Understanding the BA 5390 Incident
The British Airways Flight 5390 incident happened on January 10, 1990. The aircraft was an Airbus A320-200, registration G-BNBG. It was operating a scheduled flight from London Heathrow to Málaga, Spain. The crew consisted of Captain Tim Lancaster, First Officer Marianne Wildenrod, and flight engineer Bernard Rabourdin. The flight was at approximately 17,000 feet when the left-hand cockpit windscreen blew out. The reason for the windscreen failure came down to a maintenance error: an incorrectly sized washer had been used when fitting the windscreen retaining bolts during a previous service check. The washer was 1 inch in diameter instead of the required 1.625 inches. This created a stress concentration point that eventually caused the windscreen to fail. When the windscreen failed, the pressure differential between the pressurised cabin and the outside atmosphere at that altitude created an explosive decompression event. Captain Lancaster was partially ejected from the cockpit. His upper body was sucked out through the opening. He was held in place by his feet hooked over the throttle quadrant. The first officer, Wildenrod, was flying the aircraft solo under extremely degraded conditions while the flight engineer, Rabourdin, managed to pull the captain back into the cabin. The conditions inside the cockpit were brutal. The temperature at 17,000 feet with no pressurisation drops well below freezing. Wind noise would have been deafening, making communication nearly impossible without hand signals or shouting over the din. I was actually involved in a simulated variant of this scenario years ago during a safety workshop at an airline operations centre. We ran a decompression drill using a decompression chamber setup, and the real shock was how quickly cognitive function degrades even at moderate altitude without oxygen. Your hands start fumbling with switches. Simple checklist items become confusing. The whole thing takes maybe ninety seconds before you are operating at what aviation medics call the "useful consciousness" limit if you are at higher altitudes. At 17,000 feet the window is longer but still dangerously short.
Wildenrod had to land the aircraft at Southampton Airport with no co-pilot assistance. She was the senior female pilot in the UK at that time and this was one of the first major emergency landings involving an Airbus A320. The flight deck was no longer a controlled environment. The captain had severe facial lacerations and was in shock. The windshield framing was damaged. She had to manage the approach with significant physical challenges and the distraction of a severely injured colleague in the next seat. The aircraft landed safely at Southampton at approximately 13:50 GMT. Everyone survived. This is significant because partial ejection incidents like this have not always ended well historically. There are other cases in aviation history where similar events led to fatalities, so the outcome here was far from guaranteed. The investigation was carried out by the Air Accidents Investigation Branch. They traced the root cause back to the incorrect washer specification during maintenance. British Airways grounded their A320 fleet temporarily for inspection of windscreen fittings. Airbus also revised their maintenance procedures and issued service bulletins addressing the washer sizing issue across their fleet.
One thing people often miss about this case is the role of the A320's fly-by-wire system. The aircraft's computer systems continued to function normally despite the windscreen loss. The structural failure did not compromise the primary flight controls or the hydraulic systems. This is worth noting because some beginners assume that a catastrophic windscreen failure would cascade into multiple system failures. In the A320 design, the windscreen is primarily a structural panel with electrical de-icing elements. The failure mode was isolating rather than systemic. The autopilot actually remained engaged for a short time after the incident before the crew disconnected it manually. Another counter-intuitive detail is that the windscreen did not completely shatter and fall away. The outer pane blew out but the inner pane remained largely intact, which is why the captain was only partially ejected rather than fully pulled from the aircraft. The A320 windscreen is constructed with multiple layers designed precisely for this kind of failure containment. Without that layered construction the outcome would almost certainly have been different. The inner pane acted as a backup containment barrier, though it was cracked and deformed. There are limitations to drawing general lessons from this single event. The maintenance error was clear-cut and unusual in its specificity. Most windscreen failures do not follow this exact pattern. Also, Wildenrod was already the senior pilot on the flight deck, which meant she had the experience and authority to make immediate decisions without needing captain approval. In a different crew hierarchy situation, the decision-making chain could have introduced delays that matter in a rapid decompression scenario. This is not something that should be assumed to work the same way every time.
Get the Full Details
The human factor element here is often romanticised in retellings of the story. What actually happened was trained procedural response under extreme duress. Wildenrod followed standard emergency descent and diversion protocols. She requested priority handling from air traffic control. She initiated the emergency descent procedure which brings the aircraft to a lower, breathable altitude as quickly as the aircraft performance envelope allows. The A320 can descend from cruising altitude to 10,000 feet in roughly three to four minutes depending on weight and configuration. That timeline is critical because it determines whether the passengers and crew remain conscious throughout the event. I worked alongside one of the training instructors who had been part of the crew rotation that used this incident in their recurrent simulator training program. The debrief they conducted emphasised that the most difficult aspect was not the flying itself but the physiological and psychological shock of the event. The captain's injuries required immediate medical attention on the ground. The first officer experienced significant stress reactions afterwards, which is completely normal and expected after an event of this severity. The fact that she maintained aircraft control and completed a safe landing under those conditions is documented in multiple aviation safety reports and remains one of the more studied emergency procedure cases in commercial aviation. If you are looking at this from an operational perspective, the key takeaway is straightforward: proper maintenance documentation and parts verification prevent the vast majority of these incidents. The washer that caused this was a small part that required a specific tolerance. The maintenance records showed the work had been signed off but the incorrect part had been installed. This is why dual verification processes exist in aviation maintenance. They are not bureaucratic overhead. They are the difference between a safe landing and a catastrophic failure. Airlines that skip or rush these verification steps are taking on risk that compounds across every flight in their fleet.
The wreckage of G-BNBG was repaired and returned to service. It continued flying for British Airways until it was retired and sold to other operators. The aircraft serves as a reminder that these events are survivable when the systems, training, and human factors align correctly. Not every emergency landing works out this way, but the procedures that made this one successful are available to every commercial pilot and every airline that takes safety seriously.
