On the 10th of June 1990, a mid-air drama unfolded in the skies over England after an explosive decompression rocked British Airways flight 5390. As the plane climbed toward cruising altitude on a flight to Málaga, the cockpit windscreen suddenly blew out, sucking the captain partially out of the plane. While the flight attendants held onto his legs for dear life, the sole remaining pilot lined up for a harrowing emergency landing in Southampton, working alone under enormous pressure to save the lives of his 81 passengers. Investigators would find that the sequence of events aboard flight 5390 was made possible by a maintenance culture that valued “getting the job done” over doing the job properly. In the process they would uncover much useful information about human behavior in aviation maintenance, including findings which led to an overhaul of training and certification regulations in the United Kingdom.

The unbelievable story of flight 5390 began a couple days before the flight, in a British Airways maintenance facility in Birmingham at 3:00 in the morning. One of the planes in for service that night was a British Aerospace BAC-111, pictured above. Among the items on the long list of work orders for this aircraft was a new captain’s side windscreen. The shift maintenance manager, who was responsible for overseeing and inspecting all the work done on the aircraft, decided that he would replace the windscreen himself. He hadn’t replaced a windscreen in several years, but he figured he knew how to do it well enough, and never looked up the procedure in the BAC-111 maintenance manual.

The shift manager used a lift to reach the cockpit and began removing the bolts securing the captain’s side windscreen. Noticing that many of them showed signs of corrosion, he decided that he would need to replace the bolts as well as the windscreen. After removing all 90 bolts, he correctly identified them as type A211-7D. However, if he had read the manual, he would have known that the windscreen was normally secured with the similar type A211-8D bolts, which had the same diameter but were about a quarter of a centimeter longer. Whoever replaced the windscreen last time had used the wrong kind. The shift manager then went to the on-site storeroom to find more A211-7D bolts. The store supervisor commented that they normally use A211-8D bolts on BAC-111 windscreens, but the shift manager apparently disregarded this. However, when he found the correct container, he discovered that there were only four bolts inside, far less than the required minimum stock of 50. If he wanted A211-7D bolts, he would have to look elsewhere.

In search of a match for the bolts, the shift manager went to a self-service parts carousel in another part of the facility. But the labels on the containers were badly worn, the light was dim, and he didn’t have his glasses. He figured he could find some A211-7D bolts by visually comparing them with the old ones until he found a match. After searching for some minutes, he found what he thought was the right kind of bolt and took 84 of them, keeping six of the originals that were in decent condition. Unfortunately, the shift manager’s eye was not as good as he thought it was. The bolts he grabbed were actually A211-8C bolts, which were the correct length but were 0.066cm too narrow. Without realizing his mistake, he took these bolts back to the plane and began installing them on the captain’s side windshield. The thread spacing was the same as the correct bolts, so they fit into the holes. Although the bolts occasionally slipped, he was working at an awkward angle from which he couldn’t distinguish this slipping from the normal slipping of the clutch of the electric screwdriver. After screwing in all 90 bolts, he climbed back down and called it a day. He didn’t notice that the new bolts descended too far into the holes, exactly the sort of thing that a second set of eyes might have noticed—but as the shift manager, he normally was that second set of eyes. Nor did anyone else need to inspect the work, because the windscreen was not considered a “vital point” that needed additional oversight. The shift manager went home later that morning and the next shift was left none the wiser. The following day, the shift manager had one last chance to realize his mistake when he witnessed another mechanic replace a different windscreen using A211-8D bolts. But, still believing he had put in A211-7D bolts, he assumed this was just natural variance between different BAC-111s made at different times. After all, the bolts he took off had held the windscreen in place for four years. Still unaware of his potentially catastrophic error, he took no action, and the BAC-111 was returned to service for its next journey—flight 5390 from Birmingham to Málaga, Spain.

81 passengers and 6 crew boarded the flight on the morning of the 10th of June 1990, including the two pilots, Captain Tim Lancaster and First Officer Alistair Atchison. As flight 5390 climbed out of Birmingham, at first all was normal. Approaching 17,000 feet, the flight attendants began drinks service; the pilots undid their seat belts and ordered breakfast. It would never arrive. Moments later, as the plane climbed through 17,300 feet, the pressure differential between the cockpit and the outside air grew to the point that the improperly installed captain’s side windscreen could no longer hold. The air pressure blasted the captain’s windscreen, bolts and all, straight off the plane and out into space. An explosive decompression immediately rocked the plane, the violent pressure equalization ripping away every loose object and sending the debris hurtling into the cockpit. The decompression sucked Captain Lancaster upward and outward, pulling him half way out of the cockpit before his feet became entangled in the control column. The explosion also ripped the cockpit door off its hinges and slammed it forward into the centre console, blocking the throttle levers. With Captain Lancaster’s feet pushing against the yoke, the autopilot disconnected and the plane pitched down into a dive.

Within seconds of the explosion, flight attendant Nigel Ogden caught sight of the situation in the cockpit and ran to Atchison’s aid. He rushed in and grabbed Captain Lancaster’s waist just in time to stop him going all the way out, holding on for dear life as the air continued to rush out of the plane. Moments later, the pressure equalized and the wind came roaring back in the other way, pinning Captain Lancaster backwards across the top of the fuselage and creating a tornado of loose debris inside the cockpit. The plane was rapidly losing altitude and Atchison couldn’t reach the throttle levers. He frantically issued a mayday call, but over the sound of the wind he couldn’t tell if the controllers heard him. As flight 5390 plunged out of control through some of the busiest airspace in Britain, two more flight attendants, Simon Rogers and John Heward, fought their way into the cockpit. Heward stamped on the cockpit door, breaking it in half and freeing the throttles, then stepped in alongside Ogden and grasped Captain Lancaster’s legs. By now Ogden was suffering from frostbite and his arms felt as though they would pop out of their sockets. Unable to hold on any longer, he stepped back and let Rogers and Heward take over. The two men untangled Lancaster’s legs from the control column and placed them over the back of the captain’s seat, holding him more firmly in place and helping Atchison recover control of the plane. Still making desperate mayday calls, he continued the descent in a more controlled manner in order to reach breathable air and steer clear of other planes. Upon reaching a lower altitude, Atchison started to slow down and level out. As he did so, Captain Lancaster’s body slid down around the left side of the cockpit, leaving his bloodied and battered face plastered against the window. Rogers sat in the jumpseat, still holding onto his legs. But one look through the window at Lancaster told them he was probably already gone. His eyes were wide open, totally unblinking, and his skin was going grey. Someone suggested that they let go of his body. Ogden shot down the suggestion on principle, and Atchison agreed, pointing out that his body could strike the wings or the engines, damaging the plane. And so they continued to hold on for dear life. Ogden left the cockpit to recover from his encounter with freezing 560-kph winds and sat down with flight attendant Sue Prince, who had been tending to the terrified passengers. “I think the captain’s dead,” he told her.

With the plane slowed to a reasonable speed, the wind noise reduced enough for First Officer Atchison to talk to air traffic control. The controller suggested an emergency landing in Southampton, the closest available airport. This put Atchison in a tough position: he wasn’t familiar with Southampton, he was flying a two-pilot jet by himself in an emergency, and all his charts and checklists had been sucked out of the plane. At first he requested to land at Gatwick instead, but quickly settled on Southampton, a decision he felt compelled to make by the severity of the situation. He switched to the frequency for Southampton Airport and appraised the disbelieving controller of the situation: there had been an explosive decompression, and the captain was stuck half outside the plane! Relying on the guidance of the controller, with no charts and no captain to help him, Alistair Atchison guided flight 5390 down to a safe and controlled landing at Southampton, much to the relief of the passengers, whose lives had flashed before their eyes only minutes earlier. All 81 passengers disembarked without a single injury, while ambulances rushed to the aid of the beleaguered crew. Paramedics found Ogden, Rogers, Heward, and Atchison suffering from minor injuries ranging from frostbite to shock to a dislocated shoulder. There was little hope for Captain Lancaster, who had been pinned to outside of the plane amid 600kph winds and temperatures as low as -17˚C. But, as paramedics removed his body from the plane, he started to show signs of life. Within a few minutes, he had opened his eyes, regained consciousness, and appeared to be recovering! Reportedly, the first thing he said after coming round was, “I want to eat.” In what can only be considered a medical miracle, Tim Lancaster suffered little more than frostbite, bruising, and a few relatively minor bone fractures. After being released from the hospital and taking time to recuperate from his ordeal, Captain Lancaster returned to flying jets for British Airways only 5 months after the accident.

Meanwhile, an investigation by the United Kingdom’s Air Accidents Investigation Branch (AAIB) worked to uncover the cause of the near-disaster. Investigators managed to find the windscreen with some of the bolts still attached. They were shocked to discover that the bolts were too narrow and had simply pulled right out of the holes. The shift maintenance manager who replaced the window had a supposedly glowing safety record, including several official commendations for the quality of his work. In trying to figure out how he could have made such a basic error, the AAIB found that his supposed proficiency belied several problematic habits. He was so confident in his ability that he didn’t take extra effort to ensure that he was maintaining aircraft by the book, and in fact he stated that it was perfectly normal to use one’s own judgment rather than referring to official guidance materials. His small errors slipped under the radar of quality assurance inspections because the chances of any of those mistakes manifesting visibly on the aircraft were very low; inspectors would have had to observe him actually doing the work to see the problems. His commendations, as it turned out, were less a result of doing the work properly and more a recognition of his ability to keep aircraft on schedule.

This problem extended far beyond this one individual, who was merely a symptom. The entire Birmingham maintenance facility, and perhaps British Airways more broadly, had a singular focus on “getting the job done.” If doing the work by the book took longer and jeopardized schedules, then doing the work by the book was discouraged. The shift manager who used the wrong bolts stated in an interview that if he sought out the instructions or used the official parts catalogue on every task, then he would never “get the job done,” as though this was a totally normal and reasonable attitude with which to approach aircraft maintenance. This attitude was in fact normalized on a high level by supervisors who rewarded the employees who most consistently kept planes on schedule. That a serious incident would result from such a culture was inevitable. The shift manager believed it to be reasonable to just “put on whatever bolts came off” and make a quick judgment call about what kind of bolts they were—not because he was personally deficient, but because he had been trained into a culture that didn’t consider this a flagrant safety violation.

As a result of these troubling findings, the accident report recommended sweeping reviews of quality assurance at British Airways, including whether it was appropriate for shift managers to self-certify their own work, whether their “vital points” list was incomplete, and other shortcomings that had been identified ranging from job descriptions to engineer training to product standards. It also recommended that maintenance engineers in the United Kingdom receive periodic retraining, just like pilots. It was this recommendation that proved the most critical: today, maintenance engineers are indeed recertified every few years, ensuring that any unsafe habits they develop are noticed and rectified whenever they renew their license. In a strange follow-up to flight 5390 that came almost 28 years later, an almost identical incident took place aboard a Sichuan Airlines flight in May 2018. While flying over China, the first officer’s windscreen blew off the Airbus A319 at 32,000 feet, partially sucking the first officer out of the plane before he managed to pull himself back inside. Captain Liu Chuanjian went on to make a safe emergency landing in Chengdu, with his first officer suffering only minor injuries. For the first officer, the difference between life and death may have been his seat belt. One can only imagine that Tim Lancaster, despite his positive attitude regarding his near-death experience, is now a little more careful about keeping it fastened.