The Handover That Wasn't
During a heavy maintenance check, the day shift removes the fuel quantity indicating system connector in the left wing root to gain access to a wiring loom. The technician writes in the shift handover log: "FQIS connector off, do not power." He does not annotate the task card, does not attach a warning tag, and leaves before the incoming shift arrives. The night shift supervisor reads the log quickly at 22:15, assumes the connector has been reconnected because the access panel is closed, and authorises a fuel system functional test. Power is applied; the FQIS shows a fault and the test is aborted. No damage occurs, but the aircraft is delayed six hours.
1. Analyse the communication failures using a sender–message–receiver framework and identify which barrier failed.
Read the worked answer
- Sender: the day technician had the correct information but encoded it only in a free-text log entry, with no task-card annotation and no physical tag on the aircraft.
- Message: "FQIS connector off, do not power" is ambiguous about scope and status. It does not say which connector, whether it is still off, or who must reconnect it before power. It is also separated from the task card, the document the night shift actually works to.
- Channel: a handwritten log read at speed during a shift change – a low-fidelity channel for a high-consequence instruction.
- Receiver: the night supervisor read the log quickly and then applied an assumption (panel closed = connector restored) rather than verifying.
The primary barrier that failed is the handover barrier: there was no structured, two-way handover and no cross-check between the log, the task card and the physical state of the aircraft. The secondary failure is the receiver's assumption – treating a closed panel as evidence of completion, when panel closure proves nothing about connector status.
2. What handover practices would have prevented this event?
Read the worked answer
A combination of written, verbal and physical controls:
- Verbal face-to-face handover between outgoing and incoming technicians, with the incoming person repeating back the key status items.
- Task-card annotation – the removal should be recorded on the task card that the next shift will use, not only in a general log.
- Physical warning tag / "do not power" placard at the connector or circuit breaker, plus a corresponding entry in the power-control log.
- Status board or duplicate inspection record showing open items, so the supervisor authorising the test sees a list of outstanding work.
- A defined hold point before the fuel system functional test requiring confirmation that all connectors are restored.
The reasoning is that safety-critical handover information should be redundant across independent channels and should end with a confirmation step, so that a single missed document or a single wrong assumption cannot lead to an unsafe action.
3. Was this a violation or an error? Justify your classification, and state what should be reported.
Read the worked answer
It is better classified as an error – specifically a lapse in the handover process combined with a mistake by the supervisor – rather than a deliberate violation. The day technician intended to communicate the hazard and did write a warning; the failure was that the communication was incomplete and not placed where the next shift would use it. The supervisor did not choose to ignore a known prohibition; he formed a wrong belief from incomplete information.
However, there is a procedural non-compliance element: if the organisation's handover procedure requires task-card annotation or tagging, then omitting those steps is a deviation, and it should be recorded as such rather than smoothed over.
What should be reported:
- A near-miss / internal occurrence report describing the uncommanded power application to a disconnected FQIS connector.
- The local circumstances (handover timing, absence of tag, assumption made) so that the cause can be addressed.
- Any delay and test abort through the normal maintenance recording system.
The purpose is not to blame the individuals but to correct the handover and power-control barriers before the same sequence produces damage.