The Latches Nobody Checked — Fire Over Heathrow

During overnight checks, two technicians opened the fan cowl doors on both engines of an A319 to inspect the IDG oil levels, found both IDGs low, and lowered the doors onto their hold-open devices — unlatched — intending to return with an oil gun. No warning notice went in the cockpit, no open entry went in the technical log for the low oil. Hours later they drove back, but to the wrong stand: an identical-looking A321. They did not check the registration. Finding that aircraft's cowls latched and its IDG oil full, they rationalized both surprises, latched what they had opened, and signed off G-EUOE's Weekly Check. The real G-EUOE flew the next morning with all eight latches disengaged — a condition neither the tug driver's inspection nor the co-pilot's walk-around caught. At rotation all four fan cowl doors tore off, striking slats, fuselage, landing gear and pylons; on the return approach, fuel leaking from a damaged fuel pipe on the right engine ignited. The crew shut the engine down, landed, and evacuated all 80 occupants by slide.

The AAIB found two causal factors: the technicians' non-compliance with the AMM procedures that left the doors unlatched, and the failure of both pre-departure inspections to detect it (AAIB AAR 1/2015 §3b). Behind them sat fatigue — the investigation's first Safety Recommendation demanded a fatigue risk management system for Part-145 organisations — plus an interrupted task with no log entry to protect it, and an aircraft-swap error that turned a deferred job into a signed-off one. It is the definitive card for task interruption, work resumption discipline, and the limits of the walk-around as a safety net.

1. Follow the AMM opening procedure to the letter — including the cockpit warning notice that tells the next person the cowls are open.
2. An interrupted task gets an open technical log entry the moment it is deferred; an unrecorded open job does not exist for anyone else.
3. On returning to a job, positively identify the aircraft by registration before touching it — never by stand, silhouette or habit.
4. Close-up means latching every latch and verifying each one — and anomalies that "must have been someone else" are stop signs, not reassurance.
5. The walk-around checks fan cowl latches deliberately: crouch to see them — flush doors with latches hanging low are exactly what an unlatched cowl looks like.

Between 2002 and 2013 the A320-family fleet suffered fan cowl door losses at about one event per 2.42 million flight cycles — roughly half the 1992–2002 rate, but persisting after two rounds of airworthiness action (AAIB AAR 1/2015 §1.18.2).

All four fan cowl doors detached at rotation, damaging slats, wing skin, fuselage, the left main gear's brake pipe and both engine pylons; the right pylon primary structure was severely buckled. On final approach a damaged fuel pipe on the right engine fed an external fire; the engine was shut down, the aircraft landed on Runway 27R and stopped, the fire was extinguished, and all occupants evacuated by the left-side slides without serious injury (AAIB AAR 1/2015 Summary, §1.1.9, §1.2, §1.3).