Patient Safety Tip of the Week Archive

Patient Safety Tip of the Week

July 19, 2022

Sucked Out of the Plane at 17,000 Feet

Our regular readers know we like to use aviation analogies to make points about safety in healthcare (see list of prior columns below). We are giving a course on “Why Accidents Happen” and one of our examples is well worth telling here. The following comes from the book “Inviting Disaster” by James R. Chiles and 2 videos “Blow Out”, a short version and a long version.

On June 10, 1990 British Airways Flight 111 left Birmingham, England on a flight to Malaga, Spain with 87 passengers and crew aboard. As the aircraft climbed out, the captain and copilot unbuckled their chest straps but left their lap belts loosely fastened. Then, at 17,000 feet, the windscreen pulled loose and flew up and over the nose, snapped off a radio antenna and fell free. A force of 5500 pounds pulled the captain out of his seatbelt and launched him headfirst into the window frame. His legs and feet were lodged in the console but he was now mostly outside the plane in zero degree temperature and windspeed 396 miles per hour. Hypothermia was very likely to kill him even if he did not fall out completely.

The cockpit and cabin filled with fog (the decompression takes water vapor out of the air) and wind whistled through the cockpit at 350+ mph. The copilot could not hear anything else and could not communicate with air traffic control. The captain’s legs and feet, still lodged in the console, were actually causing the plane to increase speed. A downed cabin door also contributed to lack of access to controls. The copilot knew he must descend to lower altitude, so passengers and crew do not suffer from lack of oxygen. He must descend blindly over Heathrow airspace, one of the busiest in the world, thus risking a mid-air crash.

A flight steward enters the cockpit and grabs hold of the captain’s legs. Another steward enters and moves the fallen cabin door, freeing up the controls. The copilot descends to a safe level and makes contact with air traffic control (ATC). He asks for emergency landing at Gatwick Airport, which he is familiar with. ATC suggests Southampton airport instead. The copilot is concerned because he thinks he needs at least a 2200 meter runway (because of full fuel load that cannot be dumped) and Southampton has only 1800 meter runway. ATC still says to go to Southampton anyway and it deploys emergency vehicles there.

Flight stewards took turns holding the captain’s legs, while the copilot reduced speed and altitude. Crew was certain the captain was already dead and, at one point, had to decide whether to let the captain go. The decision to keep holding on to him was based as much on risk factors to the plane (fear his body would damage wings or jet engine) as well as the remote chance they could save him.

The copilot managed a safe emergency landing on the short runway at Southampton 18 minutes later. There the captain was whisked off in an ambulance. In the ambulance his eyes began to open. He’s still miraculously alive!!! He suffered frostbite, cuts and bruises, and several broken bones but survived. Five months later he returned to pilot again.

That was the drama. You can watch both a short version and a long version of these events online.

But the lessons came after the successful landing.

The investigation began immediately. There was no evidence of structural damage to the fuselage and no glass shards or fragments were found, so a bird strike or collision with other object was excluded. The investigator reviewed logs and saw that recent maintenance had been done. So the investigation moved back to Birmingham, England.

At 3:00 AM that morning the plane had rolled into the maintenance facility at Birmingham, England for a windscreen replacement that needed to be finished by 6:30 AM so the aircraft could get a wash before starting the day’s flight to Malaga, Spain. Windscreens must be strong enough to resist tons of force from cabin pressure when the airplane is at high altitudes. A hard-working maintenance manager decided to take on the awkward job of replacing the sixty-pound slab of layered glass and plastic himself. He began the job at 3:00 AM. He had replaced aircraft windscreens six times before, but he still read through that part of the maintenance manual quickly. Then he gathered his tools, positioned a scaffold, and climbed up to unscrew ninety bolts from the rim of the windscreen. He had a new windscreen ready and he had the pile of original bolts, eighty-four of which he knew to be of size 7D and six of them a little longer. But some of the bolt heads had globs of dried paint on them and others had been scarred from the removal process. He refused to take the easy course of using as many of the old bolts as possible, replacing only the damaged ones. He wanted to replace them all.

He went to the storeroom with a sample of the bolts he needed. The 7D bolt bin had only a few on hand, far less than he needed. The man in charge of the storeroom told him he should be using 8D bolts for a windscreen replacement, anyway. He disregarded that comment, figuring that since 7D bolts had worked before, they would work again. (The proper bolt actually was the 8D.)

There was a standby parts depot located two miles away, so he drove there. Most of the bins weren’t marked, none were supervised, and the lighting in this part of the building was bad. He kept digging until he found a bin of bolts that, when he held one up in the gloom alongside his old 7D, looked to be the same. In fact, the ones he found were neither 7D’s nor the proper 8D’s. The eighty-four unmarked bolts he loaded up and took back with him to the hangar were size 8C. They were one-fortieth of an inch narrower in diameter than the 7D’s he wanted. When he was finished, of all ninety bolts, only six long bolts of the correct size actually held the windscreen fast.

So, what were the contributing factors in this case that we also often see in healthcare incidents? The lead investigator in this incident said that there were “something like 13” contributing factors to this accident and that correction or avoidance of any one of them would have prevented the accident. Sound familiar? In healthcare incidents we typically see such a cascade of events and contributing factors, avoidance of any one of which would have prevented the adverse outcome.

Fatigue may well have played a role. The maintenance work took place in the middle of the night, beginning at 3:00 AM and not finishing until near the end of the maintenance manager’s shift. Time pressures clearly played a role. This work had to be done so the flight could get washed at 6:30 AM prior to its early departure time. So, all the work had to be compressed into the period between 3:00 AM and 6:00 AM. In the airline industry (and most industries), “time is money”.

Work overload likely contributed as well. There were so many ongoing maintenance jobs that the manager had to do this job on his own. In addition, there were likely distractions, since the manager was in charge of all work being done and was concerned how all the other jobs were going, even while doing his own project.

Workarounds were a major contributor. People often take pride in their workarounds and may be considered “resourceful” Some workarounds are indeed “resourceful” and useful, but most are not and can be dangerous. In this case, the workaround was that the manager did not look at the parts catalog. He told the investigators, apparently with a sense of pride, that finding the correct bolts is “easier to do visually”. In fact, bypassing the parts catalog apparently had become the norm in this maintenance facility. We refer to that as “normalization of deviance”.

Assumptions played a big role. The manager matched up bolts to the ones he had removed. The old ones had been in place for 4 years, apparently without incident. He assumed that, if the old ones worked, the new ones will work.

And 2 of the common cognitive biases we so often see in healthcare incidents came into play here: confirmation bias and ignoring disconfirming evidence. The bolts looked like they were the same size as the ones he had removed. “I got 7D bolts out, I put 7D bolts back in”. There were at least 2 bits of disconfirming evidence. He ignored stockroom worker’s warning that those were not the correct bolts and he also ignored the fact that the bolts went in without the usual resistance you’d expect when putting them in.

Overconfidence (or hubris) also played a role. When asked why he ignored the storeroom clerk’s statement that those were the wrong bolts, the manager said “Well, I’m an engineer…”.

There were also environmental factors. The hangar was full and the plane was pushed up against a wall, making it difficult for the manager to work on the windscreen. The lighting in the auxiliary parts storeroom was poor, making identification of the bolts difficult.

And there was also a critical design flaw. The bolts on this aircraft windscreen went in from the outside. On newer models, the bolts go on the inside. If the bolts loosened at high altitude, the higher cabin pressure inside the plane would push the windscreen against the fuselage rather than having the windscreen blow out as it would on the old design.

And there was probably a latent factor: the old bolts were actually the wrong size!!! It’s incredible this accident had not occurred earlier. Perhaps those 6 long bolts had been originally located just strategically enough to prevent a blowout?

When we look at an incident, there is typically a “sharp” end. The root causes and other contributing factors at the “blunt” end add up and leave a human with “the smoking gun”. The lead investigator in this incident said “This investigation uncovered pressures in the hangar that caused an otherwise proficient engineer to make potentially lethal mistakes while being certain he was doing the right thing”.

Lastly, this incident was technically a “near miss” since the ultimate outcome for the pilot and the 87 passengers and crew was not physically detrimental. As in many healthcare incidents that are “near misses”, a little bit of luck is important. On the bad luck side, the pilot happened to be sitting on the side of the defective windscreen and had loosened his shoulder harness. On the good luck side, all were lucky the plane did not hit any other planes as they descended blindly through crowded airspace and that the runway was just long enough for a fully fueled plane to be able to stop. And the hypothermia the captain undoubtedly experienced as he lay outside the aircraft may well have protected his brain from the lack of oxygen he also undoubtedly experienced.

We know this is not a healthcare incident. But we hope you can all see the common root causes, latent factors, cognitive biases, and other contributing factors seen in this case are often present in our serious healthcare incidents. If you have time, the long version is quite dramatic and worth watching. It’s just over 51 minutes but you’ll be impressed by it.

This case is also a reminder that accidents often follow maintenance activities. Many high profile industrial disasters (Three Mile Island, Chernobyl, Bhopal, Piper Alpha) and many airline disasters occurred during maintenance procedures. Our August 7, 2007 Patient Safety Tip of the Week “Role of Maintenance in Incidents” discussed the book “Managing Maintenance Error” by James Reason and Alan Hobbs. Maintenance may be a factor in some healthcare incidents as well. Our March 5, 2007 Patient Safety Tip of the Week “Disabled Alarms” described a near-miss in which tape placed over an oxygen blender alarm on a ventilator during maintenance resulted in lack of a warning when the ventilator became disconnected from it oxygen source while in use on a patient.