The Debrief · No. 02
Matching is not verification
The airliner that lost its windscreen at 17,300 feet because one engineer checked his work against the wrong part already in his hand, not against the standard.
Case File
What happened
On 10 June 1990, British Airways Flight 5390, a BAC One-Eleven registered G-BJRT, departed Birmingham for Malaga. The previous night, a shift maintenance manager had replaced the cockpit's direct-vision windscreen panel on his own. He selected the ninety replacement securing bolts by comparing them to the bolts he had just removed, rather than checking the maintenance manual for the correct specification. The bolts he removed were themselves the wrong type, a mistake left over from an earlier repair. Working from a stepladder in poor hangar lighting, he fitted bolts of which eighty-four were undersized in diameter and the remaining six were too short. He did not use a torque wrench, and no second engineer inspected or signed off the work: company procedure did not require an independent check of a safety-critical task carried out by one person.
At around 17,300 feet, the pressure differential the undersized bolts were never fitted to hold finally told on them. The windscreen blew outward. The captain was pulled forward through the opening, out from the waist up, saved only because his knees caught the control column and cabin crew grabbed and held his legs. The first officer, with a colleague hanging half out the front of the aircraft and most of the cockpit instruments unreadable in the wind, flew the descent by hand and landed at Southampton Airport. Cabin crew held the captain for close to twenty minutes. All 87 people on board survived; the captain recovered from frostbite, bruising and fractures and returned to flying.
The Lesson
The lesson aviation took
The finding was not that one engineer had been careless. It was that his check had nothing to check against except itself. He compared the new bolts to the old bolts, not to the standard the old bolts should have met. An error, once installed, becomes the reference point for the next person who is only checking for consistency. Aviation's response was to require an independent inspection: someone other than the person who did the work verifying it against the specification, not against what they find already in place. Working alone, in poor light, overnight, under time pressure, did not cause the error. It removed the one thing that would have caught it: a second person with their own reference point.
Translation
On your site
The isolation tag copied from what the last shift left, not checked against the isolation register. The bolt or gasket replaced to match the one that came out, not the drawing. The setting left as found because that is what "normal" looks like on this pump, this valve, this circuit, when nobody has checked what normal is actually meant to be. Every one of these feels like due diligence. None of them is, if the only standard being checked against is what is already there. Independent verification means someone checks the part, the setting, or the isolation against the drawing or the spec sheet, not against the last person's work.
Ask the Crew
Three questions for pre-start
- 01
Where does our checking compare against the actual standard (drawing, spec, isolation register), and where does it just compare against what we already find in place?
- 02
What safety-critical tasks on our site are still done, checked, and signed off by one person, alone?
- 03
Pick one task this week done from memory or from "what's normally there": what would it take to verify it against the standard instead?
Matching is not verification.
Free Download
Run better pre-starts
The free Pre-Start Briefing Pack includes the THREAT Brief format, a Challenge and Response card, and three read-aloud talks like this one.