Transport Canada

Transports Canada

Aviation Safety

Maintainer
Learn from the mistakes of others and avoid making them yourself . . . Issue 2/2004

Cross-Wired Side-Stick Almost Brings Down Airbus A320

The Airbus had just lifted off the tarmac when turbulence from the wake of another departing jet was encountered, and the left wing dipped down. The pilot immediately applied a right input to his side-stick controller, but the wing banked down even more. He re-corrected the wing-down moment with more controller input and the wing dipped to 21, coming close to one foot from the runway. The first officer (F/O) quickly recognized that there was a problem, and switched the control priority to his side-stick and recovered the aircraft. He then switched on the autopilot and set a climb to 12 000 ft where a handling check was performed. It confirmed that the captains side-stick was creating a reversed input. The crew returned and conducted a precautionary landing. Investigation of the incident revealed that as the technicians were troubleshooting and repairing the elevator and aileron computer (ELAC) system, they found a damaged pin on one segment of the four connector segments, with 140 pins each, on the rack side of the ELAC mount. The repair work performed by various technicians over several shifts involved a complete rewiring upstream of the connector pins. During this process, the polarity was inadvertently reversed on four wires in one connector segment. Two of the wires were for the roll control input and two were for the associated channel outputs. It is believed that the technicians correctly followed the wiring list but that this list can vary by aircraft serial number. Extreme care must be taken to match up the correct wiring list by tail-number (aircraft-affectivity). Since the ELACs are interchangeable from one aircraft to the other, it is thought that the issue of crossed-wiring has at its source the colour coding scheme of the wiring on the backside of the connectors on the rack to which the ELAC is mated. Before the airplane left the hangar to return to service, a flight control check was performed using the respective indications in the cockpit electronic centralized aircraft monitoring system (ECAM). The flight control check was limited to the F/Os side-stick. The fault got by at least two safety filters, as it was neither detected by maintenance nor at the pre-flight check. It is very fortunate that the incident did not lead to a crash, as there might have been insufficient evidence left to point to a connector/wiring fault. Crossed or reversed flight control cables continue to lead to crashes in conventional aircraft; however, it is deemed almost impossible in transport category aircraft. In these times of fly-by-wire technology, the risk is almost non-existent as long as the checks are performed judiciously at the maintenance and operational levels. In this instance, the captain and the F/O displayed remarkable adherence to cockpit resource management (CRM) principles and saved the day. Likewise, maintenance crews must go through the functional test procedures diligently each time that major work is performed on aircraft flight controls. The time spent double-checking each step of the procedures is well worth the effort in the recognition of a job well done on such complex and sophisticated systems. Keep up the good work!

TP 3658E
ISSN 0823-5538
1

The Safety Culture

Military organizations have a saying: There is only one way to do any task: the way that follows the rules and takes precautions against hazards. Good year or bad year, the ratio of aircraft accidents to hours flown stays pretty much constant, and since transportation needs and demands continue to rise, so will the number of accidents. It is estimated that air travel will double in the next two decades, when the airlines are expected to transport more than 2.5 billion passengers annually. At the rate things are going, it is predicted that there will be one large airliner accident per week by the year 2020. Can we afford to have public opinion turn against air travel; against all that we have worked for? We have made it one of the safest modes of transportation in the world. What can be done? A review of most accidents and incidents reveals that the cause was not so much the application of unknown principles that failed, but more often the result of a failure to apply well-known engineering practices. Technology alone cannot provide all of the solutions, as there will always be human factors and procedures that will affect safety management. As you have experienced, maintenance errors, just like equipment failures are somewhat predictable and manageable events, if monitored systematically. There is a worldwide commitment to reducing fatal accidents, but it is important that the industry undertake a program to reduce the number of maintenance errors, and mitigate the consequences of those that remain. How can the industry provide an environment where factors influencing maintenance errors can be addressed? Many believe that a safety management system (SMS) provides everyone with the tools necessary to do just that. Transport Canada and most international Civil Aviation Authorities encourage the use of such a system. To paraphrase the Flight Safety Director of a large Canadian charter company, Michael DiLollo, SMS equals to, Risks down, costs down, incidents down, quality up, trendsfavourable. Safety pays. More precisely, the time, effort and management discipline invested to improve safety translates into reduced costs. The cost-savings incurred by this company since the adoption of an SMS would make even an accountant dream of investing in air transport. The success obtained by this company in implementing SMS follows the International Air Transport Association (IATA) directives for members to work towards reducing accidents by 25 percent. It is a timely objective, as it arrives when air travel is just coming out of a time of trial and tribulation that has cost the industry plenty in financial and job losses, and needless to say in technological research and development investment losses as well. The effort required to implement an SMS means that it has to be a concerted effort, one that is carried through from the top down. Mr. DiLollo states that it has to be
2 Maintainer 2/2004

institutionalized, and I believe that he is right. If you review the mishaps incurred by your organization large or smallin the last year, you will recognize that most, if not all, were predictable, and therefore preventable. Mr. DiLollo states that, the company has to commit to conducting its operations efficiently and in a manner that ensures the safety of its employees, customers, suppliers and aircraft. The SMS must be used to systematically reinforce safety as a corporate and individual core value. This will be achieved best by adopting the philosophy that all incidents can be prevented; management is responsible for the prevention of incidents; all hazards can be safeguarded; training is essential; safety is good business; working safely is a condition of employment; safety and quality are interdependent; safe conduct will be recognized and rewarded. How do I apply it on the floor? First, you have to stick with the published rules, procedures and recommendations. They are, after all, well proven and can take most hazards out of your work. Second, try to report any safety issues that you may encounter and that may not have been documented or reported and that, to your mind, may pose a threat to safety. Discuss them with your superior and colleagues; keep notes and check to see that something is done. The changes have to take place in the workplace. Safety issues have to be documented and addressed. There has to be more communication in order to reduce risks. SMS is an educational process by which all involved learn and improve their performance through the experience of others. Make better use of checklists, adopt tool and accessory management programs, improve and ensure channels of communication, discuss human factors, ensure recurrent training, and everyone will benefit. SMS enables you to recognize the potential for errors in your workplace, and helps you establish defences to ensure that those errors do not result in accidents or incidents with ensuing losses for everyone. Mr. DiLollos company has adopted what it calls a Five S safety activity guide on the floor: to sort, straighten, sweep, standardize and sustain the effort. Think about adopting something similar. Do like the military and take all the precautions against hazards. Safety is a team effort that can be planned.

Transport Canada

Transports Canada

Letter to the editor

Mr. Steven McNabb writes about the parallel that often exists between seemingly mundane and recurring errors and tragedy in reference to the Concorde crash in issue 3/2003 in the article entitled Concorde Remember the Dirty Dozen. A brief synopsis of his letter follows. I think that linking the Concorde accident and the ValuJet accident can make a powerful point. The common failure mode in each was improper maintenance that was remote from the accident aircraft, yet resulted in catastrophic total loss. The Concorde accident stemmed from the maintenance errors or contraventions that were performed on the Continental DC-10. Persons involved likely assessed the errors or contraventions as acceptable risk-taking, or necessary violations, that would not endanger the DC-10, and were appropriate to facilitate meeting scheduling or other goals. The ValuJet accident stemmed from a maintenance error or contravention during the removal of oxygen generators on another airplane. The work cards required completion of tasks to make-safe each removed generator. Maintenance did not accomplish the make-safe tasks, but signed off the work cards anyway. Persons involved apparently assessed the make-safe tasks as being unrelated to the airplane under maintenance, and formed a belief that the incomplete tasks would not endanger that airplane. They apparently also formed the opinion that since the work was not related to approving the aircraft for return to service creating the misleading maintenance records was somehow acceptable, as it would not affect safety of the airplane undergoing maintenance. The unsafe oxygen generators found their way (by a dangerous goods violation) onto another airplane, resulting in the total loss accident. Both accidents were initiated by maintenance errors that seemed okay at the time as assessed by the persons involved. In both cases, the result was an accident to an aircraft other than the one being worked on. The subsequent events were just links in the accident chain: the certification weaknesses in the Concorde design and the transportation of dangerous goods violations that resulted in the oxygen generators getting on a scheduled flight. Steve MacNabb Risk management programs assist in identifying hazards as well as in structuring control measures to minimize risks. Identification and discussion of potentially hazardous conditions of work by individuals who are knowledgeable of the environmental conditions in which the work is accomplished can best lead to measures that will minimize risks and improve the overall efficiency of performance. Risk management cannot curtail hazards that are not identified by the preponderant (i.e. the technical expert), nor can it be successful if it is not supported by management. Therefore it is paramount for all involved to cooperate to get optimized results. Risk management is planning for the future, and it pays off. Ed.

The Aviation Safety Maintainer is published quarterly by Civil Aviation, Transport Canada, and is distributed to all Canadian licensed AMEs. The contents do not necessarily reflect official policy and, unless stated, should not be construed as regulations or directives. Letters with comments and suggestions are invited. Correspondents should provide name, address and telephone number. The editor reserves the right to edit all published articles. Name and address will be withheld from publication at the writers request. Address correspondence related to articles in this issue to: Editor: Serge Beauchamp Aviation Safety Maintainer Transport Canada (AARQ) Ottawa ON K1A 0N8 Tel.: 613 990-9495 Fax: 613 991-4280 E-mail: [email protected] Internet: www.tc.gc.ca/maint Reprints are encouraged, but credit must be given to the Maintainer. Please forward one copy of the reprinted article to the Editor.

Serge Beauchamp

Regional System Safety Offices Atlantic Box 42 Moncton NB E1C 8K6 506 851-7110 Quebec 700 Leigh Capreol Dorval QC H4Y 1G7 514 633-3249 Ontario 4900 Yonge St., Suite 300 Toronto ON M2N 6A5 416 952-0175 Prairie & Northern Box 8550 344 Edmonton St. Winnipeg MB R3C 0P6 204 983-5870 Canada Place 1100-9700 Jasper Ave. Edmonton AB T5J 4E6 780 495-3861 Pacific 3600 Lysander Lane Richmond BC V7B 1C3 604 666-9517

IN THIS ISSUE

Page

Scurit arienne Mainteneur est la version franaise de cette publication.

Agreement Number 40063845

Cross-Wired Side-Stick Almost Brings Down Airbus A320 . . . . . . . . . . . . . . 1 The Safety Culture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Letter to the editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Mechanical Happenings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Suspected Unapproved Parts (SUPs) Down a Bell 206B Helicopter One Casualty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Safety Chain BrokenLoss of Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Ben McCarty Wins Transport Canada Aviation Safety Award. . . . . . . . . . . . 8 Unscheduled Maintenance Costs to Airlines Can Be Horrific . . . . . . . . . . . 9 Take Five: Personal Minimums Checklists . . . . . . . . . . . . . . . . . . . . . tear-off
Maintainer 2/2004 3

Mechanical Happenings
The following aircraft incidents are a heads-up for aircraft maintenance engineers (AME). They focus on the maintenance outcome of the incident and do not include all of the facts of each incident. In most cases of component failures, it is assumed that a service difficulty report (SDR) was submitted, as it is a Canadian Aviation Regulations (CARs) requirement. AS350BAThe helicopter was in its initial climb phase after a normal take-off sequence, when suddenly all engine power was lost. The pilot immediately executed an autorotation in the only area available; it was slightly upslope and littered with rocks and dirt. Due to the low altitude for autorotation, the pilot was unable to prevent a very hard landing and serious injury to himself. As a result of an inspection of the engine by the U.S. National Transportation Safety Board (NTSB), investigators determined that the engine gas generator compressor turbine shaft had seized. The engine had been overhauled 61 hrs prior to the accident. The aft support bearing of the gas generator turbine shaft was found dislodged from the bearing support cage. Further investigation revealed that the circlip used to retain the bearing in the cage was not present and there was no evidence that it had been installed during the overhaul. The total loss of engine power was due, in this case, to the failure by the manufacturers repair station personnel to ensure that the engine had been assembled properly. Were check sheets used? Were the engine techs properly trained? How about inspection after assembly: could it be improved? Can anyone afford such accidents? A safety management system (SMS) would have helped identify any weaknesses in the system and

most likely would have prevented such a mishap. AS350BAThe helicopter had departed a helipad located on an offshore oil platform. The pilot was 3 min away from landing at a refuelling helipad situated offshore on another platform when he transmitted two distress calls indicating that he was going down. There were no witnesses to the accident and 9 min later the helicopter was found floating inverted in 3- to 4-ft swells. Shortly thereafter, it sank but was later recovered. Investigation found that there were no anomalies with the airframe and flight controls, but examination of the engine revealed that the first- and second-stage turbine blades were fractured due to extreme heating. One blade of the second-stage turbine disk had liberated from its retention slot, and all the blade roots and retention slots of this disk exhibited permanent outboard deformation due to a combination of centripetal forces from the engine rotation and from excessive heat. In contrast, the blade roots and the retention slots of the first-stage turbine disk did not exhibit evidence of deformation, most likely since they were located further away from the heat source. The rear bearing assembly located aft of the second stage disk was contaminated with coke. The coking suggests that oil was leaking from the engine and migrating from the rear bearing assembly. The aft side of the second-stage turbine disk displayed dark stain marks in the form of streaks. A passage exists that would allow oil to flow from the rear bearing to the aft face of the second-stage turbine disk. Oil that strikes the disk would flow into the hot stream of gases and auto-ignite, starting a fire. Oil migration in this engine can occur if the rear bearing scavenge and vent tubes

become blocked; however, in this case, these were checked and found free of contamination. AS350BAThe helicopter was on a ferry flight from the Elbow River Ranger Station, Alberta, to the Highwood Ranger Station with the pilot and engineer on board. The pilot noticed the engine chip light illuminate, and was preparing for a precautionary landing when he heard a loud bang, and the engine (Turbomeca Ariel 1B1) failed. In the ensuing hard landing from about 40 ft above ground level (AGL), the tail boom and the right-hand (RH) landing skid were damaged, but there were no injuries to the pilot or engineer. Maintenance reported that the engine had seized up. The Transportation Safety Board of Canada (TSB) will observe the engine teardown. Airbus 320 (SDR 20031223002) During the take-off run, numerous circuit breakers tripped on 121 V and 122 V circuit breaker panels and a burning odor could be smelled. The F/Os primary flight display (PFD), elevator and aileron computer (ELAC), reverser No. 2 and fuel pumps became inoperative. The aircraft was able to return for landing without further incident. Maintenance personnel investigated the deficiencies and found a loose Allen key that had fallen across the terminals of several circuit breakers and had welded itself to them. A total of 25 components had to be replaced. The entire electrical system had to be checked and verified for conformity. All systems were checked serviceable and the aircraft was returned to service. The adoption of a tool management training program will help lower the risks caused by foreign object damage (FOD). Beech King Air C90AThe aircraft was in cruise flight at flight level (FL) 220 en route

4 Maintainer 2/2004

from Winnipeg, Manitoba, to Prince Albert, Saskatchewan, when the crew heard a loud bang followed by a sudden severe tail vibration. The crew disconnected the autopilot and applied forward nose-down pressure on the control column in an effort to reduce the vibration. The crew declared an emergency and requested a diversion to Dauphin, Manitoba, 25 NM NE of their position. The aircraft landed safely. Maintenance personnel were dispatched and initial indications are that the left elevator trim tab actuator rod had failed in flight when it was subjected to excessive bending loads caused by a trim tab horn inner bushing seizure. It is recommended that the bolt securing the assembly be removed in order to allow for a complete inspection of the rod and rod end clevis, along with the trim tab horn and the inner bushing, at each inspection interval prescribed by the aircraft maintenance program. Bell 204BThe helicopter had departed on a smoke patrol in support of forest fire-fighting operations. The helicopter was established in cruise flight at 3 000 ft when, approximately 15 to 20 min into the flight, a banging noise was heard coming from the tail area, followed by a slow and smooth 30 yaw to the left. The pilot gently applied opposite pedal and was able to correct the yaw. The banging was not repetitive, but was heard as pedal was applied. The pilot landed the helicopter straight ahead in a swampy area. The helicopter landed without incurring further damage or injury to the occupants. An examination of the helicopter revealed that one of the tail rotor pitch link bolts (AN 174-15 or subsequent) was missing and that the pitch link was hanging free from the tail rotor horn, but still attached on the opposite end to the crosshead assembly. One, or both, of the tail rotors had

struck the tail boom several times in flight causing the banging noise heard by the pilot, and damage to the tail boom. The tail boom and tail rotor assembly are to be replaced in situ, but it could have been much worse. Bell 206BThe helicopter was approximately 1 000 ft AGL, on a reconnaissance flight over a forest fire in Alberta, when the engine (Allison 250-C20) decelerated to minimum idle speed. A forced landing was conducted onto a muskeg area adjacent to the fire and on touchdown the main rotor struck and severed the tail boom. The pilot and passenger were uninjured. The field investigation discovered that the compressor pressure (Pc) line from the engine governor to the fuel control unit had separated. Bellanca 17-30A Super VikingThe aircraft had just departed Runway 31 at Regina Airport, Saskatchewan, when the pilot noticed smoke in the cockpit, accompanied by a strong electrical burning odor and a complete loss of engine power. The pilot declared an emergency and turned off the aircrafts master switch to shut off all electrics. The pilot lowered the landing gear manually but was not able to make it back to the runway. The pilot set the aircraft down beside the runway, striking a drainage ditch during the landing roll. The main landing gear collapsed, but the pilot was able to exit the aircraft uninjured. A post-occurrence examination of the aircraft discovered that the exhaust stub on the back of the left muffler assembly had fractured and broken off, causing the tail pipe to detach. Hot exhaust gases were directed onto the wiring harness in the engine compartment that contained the engine magneto P leads. The wiring harness burnt and the P leads shorted out, effectively shutting off the engine. The inspection of the exhaust system is best performed with the unit assem-

bly removed from the engine. Its integrity, along with that of gaskets, the hold down nuts, studs and exhaust shrouds can then be confirmed. The time spent inspecting the unit is far less costly than a forced landing or severe injuries following such a failure. Boeing 727 (SDR 20040102001) The crew retracted the landing gear after takeoff and noticed that the nose landing gear light showed the gear extended. The pilot advised the tower that he was returning for landing and extended the gears with confirmation of no fault indication. He landed without incident. An inspection revealed that the nose landing gear lock-pin was still installed and had prevented the nose gear from retracting. The pin was removed and the aircraft was returned to service. The company has initiated changes to its preflight checklist procedures. Had the lock-pin been equipped with a red warning flag, it most likely would have been seen on the preflight check. Boeing 737 (SDR 20040115003) On arrival at the gate, the ground power unit was plugged in. When the auxiliary power unit (APU) bleed air and pneumatics were selected, the cockpit and cabin quickly filled with smoke. The captain then selected APU electrical and the first officer (F/O) contacted ground control to request emergency response services (ERS). The smoke then cleared. Maintenance was called and investigation seemed to indicate that the APU inlet had been contaminated earlier with de-icing fluid. The crew snagged the deficiency as per the minimum equipment list (MEL) and a ground run of the APU showed that the unit was serviceable. Flight monitoring of the APU and maintenance performance runs cleared the deficiency and the aircraft was returned to service with no further incidents to report.
Maintainer 2/2004 5

Suspected Unapproved Parts (SUP) Down a Bell 206B HelicopterOne Casualty

SUP-use in aircraft represents a definite and potential threat to the safety of flight. SUPs do not meet applicable design, manufacturing and maintenance requirements and every initiative must be taken to lower the inherent risk involved with their use. Civil aviation authorities grant approvals of aircraft parts and components strictly based on stringent reviews of design criteria, processes, quality control and organizational structure of the manufacturing facility. These approvals are subject to continual surveillance and inspection to ensure compliance with the conditions of approval. Standard parts, such as nuts and bolts are not specifically monitored by the authorities, but most conform to specific industry criteria. Standard parts can be tested for conformity and may be used in an aeronautical product only when specified in the type design. In the above-mentioned case, the pilot of a Bell 206B helicopter was conducting a 10-km positioning flight from one camp to another in the British Columbia interior. As he descended for his approach over surrounding trees, at a low forward speed and with low rotor inertia, the engine failed. The approach was cluttered with buildings, vehicles and equipment. The lower vertical fin of the helicopter struck a steel-pipe fence located near the threshold of the runway. The fuselage made contact with the hard surface in a nose-down, right-side low attitude, breaking off the skid gear and cross tubes. The helicopter swung around and came to a stop. Fire erupted, and before anyone could assist the pilot escape, the wreckage was consumed. The helicopter had no known deficiencies before the flight and was being operated within its load and centre of gravity limits. The last 100-hr inspection had been carried out 3 days prior to the accident. The fuel-fed fire destroyed the majority of the helicopter, except for the aft portion of the tail boom. The ignition source could not be determined. The engine and transmission were damaged by the fire, but remained relatively intact. A subsequent strip examination of these parts revealed that they were capable of normal operation. During the inspection of the engine, investigators found that one of the screws securing the cover of the fuel control unit, a Honeywell/Bendix DP-N2, p/n 2524644-29, was missing. A closer look revealed that the screw head securing the ratio-lever cover had separated and had been retained by a braid of lock wire. The O-ring providing a cover seal was found incomplete, as a section had burned away in the vicinity of the failed screw. Examination of the failed head and screw shank by the Transportation Safety Board of Canada (TSB) laboratory determined that the failure resulted from a phenomenon called hydrogen embrittlement cracking and that it had most likely originated during the initial manufacturing process
6 Maintainer 2/2004

of the fastener itself. The hydrogen probably originated from the cadmium plating operation, and was retained or not removed during subsequent baking treatments. When hydrogen is dissolved in steel, it promotes the creation of hairline cracks and a loss of ductility of the material. The TSB determined that the failed screw did not meet the strength specifications of the part drawing. The ultimate tensile strength of the screw was significantly greater than the maximum specified. Four additional screws of the same type were recovered from the fuel control unit and did not conform to the strength specifications. The failed screws and the other screws used for fastening the cover of the fuel control unit were all unapproved parts. The fuel control manufacturer was able to establish that these fasteners had been installed at their overhaul facility on the west coast and came from a large bulk purchase from a parts supplier. Examination of more sample screws from this shipment indicated that the entire lot did not conform with the screw drawing requirements for heat treatment, marking of an X on the head and pitch diameter shank dimensions under the screw head. When a bench test of the fuel control unit was conducted with one of the screw heads missing, it began to leak when the fuel flow reached about 177 pounds per hour (pph). When the leaking started, the fuel flow decreased to 111 pph and at that fuel flow, the manufacturer of the engine determined that the engine was only producing about 101 horsepower. After the crash, a number of low-energy signaturesindicative of low main-rotor RPM (revolution per minute)were observed on the wreckage and in the impact area. The fuel leakage was sufficient to decrease the output of the engine below that required for sustained flight. It is believed that the failure of the fuel control unit ratio-lever cover during the flight would have resulted in a sudden spray of fuel into the engine compartment, producing a strong jet fuel smell in the cockpit through the cabin heater ducts. It is probable that the pilot carried out an immediate autorotation landing, but because the cluttered area available to him did not allow for a glide to a clear area, he may have tried to stretch the glide and impacted the top of a fence with the lower vertical fin of the tail rotor near the landing area. He was not wearing a helmet at the time and may have been temporarily immobilized by the initial impact. He was unable to exit the damaged helicopter in time, and lost his life. The Transport Canada SUP program needs your help in its quest to ensure the continued airworthiness of aircraft. Be alert! Inspect all parts for conformity to the type design before installing them on an aircraft or aeronautical component. Report SUP using the Service Difficulty Reporting (SDR) Program form.

Safety Chain BrokenLoss of Aircraft

Would a personal minimums checklist have helped in this case? On January 8 2003, a BE1900D crashed shortly after taking off from the Charlotte-Douglas International Airport in North Carolina. The aircraft was observed climbing at an extremely high angle of attack, and then it stalled at an altitude from which a recovery was impossible. Impact forces were violent and fire destroyed the aircraft. A review of the flight data recorder (FDR) information allowed investigators to determine that, following a maintenance action performed two days earlier, nine flights had been undertaken. From the time the maintenance was completed, the pitch control sensor noted a 10-down shift on all flights. This meant that in cruise flight, the aircraft elevator control had to be trimmed 10 nose-down, instead of near the zero-degree reference. On the fatal flight, during the take-off phase, the FDR registered a full nose-down pitch control indication during ascent, and movement in the nose-up direction during the descent. Insufficient altitude attained at this point precluded any safe recovery of the aircraft and the crash was fatal to all on board. What maintenance action could have caused such a pitch change? Investigators were able to recover the elevator control system cables, elevator control rods, bell cranks, and elevator counter balance weights, all intact, from the wreckage. Examination of the elevator control cables revealed that the turnbuckle on the down elevator cable was offset to nearly full extension and the turnbuckle on the up elevator cable was near the fully retracted position, a difference of 1.8 in. The turnbuckles are used to set cable tension and are typically adjusted to about the same length. Through ground tests, which included a series of control column sweeps to collect data on the movement of the elevator and various cable tensions and turnbuckle lengths used during testing, investigators were able to reproduce similar conditions and obtain results that confirmed that the BE1900D had sustained a failure of its flight controls in pitch because of the incorrect rigging of the elevator control system. The extent of the loss of pitch control was further compounded by the airplanes centre of gravity that was substantially aft of the certified limit. The accident occurred at the most crucial stage of flight and presented the most dangerous situation that a crew may be faced with; loss of elevator control authority following takeoff with an aft centre of gravity moment past maximum. This accident shows how important it is for everyone involved in the safety chain to do their jobs properly, said U.S. National Transportation Safety Board (NTSB) Chairman, Ellen EnglemanConners. It is imperative that the recommendations weve issued today be

Same aircraft type as in accident.

implemented so that tragedies like this not be repeated. Civil aviation authorities do the utmost to assist operators in structuring their flight operations and maintenance organization in a way that accidents risks are minimized, if not almost ruled out completely. Once this system is in place, the daily responsibility of maintaining the high level of consciousness of the professional values necessary to maintain this level of safety rests with each individual team member. Investigators found that the accident airplane entered a maintenance check with an elevator control system rigged to achieve full elevator travel in the downward direction. However, the airplanes elevator control system was incorrectly rigged during maintenance, and the incorrect rigging restricted the airplanes downward elevator travel to about one-half of the travel specified by the airplane manufacturer. Air Midwest had contracted the services of "a FAA Approved Repair Station (AMO)." This organization was to supply the quality assurance, inspectors, parts personnel, site manager and mechanics in order to meet the carriers maintenance requirements. The NTSB investigation revealed that the mechanic was not properly trained and had no previous experience on the BE1900D airplane. On the night that the elevator control rigging was performed on the BE1900D, the inspector was training the mechanic for the first time. He also had to carry out multiple tasks on other aircraft. The inspector had worked a total of 44 hr in the three days prior to the release of the aircraft. He reported that he had suffered from a cold and had taken cold medicine in the days prior to the shift when the work was performed. Do you think that fatigue could have influenced the way that the inspector performed his work? How often are you put in a similar situation? On January 6, two days prior to the crash, the mechanic who carried out the work was confronted
Maintainer 2/2004 7

with his first BE1900D Detail 6 inspection. He said that when he was assigned the task, his on-the-job log was not signed off for the task, as he had never received any on-the-job training for it. He confirmed that he had previous rigging experience on other aircraft and had expected that rigging of the BE1900D would present no major hurdle. He felt that he was properly trained to accomplish this task. History would prove him wrong. When he was asked whether he felt that he was properly overseen during the task and he replied, When I needed help, there was somebody around. The foreman reported assigning the mechanic the responsibility of the rigging based on the mechanics past experience of this task on other types of aircraft. The foremans responsibilities did not include training mechanics. He worked 15 hr during the shift in which the accident aircraft was in the hangar. The least this foreman could have done was review the rigging procedures, as spelled out in the current BE1900D manual, with the mechanic. Maintenance procedures and human factors have to be taken into consideration in order to reduce risk. In hindsight, can we not say that most maintenance errors that weve experienced were predictable, and therefore preventable? Would it have helped the mechanic to use a checklist? The NTSB faulted the U.S. Federal Aviation Administration (FAA) for lack of oversight of the work being performed at Air Midwests maintenance facility in Huntington, Virginia. Serious deficiencies of Air Midwests maintenance training program had been found and it lead to the accident aircraft maintenance check. The mechanic lacked the knowledge and he failed to communicate his need for assistance. How easy it is to be put in such a position and react in a similar manner today, when there is constant pressure to perform, and communication may be interpreted as a sign of weakness? The AMO that was contracted to do the work had a high personnel-turnover rate, which may have played a role in the hiring of a mechanic who was not duly certified to perform the Detail 6 inspection on the BE1900D.

The air carrier is ultimately responsible for the maintenance of its aircraft and, although it did transfer the performance of the maintenance to a third party, it still had to ensure sufficient oversight to ensure compliance with the norms. We can address several administrative issues such as quality assurance, inspection, training, employee selection, maintenance processes, company policies, enforcement of the norms, but the end results will always be the same when an AMO fails to adopt sound administrative principles based on safety first. A safety management system (SMS) has to serve as the basis for all administrative structures in the air transport industry. What could have prevented such a tragedy? Accidents are more complex than you might think. How often do you think of the many human factors that come into play before you set out to perform a task? Is everyone around you as keen on ensuring that the work is carried out in the best possible manner, every time? What would you think of the idea of consulting a list of factors that could influence the outcome of a task? If this list would spell out things that you should know or organize before you set out on the floor or before you proceed to your workbench, would you consult it every time? The maintenance of aircraft and of their complex systems is a critical business and you have to use all available resources to assist in achieving the quality-level necessary for safety. With this objective in mind, System Safety has borrowed an idea from the FAA. We believe that it will help you achieve your goal. At the end of this issue of the Maintainer, you will find a personal minimums checklist in the form of a tear-out. We believe that it should be part of your toolkit, as it is just as essential as any tool to ensure that a job is done to perfection. Take a look at it, as it lists things to review before and after a maintenance job; the minimums that is! A personal minimum checklist will assist you in your work. Use it for performance, efficiency and safety.

Ben McCarty Wins Transport Canada Aviation Safety Award

Mr. Ben McCarty was awarded on April 20, 2004, the 2004 Transport Canada Aviation Safety Award, for his commitment to accident prevention. Over a 30-year period, Mr. McCarty has had a profound impact on how we approach aviation safety in Canada, said Transport Minister Tony Valeri. His contribution and influence in aviation safety is both significant and constant, resulting in a safer and more efficient aviation system in Canada. The award was presented to Mr. McCarty at the 16th annual Canadian Aviation Safety Seminar in Toronto. The Transport Canada Aviation Safety Award was established in 1988 to foster awareness of aviation safety in Canada and to recognize people or organizations that have contributed to this objective in an exceptional way.
8 Maintainer 2/2004

Deputy Minister Louis Ranger (left) congratulating Ben McCarty.

Unscheduled Maintenance Costs to Airlines Can Be Horrific

Leading edge failure in flight: cost $50,000. Fluorescent trail marker ribbon and masking tape: cost $0.10. Every year, countless airlines have to cancel flights because of issues related to unscheduled aircraft maintenance. These flight disruptions cost airlines millions each year in unplanned losses. They lead to delays, flight cancellations, flight diversions, passengers missing connecting flights, cargo not delivered on time, crew rescheduling and numerous ancillary losses. These losses are in addition to landing and parking fees, aircraft operating cost, unplanned aircraft maintenance and personnel scheduling, parts cost, rerouting of passengers and cargo relocation. A diversion to an alternate airport because of a maintenancerelated issue affects the airlines passenger goodwill, as well as the appreciation of your professional status, and may even affect your job security. Case in point. A DeHavilland Dash-8 aircraft was brought into the hangar for a nose-steering problem. At the same time, someone decided to assign additional work to the aircraft in order to streamline the aircrafts maintenance schedule and improve aircraft dispatch. One of the items consisted of a check of the wings de-icing system. As the crew chief was busy on another aircraft, the maintenance supervisor bypassed the chain of responsibility and assigned the work to the maintenance personnel that was on the floor. The task was assigned to a senior apprentice who first removed the No. 4 leading edge of the right wing to provide access to the heaters in the wings. Screws and PRC sealant secured the leading edge of the wing and, although the screws were removed, the PRC still held it securely in place on the ground. As the apprentice moved to the other wing, he failed to flag the right wing to warn of the outstanding maintenance. As he proceeded to the left wing No. 4 leading edge segment, he received assistance from an apprentice who was on the other shift; the afternoon shift. Together they removed the screws, the PRC sealant and they gained access to the leading edge heaters. They performed the functional check and reinstalled the screws on the top part of the wing only. The first apprentice arrived at the end of his shift and handed over the screws to the other apprentice who was staying on to complete the work. This individual finished sealing the top of the wing and moved the work stand to the right wing to complete that job. Neither of the two apprentices had installed the screws or sealed the bottom part of the wings leading edge. As this second apprentice set up to work on the right wing, he was called away to the ramp, but left the screws taped to the leading edge. The night shift arrived at around 19:30 and waited for the apprentice to return so that they could get feedback of the work in progress. When this apprentice returned, he informed the night shift crew that that the left wing had been completed. They then proceeded to install the screws on the No. 4 leading edge of the right wing. It is possible that the heaters of that wing were never checked. A functional check of the leading edge anti-ice system was performed and the aircraft was released for return to service as a hot spare. At this point, it is believed that the screws for the left wing leading edge segment had not been installed. Eight members of the maintenance staff were involved in this task. The aircraft departed on a scheduled flight and as it rotated in the take-off sequence, 38 in. of the leading edge skin and the deicing boot assembly came off the left wing. The crew felt a

vibration and believed that they had had a bird strike. Soon after, air traffic control (ATC) reported foreign object damage (FOD) on the runway following the aircrafts departure. The runway was closed and the missing wing section was recovered. Meanwhile, the crew safely returned the aircraft for landing. Investigation revealed that the lower attachment screws had not been installed and that inspection had failed to observe the discrepancy. If there been a procedure in which work cards were used to report that each step of the job had been completed, inspected and signed off, the risk of such an occurrence happening would have been lower. The maintenance system and maintenance personnel failed. It is hoped that this company adopts a safety management system (SMS) that includes a maintenance error management program. This should assist them in identifying all of the factors that came into play during this event and prevent them from ever happening again. We are all responsible for safety; it has to be foremost in our mind when we set out to perform maintenance on these complex aircraft and systems. Costs of unscheduled maintenance are horrific. Can we afford to go on and be part of this when all that is required is a little more care? Be part of the solution, not part of the problem.

Maintainer 2/2004 9

V F ... i E KE TA
for safety
Five minutes reading could save a life

PERSONAL MINIMUMS CHECKLISTS Before the Task

Do I have the knowledge required to perform the task? Do I have the technical data required to perform the task? Have I performed the task before? Do I have the proper tools and equipment required to perform the task? 5Have I had the proper training required to support the job task? 6Am I mentally prepared to perform the job task? 7Am I physically prepared to perform the job task? 8Have I taken the proper safety precautions to perform the task? 9Do I have the required resources available to perform the tasks? 10- Have I researched the Canadian Aviation Regulations (CARs), Airworthiness Directives (AD), Service Bulletins (SB), and Service Difficulty Reports (SDR) to ensure compliance?
1234-

After the Task

Did I perform the task to the best of my abilities? Is the result of the job task performed equal to or better than the original design? 3Was the job task performed in accordance with appropriate data? 4Did I use all the methods, techniques, and practices acceptable to the industry? 5Did I perform the job task without pressure, stress and distractions? 6Did I re-inspect my work or have someone inspect my work before returning the aircraft to service? Have the required "Independent Checks" of affected controls been accomplished and recorded? 7Did I record the proper entries for the work performed? 8Did I perform the operational checks after the work was completed? 9Am I willing to sign off for the work performed? 10- Am I willing to fly in the aircraft once it is approved for the return to service?
12Adapted from Aviation Safety Program, FAA

u
10 Maintainer 2/2004

Transport Canada

Transports Canada

qwewrt