inspector. Finding that the cable tension was less
than required, the engineer performed selected steps from the elevator control
system rigging procedure to tighten the cable tension using cable turnbuckles.
However, in tightening the cables, he inadvertently restricted the amount of nose-
down elevator travel to about half of what should have been available (See Figure
4).

- 7 -
Figure 4: The Beech 1900 involved in the accident. Right, the cable
adjustment turnbuckles on the elevator control cables.

The maintenance manual for the Beech 1900D did not have an isolated task
procedure for adjusting cable tension, instead, the manufacturer specified that the
entire rigging procedure should be followed. However, the engineer and the
inspector misunderstood the technical procedure and thought that it was only
necessary to perform the steps that were specifically related to adjusting cable
tension. One of the steps skipped from the rigging procedure would have required a
cross-check of elevator positions with a read-out from the aircrafts flight data
recorder at the end of the maintenance procedure. This step may have alerted the
engineer that the full range of elevator travel was not available.
After the engineer had finished adjusting the control cable, he checked the
movement of the controls from the cockpit. The inspector signed off the duplicate
inspection, and also performed a physical check of the elevators that included
grasping the elevator and moving it through its available travel. He concluded that
the travel was within limits.
At the time of the accident, there was no requirement for a post-maintenance
functional check at the conclusion of the control cable rigging procedure. Such a
check would have involved an engineer in the cockpit moving the control wheel
through its full forward and aft range of movement while an engineer positioned at
the tail of the aircraft measured the deflection of the elevator using a travel board.
Five weeks after the accident, the aircraft manufacturer added such a post-
maintenance functional check to its elevator control rigging procedure. The
accident highlighted the difficulties of capturing maintenance errors once they have
been made. The NTSB noted that the US Federal Aviation Administration (FAA)
did not have a general requirement for complete functional checks to be performed
after maintenance on critical flight systems or components.

- 8 -
A MODEL OF ACCIDENT AND INCIDENT CAUSATION
The errors of maintenance personnel can be the most visible aspects of maintenance
human factors, but to understand how and why maintenance errors occur, we need
to understand the organisational context in which they occur. Figure 5 below shows
the main causal elements involved in accidents and incidents. It is an adaptation of
the Swiss Cheese model originally developed by James Reason.
According to this model, accidents or incidents are usually triggered by the actions
of operational personnel, such as pilots or maintenance engineers. However, these
actions occur in the context of local conditions, such as communication, workplace
conditions, and equipment. The task environment also includes risk controls. These
are features such as procedures, checks or precautions designed to manage hazards
that threaten safety. Risk controls, local conditions and individual actions can, in
turn, be influenced by organisational factors such as company policies, resource
allocation, and management decisions.
In order to understand and ultimately prevent accidents, it is necessary to trace the
chain of causes back through all the elements of the system including organisational
influences. This is often referred to as root cause analysis.

Figure 5: A model of accident and incident causation. b

Incident
Organisation Local Individual Risk
or
conditions actions controls
Accident

Individual actions
Human error is a threat to virtually all advanced technological systems. It has been
estimated that human error is involved in 70 per cent of aircraft accidents, as well as
80 per cent of shipping accidents, and at least 58 per cent of medical
15
misadventures. According to some authorities, around 80,000 people in the US die
16
each year because of avoidable medical errors. So it should not be surprising to
learn that human error is a significant threat in airline maintenance.
The use of the term human error should not imply that we have a problem with
people. In many cases, maintenance errors are symptoms of underlying problems
within the organisation. Although they are unwanted events, errors are valuable
opportunities to identify improvements. There are two main approaches to
describing errors: physical descriptions and psychological descriptions.

b The Australian Transport Safety Bureau uses a similar accident investigation model, also based on
the original model by James Reason, which is documented in Walker, M.B. & Bills, K.M. (2008).
Analysis, Causality and Proof in Safety Investigations (Aviation Research and Analysis Report
AR-2007-053). Australian Transport Safety Bureau: Canberra

- 9 -
Physical descriptions of errors
A simple approach to the categorisation of human errors is to describe them in
terms of the observable actions of the error-maker. Errors are frequently divided
into acts of omission, commission, or timing and precision.
An omission is a failure to perform a necessary action, for example, leaving an oil
cap unsecured. Commissions are cases in which an action is performed that should
not have been performed, for example, cross-connecting cables. Timing and
precision errors involve an action performed at the wrong time, in the wrong order
or without the necessary level of precision, for example, using the wrong setting on
a torque wrench.
The most common maintenance errors in a Boeing database are omissions:
17
equipment or parts not installed and incomplete installation of components. In an
Australian study, the most commonly reported maintenance errors with
airworthiness implications were commissions involving the unsafe operation of
systems such as flaps or thrust reversers during maintenance, and the incomplete
18
installation of components, an omission. An analysis of over 1,000 maintenance
incidents reported to the US National Aeronautics and Space Administration
(NASA) Aviation Safety Reporting System, revealed that the most common
problem was the omission of a required service procedure, followed by various
documentation irregularities (often the commission of a sign-off by an unauthorised
19
person), and the fitment of wrong parts, a commission.
Physical descriptions can be useful and, in most cases, are relatively easy to apply.
Unfortunately, they give very little insight into why the error occurred, or what it
reveals about the wider system. For example, if the only information we have about
an incident is that an engineer fitted the wrong part, we would not be able to
determine an adequate response from options such as changing procedures,
modifying training, or redesigning equipment. To identify the root causes of
maintenance anomalies involving human error, we need to gain an understanding of
the persons thinking at the time of their error.

Psychological descriptions of errors

Psychological error models require us to categorise errors according to the persons
intentions at the time of their action. For example, rather than just concluding that
an engineer did not secure a plumbing connection, we would try to understand their
mindset at the time of the error. For example, we would want to know: Did they
forget? Did they intend to leave it loose? Did they assume that a colleague was
going to complete the task? Obviously, we can never know for certain what a
person was thinking, but we can usually make reasonable judgments.
A simple way to assign a psychological description to an error is to imagine what
the person who made the error might have said the moment they realised that they
had not acted correctly. If they did not realise they had made an error, it helps to
imagine what they would have said had they become aware of their error.
An advantage of psychological descriptions is that they enable us to place the error
in its organizational context, and then develop countermeasures tailored to the root
causes of the problem. For example, if we conclude that someone did not perform a
necessary action because they forgot, we might consider the prompts to memory
available to them, such as documentation. We might also consider what could be

- 10 -
done in future to catch similar memory lapses. If, on the other hand, we conclude
that a person did not perform a necessary action because they thought the procedure
did not require it, our investigation might lead us to organisational issues such as
training or procedure design. In the following pages, we consider six psychological
error types relevant to maintenance.

Perception errors

Error type Likely statement following the error

1. Perception error I didnt see it or I didnt notice the

difference

Perception errors are failures to detect a critical item that the person should have
been capable of perceiving. In maintenance, the item might be a worn tyre, a visible
crack in a metallic structure, or an obstruction in the way of an aircraft under tow.
These errors are particularly important in maintenance inspection tasks, as
illustrated by the following example.
After being on duty for 18 hours on a long overtime shift, the worker was
carrying out a general inspection on an engine at around 2,200 hrs. He missed
obvious damage to the internals of the cold stream duct area. The damage was
found later, when another defect was being investigated.

Despite advanced non-destructive testing (NDT) techniques such as eddy current,

X-Ray and ultrasound inspection, unaided visual inspection is still the most
commonly used method of detecting defects in aircraft. An understanding of the
limitations of human vision can help ensure that inspections are carried out
effectively. A critical limitation is that we perceive only a small central part of the
visual field in fine detail and with colour. Visual acuity drops off sharply just a few
degrees away from our line of sight, and the probability of detecting a defect, such
as a crack, decreases if it is not looked at directly. Probability of detection (POD)
curves such as the one shown in Figure 6 have been used to estimate the chances
that a crack will be visible to an inspector.

- 11 -
Figure 6: Probability of detection (POD) curve showing crack length in
inches
100.00%
90.00%
Level of Visual Detectability
Probability of Detection 80.00%
70.00%
60.00%
90% Probability of
50.00% Detection
40.00%
30.00%
y = 0.4728Ln(x) - 0.0043
20.00% 2
R = 0.8548
10.00%
0.00%
0.125 0.18 0.25 0.4 0.63 0.75 0.92 1
True Crack Length in Inches

20
Source: Ostrom & Wilhelmsen (2008)

The ability of inspectors to detect defects in metallic structures is relatively well

understood, however, new generation aircraft are increasingly built from composite
materials and at present, the probability of detecting a failure in a composite
material is not well understood. Unlike cracks in metals, failures in composites do
not necessarily begin as small defects that then grow at a predictable rate. The
inspector may be required to detect disbonds, punctures, bulges, or dents that could
be signs of a future sudden failure.
Not all unaided inspection is visual. Tap testing is one of the simplest inspection
techniques available for composite materials. The structure is tapped with a small
coin or washer and the inspector listens for changes in tone. The method is widely
used on structures that have honeycomb cores. For the technique to work,the
inspector must have good hearing and be in an environment away from loud noise.
However, airports are noisy places and noise-induced hearing loss may be a
particular problem for people who work near aircraft.

Memory lapses

Error type Likely statement following the error

2. Memory lapse I forgot

One of the most common errors in maintenance incidents is memory failure. Rather
than forgetting something about the past, the technician typically forgets to perform
an action that they had intended to perform at some time in the future.
Psychologists refer to memory for intentions as prospective memory. Two common
examples are: forgetting to reconnect a disconnected system at the end of a task,
and leaving an oil cap unsecured. Failures of prospective memory are particularly

- 12 -
likely when a maintenance task has been interrupted and has to be picked up again
at a later time. Common triggers of prospective memory failures are phone calls,
breaks in tasks while equipment is located, or the need to leave an incomplete task
to attend to a more urgent task.
The following incident report illustrates a typical prospective memory failure in
maintenance.
While performing a walk-around on the aircraft, I noticed that the nose strut
appeared lower than normal on extension. I decided to install the aircraft nose
gear down-lock pin for an added safety precaution. After completion of strut
service, I began to stow the equipment. In the process, a catering employee
asked me if I could apply ground power to another aircraft parked at another
gate. In turn, I completely forgot about removing the gear down-lock pin. It
was not until the aircraft departed and then radioed in that he was unable to
retract the aircraft nose gear. The aircraft returned to the gate. The gear pin
was discovered to be installed in the nose gear.

People who have good memories for past events do not necessarily have good
prospective memories. This is sometimes referred to as the absent minded
professor effect. Prospective memory also appears to show marked decreases with
age. There is evidence that in aircraft maintenance, fatigue and shiftwork have
particularly strong effects on prospective memory. The rate of memory lapses by
maintenance technicians reaches a peak at around 3 to 4 AM.

Slips

Error type Likely statement following the error

3. Slip I didnt mean to do that

A slip is the absent-minded performance of a familiar skill-based action at a time or

21
place where the action was not intended. Many maintenance tasks involve routine
activities such as checking air pressures, opening and closing cowls, and lock-
wiring. Once these actions have been performed many times they start to involve
automatic skill sequences that are outside conscious awareness. Slips are often
fragments of routine behaviour or simple actions performed in the wrong context,
or on the wrong object. For example, a helicopter maintenance engineer reported
that:
Without thinking, I moved to wipe oil with a rag. The rag was ingested in the
engine intake causing FOD [foreign object damage].

Slips in maintenance can also occur when dealing with paperwork, such as
automatically signing off a task when the intention was not to do so.

- 13 -
Wrong assumptions

Error type Likely statement following the error

4. Wrong assumption I assumed that the situation was X

An assumption occurs when a person misidentifies a familiar situation, and fails to

check that their understanding of the situation is correct. A common error of this
type occurs when an engineer makes a wrong assumption while working with a
colleague, such as wrongly assuming that the other person is going to perform a
task step. For example, an electrical tradesperson may assume that a colleague who
usually disconnects the power supply, has done so this time. False assumptions do
not indicate that the person lacked the technical knowledge to perform the task,
because they usually occur in situations where the person has the expertise to deal
with the task. While perception errors, memory lapses and slips are errors of action
execution, wrong assumptions occur at the stage of action planning. The actions
involved in an assumption error are intended, although misguided. For example, an
engineer did not check the position of the flap lever before he pushed in a cockpit
circuit breaker that provided electrical power to a hydraulic pump. When the pump
started, the flaps began to retract automatically. This could have caused damage to
the aircraft, or injured other workers.

Technical misunderstandings

Error type Likely statement following the error

5. Technical misunderstandings I tried to do it the right way but I didnt

understand what I had to do

Technical misunderstandings are errors in which the engineer did not possess the
necessary knowledge, or lacked an awareness of where to find the information they
needed. This is most likely to occur when a person is performing an unfamiliar
task, or in non-routine situations. An activity analysis of line maintenance personnel
indicated that they spent between 15 and 20 per cent of their time performing work
22
packages they had never performed before. Typically, a person who has made a
technical misunderstanding will say they did not know about a procedure or were
confused by the task. A maintenance engineer at a US airline reported the following
technical misunderstanding to the NASA Aviation Safety Reporting System.

- 14 -
 I went to another hangar bay to ask another mechanic [maintenance engineer]
if he could show me how to service a constant speed drive on a B727. He
showed me where to hook up the servicing line from the servicing cart and
told me where to find the carts to service the equipment. On the cart was an
orange tape that said Mobil II eng oil. So I took the cart to the ramp and
serviced the constant speed drive. The same engineer that I had asked
assistance from (later) flagged me down and told me that I had used the
wrong oil.

Procedure violations

Error type Likely statement following the error

6. Procedure violation Nobody follows that procedure or I

know this is not the right way, but it will be
okay this once

Violations are an important class of behaviour in many safety-critical industries in

fields as diverse as oil production, rail transport and medicine. Violations may be
23
involved in 70 per cent of accidents in some industries. An aircraft hangar is a
highly regulated workplace. Engineers are expected to carry out their duties while
observing legal requirements, manufacturers maintenance manuals, company
procedures and unwritten norms of safe behaviour. As a result, procedure violations
are widespread in maintenance.
A study of the normal job performance of aircraft engineers in Europe found that
34 per cent acknowledged that their most recent task had been performed in a
24
manner that contravened the formal procedures. Violations or procedure shortcuts
were the second most frequently reported unsafe act in maintenance incidents
reported in an Australian survey of licensed aircraft maintenance engineers, second
only to memory lapses. Over 30 per cent reported that they had signed off a task
before it was completed, and over 90 per cent reported having done a task without
25
the correct tools or equipment. In most of these cases, the engineer could probably
have justified their actions, nevertheless the responses highlight the divergence
between formal procedures and actual task performance.
Two types of violations can be identified, routine violations and exceptional
violations.
Routine violations are the everyday deviations that have become part of the normal
way of working, for example, driving a few kilometres per hour over the speed
limit. Common routine violations include not referring to approved maintenance
documentation, abbreviating procedures, or referring to informal sources of
information such as black books. Violations such as these are not unique to airline
maintenance. Figure 7 shows results from a large survey of airline maintenance
26
technicians and railway locomotive mechanics. As can be seen, about half of the
airline maintenance personnel and about 70 per cent of the railway maintenance
personnel reported having used a black book in the previous six months. In many
cases, management is aware that routine violations are occurring, but tolerates them
because they help to get the work done efficiently.

- 15 -
Figure 7: Informal data sources, or black books, are widely used in
maintenance.

At
At work
workininthe
thelast sixsix
last months, on average,
months, how how
on average, often often
have have
you
you referred
referredtotoanan
informal
informalsource of maintenance
source data (such
of maintenance data (such
as aa personal
as personalnotebook).
notebook).

70%
60%
50%
40%
30%
20%
10%
0%
Every day Once a Once a Once in 6 Never Not relevant
week month months

Rolling stockmechanics
Locomotive mechanics Airline mechanics
techs

25
Source: Hobbs (2007)

Exceptional violations are less common than routine violations, and tend to be
responses to unusual circumstances. They are often well-intentioned attempts to
keep working despite problems such as missing documents, a shortage of parts, or
schedule pressure. One of the most common reasons for exceptional violations is
management pressure, as illustrated by the following incident reported to the NASA
Aviation Safety Reporting System.
An Airbus A320 arrived at our station with a totally deflated nose landing
gear strut. The history showed the identical condition at the previous station
where a quick service was performed. The maintenance manual requires a
full service at the next maintenance opportunity. The aircraft was scheduled
for this service at our station. The flight was delayed for the strut service.
Myself and another mechanic [engineer] believed a full service was required
but the station maintenance manager insisted that we only perform a quick
service. The strut was serviced with nitrogen and then released and
dispatched.

There is evidence that engineers who violate procedures frequently are at greater
risk of being involved in a maintenance incident than those who adhere more
27
closely to procedures. Violations may set the scene for accidents by increasing
the probability of error, or by reducing the margin of safety should an error occur.
For example, the omission of a functional check at the completion of maintenance
work may not in itself lead to a problem, but could permit an earlier lapse to go
undetected.
The issue of maintenance violations is one of the most difficult human factors
issues currently facing the aviation industry. Yet many aviation professionals
outside the maintenance field are either unaware of the issue, or else take a simple

- 16 -
moralistic approach when they hear of the extent to which maintenance workers
routinely deviate from procedures to accomplish tasks. Maintenance personnel are
often confronted with a double standard of task performance. On the one hand, they
are expected to comply with a vast array of requirements and procedures, while also
being expected to complete tasks quickly and efficiently.

Local Conditions
The individual actions that lead to maintenance incidents often reflect local
conditions present in the workplace at the time of the action. Accurately identifying
the nature of an error and the local conditions that prompted it is a critical step
towards identifying how the system can be improved to prevent the problem from
occurring again. Some of the more frequent error and violation producing
conditions in maintenance are described in the following sections.

Time pressure
Delays to aircraft caused by maintenance can impose significant costs on operators,
and much maintenance work is carried out under time constraints. While time
pressure is an unavoidable aspect of aircraft operations, maintenance personnel
sometimes find it difficult to deal with the pressures imposed by aircraft departure
times and maintenance schedules.
Time pressure is particularly likely to lead to memory lapses and procedural
violations, such as where an engineer uses a procedure shortcut to enable an aircraft
to depart on time. In the following example, taken from the NASA Aviation Safety
Reporting System, an engineer reported that time pressure led him to continue
working, despite being unable to see due to hydraulic fluid in his eyes.
I was notified by my shop steward that the hydraulic shutoff valve I removed
from a Fokker 100 was the same serial number on the new parts tag. He said
the aircraft had faulted again in DFW with a flap disagreement, which it had a
long history of. I removed the valve from the aircraft during which I had
gotten Skydrol 500 in my eyes and could not see for about 30 minutes. I tried
to keep working because time was short and I needed to complete the job
ASAP. I apparently installed the old valve back on the aircraft. I completed a
flap test with no faults.

Maintenance procedures and documentation

Aircraft maintenance is heavily reliant on documented procedures. According to the
FAA, aviation maintenance personnel spend between 25 and 40 per cent of their
time dealing with maintenance documentation. Poor documentation is one of the
leading causes of maintenance incidents. Poor maintenance procedures can lead to a
range of errors including memory lapses, technical misunderstandings, and rule
violations.
When it comes to the content of maintenance manuals, structural repair manuals
and other documents such as the minimum equipment list, the primary problem is
not generally inaccuracies or technical errors. A survey of US maintenance
technicians found that respondents rarely, if ever, found errors in maintenance
manuals. However, there were other problems with the content of documented

- 17 -
procedures. Only 18 per cent of those who returned the survey agreed with the
statement: the manual describes the easiest way to do a procedure. Only 13 per
cent agreed with the statement the manual writer understands how I do
maintenance. Most respondents reported that they overcame difficult-to-follow
procedures by consulting colleagues or finding their own way through a
28
procedure. Unworkable or awkward procedures are one of the most common
reasons for procedural violations. The most common reasons for procedural
violations given by maintenance technicians at European airlines was that there was
an easier or quicker way than the formal procedures, or that the procedure was
24
unclear.
There is clearly potential to narrow the gulf between those who write technical
publications and those who carry out the procedures. Aligning documentation with
the way tasks are actually done (wherever it is safe and practical to do so) may be
one of the most useful human factors interventions that can be made at an
organisational level.
In many cases, the only communication between pilots and maintenance engineers
is via the aircraft logbook. In a survey of the Australian regional airline industry,
maintenance personnel reported that flight crew write-ups of deficiencies were
often not helpful in identifying the problem. On other occasions, Australian pilots
acknowledged that they recorded deficiencies on loose pieces of paper, or else
made verbal reports to maintenance personnel rather than documenting the
29
problem.
In a recent study, pilots and maintenance engineers at two US air carriers were
asked about their use of the aircraft logbook. The results indicated a distinct split
between the two groups. Engineers reported that they frequently wanted more
information from pilots logbook entries, yet pilots were generally satisfied with the
level of detail in maintenance write-ups. A common complaint from engineers
was that pilots make logbook entries in which a component is simply described as
INOP(inoperative) with no further details. A particularly intriguing finding was
that when asked to indicate who they were making logbook entries for, engineers
and pilots had very different perspectives. Pilots reported that they made logbook
entries to give information to maintenance personnel, followed by other flight crew
and then the company, in that order. Engineers on the other hand, considered that
their logbook sign-offs were made primarily for the regulator, and only then for
30
pilots and other maintenance personnel.

Teamwork
Few maintenance workers work completely alone, and to perform their work
successfully, they must coordinate with other operational personnel. Coordination
problems such as misunderstandings, ineffective communication, and incorrect
assumptions feature in many maintenance incidents. In a survey at a US airline,
lead maintenance engineers identified communication and people skills as the
31
issues most important to job effectiveness.

- 18 -
The following incident report illustrates a communication difficulty involving
unspoken assumptions.
Two of us were dispatching the aircraft. The nose steering bypass pin was left
in. This is a repetitive maintenance task, both of us assumed the other had the
pin. The aircraft began to taxi, but stopped as soon as no steering recognised.
We removed pin and ops normal.

Figure 8 presents a simple model of communication. The relative size of the areas
in this diagram is for illustration purposes only. Communication errors can take the
form of messages sent but not received (A) or messages received but not sent (C).
Effective communication is represented by area B. The process of communication
occurs in a context of noise, not only unwanted sound, but also other impediments
to communication such as unclear speech or poor listening skills. The error rate for
verbal communication in industrial settings has been estimated to be around 3 per
32
cent. When we consider the number of verbal messages that occur in a typical
maintenance facility in the course of a day, it is apparent that communication failure
presents an almost constant threat to maintenance quality.

Figure 8: A model of communication.

Feedback

Message Message
sent received
A B C

Noise

Sender Receiver

The sender and the receiver of a message each have responsibilities to ensure that
communication is effective. Senders can help by putting themselves into the shoes
of the receiver and realising that the receiver may have a different understanding of
the task. The receiver of the message should avoid passive listening, and can assist
communication by providing active feedback such as paraphrasing the message and
clarifying areas of uncertainty.
A large proportion of communication occurs via non-verbal cues such as body
language or voice tone. Particularly under time pressure or stress, we may see or
hear what we expect, rather than what is actually occurring. The following
maintenance incident from the NASA Aviation Safety Reporting System illustrates
the problem of misinterpreted body language.

- 19 -
 The aircraft flight manual and pilots operations manual which were removed
from the aircraft earlier were on a table inside the hangar. The pilot placed his
hand on the two manuals on the table noting that they were or had been
looked at. After a few minutes I went back into the hangar where I saw the
cabin door being closed and latched by one of the crew from the inside. I
recall looking over at the table and recall seeing the manuals not there
anymore suggesting the crew had taken them with them. Just after that I
noticed them on a chair.

There is scope to improve the communication and coordination skills of

maintenance personnel. John Goglia, a maintenance technician and a former
member of the United States NTSB board, has noted that With their engineering
focus, maintenance managers and technicians possess highly technical skills, but
sometimes lack the communication skills to ensure safety in todays complex
operations. What is needed is a better balance of technical skills and social skills.
How we can go about developing these skills will be dealt with in a later section.

Shift handover
Many maintenance tasks, particularly in heavy maintenance, cannot be completed
in a single shift. Aircraft maintenance workers frequently need to accept work in
progress from colleagues, and pass incomplete work to an incoming shift. The need
to accurately and effectively transfer information, in many cases without face-to-
face contact, is a crucial aspect of maintenance work.
Shift handover errors can be particularly hazardous, as shown by a 1991 accident
involving a Brasilia aircraft at Eagle Lake, Texas that resulted in 14 fatalities. The
night before the accident, maintenance work had been carried out which involved
removing screws from the upper left surface of the Brasilia's T-tail. However, the
work was only partially completed when a shift change occurred and no record had
been made to show that the task had been started. The maintenance technicians on
the incoming shift signed the aircraft back into service, unaware that the crucial
screws were missing from the aircraft's tail. The leading edge of the left horizontal
33
stabiliser separated from the aircraft in flight.
Four types of shift handover can be identified, as illustrated in Figure 9. In each
case, the handover is indicated by a vertical line. The outgoing shift is indicated by
the arrow on the left, and the incoming shift is indicated by the arrow on the right.
Shift handovers are often focused on the transfer of information from the outgoing
shift to the incoming shift, however, handovers are also an opportunity to review
task progress and catch and correct errors.

- 20 -
Figure 9: Types of shift handovers.
a. Type 1 handover
This is the ideal shift handover, where the
task is proceeding normally before the
handover and continues to proceed
normally after the handover.

b. Type 2 handover
Although handovers create challenges for
communication, they also provide
opportunities to detect and correct errors.
A type 2 handover is where the task has
gone off track during the first shift, but the
handover provides an opportunity to
identify the problem and correct it.

c. Type 3 handover
In this case, the task was performed
correctly by the first shift, however a
problem began when the second shift
took over. An example is a case where
the first shift removed a faulty component
for replacement and left the component
by the aircraft at the end of the shift.
Instead of ordering and installing a
serviceable component, the second shift
then re-installed the faulty component, not
noticing that it had an unserviceable tag
attached.

d. Type 4 handover
In this case, an error was made on the
first shift, and was then continued by
personnel on the second shift. A healthy
level of scepticism can help to ensure that
the incoming shift reviews the work of the
outgoing shift and makes as few
assumptions as possible about the status
of the work.

Authorities on shift handover recommend face-to-face handovers by the people

doing the work, instead of verbal briefings filtered through a shift lead, as is
currently the case in many maintenance facilities. Face-to-face handovers are
standard operating procedure in many high-risk industries such as nuclear power,
offshore oil, and air traffic control, yet are relatively rare in aircraft maintenance. In
many cases the information content of the handover, whether via documents or

- 21 -
face-to-face interaction, is limited to describing the task steps completed by the
outgoing shift. Studies in a range of industries also show that information transfer
between shifts is most effective when it captures problems, possible solutions and
intentions, and does not just describe what has been accomplished. Yet describing
the steps remaining to be accomplished is not an accepted practice in many
34
maintenance facilities.

Group norms
Group norms are important forces that mould behaviour in safety-critical situations.
Norms are the unspoken informal rules about how work is done. New workers learn
the workplace norms from their colleagues. Many norms are positive, yet others can
have a negative impact on work performance. It is very important to identify
dangerous norms that have arisen in the workplace. Examples include signing for
others work without checking, or not documenting where additional components
have been loosened or disassembled when this was not specified in the task
instructions.

Fatigue
The word fatigue is used widely in the field of human factors, yet it is rarely
defined and can mean different things in different contexts. The word fatigue can
refer to physical weariness, emotional exhaustion, the degradation of skill that
results from performing a mentally demanding task over an extended period,
chronic fatigue related to weeks of work without an adequate rest, and finally, an
unmet need for sleep. Sleepiness can occur for two related reasons. The first is sleep
deprivation, the second is the effect of 24-hour rhythms in human performance.
Recent research has shown that moderate sleep deprivation of the kind experienced
by shift workers can produce effects very similar to those produced by alcohol.
After 18 hours of being awake, mental and physical performance on many tasks is
affected as though the person had a blood alcohol concentration of 0.05 per cent.
Boring tasks that require a person to detect a rare problem, like some inspection
35
jobs, are most susceptible to fatigue effects. Studies have shown that there are 24-
hour circadian rhythms in human error, with many aspects of human performance
being at a low ebb in the early hours of the morning. Memory and reaction time are
at their worst at around 4 am and the chance of error is increased. There appears to
be an increased risk of maintenance errors on night shifts.
It has been found that when maintenance technicians are experiencing sleepiness,
they are at increased likelihood of errors involving failures to carry out intentions,
such as memory lapses and perceptual errors. Sleepiness, however, seems to be less
18
likely to lead to mistakes of thinking such as procedural misunderstandings.

Twelve-hour shifts
Twelve-hour maintenance shifts are becoming increasingly common. In some
cases, a companys move to 12-hour shifts is driven by employee preference rather
than management pressure. When compared with 8-hour shifts, 12-hour shifts offer
certain advantages, such as less commuting time over the course of a week, more
days off, and the opportunity to complete more work in each shift, with fewer
handovers of tasks between shifts. Although workers tend to be more fatigued at the

- 22 -
end of a 12-hour shift than at the end of an 8-hour shift, they sometimes report
fewer health problems and better sleep on a 12-hour shift pattern than when on an
36
8-hour pattern. At present there is no conclusive evidence to indicate that
extending the duration of shifts from eight to twelve hours will increase the
probability of accidents or injuries. Nevertheless, 12-hour shifts may not be
appropriate in all cases. Whenever a change is being made to 12-hour shifts, it is
essential to evaluate the effects of the change on worker well-being and work
quality. Quite possibly, the most significant effects of 12-hours shifts would show
themselves on the journey home rather than at work. Finally, some authorities
recommend that overtime should not be permitted when 12-hour shifts are being
worked.

Vigilance Decrement
A form of short-term fatigue highly relevant to maintenance inspection tasks is the
vigilance decrement. During the Second World War, it was found that after about
20 minutes at their posts, radar operators became much less likely to detect obvious
targets. This problem applies to many monitoring tasks where the search targets are
relatively rare. Aircraft inspection, the checking of medical X-rays, and quality
control inspection in factories are areas where vigilance decrements may occur.
Figure 10 below illustrates a typical vigilance curve. The vigilance decrement
applies particularly to detection tasks where the person is required to passively
monitor a situation that is boring and monotonous, such as inspecting large numbers
of turbine blades. The limiting factor is the ability to keep attention on the task. For
example, during the visual inspection of an aircraft, a maintenance worker may look
directly at a defect, yet if their attention is occupied with other demands, the defect
may not be recognised. In general, inspection tasks that involve variety and regular
breaks are less likely to suffer from the vigilance decrement.

Figure 10: An illustration of the vigilance decrement.

90
80
Vigilance effectiveness %

70

60
50
40
30

20
10
0
10 20 30 40 60 70 90 100 110 120 130 140
Time (min)

- 23 -
Lack of system knowledge
In a study of maintenance incidents in Australia, a lack of training or system
knowledge emerged as a contributing factor in just over 12 per cent of
25
occurrences. While training issues were sometimes associated with unlicensed or
newly-qualified personnel, experienced certifying engineers also reported incidents
related to inadequate knowledge, skills or experience. The following incident from
the NASA Aviation Safety Reporting System illustrates an error that was captured
before the aircraft was dispatched.
A co-worker and I replaced the 2R main landing gear tire because of worn
limits. Instead of putting on an L1011-250 tire, I replaced it with an L1011-
100 tire. I was not aware of the differences. It was changed before the flight
and caused no delay.

Equipment deficiencies
Problems with ground equipment, including a lack of specialised tools or stands is
often found to be a factor in maintenance incidents. In the BAC 111 accident
referred to earlier, the technician who installed the windscreen was making do with
an inadequate work-stand, and was unable to obtain the appropriate torque wrench
to install windscreen bolts.
In some cases, equipment problems result in hazards to maintenance workers
themselves, as illustrated in the following incident report.
We had some work to do in the forward cargo compartment. We wanted to
get the maintenance done as quickly as possible so an engine stand was used
to access the cargo. The top of the stand is about 4 feet below the floor of the
cargo, but was used because it was the only available stand in the area. A
person fell out of the compartment onto the stand and then the ground after
tripping while exiting the cargo compartment.

Design for maintainability

Although maintenance personnel rarely have the opportunity to influence the design
of the systems they maintain, poor design is a major factor leading to maintenance
problems. An awareness of design limitations can help prepare maintenance
technicians guard against design-induced maintenance errors. Examples of poor
design for maintainability include:
Components that are difficult to reach, particularly where unrelated components
must be disconnected to enable access (see Figure 11);
Obstructions to vision;
Procedures that require levels of precision or force that are difficult to deliver;
Closely located systems that are difficult to distinguish from each other;
Rows of identical looking controls, increasing the chance of confusion;
Systems with multiple modes but without clear mode annunciation;
Gauges that provide misleading information;
Plumbing or electrical connections that permit cross connection, or connection
to the wrong system; and

- 24 -
 Components that can be installed backwards.
A great deal of effort has been spent since WW2 to improve cockpit design. Yet
much less effort has been made on designing for maintainability.

Figure 11: Accessibility difficulties are a common feature in maintenance.

Photo: Colin Drury

The US Department of Defense lists the three following key questions about
maintainability:
1. Strength limitations: Can the maintenance person physically carry, lift, hold,
twist, push and pull objects as required?
2. Accessibility difficulties: How easy is it to gain physical access to the work
areas?
3. Visibility problems: Can the work area be seen directly, or must work be done
by feel or with the use of mirrors etc?
In aircraft maintenance some well known design-related errors occur regularly. The
following examples are taken from NASAs Aviation Safety Reporting System.
Wheel spacers left off during nosewheel changes when the spacer sticks to the
removed wheel.
Leading edge flaps that, when extended, contact open engine cowls.
High pressure fuel filter housings on some engines. Two nuts that secure the
housing are in a difficult-to-reach position. Fuel leaks have occurred when these
nuts have not been torqued correctly.

- 25 -
Risk controls
Originally referred to as defences by Professor James Reason, risk controls are
features put in place to manage hazards in the workplace. There are two main types
of risk controls related to maintenance error preventative controls and recovery
risk controls.
Preventative risk controls are intended to reduce the chance of unwanted events
such as human error. Examples of preventative risk controls are components
designed to prevent incorrect installation, or streamers on rigging pins that reduce
the chance that the pin will be inadvertently left in place. In other cases,
preventative risk controls take the form of training, qualifications, or procedures
such as the use of shadow boards or other methods to keep tools under control.
Recovery risk controls are designed to detect and recover from a dangerous
situation once it has started to develop. Functional checks and duplicate inspections
are examples of procedures designed to detect maintenance errors.
Less formal approaches also have a role in capturing errors. For example, a
read-back of verbal instructions can be effective in reducing communication errors.
However, checks, inspections and read-backs rely on human performance and are
themselves subject to human fallibility. In a survey of airline maintenance
personnel, over 30 per cent of respondents reported that they had skipped a required
33
functional check (such as an engine run) in the preceding 12 months.
Risk controls are not all equally effective. Engineered risk controls, such as reverse
threaded plumbing connections that prevent inadvertent connection, are generally
more reliable than risk controls that rely on procedural compliance. There are also
differences in effectiveness within the category of procedural risk controls.
Functional checks that demonstrate system performance, such as an engine run
performed at the completion of a maintenance procedure, are generally more
effective at managing risk than procedures that merely require a visual inspection of
completed work. Inspections are sometimes omitted due to factors such as time
pressure or overconfidence. The general order of effectiveness of risk controls is
shown in Table1.

Table 1: The general order of effectiveness of risk controls in maintenance.

More effective Engineered Solutions

Functional check
Duplicate inspection
Less effective
Self-check of work

In other cases, the risk control is designed to minimise the consequences of the
error. The special maintenance precautions applied with extended-range twin-
engine operations (ETOPS) are an example of such an approach. When an aircraft
is being maintained in accordance with ETOPS procedures, the performance of
identical maintenance actions on multiple elements of critical systems is avoided
wherever possible. Engines, fuel systems, fire-suppression systems and electrical
power are examples of ETOPS critical systems on aircraft such as the Boeing 767
and Boeing 737. ETOPS maintenance precautions reduce the risk that a repeated
maintenance error will affect multiple redundant systems.

- 26 -
Organisational influences on maintenance error
Although maintenance occurrences usually involve errors made by technicians,
investigations of airline maintenance events also identify organisational-level
factors such as: training and qualification systems; the allocation of resources; and
the cultural or value systems that permeate the organisation. For example, a
maintenance violation, such as using an incorrect tool, may occur because the
correct tool was not available, which in turn may reflect equipment acquisition
policies or financial constraints. One of the most common reasons given for
maintenance violations is time pressure, and this in turn may be symptomatic of
organisational conditions such as planning, staffing levels, or work scheduling.
An acknowledgement of the organisational influences on maintenance error is
sometimes misconstrued as an attempt to absolve maintenance technicians of
responsibility for their work, or to shift blame from workers to management. Yet
just as positive outcomes such as profitability, on-time performance, and customer
satisfaction are indicative of the performance of the entire organisation, so too,
negative events such as maintenance lapses are often a product of organisational
processes.
Although human factors problems in maintenance are usually revealed through the
actions of technicians, the solutions to these problems usually require system-level
solutions, as described in the next section.

- 27 -
- 28 -
MANAGING THE RISK OF MAINTENANCE ERROR

Error management systems

Within airline maintenance, there is an increasing emphasis on error management as
an integral part of an organisations safety management system (SMS). An SMS is
a coordinated approach to the management of safety that goes beyond regulatory
compliance. According to the International Civil Aviation Organization (ICAO), an
effective SMS requires strong management commitment and attention to concerns
37
ranging from corporate culture to event investigation and human factors training.
A significant problem facing maintenance organisations is how to encourage the
disclosure of maintenance incidents that would otherwise remain unknown to
management. Despite the extensive documentation that accompanies maintenance,
the day-to-day work of maintainers may be less visible to management than the
work of pilots or controllers. Pilots work under the constant scrutiny of quick
access recorders, cockpit voice recorders and flight data recorders, not to mention
passengers and the public. The performance of air traffic controllers is carefully
monitored, and their errors tend to become immediately apparent to either fellow
controllers or pilots. In contrast, if a maintenance engineer has a difficulty with a
maintenance procedure at 3 AM in a remote hangar, the problem may remain
unknown to the organisation unless the engineer chooses to disclose the issue. Once
a maintenance error has been made, years may elapse before it becomes apparent,
by which time it may be difficult to establish how it occurred.
Incident reports are one of the few channels for organisations to identify
organisational problems in maintenance, yet the culture of maintenance around the
world has tended to discourage the open reporting of maintenance incidents. This is
because the response to errors has frequently been punitive. In some companies,
common errors such as leaving oil filler caps unsecured, will result in several days
without pay, or even instant dismissal. It is hardly surprising that many minor
maintenance incidents are never officially reported. When Australian maintenance
engineers were surveyed in 1998, over 60 per cent reported having corrected an
error made by another engineer, without documenting their action, to avoid
33
potential disciplinary action against the colleague.
While all involved in aviation safety must be prepared to take responsibility for
their actions, a punitive response to genuine errors is ultimately counterproductive.
Some in the aviation industry have proposed that a blame free culture is necessary
to encourage reporting. This could imply that no-one would ever be held
responsible for their actions. More recently, the concept of just culture has been
promoted, in which some extreme violations will result in discipline, however most
will not.
Incident reporting programs in maintenance
Progress is slowly being made towards error reporting systems that enable
maintenance engineers to disclose genuine mistakes without fear of punishment.
Part 145 of the European Aviation Safety Agency (EASA) regulations requires
maintenance organisations to have an internal occurrence reporting scheme that
enables occurrences, including those related to human error, to be reported and
analysed. In 2001, prior to the release of the EASA requirements, the UK Civil

- 29 -
Aviation Authority released Airworthiness Notice 71 outlining best practices on
maintenance error management. These included corporate commitment, a clear
discipline policy and an event investigation process. Transport Canada has also
promulgated regulations requiring safety management systems for airlines. This
requirement includes the reporting of errors and other problems, and the internal
investigation and analysis of such events.
In the United States, the FAA encourages airlines and repair stations to introduce
Aviation Safety Action Programs (ASAP) that allow employees to report safety
issues with an emphasis on corrective action rather than discipline. Incident reports
are passed to an event review committee comprising representatives of the FAA,
38
management and the union. Despite the advantages that these programs offer, they
have been adopted more widely for flight crew than for maintenance personnel.
Not all incidents are accepted into ASAP programs. Some of the key conditions for
accepting a report are as follows:
1. The report must be submitted in a timely manner, generally within 24 hours of
the reporter becoming aware of the problem.
2. The incident must not involve criminal activity or substance abuse.
3. The incident must not involve intentional falsification.
4. The incident must not involve intentional violations or actions that reflect
intentional disregard for safety.
The first three of these criteria are unlikely to pose a problem in most cases.
However, when it comes to violations or actions that involve an intentional
disregard for safety, the matter becomes more subjective. Many routine violations
in maintenance could fit this criterion.
The issues of blame and justice apply to more than just maintenance personnel on
the hangar floor. Managers and supervisors are also responsible for the performance
of the personnel who report to them. It has been proposed that when workplace
violations occur, there should be consequences not only for the individuals directly
involved, but also for managers. For example, if an incident involved a routine rule
violation, managers should be called to account for their failure to ensure
39
compliance, or their failure to change the rule if it was an unnecessary one.

Human Factors Training

From the 1970s onwards, airlines around the world began to provide human factors
awareness training for flight crew. Until relatively recently, human factors training
was rarely provided to maintenance personnel.
In the 1990s, an initial wave of maintenance human factors training courses began
in the US, modelled on successful cockpit resource management training. This early
training was typically referred to as maintenance resource management (MRM) and
focused on topics such as assertiveness, stress management, decision making,
awareness of norms, communication skills, and conflict resolution. Courses
typically aimed not only to change attitudes among maintenance personnel, but also
to provide them with practical skills that could be applied in the workplace such as
assertiveness skills and conflict resolution techniques.

- 30 -
A second wave of maintenance human factors training has been generated by new
requirements from ICAO, EASA, and Transport Canada that call for maintenance
staff to have knowledge of human factors principles. EASA Regulation 66 lists
human factors knowledge among the basic initial knowledge requirements for
certifying maintenance staff on commercial air transport aircraft. The recommended
syllabus includes teamwork, working with time pressure and deadlines,
communication, and the management of human error. Although these syllabus
items are listed in the appendix to the regulation as an Acceptable means of
compliance, EASA has not listed alternative means of compliance, so this syllabus
effectively has the force of a regulatory requirement.
The related EASA-145 contains extensive human factors requirements for
maintenance organisations. Among the requirements in these regulations, and the
associated support documents, are that personnel receive training in human factors
principles. This training is required not only for certifying staff, engineers and
technicians, but also for managers, supervisors, quality control staff, store-
personnel and others. Human factors continuation training must occur every 2
years. Over 60 human factors topics are listed in the guidance material associated
with EASA-145, including violations, peer pressure, memory limitations, workload
management, teamwork, assertiveness, and disciplinary policies. The Civil Aviation
Safety Authority has indicated that similar regulations will apply to maintenance
organisations and personnel in Australia in the future when Civil Aviation Safety
40
Regulation (CASR) Part 145 is introduced.

Learning from incidents

In most cases, the immediate circumstances of a mishap are symptoms of deeper,
fundamental problems. Treating the symptoms of a problem will rarely lead to
adequate solutions, and may even make things worse. For example, enforcing
compliance with a routinely ignored procedure may cause more harm than good if
the procedure is unnecessary or poorly conceived. To make lasting improvements
we need to identify and treat the underlying fundamental origins, or root causes, of
mishaps.
To arrive at the organisational root causes of a mishap involving human
performance, we need to ask Why? repeatedly Why did the behaviour occur?
Why did risk controls fail? Why did the contributing factors exist? Repeatedly
asking Why? eventually leads us to fundamental aspects of the organisation that
can have powerful and wide-ranging influences on safety and quality.

Incident Investigation Systems

Incident reports provide valuable raw material from which safety lessons can be
extracted. In recent years, several investigation techniques have been developed
specifically for airline maintenance.
The oldest of these, Boeings Maintenance Error Decision Aid (MEDA) presents a
comprehensive list of error descriptions, such as access panel not closed and then
guides the investigator in identifying the contributing factors that led to the error.
Over 70 contributing factors are listed, including fatigue, inadequate knowledge,
41
and time constraints. The system however, does not include psychological
descriptions of errors.

- 31 -
The Aircraft Dispatch and Maintenance Safety System (ADAMS) was developed in
Europe by a team based at the Psychology Department of Trinity College Dublin.
In common with MEDA, ADAMS includes a range of maintenance errors, but also
enables the investigator to describe the psychological form of the error using a large
range of descriptions such as habit capture and memory failure. The investigator is
provided with a choice of approximately 100 performance influencing factors
covering the task, the work environment, the organisation and the error-makers
42
physical and mental state.
The Human Factors Analysis and Classification System (HFACS) is based on the
Reason model, and was originally developed to assist in the investigation of
mishaps in the US military. A maintenance extension of this methodology
43
(HFACS-ME) was developed by the US Navy to analyse aviation incidents.
HFACS-ME assists the investigator in identifying maintenance actions using a
taxonomy based on that of Reason, and provides 25 potential latent conditions that
contribute to maintainer errors. Perhaps due to their military origins, HFACS and
HFACS-ME emphasise supervisory factors.
There are two key advantages of using a structured and systematic error
investigation system such as those described above. First, structured investigation
systems have been shown to improve the effectiveness of investigations. Structured
systems serve as prompts or checklists that assist the investigator with uncovering
relevant issues during the investigation process. Second, once the system has been
in use over time, a bank of incident data becomes available in standard form that is
suitable for statistical analysis. It then becomes possible to search for trends and
associations in the data that may not otherwise have been identifiable.

- 32 -
CONCLUSION
The aviation industry could not function without the contribution of maintenance
personnel, yet maintenance error is a significant and continuing threat to aviation
safety. In the past, maintenance errors were often viewed as nothing more than
failures of individuals to perform their assigned tasks, and organisations often
responded with punishment or dismissal. There is now worldwide recognition that
maintenance errors reflect the interplay of personal, workplace, and organisational
factors. While maintenance technicians must still take responsibility for their
actions, managing the threat of maintenance error requires a system-level response.
The organisational response to maintenance error involves two paths. First, the
probability of maintenance error can be minimised by identifying and counteracting
error-producing conditions in the organisation. This typically involves attention to
fatigue management, human factors training, the provision of appropriate tooling
and equipment, and other actions directed at the human factors associated with
maintenance error. Second, it must be acknowledged that maintenance error is a
threat that can be reduced, but never entirely eliminated. Airlines can learn to
manage the inevitable threat of maintenance error in the same way they deal with
natural hazards such as weather. Organisational resilience in the face of human
error can be maximised by ensuring that appropriate risk controls are in place to
identify and correct errors, and minimise the consequences of those errors that
remain undetected, despite the best efforts of the organisation.

- 33 -
RESOURCES AND FURTHER READING
The following agencies have released research and guidance material on the topic
of human factors in maintenance.
Federal Aviation Administration (FAA) http://hfskyway.faa.gov
The United States Federal Aviation Administration began a research program into
maintenance human factors in 1988. A large library of research and guidance
documents can be accessed through the FAAs maintenance human factors website,
listed above. The available documents include the popular Operators Manual for
Human Factors in Aviation Maintenance, available in English, Chinese and
Spanish.
International Civil Aviation Organization (ICAO) http://www.icao.int
ICAO specifies that maintenance organisations should have safety management
systems, and that maintenance personnel should have an awareness of human
factors. ICAO has published two educational documents on maintenance human
factors: Human Factors in Aircraft Maintenance and Inspection (ICAO Digest 12,
1995) and Human Factors Guidelines for Aircraft Maintenance (ICAO Doc 9824,
2003).
European Aviation Safety Agency (EASA) http://www.easa.eu.int
EASA-66 lists human factors knowledge required to qualify as certifying
maintenance staff on commercial air transport aircraft. The related EASA-145
contains extensive human factors requirements for maintenance organisations. The
EASA guidance material and acceptable means of compliance companion
documents specify in detail how the intent of the regulations can be met.
Transport Canada http://www.tc.gc.ca
Transport Canada is a leader in the areas of Safety Management Systems (SMS)
and Fatigue Risk Management Systems (FRMS). Transport Canada has actively
applied these concepts to aviation maintenance. Guidance material on these topics
is available on their website.
United Kingdom Civil Aviation Authority (CAA) http://www.caa.co.uk
The UK CAA has published two comprehensive documents on maintenance human
factors to help maintenance personnel and organisations meet EASAs human
factors requirements. These are An Introduction to Aircraft Maintenance
Engineering Human Factors for JAR 66, and Aviation Maintenance Human Factors
(EASA / JAR145 Approved Organisations).
United States Air Transport Association (ATA) http://www.airlines.org
Specification 113 of the Air Transport Association Maintenance Human Factors
Program Guidelines provides advice for maintenance organisations on the
establishment of a maintenance human factors program. The specification is also
available via the FAA maintenance human factors website.

- 34 -
REFERENCES

1 Reason, J. & Hobbs, A. (2003). Managing maintenance error: A practical

guide. Ashgate: Aldershot.
2 Boeing (2003). Statistical summary of commercial jet aircraft accidents.
Seattle, Washington.
3 Learmount, D. (2004). Annual Accident Survey. Flight International, 20-
26 January, pp 34 36.
4 Human Factors Programs Vital to Enhance Safety in Maintenance. (2002,
August 12). Air Safety Week, 16, 1-6.
5 Boeing Commercial Airplanes (2008). Flight Interruption Cost Estimates.
Boeing Minute, 17 November 2008.
6 Leape, L.L. (1994). Error in medicine. Journal of the American Medical
Association, 272, 1851-1857.
7 Hobbs, A. & Williamson, A. (2002). Skills, rules and knowledge in aircraft
maintenance: errors in context. Ergonomics, 45, 290-308.
8 Japanese Aircraft Accident Investigation Commission. (1987).
Investigation Report. Japan Air Lines Co., Ltd. Boeing 747 SR-100.
JA8119, Gunma Prefecture, Japan, August 12, 1985.
Job, M. (1996). Air disaster (Vol. 2). Canberra: Aerospace Publications.
Marriott, L., Stewart, S. and Sharpe, M. (1999). Air disasters. New York:
Barnes and Noble.
9 Kobayash, H. & Terada, H. (2006). Crash of Japan Airlines B-747 at Mt.
Osutaka. Retrieved 1 December 2008, from Japan Science and Technology
Agency Failure Knowledge Database (http://shippai.jst.go.jp/en/).
10 National Transportation Safety Board (1984). Eastern Air Lines, Inc.,
Lockheed L-1011, N334EA, Miami International Airport, Miami, Florida,
May 5, 1983. NTSB/AAR-84/04
11 Marx, D. & Graeber, R. C. (1994). Human error in aircraft maintenance. In
N.Johnson, N. McDonald & R. Fuller (Eds.). Aviation Psychology in
Practice (pp. 87-104). Ashgate: Aldershot.
12 National Transportation Safety Board (1989). Aloha Airlines, Flight 243,
Boeing 737-200, N73711, near Maui, Hawaii, April 28, 1988. NTSB/AAR-
89/03.
13 Air Accident Investigation Branch. (1992). Report on the accident to BAC
One -Eleven, G-BJRT over Didcot, Oxfordshire on 10 June 1990. (No.
1/92). London: Author.
14 National Transportation Safety Board. (2004). Loss of Pitch Control
During Takeoff. Air Midwest Flight 5481. Raytheon (Beechcraft) 1900D,
Charlotte, North Carolina, January 8, 2003. NTSB/AAR-04/01.

- 35 -
15 Hawkins, F. H. (1993). Human factors in flight. Aldershot: Ashgate.
Lucas D. (1997). The causes of human error. In F. Redmill & J. Rajan
(Eds.). Human factors in safety critical systems (pp. 37-65). Oxford:
Butterworth Heinmann.
Leape, L.L., Brennan, T.A., Laird, N., Lawthers, A.G., Localio, A.R.,
Barnes, B.A., Hernert, L., Newhouse, J.P., Weiler, P.C., & Hiatt, H. (1991).
The nature of adverse events in hospitalized patients. The New England
Journal of Medicine, 324, 377-384.
16 Leape, L.L. (1994). Error in medicine. Journal of the American Medical
Association, 272, 1851-1857.
17 Rankin, W. L & Sogg, S. L. (2003). Update on the Maintenance Error
Decision Aid (MEDA) Process. Paper presented at the MEDA/MEMS
Workshop and Seminar. May 21-23, 2003, Aviation House, Gatwick, UK.
18 Hobbs, A. & Williamson, A. (2003). Associations between errors and
contributing factors in aircraft maintenance. Human Factors, 45, 186-201.
19 Hobbs, A. & Kanki, B. (2003). A correspondence analysis of ASRS
maintenance incident reports. Paper presented at International Society for
Aviation Psychology Symposium, Dayton Ohio, April.
20 Ostrom, L.T. & Wilhelmsen, C.A.(2008). Developing risk models for
aviation maintenance and inspection. International Journal of Aviation
Psychology. 18, 30-42.
21 Reason, J. (1990). Human error. Cambridge, UK: Cambridge University
Press.
22 Hobbs, A., & Williamson, A. (2002). Skills, rules and knowledge in aircraft
maintenance. Ergonomics. 45, 290-308.
23 Mason, S. (1997). Procedural violations causes, costs and cures. In F.
Redmill & J. Rajan (Eds.), Human factors in safety-critical systems (pp.
287-318). London: Butterworth Heinemann.
24 McDonald, N., Corrigan, S., Daly, C., & Cromie, S. (2000). Safety
management systems and safety culture in aircraft maintenance
organisations. Safety Science, 34, 151176.
25 Hobbs, A. & Williamson, A. (2000) Aircraft Maintenance Safety Survey:
Results. Canberra: Australian Transport Safety Bureau.
26 Hobbs, A. (2007). The development and validation of the Maintenance
Environment Questionnaire. Paper presented at 14th International
Symposium on Aviation Psychology, 23-26 April, Dayton, Ohio.
27 Hobbs, A. & Williamson, A. (2002). Unsafe and unsafe outcomes in
aircraft maintenance. Ergonomics, 45, 866-882.
28 Chaparro, A. & Groff, L. (2003). User perceptions of aviation maintenance
technical manuals. Proceedings of International Society for Aviation
Psychology Symposium. (pp 216-221). Dayton, Ohio, April.

- 36 -
29 Bureau of Air Safety Investigation (1999). Regional airline safety study:
Project report. Canberra: Author.
30 Munro, P., Kanki, B. and Jordan, K. (2008). Beyond INOP: logbook
communication between airline mechanics and pilots. International Journal
of Aviation Psychology, 18, 86-103.
31 Predmore, S., & Werner, T. (1997, March). Maintenance human factors and
error control. Paper presented at the 11th FAA Symposium on Human
Factors in Aviation Maintenance, San Diego, CA.
32 Kirwan, B. (1994). A practical guide to human reliability assessment.
London: Taylor and Francis.
33 National Transportation Safety Board (1992). Continental Express,
Embraer 120. Aircraft Accident Report 92/04.
34 Parke, B., & Kanki, B. (2008). Best practices in shift turnovers.
International Journal of Aviation Psychology. 18 (1) 72-85.
35 Dawson, D., & Reid, K. (1997). Equating the performance impairment
associated with sustained wakefulness and alcohol intoxication. Journal of
the Centre for Sleep Research, 2, 1-8.
36 Pollock, C. (1988). The use of human error data as indicators of changes in
work performance. In A. Feyer & A. Williamson (Eds.) Occupational
Injury. Risk, prevention and intervention (pp. 59-71). London: Taylor and
Francis.
37 International Civil Aviation Organization (2008). Safety Management
Manual (SMM). 2nd ed. (Document 9859). Author.
38 Federal Aviation Administration, Advisory Circular AC 120-66B.
39 Hudson, P. (2000). Safety culture and human error in the aviation industry:
In search of perfection. In B. Hayward & A. Lowe (Eds). Aviation
Resource Management. Ashgate: Aldershot.
40 Civil Aviation Safety Authority (2006). Notice of Proposed Rule Making.
A Proposal to Modernise and Harmonise Rules for the Maintenance of
Australian Aircraft and Licensing of Aircraft Maintenance Personnel.
(Document NPRM 0604MS). Canberra: Author.
41 Rankin, B. & Allen. J, (1996). Boeing introduces MEDA, Maintenance
Error Decision Aid. Airliner, April-June, 20-27.
42 Russell, S., Bacchi, M., Perassi, A., & Cromie, S. (1998). Aircraft Dispatch
And Maintenance Safety (ADAMS) reporting form and end-user manual.
(European Community, Brite-EURAM III report. BRPR-CT95-0038,
BE95-1732.) Dublin, Ireland: Trinity College.
43 Schmidt, J. K., Schmorrow, D. & Hardee, M. (1998). A preliminary human
factors analysis of naval aviation maintenance related mishaps. SAE
Technical Paper 983111. Warrendale, PA: Society of Automotive
Engineers.

- 37 -
 ATSB Transport Safety Report
Investigation Aviation Research and Analysis
An Overview of Human Factors in Aviation Maintenance
AR-2008-055
Final December 2008
Australian Transport Safety Bureau

Email [email protected]
24 Hours 1800 020 616
Web www.atsb.gov.au
Twitter @ATSBinfo