The captain of British Airways Flight 5390 was sucked partially out of the aircraft through the forward windscreen at 23,000 feet and held there — by cabin air pressure and by cabin crew grasping his legs — for twenty-two minutes at 300 knots and minus seventeen degrees Celsius. The first officer declared an emergency, made an emergency descent, and landed safely at Southampton Airport. Captain Tim Lancaster survived.
The windscreen had separated because the maintenance engineer who replaced it the previous night had selected bolts from the stores by eye — assessing them as correct — and had installed eighty-four of the ninety bolts one size too small. The difference was 0.026 inches in diameter. It was invisible to the unaided eye. No measurement was required. No independent check confirmed the part number. The documentation said complete. The bolts were wrong.
BA 5390 is the proof that a maintenance error invisible to the human eye — a bolt diameter difference of 0.026 inches — can put a captain half-out of an aircraft at 300 knots. The only protection against this error was independent measurement. The system did not require it.
Date | 10 June 1990 |
Flight | BA 5390 |
Aircraft | BAC One-Eleven 528FL |
Operator | British Airways |
Fatalities | 0 — all 87 on board survived |
Category | Maintenance Error / Windscreen / Explosive Decompression / Quality Assurance |
Location | Near Oxford, England |
The Event
- The night before the accident, a maintenance engineer replaces the forward left windscreen on the BAC-111
- He selects bolts from the stores, visually assessing them as correct — he does not check the part number
- 84 of the 90 bolts installed are one size too small in diameter
- The shift supervisor does not conduct an adequate independent verification
- BA 5390 departs Birmingham; 13 minutes later, at 23,000 feet, the windscreen separates
- Captain Tim Lancaster is partially ejected through the opening
- First Officer Alistair Atchison takes control; cabin crew hold Lancaster by his legs
- Emergency descent; priority landing at Southampton
- Lancaster is held outside the aircraft for 22 minutes in -17°C temperatures at 300 knots
- The aircraft lands safely; Lancaster survives with fractures, frostbite, and soft tissue injuries
Flight attendant Nigel Ogden held Captain Lancaster’s legs for most of the emergency. He sustained a dislocated shoulder. Lancaster’s survival against the physical forces he experienced was, by any clinical assessment, improbable.
Systems Engineering Perspective
From a systems engineering perspective, BA 5390 is a maintenance quality assurance failure in which two independent verification layers — part number confirmation and independent sign-off — both failed to detect a safety-critical error on the same maintenance task, performed in the early hours of the morning under schedule pressure.
Two independent verification layers failed on one maintenance task. The failure was not improbable — it was predictable. Both layers relied on visual assessment by time-pressured humans in a low-lighting environment. Neither required measurement.
Part Number Verification Without Measurement
The maintenance engineer selected the windscreen retaining bolts from the stores by visual assessment — judging them to be the correct part by appearance. The correct bolt was part number SP(LH)113-2. The bolts installed were SP(LH)113-1C — identical in appearance, 0.026 inches smaller in shank diameter.
The quality assurance process did not require the engineer to read the part number from the specification and compare it to the part number on the stores label. It did not require measurement. It required visual assessment. Visual assessment of a 0.026-inch dimensional difference is impossible.
Part number verification by visual assessment of a 0.026-inch difference is not verification. It is an assumption with documented consequences.
Independent Sign-Off — Form Without Function
A shift supervisor was required to conduct an independent check of the completed windscreen installation before the aircraft was released to service. This check was performed. It did not detect the incorrect bolts.
The investigation found that the supervisor’s check was insufficient — not verifying the part numbers against the maintenance manual specification, and not identifying the non-conforming installation. The independent check existed as a procedural requirement but did not function as an independent safety verification. The form of the check was present; the function was absent.
An independent check that uses the same method as the original installation — visual assessment without measurement — is not independent. It is a second visual assessment, equally blind to the same error.
Night Shift, Time Pressure, and Error Vulnerability
The windscreen replacement was performed overnight, under time pressure to have the aircraft ready for the morning’s operations. Research into maintenance error consistently identifies night shifts, time pressure, and end-of-shift handovers as conditions associated with elevated error rates. All three were present on this task.
The maintenance quality assurance system had not structured the highest-risk tasks with verification requirements that compensated for the elevated error risk of these conditions.
Human Factors Perspective
The human factors analysis of BA 5390 is a study in maintenance error-shaping conditions — the environmental and organisational factors that make errors more likely — and in the failure of verification systems to compensate for them.
Error-Shaping Conditions
Night shift work, time pressure, and the inherent monotony of routine fastener selection are three of the most well-documented error-shaping conditions in maintenance human factors. Their simultaneous presence on the windscreen replacement task made an error significantly more likely than it would have been in daytime, unhurried conditions. The verification system was designed as if these conditions did not exist.
Verification systems must be designed for the conditions in which maintenance is actually performed — not for the ideal conditions in which it might be performed.
The Independent Check That Wasn’t
The supervisor’s check provided procedural compliance — the paperwork was completed. It did not provide functional independence — the check could not detect the error that was present. When independent checks are functionally identical to the original installation, they provide false confidence, not genuine verification.
The Crew Response — Holding the Captain
Flight attendant Nigel Ogden’s decision to grasp the captain’s legs, and his maintenance of that grip for the duration of the emergency, is one of aviation’s most remarkable examples of crew response under extreme conditions. That it succeeded is testimony to human endurance. That it was the final layer of defence between the captain and the sea is testimony to how far the system had already failed before the windscreen separated.
System Interaction Breakdown
1. Visual Selection of Safety-Critical Fasteners
A 0.026-inch diameter difference is visually imperceptible. The selection process required visual assessment of an imperceptible difference. The error was structurally invisible to the available verification method.
2. Independent Check Using Same Method
Both the installation and the independent check used visual assessment. Neither could detect the error. The independence was procedural, not substantive.
3. Night Shift Conditions Without Enhanced Procedures
The error-shaping conditions of night shift and time pressure were not compensated for by enhanced verification requirements.
Significance in Aviation Risk
1. Measurement-Based Fastener Verification
Following BA 5390, part number verification for safety-critical fasteners — particularly windscreen retaining bolts — was required to be measurement-based and reference the approved maintenance manual specification, not visual assessment.
2. Independent Check Genuinely Independent
Independent sign-off requirements were revised to require that the independent check use a different verification method from the original installation — ensuring genuine independence rather than procedural compliance.
3. Maintenance Human Factors Training
BA 5390 became a foundational case study in aviation maintenance human factors (MHF) training — demonstrating how error-shaping conditions, combined with inadequate verification design, produce safety-critical errors on routine tasks.
Related Aviation Risk Lab Content
Pillar Pages
Maintenance and Airworthiness: Maintenance And Airworthiness
Human Factors: Human Factors
Systems Engineering: Systems Engineering
Related Case Studies
Case Study 7: Aloha Airlines 243 — The Fuselage That Flew Apart: Aloha 243
Case Study 19: Alaska Airlines 261 — The Jackscrew: Alaska 261
Case Study 28: Helios 522 — The Switch Left in the Wrong Position: Helios 522
Closing Perspective
BA 5390 survived because a flight attendant held a captain’s legs for twenty-two minutes at 300 knots in sub-zero temperatures. That is the last-resort defence that the maintenance system had left available when every designed safety layer had failed.
The windscreen bolts were wrong. The independent check missed it. The captain nearly died. The investigation found that the wrong bolts had been selected using a verification method that was physically incapable of detecting the error.
The lesson is simple and old: safety-critical measurements must be measured. Visual assessment of dimensional differences below the resolution of human vision is not verification. It is optimism. BA 5390 is the case that made measurement-based verification a requirement — and that demonstrated the cost of not requiring it.
BA 5390 is the case that put measurement-based fastener verification in the maintenance manual. The cost of not measuring a bolt diameter difference of 0.026 inches was a captain half out of an aircraft at 300 knots.
Related Posts
