Saturday, July 1, 2006
SAFETY CASE STUDIES
COCKPIT DOOR MELTDOWN
Heat damaged wiring in the doorframe, above the locking solenoid of the cockpit security door, was discovered in post-incident examination of a World Airways MD-11.
The door had sustained damage during cruise on a flight from Japan about 950 miles southwest of Anchorage, Alaska, on April 28, 2005, and diverted to Ted Stevens International Airport there with a declared emergency. Smoke was filling the cockpit. The National Transportation Safety Board (NTSB) has only recently released details of the incident.
The inspection of the cockpit security door by the NTSB revealed that an excess length of wiring, which provides power to the electrically locking security door, was laying atop the metal-encased, unshielded solenoid inside the doorframe. Several of the wires were encased in anti-chafing mesh. A portion of the mesh was melted and had the smell of burned plastic.
A mechanic told the NTSB that he had seen similar doors overheat when the door and frame were misaligned and the locking bolt could not extend fully.
The security door installation does include a warning light that illuminates in the event that the solenoid does not shut off. The crew did not report seeing the warning light.
Federal Aviation Administration (FAA) Advisory Circular (AC) 65-15A covers generally accepted procedures for the installation and maintenance of aircraft electrical wiring. Regarding slack on wire bundles, the AC states, "Single wires or wire bundles should not be installed with excessive slack," and further that "All wires and wire groups should be routed and installed to protect them from high temperature."
This is one of a number of inflight emergencies caused by electrical malfunctions of the locking security doors installed on jetliners in the wake of the 9/11 terrorist attacks. (For more, see www.ntsb.gov/ntsb/brief.asp?ev_id=20050518X00630&key=1)
ELEVATOR TRIM RIGGING ANOMALIES
Two Transport Canada maintenance inspectors carrying out ramp inspections last fall came across several Cessna 208 (Caravan) aircraft that had anomalies in the elevator trim rigging.
The aircraft had not all been maintained by the same organization, which led the inspectors to believe that the issue they found was more widespread than just the aircraft they inspected. The concern was the connection of the elevator trim control pushrods to the elevator trim tab horns. It was noticed that, in some instances, washers had been added to the bolt/bushing stack-up (highlighted in the attached illustration, below), which removed the required endplay on the assembly.
The lack of endplay bound the pushrods to the trim tab horns, stopping them from pivoting freely, which could lead to eventual failure of the horns or pushrods.
Discussion with approved maintenance organization (AMO) personnel on site revealed that adding washers was an attempt to remove the "slop" (side play) in the assembly. However, some side play is required in this design to prevent binding.
When properly installed, as per the manufacturer's instructions, each pushrod will have approximately 1/8 inch side play on the trim tab horn. In this instance, as elsewhere, the pertinent manufacturer's instructions should always be referred to for the identification of required parts and their proper assembly. (From
FUEL LEAK FROM HUMAN ERROR
This is a case of a combination of errors that led to a fuel leak, one that was noted by other pilots and air traffic control who observed takeoff, but that was not detected by the pilots of the aircraft involved. Fortunately, takeoff of the Air Canada A330 was in daylight and clear weather, and the fuel leak was unmistakable to witnesses who saw the aircraft (see photo).
The airplane returned to the field, shut down, and eventually (after no observed danger of fire) was towed to a gate, where the passengers were deplaned.
The November 6, 2003, incident is documented in a Transportation Safety Board (TSB) of Canada investigation, just published, and it shows the pitfalls of human error in maintenance.
The day before the incident flight, technicians found fuel leaking from the Number 2 engine, and they traced the source of that leak to the air/oil heat exchanger, where air is used to cool the oil.
The airplane was removed from service for corrective action. At this point, things started to go awry. The notation on the maintenance office duty board incorrectly called for a fuel/oil heater exchanger replacement, not an air/oil heat exchanger, which had been written in the aircraft logbook. As a result, the three-man team assigned to the task was told incorrectly to replace the fuel/oil heat exchanger.
To their credit, the technicians reviewed the air/oil heat exchanger write-up in the logbook, although the elected to check the fuel/oil heat exchanger first.
They were unfamiliar with the style of coupling used, and they did not refer to the troubleshooting manual (TSM). The three bolts attaching the inlet coupling were tightened to the correct torque, but they failed to first threat the bolts through a retainer, which had slipped down the fuel line (see illustration). They also did not record removal or reinstallation of the fuel line to the fuel/oil heat exchanger.
The TSB report issued the following findings:
As to causes and contributing factors:
1. Because of an incorrect entry on the maintenance office duty board, and because technicians did not follow the TSM, they unnecessarily removed the low-pressure (LP) fuel line from the fuel/oil heat exchanger.
2. Because the technicians were unfamiliar with the coupling, due to the retainer hidden from view, and because they did not refer to the aircraft maintenance manual (AMM), the technicians did not properly reconnect the LP fuel line.
3. Upon application of take-off power, the fuel pressure, the fuel flow rate, and engine vibration caused the fuel/oil heat exchanger LP fuel line to detach, causing a substantial leak from the No. 2 engine.
Findings as to risk:
1. A high-power engine run was not performed by the operator (nor was one required by the engine manufacturer), which would have produced conditions similar to those that caused the LP fuel line to detach from the fuel/oil heat exchanger on takeoff. A high-powered engine run could decrease the risk that a leak or mis-installed component would go undetected.
2. Correct inspection of the fuel/oil heat exchanger would require the use of an elevated platform both prior to and after the actual engine run-up. A proper inspection of the LP fuel line connection was not accomplished after the engine run-up, increasing the risk that a leak or mis-installed component would go undetected.
3. The operator had not implemented Airbus Service Bulletin (SB) A330-28-3080. Implementing this SB would reduce the risk that a fuel leak could go undetected, leading to fuel exhaustion, engine failure, or fire.
1. The removal and re-installation of the fuel/oil heat exchanger LP fuel line was not documented, as required by the operator's maintenance policy manual and Transport Canada regulation.
It should be noted that without the retainer, it is nevertheless possible to affix the fuel line to the fuel/oil heat exchanger with the correct torque on the mounting bolts, so achieving the correct torque is not of itself sufficient to assure that the assembly is made up properly.
It should also be noted that the SB was generated in August 2001 after an Air Transat A330 made an emergency deadstick landing in the Azores as a result of a fuel leak. One would think that experience would have been enough to prompt all A330 operators to pay close attention to the SB. Air Canada has since incorporated the SB into all its A330s. In addition, the carrier issued a maintenance alert, which stated, in part, to its technicians:
"It is imperative that you always consult the appropriate Technical Publications, AMM/TSM, etc., especially in cases where you are not familiar with the aircraft, systems or engine and to follow the specified instructions for maintenance and/or troubleshooting."
Among Transport Canada's responses to the investigation, these may be salient:
More precisely, non-standard maintenance practices and human factors breakdowns contributed to the incident. There lies the lesson. (For the complete TSB report, see (link).
MAKE THEM EQUAL
Based on the crash of a Convair 580, the National Transportation Safety Board (NTSB) concludes that "fuel transfer can occur if (the) airplane is operated with different fuel boost pump output pressure settings ..."
The airplane, owned by Air Tahoma and operated as a DHL Express cargo carrier on a flight from Memphis, Tenn., crashed about a mile short of Cincinnati/Northern Kentucky International Airport. The first officer was killed and the captain received minor injuries.
In addition to the captain's inadequate procedures, the Board noted that the airplane's "changing handling characteristics were caused by a fuel imbalance."
The Board said, "Although operating the Convair 580 with different fuel boost pump output pressure settings does not in itself create an unsafe operating condition, the Board notes that crossfeed valves are not monitored and that the only indication that these valves are open is the switch position in the cockpit ... if an airplane operates with different fuel boost pump pressure settings and with the crossfeed valves unintentionally left open, a large amount of fuel can transfer from one tank to another in a short period of time, possibly causing structural failure or fuel overflow."
Accordingly, the Board recommends that Convair 580 operators be required to set the boost pump outputs to the same setting. (See www.ntsb.gov/recs/letters/2006/A06_41.pdf)
GUIDANCE NEEDED RETURNING A GROUNDED AIRCRAFT TO SERVICE
"We're declaring an emergency now," reported the first officer to air traffic control, an agitated tone to his voice. At about this time, investigators determined that the airplane's rate of descent increased to 10,000 feet per minute, or roughly two miles per minute. The Learjet 24B impacted the California hills in a near-vertical descent.
There wasn't enough left of the first officer to obtain a tissue specimen for purposes of a toxicological examination for alcohol or other performance-impairing drugs (a sample was recovered from the captain's remains, and it tested negative). The two pilots were the only ones killed; the aircraft was en route to pick up a passenger (or passengers; the number of people is not clear).
The National Transportation Board (NTSB) recently issued its report on the December 23, 2003, crash. Its May 2006 report concluded with the frustrated declaration that "the probable cause of this accident was a loss of airplane control for undetermined reasons."
To be sure, the NTSB did not have much to work with. The airplane was not equipped, and was not required to have, either a cockpit voice recorder (CVR) or a flight data recorder (FDR). The wreckage was confined to a crater measuring 43 x 73 feet and about 24 inches deep, but even though components could be identified, no system continuity or functionality could be determined from the shivered remains. About the only thing that could be determined was that the aircraft was not brought down by electrical arcing: "An examination of the electrical wire components revealed that some of the wire bundles sustained fire damage but that none displayed molten metal or fused components, which would have indicated a shorted condition."
Significantly, no maintenance logbooks from April 1999 until the time of the accident were available; at least, they were not provided to the NTSB.
The airplane's left battery was replaced immediately before the accident flight, but "no maintenance endorsement was provided for this work."
NTSB investigators were able to determine that the right engine flamed out twice during November 2003 flights, but the cause could not be determined. Here is where the NTSB report is particularly interesting:
"According to the Riverside Flight Standards District Office (FSDO), an airworthiness inspector followed up on the airplane's engine issue and asked Pavair [the owner/operator] to provide him with the airplane's maintenance records. Because Pavair did not [provide the records, the inspector] placed an aircraft condition notice on the airplane on December 12, 2003, that indicated the following:
`Operation of this aircraft may be in violation of [Federal Aviation Regulations] ... The airplane owner is asked to provide for review to the Riverside FSDO: 1. Aircraft maintenance records for the past 2 years [and] 2. List of complied ADs [airworthiness directives]. Owner shall provide the data for review no later than 12/29/2003.'
"On December 23, 2003 (the day before the accident), JETT [Jet Executive Transport Technologies, the maintainer of the aircraft] maintenance personnel tried to contact the airworthiness inspector who had placed the condition notice on the airplane. He was not in the office, so they spoke with another Riverside FSDO airworthiness inspector. According to this inspector, JETT reported (on behalf of Pavair) that it had complied with the limitations of the condition notice; therefore, he verbally released the airplane for operations. However, the investigation revealed that Pavair's maintenance records were never fully received by the Riverside FSDO."
The investigation offered neither findings nor recommendations, but it did include a statement from Member Kathryn Higgins, which bears extensive quotation:
"I continue to be concerned about the criteria used to grant, oversee, and revoke a part 135 operating certificate and the criteria used to determine which entity then operates under a new certificate. In this case, there were several entities involved in ownership, operation, maintenance, and control of the accident aircraft: Pavair Inc.; XtraJet, Inc.; American Air Network (AAN); and Jet Executive Transport Technologies (JETT). According to information in the docket, those various entities in some manner had responsibility for the aircraft; the pilots; pilot training; maintenance and maintenance records; and scheduling of aircraft, aircraft maintenance, and crew. ...
"Ultimately, the FAA revoked the part 135 operating certificate of AAN, a self-described `part 135 management company' for failure to retain operational control of the aircraft listed on its operations specifications. The accident airplane was owned by Pavair but operated by AAN until a few weeks before the accident. ... If the inability to exercise sufficient operational control is significant enough to warrant emergency revocation of an operating certificate, I question why and how the same people, without additional training or demonstration of competence, would be able to exercise appropriate operational control of a company under a new part 135 certificate.
"According to the information in the NTSB docket, there were at least four seemingly independent entities, but more accurately intertwined operations, touching the airplane and its day-to-day operations. And, unfortunately, it is still not clear to me how the FAA screens and subsequently oversees these types of enterprises. ...
"When Pavair did not provide the [maintenance] records, the airworthiness inspector placed an aircraft condition notice on the aircraft, effectively grounding the aircraft ... Based only on the verbal assertions of the third party that maintained the aircraft claiming that the conditions had been satisfied, a different inspector from the Riverside FSDO released the airplane for operations on the morning of the accident. Not only were the records never reviewed by the FAA, they were never provided for review.
"While there are written procedures for issuing a condition notice, there is little guidance for inspectors to follow in releasing the condition notice and returning a grounded aircraft to service. The condition notice is intended to ensure that the aircraft is in a condition for safe operation - or it does not fly. Without review of the records, the second inspector could not make that determination and the good work of the first inspector was negated. Additional guidance within the FAA governing the release of planes grounded with a condition notice is clearly needed." (From www.ntsb.gov/publictn/2006/AAB0604.htm)