Photo: Eurocopter nut and split pin of the fore/aft servo input rod, from NTSB AAR-13/01, figure 4.

Eddie Sez:

There are two recurring themes in many mishaps where failures to complete maintenance procedures properly are found causal: the mechanic was fatigued from lack of sleep or extended duty periods, and the procedures for a complicated task were not provided in checklist form. I've seen a few of these first hand in the Air Force where the second problem was addressed by "work cards" but the first problem was ignored due to military priorities. What about us in the civilian world?

Duty time limits

Back in 1996 when ValuJet Flight 592 crashed into the Everglades the cause was determined to be over 100 expired chemical oxygen generators that should not have been carried in the first place. Part of the blame was placed on an inspector who had been on duty for an extended period. The NTSB recommended the FAA establish duty time limitations for maintenance personnel as a result. Here we are 20 years later and nothing has been done about this.

This helicopter appears to have lost control because of an improperly reused part and another missing part. Both the mechanic and inspector were suffering from the fatigue related to changing from night to day shifts and the lack of recent sleep. They were operating under 14 CFR 135 where there still remains no duty time limitations for mechanics.

The NTSB has added to their recommendations in a statement that bears copying: "Establish duty-time regulations for maintenance personnel working under 14 Code of Federal Regulations Parts 121, 135, 145, and 91 Subpart K that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and other factors shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness." (NTSB AAR-13/01, §5.1)

Work Cards

A common practice for aircraft mechanics in many organziations is to study a loosely worded description of the task to be undertaken and then head to the hangar floor to accomplish the task. Once completed, an inspector (who could be the very same mechanic), checks the work using his memory of the task. This is a recipe for error.

This may have been a factor is this mishap. The NTSB recommendation is another item to cut and paste into a company operations manual: "Using work cards that clearly delineate the steps to be performed and critical areas to be inspected to support both the maintenance and inspection tasks is one way to mitigate inadvertent errors of omission in the performance and verification of maintenance tasks, especially tasks involving critical flight controls." (NTSB AAR-13/01, §5.1)

What follows comes from the references shown below and my comments shown in blue.


Accident Report


Narrative

[NTSB AAR-13/01, §1.1]

[NTSB AAR-13/01, §1.2]

[NTSB AAR-13/01, §1.3]

Figure: Schematic of the main rotor servo assembly and the fore/aft main rotor servo's input rod assembly, from NTSB AAR-13/01, figure 3.

  • The Eurocopter AS350-B2 helicopter is equipped with a single three-blade main rotor system and a two-blade tail rotor for antitorque and heading control. The helicopter is equipped with a mechanical flight control system assisted by a hydraulic tail rotor servo and three hydraulic servos installed on the main rotor: two lateral servos, which transfer the lateral inputs to the nonrotating swashplate (roll), and one fore/aft servo, which transfers the fore and aft inputs to the nonrotating swashplate (pitch). The system is controlled by pilot-actuated control inputs using the cyclic, collective, and antitorque pedals.

  • The collective and cyclic inputs are transferred to the helicopter’s main rotor system via control rods interconnected by bellcranks and levers. The control linkages are routed beneath the main cabin and aft to the mixing unit. Pilot movements of the collective and cyclic controls are transferred to the mixing unit, which apportions the commands through the appropriate servo control input rod to a servo input rod assembly.

  • Each of the three main rotor servos has three connections: one connection is at the lower end of the servo and is fixed to the main rotor transmission case, another connection is at the upper end of the servo and is secured to the nonrotating swashplate, and the third connection is the servo control input rod that supplies pilot commands to extend or retract the servo. See figure 3 for a schematic of the main rotor servo assembly and the fore/aft main rotor servo’s input rod assembly.

  • The servo control input rod is connected to the servo input lever with a bolt, washer, and self-locking castellated (slotted) nut that has a full-circle nylon locking element. The nut is safetied using a split pin (sometimes referred to as a “cotter pin” or “cotter key”), which engages the nut slots and a hole through the bolt threads and prevents the unthreading of the nut. All of the components are made of cadmium-plated steel. In Eurocopter’s certification document, EC 130, “Flight Controls Failure Mode Effects and Criticality Analysis,” Eurocopter indicated that the loss of control of the fore/aft servo would most likely result in a catastrophic failure of the helicopter (a loss of flight control from which a pilot could not recover).

  • According to 14 CFR 27.607, any removable fastener whose loss could jeopardize the safe operation of the helicopter must incorporate two separate locking devices. For the Eurocopter AS350-B2 fore/aft servo input rod, the first locking device is the self-locking nut, and the second one is the split pin. In accordance with the Eurocopter Standard Practices Manual, section 1.5.1.2, “JOINING: Assembling by Bolts and Nuts,” the self-locking nut is installed on the bolt and torqued to the minimum specification. The nut is further tightened (up to the maximum specified) until the hole in the bolt threads aligns with a slot on the nut. The split pin is then inserted through the nut and bolt, and the pin’s tangs are bent open 90° or more around the nut.

[NTSB AAR-13/01, §1.4]

[NTSB AAR-13/01, §1.5]

[NTSB AAR-13/01, §1.5]


Analysis

[NTSB AAR-13/01, §2.1]

[NTSB AAR-13/01, §2.2]

[NTSB AAR-13/01, §3.2.1]


Probable Cause

[NTSB AAR-13/01, §4.2] The National Transportation Safety Board determines that the probable cause of this accident was Sundance Helicopters’ inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate post maintenance inspections, which resulted in the in-flight separation of the servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable. Contributing to the improper or lack of installation of the split pin was the mechanic’s fatigue and the lack of clearly delineated maintenance task steps to follow. Contributing to the inadequate post maintenance inspection was the inspector’s fatigue and the lack of clearly delineated inspection steps to follow.


See Also:

Abnormal Procedures / Fatigue

Abnormal Procedures / Maintenance Malpractice


References

NTSB Aircraft Accident Report, AAR-13/01, Loss of Control, Sundance Helicopters, Inc., Eurocopter AS350-B2, N37SH, Near Las Vegas, Nevada, December 7, 2011