Safety Alert: The Human Component in a Mechanical System
•Transferir como PPTX, PDF•
6 gostaram•973 visualizações
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (19)
Destaque
Destaque (17)
Semelhante a Safety Alert: The Human Component in a Mechanical System
Semelhante a Safety Alert: The Human Component in a Mechanical System (20)
Mais de FAA Safety Team Central Florida
Mais de FAA Safety Team Central Florida (20)
Último
Último (20)
Safety Alert: The Human Component in a Mechanical System
- 1. The Human Component in a Mechanical System 1 Kristi Dunks Senior Air Safety Investigator
- 2. Overview • The NTSB • General aviation safety • Identifying risks/hazards • Case studies 2
- 3. Who is the NTSB? • Promotes transportation safety • Investigate for probable cause • Issue safety recommendations • Promotes safety improvements • Multi-modal: Aviation, highway, marine, railroad, pip eline, HAZMAT • Small federal agency
- 4. General Aviation Safety • 1,466 GA accidents in 2011 • 271 fatal accidents resulting in 457 fatalities • NTSB working with FAA, AOPA, EAA, and others to improve GA accident rate
- 5. Risk/Hazard Identifier • People • Actions • Resources • Environment
- 6. Physical Size Age Strength The Five Senses Physiological Health Nutrition Lifestyle Alertness/fatigue Chemical dependency Psychological Knowledge Experience Training Attitude Emotional state Psychosocial Interpersonal relations Ability to communicate Empathy Leadership People
- 7. Physical Weather extremes Location (in/out) Workspace Lighting Sound levels Housekeeping Safety issues Organizational Personnel Supervision Labor - management Size of company Profitability Job security Morale Corporate culture Safety culture Environment
- 8. • What do you need to know? • What skills are necessary? • Steps to perform a task • Sequence of actions • Communication requirements • Information requirements • Inspection requirements • Certification requirements Actions
- 9. • Technical documentation systems • Test equipment • Enough time • Enough people • Lifts, ladders, stands, seats • Materials • Portable lighting, heating, cooling • Training Resources
- 10. Case Study • Cirrus SR 22 • VMC prevailed • March 19, 2010
- 11. History of Flight • Buchanan Field, Concord, California, to Renton Municipal Airport, Renton, Washington • Departed at 1540 • Accident occurred at 1910
- 12. History of Flight • 1906:51 pilot transmitted “Mayday, Mayday, Cirrus N4GS” • “I’m west of Strom airport, trying to make the field.” • Wreckage located 2.5 west-northwest of Strom Field Airport
- 17. Cirrus Airframe Parachute System • Rocket motor and deployment bag remained connected to parachute • Activation handle found seated in the handle holder • Enclosure cover found 15 feet from wreckage • Consistent with activation due to impact forces
- 20. Engine Examination • Examined at Teledyne Continental • Engine test run • Fitting cap installed finger tight • Engine operated normally
- 21. Fuel Line Caps
- 24. Last Annual Inspection Entry
- 25. Annual Work Order Entry
- 28. Maintenance Personnel Interviews • Three mechanics worked on airplane, two IAs and one A&P • Another Cirrus SR22 in facility • Rushed to complete work • Performed fuel pressure check • Final checklist items incomplete
- 29. Findings • Engine lost power during cruise • Fitting cap for throttle and metering assembly inlet found uninstalled • Engine operated normally following accident • Maintenance was performed that required cap to be removed • If cap had been properly torqued it would have remained secure
- 30. Findings • Director of Maintenance signed off annual inspection on work order • Assigned IA indicated he had not completed the annual inspection • Maintenance records incomplete • If final checks completed, cap would have likely been identified
- 31. Risks/Hazards: People, Actions, Resources, and Environment How could this accident have been prevented? 31
- 32. Case Study 32 • Eurocopter AS350 B2 • December 7, 2011
- 33. Initial Information • Sightseeing tour from Las Vegas to Hoover Dam • Normal departure - VFR • Calm wind, good visibility • Standardized route 33
- 34. Flight Path Las Vegas Airport To Hoover Dam Accident site Sudden climb and turn Path approximate and not to scale, for visualization only Flightpath Tour route Flightpath
- 35. Sequence of Events 35 Hoover Dam Sudden climb and turn 3100 feet, 90° off course Path approximate and not to scale, for visualization only Steep descent and crash site
- 37. Preflight Sequence 37 • 100-hour maintenance inspection • Replaced fore/aft servo • Flew check flight • 2 tour flights • Accident on third tour flight • 3.5 flight hours after maintenance
- 38. View of helicopter components 38 Main rotor assembly Cockpit and cabin Input rod and fore/aft servo
- 39. Initial Findings • No evidence of non-standard flight • No evidence of bird strike • Altitude clear of terrain/obstacles • Weather not a factor 39
- 40. Input rod and servo 40 Servo body Lugs Input rod
- 41. Maintenance • 100-hour inspection • Replacement of the following: • Engine • Fore/aft and tail rotor servos 41
- 42. Fore/Aft Servo Installation • Fore/aft servo replaced • Fore/aft servo installation procedures: • Assess hardware • Connect servo to input rod • Torque nut • Install split pin • Inspect installation 42
- 43. Hardware Input rod hardware Hardware installed 43 Fore/Aft servo with Ice Shield Input Rod
- 44. Self-Locking Nut Acceptable Nut Degraded Nut 44
- 45. Hardware Reuse • Fleet inspection of 13 helicopters, half of nuts did not meet requirements • Manufacturer’s guidance: “If a nut can be easily tightened, it is to be discarded” • FAA guidance: “DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values” 45
- 46. Bolt Loss Scenario 46 • Two locking devices • Self-locking nut • Split pin • Self-locking nut most likely became separated from bolt
- 47. Postmaintenance Inspection and Check Flight • Mechanic and inspector completed inspection • Helicopter check flight conducted • Hydraulic belt tension • No flight discrepancies 47
- 48. Maintenance Errors • Improper securing of the fore/aft servo • Improper tension of the hydraulic belt • Incomplete maintenance inspection 48
- 49. Maintenance Personnel Fatigue • The mechanic • Recent sleep and wake activity • Shift change • Inadequate sleep 49
- 50. 50 Maintenance Personnel Fatigue • The inspector • Recent sleep and wake activity • Shift change • Long duty day
- 51. Maintenance Personnel Fatigue 51 Personnel Normal Shift Shift Originally Scheduled for December 6 Actual Schedule on December 6 Mechanic Noon to 11:00 pm Off duty 5:50 am to 6:46 pm Inspector Noon to 11:00 pm Off duty 5:31 am to 6:55 pm
- 52. Maintenance Personnel Fatigue • Effects of fatigue • Difficulty sustaining attention • Memory errors • Lapses in performance 52
- 53. Human Factors Training • Causes of fatigue, its effects, and countermeasures • Fatigue education as part of a training curriculum • No human factors training requirement in United States 53
- 54. Work Cards With Delineated Steps 54 • Paperwork for 100-hour inspection • Inspector signoff for overall fore/aft servo installation • No specific signoffs for critical steps within task
- 56. Work Cards With Delineated Steps 56 Sample work card
- 57. Risks/Hazards: People, Actions, Resources, and Environment How could this accident have been prevented? 57
- 58. GA Maintenance Alert • Independent inspections of work • Safety and security of components disconnected • Look for the obvious; if there is a castellated nut, there is generally an associated cotter pin 58
- 59. GA Maintenance Alert • Review and adhere to guidance regarding self-locking nuts • When a component or system is in the work process, mark it • Cell phone policies 59
- 60. GA Maintenance Alert • Turnover briefings • Pilot check flights/review are last opportunity to detect potential safety hazards • Review FAA HF guidance and “Personal Minimums” Checklist 60
- 61. Safety recommendations • Duty time limitations for maintenance personnel • Work cards for maintenance tasks • Human factors training for maintenance personnel • Review issue of human fatigue in aviation maintenance 61
- 62. • Piper PA-22-108 • No injuries Case Study
- 63. • Pilot recently purchased airplane • Lost oil pressure during flight and landed in a field • Post accident examination showed that the main crankshaft seal was extruded and oil had been pumped out during the flight • Breather tube modified to drain oil and moisture away from airplane Overview
- 65. • Moisture is expelled from the engine crankcase through the breather tube which often extends through the bottom of the engine cowling into the air stream • This moisture may freeze and continue a buildup of ice until the tube is completely blocked • To prevent freeze-up, the breather tube may be insulated, it may be designed so the end is located in a hot area, it may be equipped with an electric heater, or it may incorporate a hole, notch or slot which is often called a "whistle slot" Whistle Slot Guidance- Lycoming Flyer
- 66. • The operator of any aircraft should know which method is used for preventing freezing of the breather tube, and should insure that the configuration is maintained as specified by the airframe manufacturer • Because of its simplicity, the "whistle slot" is often used, and a notch or hole in the tube is located in a warm area near the engine where freezing is extremely unlikely • When a breather tube with whistle slot is changed, the new tube must be of the same design Whistle Slot Guidance- Lycoming Flyer
- 67. Risks/Hazards: People, Actions, Resources, and Environment How could this accident have been prevented? 67
- 68. • Diamond DA-40 • No injuries Case Study
- 69. • The run up was without incident and the pilot noted that the RPMs dropped slower than normal when he cycled the propeller • During climb out, he noticed that the engine RPMs climbed to 2,800 so he leveled off his climb and pulled the propeller control back with no reduction in RPM noted • Attempted to cycle the propeller twice but noticed no change in RPMs • Decided to return to the departure airport and then he heard and felt a thump forward of the cockpit • Engine continued to run smoothly, while developing adequate power, and the pilot landed uneventfully Overview
- 70. Engine examination • Post incident engine examination showed a blister in the engine casing and fragments of metal in the oil • Engine then disassembled and ball bearings from the propeller governor were located in the engine • Further disassembly of the engine identified one ball bearing within the oil sump, as well as damage to the case and two camshaft lifters • The ball bearings from the governor were able to pass through the oil drain hole of the governor
- 71. Assembly
- 72. • Follow up examinations of the propeller governor showed that the governor bearing race and plunger were assembled with the bearing race set screw and plunger hole misaligned • When the bearing race set screw was torqued down, the set screw tip flattened against the harder plunger surface • During operation, the set screw/plunger race separated Governor examinations
- 74. • Review of the governor manufacturer’s reports showed two service difficulty reports (SDRs) had been reported for similar events • The two events, as well as the governor assembly from the accident, were from a single batch of 74 assemblies Service difficulty reports
- 75. Risks/Hazards: People, Actions, Resources, and Environment How could this incident have been prevented? 75
- 76. • As a result of this incident, the governor manufacturer issued a mandatory service bulletin (SB) DES-353, on December 18, 2008, for the affected assemblies. The SB required that the units be returned to Ontic for inspection and, if necessary, repair. • The FAA issued an Airworthiness Directive requiring examination of the affected assemblies.
- 78. Probable Cause The failure of maintenance personnel to properly secure a fitting cap on the throttle and metering assembly inlet after conducting a fuel system pressure check, which resulted in a loss of engine power due to fuel starvation.
- 79. Contributing Factor Contributing to the accident was the decision by the Director of Maintenance to return the airplane to service without verifying with the assigned inspector that all annual inspection items had been completed.
- 80. Probable cause • Sundance Helicopters’ inadequate maintenance of the helicopter, 8 including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate postmaintenance inspections, which resulted in the in-flight separation of the pilot servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable. 80
- 81. Probable cause • Contributing to the improper or lack of installation of the split pin was the mechanic’s fatigue and the lack of clearly delineated maintenance task steps to follow. Contributing to the inadequate postmaintenance inspection was the inspector’s fatigue and the lack of clearly delineated inspection steps to follow. 81
- 82. Probable Cause The National Transportation Safety Board determined the probable cause of this accident to be: • oil exhaustion due to an improper oil breather tube installation, which became plugged in flight due to frozen moisture build-up. The blocked breather tube then created a crankcase over pressure that caused a failure of the crankshaft seal. The rough, uneven terrain and strong crosswind were factors in the accident.
- 83. Probable Cause The National Transportation Safety Board determined the probable cause of this accident as follows: • The improper assembly of the governor during manufacture.
Notas do Editor
- Good morning. I will discuss maintenance issues identified during the investigation.
- This is a view looking northeast at the wreckage site, in rugged terrain on National Park Service land. The wreckage was consistent with a steep descent into the narrow ravine. Impact forces were high and the site was in a very contained area. The wreckage was fragmented and consumed by fire.[CLICK] The red circle indicates the tail boom and skids, [CLICK] the fuselage impacted just to the left of the circle. All of the main and tail rotor blades were found in the area.[CLICK]
- The day prior to the flight,Sundance maintenance personnel performed a routine 100 hour inspection, which among other tasks, included the replacement of the main rotor fore-aft servo. After the maintenance was completed a short check flight was performed, followed by two tour flights – one flown by the same pilot who performed the check flight and one by the accident pilot. The next tour flight was the accident flight, which occurred about 3.5 flight hours after the maintenance.Ms. Dunks will go into more detail on this work in her presentation and Dr. Alley-R will discuss human factors and fatigue in maintenance.[CLICK]
- This is a view with the engine cowl open, of the area where the servos and other components are located, under the main rotor assembly, between the cabin and engine. The fore-aft servo is one of three that transfer pilot control inputs to the main rotor, allowing the pilot to change the pitch of the blades, in order to control the helicopter.[CLICK]
- However, examination of the wreckage, found the fore-aft servo and the associated flight control input rod were not connected, and there was no evidence of a connecting bolt.[CLICK] This is a view of the input rod, and the servo [CLICK] at top right, the lugs [CLICK] indicated by the arrow are where the rod end should be fastened [CLICK] with a bolt, locknut, washer, and safety cotter or split pinA disconnected input rod to the fore-aft servo is considered catastrophic, the pilot would not be able to control main rotor pitch and other inputs would result in unexpected response. The input rod and servo therefore likely disconnected in flight, just prior to the unexpected climb and turn. [CLICK]
- The day before the accident, the helicopter underwent a routine 100-hour inspection. Three mechanics and a company-designated quality control inspector participated in the maintenance activity. The helicopter also had its engine and fore aft and tail rotor servos replaced. As noted by Mr. English, the fore/aft servo was found disconnected from the input rod at the accident site.
- The fore aft servo that wasinstalledon the accident helicopter was an overhauled unit. During the replacement of the fore/aft servo, the mechanic is required to assess the hardware condition and then to connect the fore aft servo to the input rod, torque the nut, and install the split pin. A company-designated quality control inspector then inspects the installation.
- The schematic on the left shows a close-upview of the hardware for the fore aft servo and input rod connection. As shown, the bolt is inserted through the fore aft servo and servo control input rod, the washer is installed, and then the nut is installed. The nut is torqued and the split pin is inserted through the nut and bolt. Once the split pin is in place, the tangs are bent back to secure the connection.The image on the right shows a close-up view of the fore aft servo and input rod connection. In accordance with Sundance’s procedures, when inspecting the fore/aft servo installation, the inspector is required to mark all safeties with a torque pen. In the case of the accident helicopter, the inspector reported verifying and marking the security of the installation.
- Here are images of self-locking nuts. The image on the left shows the full-circle nylon locking element of a new or “acceptable” nut. The image on the right shows a degraded nut with the nylon locking element worn. During the hardware assessment, the mechanic verifies the condition of the self-locking nut to ensure that it meets the minimum torque value. That is, it cannot be tightened by hand to the base of the bolt threads. NTSB tests showed that torque values degraded with each on-off cycle.In this case, the mechanic reported that the original hardware met the requirements and it was not replaced.
- Following the accident, Sundance inspected its helicopter fleet to determine the condition of the servo hardware and to ensure that all items were safetied. Although no unsafetied items were found, about half of the nuts associated with the bolts that had beenexamined at the time of the NTSB’s visit did not meet the minimum locking capability.The manufacturer’s guidance states that if a nut can be easily tightened, it is to be discarded. FAA guidance states that nut torque must be verified and notes “DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values.”Sundance now requires that all nuts be replaced with new nuts when servos are removed.
- During the investigation, several nut and split pin installation scenarios were evaluated. By design, a properly installed input rod to the fore/aft servo has a secure connection because it has two locking devices, the self-locking nut and split pin. If an improperly installed or degraded nut is installed without a split pin, the nut can vibrate off of the bolt due to normal in-flight vibratory forces and a disconnect of the control input rod from the fore/aft servo can occur. Therefore, the self-locking nut most likely became separated from the bolt.
- Once the maintenance was completed, the inspector, with assistance from the mechanic that installed the fore/aft servo, completed the final overall checks on the helicopter. No problems were identified.The following morning, the day of the accident, a check pilot completed the post maintenance checks. This included a before first flight check, a check of the maintenance items performed, and a check flight. During the before first flight check, the check pilot noted that the hydraulic belt tension was too loose. The belt tension had been set by the same mechanic that completed the installation of the fore aft servo. After the tension was reset, the check flight was completed. According to the check pilot, no discrepancies were identified during the flight.
- As discussed earlier, the day before the accident, the accident helicopter underwent a 100-hour inspection, including the fore aft servo replacement. Errors made during this maintenance were: improper securing of the fore /aft servo connection hardware, improper tension of the hydraulic belt, and incomplete maintenance inspection of the accident helicopter. [click]
- The mechanic was contacted on his off duty day, to report to work about 6 hours earlier than his normal shift and on a day he was previously scheduled to be off duty. He stated that he went to bed earlier than normal, about 10:00 pm; however, he had difficulty falling asleep. Heawoke at 5:00 am on the morning of December 6, after obtaining only about 5 hours of sleep and reported to work about 5:50 am. He completed his shift about 6:45 pm. He had been awake for over 13 ½ hours. [Click]
- The inspector was also contacted on his off duty day, to report to work about 6½ hours earlier than his normal shift and also on a day when he was previously scheduled to be off duty.He went to bed about 9:00 pm on December 5 and awoke at 4:00 am on December 6, obtaining approximately 7 hours of sleep. He reported to work about 5:30 am and completed his final inspection and ground run of the accident helicopter around 6:00 pm, at the end of a 12-hour shift. The inspector had been awake for over 14 hours at the end of his shift. [Click]
- Here is a table summarizing the mechanic’s and inspector’s normal shift schedule, the shift they were originally scheduled for on December 6, and actual shifts they worked.For the Mechanic, the insufficient time to adjust to working an earlier shift than normal and inadequate amount of sleep the night prior to the scheduled maintenance contributed to the development of fatigue. For the inspector, the insufficient time to adjust to working an earlier shift than normal and a long duty day contributed to the development of fatigue. [Click]
- Fatigue associated with sleep loss, shift work, and long duty cycles can lead to increased difficulty in sustaining and directing attention, memory errors, and lapses in performance. Available evidence indicates that both the mechanic and inspector were experiencing fatigue and the known effects of fatigue can lead to the type of errors that they made. Staff concludes that both the mechanic’s and inspector’s degraded performance due to fatigue contributed to the improper securing of the fore/aft servo connection hardware, the improper tension of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively. [Click]
- Education and training is another important approach to mitigating the risks of fatigue-related errors in maintenance. Educating maintenance personnel on the causes of fatigue, its effect on performance, and appropriate countermeasures promotes a safer maintenance culture. This type of training can be done as part of a human factors training curriculum which would provide benefits to reducing human errors in maintenance beyond fatigue awareness. Current federal regulations do not require maintenance personnel to receive human factors training, however, other international regulatory authorities such as the European Aviation Safety Agency do. The circumstances of this accident illustrate that the reliability of inspections of critical flight control system components can be affected by a number of inherent human factors. Therefore, staff concludes that all maintenance personnel would benefit from receiving human factors training, including fatigue education, which would help reduce the likelihood of human errors in aviation maintenance. Staff has proposed recommendations in these areas. [click]
- Documentation used by Sundance Helicopters’ maintenance personnel for the fore/aft servo replacement listed the servo replacement task as an item on a discrepancy list to be accomplished with a reference to the Aircraft Maintenance Manual. The Aircraft Maintenance Manual listed the tools, parts, and sequential steps required to accomplish the task. According to Sundance’s General Maintenance Manual, maintenance functions requiring a safety, such as the fore/aft servo replacement, required an inspector sign off to approve the helicopter for return for service. However, the company’s 100-hour inspection paperwork provided only a single location for the inspector to signoff for the overall fore/aft servo installation rather than including individual areas for the inspector to sign off to note inspection of critical steps within this task. [Click]
- This picture depicts a page from the 100-hour inspection paperwork showing the single sign off location for the overall fore/aft servo. [Click]It is likely that the maintenance personnel’s performance was also affected by human factors such as failure in systematic visual inspections, complacency and expectations, overreliance on memory for performing tasks or identifying critical areas for inspection, and interruptions (which are common in the maintenance environment). [Click]
- Using documentation that clearly delineates the steps to be performed and critical areas to be inspected to support the maintenance and inspection task is one way to mitigate these factors.This picture depicts a section of a sample work card where the mechanic [Click] and the inspector [Click] have separate columns to sign off delineated steps for a task such as installation of the nut, applying torque, and installation of the split pin. Work cards, which are used much like checklists in the cockpit, can help to ensure that critical steps in a maintenance task have been performed and protected against some of the human factors errors. Staff has proposed a recommendation in this area.[Click]
- As a result of concerns regarding the reuse of hardware and other helicopter maintenance items, the FAA issued a GA Maintenance Alert in November 2012. This alert notice was distributed via the FAA’s safety and outreach FAAST Team email database to 239,000 users including pilots and mechanics.Similar information will also be published by the FAA in an Aviation Maintenance Alert in early 2013.Additionally, the NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization renewal training, and this information will be included in renewal training clinics throughout the United States in 2013.
- As a result of concerns regarding the reuse of hardware and other helicopter maintenance items, the FAA issued a GA Maintenance Alert in November 2012. This alert notice was distributed via the FAA’s safety and outreach FAAST Team email database to 239,000 users including pilots and mechanics.Similar information will also be published by the FAA in an Aviation Maintenance Alert in early 2013.Additionally, the NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization renewal training, and this information will be included in renewal training clinics throughout the United States in 2013.