British Airways 5390: The Bolts Nobody Looked Up
In June 1990 the left windscreen of a British Airways BAC One-Eleven blew out at 17,300 feet. Eighty-four of its ninety bolts were thinner than specified, chosen by one engineer who matched them to the old ones by hand and never opened the parts catalogue. Nobody checked his work, and the rules did not ask anyone to.
Chapters
- 0:00 The bolts nobody looked up
- 0:16 Birmingham to Malaga, 17,300 feet
- 0:41 148 seconds to level flight
- 1:11 A windscreen that is not a plug
- 1:38 A211-8D and A211-8C
- 2:05 A part that feels right
- 2:32 The night shift of 8 and 9 June
- 3:03 Copying a mistake already there
- 3:33 The stores and the 8Ds
- 3:59 The second carousel, under the Pier
- 4:28 The catalogue on microfiche
- 4:54 Fifteen, then twenty
- 5:23 Clues in the countersink
- 5:52 Why no one checked
- 6:20 One line: windscreen replaced
- 6:48 One man or the system?
- 7:18 Three causal factors
- 7:45 Eight recommendations
- 8:11 The checks on the fleet
- 8:37 A second pair of eyes
Transcript
The bolts nobody looked up 0:00
The windscreen of British Airways Flight 5390 was held by ninety bolts, and nobody looked them up. One engineer chose them by eye, then signed for the work himself. We read the report page by page, to find who could have stopped him.
Birmingham to Malaga, 17,300 feet 0:16
On the morning of June 10th, 1990, a British Airways BAC One-Eleven took off from Birmingham, bound for Malaga. On board were eighty-one passengers, four cabin crew and two pilots. At thirty-three minutes past seven, climbing through seventeen thousand three hundred feet, there was a loud bang and the fuselage filled with mist. The left windscreen had blown out of its frame.
148 seconds to level flight 0:41
The commander was pulled partway out through the opening. A member of the cabin crew caught him and held on, and was relieved by another, who held him by the ankles until the airplane had landed. The co-pilot, disoriented, took control and began an immediate descent. From the loss of the windscreen to level flight at eleven thousand feet took one hundred and forty-eight seconds. The co-pilot landed at Southampton at five to eight. Everyone on board survived.
A windscreen that is not a plug 1:11
That is the story you may know, and it is true. The question here is how a windscreen came loose in the first place. This one was not designed as a plug, where cabin pressure presses it into its frame. It was fitted from the outside, and held by ninety countersunk bolts. The report says far fewer bolts could resist the force of the air inside. Ninety was margin. The night before the flight, that margin was spent.
A211-8D and A211-8C 1:38
The parts catalogue called for a bolt numbered A211-8D. Of the ninety bolts on the airplane, eighty-four were A211-8C. Same length, but about twenty-six thousandths of an inch thinner. Even the thickest of the thin bolts was thinner than the thinnest allowed for the right one. The other six were the right diameter, and a tenth of an inch too short. The bolts carry no mark to tell them apart.
A part that feels right 2:05
The bolts screw into floating anchor nuts on the inside of the frame. A thinner bolt of a similar thread still goes in, and still turns. In the investigators' tests, those thin bolts stripped their threads in the nut at between one and seven pound-inches. The manual asked for fifteen. At five, the feel of the tool slipping was indistinguishable from the feel of the thread slipping. The part was wrong, and it felt right.
The night shift of 8 and 9 June 2:32
The windscreen was changed on the night shift of June 8th and 9th, between about three and five in the morning. The airplane had not flown since. The engineer in charge was a shift maintenance manager, with thirty-three years in the RAF and the airline. His shift was short-handed, and a wash was booked for half past six. The report says no one put pressure on him. To finish in time, he decided to do the windscreen himself. At that moment, he stepped back from supervising the rest of the shift.
Copying a mistake already there 3:03
He had a way to pick the new bolts: copy the old ones. Some of the old bolts were damaged coming out, so he decided to replace them all. He took one to the stores to match it. The report found that eighty of the old bolts were recovered, and seventy-eight of them were the short kind, a tenth of an inch under what the catalogue specified. The old windscreen had been fitted four years earlier, before the airline owned the airplane. He was copying a mistake that was already there.
The stores and the 8Ds 3:33
At the stores, he read the part number from the issue note in the drawer: A211-7D. A stores worker with sixteen years in the job told him that the right bolts for that windscreen were the 8Ds. He did not press the point. And the engineer decided that since 7D bolts had come out, he would put in bolts of the same size. The drawer held four or five. The minimum stock was fifty.
The second carousel, under the Pier 3:59
So he drove to a second carousel of parts, under the International Pier, which no one supervised. The report says the light was poor, and the labels old and faded. He did not read the labels, though he now knew the number. He matched bolts the way a person would: holding two of them between finger and thumb and rolling them. These bolts are too small to carry a mark. He had reading glasses, a weak prescription, and was not wearing them.
The catalogue on microfiche 4:28
The parts catalogue was available on a microfiche reader. He did not use it. In the report's words, it would take so much time to find the numbers that he did not feel justified. He was satisfied that the bolts he had removed were the right ones. And the catalogue was not a clean oracle. For this model, its page shows one bolt, a short one. The long ones are named only in the text beside it.
Fifteen, then twenty 4:54
Then he tightened them. The manual calls for fifteen pound-inches. His experience said many would be found loose later, so he chose twenty. The proper dial wrench was not on the board that night. A torque-limiting screwdriver had been obtained from London, and it was out of its calibration date, so it was not cleared for use. The policy was to set such tools in a standards room. That night, a storeman set it to twenty, and he checked it on two gauges.
Clues in the countersink 5:23
There were clues on the airplane. A thinner bolt sits deeper in the countersink, and leaves a ring of empty space that is easy to see in good light. The investigators photographed it. Side by side, the new thin bolt sits lower than the old one. The next night, he changed a right-hand windscreen whose bolts had been set out before he arrived. They were 8Ds. He remembered fitting 7Ds the night before, and explained the difference away.
Why no one checked 5:52
No one checked. Duplicate inspection was required for control systems, and for a list of vital points, any point where one mistake could bring down the airplane. But the regulations exempted this airplane type from that definition. And the manufacturer did not expect a pilot's windscreen on such a list. The airline's rules let one authorised engineer do most work, and sign for it. No one needed to test the cabin pressure afterwards.
One line: windscreen replaced 6:20
The record of the job was a single line. Windscreen replaced. A certificate of release was already printed beside it. The report summarises the position of the engineer that night plainly. The only functional check recorded was of the windscreen heating. He had no backstop, nothing with a chance of finding his errors. And, at the end of a first night shift, with only a short sleep that afternoon, the errors were more likely.
One man or the system? 6:48
The investigators asked whether this was one man, or the system that he worked in. They concluded it lay somewhere between the two. No one had been placed to look at how shift managers worked. The airline's product samples were taken by the managers directly responsible for the work. The regulator's last visit had lasted about half a day. And in thirty-nine months, staff filed the quality report thirty-six times, and the other form, three hundred and sixty-five.
Three causal factors 7:18
The report names three causal factors. A safety critical task, not identified as a vital point, was done by one person who carried total responsibility for its quality, and it was not tested until the airplane was in the air with passengers. His care, his trade practices and his tools fell short of company standards. And the airline had no way to see that, because it did not watch how shift managers worked.
Eight recommendations 7:45
Eight safety recommendations followed. The first asks the regulator to examine self-certification for safety critical tasks that are cleared without a functional check, and the waiver of vital points for older airplanes. The others ask for job descriptions, an independent audit of Birmingham, periodic training and testing of engineers, and corrective glasses for those who need them. None of them is a better bolt.
The checks on the fleet 8:11
The airline ordered every One-Eleven it owned checked before its next flight. Every fourth bolt was removed from the front windscreens, to check the length. Two airplanes failed, with forty-one short bolts between them. Another airline had the same check done on four of its own. Two failed, with a hundred and seven. We could not find the regulator's published reply, so we do not say what changed in the rules.
A second pair of eyes 8:37
Ninety bolts looked like ninety chances to be right. Each of them was chosen once, by the same hand, from the same mistake. A second pair of eyes is not an insult to the first. It is the only place a mistake can be seen by someone who did not make it. Next case is a jackscrew. Alaska Airlines Flight 261, January 2000: a McDonnell Douglas MD-83 lost pitch control when the thread of a part that held its tail wore through. The check that could have caught the wear had its interval stretched, with the regulator's approval.
Description and sources
British Airways Flight 5390 took off from Birmingham on 10 June 1990 bound for Malaga. At 17,300 feet, with 81 passengers, four cabin crew and two pilots aboard, the left windscreen blew out of its frame. The commander was pulled partway through the opening and held by cabin crew while the co-pilot flew the airplane to Southampton. Everyone survived.
The windscreen had been replaced 27 hours earlier by one shift maintenance manager, working alone on a night shift. Of the 90 bolts, 84 were A211-8C, about 0.026 of an inch thinner than the specified A211-8D; six were the right diameter but 0.1 of an inch short. He had picked them by comparing them with the old ones, two carousels of parts and a microfiche catalogue he did not use. Even the old windscreen's bolts had been mostly the wrong, short type for four years. The task was not designated a vital point, so no independent inspection was required. The AAIB report found that the system had allowed this engineer's standards for some time, and made eight safety recommendations, the first to the regulator on self-certification.
PRINT-READY, FROM THIS CHANNEL
The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency
https://therepository.gumroad.com/l/failure-atlas
PRIMARY SOURCES
- UK Air Accidents Investigation Branch, Report on the accident to BAC One-Eleven, G-BJRT, over Oxfordshire on 10 June 1990, Aircraft Accident Report 1/92 (Crown copyright; Open Government Licence v3.0 on the GOV.UK page) -- read directly (synopsis, 1.1, 1.3, 1.11-1.12, 1.15-1.17, 2.2, 3, 4): https://www.gov.uk/aaib-reports/1-1992-bac-one-eleven-g-bjrt-10-june-1990
- Next episode: Alaska Airlines Flight 261, 31 January 2000 (NTSB report AAR-02/01, to be read directly): https://www.faa.gov/lessons_learned/transport_airplane/accidents/N963AS
ARCHIVE PHOTOGRAPHS — the real structure, with title, author, date, archive and licence. All public-domain.
- Appendix E — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 12, 1.12.1 — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 12, 1.11.2 — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- Appendix B — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 13, 1.12.1 — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 31, 1.17.4.2.c — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 30, 1.17.4.2.b — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 31, 1.17.4.2.b — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 32, 1.17.4.2.d — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 17, 1.17.1.2 — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
- p. 52, Findings (iii)-(ix) — AAIB — 1992 | AAIB 1/92 | Open Government Licence v3.0 (Crown copy
The 4 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system — the photographs above are the archive, the drawings are ours, not photographs of the hardware, and no person is depicted in any of them.
Root Cause investigates why engineered systems fail, using official investigation findings and primary technical literature. Sources for this episode are linked above.