Jherrod ThomasThe Lion of Functional Safety™

May 16, 2026 · 15 min read

14 CFR Part 21AS9100D / AS9145ARP4761A

When the Skin Was Off by a Mil

A fuselage skin panel a few thousandths of an inch off drawing tolerance does not sound like the kind of defect that produces an emergency airworthiness directive, an inventory bulge of €5.2 billion, and a 30-airplane delivery cut. It became all of those things because the artifact that should have caught a single-supplier monoculture — the Particular Risks Analysis row, the receiving-inspection plan, the PPAP control plan — was either missing, not flowed down, or treated as a formality. The fix is a thickness map. The lesson is older than the panel.

The public story moves in two beats. On December 17, 2025, EASA issued PAD 25-196 covering the forward fuselage (Section 12) of A319, A320 and A321 family aircraft. On May 8, 2026, the FAA followed with Emergency Airworthiness Directive AD 2026-09-06 (Docket FAA-2026-3871), effective May 26, 2026, against the A319-153N, A320-251N / -252N / -271N and A321-251NX / -252NX / -271NX / -272NX configurations. By the time the FAA paperwork went out the door, Airbus had identified about 628 airframes in the inspection scope — roughly 177 in revenue service and 451 still in final assembly at Toulouse, Hamburg, Tianjin, and Mobile — and had quietly cut its 2025 delivery target by 30 aircraft to absorb the rework. (Federal Register — AD 2026-09-06; EASA PAD 25-196.)

The root cause traces to a single supplier: Sofitec Aero SL, a Carmona, Sevilla–based structures manufacturer that is one of only two production sources for the affected skin panels. During an internal quality review, Sofitec found that panels were exiting the stretching and milling line outside drawing tolerance — some too thin, some too thick. EASA's language is precise and worth quoting verbatim: "This condition, if not detected and corrected, in combination with certain repair conditions, could affect the structural integrity of the aeroplane." (Aircraft Insider — FAA Issues Emergency AD on A320neo Family; Flight Global — Panel quality issue centres on thickness deviations.)

That phrasing — in combination with certain repair conditions — is the part that should make any safety engineer pause. A nominal panel with an undersize starting thickness still meets the strength margin of the original design, because the design carries margin. The structure breaks when a future maintenance event eats into a margin that was already invisibly consumed at the plant. The defect is silent on day one. It is loud on day five thousand.

This is an aerospace story, so the lens is 14 CFR Part 21, AS9100D, AS9145, and ARP4761A — not ISO 26262. Class designations on commercial structure run through CS-25 / Part 25 strength and damage-tolerance regulations, not DAL letters; the safety analysis flows through the FHA → PSSA → SSA → CCA chain in ARP4761A. The failure mode, though, is one I write up every other week from automotive, medical, and industrial: a supplier escape that no upstream artifact was scoped to detect.

Let me put the rows in the table.

1. The public record

The chain of events as reconstructed from the filings:

Two facts deserve to be called out separately, because they reshape the engineering question. First, the affected skin lives in Section 12, the forward fuselage — a region that absorbs every pressurization cycle the aircraft will ever fly. Cyclic loading is unforgiving of any reduction in design margin; classical Paris-law crack growth is what regulators have in mind when they write the words "in combination with certain repair conditions." Second, Sofitec is one of only two suppliers producing these specific panels. That means the production line is, in effect, a single-source path for an entire structural assembly — the textbook setup for a Common Cause Analysis row that I would expect to see in any modern PSSA.

2. The standards lens

The failure is structural, but the root cause is a production-quality miss. The standards that should have caught it sit in three buckets.

Bucket A — The Production Approval Holder's quality system (14 CFR Part 21 Subpart G and AS9100D). Under 14 CFR §21.137, a Production Approval Holder is required to operate a quality system that includes (a) supplier control, (b) design data and changes, (c) manufacturing process controls, (d) inspecting and testing, and (e) nonconformance documentation and disposition. AS9100D is the industry's expression of that obligation; clause 8.4 ("Control of externally provided processes, products and services") is where supplier flowdown lives, and clauses 8.5 / 8.7 cover production process control and nonconforming product. AS9100D explicitly requires the PAH to verify externally provided product, to flow down product-safety and Key Characteristic requirements, and to retain authority over disposition of nonconforming material.

A panel arriving outside drawing tolerance and reaching final assembly means at least one of three things broke: the supplier's in-process SPC did not detect the drift, the receiving inspection at Airbus did not include the relevant thickness points, or the Key Characteristic flowdown never identified those points as KCs in the first place. The AD does not tell us which. AS9100D says all three are non-conformities.

Bucket B — Advance Product Quality Planning for aerospace (AS9145). AS9145 is the AESQ adaptation of automotive APQP to aerospace, and it bakes in a Production Part Approval Process (PPAP) with Key Characteristic identification, measurement system analysis (Gage R&R per AIAG MSA principles), and process capability studies that should demonstrate Cpk of at least 1.67 on every KC before production release. A stretched-and-milled panel whose final thickness is a Key Characteristic — and on a fuselage skin under pressurization cycles, it is — would, under a properly executed AS9145, have been gated by a capability study before serial production. Either Cpk dropped below the gate after Process Validation and no SPC trigger fired, or the KC was never declared. Either way, this is an AS9145 / PPAP failure.

Bucket C — The safety assessment process (ARP4761A). ARP4761A is the methods document underlying ARP4754A's aircraft systems development; it spells out FHA, PSSA, SSA, FTA, FMEA, and the Common Cause Analysis trio of Particular Risks Analysis (PRA), Zonal Safety Analysis (ZSA), and Common Mode Analysis (CMA). Structure is not a "system" in the avionics sense, but the principle transfers: any monoculture along the supply chain — single supplier, single material lot, single heat treat process — is a candidate for a PRA row.

The PRA row I want to see for the A320 fuselage skin reads roughly: "All Section 12 forward-fuselage panels are produced by one of two stretching-and-milling sources. A process drift at either source produces a coherent, fleet-wide reduction in design margin not visible from any single-aircraft inspection." That row would have been the gate for either a second-source qualification (eliminate the monoculture) or a 100% in-line gauging requirement (detect the drift before release). Neither happened, because the row was either never written, never reviewed, or written and accepted without a mitigation.

That is the artifact that was missing. Everything else flowed from it.

3. A worked snippet — FHA row, PRA row, FTA, FMEA

3a. FHA row (per ARP4761A and AC 25.1309-1B intent)

| ID | Function | Failure condition | Operational phase | Effect on airplane and occupants | Classification | Quantitative budget | |---|---|---|---|---|---|---| | FHA-STR-12-04 | Pressure-tight forward-fuselage skin in Section 12 | Skin panel installed below minimum allowable thickness, undetected at production, combined with a future patch repair concentration | All phases involving pressurized flight | Reduced structural margin against fatigue crack growth under cyclic pressurization; potential loss of pressure boundary integrity if margin consumed | Catastrophic | Probability budget of under 1.0E-9 per flight hour for the loss of pressure boundary contribution |

3b. PRA / CMA row (the row I want to find written down)

| ID | Hazard source | Coupling factor | Affected items | Result if uncontrolled | Mitigation | |---|---|---|---|---|---| | PRA-SUP-07 | Single-supplier monoculture for Section 12 skin panels (Sofitec, one of two sources) | Identical stretching-and-milling process, identical KC measurement program, common drawing release path | Entire A319 / A320 / A321 neo fleet built with Sofitec panels in the affected window | Fleet-wide reduction in design margin, invisible on any single-aircraft inspection | (a) Second-source qualification with independent process; (b) 100 percent in-line ultrasonic thickness gauging at supplier and at receiving; (c) trended SPC with PAH-side dashboard and Cpk gate at 1.67 |

3c. Fault tree (top event: in-service loss of pressure boundary on a panel that was below minimum allowable at delivery)

Top: Loss of pressure boundary, Section 12 skin, in service
        AND
        ├── A. Panel installed below minimum allowable thickness
        │       OR
        │       ├── A1. Stretching-and-milling process drift not caught by supplier SPC
        │       │       OR
        │       │       ├── A1a. Cpk monitoring absent or not gating release
        │       │       └── A1b. KC not declared on supplier drawing
        │       ├── A2. Receiving inspection did not include the affected thickness points
        │       └── A3. Engineering disposition accepted out-of-tolerance lot without
        │              quantified margin-loss analysis
        └── B. Latent margin consumed by a later event
                OR
                ├── B1. In-service repair patch concentration consumes remaining margin
                ├── B2. Fatigue crack growth accelerated by reduced thickness
                └── B3. Hard landing or pressure-cycle extreme not bounded by the
                        as-installed strength

3d. FMEA snippet (manufacturing process — supplier stretching and milling)

| Step | Failure mode | Failure effect | S | O | D | Action Priority | Recommended action | |---|---|---|---|---|---|---|---| | Stretch-form skin to panel contour | Over-stretch reduces local thickness below drawing minimum | Latent strength deficit invisible to visual inspection | 9 | 4 | 5 | High | Add in-line 100 percent ultrasonic thickness mapping at the post-stretch station; trend Cpk per shift; auto-quarantine any panel outside KC limits | | Mill panel pocket geometry | Tool wear drifts wall thickness above or below drawing | Same as above; either direction harmful for repair planning | 9 | 5 | 6 | High | Add tool-life tracking with mandatory replacement at the validated tool-life ceiling; ultrasonic re-verify post-mill | | Final inspection at supplier | Inspector misses thickness deviation under a partial-coverage sampling plan | Out-of-tolerance panel released to customer | 9 | 3 | 7 | High | Replace sampling plan with 100 percent KC coverage; require dual-witnessed certificate of conformity with measured value, not pass/fail | | Receiving inspection at PAH | KC not on the PAH inspection plan | No second look at the dimension that matters | 9 | 5 | 6 | High | Add a receiving-inspection requirement that mirrors the supplier KC plan; reconcile measured value to certificate value |

Action Priority is assigned using the AIAG-VDA 2019 lookup, not by multiplying S × O × D — and on a Severity 9 row with Detection above 4, the table puts you in the High band every time. That is, frankly, the correct answer here.

4. Derived requirements (excerpt)

These are five traceable requirements with stable IDs that, taken together, would have caught this in production rather than in a fleet emergency. They are written in the same shall-form style I use on flight-program statements of work.

These are not exotic requirements. Every one of them is already implicit in 14 CFR Part 21 Subpart G, AS9100D 8.4, AS9145, and ARP4761A. The lesson is not that the regulations need new clauses. The lesson is that the existing clauses need to be worked with the same rigor we apply to flight-control software and engine FADEC.

5. What the headline really tells us

The trade press has been calling this a quality issue and an Airbus production setback. Those framings are correct as far as they go, but they bury the engineering point. Read the AD again with one phrase emphasized: "in combination with certain repair conditions, could affect the structural integrity of the aeroplane." The defect is not, by itself, a structural failure. It is a loss of margin — a quiet erosion of the headroom the original certification baseline assumed was there. The same panel, installed and never repaired, may well fly its full design life uneventfully. The fleet is exposed because some of these panels will be patched, and when they are, the patch designer will be working from a thickness assumption that was never true.

That is what makes the missing artifact so consequential. A receiving-inspection requirement, a PRA row, a Cpk gate, an in-line ultrasonic thickness map — any one of these, written down and enforced, ends the story at the supplier door. None of them require a new standard. They require that the standards already in force be treated as engineering deliverables rather than checkbox audits.

If you build any aerospace primary structure on a small supplier base, the question is older than this AD: "Where in your AS9100D 8.4 flowdown, your AS9145 PPAP, and your ARP4761A Particular Risks Analysis is the row that proves you would catch a coherent, fleet-wide process drift at one of your tier suppliers?" If the answer is "we'd notice it in the field," that is the same answer that produced this AD.

I have run this kind of supplier-monoculture audit for OEMs and Tier-1s in automotive, medical devices, and industrial control. The artifacts look different across domains; the missing row looks exactly the same. If you want to walk through a worked PRA and a receiving-inspection plan for your own structural or safety-critical supplier base, the contact link on the main site is the fastest way to reach me.

— Jherrod Thomas, The Lion of Functional Safety™

Sources