Safety Alert: The Human Component in a Mechanical System
1. The Human Component in a
Mechanical System
1
Kristi Dunks
Senior Air Safety Investigator
2. Overview
• The NTSB
• General aviation safety
• Identifying risks/hazards
• Case studies
2
3. Who is the NTSB?
• Promotes transportation safety
• Investigate for probable cause
• Issue safety recommendations
• Promotes safety improvements
• Multi-modal:
Aviation, highway, marine, railroad, pip
eline, HAZMAT
• Small federal agency
4. General Aviation Safety
• 1,466 GA accidents in 2011
• 271 fatal accidents resulting in 457
fatalities
• NTSB working with FAA, AOPA, EAA,
and others to improve GA accident rate
8. • What do you need to know?
• What skills are necessary?
• Steps to perform a task
• Sequence of actions
• Communication requirements
• Information requirements
• Inspection requirements
• Certification requirements
Actions
9. • Technical documentation systems
• Test equipment
• Enough time
• Enough people
• Lifts, ladders, stands, seats
• Materials
• Portable lighting, heating, cooling
• Training
Resources
11. History of Flight
• Buchanan
Field, Concord, California, to Renton
Municipal Airport, Renton, Washington
• Departed at 1540
• Accident occurred at 1910
12. History of Flight
• 1906:51 pilot transmitted
“Mayday, Mayday, Cirrus N4GS”
• “I’m west of Strom airport, trying to
make the field.”
• Wreckage located 2.5 west-northwest
of Strom Field Airport
17. Cirrus Airframe Parachute System
• Rocket motor and deployment bag remained
connected to parachute
• Activation handle found seated in the handle
holder
• Enclosure cover found 15 feet from
wreckage
• Consistent with activation due to impact
forces
18.
19.
20. Engine Examination
• Examined at Teledyne Continental
• Engine test run
• Fitting cap installed finger tight
• Engine operated normally
28. Maintenance Personnel Interviews
• Three mechanics worked on airplane, two
IAs and one A&P
• Another Cirrus SR22 in facility
• Rushed to complete work
• Performed fuel pressure check
• Final checklist items incomplete
29. Findings
• Engine lost power during cruise
• Fitting cap for throttle and metering
assembly inlet found uninstalled
• Engine operated normally following accident
• Maintenance was performed that required
cap to be removed
• If cap had been properly torqued it would
have remained secure
30. Findings
• Director of Maintenance signed off annual
inspection on work order
• Assigned IA indicated he had not completed
the annual inspection
• Maintenance records incomplete
• If final checks completed, cap would have
likely been identified
33. Initial Information
• Sightseeing tour from Las Vegas
to Hoover Dam
• Normal departure - VFR
• Calm wind, good visibility
• Standardized route
33
34. Flight Path
Las Vegas Airport
To Hoover Dam
Accident site
Sudden climb and turn
Path approximate
and not to scale, for
visualization only
Flightpath
Tour route
Flightpath
35. Sequence of Events
35
Hoover Dam
Sudden climb and turn
3100
feet, 90° off
course
Path approximate
and not to scale, for
visualization only
Steep descent and
crash site
45. Hardware Reuse
• Fleet inspection of 13 helicopters, half
of nuts did not meet requirements
• Manufacturer’s guidance: “If a nut can
be easily tightened, it is to be
discarded”
• FAA guidance: “DO NOT reuse a fiber
or nylon lock nut if the nut cannot meet
the minimum prevailing torque values”
45
46. Bolt Loss Scenario
46
• Two locking devices
• Self-locking nut
• Split pin
• Self-locking nut most likely became
separated from bolt
47. Postmaintenance Inspection and
Check Flight
• Mechanic and inspector
completed inspection
• Helicopter check flight conducted
• Hydraulic belt tension
• No flight discrepancies
47
48. Maintenance Errors
• Improper securing of the fore/aft
servo
• Improper tension of the hydraulic
belt
• Incomplete maintenance inspection
48
51. Maintenance Personnel Fatigue
51
Personnel Normal Shift
Shift
Originally
Scheduled for
December 6
Actual Schedule
on December 6
Mechanic Noon to 11:00 pm Off duty 5:50 am to 6:46 pm
Inspector Noon to 11:00 pm Off duty 5:31 am to 6:55 pm
52. Maintenance Personnel Fatigue
• Effects of fatigue
• Difficulty sustaining attention
• Memory errors
• Lapses in performance
52
53. Human Factors Training
• Causes of fatigue, its effects, and
countermeasures
• Fatigue education as part of a
training curriculum
• No human factors training
requirement in United States
53
54. Work Cards With Delineated Steps
54
• Paperwork for 100-hour inspection
• Inspector signoff for overall fore/aft
servo installation
• No specific signoffs for critical
steps within task
58. GA Maintenance Alert
• Independent inspections of work
• Safety and security of
components disconnected
• Look for the obvious; if there is a
castellated nut, there is generally
an associated cotter pin
58
59. GA Maintenance Alert
• Review and adhere to guidance
regarding self-locking nuts
• When a component or system is
in the work process, mark it
• Cell phone policies
59
60. GA Maintenance Alert
• Turnover briefings
• Pilot check flights/review are last
opportunity to detect potential
safety hazards
• Review FAA HF guidance and
“Personal Minimums” Checklist
60
61. Safety recommendations
• Duty time limitations for
maintenance personnel
• Work cards for maintenance tasks
• Human factors training for
maintenance personnel
• Review issue of human fatigue in
aviation maintenance
61
63. • Pilot recently purchased airplane
• Lost oil pressure during flight and
landed in a field
• Post accident examination showed
that the main crankshaft seal was
extruded and oil had been pumped
out during the flight
• Breather tube modified to drain oil
and moisture away from airplane
Overview
64.
65. • Moisture is expelled from the engine crankcase
through the breather tube which often extends
through the bottom of the engine cowling into the
air stream
• This moisture may freeze and continue a buildup
of ice until the tube is completely blocked
• To prevent freeze-up, the breather tube may be
insulated, it may be designed so the end is
located in a hot area, it may be equipped with an
electric heater, or it may incorporate a hole, notch
or slot which is often called a "whistle slot"
Whistle Slot Guidance- Lycoming
Flyer
66. • The operator of any aircraft should know which
method is used for preventing freezing of the
breather tube, and should insure that the
configuration is maintained as specified by the
airframe manufacturer
• Because of its simplicity, the "whistle slot" is often
used, and a notch or hole in the tube is located in
a warm area near the engine where freezing is
extremely unlikely
• When a breather tube with whistle slot is
changed, the new tube must be of the same
design
Whistle Slot Guidance- Lycoming
Flyer
69. • The run up was without incident and the pilot
noted that the RPMs dropped slower than normal
when he cycled the propeller
• During climb out, he noticed that the engine
RPMs climbed to 2,800 so he leveled off his climb
and pulled the propeller control back with no
reduction in RPM noted
• Attempted to cycle the propeller twice but noticed
no change in RPMs
• Decided to return to the departure airport and
then he heard and felt a thump forward of the
cockpit
• Engine continued to run smoothly, while
developing adequate power, and the pilot landed
uneventfully
Overview
70. Engine examination
• Post incident engine examination showed
a blister in the engine casing and
fragments of metal in the oil
• Engine then disassembled and ball
bearings from the propeller governor were
located in the engine
• Further disassembly of the engine
identified one ball bearing within the oil
sump, as well as damage to the case and
two camshaft lifters
• The ball bearings from the governor were
able to pass through the oil drain hole of
the governor
72. • Follow up examinations of the propeller
governor showed that the governor bearing race
and plunger were assembled with the bearing
race set screw and plunger hole misaligned
• When the bearing race set screw was torqued
down, the set screw tip flattened against the
harder plunger surface
• During operation, the set screw/plunger race
separated
Governor examinations
73.
74. • Review of the governor manufacturer’s
reports showed two service difficulty
reports (SDRs) had been reported for
similar events
• The two events, as well as the governor
assembly from the accident, were from a
single batch of 74 assemblies
Service difficulty reports
76. • As a result of this incident, the governor
manufacturer issued a mandatory service
bulletin (SB) DES-353, on December 18, 2008,
for the affected assemblies. The SB required
that the units be returned to Ontic for inspection
and, if necessary, repair.
• The FAA issued an Airworthiness Directive
requiring examination of the affected
assemblies.
77.
78. Probable Cause
The failure of maintenance personnel to
properly secure a fitting cap on the throttle
and metering assembly inlet after
conducting a fuel system pressure check,
which resulted in a loss of engine power due
to fuel starvation.
79. Contributing Factor
Contributing to the accident was the decision
by the Director of Maintenance to return the
airplane to service without verifying with the
assigned inspector that all annual inspection
items had been completed.
80. Probable cause
• Sundance Helicopters’ inadequate maintenance
of the helicopter, 8 including (1) the improper
reuse of a degraded self-locking nut, (2) the
improper or lack of installation of a split pin, and
(3) inadequate postmaintenance
inspections, which resulted in the in-flight
separation of the pilot servo control input rod
from the fore/aft servo and rendered the
helicopter uncontrollable.
80
81. Probable cause
• Contributing to the improper or lack of installation
of the split pin was the mechanic’s fatigue and
the lack of clearly delineated maintenance task
steps to follow. Contributing to the inadequate
postmaintenance inspection was the inspector’s
fatigue and the lack of clearly delineated
inspection steps to follow.
81
82. Probable Cause
The National Transportation Safety
Board determined the probable cause
of this accident to be:
• oil exhaustion due to an improper oil
breather tube installation, which became
plugged in flight due to frozen moisture
build-up. The blocked breather tube then
created a crankcase over pressure that
caused a failure of the crankshaft seal.
The rough, uneven terrain and strong
crosswind were factors in the accident.
83. Probable Cause
The National Transportation Safety
Board determined the probable
cause of this accident as follows:
• The improper assembly of the
governor during manufacture.
Editor's Notes
Good morning. I will discuss maintenance issues identified during the investigation.
This is a view looking northeast at the wreckage site, in rugged terrain on National Park Service land. The wreckage was consistent with a steep descent into the narrow ravine. Impact forces were high and the site was in a very contained area. The wreckage was fragmented and consumed by fire.[CLICK] The red circle indicates the tail boom and skids, [CLICK] the fuselage impacted just to the left of the circle. All of the main and tail rotor blades were found in the area.[CLICK]
The day prior to the flight,Sundance maintenance personnel performed a routine 100 hour inspection, which among other tasks, included the replacement of the main rotor fore-aft servo. After the maintenance was completed a short check flight was performed, followed by two tour flights – one flown by the same pilot who performed the check flight and one by the accident pilot. The next tour flight was the accident flight, which occurred about 3.5 flight hours after the maintenance.Ms. Dunks will go into more detail on this work in her presentation and Dr. Alley-R will discuss human factors and fatigue in maintenance.[CLICK]
This is a view with the engine cowl open, of the area where the servos and other components are located, under the main rotor assembly, between the cabin and engine. The fore-aft servo is one of three that transfer pilot control inputs to the main rotor, allowing the pilot to change the pitch of the blades, in order to control the helicopter.[CLICK]
However, examination of the wreckage, found the fore-aft servo and the associated flight control input rod were not connected, and there was no evidence of a connecting bolt.[CLICK] This is a view of the input rod, and the servo [CLICK] at top right, the lugs [CLICK] indicated by the arrow are where the rod end should be fastened [CLICK] with a bolt, locknut, washer, and safety cotter or split pinA disconnected input rod to the fore-aft servo is considered catastrophic, the pilot would not be able to control main rotor pitch and other inputs would result in unexpected response. The input rod and servo therefore likely disconnected in flight, just prior to the unexpected climb and turn. [CLICK]
The day before the accident, the helicopter underwent a routine 100-hour inspection. Three mechanics and a company-designated quality control inspector participated in the maintenance activity. The helicopter also had its engine and fore aft and tail rotor servos replaced. As noted by Mr. English, the fore/aft servo was found disconnected from the input rod at the accident site.
The fore aft servo that wasinstalledon the accident helicopter was an overhauled unit. During the replacement of the fore/aft servo, the mechanic is required to assess the hardware condition and then to connect the fore aft servo to the input rod, torque the nut, and install the split pin. A company-designated quality control inspector then inspects the installation.
The schematic on the left shows a close-upview of the hardware for the fore aft servo and input rod connection. As shown, the bolt is inserted through the fore aft servo and servo control input rod, the washer is installed, and then the nut is installed. The nut is torqued and the split pin is inserted through the nut and bolt. Once the split pin is in place, the tangs are bent back to secure the connection.The image on the right shows a close-up view of the fore aft servo and input rod connection. In accordance with Sundance’s procedures, when inspecting the fore/aft servo installation, the inspector is required to mark all safeties with a torque pen. In the case of the accident helicopter, the inspector reported verifying and marking the security of the installation.
Here are images of self-locking nuts. The image on the left shows the full-circle nylon locking element of a new or “acceptable” nut. The image on the right shows a degraded nut with the nylon locking element worn. During the hardware assessment, the mechanic verifies the condition of the self-locking nut to ensure that it meets the minimum torque value. That is, it cannot be tightened by hand to the base of the bolt threads. NTSB tests showed that torque values degraded with each on-off cycle.In this case, the mechanic reported that the original hardware met the requirements and it was not replaced.
Following the accident, Sundance inspected its helicopter fleet to determine the condition of the servo hardware and to ensure that all items were safetied. Although no unsafetied items were found, about half of the nuts associated with the bolts that had beenexamined at the time of the NTSB’s visit did not meet the minimum locking capability.The manufacturer’s guidance states that if a nut can be easily tightened, it is to be discarded. FAA guidance states that nut torque must be verified and notes “DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values.”Sundance now requires that all nuts be replaced with new nuts when servos are removed.
During the investigation, several nut and split pin installation scenarios were evaluated. By design, a properly installed input rod to the fore/aft servo has a secure connection because it has two locking devices, the self-locking nut and split pin. If an improperly installed or degraded nut is installed without a split pin, the nut can vibrate off of the bolt due to normal in-flight vibratory forces and a disconnect of the control input rod from the fore/aft servo can occur. Therefore, the self-locking nut most likely became separated from the bolt.
Once the maintenance was completed, the inspector, with assistance from the mechanic that installed the fore/aft servo, completed the final overall checks on the helicopter. No problems were identified.The following morning, the day of the accident, a check pilot completed the post maintenance checks. This included a before first flight check, a check of the maintenance items performed, and a check flight. During the before first flight check, the check pilot noted that the hydraulic belt tension was too loose. The belt tension had been set by the same mechanic that completed the installation of the fore aft servo. After the tension was reset, the check flight was completed. According to the check pilot, no discrepancies were identified during the flight.
As discussed earlier, the day before the accident, the accident helicopter underwent a 100-hour inspection, including the fore aft servo replacement. Errors made during this maintenance were: improper securing of the fore /aft servo connection hardware, improper tension of the hydraulic belt, and incomplete maintenance inspection of the accident helicopter. [click]
The mechanic was contacted on his off duty day, to report to work about 6 hours earlier than his normal shift and on a day he was previously scheduled to be off duty. He stated that he went to bed earlier than normal, about 10:00 pm; however, he had difficulty falling asleep. Heawoke at 5:00 am on the morning of December 6, after obtaining only about 5 hours of sleep and reported to work about 5:50 am. He completed his shift about 6:45 pm. He had been awake for over 13 ½ hours. [Click]
The inspector was also contacted on his off duty day, to report to work about 6½ hours earlier than his normal shift and also on a day when he was previously scheduled to be off duty.He went to bed about 9:00 pm on December 5 and awoke at 4:00 am on December 6, obtaining approximately 7 hours of sleep. He reported to work about 5:30 am and completed his final inspection and ground run of the accident helicopter around 6:00 pm, at the end of a 12-hour shift. The inspector had been awake for over 14 hours at the end of his shift. [Click]
Here is a table summarizing the mechanic’s and inspector’s normal shift schedule, the shift they were originally scheduled for on December 6, and actual shifts they worked.For the Mechanic, the insufficient time to adjust to working an earlier shift than normal and inadequate amount of sleep the night prior to the scheduled maintenance contributed to the development of fatigue. For the inspector, the insufficient time to adjust to working an earlier shift than normal and a long duty day contributed to the development of fatigue. [Click]
Fatigue associated with sleep loss, shift work, and long duty cycles can lead to increased difficulty in sustaining and directing attention, memory errors, and lapses in performance. Available evidence indicates that both the mechanic and inspector were experiencing fatigue and the known effects of fatigue can lead to the type of errors that they made. Staff concludes that both the mechanic’s and inspector’s degraded performance due to fatigue contributed to the improper securing of the fore/aft servo connection hardware, the improper tension of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively. [Click]
Education and training is another important approach to mitigating the risks of fatigue-related errors in maintenance. Educating maintenance personnel on the causes of fatigue, its effect on performance, and appropriate countermeasures promotes a safer maintenance culture. This type of training can be done as part of a human factors training curriculum which would provide benefits to reducing human errors in maintenance beyond fatigue awareness. Current federal regulations do not require maintenance personnel to receive human factors training, however, other international regulatory authorities such as the European Aviation Safety Agency do. The circumstances of this accident illustrate that the reliability of inspections of critical flight control system components can be affected by a number of inherent human factors. Therefore, staff concludes that all maintenance personnel would benefit from receiving human factors training, including fatigue education, which would help reduce the likelihood of human errors in aviation maintenance. Staff has proposed recommendations in these areas. [click]
Documentation used by Sundance Helicopters’ maintenance personnel for the fore/aft servo replacement listed the servo replacement task as an item on a discrepancy list to be accomplished with a reference to the Aircraft Maintenance Manual. The Aircraft Maintenance Manual listed the tools, parts, and sequential steps required to accomplish the task. According to Sundance’s General Maintenance Manual, maintenance functions requiring a safety, such as the fore/aft servo replacement, required an inspector sign off to approve the helicopter for return for service. However, the company’s 100-hour inspection paperwork provided only a single location for the inspector to signoff for the overall fore/aft servo installation rather than including individual areas for the inspector to sign off to note inspection of critical steps within this task. [Click]
This picture depicts a page from the 100-hour inspection paperwork showing the single sign off location for the overall fore/aft servo. [Click]It is likely that the maintenance personnel’s performance was also affected by human factors such as failure in systematic visual inspections, complacency and expectations, overreliance on memory for performing tasks or identifying critical areas for inspection, and interruptions (which are common in the maintenance environment). [Click]
Using documentation that clearly delineates the steps to be performed and critical areas to be inspected to support the maintenance and inspection task is one way to mitigate these factors.This picture depicts a section of a sample work card where the mechanic [Click] and the inspector [Click] have separate columns to sign off delineated steps for a task such as installation of the nut, applying torque, and installation of the split pin. Work cards, which are used much like checklists in the cockpit, can help to ensure that critical steps in a maintenance task have been performed and protected against some of the human factors errors. Staff has proposed a recommendation in this area.[Click]
As a result of concerns regarding the reuse of hardware and other helicopter maintenance items, the FAA issued a GA Maintenance Alert in November 2012. This alert notice was distributed via the FAA’s safety and outreach FAAST Team email database to 239,000 users including pilots and mechanics.Similar information will also be published by the FAA in an Aviation Maintenance Alert in early 2013.Additionally, the NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization renewal training, and this information will be included in renewal training clinics throughout the United States in 2013.
As a result of concerns regarding the reuse of hardware and other helicopter maintenance items, the FAA issued a GA Maintenance Alert in November 2012. This alert notice was distributed via the FAA’s safety and outreach FAAST Team email database to 239,000 users including pilots and mechanics.Similar information will also be published by the FAA in an Aviation Maintenance Alert in early 2013.Additionally, the NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization renewal training, and this information will be included in renewal training clinics throughout the United States in 2013.