Aviation Investigation Report A00P0040

An Airbus A330, C-GGWA, departed from Vancouver International Airport, British Columbia, at about 2046 Pacific standard time. Immediately after take-off, the flight crew were informed that a flight attendant and at least one passenger had heard a loud bang just after lift-off, like something hitting the aircraft. A short while later, they were informed that a passenger had seen something fall off the left engine or the wing. A deadheading A330 captain was asked to inspect the engine area with the wing lights on, and it was discovered that the left engine outboard fan cowl was missing. There were no cockpit indications or abnormal aircraft handling characteristics associated with the noise or the departure of the cowl. The flight crew reported the situation to air traffic control and returned to Vancouver without further incident.

When the cowl separated, it struck the leading edge of the left wing, travelled inboard over the left wing, and damaged the fuselage-to-wing fairing and the hydraulic access panel, then contacted the vertical stabilizer. The separation and the break-up also substantially damaged the left engine pylon.

Background

This accident occurred on a Friday evening when, routinely, the company's maintenance workload is increased by the arrival of three aircraft over the same time period. The ramp activities involved in servicing these aircraft are split between a two-person crew, which is augmented for the evening by one additional overtime staff member. During these ramp activities, the assigned maintenance staff share the workload, and individual tasks are informally assigned and re-assigned between them.

Before the accident aircraft arrived in Vancouver, British Columbia, on the evening of the occurrence, the ramp crew were aware that several maintenance items would have to be completed on the aircraft before it could be released into service for its flight to Gatwick, England, later that evening. One of those maintenance items involved changing a thrust reverser directional pilot valve on the aircraft's left engine. That task was assigned to the overtime staff member, an apprentice mechanic, whose work was to be inspected independently by the other two qualified aircraft maintenance engineers (AMEs) on the evening shift. The apprentice mechanic was familiar with the task and had done it before.

The aircraft arrived at 1900 Pacific standard time.^{Footnote 1} After the walk-around inspection of the aircraft was complete, the apprentice opened the left engine fan cowl door and changed the pilot valve; that activity took about 45 minutes. During that time, the first officer completed a pre-flight inspection, and the captain walked over to the engine area and confirmed the status of the thrust reverser system with the apprentice mechanic. Once the valve was changed, the apprentice arranged for his supervisor and the second qualified AME to inspect and certify his work. When that inspection was done, the apprentice lock-wired the pilot valve, removed his tools, and lowered and locked the fan cowl door. A short time later, the supervisor passed by the left engine and noted that the fan cowl was closed and that the latch handles were not visible.

Fan cowl door - System description

The mid-section (fan module) of the engine is enclosed by two large, crescent-shaped doors, each weighing about 135 pounds. Each of these fan cowl doors is supported at the top by hinges mounted to the forward section of the engine pylon. The hinge line is parallel to the axis of the engine. When unlatched, the fan cowl doors can be opened by swinging them outward and upward from below the engine.

When the door is closed, alignment is effected by mating three bullet-shaped locator pins at the bottom of the inboard cowl into corresponding receptacles on the bottom of the outboard cowl. Once aligned, the doors can be secured along the bottom centreline of the fan module by connecting three hook latches (part number [p/n] H2923-3) to three adjacent keepers (p/n H2924-17). These hook latches each have a primary geometric over-centre lock that drives the handle closed when the hook is clasped to the keeper and the latch is placed under tension. A secondary lock, a notched trigger on the handle, engages the hook crosspin and provides a secondary means of holding the mechanism in the over-centre locked position in the event that the hook load goes to essentially zero.

To perform as designed, all three latch points must be rigged to ensure that a minimum pre-load is maintained across the latches themselves. Additionally, the latch handle closing loads must be maintained between 50 and 100 pounds, as specified in the aircraft maintenance manual. This force is important to ensure that the hook is always loaded across the keeper (that is, to generate, within the latch mechanism, loads that tend to further close the latch), to prevent chatter wear due to a loose hook assembly, and to keep the two latch housing faces always in contact. The fan cowl design is such that the failure of any one of its three latches should not adversely affect the security of the latching system.

Wreckage examination

After the accident, TSB investigators and representatives of the component manufacturers and the aircraft operator examined the damaged components. It was determined that the fan cowl door had opened into the airflow and fractured about two feet below the hinge because of overload. The upper section had remained attached to the pylon at the hinge, and the lower section had dropped to the runway. At runway impact, the detached section had shattered into numerous pieces, and the forward and aft latch assemblies had torn out of the door structure. The forward latch was recovered trapped in the channel of the latch sub-assembly, in the clasped position.^{Footnote 2} The centre latch assembly remained attached to a large piece of the fan cowl door and was found in the clasped position. The aft latch was found, jammed and twisted, in the open (unlatched) position. All three of the outboard cowl door alignment pin receptacles were detached because of overload. The corresponding inboard cowl door exhibited no visible damage to the latch keepers, the keeper mounting brackets, the locator pins, or the adjacent structure.

Scope of investigation

Because the components had been damaged and had separated, as a result of the accident, the status of latch rigging and the latch pre-load that existed before the occurrence could not be determined. Consequently, the TSB broadened the scope of its examination to include other similar (but undamaged) aircraft fan cowl latching mechanisms that were in operation with Canada 3000 and other operators. By obtaining data from undamaged comparison aircraft and by comparing and contrasting the various latching systems, it was possible to identify a number of mechanical issues that could increase the risk of a fan cowl separation.

Interference between latch fitting sub-assembly fasteners and trigger pins

The fan cowl latch mechanism on the occurrence aircraft employs a latch fitting constructed of two sub-assemblies that are joined using four hex bolts, flat washers, and nuts. Examination of the latch mechanisms indicated that the latch fitting sub-assemblies had been assembled with the bolt threads, washers, and nuts inside the sub-assembly. Further examination revealed that interference between the trigger/safety pins and the nuts / threaded end of the bolts appeared to be the cause of several bent and one broken trigger/safety pins (Figure 1). With the bolts installed in this fashion, the combined washer and nut thickness is almost double that of the bolt head alone.

Image

Indications of interaction between the trigger/safety pins and the fitting sub-assembly fasteners were also observed on a comparison aircraft, as shown by damage to the ends of the pins, grooves in the innermost end of the nuts, and thread imprints in the trigger/safety pins (Figure 2).

Image

Investigators observed that the latch fitting sub-assembly bolts on the fan cowls of one engine of a similarly equipped Airbus A330 were oriented with the threaded portion facing outward (Figure 3) while those on the other engine fan cowls were oriented inward (Figure 4). Also, the bolts used in the comparison aircraft's sub-assembly were noticeably longer than those that had been used on the occurrence aircraft. The increased length exacerbated interference between the assembly bolts and the trigger/safety pins. Discussion with a representative of the manufacturer revealed that the original latch fitting sub-assembly drawing showed the fasteners installed with the threaded end of the bolts facing inward (Figure 4).

Image

Image

Insufficient latch tensioning

Proper latch tensioning is important to ensure securement of the fan cowls. Of the fan cowls examined during this investigation, approximately 80% were below the aircraft manufacturer's specified minimum latch tension. An aircraft that was just three weeks old had a latch tensioned below the minimum specifications. The latch tension for the fan cowls of the right-hand (uninvolved) engine on the accident aircraft was measured and found to be well below the required specification. Latch tension for the fan cowls of the left-hand (involved) engine could not be determined because of damage related to the failure.

Eye-bolt adjustment star retention spring failures

Engine fan cowl latch tension is adjusted through the use of a radially slotted adjustment star in the keeper mounting assembly. The position of the star is retained by a top and a bottom spring (adjustment star retention springs) in each assembly (Figure 5). These springs engage the corresponding top and bottom slot of the adjustment star.

Image

No specific damage was noted to the adjustment star retention springs of the occurrence aircraft. However, based on a brief survey of comparison aircraft that used similar components, several keeper mounting assemblies were observed, in service, with broken adjustment star retention springs. (See Figure 6 as one example.) In some of these cases, the top and the bottom springs on the same eye-bolt had failed, and there were two cases where more than one adjustment assembly was affected on the same cowl. A specific inspection procedure for the eye-bolt adjustment retention springs could not be found.

Image

Industry practice of using tools to operate latches

Two basic types of latch mechanisms are used to secure fan cowls: those designed to be manipulated with tools and those intended for use by hand only. During the investigation, the TSB observed that maintenance personnel from a number of different air carriers routinely used tools (normally screwdrivers) to operate latches. In some of those cases, the aircraft maintenance manuals restricted the use of tools for that purpose. It was also noted that both types of latches are occasionally juxtaposed on the same engine cowling. This type of configuration requires maintenance personnel to use different procedures to operate the various latches on a single aircraft, increasing the risk of error. Damage that appeared to have been caused by the use of tools was noted on the latch mechanism of the failed fan cowl and on the latches on comparison aircraft.

Conspicuity of latches

The size of large, modern turbo-fan engines, their proximity to the ground, and the fact that latches are often located centrally, underneath the engines, contribute to difficulty in seeing latches that might have been left unsecured. Additionally, the cowl's design and operation make it difficult to notice any difference between fan cowls that are hanging in a closed but unlatched position and those that have been closed and properly latched.

Numerous service bulletins and advisories have been issued regarding the need to ensure that unsecured latches are clearly visible. At the time of this occurrence, there were no airworthiness directives issued against the Airbus A330 / General Electric CF6-80E1 fan cowls. The only relevant service bulletin (N^o 71-022) required the application of international orange paint to the sides of the latch handles. Canada 3000 had complied with the service bulletin and had painted the sides of its fan cowl latches. However, investigators noted that the latch handles on the occurrence aircraft were painted the same bright red as the adjacent fan cowl structure. Examination of aircraft being operated by other companies revealed similar marking schemes.

Aircrew warning systems

There is no system on the Airbus A330 to alert the flight crew that a fan cowl door is not properly secured. In this occurrence, there were no aerodynamic changes with the loss of the fan cowl that were significant enough to alert the crew to the fan cowl separation. This lack of warning has been recorded on other similar fan cowl separation events.

Crew pre-flight inspection

Flight crews conduct a pre-flight inspection before every flight. The company checklist governing this inspection indicates that, when at a maintenance base, the flight crew must check all asterisked items on the checklist. Fan cowl latch security is an asterisked item. In this occurrence, the first officer completed the pre-flight inspection of the aircraft while maintenance was still under way on the thrust reverser pilot valve.

History of fan cowl failures

Airbus has recorded 13 similar fan cowl separations involving Airbus A300 to A330 aircraft since 1978. This occurrence was the first event involving an A330. Records indicate that in 9 of the previous occurrences, the fan cowls had been opened before flight. The separations usually occurred at take-off. Each time, two or more of the latching mechanisms were found to be undamaged after the incident.

Boeing has reported parallel incidents involving its aircraft products that use similar latch designs. In many of the records, the doors appear to have been left unlatched after maintenance. Other incidents, however, involved a failure of the cowl doors because of misrigging or as secondary damage caused by birdstrikes or collisions with ground support equipment.

BF Goodrich, the company that manufactures the cowls and installs the latching hardware, has recorded 15 fan cowl separations since 1972. Of those, 7 were classified as maintenance errors where the latches were not latched; 4 were secondary to another event, like a bird strike; and the remaining 4 were not determined because the associated hardware either was missing or was recovered but provided the investigators with insufficient information to pinpoint the cause.

During this occurrence investigation, a domestic carrier gave the TSB a similar fan cowl latch from an Airbus A320. Reportedly, despite having been through a "dual inspection" before departure, this latch was discovered unlatched on two separate occasions after arrival at the destination. It is noted that the A320/CFM aircraft cowls use latches with a different locking concept: a "double link" over-centre mechanism. The effects of wear, tolerances, and handle damage on a double link latch may differ from the effects on the single toggle mechanism of the occurrence cowls. However, while examining the latch tensioning procedures on an Airbus A320, several engagement failures of the latch trigger/safety were observed. Although the primary latching mechanism functioned correctly, the handle of the latch reached full travel before the latch trigger/safety could engage; the trigger/safety remained ajar. This subtle offset of the trigger/safety, which would be difficult to detect under operational conditions, renders the latch insecure.

Historically, fan cowl losses have been primarily attributed to human error. This accident involved similar attributes to those previous events. Specifically, the left fan cowl had been opened for maintenance immediately before the occurrence; the fan cowl loss occurred during the take-off roll, when differential air pressures would affect an improperly locked cowl; and there was no damage to the adjacent fan cowl latching mechanism that would be expected if the cowl had failed when the latches were engaged with the keepers and properly locked. Each of these attributes can be used to infer that the cowl had not been properly locked after the ramp maintenance activity on the left engine thrust reverser. Conversely, the forward and the centre latch mechanisms of the failed fan cowl were recovered in the clasped position, indicating a possibility that the cowl latches either had been clasped during the maintenance activity or engaged and properly locked after maintenance and before the failure. Because of the ambiguity of the available information, it is difficult to accurately determine the cause of the failure. However, by looking beyond this particular event, the investigation was able to identify related safety deficiencies involving human factors and mechanical components of the system that, if left uncorrected, could lead to an increased risk of further loss.

Human factors issues

Because of the fan cowl's design and method of closure, a fan cowl that has been lowered but not latched looks virtually identical to a fan cowl that has been lowered and properly latched. Latch handles are very difficult to see because of their location on the underside of very large, low-slung engines; this difficulty increases as you move closer to the engine. The company's attempts to make the latch handles more conspicuous by painting them bright red were ineffective because the adjacent cowl area was also painted bright red. This paint scheme effectively camouflaged the fan cowl latching mechanisms.

The inappropriate use of tools to operate these latches can damage the latch's internal spring mechanism. Additionally, increased leverage on the handle, as a result of tool use, may make the bending or breaking off of a latch's trigger/safety pins more probable, thereby negating their safety function. This problem could be corrected by clarifying the maintenance manuals, specifically warnings about the use of tools.

In theory, the fan cowl latches should have been inspected by the flight crew before departure. In practice, however, the flight crew walk-around inspection was conducted before the maintenance items were complete. At that time, numerous doors and latches were open to allow refuelling, resupply of food and beverage, loading of baggage, loading of passengers, and maintenance activity on the left engine. The effectiveness of the flight crew's pre-flight inspection to confirm the completeness of a maintenance activity was lost.

Difficulties in visually detecting unsecured latches, the lack of a final flight crew pre-flight inspection as a defence to ensure that fan cowls are properly secured, and the industry-wide practice of using tools to operate the latches all increase the risk that a fan cowl failure will occur because of human error.

Mechanical deficiencies

Of the fan cowls examined during this investigation, approximately 80% were below the aircraft manufacturer's specified minimum latch tension. Low tension increases the likelihood that a latch will become unlatched on its own. For that reason, the present requirements regarding tensioning do not appear to be appropriate.

Deficiencies related to the orientation of latch fitting sub-assembly bolts with the threads inward, the interference between latch fitting sub-assembly fasteners and trigger/safety pins, the adjustment star retention spring failures, the insufficient latch tensioning, and the incomplete trigger/safety engagement will increase the risk of fan cowl loss due to mechanical malfunction.

Findings as to causes and contributing factors

1. More than one cowl latch was not secured or failed to lock properly, thus allowing the fan cowl to open during take-off.

Findings as to risk

1. There is no cockpit indication to notify the crew whether fan cowls are closed and secured.
2. Interaction between the trigger/safety pins and the fitting sub-assembly fasteners can damage the ends of the pins and thereby increase the risk of component failure.
3. Orientation of latch fitting sub-assembly bolts with the threads inward and use of longer-than-required bolts exacerbates any interference between the assembly bolts and the trigger/safety pins.
4. Failure of adjustment star retention springs increases the risk that the engine fan cowl latch tension will move out of adjustment.
5. By design, the height of the latches and their position at the bottom centreline of the fan cowls makes it difficult to visually detect an unlatched latch.
6. The present maintenance requirements regarding latch tensioning do not appear to be adequate to ensure that latch tension remains in accordance with the manufacturer's specified minima.
7. The effectiveness of the flight crew's pre-flight inspection was lost when the inspection was done before completion of the maintenance activity.

Safety action taken

On 15 August 2000, the TSB forwarded Aviation Safety Advisory A000026-1 to Transport Canada suggesting that Transport Canada

1. ensure that all Canadian-registered aircraft fitted with fan cowl latch fitting sub-assemblies have the fastener bolts correctly installed;
2. advise Canadian air carriers of the increased safety that is attained by making latch handles more conspicuous;
3. advise or issue a warning to Canadian air carriers regarding the dangers of using tools to operate latches not designed for tool use;
4. advise Canadian air carriers of the TSB's survey results regarding eye-bolt adjustment retention spring failures and take appropriate action to correct the deficiency;
5. advise Canadian air carriers of the importance of ensuring proper latch tensioning and of its effect on the operation and the integrity of the latching system;
6. advise Canadian air carriers of the potential for incomplete trigger/safety engagement on Airbus A320 aircraft and monitor accordingly; and
7. advise applicable foreign airworthiness authorities of the concerns raised in this advisory.

In response to the safety advisory, Transport Canada

1. notified the Federal Aviation Administration (FAA) certification office and the French Direction Général de l'Aviation Civile (DGAC), the organization responsible for the type design of Airbus aircraft, of the concerns indicated in the advisory;
2. issued Service Difficulty Alert AL-2000-06 on 11 October 2000, providing five recommendations that could be taken to prevent future occurrences; and
3. published an article entitled "Large Aircraft Cowl Fastener Problems" in issue 4/2000 of its newsletter Aviation Safety Maintainer. The article informed industry of the number of incidents involving cowl fastener failures, with specific mention of Airbus aircraft and a similar incident that took place on 13 September 2000 (TSB Report N^o A00O0199).

In response to this occurrence, Canada 3000

A330 Fleet Only

1. checked and corrected the latch tensions in accordance with the aircraft maintenance manual;
2. introduced an additional maintenance schedule requirement to recheck the latch tensions at "C" check intervals and at each engine change;
3. added reflective tape to the sides and the face of each fan cowl latch on the A330's to make them more conspicuous in the unlatched position;
4. introduced an additional maintenance schedule requirement on the A330 to recheck the reflective tape at "A" checks; and
5. checked the A330 fleet for potential interference between the hook latching pins and the adjacent latch mounting bolts and corrected as necessary.

A330, A320, and Boeing 757 Fleet Types

1. Quality Control published inspection alerts for all fleet types, highlighting the importance of inspecting the latches for condition and checking for sufficient tension when closing;
2. Quality Control made fan cowl latches a required inspection item (requiring a second inspection and signature each time they are opened) on all aircraft types in the fleet;
3. Quality Control circulated Service Difficulty Alert N^o AL-2000-06 to heighten maintenance personnel's awareness of fan cowl latches; and
4. Quality Control made TSB Aviation Safety Advisory A000026-1 (Factors Affecting the Loss of Engine Fan Cowls) the subject of a presentation at its annual Maintenance Conference in September 2000, again to heighten awareness.

In response to this occurrence, BF Goodrich

1. issued a service bulletin (CF6-80E1-NAC-71-032) on 01 January 2001 covering the correction to the direction of latch fitting sub-assembly bolts;
2. will add a warning to the applicable maintenance manuals regarding potential damage to the latching systems from unauthorized use of tools to operate the latches; and
3. revised the 3000-flight-hour periodic interval to the "C-Check" interval, although the March 2000 maintenance manual includes tension verification after inlet and fan cowl removal/replacement and periodic tension verifications at the 3000-flight-hour internal. This aircraft maintenance manual improvement to the "C-Check" interval was scheduled for the January 2002 revision.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 06 February 2002.

Appendix A - Cowl Latch Terminology

• Unlatched: The latch handle secondary trigger hooks are released from the safety crosspins, and the latch hook is not engaged with the keeper (part number H2924-17).
• Clasped: The latch hook is not engaged with the keeper, but the latch handle secondary trigger hooks are secured to the safety crosspins.
• Engaged: The latch hook is engaged with the keeper but has not been placed in the over-centre position.
• Locked: The latching mechanism is properly prepared for flight according to maintenance manual requirements.