Safety Alert: The Human Component in a Mechanical System


Published on

Published in: Education, Business, Technology
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • Good morning. I will discuss maintenance issues identified during the investigation.
  • This is a view looking northeast at the wreckage site, in rugged terrain on National Park Service land. The wreckage was consistent with a steep descent into the narrow ravine. Impact forces were high and the site was in a very contained area. The wreckage was fragmented and consumed by fire.[CLICK] The red circle indicates the tail boom and skids, [CLICK] the fuselage impacted just to the left of the circle. All of the main and tail rotor blades were found in the area.[CLICK]
  • The day prior to the flight,Sundance maintenance personnel performed a routine 100 hour inspection, which among other tasks, included the replacement of the main rotor fore-aft servo. After the maintenance was completed a short check flight was performed, followed by two tour flights – one flown by the same pilot who performed the check flight and one by the accident pilot. The next tour flight was the accident flight, which occurred about 3.5 flight hours after the maintenance.Ms. Dunks will go into more detail on this work in her presentation and Dr. Alley-R will discuss human factors and fatigue in maintenance.[CLICK]
  • This is a view with the engine cowl open, of the area where the servos and other components are located, under the main rotor assembly, between the cabin and engine. The fore-aft servo is one of three that transfer pilot control inputs to the main rotor, allowing the pilot to change the pitch of the blades, in order to control the helicopter.[CLICK]
  • However, examination of the wreckage, found the fore-aft servo and the associated flight control input rod were not connected, and there was no evidence of a connecting bolt.[CLICK] This is a view of the input rod, and the servo [CLICK] at top right, the lugs [CLICK] indicated by the arrow are where the rod end should be fastened [CLICK] with a bolt, locknut, washer, and safety cotter or split pinA disconnected input rod to the fore-aft servo is considered catastrophic, the pilot would not be able to control main rotor pitch and other inputs would result in unexpected response. The input rod and servo therefore likely disconnected in flight, just prior to the unexpected climb and turn. [CLICK]
  • The day before the accident, the helicopter underwent a routine 100-hour inspection. Three mechanics and a company-designated quality control inspector participated in the maintenance activity. The helicopter also had its engine and fore aft and tail rotor servos replaced. As noted by Mr. English, the fore/aft servo was found disconnected from the input rod at the accident site.
  • The fore aft servo that wasinstalledon the accident helicopter was an overhauled unit. During the replacement of the fore/aft servo, the mechanic is required to assess the hardware condition and then to connect the fore aft servo to the input rod, torque the nut, and install the split pin. A company-designated quality control inspector then inspects the installation.
  • The schematic on the left shows a close-upview of the hardware for the fore aft servo and input rod connection. As shown, the bolt is inserted through the fore aft servo and servo control input rod, the washer is installed, and then the nut is installed. The nut is torqued and the split pin is inserted through the nut and bolt. Once the split pin is in place, the tangs are bent back to secure the connection.The image on the right shows a close-up view of the fore aft servo and input rod connection. In accordance with Sundance’s procedures, when inspecting the fore/aft servo installation, the inspector is required to mark all safeties with a torque pen. In the case of the accident helicopter, the inspector reported verifying and marking the security of the installation.
  • Here are images of self-locking nuts. The image on the left shows the full-circle nylon locking element of a new or “acceptable” nut. The image on the right shows a degraded nut with the nylon locking element worn. During the hardware assessment, the mechanic verifies the condition of the self-locking nut to ensure that it meets the minimum torque value. That is, it cannot be tightened by hand to the base of the bolt threads. NTSB tests showed that torque values degraded with each on-off cycle.In this case, the mechanic reported that the original hardware met the requirements and it was not replaced.
  • Following the accident, Sundance inspected its helicopter fleet to determine the condition of the servo hardware and to ensure that all items were safetied. Although no unsafetied items were found, about half of the nuts associated with the bolts that had beenexamined at the time of the NTSB’s visit did not meet the minimum locking capability.The manufacturer’s guidance states that if a nut can be easily tightened, it is to be discarded. FAA guidance states that nut torque must be verified and notes “DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values.”Sundance now requires that all nuts be replaced with new nuts when servos are removed.
  • During the investigation, several nut and split pin installation scenarios were evaluated. By design, a properly installed input rod to the fore/aft servo has a secure connection because it has two locking devices, the self-locking nut and split pin. If an improperly installed or degraded nut is installed without a split pin, the nut can vibrate off of the bolt due to normal in-flight vibratory forces and a disconnect of the control input rod from the fore/aft servo can occur. Therefore, the self-locking nut most likely became separated from the bolt.
  • Once the maintenance was completed, the inspector, with assistance from the mechanic that installed the fore/aft servo, completed the final overall checks on the helicopter. No problems were identified.The following morning, the day of the accident, a check pilot completed the post maintenance checks. This included a before first flight check, a check of the maintenance items performed, and a check flight. During the before first flight check, the check pilot noted that the hydraulic belt tension was too loose. The belt tension had been set by the same mechanic that completed the installation of the fore aft servo. After the tension was reset, the check flight was completed. According to the check pilot, no discrepancies were identified during the flight.
  • As discussed earlier, the day before the accident, the accident helicopter underwent a 100-hour inspection, including the fore aft servo replacement. Errors made during this maintenance were: improper securing of the fore /aft servo connection hardware, improper tension of the hydraulic belt, and incomplete maintenance inspection of the accident helicopter. [click]
  • The mechanic was contacted on his off duty day, to report to work about 6 hours earlier than his normal shift and on a day he was previously scheduled to be off duty. He stated that he went to bed earlier than normal, about 10:00 pm; however, he had difficulty falling asleep. Heawoke at 5:00 am on the morning of December 6, after obtaining only about 5 hours of sleep and reported to work about 5:50 am. He completed his shift about 6:45 pm. He had been awake for over 13 ½ hours. [Click]
  • The inspector was also contacted on his off duty day, to report to work about 6½ hours earlier than his normal shift and also on a day when he was previously scheduled to be off duty.He went to bed about 9:00 pm on December 5 and awoke at 4:00 am on December 6, obtaining approximately 7 hours of sleep. He reported to work about 5:30 am and completed his final inspection and ground run of the accident helicopter around 6:00 pm, at the end of a 12-hour shift. The inspector had been awake for over 14 hours at the end of his shift. [Click]
  • Here is a table summarizing the mechanic’s and inspector’s normal shift schedule, the shift they were originally scheduled for on December 6, and actual shifts they worked.For the Mechanic, the insufficient time to adjust to working an earlier shift than normal and inadequate amount of sleep the night prior to the scheduled maintenance contributed to the development of fatigue. For the inspector, the insufficient time to adjust to working an earlier shift than normal and a long duty day contributed to the development of fatigue. [Click] 
  • Fatigue associated with sleep loss, shift work, and long duty cycles can lead to increased difficulty in sustaining and directing attention, memory errors, and lapses in performance. Available evidence indicates that both the mechanic and inspector were experiencing fatigue and the known effects of fatigue can lead to the type of errors that they made. Staff concludes that both the mechanic’s and inspector’s degraded performance due to fatigue contributed to the improper securing of the fore/aft servo connection hardware, the improper tension of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively. [Click]
  • Education and training is another important approach to mitigating the risks of fatigue-related errors in maintenance. Educating maintenance personnel on the causes of fatigue, its effect on performance, and appropriate countermeasures promotes a safer maintenance culture. This type of training can be done as part of a human factors training curriculum which would provide benefits to reducing human errors in maintenance beyond fatigue awareness. Current federal regulations do not require maintenance personnel to receive human factors training, however, other international regulatory authorities such as the European Aviation Safety Agency do. The circumstances of this accident illustrate that the reliability of inspections of critical flight control system components can be affected by a number of inherent human factors. Therefore, staff concludes that all maintenance personnel would benefit from receiving human factors training, including fatigue education, which would help reduce the likelihood of human errors in aviation maintenance. Staff has proposed recommendations in these areas. [click]
  • Documentation used by Sundance Helicopters’ maintenance personnel for the fore/aft servo replacement listed the servo replacement task as an item on a discrepancy list to be accomplished with a reference to the Aircraft Maintenance Manual. The Aircraft Maintenance Manual listed the tools, parts, and sequential steps required to accomplish the task. According to Sundance’s General Maintenance Manual, maintenance functions requiring a safety, such as the fore/aft servo replacement, required an inspector sign off to approve the helicopter for return for service. However, the company’s 100-hour inspection paperwork provided only a single location for the inspector to signoff for the overall fore/aft servo installation rather than including individual areas for the inspector to sign off to note inspection of critical steps within this task. [Click] 
  • This picture depicts a page from the 100-hour inspection paperwork showing the single sign off location for the overall fore/aft servo. [Click]It is likely that the maintenance personnel’s performance was also affected by human factors such as failure in systematic visual inspections, complacency and expectations, overreliance on memory for performing tasks or identifying critical areas for inspection, and interruptions (which are common in the maintenance environment). [Click]
  • Using documentation that clearly delineates the steps to be performed and critical areas to be inspected to support the maintenance and inspection task is one way to mitigate these factors.This picture depicts a section of a sample work card where the mechanic [Click] and the inspector [Click] have separate columns to sign off delineated steps for a task such as installation of the nut, applying torque, and installation of the split pin. Work cards, which are used much like checklists in the cockpit, can help to ensure that critical steps in a maintenance task have been performed and protected against some of the human factors errors.  Staff has proposed a recommendation in this area.[Click] 
  • As a result of concerns regarding the reuse of hardware and other helicopter maintenance items, the FAA issued a GA Maintenance Alert in November 2012. This alert notice was distributed via the FAA’s safety and outreach FAAST Team email database to 239,000 users including pilots and mechanics.Similar information will also be published by the FAA in an Aviation Maintenance Alert in early 2013.Additionally, the NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization renewal training, and this information will be included in renewal training clinics throughout the United States in 2013.
  • As a result of concerns regarding the reuse of hardware and other helicopter maintenance items, the FAA issued a GA Maintenance Alert in November 2012. This alert notice was distributed via the FAA’s safety and outreach FAAST Team email database to 239,000 users including pilots and mechanics.Similar information will also be published by the FAA in an Aviation Maintenance Alert in early 2013.Additionally, the NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization renewal training, and this information will be included in renewal training clinics throughout the United States in 2013.
  • Safety Alert: The Human Component in a Mechanical System

    1. 1. The Human Component in aMechanical System1Kristi DunksSenior Air Safety Investigator
    2. 2. Overview• The NTSB• General aviation safety• Identifying risks/hazards• Case studies2
    3. 3. Who is the NTSB?• Promotes transportation safety• Investigate for probable cause• Issue safety recommendations• Promotes safety improvements• Multi-modal:Aviation, highway, marine, railroad, pipeline, HAZMAT• Small federal agency
    4. 4. General Aviation Safety• 1,466 GA accidents in 2011• 271 fatal accidents resulting in 457fatalities• NTSB working with FAA, AOPA, EAA,and others to improve GA accident rate
    5. 5. Risk/Hazard Identifier• People• Actions• Resources• Environment
    6. 6. PhysicalSizeAgeStrengthThe Five SensesPhysiologicalHealthNutritionLifestyleAlertness/fatigueChemical dependencyPsychologicalKnowledgeExperienceTrainingAttitudeEmotional statePsychosocialInterpersonal relationsAbility to communicateEmpathyLeadershipPeople
    7. 7. PhysicalWeather extremesLocation (in/out)WorkspaceLightingSound levelsHousekeepingSafety issuesOrganizationalPersonnelSupervisionLabor - managementSize of companyProfitabilityJob securityMoraleCorporate cultureSafety cultureEnvironment
    8. 8. • What do you need to know?• What skills are necessary?• Steps to perform a task• Sequence of actions• Communication requirements• Information requirements• Inspection requirements• Certification requirementsActions
    9. 9. • Technical documentation systems• Test equipment• Enough time• Enough people• Lifts, ladders, stands, seats• Materials• Portable lighting, heating, cooling• TrainingResources
    10. 10. Case Study• Cirrus SR 22• VMC prevailed• March 19, 2010
    11. 11. History of Flight• BuchananField, Concord, California, to RentonMunicipal Airport, Renton, Washington• Departed at 1540• Accident occurred at 1910
    12. 12. History of Flight• 1906:51 pilot transmitted“Mayday, Mayday, Cirrus N4GS”• “I’m west of Strom airport, trying tomake the field.”• Wreckage located 2.5 west-northwestof Strom Field Airport
    13. 13. History of Flight
    14. 14. Cirrus Airframe Parachute System• Rocket motor and deployment bag remainedconnected to parachute• Activation handle found seated in the handleholder• Enclosure cover found 15 feet fromwreckage• Consistent with activation due to impactforces
    15. 15. Engine Examination• Examined at Teledyne Continental• Engine test run• Fitting cap installed finger tight• Engine operated normally
    16. 16. Fuel Line Caps
    17. 17. Last Annual Inspection Entry
    18. 18. Annual Work Order Entry
    19. 19. Fuel System Check
    20. 20. Inspection Checklist
    21. 21. Maintenance Personnel Interviews• Three mechanics worked on airplane, twoIAs and one A&P• Another Cirrus SR22 in facility• Rushed to complete work• Performed fuel pressure check• Final checklist items incomplete
    22. 22. Findings• Engine lost power during cruise• Fitting cap for throttle and meteringassembly inlet found uninstalled• Engine operated normally following accident• Maintenance was performed that requiredcap to be removed• If cap had been properly torqued it wouldhave remained secure
    23. 23. Findings• Director of Maintenance signed off annualinspection on work order• Assigned IA indicated he had not completedthe annual inspection• Maintenance records incomplete• If final checks completed, cap would havelikely been identified
    24. 24. Risks/Hazards:People, Actions, Resources, andEnvironmentHow could this accident have beenprevented?31
    25. 25. Case Study32• Eurocopter AS350 B2• December 7, 2011
    26. 26. Initial Information• Sightseeing tour from Las Vegasto Hoover Dam• Normal departure - VFR• Calm wind, good visibility• Standardized route33
    27. 27. Flight PathLas Vegas AirportTo Hoover DamAccident siteSudden climb and turnPath approximateand not to scale, forvisualization onlyFlightpathTour routeFlightpath
    28. 28. Sequence of Events35Hoover DamSudden climb and turn3100feet, 90° offcoursePath approximateand not to scale, forvisualization onlySteep descent andcrash site
    29. 29. Fuselageand engine
    30. 30. Preflight Sequence37• 100-hour maintenance inspection• Replaced fore/aft servo• Flew check flight• 2 tour flights• Accident on third tour flight• 3.5 flight hours after maintenance
    31. 31. View of helicopter components38Main rotor assemblyCockpit and cabinInput rod andfore/aft servo
    32. 32. Initial Findings• No evidence of non-standardflight• No evidence of bird strike• Altitude clear of terrain/obstacles• Weather not a factor39
    33. 33. Input rod and servo40Servo bodyLugsInput rod
    34. 34. Maintenance• 100-hour inspection• Replacement of the following:• Engine• Fore/aft and tail rotor servos41
    35. 35. Fore/Aft Servo Installation• Fore/aft servo replaced• Fore/aft servo installationprocedures:• Assess hardware• Connect servo to input rod• Torque nut• Install split pin• Inspect installation42
    36. 36. HardwareInput rod hardware Hardware installed43Fore/Aft servo with Ice ShieldInput Rod
    37. 37. Self-Locking NutAcceptable Nut Degraded Nut44
    38. 38. Hardware Reuse• Fleet inspection of 13 helicopters, halfof nuts did not meet requirements• Manufacturer’s guidance: “If a nut canbe easily tightened, it is to bediscarded”• FAA guidance: “DO NOT reuse a fiberor nylon lock nut if the nut cannot meetthe minimum prevailing torque values”45
    39. 39. Bolt Loss Scenario46• Two locking devices• Self-locking nut• Split pin• Self-locking nut most likely becameseparated from bolt
    40. 40. Postmaintenance Inspection andCheck Flight• Mechanic and inspectorcompleted inspection• Helicopter check flight conducted• Hydraulic belt tension• No flight discrepancies47
    41. 41. Maintenance Errors• Improper securing of the fore/aftservo• Improper tension of the hydraulicbelt• Incomplete maintenance inspection48
    42. 42. Maintenance Personnel Fatigue• The mechanic• Recent sleep and wake activity• Shift change• Inadequate sleep49
    43. 43. 50Maintenance Personnel Fatigue• The inspector• Recent sleep and wake activity• Shift change• Long duty day
    44. 44. Maintenance Personnel Fatigue51Personnel Normal ShiftShiftOriginallyScheduled forDecember 6Actual Scheduleon December 6Mechanic Noon to 11:00 pm Off duty 5:50 am to 6:46 pmInspector Noon to 11:00 pm Off duty 5:31 am to 6:55 pm
    45. 45. Maintenance Personnel Fatigue• Effects of fatigue• Difficulty sustaining attention• Memory errors• Lapses in performance52
    46. 46. Human Factors Training• Causes of fatigue, its effects, andcountermeasures• Fatigue education as part of atraining curriculum• No human factors trainingrequirement in United States53
    47. 47. Work Cards With Delineated Steps54• Paperwork for 100-hour inspection• Inspector signoff for overall fore/aftservo installation• No specific signoffs for criticalsteps within task
    48. 48. 100-Hour Inspection Paperwork55sign off
    49. 49. Work Cards With Delineated Steps56Sample work card
    50. 50. Risks/Hazards:People, Actions, Resources, andEnvironmentHow could this accident have beenprevented?57
    51. 51. GA Maintenance Alert• Independent inspections of work• Safety and security ofcomponents disconnected• Look for the obvious; if there is acastellated nut, there is generallyan associated cotter pin58
    52. 52. GA Maintenance Alert• Review and adhere to guidanceregarding self-locking nuts• When a component or system isin the work process, mark it• Cell phone policies59
    53. 53. GA Maintenance Alert• Turnover briefings• Pilot check flights/review are lastopportunity to detect potentialsafety hazards• Review FAA HF guidance and“Personal Minimums” Checklist60
    54. 54. Safety recommendations• Duty time limitations formaintenance personnel• Work cards for maintenance tasks• Human factors training formaintenance personnel• Review issue of human fatigue inaviation maintenance61
    55. 55. • Piper PA-22-108• No injuriesCase Study
    56. 56. • Pilot recently purchased airplane• Lost oil pressure during flight andlanded in a field• Post accident examination showedthat the main crankshaft seal wasextruded and oil had been pumpedout during the flight• Breather tube modified to drain oiland moisture away from airplaneOverview
    57. 57. • Moisture is expelled from the engine crankcasethrough the breather tube which often extendsthrough the bottom of the engine cowling into theair stream• This moisture may freeze and continue a buildupof ice until the tube is completely blocked• To prevent freeze-up, the breather tube may beinsulated, it may be designed so the end islocated in a hot area, it may be equipped with anelectric heater, or it may incorporate a hole, notchor slot which is often called a "whistle slot"Whistle Slot Guidance- LycomingFlyer
    58. 58. • The operator of any aircraft should know whichmethod is used for preventing freezing of thebreather tube, and should insure that theconfiguration is maintained as specified by theairframe manufacturer• Because of its simplicity, the "whistle slot" is oftenused, and a notch or hole in the tube is located ina warm area near the engine where freezing isextremely unlikely• When a breather tube with whistle slot ischanged, the new tube must be of the samedesignWhistle Slot Guidance- LycomingFlyer
    59. 59. Risks/Hazards:People, Actions, Resources, andEnvironmentHow could this accident have beenprevented?67
    60. 60. • Diamond DA-40• No injuriesCase Study
    61. 61. • The run up was without incident and the pilotnoted that the RPMs dropped slower than normalwhen he cycled the propeller• During climb out, he noticed that the engineRPMs climbed to 2,800 so he leveled off his climband pulled the propeller control back with noreduction in RPM noted• Attempted to cycle the propeller twice but noticedno change in RPMs• Decided to return to the departure airport andthen he heard and felt a thump forward of thecockpit• Engine continued to run smoothly, whiledeveloping adequate power, and the pilot landeduneventfullyOverview
    62. 62. Engine examination• Post incident engine examination showeda blister in the engine casing andfragments of metal in the oil• Engine then disassembled and ballbearings from the propeller governor werelocated in the engine• Further disassembly of the engineidentified one ball bearing within the oilsump, as well as damage to the case andtwo camshaft lifters• The ball bearings from the governor wereable to pass through the oil drain hole ofthe governor
    63. 63. Assembly
    64. 64. • Follow up examinations of the propellergovernor showed that the governor bearing raceand plunger were assembled with the bearingrace set screw and plunger hole misaligned• When the bearing race set screw was torqueddown, the set screw tip flattened against theharder plunger surface• During operation, the set screw/plunger raceseparatedGovernor examinations
    65. 65. • Review of the governor manufacturer’sreports showed two service difficultyreports (SDRs) had been reported forsimilar events• The two events, as well as the governorassembly from the accident, were from asingle batch of 74 assembliesService difficulty reports
    66. 66. Risks/Hazards:People, Actions, Resources, andEnvironmentHow could this incident have beenprevented?75
    67. 67. • As a result of this incident, the governormanufacturer issued a mandatory servicebulletin (SB) DES-353, on December 18, 2008,for the affected assemblies. The SB requiredthat the units be returned to Ontic for inspectionand, if necessary, repair.• The FAA issued an Airworthiness Directiverequiring examination of the affectedassemblies.
    68. 68. Probable CauseThe failure of maintenance personnel toproperly secure a fitting cap on the throttleand metering assembly inlet afterconducting a fuel system pressure check,which resulted in a loss of engine power dueto fuel starvation.
    69. 69. Contributing FactorContributing to the accident was the decisionby the Director of Maintenance to return theairplane to service without verifying with theassigned inspector that all annual inspectionitems had been completed.
    70. 70. Probable cause• Sundance Helicopters’ inadequate maintenanceof the helicopter, 8 including (1) the improperreuse of a degraded self-locking nut, (2) theimproper or lack of installation of a split pin, and(3) inadequate postmaintenanceinspections, which resulted in the in-flightseparation of the pilot servo control input rodfrom the fore/aft servo and rendered thehelicopter uncontrollable.80
    71. 71. Probable cause• Contributing to the improper or lack of installationof the split pin was the mechanic’s fatigue andthe lack of clearly delineated maintenance tasksteps to follow. Contributing to the inadequatepostmaintenance inspection was the inspector’sfatigue and the lack of clearly delineatedinspection steps to follow.81
    72. 72. Probable CauseThe National Transportation SafetyBoard determined the probable causeof this accident to be:• oil exhaustion due to an improper oilbreather tube installation, which becameplugged in flight due to frozen moisturebuild-up. The blocked breather tube thencreated a crankcase over pressure thatcaused a failure of the crankshaft seal.The rough, uneven terrain and strongcrosswind were factors in the accident.
    73. 73. Probable CauseThe National Transportation SafetyBoard determined the probablecause of this accident as follows:• The improper assembly of thegovernor during manufacture.