Plane Crashes Caused by Maintenance Errors, and the Lessons

Maintenance errors have caused or set up some of the most studied accidents in airline history. In most of them no single mechanic was careless in isolation: a procedure was unclear, a check was too short to show the fault, or an inspection programme was not designed for the way the aircraft was really used.

The six cases below all have event pages on this site. Each one is described as its investigating body found it.

How a maintenance mistake reaches the air

Airliner maintenance is built in layers. A task card says what to do. A mechanic signs for the work. Some tasks need a second inspector. Many end with a test, such as an engine run or a leak check. Then the aircraft is released to service and the crew does its own walk-round and checks.

A mistake becomes an accident when it gets through every layer. The cases here show the usual ways that happens:

The part: a component is fitted without a seal, or in a combination that does not match.
The paperwork: a modification is recorded as done when it is only partly done, or a known fault is carried with the wrong procedure.
The test: the check after the work is too short, or tests the wrong thing.
The inspection programme: the schedule assumes the aircraft is used one way, and it is used another.

Investigators often explain this with James Reason’s model of defences with holes in them. Our guide to the Swiss cheese model uses two of these cases as worked examples.

Eastern Air Lines Flight 855: missing O-rings on three engines

On 5 May 1983 Eastern Air Lines Flight 855, a Lockheed L-1011 TriStar flying from Miami to Nassau, lost the oil from all three engines.

The night before, mechanics had replaced the master chip detectors in all three engines. These magnetic plugs collect metal particles from the oil. The detectors were fitted without their O-ring seals. The engines were run for only about 10 seconds after the work, too short to show a leak.

In flight, oil seeped out of all three engines. The crew shut down the tail engine, turned back for Miami, and then lost the other two. They restarted the tail engine at about 4,000 feet and landed at Miami on that one engine. All 172 people on board were unhurt.

The NTSB found that the O-ring seals had been left off all the chip detectors because mechanics did not follow established procedures for installing them (NTSB/AAR-84/04). The case is a lesson in redundancy: three engines are meant to be independent, but the same person doing the same task on all three overnight can remove that independence. The L-1011 TriStar guide covers the aircraft’s other accidents.

Aloha Airlines Flight 243: corrosion and fatigue nobody caught

On 28 April 1988 about 18 feet of the upper fuselage of Aloha Airlines Flight 243, a Boeing 737-200, tore away at 24,000 feet between Hilo and Honolulu. Flight attendant Clarabelle “C.B.” Lansing was swept out of the aircraft. The crew landed at Kahului on Maui, and the other 94 people on board survived.

The aircraft had flown 89,680 flight cycles, according to the FAA. Its lap joints had been built with a cold-bond adhesive that had known problems. Once the bond let go, the rivets carried the load, and small fatigue cracks grew at many neighbouring rivets. This is called multiple-site damage. Many small cracks can link up suddenly into one long one.

Aloha’s heavy check interval looked reasonable in flight hours. But the airline flew very short island hops, so it built up cycles at about twice the rate Boeing assumed. In a pressurised fuselage, cracks grow with each pressurisation cycle, not with hours in the air. Aloha had also split its heavy check into 52 separate work packages, which the NTSB called an inappropriate way to do it.

The NTSB’s probable cause was the failure of Aloha’s maintenance programme to detect significant disbonding and fatigue damage, with Aloha management, FAA oversight and Boeing’s handling of the early lap joint problems contributing (NTSB/AAR-89/03). What followed, from the 1991 Aging Aircraft Safety Act to widespread fatigue damage rules, is in our guide to aging aircraft rules after Aloha 243.

Air Transat Flight 236: a part that did not match

On 24 August 2001 Air Transat Flight 236, an Airbus A330 flying from Toronto to Lisbon, lost all its fuel over the Atlantic through a leak in the right engine. Both engines stopped. The crew glided to Lajes in the Azores and landed, and all 306 people on board survived.

The leak was a crack about 80 mm long in a fuel line, worn through where it rubbed against a hydraulic line. The FAA’s summary of Portugal’s investigation explains why. A Rolls-Royce service bulletin set out the fuel and hydraulic tubes needed to fit an improved hydraulic pump. On the engine fitted to this aircraft, the tube work had not been completed because of a parts shortage, but the new pump was fitted anyway. The mismatch left the two lines too close together.

The crew’s response to the fuel imbalance also mattered: opening the crossfeed sent fuel from the good side out through the leak. That part of the story, and the record glide, is in our guide to planes that ran out of fuel.

Helios Airways Flight 522: a switch left in the wrong position

On 14 August 2005 Helios Airways Flight 522, a Boeing 737-300 flying from Larnaca to Athens and Prague, never pressurised. The night before, engineers had carried out a pressure test with the pressurisation mode selector in manual. It was left there.

The pilots did not notice the selector in three checks. As the aircraft climbed on autopilot, they were overcome by hypoxia. It flew on for almost three hours until its fuel ran out and crashed into hills near Grammatiko. All 121 people on board were killed.

Greece’s AAIASB (report 11/2006) found that the crew did not recognise the selector position or the warnings. It also named latent causes, among them the operator’s safety culture, weak regulatory oversight and ineffective action by the manufacturer after earlier pressurisation incidents. The maintenance step was small, but it left a trap that every later check failed to catch.

Emery Worldwide Flight 17: an elevator bolt that came out

On 16 February 2000 Emery Worldwide Flight 17, a McDonnell Douglas DC-8 freighter, pitched up uncontrollably as it took off from Sacramento Mather Airport. The crew fought for about two minutes to fly back to the airport. The aircraft crashed into an automobile salvage yard in Rancho Cordova, and all three crew members died.

A bolt had come out of the right elevator control tab, the small surface that helps move the elevator. Flight data showed a change in the elevator’s behaviour on the previous flight, consistent with the tab already being disconnected.

The NTSB found a loss of pitch control caused by the disconnection of the right elevator control tab, because the attachment bolt was not properly secured and inspected (NTSB/AAR-03/02).

The Gimli Glider: a faulty fuel gauge and the paperwork around it

On 23 July 1983 Air Canada Flight 143, the Gimli Glider, a new Boeing 767, ran out of fuel at 41,000 feet over northern Ontario. Captain Robert Pearson glided it to a landing on the disused air force runway at Gimli, Manitoba, and all 69 people on board survived.

The headline cause was a unit mix-up: the fuel load was worked out with a pounds-per-litre factor instead of kilograms per litre. But maintenance set the scene. The aircraft had a fault in its fuel quantity system, and it was dispatched with blank fuel gauges contrary to the minimum equipment list. That meant the fuel figure depended entirely on manual calculations, and those were wrong. The Board of Inquiry led by Commissioner George H. Lockwood also found wider corporate and equipment deficiencies at Air Canada (final report, April 1985).

Three more cases: American 191, Alaska 261 and JAL 123

These accidents are central to the history of maintenance safety. Each now has its own event page, with the full timeline and the official finding.

American Airlines Flight 191, Chicago, 25 May 1979. The left engine and pylon of a DC-10 separated on take-off. All 271 people on board and 2 people on the ground were killed. The NTSB traced the pylon failure to damage caused when the engine and pylon were removed and refitted as one unit with a forklift, a shortcut procedure the airline had developed (NTSB-AAR-79-17).
Alaska Airlines Flight 261, off California, 31 January 2000. An MD-83’s horizontal stabiliser trim jackscrew failed after its nut threads wore away. All 88 people on board were killed. The NTSB found the wear was caused by Alaska Airlines’ insufficient lubrication of the jackscrew assembly (NTSB/AAR-02/01).
Japan Air Lines Flight 123, Japan, 12 August 1985. A Boeing 747’s rear pressure bulkhead ruptured, taking away the fin and all four hydraulic systems. According to the FAA, 505 passengers and 15 crew were killed and four people survived. The bulkhead had been repaired years earlier after a tail strike, and the repair was installed improperly, which led to early fatigue failure.

What changed: human factors in the hangar

For a long time, maintenance errors were treated as individual lapses. That changed after cases like these. The cockpit had moved to crew resource management in the 1980s, and the FAA notes that this started the attention to human factors in maintenance in the late 1980s (Advisory Circular 120-72A).

In 2000 the FAA published guidance on maintenance resource management training (AC 120-72). Its 2017 replacement, AC 120-72A, uses the broader term maintenance human factors. It says many repair stations, US carriers and organisations approved under EASA Part-145 have run required human factors programmes since 2005.

A core part of that training is the “Dirty Dozen”, which the FAA defines as the twelve most common maintenance-related causes of errors:

Lack of communication
Complacency
Lack of knowledge
Distraction
Lack of teamwork
Fatigue
Lack of resources
Pressure
Lack of assertiveness
Stress
Lack of awareness
Norms

The FAA’s reference list credits Gordon Dupont as the father of the Dirty Dozen. Each item maps onto a case above. Pressure and lack of resources describe the parts shortage behind Air Transat 236. Norms describes the Aloha fleet, where, the NTSB noted, pilots and line staff had come to accept classic signs of corrosion as normal.

Specific fixes followed specific accidents too. After Eastern 855, the airline required engines to run for at least 30 seconds after this kind of work, long enough to reveal leaks. After Aloha 243, the FAA required corrosion control programmes and mandated inspections of fuselage lap joints.

The collection When a repair or a part gave way brings the videos on these accidents together. The topic page for maintenance error lists every event on the site with that cause, and structural failure covers the cases where the airframe itself broke.

Comparison table

Flight	Date	Aircraft	What went wrong in maintenance	Outcome	Investigating body
Eastern Air Lines 855	5 May 1983	Lockheed L-1011	Chip detectors fitted without O-ring seals on all three engines	All 172 on board unhurt	NTSB
Aloha Airlines 243	28 April 1988	Boeing 737-200	Disbonding and fatigue cracking not detected by the inspection programme	1 killed, 94 survived	NTSB
Air Transat 236	24 August 2001	Airbus A330	Service bulletin only partly done; fuel line chafed by hydraulic line	All 306 survived	GPIAA (Portugal)
Helios Airways 522	14 August 2005	Boeing 737-300	Pressurisation selector left in manual after a test	All 121 killed	AAIASB (Greece)
Emery Worldwide 17	16 February 2000	DC-8 freighter	Elevator control tab bolt not properly secured and inspected	All 3 crew killed	NTSB
Air Canada 143	23 July 1983	Boeing 767	Dispatched with blank fuel gauges contrary to the minimum equipment list	All 69 survived	Board of Inquiry (Canada)

Watch in the library

Every video on this subject is on the Maintenance error page.

Sources

NTSB. NTSB/AAR-84/04, Eastern Air Lines Lockheed L-1011, N334EA, Miami, 5 May 1983 Source
NTSB. NTSB/AAR-89/03, Aloha Airlines Flight 243, Boeing 737-200, N73711, near Maui, 28 April 1988 Source
FAA. Lessons Learned: Aloha Airlines Flight 243 (N73711) Source
FAA (summarising the GPIAA, Portugal, final report). Lessons Learned: Air Transat Flight 236 (C-GITS) Source
AAIASB (Greece). Final Report 11/2006, Helios Airways Flight HCY522, Boeing 737-31S, 5B-DBY Read the report
NTSB. NTSB/AAR-03/02, Loss of Pitch Control on Takeoff, Emery Worldwide Airlines Flight 17, DC-8-71F, N8079U Source
Government of Canada Board of Inquiry (Library and Archives Canada scan). Final Report of the Board of Inquiry into Air Canada Boeing 767 C-GAUN (Commissioner G. H. Lockwood), April 1985 Read the report
NTSB. NTSB-AAR-79-17, American Airlines DC-10-10, N110AA, Chicago O’Hare, 25 May 1979 Source
FAA. Lessons Learned: American Airlines Flight 191 (N110AA) Source
NTSB. NTSB/AAR-02/01, Alaska Airlines Flight 261, MD-83, N963AS, near Anacapa Island, 31 January 2000 Source
FAA. Lessons Learned: Japan Air Lines Flight 123 (JA8119) Source
FAA. Advisory Circular 120-72A, Maintenance Human Factors Training (2017) Source