Safety Alert: The Human Component in a Mechanical System

The Human Component in a

Mechanical System

1

Kristi Dunks

Senior Air Safety Investigator

Overview

• The NTSB

• General aviation safety

• Identifying risks/hazards

• Case studies

2

Who is the NTSB?

• Promotes transportation safety

• Investigate for probable cause

• Issue safety recommendations

• Promotes safety improvements

• Multi-modal: Aviation, highway, marine, railroad, pipeline, HAZMAT

• Small federal agency

General Aviation Safety

• 1,466 GA accidents in 2011

• 271 fatal accidents resulting in 457

fatalities

• NTSB working with FAA, AOPA, EAA,

and others to improve GA accident rate

Risk/Hazard Identifier

• People

• Actions

• Resources

• Environment

Physical Size

Age

Strength

The Five Senses

Physiological Health

Nutrition

Lifestyle

Alertness/fatigue

Chemical dependency

Psychological Knowledge

Experience

Training

Attitude

Emotional state

Psychosocial Interpersonal relations

Ability to communicate

Empathy

Leadership

People

PhysicalWeather extremes

Location (in/out)

Workspace

Lighting

Sound levels

Housekeeping

Safety issues

Organizational Personnel

Supervision

Labor - management

Size of company

Profitability

Job security

Morale

Corporate culture

Safety culture

Environment

• What do you need to know?

• What skills are necessary?

• Steps to perform a task

• Sequence of actions

• Communication requirements

• Information requirements

• Inspection requirements

• Certification requirements

Actions

• Technical documentation systems

• Test equipment

• Enough time

• Enough people

• Lifts, ladders, stands, seats

• Materials

• Portable lighting, heating, cooling

• Training

Resources

Case Study

• Cirrus SR 22

• VMC prevailed

• March 19, 2010

History of Flight

• Buchanan

Field, Concord, California, to Renton

Municipal Airport, Renton, Washington

• Departed at 1540

• Accident occurred at 1910

History of Flight

• 1906:51 pilot transmitted

“Mayday, Mayday, Cirrus N4GS”

• “I’m west of Strom airport, trying to

make the field.”

• Wreckage located 2.5 west-northwest

of Strom Field Airport

History of Flight

Cirrus Airframe Parachute System

• Rocket motor and deployment bag remained

connected to parachute

• Activation handle found seated in the handle

holder

• Enclosure cover found 15 feet from

wreckage

• Consistent with activation due to impact

forces

Engine Examination

• Examined at Teledyne Continental

• Engine test run

• Fitting cap installed finger tight

• Engine operated normally

Fuel Line Caps

Last Annual Inspection Entry

Annual Work Order Entry

Fuel System Check

Inspection Checklist

Maintenance Personnel Interviews

• Three mechanics worked on airplane, two

IAs and one A&P

• Another Cirrus SR22 in facility

• Rushed to complete work

• Performed fuel pressure check

• Final checklist items incomplete

Findings

• Engine lost power during cruise

• Fitting cap for throttle and metering

assembly inlet found uninstalled

• Engine operated normally following accident

• Maintenance was performed that required

cap to be removed

• If cap had been properly torqued it would

have remained secure

Findings

• Director of Maintenance signed off annual

inspection on work order

• Assigned IA indicated he had not completed

the annual inspection

• Maintenance records incomplete

• If final checks completed, cap would have

likely been identified

Risks/Hazards:

People, Actions, Resources, and

Environment

How could this accident have been

prevented?

31

Case Study

32

• Eurocopter AS350 B2

• December 7, 2011

Initial Information

• Sightseeing tour from Las Vegas

to Hoover Dam

• Normal departure - VFR

• Calm wind, good visibility

• Standardized route

33

Flight Path

Las Vegas Airport

To Hoover Dam

Accident site

Sudden climb and turn

Path approximate

and not to scale, for

visualization only

Flightpath

Tour route

Flightpath

Sequence of Events

35

Hoover Dam

Sudden climb and turn

3100

feet, 90° off

course

Path approximate

and not to scale, for

visualization only

Steep descent and

crash site

Fuselage

and engine

Preflight Sequence

37

• 100-hour maintenance inspection

• Replaced fore/aft servo

• Flew check flight

• 2 tour flights

• Accident on third tour flight

• 3.5 flight hours after maintenance

View of helicopter components

38

Main rotor assembly

Cockpit and cabin

Input rod and

fore/aft servo

Initial Findings

• No evidence of non-standard flight

• No evidence of bird strike

• Altitude clear of terrain/obstacles

• Weather not a factor

39

Input rod and servo

40

Servo body

Lugs

Input rod

Maintenance

• 100-hour inspection

• Replacement of the following:

• Engine

• Fore/aft and tail rotor servos

41

Fore/Aft Servo Installation

• Fore/aft servo replaced

• Fore/aft servo installation procedures:• Assess hardware

• Connect servo to input rod

• Torque nut

• Install split pin

• Inspect installation

42

Hardware

Input rod hardware Hardware installed

43

Fore/Aft servo with Ice Shield

Input Rod

Self-Locking Nut

Acceptable Nut Degraded Nut

44

Hardware Reuse

• Fleet inspection of 13 helicopters, half of nuts did not meet requirements

• Manufacturer’s guidance: “If a nut can be easily tightened, it is to be discarded”

• FAA guidance: “DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values”

45

Bolt Loss Scenario

46

• Two locking devices

• Self-locking nut

• Split pin

• Self-locking nut most likely became

separated from bolt

Postmaintenance Inspection and

Check Flight

• Mechanic and inspector

completed inspection

• Helicopter check flight conducted

• Hydraulic belt tension

• No flight discrepancies

47

Maintenance Errors

• Improper securing of the fore/aft

servo

• Improper tension of the hydraulic

belt

• Incomplete maintenance inspection

48

Maintenance Personnel Fatigue

• The mechanic

• Recent sleep and wake activity

• Shift change

• Inadequate sleep

49

50

Maintenance Personnel Fatigue

• The inspector

• Recent sleep and wake activity

• Shift change

• Long duty day

Maintenance Personnel Fatigue

51

Personnel Normal Shift

Shift

Originally

Scheduled for

December 6

Actual Schedule

on December 6

Mechanic Noon to 11:00 pm Off duty 5:50 am to 6:46 pm

Inspector Noon to 11:00 pm Off duty 5:31 am to 6:55 pm

Maintenance Personnel Fatigue

• Effects of fatigue

• Difficulty sustaining attention

• Memory errors

• Lapses in performance

52

Human Factors Training

• Causes of fatigue, its effects, and

countermeasures

• Fatigue education as part of a

training curriculum

• No human factors training

requirement in United States

53

Work Cards With Delineated Steps

54

• Paperwork for 100-hour inspection

• Inspector signoff for overall fore/aft

servo installation

• No specific signoffs for critical

steps within task

100-Hour Inspection Paperwork

55

sign off

Work Cards With Delineated Steps

56

Sample work card

Risks/Hazards:

People, Actions, Resources, and

Environment

How could this accident have been

prevented?

57

GA Maintenance Alert

• Independent inspections of work

• Safety and security of

components disconnected

• Look for the obvious; if there is a

castellated nut, there is generally

an associated cotter pin

58

GA Maintenance Alert

• Review and adhere to guidance

regarding self-locking nuts

• When a component or system is

in the work process, mark it

• Cell phone policies

59

GA Maintenance Alert

• Turnover briefings

• Pilot check flights/review are last

opportunity to detect potential

safety hazards

• Review FAA HF guidance and

“Personal Minimums” Checklist

60

Safety recommendations

• Duty time limitations for

maintenance personnel

• Work cards for maintenance tasks

• Human factors training for

maintenance personnel

• Review issue of human fatigue in

aviation maintenance

61

• Piper PA-22-108

• No injuries

Case Study

• Pilot recently purchased airplane

• Lost oil pressure during flight and landed in a field

• Post accident examination showed that the main crankshaft seal was extruded and oil had been pumped out during the flight

• Breather tube modified to drain oil and moisture away from airplane

Overview

• Moisture is expelled from the engine crankcase through the breather tube which often extends through the bottom of the engine cowling into the air stream

• This moisture may freeze and continue a buildup of ice until the tube is completely blocked

• To prevent freeze-up, the breather tube may be insulated, it may be designed so the end is located in a hot area, it may be equipped with an electric heater, or it may incorporate a hole, notch or slot which is often called a "whistle slot"

Whistle Slot Guidance- Lycoming

Flyer

• The operator of any aircraft should know which method is used for preventing freezing of the breather tube, and should insure that the configuration is maintained as specified by the airframe manufacturer

• Because of its simplicity, the "whistle slot" is often used, and a notch or hole in the tube is located in a warm area near the engine where freezing is extremely unlikely

• When a breather tube with whistle slot is changed, the new tube must be of the same design

Whistle Slot Guidance- Lycoming

Flyer

Risks/Hazards:

People, Actions, Resources, and

Environment

How could this accident have been

prevented?

67

• Diamond DA-40

• No injuries

Case Study

• The run up was without incident and the pilot noted that the RPMs dropped slower than normal when he cycled the propeller

• During climb out, he noticed that the engine RPMs climbed to 2,800 so he leveled off his climb and pulled the propeller control back with no reduction in RPM noted

• Attempted to cycle the propeller twice but noticed no change in RPMs

• Decided to return to the departure airport and then he heard and felt a thump forward of the cockpit

• Engine continued to run smoothly, while developing adequate power, and the pilot landed uneventfully

Overview

Engine examination

• Post incident engine examination showed a blister in the engine casing and fragments of metal in the oil

• Engine then disassembled and ball bearings from the propeller governor were located in the engine

• Further disassembly of the engine identified one ball bearing within the oil sump, as well as damage to the case and two camshaft lifters

• The ball bearings from the governor were able to pass through the oil drain hole of the governor

Assembly

• Follow up examinations of the propeller

governor showed that the governor bearing race

and plunger were assembled with the bearing

race set screw and plunger hole misaligned

• When the bearing race set screw was torqued

down, the set screw tip flattened against the

harder plunger surface

• During operation, the set screw/plunger race

separated

Governor examinations

• Review of the governor manufacturer’s

reports showed two service difficulty

reports (SDRs) had been reported for

similar events

• The two events, as well as the governor

assembly from the accident, were from a

single batch of 74 assemblies

Service difficulty reports

Risks/Hazards:

People, Actions, Resources, and

Environment

How could this incident have been

prevented?

75

• As a result of this incident, the governor

manufacturer issued a mandatory service

bulletin (SB) DES-353, on December 18, 2008,

for the affected assemblies. The SB required

that the units be returned to Ontic for inspection

and, if necessary, repair.

• The FAA issued an Airworthiness Directive

requiring examination of the affected

assemblies.

Probable Cause

The failure of maintenance personnel to

properly secure a fitting cap on the throttle

and metering assembly inlet after

conducting a fuel system pressure check,

which resulted in a loss of engine power due

to fuel starvation.

Contributing Factor

Contributing to the accident was the decision

by the Director of Maintenance to return the

airplane to service without verifying with the

assigned inspector that all annual inspection

items had been completed.

Probable cause

• Sundance Helicopters’ inadequate maintenance

of the helicopter, 8 including (1) the improper

reuse of a degraded self-locking nut, (2) the

improper or lack of installation of a split pin, and

(3) inadequate postmaintenance

inspections, which resulted in the in-flight

separation of the pilot servo control input rod

from the fore/aft servo and rendered the

helicopter uncontrollable.

80

Probable cause

• Contributing to the improper or lack of installation

of the split pin was the mechanic’s fatigue and

the lack of clearly delineated maintenance task

steps to follow. Contributing to the inadequate

postmaintenance inspection was the inspector’s

fatigue and the lack of clearly delineated

inspection steps to follow.

81

Probable Cause

The National Transportation Safety Board determined the probable cause of this accident to be:• oil exhaustion due to an improper oil

breather tube installation, which became plugged in flight due to frozen moisture build-up. The blocked breather tube then created a crankcase over pressure that caused a failure of the crankshaft seal. The rough, uneven terrain and strong crosswind were factors in the accident.

Probable Cause

The National Transportation Safety

Board determined the probable

cause of this accident as follows:

• The improper assembly of the

governor during manufacture.