Internet news item, Dec. 16, 2007: Probe after Qantas pumps wrong gas into jets.
Potentially fatal gas being pumped into passenger jet emergency oxygen tanks in Australia sparked a worldwide safety investigation. The Australian Safety Transport Bureau confirmed yesterday the Qantas engineers (mechanics) accidentally put nitrogen into the emergency oxygen tanks of a Boeing 747-300 passenger jet at Melbourne Airport. Before the mistake was discovered, 51 aircraft were serviced with nitrogen instead of oxygen. Qantas sent out advisories to all operators of the affected aircraft and took the necessary measures to prevent this mistake from happening again.
Information gleaned from later news releases reported that instead of the original 51 aircraft that were serviced incorrectly, Qantas advised an additional 124 operators of aircraft that came into Melbourne to check out their aircraft’s oxygen systems for nitrogen contamination.
Before I am accused of playing the blame game, I want you to know that Qantas airlines has the best airline safety record in the world. It has never had a fatal accident in its long history of providing air transportation. Based on its safety record, study of this incident to find out how this mix-up could have happened is made even more important.
How did the oxygen bottles get serviced with nitrogen when the fittings are different sizes? The problem started in March of 2007 when Qantas purchased a brand new nitrogen cart that looked identical to the oxygen carts it was using on the ramp. Using the reasoning that if it looks like a duck, quacks like a duck, and walks like a duck, then it must be a duck, Qantas engineers (mechanics) quickly found out that the nitrogen fittings on the new cart did not fit the oxygen ports on the airplanes. They must have figured that the cart’s wrong fittings must have been the manufacturer’s mistake. They removed the new cart nitrogen fittings and installed the oxygen fittings from an old oxygen cart; their new duck was back in business. The cart was used off and on for 10 months until another mechanic saw the nitrogen cart being used to service pilot’s oxygen in the B 747-300. He stopped them from servicing the aircraft and reported the incident to his superior.
Cockpit oxygen bottles
Now just how serious was this maintenance error? Doing a little research on the incident reveals that the emergency oxygen tanks they described in the news release were actually the cockpit oxygen bottles. To the best of my knowledge, the affected aircraft were not U.S. registered and not subject to our FAR rules. However, I am sure many foreign operators have similar rules on the use of oxygen by pilots that are comparable to FAR 121.333 (c) (3). This rule requires a pilot to don his or her mask, if the aircraft is above 25,000 feet and the other pilot leaves the cockpit to take a bathroom break. Oxygen masks are also donned in emergency situations like an explosive cabin depressurization or smoke in the cockpit. Since the cockpit oxygen is used more frequently than the passenger oxygen bottles, they are usually topped-off every day or serviced at least a couple of times per week. That is why such a large number of aircraft were serviced with bad air in such a short time.
Depending on the ratio of nitrogen to oxygen in the affected bottles, it might only take a few minutes after donning the mask for the pilot to feel the effects of bad air. After that happens, I see only two possible outcomes.
(1) Upon discovering that the pilot passed out, it would be reasonable for those giving first aid to figure that the pilot had suffered a stroke or a heart attack. It would be logical to keep the mask on the pilot to ensure that he or she was getting 100 percent oxygen, while the pilot would still be getting bad air and would slowly suffocate. Result: one fatality, or:
(2) One minute or so after donning the mask, the pilot notices his or her motor and cognitive functions are deteriorating. In an effort to get help, he or she drunkenly moves the flight controls or kicks off the auto pilot while fighting to stay conscious. The aircraft goes out of control. Result: many fatalities.
Oxygen bottles have been installed in aircraft for at least 60 years. We mechanics have been servicing oxygen bottles for almost as long as we’ve been twisting safety wire. How could this happen?
Human factors case study
I believe that our Qantas incident is a maintenance error that is destined to become a human factors classic case study. I am also sure human factors specialists will identify additional human factors other than what I offer. Disclaimers aside, I would like to use two approaches to analyze this problem. The first is to broadly identify how the error could have been prevented using the Dirty Dozen list of error reduction and prevention strategies. The second way is to take a closer look at the task performance and unsafe acts using the STAMINA method.
Dirty Dozen: Going down the list of Dirty Dozen factors, I have selected the following:
Norms: The nitrogen cart looked just like the rest of the existing oxygen carts. It was not like the other nitrogen carts. Ergo, the cart must contain oxygen.
Lack of awareness: The mechanics did not seem to be aware that the bottles were marked with the word “nitrogen” and were of a different color.
Complacency: For almost 10 months, many mechanics used the cart before the error was discovered.
STAMINA
STAMINA is a human factors training program developed by Trinity College in Dublin, Ireland, and adopted by the JAAT, the training arm of the JAA. The STAMINA program is also taught in the states by the Airworthiness Standards Institute out of Richmond, TX. STAMINA human factors program uses the acronym “AWES_M” or “Awesome” to help human factors students remember the kinds of unsafe acts that we mechanics are prone to and is used to dig a little deeper into the cause of the problem. Using the Qantas oxygen/nitrogen incident as our example, let’s examine the incident using AWES_M.
A stands for action slip. The mechanic’s intent was to service the jet with oxygen but it was serviced with nitrogen instead. The intent was correct but the outcome was dead wrong.
W stands for work-around. The fittings on the new nitrogen cart were designed to service aircraft tires, not oxygen fittings, so they did not fit the oxygen service ports. The mechanics took the old fittings off the old oxygen cart and installed them on the new nitrogen cart line. Instead of figuring out why the new cart fittings did not fit or checking the manual, the mechanics worked around the problem and devised a dangerous solution.
E stands for expertise error. This can means two things. First, the original mechanics that brought the cart into service were not trained to properly service oxygen bottles so they could recognize the difference between oxygen and nitrogen bottles and their associated fittings. It may also indicate a lack of understanding on the part of the other mechanics that followed them even if they were given formal training on the equipment to service oxygen bottles.
S stands for situation awareness error. The major cause of the incident or critical factor in this incident was the fact that the new nitrogen cart looked identical to the old oxygen cart. The only differences were that the bottles in the cart were not green and the word nitrogen was stenciled on the bottles. While the nitrogen bottles were properly identified, all the mechanics saw was a cart that was identical in design and color to the old oxygen cart; therefore, there had to be oxygen in the bottles. This “looks like a duck” scenario is a classic situation awareness error. In this kind of human factors error, your brain fills in the blanks when you select the first, best solution in your mind, even if that solution is wrong.
M stands for memory error. Without prejudging the mechanics, and based on my own experience, I would be willing to believe they fell feet-first into the complacency trap. I base this observation on the fact that there were groups of mechanics who must have done this particular task at least 100 times before. I could find no mention in my research that the mechanics had a manual or a work card to use as a memory guide. They performed the task with their memory running on auto pilot instead of actively engaging in thinking the task through.
Risk assessment
In order to prevent the mix-up from ever happening again, the Australia Civil Aviation Safety Bureau required Qantas to perform a “risk assessment” to determine the causal factors and install safeguards. While I am not privy to Qantas corrective actions, I am sure it would incorporate fixes like: painting the carts different colors, branding the cart with the name of the gas that is being carried, installing warning placards and servicing instructions on the cart itself, revising the task work cards to ensure the mechanic identifies the proper cart and gas to be used, and requiring initial and recurrent training on the servicing of oxygen bottles and aircraft tires.
So what is the lesson here? The lesson is that any time a new piece of equipment comes on line, management should perform a “risk assessment” to ensure that a situation similar to our Qantas case study will not happen.
Let’s not look only at new equipment! Look at old equipment and see if it is still serviceable. While checking APUs, jacks, oxygen and nitrogen carts, and hydraulic mules are important, may I suggest there is something in everybody’s hangar that is often overlooked but is vitally important to maintaining safety. Have you tested your hangar grounding points? Can those grounding rods you clip onto every day still offer a safe ground?
Imagine the damage an errant spark could do inside a hangar. Over the years, the ability to make a good ground might be affected by changes in the soil condition and water table. That is just one area you might want to check. You might want to take a look at other things around your home away from home and do a little “risk assessment” of your own. You might find a little more than bad air lurking there.
