Loss of Control Sundance Helicopters, Inc. Eurocopter AS350-B2, N37SH

Loss of Control Sundance Helicopters, Inc.

Eurocopter AS350-B2, N37SH Near Las Vegas, Nevada December 7, 2011 Accident Report NTSB/AAR-13/01 PB2013-103890 National Transportation Safety Board

NTSB/AAR-13/01 PB2013-103890 Notation 8371A Adopted January 29, 2013

Aircraft Accident Report

Loss of Control

Sundance Helicopters, Inc.

Eurocopter AS350-B2, N37SH

Near Las Vegas, Nevada

December 7, 2011

National

Transportation

Safety Boa rd

490 L’Enfant Plaza, S.W.

Washington, D.C. 20594 National Transportation Safety Board. 2013. Loss of Control, Sundance Helicopters, Inc., Eurocopter AS350-B2, N37SH, Near Las Vegas, Nevada, December 7, 2011 . Aircraft Accident Report NTSB/AAR-13/01. Washington, DC.

Abstract: This report discusses the December 7, 2011, accident involving a Sundance Helicopters, Inc., Eurocopter AS350- B2 helicopter, N37SH, operating as a “Twilight tour” sightseeing trip, which crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were killed, and the helicopter was destroyed by impact forces and postimpact fire.

The safety issues identified in this accident are the improper reuse of degraded self-locking nuts, maintenance personnel fatigue, the need for work cards with delineated steps, and the lack of human factors training for maintenance personnel . Safety recommendations concerning these issues are addressed to the Federal Aviation Administration.

The National Transportation Safety Board is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at <http://www.nt sb.gov>. Other information about available publications also may be obtained from the website or by contacting: National Transportation Safety Board Records Management Division, CIO - 40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877 - 6799 or (202) 3 14 - 6551 Copies of NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2013 - 103890 from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553 - 6847 or (703) 605 - 6000 http://www.ntis.gov/ The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB Aircraft Accident Report

Contents

Figures ........................................................................................................................................... iii Abbreviations and Acronyms ..................................................................................................... iv Executive Summary .......................................................................................................................v i NTSB Aircraft Accident Report ii

NTSB Aircraft Accident Report

Figures

Figure 1. Accident flightpath (depicted in yellow) overlaid with the prescribed Twilight Figure 3. Schematic of the main rotor servo assembly and the fore/aft main rotor servo’s Figure 4. Photograph showing the nut and split pin of the fore/aft servo input rod connection hardware visible through the cutout of the ice shield (about eye level for a Figure 5. Photograph showing the nuts, upper input rod bolts, and washers removed from iii

NTSB Aircraft Accident Report

Abbreviations and Acronyms

A&P airframe and powerplant AC advisory circular aircraft maintenance manual AMM before first flight BFF CFR Code of Federal Regulation s FAA Federal Aviation Administration FAAST FAA Safety Team FSDO flight standards district office Grand Canyon West Airport GCW GMM general maintenance manual IA inspection authorization lbf pound - force MGB main gear box notice of proposed rulemaking NPRM NTSB National Transportation Safety Board POI principal operations inspector QC quality control RFM rotorcraft flight manual safety management system SMS TOPS Tour Operators Program of Safety iv

NTSB Aircraft Accident Report

Executive Summary

On December 7, 2011, about 1630 Pacific standard time, a Sundance Helicopters, Inc., Eurocopter AS350- B2 helicopter, N37SH, operating as a “Twilight tour” sightseeing trip, crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were killed, and the helicopter was destroyed by impact forces and postimpact fire. The helicopter was registered to and operated by Sundance as a scheduled air tour flight under the provisions of 14 Code of Federal Regulations (CFR) Part 135. Visual meteorological conditions with good visibility and dusk light prevailed at the time of the accident, and the flight operated under visual flight rules. The helicopter originated from Las Vegas McCarran International Airport, Las Vegas, Nevada, about 1621 with an intended route of flight to the Hoover Dam area and return to the airport.

The helicopter was not equipped, and was not required to be equipped, with any on-board recording devices.

The accident occurred when the helicopter unexpectedly climbed about 600 feet, turned about 90° to the left, and then descended about 800 feet, entered a left turn, and descended at a rate of at least 2,500 feet per minute to impact. During examination of the wreckage, the main rotor fore/aft servo, one of the three hydraulic servos that provide inputs to the main rotor, was found with its flight control input rod not connected. The bolt, washer, self-locking nut, and split pin (sometimes referred to as a “cotter pin” or “cotter key”) that normally secure the input rod to the main rotor fore/aft servo were not found. The investigation revealed that the hardware was improperly secured during maintenance that had been conducted the day before the accident. The nut became loose (likely because it was degraded) and, without the split pin, the nut separated from the bolt, the bolt disconnected, and the input rod separated from the linkage while the helicopter was in flight, at which point the helicopter became uncontrollable and crashed.

The safety issues identified in this accident include the following: Improper reuse of degraded self-locking nuts. Although Eurocopter and the Federal Aviation Administration (FAA) publish guidance on the reuse of self-locking nuts, the investigation revealed that Sundance Helicopters’ maintenance personnel were reusing nuts that did not meet the criteria specified by Eurocopter and FAA guidance. Federal regulations require that any removable fastener whose loss could jeopardize the safe operation of the helicopter must incorporate two separate locking devices. For the Eurocopter AS350-B2 helicopter, the first locking device is the self-locking nut and the second one is the split pin. The improper reuse of a degraded self-locking nut on critical flight control components is a safety hazard because it negates the safety benefits of one of the two required locking devices. Reinforcing the Throughout the report, the term “degraded” means that the nut was degraded beyond reuse specifications.

v NTSB Aircraft Accident Report importance of maintenance personnel properly following manufacturer and FAA self-locking nut reuse guidance would help ensure that nuts without locking ability are not being reused. In response to the National Transportation Safety Board’s (NTSB) concerns on this matter, the FAA Safety Team (FAAST) published a general aviation maintenance alert on its website at http://faasafety.gov in November 2012 and distributed the alert to over 239,000 mechanics and pilots via its e-mail registry. The NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization (IA) renewal training. This information will be included in IA renewal training clinics throughout the United States in 2013.

In addition, the FAA will publish an Aviation Maintenance Alert (Advisory Circular 43-16A) in early 2013 related to helicopter maintenance issues.

Maintenance personnel fatigue. Both the mechanic and the quality control inspector, who inspected the maintenance work completed the day before the accident, were likely fatigued during the December 6 shift, in part, because they had insufficient time to adjust to working an earlier shift than normal.

The mechanic and inspector’s performance was degraded by fatigue, which contributed to the improper securing of the fore/aft servo connection hardware, the improper installation of the hydraulic belt, and the inadequate postmaintenance inspection of the accident helicopter, respectively. If the work shifts of the maintenance personnel had been consistent, a major source of their fatigue could have been mitigated.

Need for work cards with delineated steps. In addition to the degradation of t he mechanic’s and inspector’s performance due to fatigue, the maintenance documentation did not clearly delineate specific inspection steps, which can allow these tasks to be more vulnerable to error through human factors. Using work cards that clearly delineate the steps to be performed and critical areas to be inspected to support both the maintenance and inspection tasks is one way to mitigate inadvertent errors of omission in the performance and verification of maintenance tasks, especially tasks involving critical flight controls.

Lack of human factors training for maintenance personnel. Although the FAA has developed substantial guidance for the industry about maintenance human factors and has repeatedly stressed the importance of human factors training, there is still no requirement for human factors training for maintenance personnel involved in air carrier operations. The NTSB notes that on May 21, 2012, the FAA issued a notice of proposed rulemaking (NPRM) proposing that repair stations operating under 14 CFR Part 145 provide human factors training relevant to aviation maintenance for employees performing maintenance, preventive maintenance, alterations, or inspection functions. However, if adopted, the rule would not require FAAST’s mission is to improve the nation’s aviation safety record by conveying safety principles and practices through training, outreach, and education. FAAST managers and program managers are responsible for establishing meaningful alliances and encouraging continual growth of a positive safety culture within the aviation community.

vi NTSB Aircraft Accident Report maintenance personnel working for Part 121 and 135 operators or Part 91 Subpart K programs to receive human factors training. This investigation has shown that providing human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue, to all maintenance personnel would help reduce the likelihood of human error in aviation maintenance.

The NTSB determines that the probable cause of this accident was Sundance Helicopters’ inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate postmaintenance inspections, which resulted in the in-flight separation of the servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable. Contributing to the improper or lack of installation of the split pin was the mechanic’s fatigue and the lack of clearly delineated maintenance task steps to follow.

Contributing to the inadequate postmaintenance inspection was the inspector’s fatigue and the lack of clearly delineated inspection steps to follow.

As a result of this investigation, the NTSB makes safety recommendations to the FAA, reiterates a previous recommendation to the FAA, and reclassifies a previous recommendation to the FAA.

vii

NTSB Aircraft Accident Report

1. The Accident

1.1 History of Flight

3 4 On December 7, 2011, about 1630 Pacific standard time, a Sundance Helicopters, Inc., Eurocopter AS350- B2 helicopter, N37SH, operating as a “Twilight tour” sightseeing trip, crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were killed, and the helicopter was destroyed by impact forces and postimpact fire. The helicopter was registered to and operated by Sundance as a scheduled air tour flight under the provisions of 14 Code of Federal Regulations (CFR) Part 135. Visual meteorological conditions with good visibility and dusk light prevailed at the time of the accident, and the flight operated under visual flight rules. The helicopter originated from Las Vegas McCarran International Airport, Las Vegas, Nevada, about 1621 with an intended route of flight to the Hoover Dam area and return to the airport. The helicopter was not equipped, nor required to be equipped, with any on-board recording devices.

Radar data obtained from the FAA showed the helicopter following the prescribed Twilight tour route easterly out of the airport traffic area and then turning to the southeast toward the Hoover Dam. According to the radar data, the helicopter was level at 3,500 feet at a groundspeed of about 120 knots. About 1 minute before impact, radar data showed the helicopter climbing to 4,100 feet, turning about 90° to the left, and then slowing after the turn. The climb and left turn are not part of the Twilight tour flight route. Radar data then showed the helicopter descending to 3,300 feet and tracking a northeasterly course for about 20 seconds, until it entered a left turn and descended at a rate of at least 2,500 feet per minute to impact. The last received radar target was about 1/8 mile from the accident site. See figure 1 for the accident flightpath overlaid with the Twilight tour route.

Unless otherwise indicated, all times in this report are Pacific standard time based on a 24-hour clock.

Sundance was acquired by Air Methods, Inc., in December 2012.

The Twilight tour is a standardized nonstop sightseeing tour of the Hoover Dam and the Las Vegas strip at sunset. The departure time from Las Vegas McCarran International Airport is set to make the return to the airport about 15 to 30 minutes after official sunset.

The accident occurred on the helicopter’s fourth flight of the day. The helicopter was flown on one check flight and two tour flights (one by the check flight pilot and one by the accident pilot) before the accident flight, accumulating about 3.5 hours of flight time with six engine cycles. Neither the accident pilot nor check pilot noted any controllability issues during these flights.

The NTSB public docket for this accident investigation is available online at http://www.ntsb.gov/investigations/dms.html .

As a result of the NTSB’s investigation of the July 27, 2007, fatal accident involving two Eurocopter AS350-B2 electronic news gathering helicopters that collided in flight in Phoenix, Arizona, the NTSB issued Safety Recommendations A-09-9 through -11 to the FAA on February 9, 2009, which asked the FAA to mandate image recorder equipage on all turbine-powered, nonexperimental, nonrestricted-category aircraft. On June 11, 2012, the NTSB classified Safety Recommendations A-09-9 through - 11 “Closed―Unacceptable Action” because the FAA stated that it was unable to determine a quantitative benefit for mandating image recorder equipage, and, therefore, would not do so. For more information about this accident, see Midair Collision of Electronic News Gathering Helicopters, KTVK-TV Eurocopter AS350B2, N613TV, and U.S. Helicopters, Inc., Eurocopter AS350B2, N215TV, Phoenix, Arizona, July 27, 2007, Aircraft Accident Report NTSB/AAR-09/02 (Washington, DC: National Transportation Safety Board, 2009), available online at http://www.ntsb.gov .

NTSB Aircraft Accident Report Figure 1. Accident flightpath (depicted in yellow) overlaid with the prescribed Twilight tour route (depicted in green).

The helicopter crashed in a ravine between Henderson, Nevada, and Lake Mead. The helicopter impacted the terrain in a nose-low attitude on an approximate north-easterly heading.

The cockpit area and predominate helicopter structure were found in the immediate wreckage area. A large amount of the structure forward of the horizontal stabilizer was consumed by postimpact fire. See figure 2 for a photograph of the main helicopter wreckage.

Because access to the accident site was moderately difficult, the National Park Service helped NTSB investigators reach the accident site. Following the accident, Sundance Helicopters slightly altered some of its air tour flight routes to provide quicker access to relatively flat terrain in the event of an unscheduled landing.

NTSB Aircraft Accident Report Figure 2. Photograph of the main helicopter wreckage.

1.2 Personnel Information 1.2.1 The Pilot The pilot, age 31, was hired by Sundance Helicopters on June 8, 2009. He held a commercial pilot certificate, issued March 23, 2007, with rotorcraft-helicopter and instrument ratings. He also held a flight instructor certificate with a rotorcraft-helicopter rating and a ground instructor certificate. The pilot held a second-class FAA medical certificate, issued June 1, 2011, with no limitations. According to Sundance and pilot records and interviews with his wife and father, the pilot had never been involved in any previous accidents, and he had never been subject to disciplinary action at work.

According to Sundance Helicopters and pilot records, the pilot had accumulated 3,174 total flight hours, including 1,360.6 hours as pilot-in-command in AS350 helicopters. He had flown 128.2, 36, and 4.4 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident flight. Sundance records indicated that the pilot was certificated in accordance with federal regulations and current and qualified in accordance with Sunda nce’s training requirements, which included special training in helicopter air tour flights in the vicinity of Las Vegas and the Grand Canyon.

The pilot was off duty on December 4 and 5, 2011. On December 6 (the day before the accident), the pilot was on duty from 0700 to 1715, during which time he logged 4.4 hours of flight time. On the day of the accident, he arrived on duty about 1230 and planned to log off duty

NTSB Aircraft Accident Report about 1715. About 1330, he flew a tour to the Grand Canyon in the accident helicopter, accumulating 1.4 hours of flight time. During the accident flight, he accumulated 0.3 hour of flight time. His wife described the pilot’s activities during the 3 days preceding the accident as routine, and she stated that he had closely approximated his typical schedule of going to bed about 2200 and waking up about 0645 during this period.

During postaccident interviews, the six passengers who had flown with the accident pilot on the previous tour stated that the pilot was in a good mood, happy, and chatty during the trip.

They added that at no time did he make any of them feel unsafe, that he seemed capable and appeared to have very good control over the helicopter, and that they never sensed any mishandling or “misbehaving” of the helicopter during the flight. They indicated that they were flown on a predetermined route.

Sundance Helicopters tracks its flights using a satellite-based tracking system called “Spidertracks.” A review of the Spidertracks data of the air tour routes flown by the pilot in the 2 weeks before the accident indicated that he consistently flew the prescribed routes with no deviations from company operating procedures. A review of the accident flight’s Spidertracks data showed the helicopter being flown on the Twilight tour route as usual until the sudden altitude and heading deviations occurred.

A search of FAA records revealed no accident or incident history or enforcement actions regarding the pilot. The FAA’s Civil Aerospace Medical Institute in Oklaho ma City, Oklahoma, performed forensic toxicology on specimens from the pilot. The toxicology report indicated that no ethanol, carbon monoxide, cyanide, or drugs were detected in the tested specimens. The National Transportation Safety Board’s (NTSB) revie w of company records, preaccident activities, and medical histories revealed no evidence of fatigue or of any medical or behavioral conditions that might have adversely affected the pilot’s performance during the accident flight.

1.2.2 Maintenance Personnel Four mechanics who typically worked together completed maintenance on the helicopter the day before the accident. Of these four mechanics, one replaced the fore/aft servo, one replaced the tail rotor, one replaced the engine, and one conducted a quality control (QC) inspection of the maintenance after it was completed. See section 2.3.1 for more information about this inspection. In addition, a check pilot, who conducted a postmaintenance flight check and a tour flight on the morning of the accident, performed a Before First Flight (BFF) check (an external inspection of the helicopter). See section 2.3.2 for more information about this inspection. This section focuses on the actions of the mechanic who installed the fore/aft servo, the inspector, and the check pilot.

The flight tracks are viewed on http://spidertracks.com by Sundance-authorized personnel and are used by Sundance management and safety personnel to ensure the consistency and quality of the tour flights. The reporting rate is either 8 minutes or 20 kilometers, whichever is most frequent.

NTSB Aircraft Accident Report 1.2.2.1 The Mechanic The mechanic holds an airframe and powerplant (A&P) mechanic certificate, which he received in December 2008. In June 2011 (6 months before the accident), he was hired by Sundance Helicopters without any previous helicopter maintenance work experience. Before working at Sundance, the mechanic had 1 year of experience maintaining various general aviation airplanes and 1 year of experience maintaining business jets.

The mechanic’s training at Sundance Helicopters in cluded indoctrination training, during which he learned records and maintenance procedures and how to read the Eurocopter manuals, and on-the-job training from other Sundance maintenance personnel. He had not attended any helicopter-specific training at the time of the accident. The mechanic estimated that in his 6 months at Sundance, he had completed about six fore/aft servo installations before installing the fore/aft servo on the accident helicopter.

The mechanic was normally scheduled to work 4 days of 11-hour shifts followed by 3 days off duty and then 3 days of 12-hour shifts followed by 4 days off duty. He stated that he typically reported to work about 1200. He added that he normally went to bed about 0200 and awoke about 1030 and that he maintained approximately the same rest schedule on his days off for consistency.

The mechanic was scheduled to be off duty December 4, 5, and 6, 2011. On December 4, he awoke between 1200 and 1400. He went to bed between 0000 and 0200 on December 5. On the afternoon of December 5, he was contacted to report to work on December 6. He stated that, therefore, he went to bed about 2200 instead of his normal 0200. He reported that he did not fall asleep until close to 0000, that he awoke about 0500, and that he felt “good” when he awoke. He reported to work about 0550 on December 6 and was assigned the fore/aft servo replacement on the accident helicopter. He stated that he had no difficulty performing the task, that the workload was normal, and that he did not feel rushed. He completed his shift about 1830. See section 3.2.1 for a discussion about the role of the fore/aft servo mechanic’s fatigue in this accident.

1.2.2.2 The Quality Control Inspector The mechanic who inspected the preaccident maintenance was designated as a QC inspector for Sundance Helicopters about 6 months before the accident. The inspector holds an A&P mechanic certificate, which he received in February 2002. In November 2010, the inspector was hired by Sundance. Before working at Sundance, he had about 2 years’ experience According to the Sundance General Maintenance Manual, s ection 4.9.2, “Qualifications,” the QC inspector must hold a mechanic certificate with A&P ratings; have 3 years’ experience within the past 6 years maintaining aircraft as a certified mechanic, including, at the time of appointment, as QC inspector; have experience maintaining the same category and class of aircraft that the certificate holder uses; have 3 years’ experience within the past 6 years repairing aircraft, including 1 year in the capacity of approving aircraft for return to service; be knowledgeable of all company auditing, evaluation, and reporting procedures, the aircraft m anufacturer’s maintenance manual, inspection and maintenance specifications, and applicable Federal Aviation Regulations; and have completed required company training. At the time of the accident, the QC inspector was working on obtaining an FAA inspection authorization.

NTSB Aircraft Accident Report maintaining commercial aircraft and about 7 years’ experience maintaining civilian (nonmilitary) helicopters. The inspector was also one of three lead mechanics who directed the maintenance being performed in the hangar when management was not present.

A review of Sundance Helicopters records revealed that in June 2011, the QC inspector (acting as a mechanic) failed to properly re- install the chin bubble on one of Sundance’s helicopters. A formal root cause analysis of the event conducted by Sundance stated that the inspector’s perception of the need to expedite the repair to avoid aircraft downtime was a contributing factor leading to this failure and that in his attempt to expedite the repair process, he failed to reference the appropriate aircraft maintenance documents that detailed the task of installing the chin bubble.

The NTSB randomly selected and reviewed eight maintenance log sheets signed off by the inspector that covered a period of about 4 months before the accident to look for any discrepancies or overlooked items. In addition, the NTSB reviewed all 11 inspections completed by the inspector within the 30 days before the accident for any discrepancies or overlooked items. No instances of discrepancies or overlooked items were identified during the NTSB’s review.

The inspector was also on the 4-days-on, 3-days-off and 3-days-on, 4-days-off schedule and typically reported to work about 1200. He stated that he typically went to bed on his days off about 2200 or 2300 but that he woke up every day about 0730 or 0800.

The inspector was scheduled to be off duty December 4, 5, and 6, 2011. He went to bed on December 4 about 0000 and awoke about 0800 on December 5. On the afternoon of December 5, he was contacted to report to work on December 6. Therefore, he went to bed about 2100 on December 5. He awoke about 0400 on December 6 and reported to work about 0530. He reported that he did not have trouble sleeping and felt rested. He completed the inspection and ground run of the helicopter about 1800, at the end of a 12-hour shift. See section 3.2.1 for a discussion about the role of the inspector’s fatigue in this accident.

1.2.2.3 The Check Pilot The check pilot holds an A&P mechanic certificate, which he received in 2000. The check pilot was hired by Sundance Helicopters in February 2010 as a line pilot. At the time of the accident, he had accumulated about 2,400 total flight hours, including about 1,500 hours in rotorcraft and about 900 hours in airplanes. He worked for 6 years as a helicopter mechanic on Robinson helicopters before joining Sundance as a pilot. He had conducted about 10 to 12 flight checks at Sundance before the accident.

The chin bubble separated during transition from hovering to taxi and the helicopter immediately landed without further incident. The reinstallation of the chin bubble was not required to be inspected.

NTSB Aircraft Accident Report 1.3 The Helicopter’s Flight Control System The Eurocopter AS350-B2 helicopter is equipped with a single three-blade main rotor system and a two-blade tail rotor for antitorque and heading control. The helicopter is equipped with a mechanical flight control system assisted by a hydraulic tail rotor servo and three hydraulic servos installed on the main rotor: two lateral servos, which transfer the lateral inputs to the nonrotating swashplate (roll), and one fore/aft servo, which transfers the fore and aft inputs to the nonrotating swashplate (pitch). The system is controlled by pilot-actuated control inputs using the cyclic, collective, and antitorque pedals.

The collective and cyclic inputs are transferred to the helicopter’s main rotor system via control rods interconnected by bellcranks and levers. The control linkages are routed beneath the main cabin and aft to the mixing unit. Pilot movements of the collective and cyclic controls are transferred to the mixing unit, which apportions the commands through the appropriate servo control input rod to a servo input rod assembly.

Each of the three main rotor servos has three connections: one connection is at the lower end of the servo and is fixed to the main rotor transmission case, another connection is at the upper end of the servo and is secured to the nonrotating swashplate, and the third connection is the servo control input rod that supplies pilot commands to extend or retract the servo. See figure 3 for a schematic of the main rotor servo assembly and the fore/aft main rotor servo’s input rod assembly.

Figure 3. Schematic of the main rotor servo assembly and the fore/aft main rotor servo’s input rod assembly.

NTSB Aircraft Accident Report The servo control input rod is connected to the servo input lever with a bolt, washer, and self-locking castellated (slotted) nut that has a full-circle nylon locking element. The nut is safetied using a split pin (sometimes referred to as a “cotter pin” or “cotter key”), which engages the nut slots and a hole through the bolt threads and prevents the unthreading of the nut. All of the components are made of cadmium-plated steel. In Eurocopter’s certification document, EC 130, “Flight Controls Failure Mode Effects and Criticality Analysis,” Eurocopter indicated that the loss of control of the fore/aft servo would most likely result in a catastrophic failure of the helicopter (a loss of flight control from which a pilot could not recover).

According to 14 CFR 27.607, any removable fastener whose loss could jeopardize the safe operation of the helicopter must incorporate two separate locking devices. For the Eurocopter AS350-B2 fore/aft servo input rod, the first locking device is the self-locking nut, and the second one is the split pin. In accordance with the Eurocopter Standard Practices Manual, section 1.5.1.2, “ JOINING: Assembling by Bolts and Nuts, ” the self-locking nut is installed on the bolt and torqued to the minimum specification. The nut is further tightened (up to the maximum specified) until the hole in the bolt threads aligns with a slot on the nut. The split pin is then inserted through the nut and bolt, and the pin’s tangs are bent open 90° or more around the nut.

1.4 Wreckage Information At the accident site, the fore/aft main rotor servo’s control input rod was found disconnected from the input lever, and the connection hardware (bolt, washer, self-locking nut, and split pin) was not found. The fore/aft servo connection hardware also was not found during subsequent comprehensive and detailed examinations of the wreckage and engine. (The NTSB notes that the main rotor transmission area of the helicopter is not sealed. Therefore, if the connection hardware separates during flight, it most likely would not be contained.) The control input rods for both of the main rotor lateral servos and the tail rotor servo were found properly connected to their respective servo input levers.

The fore/aft servo’s control input rod was found in two pieces: one piece was an approximate 14-inch section of the upper input rod end that was found disconnected from the fore/aft servo input lever, and the other piece was an approximate 3-inch section of the lower end of the input tube that was found correctly attached to its linkage. Examination of the 14-inch section of the upper input rod end revealed no visible elongation of the bolt hole. The separation points on both sections of the input rod were consistent with overload/impact damage.

The NTSB notes that the certification document was not issued and not required at the time of AS350 certification but that AS350 and EC130 helicopters have a similar design.

During these examinations, smaller pieces were examined by hand, and sifters and a large magnet were used to separate the pieces for better identification. Larger sections of wreckage, including the engine, were examined to determine whether any pieces of the connection hardware might have fallen inside these sections. In addition, approximately 56 pounds of melted metal were sent to the NTSB’s materials laboratory for radiographic (x-ray) inspection.

NTSB Aircraft Accident Report 1.5 Company Information At the time of the accident, Sundance Helicopters employed 50 pilots and operated 22 helicopters, including 4 Eurocopter EC130-B4, 1 AS350-BA, and 17 AS350-B2 helicopters.

Sundance averaged about 53 tour flights and 90 shuttle flights to Grand Canyon West Airport (GCW) daily during the peak season and 35 tour flights and 40 shuttle flights to GCW daily during the off season (when the accident occurred). In 2011, Sundance operated about 31,350 flight hours and transported over 200,000 passengers. In 2010, Sundance operated about 28,029 flight hours and transported over 175,000 passengers.

On September 20, 2003, a Sundance Helicopters Eurocopter AS350-BA helicopter was involved in a fatal accident near GCW. The helicopter was being operated on a short shuttle route between GCW and a landing site beside the Colorado River. The route from the airport to the river landing site was via a narrow canyon call ed Descent Canyon. On the pilot’s 11th flight through Descent Canyon that day, the helicopter hit a near vertical wall and was destroyed by the impact and subsequent fire. The NTSB determined that the probable cause of the accident was, in part, “the pilot’ s disregard for safe flying procedures and misjudgment of the he licopter’s proximity to terrain . ” The report also stated that Sundance and the FAA conducted inadequate surveillance of air tour operations in Descent Canyon.

In response to that accident, Sundance Helicopters made many changes to its operations and procedures, including, but not limited to, adopting a zero-tolerance safety policy (any pilot caught operating outside of Sundance policy guidelines is terminated immediately), revising its pilot selection process, hiring a new training captain who rewrote and implemented a new training syllabus with a strong emphasis on thoroughness and safety, and forbidding any type of “thrill flight” and making it well known that any indication of that type of flying would result in immediate termination. Further, in January 2011, Sundance Helicopters implemented a safety management system (SMS), which included adding a director of safety who focuses full time on managing the SMS.

1.5.1 Maintenance Program Information Except for component overhauls, all maintenance performed on Sundance helicopters is conducted at Sundance Helicopters’ maintenance base in Las Vegas. About 60 days before the accident, Sundance moved its maintenance activity to a new hangar, which provides more space, better lighting, and, according to maintenance personnel, an improved work environment.

GCW is about 65 nautical miles east of Las Vegas, Nevada.

For more information, see Crash of Sundance Helicopters, Inc., Aerospatiale AS350BA, N270SH, Near Grand Canyon West Airport, Arizona, September 20, 2003, Aircraft Accident Brief NTSB/AAB-07/03 (Washington, DC: National Transportation Safety Board, 2007), available online at http://www.ntsb.gov .

NTSB Aircraft Accident Report 1.5.1.1 Most Recent Maintenance The most recent maintenance performed on the accident helicopter was completed on December 6, 2011 (the day before the accident) and included a 100-hour inspection and the replacement of the tail rotor servo, the engine, and the main rotor fore/aft servo with a new (zero hour) unit.

1.5.1.2 Fore/Aft Servo Installation Procedures The fore/aft servo is located just below the main rotor system, and its installation includes an ice shield that is attached to the top of the servo and that has a cutout for viewing the nut and split pin of the input lever connection when the left main gear box (MGB) cowl is opened for access, as shown in figure 4. The ice shield was installed on the fore/aft servo and is not required to be removed during installation of the fore/aft servo on the helicopter. However, the shield may be removed to provide more clearance around the input rod connection hardware and reinstalled after the servo is installed.

Figure 4. Photograph showing the nut and split pin of the fore/aft servo input rod connection hardware visible through the cutout of the ice shield (about eye level for a pilot inspecting the left MGB area).

A 100-hour inspection is completed every 100 flight hours and includes a combination of visual, condition, and measurement checks throughout the helicopter, as specified in the 100-hour checklist contained in the Eurocopter Aircraft Maintenance Manual.

NTSB Aircraft Accident Report According to Eurocopter’s Aircraft Maintenance Manual (AMM), chapter 67, “Rotors Control,” subsection 4-1, “Removal/Installa tion ― Main Rotor Servocontrols ” (reference number 67-32-00, 4-1), the following procedures should be followed when installing the fore/aft servo: Connect upper ball end of servocontrol to stationary swashplate o Check that there are spacer bushings [18] o Offer-up servocontrol, actuator downwards, install pin, washers, and nut o Torque the nut o Safety nut with cotter pin Connect lower ball end of servocontrol to MGB flared housing o Install pin, washer, and nut o Torque the nut o Safety nut with cotter pin Connect input rod to servocontrol distributor o Install pin, washer, and nut o Torque the nut o Safety nut with cotter pin During postaccident interviews, Sundance Helicopters’ mechanics described the fore/aft servo installation area as accessible, and no difficulties were noted related to the normal fore/aft servo installation procedures. The mechanic stated that during the replacement of the fore/aft servo, he replaced the servo’s upper rod end, reassembled it, and torqued and safetied everything, including securing the input rod connection with a split pin. (However, as noted previously, no split pin was found in the wreckage.) He stated that he then connected the hydraulic lines and retorqued all of the rod ends back to the flight controls. The mechanic estimated that he had performed this process six times before the installation of the fore/aft servo on the accident helicopter and stated that he did not encounter any difficulties during the installation on the day of the accident. He stated that although he normally removes the ice shield, he could not recall whether he removed it during the fore/aft servo installation.

1.6 Self-Locking Nut Reuse Guidance The Eurocopter Standard Practices Manual provides guidance regarding the reuse of hardware on its helicopters. Specifically, regarding the reuse of nuts, section 1.4.2, “Criteria for Re- Using Dual Locking Nuts,” states the following: Prior to re-using the nuts: Make sure nylon lock is not excessively damaged.

In the AMM, in each case, the statement “install pin” means to install the bolt.

Other helicopter manufacturers also have guidance regarding the reuse of nuts. Bell Helicopter guidance on its light helicopters notes that “if measured tare torque value is less than the minimum listed, the lock nut must be replaced.” Sikorsky Aircraft Corporation provides similar guidance regarding torque values and replacement of reused self-locking nuts on its light helicopters.

NTSB Aircraft Accident Report Fit the nut by hand: o If nut can easily be tightened, it is to be discarded o If nut is hard and cannot be tightened by hand, it may be reused (In a workshop, the minimum locking torque value can be read using a torque wrench).

The manual provides a chart indicating that if the self-locking nut can be hand tightened, it is not to be reused. Eurocopter does not require that the nut be replaced when the bolt is replaced, unless the nut does not meet the torque limits. In addition, Advisory Circular (AC) 43.13-1B, “Acceptable Methods, Techniques, and Practices ― Aircraft Inspection and Repair,” section 7- 64, “Self - Locking Nuts,” states, “After the nut has been tightened, make sure the bolt or stud has at least one thread showing past the nut. DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values. ” During postaccident interviews, the mechanic indicated that when determining whether a nut can be reused, he removes it, cleans it, and then inspects it for any cracks, damage, or discoloration. The mechanic indicated that he then threads the nut on the bolt to see if it will thread all the way down, and if he is able to turn the nut down to where the shank is visible, he replaces the nut. In the case of the accident helicopter, he deemed the hardware airworthy.

When asked when or if hardware could be reused, the inspector responded that the Eurocopter Standard Practices Manual provides guidance on when the hardware can be reused.

He reported that based on his personal experience, if the nut can be threaded all the way on by hand, it cannot be reused because it has lost its entire locking feature.

In 2009, Sundance Helicopters began requiring written requests for controlled hardware, such as the bolt and nut used for the fore/aft servo connection. Before 2009, Sundance did not require such documentation (nor is this documentation required by the FAA).

A review of Sundance maintenance records for the accident helicopter dating back to July 9, 2001, revealed no record of the fore/aft servo connection hardware having been requested.

However, the NTSB notes that before the implementation of hardware tracking, the hardware could have been replaced but not documented. Therefore, at the time of the accident, Sundance required mechanics to complete a parts form to request new hardware. However, no such form was completed, and the mechanic indicated that the hardware was reused. If the form had been completed, it would have been included in the maintenance records as documentation that new hardware had been used.

The NTSB notes that following the accident, Sundance Helicopters issued a Quality Alert Notice, which stated that an initial replacement of the connection hardware, including the bolt, washer, and self-locking nut, was to be accomplished at the next scheduled inspection for each The “prevailing torque value” is the torque required to overcome the self -locking feature of the nut.

Eurocopter guidance and AC 43.13-1B start listing minimum prevailing torque values for reused self-locking nuts with a thread size larger than the thread size of the accident nuts.

According to Sundance Helicopters, controlled hardware is hardware specific to the maintenance being performed and is inventoried by the logistics department. Uncontrolled hardware does not require a written request and is readily available to maintenance personnel.

NTSB Aircraft Accident Report helicopter with over 5,000 flight hours and that replacement of the hardware was to be accomplished at each 5,000 flight hours thereafter. Further, the alert notice stated that any time an input rod is disconnected from any of the servos, the nut must be replaced with a new nut.

1.7 Federal Aviation Administration Oversight Sundance Helicopters’ operating certificate is managed by the FAA Las Vegas Flight Standards District Office (FSDO). At the time of the accident, the principal operations inspector (POI) was responsible for six Part 135, one Part 141, one Part 137, and two Part 133 operators. The POI did not have an assistant POI assigned, but he stated that he did not think that this impacted his effectiveness. He characterized Sundance operations personnel as compliant and professional in the conduct of flight operations. He stated in a postaccident interview that he conducted visits often, most of which were unannounced. He further stated that if discrepancies were found, Sundance management cooperatively and proactively corrected the issues and that the company had implemented a viable and functioning SMS program that had helped to identify risk areas. A review of the FAA Program Tracking and Reporting System showed a total of 84 entries related to Sundance in the year before the accident but none were relevant to the accident.

In the 3 years before the accident, the FAA’s principal maintenance inspector had changed four times and the principal avionics inspector had changed three times. The Las Vegas FSDO manager reported that no principal maintenance inspector was assigned from April to September 2011 due to a shortage in office staffing but that surveillance was completed by other office inspectors. A review of the maintenance surveillance records showed that three administrative items, one fuel facility inspection, and one followup on a company incident were completed from April to September 2011.

NTSB Aircraft Accident Report

2. Investigation and Analysi s

2.1 Scenarios Evaluated to Explain the Loss of Control The NTSB evaluated the most likely scenarios for why the helicopter experienced a loss of control during the accident flight: (1) jamming or obstructions in any of the servos, (2) hydraulic system failure, (3) other system failures (a failure not involving the fore/aft servo connection hardware) that could have resulted in the same flight profile, or (4) the disengagement of the fore/aft servo bolt in flight. As explained below, the most likely scenario is the fourth scenario.

The four servos were sent to the Meggitt Control Systems facility in Coventry, United Kingdom, for detailed examination by Meggitt personnel under NTSB supervision. An initial inspection revealed that all four servos were severely damaged by impact forces and, therefore, could not be functionally tested. The four servos were torn down and examined, and the examinations did not reveal any indications of a failure condition (jamming or obstructions in any of the servos) that would have affected the operation of the servo. Further, a review of the helicopter maintenance log revealed no indications of problems on any of the four servos.

No evidence was found indicating that a preimpact loss of hydraulic pressure occurred. A loss of hydraulic pressure is indicated to the pilot by a red HYD alert light and an audible tone. If this occurs, the flight controls can be operated manually. In addition, the hydraulic system has an accumulator backup that allows the hydraulics to be used for a period of time to establish as level an attitude as possible and a safe speed. According to the Eurocopter Rotorcraft Flight Manual (RFM), “Emergency Procedure: Loss of Hydraulic Pressure,” if a loss of hydraulic pressure occurs, the pilot should keep the aircraft at a more or less level attitude and avoid abrupt maneuvers. The RFM advises the pilot to set the indicated airspeed to within 40 to 60 knots (hydraulic failure safety speed) before turning off the hydraulics via the hydraulic cutoff switch located on the collective. The pilot may then continue flight without hydraulic assistance to land as soon as possible by making an approach over a clear and flat area and a no-hover/run-on landing. Therefore, if a loss of hydraulic pressure had occurred, the expected response would be to maintain straight and level flight and to decrease airspeed; however, the radar data showed the helicopter climbing, followed by a sharp left turn. Although the radar data show the helicopter slowing after the left turn, the data are not sufficient to determine if the decrease in groundspeed was the pilot’s response to a loss of hydraulic pressure or as a result of the climb.

During the 100-hour inspection, the mechanic removed and reinstalled the hydraulic belt. During the BFF check of the helicopter, the check pilot found that the hydraulic belt was loose. A dayshift mechanic readjusted the hydraulic belt.

The accumulator backup consists of a pressurized nitrogen cylinder that provides pressure to the system for about 30 seconds to 3 minutes depending on how aggressively or frequently the pilot manipulates the controls. Once at the specified speed, the pilot reverts to manual control per the emergency checklist.

The loss of hydraulic pressure emergency procedure is a basic helicopter training item, and the RFM indicates the pilot should memorize the procedure.

NTSB Aircraft Accident Report Although Eurocopter stated that some other disconnection in the mechanical flight control system could have potentially resulted in the same radar track, no preimpact disconnects were identified in the flight control system during the on-site examination other than the fore/aft main rotor servo control input. Eurocopter also stated that a main rotor servo slide seizure could result in a flight profile similar to the very beginning of the accident sequence but that no such seizure has ever been reported. Further, an emergency procedure exists for such an event that, if properly executed, would allow a pilot to regain full control of the helicopter and land it safely.

Due to the lack of detailed information about the flight profile and the load on the servo control (for example, there were no cockpit voice recorder or flight data recorder data and the radar data were limited), the NTSB and Eurocopter could not conduct a performance (flight controls) analysis of the helicopter’s motion during the accident flight. However, Eurocopter stated that the servo input lever is set on a slight retracting position during cruise flight to counteract a tension flight load applied on the front servo control. Therefore, if the disconnection occurred during the cruise phase of flight and taking into account a slight and progressive increasing of tension flight load applied on the front servo control, the climb of the helicopter as shown in the FAA radar data could be expected. Further, as previously noted, the loss of control of the fore/aft servo would result in a loss of flight control from which a pilot could not recover.

Microscopic examinations of the fore/aft servo ’s attachment area, including the rod end and the clevis area, at the NTSB’s materials laboratory did not reveal any marks indicating that the connection hardware was present at the time of impact. However, evidence, including resolidified aluminum found covering one of the two input rod attachment holes in the fore/aft servo clevis area and resolidified plastic found covering the pilot control input rod end, indicates that the connection hardware was not securing the control input rod to the input lever at the time of the postimpact fire. Regardless, the bolt was present and the control input rod was attached to the fore/aft servo’s input lever at the beginning of the accident flight because proper functioning of the control input rod is necessary for takeoff.

Therefore, the NTSB concludes that the bolt connecting the control input rod to the fore/aft servo’s input lever must have been present at the start of the flight to allow normal flight up until the time of the catastrophic upset, but it was not present immediately before the impact and postimpact fire. Further, based on the evidence, the NTSB concludes that the most likely explanation for the in-flight loss of control is that the fore/aft servo bolt disengaged in flight, which resulted in the separation of the control input rod to the fore/aft servo’s input lever, rendering the helicopter uncontrollable.

2.2 Probable Bolt Loss Scenario The NTSB evaluated the following four scenarios to help determine the likely explanation for how the connection hardware became disengaged in flight: (1) the bolt was sheared by in-flight or impact forces; (2) the bolt fractured for other reasons, such as fatigue or embrittlement; (3) the self-locking nut became separated from the bolt, allowing the bolt to work its way out of the joint due to normal in-flight vibratory forces; or (4) the self-locking nut and split pin were not installed during the servo installation. As explained below, the most likely NTSB Aircraft Accident Report scenario is the third scenario. The other three scenarios were not supported by the evidence. For detailed information about all four scenarios evaluated by the NTSB, see the appendix.

In the high-vibration environment of helicopter operation, a degraded self-locking nut could become loose and unthread by vibration until it falls off the bolt. As noted, in accordance with 14 CFR 27.607, the nut has two separate locking devices (the self-locking nut and split pin) to prevent this. In a March 7, 2012, letter to the NTSB, Eurocopter stated that if there were no split pin behind an airworthy self-locking nut and the nut was correctly torqued, the nut should not loosen and unthread.

Following the accident, Sundance Helicopters’ mechanics inspected all of the company’s Eurocopter AS350 helicopters to ensure that the fore/aft servo hardware was connected and safetied properly. All of the fore/aft servos were found properly connected and safetied with split pins. Additionally, the connection hardware for each of the three main rotor servos on all company helicopters that had 5,000 or more total flight hours was removed and examined. About half of the self-locking nuts from the 13 helicopters examined by the time of the NTSB’s visit to the Sundance facility on January 11, 2012, were determined to have no locking capability, and about half of the bolts had wear markings on the shanks. Examinations of the bolts could not determine where the markings on the bolt shanks originated.

Sundance Helicopters provided the NTSB with self-locking nuts from two of the examined helicopters (N340SH and N351WM) that could be easily and fully tightened or loosened on the accompanying bolts with finger pressure. This indicates that the nuts from the two helicopters were not suitable for reuse because new nuts restrict movement by hand after two to three turns. In addition, torque measurements found that the turning resistance of the nuts on the bolts was about 1 in-lbf (inch pound force) or less in both directions. Figure 5 shows the nuts, upper input rod bolts, and washers removed from N340SH and N351WM next to a new bolt and nuts.

The NTSB visited Sundance’s facility to conduct interviews, examine maintenance records, and review maintenance procedures.

Of the additional helicopters examined after the NTSB’s visit, Sundance Helicopters reported that the bolts were deemed airworthy but that the nuts were not checked; however, all of the nuts and bolts on all of its helicopters’ fore/aft servos have since been replaced.

NTSB Aircraft Accident Report Figure 5. Photograph showing the nuts, upper input rod bolts, and washers removed from N340SH and N351WM next to a new bolt and nuts.

On the basis of this evidence, the NTSB concludes that at the time of the accident, Sundance Helicopters was not following Eurocopter and FAA self-locking nut reuse guidance, which led to the repeated improper reuse of degraded nuts on its helicopters.

The NTSB repeatedly measured the peak tightening (on) and loosening (off) torque on four new test self-locking nuts to compare locking torque. Measurements were made by fixing a calibrated dial-indicating torque wrench in a fixture and tightening and loosening the new nut-bolt combination while recording the peak torque. The nuts were tightened until all bolt threads were engaged by the test nut. The nuts were loosened until the locking portions of the nuts disengaged. The tightening-loosening (on-off) cycle was repeated at least 10 times for the four test nuts. The first application of the nut resulted in the highest resistance torque (4.0 to 4.5 in-lbf) with generally lower torque values with successive on-off cycles. After 10 cycles, the average torque values dropped by almost half.

Calibration was performed by testing the torque wrench with a known weight suspended at a measured distance and comparing the dial indication to the calculated value.

NTSB Aircraft Accident Report If the split pin was installed improperly or not at all, no backup mechanism for a self-locking nut with degraded locking ability was in place to secure the input rod to the fore/aft servo. Eurocopter stated that even if the bolt and nut were improperly torqued or the nut was degraded, the split pin should have prevented the loss of the nut. With the pin installed properly, the self-locking nut can only be removed with very high torque shearing of the pin; however, it is highly improbable that this occurred because the magnitude and direction of the forces needed to shear the pin are not present during controlled operation or normal vibrational loading. However, if the split pin is installed without properly spreading the tangs, the pin can fall out with little effort. Eurocopter stated that this scenario would result in a loss of an improperly torqued or degraded nut after a “short period of time.” In summary, for the bolt to have been able to work its way out of the joint, the following must have occurred: The nut-tightening torque must have been overcome.

The running resistance of the nylon locking feature must have been overcome.

The split pin must have been missing.

The NTSB concludes that the fore/aft servo bolt most likely disengaged because the split pin was installed improperly or it was not installed and a self-locking nut that was either degraded or not torqued was used when the fore/aft servo was replaced. This allowed the nut to unthread and separate from the bolt.

2.3 Postmaintenance Inspections 2.3.1 Quality Control Inspections Sundance Helicopters General Maintenance Manual (GMM) requires independent inspections of specific maintenance actions by designated company QC inspectors. Specifically, the Sundance GMM, section 7.3, “Quality Control Inspection System,” states the following: 1. The following maintenance procedures require a company assigned inspector to sign, initial or stamp to approve for return to service; a. All maintenance functions requiring a safety. (safety wire, split pin etc.)

b. Prior to installation of cowlings or panels that would cover a safety or work procedure.

c. Any maintenance procedure involving a flight control or drive train assembly.

d. Reassembly of a component.

e. Installation of engines, main gearbox or tail rotor gearbox.

Sundance Helicopters was not required to have a GMM because only Part 121 and Part 135 operations that operate aircraft with 10 or more seats are required to have GMMs. However, the company voluntarily implemented a GMM to standardize its maintenance processes and procedures and to supplement its operations specifications.

NTSB Aircraft Accident Report f. Installation of all fuel lines, hydraulic lines and oil lines. (Rigid or Flexible).

2. The assigned QC inspector will review all work packages for completeness to include insuring there are no open blocks. After review the inspector will sign, initial or stamp the cover sheet as indicated.

3. The assigned QC inspector will review all serviceability tags to ensure correct information and will sign, initial or stamp the component serial number verification block.

Nine Sundance maintenance personnel are certified to perform company-required QC inspections.

As noted, after the maintenance tasks were completed on the accident helicopter, a QC inspector inspected the work. During postaccident interviews, the inspector stated that the specific items that needed to be inspected were “a nything that requires a safety or a split pin, all pipes and lines.” He was unable to think of any other inspe ction items. He indicated that when he inspects items, he physically touches things and looks everything over.

The inspector reported that when he inspects a fore/aft servo installation, he looks “ for the two safeties on both the rod ends, the two split pins on the mount hardware, and the safety holding the two bolts that hold the accumulator assembly to the servo.” He specifically stated that he inspected the fore/aft servo input rod, hardware, and split pin and marked them with a torque pen and that he inspected the hydraulic lines that connect to the manifold. He reported that the items to be inspected are easy to access and are not blocked by other components. The inspector stated that he did not find any problems during the inspections. Despite these statements, as discussed previously, the evidence indicates that the split pin was installed improperly or was not present.

The inspector estimated that it took about 40 to 45 minutes to complete the postmaintenance ground run and checks with the mechanic ’s assistance. During the ground run, the mechanic, in part, ensured that there were no leaks and checked the servos to ensure that they were not binding. No problems were identified. The inspector stated that the ground run was completed about 1800. He then completed the paperwork, which readied the helicopter for the maintenance operational check flight the following morning.

2.3.2 External Check Procedures As part of its normal daily operations, Sundance Helicopters conducts external checks of its operating helicopters in accordance with the Eurocopter AS350-B2 RFM. According to the RFM, daily checks must be conducted in accordance with standard helicopter practices and the During QC inspector recurrent training, inspectors are instructed to mark all safeties and line installations with a torque pen, and each inspector is designated a specific color. However, due to fire damage, no torque pen evidence could be found on the helicopter wreckage.

NTSB Aircraft Accident Report appropriate manufacturer’s recommendations by qualified maintenance personnel or a specially trained pilot. These checks include, but are not limited to, the following: A BFF check, which is the preflight check pilots are expected to complete before the first flight of each day. Additionally, Sundance Helicopters had expanded Eurocopter ’s External Checks checklist (Sundance Helicopters AS350B2 Flight Manual Expanded External Checks Checklist, dated February 9, 2011) to include additional items, such as requiring pilots to open all cowlings and visually inspect the MGB and engine areas, to enhance safety. If a helicopter has undergone any maintenance activity, pilots are required to visually inspect any serviced components.

A turn-around check, which is used for checks between flights on the same day. The turn-around check consists of checking the vital fluids, rapidly inspecting the main and tail rotor blades, securing all cargo, and properly latching all doors and cowlings.

Before conducting a check flight, a check pilot conducts a BFF check and, if any discrepancies are noted, coordinates with maintenance to take corrective action. After completing the check flight, the pilot records the check in the helicopter logbook. As noted, a Sundance check pilot conducted a postmaintenance check flight in the accident helicopter on the morning of the accident. Before the check flight, he conducted a BFF check, and after the check flight, he performed another BFF-type check. The left MGB cowl was not opened, nor was it required to be, during the turn-around checks between each flight throughout the remainder of the day.

During postaccident interviews, the check pilot stated several times that he saw nothing in the left MGB cowl area during his preflight inspection that indicated that the helicopter was not in a condition to fly. He stated that if he thought that a split pin or anything was not installed as he would expect it to be, he would immediately stop the preflight inspection and consult maintenance personnel. However, as stated previously, the split pin either was installed improperly or not present, and the check pilot did not note any discrepancy in this area.

The NTSB concludes that the mechanic, inspector, and check pilot each had at least one opportunity to observe the fore/aft servo self-locking nut and split pin; however, they did not note that the split pin was installed improperly or not present.

2.4 Misinterpretation of TOPS Audit Requirements Sundance Helicopters is a member of the voluntary Tour Operators Program of Safety (TOPS). The TOPS program outlines management requirements, pilot qualifications and training, maintenance practices, support personnel training, and minimum equipment for aircraft and requires members to “establish and enforce standards to e nsure that safety is the primary consideration for all air tour operations.” TOPS requirements go beyond the current requirements The check pilot opened the MGB cowl area after the maintenance operational check even though it was not required.

NTSB Aircraft Accident Report applicable to most air tour operations because nearly all helicopters used for air tour operations have 10 or fewer seats, which exempts them from a substantial portion of the Part 135 maintenance program requirements.

Under the TOPS program, members agree to annual independent safety audits, which are conducted by independent evaluators who are paid by TOPS through members’ ann ual fees. In July 2011, TOPS conducted an audit of Sundance Helicopters. The audit indicated that Sundance met the TOPS standards, including one specifying that maintenance personnel should have 3 years of experience maintaining helicopters or have undergone helicopter manufacturer training before being employed with a TOPS operator. However, the investigation revealed that the mechanic and two additional mechanics employed at Sundance during the audit did not meet the TOPS standard for experience or training.

According to the TOPS auditor who performed the Sundance Helicopters audit, when an audit is performed, the operator makes all employee records and training histories available to the auditor. He stated that about 25 percent of the records are audited. In initial interviews, TOPS personnel indicated that auditors are trained to evaluate all pilot and maintenance personnel employment records and training histories, not just a percentage of those records. In later conversations, TOPS personnel indicated that they initially misspoke and that auditing a sampling of the records was an approved procedure. The specifics of TOPS’ auditing procedures were not defined in the TOPS guidance at the time of the Sundance audit.

On June 12, 2012, the Sundance Helicopters director of maintenance indicated in an e- mail that the company’s understanding of the TOPS requirements was that the operator must meet the experience and factory training requirements “collectively,” rather than its staff members having to individually meet the requirements. Additionally, he reported that the maintenance department had undergone yearly TOPS audits with no issues identified.

The NTSB concludes that Sundance Helicopters did not meet the TOPS audit requirements because Sundance’s director of maintenance misinterpreted the TOPS maintenance standards regarding training and qualifications of mechanics. NTSB staff discussed these findings with TOPS personnel in May 2012. In response, TOPS formed an auditing committee, including auditors with more extensive maintenance backgrounds, to evaluate its auditing processes. At its October 2012 board meeting, TOPS discussed the issue regarding the misinterpretation of the mechanics’ experience requirement with its members and auditors and the auditing committee’s findings . TOPS has formalized its audit sampling procedures for maintenance and flight personnel in its 2013 audit program, incorporated this information into its annual auditor training and orientation, and revised its audit-related checklists. In addition, TOPS indicated that it will distribute any additional pertinent information about its auditing procedures to its members at the Helicopter Association International’s annual conference, Heli -Expo, in Las Vegas, Nevada, in March 2013.

According to 14 CFR 135.1, for many air tour operations conducted as nonstop sightseeing flights, only Part 91 maintenance regulations are applicable. Further, many maintenance requirements exist in Part 135 that apply only to helicopters with 10 or more seats.

NTSB Aircraft Accident Report The NTSB notes that on June 12, 2008, as a result of its investigation of the March 8, 2007, accident involving a Eurocopter AS350-BA operated by Heli-USA Airways, Inc., as an air tour flight, which crashed into terrain following a loss of control while landing at Princeville Airport, Princeville, Hawaii, the NTSB issued Safety Recommendations A-08-36 through -38, asking TOPS to do the following.

Coordinate with Tour Operators Program of Safety members to set requirements for establishing and maintaining a system for continuously analyzing the performance and effectiveness of their inspection and maintenance programs to ensure that all maintenance is performed with the utmost regard for quality and safety. (A-08-36) Expand the Tour Operators Program of Safety’s safety audit program to ensure that operators implement an effective maintenance quality assurance program.

(A-08-37) Work with the Federal Aviation Administration to establish appropriate guidance for Tour Operators Program of Safety members on how to develop and implement [33] appropriate inspection and maintenance quality assurance programs. (A-08-38) In response to Safety Recommendations A-08-36 through -38, TOPS updated its annual audit. The NTSB expressed concern that the updated audit only checks that a maintenance quality assurance program is in place but that it does not include standards to properly assess the effectiveness of the program. Currently, TOPS is working with the FAA to develop special emphasis areas so that both members and auditors can determine the effectiveness of a maintenance quality assurance program and to draft an AC that will include best practices for air tour operators and information on accreditation programs available to commercial air tour operators. As a result of these actions, the NTSB stated that Safety Recommendations A-08-36 through - 38 remained classified “Open―Acceptable Response” on July 12, 2012.

More information about this accident, NTSB case number NYC07MA073, is available online at http://www.ntsb.gov/aviationquery/index.aspx .

As a companion to Safety Recommendation A-08-38, the NTSB also issued Safety Recommendation A-08- 35, which asked the FAA to “work with independent safety programs, such a s the Tour Operators Program of Safety, to establish appropriate guidance for their members on how to develop and implement appropriate inspection and maintenance quality assurance programs and to encourage operators to participate in these voluntary programs.” On November 6, 2012, the NTSB classified Safety Recommendation A-08-35 “Open― Acceptable Respo nse” pending review of a proposed AC that will include best practices for air tour operators and information on accreditation programs available to commercial air tour operators.

NTSB Aircraft Accident Report

3. Safety Issues

3.1 Improper Reuse of Degraded Self-Locking Nuts As discussed in section 2.2, NTSB nut torque measurements showed that reusing self-locking nuts leads to a decrease in their locking capability (prevailing torque value). This investigation demonstrated that if a self-locking nut with a degraded locking ability is used and if the split pin is installed improperly or not at all, no backup mechanism is in place to secure the input rod to the fore/aft servo.

Another recent aircraft accident was found to be related to self-locking nuts coming loose, demonstrating that the reuse of nuts with a degraded locking ability affects airplanes as well as rotorcraft. On September 16, 2011, an accident occurred involving an experimental, single-seat North American P-51D at Reno/Stead Airport, Reno, Nevada. The investigation determined that deteriorated self-locking nuts (t he nuts’ insert material was badly deteriorated to the extent that screw-retaining torque could not be maintained) resulted in loose tab attachment screws and fatigue cracking in one screw, which allowed for undesirable movement of the trim tabs and a reduction of stiffness in the elevator (pitch) trim control system. Based on the condition of the nut inserts, the screws likely needed to be tightened several times over the course of the airplane’s recent racing career, providing the ground crew with an indication of a recurrent problem and opportunities to identify and replace the deteriorated hardware. The NTSB determined that the probable cause of this accident was, in part, “ the reduced stiffness of the elevator trim tab system that allowed aerodynamic flutter to occur at racing speeds. The reduced stiffness was a result of deteriorated locknut inserts that allowed the trim tab attachment screws to become loose and to initiate fatigue cracking in one screw sometime before the accident flight. ” Despite manufacturer and FAA guidance that clearly states that if a self-locking nut does not meet the prevailing minimum torque value, it is not to be reused, these accidents indicate that maintenance personnel are not properly following the provided guidance and are reusing self-locking nuts that do not meet the minimum prevailing torque value. Reinforcing the importance of following manufacturer and FAA nut reuse guidance would help ensure that degraded self-locking nuts are not being reused improperly. The NTSB concludes that because a self- locking nut’s locking ability degrades with use, it is critical that maintenance personnel follow manufacturer and FAA self-locking nut reuse guidance to prevent the improper reuse of degraded nuts.

The NTSB believes that this finding indicates that information about the safety hazards associated with improperly reusing degraded self-locking nuts needs to be shared throughout the aviation community and that maintenance inspectors need to be reminded about proper self-locking nut reuse procedures to prevent the improper reuse of degraded nuts. In response to For more information, see Pilot/Race 177, The Galloping Ghost, North American P-51D, N79111, Reno, Nevada, September 16, 2011, Aircraft Accident Brief NTSB/AAB-12/01 (Washington, DC: National Transportation Safety Board, 2012), available online at http://www.ntsb.gov .

NTSB Aircraft Accident Report the NTSB’s concerns on this matter, the FAA Safety Team (FAAST) published a general aviation maintenance alert on its website at http://faasafety.gov in November 2012 and distributed the alert to over 239,000 mechanics and pilots via its e-mail registry. The NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization (IA) renewal training. This information will be included in IA renewal training clinics throughout the United States in 2013. In addition, the FAA will publish an Aviation Maintenance Alert (Advisory Circular 43-16A) in early 2013 related to helicopter maintenance issues.

3.2 Maintenance Human Factors The NTSB evaluated the human factors issues that could have affected the performance of the maintenance personnel. During the investigation, the NTSB determined that the maintenance personnel were not under any time pressure to complete the required work on the day of the 100-hour maintenance inspection, nor were any issues identified with the environment of the hangar, such as lighting or temperature, that would have adversely affected performance.

To rule out systemic occurrence of maintenance errors by the maintenance personnel involved in this accident, the NTSB conducted a review of Sundance Helicopters records. As stated in section 1.2.2.2, the review showed that in June 2011, the QC inspector (acting as a mechanic) failed to properly re- install the chin bubble on one of Sundance’s helicopters, and Sundance determined that his perception of the need to expedite the repair to avoid aircraft downtime was a contributing factor leading to this failure. To evaluate whether this event was representative of the QC inspector’s work, the NTSB randomly selected and reviewed eight maintenance log sheets signed off by the inspector that covered a period of about 4 months before the accident and reviewed all 11 inspections completed by the inspector within the 30 days before the accident. No instances of discrepancies or overlooked items were identified during the NTSB’s review. Further, there were no recorded issues or problems for the mechanic and no reports from his managers of any previous problems.

This section discusses the following safety issues associated with maintenance human factors that affected the maintenance personnel: the role of human fatigue, the need for improved maintenance documentation (work cards with delineated steps), and the lack of human factors training for maintenance personnel.

An IA held by an aviation mechanic expires every odd-numbered year on March 31. IA holders also must meet the yearly training requirements of 14 CFR 65.93. To meet these training requirements, mechanics with an IA can attend a refresher course provided by FAA FSDOs or outside vendors. The refresher courses provide information directly related to aircraft maintenance, inspection, repairs, and alterations, as well as some nontechnical subjects.

Aviation Maintenance Alerts are published monthly and provide the aviation community with an economical means to exchange service experiences and to assist the FAA in improving aeronautical product durability, reliability, and safety.

NTSB Aircraft Accident Report 3.2.1 Maintenance Personnel Fatigue Because the maintenance errors in this accident largely center on the mechanic and the QC inspector, the NTSB evaluated the role of fatigue for these individuals. As discussed previously, on December 5, both the mechanic and the inspector were contacted to report to work on an off-duty day (December 6) to perform the 100-hour inspection, which was maintenance work that needed to be conducted in addition to the work being conducted by the regularly scheduled maintenance crew. Sundance Helicopters’ director of maintenance explained that it was not unusual for the company to contact maintenance personnel on their off-duty days to schedule helicopter maintenance. The following table shows the mechanic’s and inspector’s normally scheduled shift, the shift they were originally scheduled for on December 6, and the actual shifts they worked.

Tab le. The mechanic’s and inspector’s normal shift schedules, the shift they were originally scheduled for on December 6, and actual shifts they worked.

Shift Originally Scheduled for Actual December 6 Personnel Normal Shift December 6 Shift Mechanic 1200 to 2300 Off duty 0550 to 1846 Inspector 1200 to 2300 Off duty 0531 to 1855 The mechanic reported that he normally went to bed about 0200 and awoke between 1000 and 1200, obtaining at least 8 hours of sleep regularly. He stated that the night before the 100-hour inspection, he went to bed about 2200; however, he had difficulty falling asleep until about 0000. He awoke on December 6 about 0500. Therefore, the reported evidence indicates that the mechanic slept for about 5 hours the night before the maintenance was conducted, and he had slept a total of about 21 hours in the 72 hours before the maintenance was conducted. His bedtime was not consistent, and his sleep time fluctuated in length during this period. Further, his work shift on the day of the maintenance began about 6 hours earlier than his regularly scheduled shifts. This evidence suggests that the mechanic did not have an adequate amount of sleep on the night preceding the maintenance and that he did not have sufficient time to adjust to a shift change for an early morning shift instead of his regular 1200 shift.

The QC inspector reported that he normally went to bed about 2200 or 2300 and awoke about 0730 or 0800 every day, obtaining at least 8.5 hours of sleep. Therefore, the reported evidence indicates that the QC inspector slept for about 7 hours the night before the maintenance Evidence exists showing that a 2-hour sleep debt can produce performance decrements comparable to those produced by a blood alcohol level of 0.045 percent and that a 4-hour sleep debt can produce performance decrements comparable to a blood alcohol level of 0.095 percent. For more information, see T. Roehrs, E. Burduvali, A. Bonahoom, et al., “Ethanol and Sleep Loss: A ‘Dose’ Comparison of Impairing Effects,” Sleep 26, no. 8 (2003): 981-985.

For more information, see N. Goel, H. Rao, J. Durmer, and D. Dinges, “Neurocognitive Consequences of Sleep Deprivation,” Seminars in Neurology 29, no. 4 (2009).

For more information, see P.S. Della Rocco and T.E. Nesthus, “Shiftwork and Air Traffic Control: Transitioning Research Results to the Workforce,” in Human Factors Impacts in Air Traffic Management , eds.

B. Kirwan, M.D. Rodgers, and D. Schaefer (Burlington, Vermont: Ashgate Publishing Company, 2005).

NTSB Aircraft Accident Report inspection and that he slept a total of about 15 hours in the 48 hours before the maintenance inspection. His work shift on the day of the inspection began about 6 hours earlier than his regularly scheduled shift. Further, he completed the inspection on the accident helicopter when he had been awake for about 14 hours.

Research shows that adjusting for changes to an early morning shift (phase advance) takes longer than adjusting from a day shift to a night shift (phase delay). Both the mechanic and the inspector would have had to attempt to compensate for this, and inconsistency in work shift has been shown to be a factor associated with the development of fatigue. For the mechanic, the change in shift was associated with a limited sleep opportunity as compared to his normal amount of sleep obtained, which would have contributed to the development of fatigue.

For the inspector, the long duty day would have contributed to the development of fatigue. An NTSB safety study found that flight crewmembers who were awake for more than 12 hours made more procedural errors, tactical decision errors, and errors of omission than those awake less than 12 hours. These findings can be extrapolated to other areas in which individuals work beyond 12 hours. In addition, an analysis of self-reported maintenance incidents conducted by the Bureau of Air Safety Investigation, Australia, showed that maintenance incidents were more frequent as the shift progressed.

In accident investigations, factors commonly examined for evidence related to fatigue are cumulative sleep loss, amount of recent sleep, continuous hours of wakefulness, circadian disruption, time of day, time on task, individual variation, and sleep disorders. Scientific research consistently demonstrated that adequate sleep is necessary to sustain performance. The effects of fatigue are particularly prevalent when these factors overlap. The evidence in this accident shows that the maintenance crew met at least two of the criteria for susceptibility to the debilitating effects of fatigue. Therefore, the NTSB concludes that, because both the mechanic and the inspector had insufficient time to adjust to working an earlier shift than normal, they were experiencing fatigue during the December 6 shift. In addition, the mechanic had an inadequate amount of sleep and the inspector had a long duty day, both of which also contributed to the development of their fatigue.

J. Reason and A. Hobbs, “Managing Maintenance Error: A Practical Guide” (Burlington, Vermont: Ashgate Publishing Company, 2003), 32.

For more information, see Proceedings from the 83rd Annual Scientific Conference , “Aircrew Fatigue― A Review of Fatigue Risk Management” (Atlanta, Georgia: Aerospace Medical Association, 2012).

For more information, see FAA Human Factors Guide for Aviation Maintenance and Inspection (2008), available online at http://www.hf.faa.gov/hfguide/index.html .

For more information, see Review of Flightcrew-Involved, Major Accidents of U.S. Air Carriers, 1978 Through 1990 , Safety Study NTSB/SS-94/01 (Washington, DC: National Transportation Safety Board, 1994).

See NTSB/SS-94/01.

For more information, see Human Factors in Airline Maintenance: A Study of Incident Reports , Department of Transport and Regional Development, Bureau of Air Safety Investigation, Australia (1997).

Department of Transportation, Federal Aviation Administration, 14 CFR Parts 117, 119, and 121. Docket No: FAA-2009- 1093, “Flightcrew Member Duty and Rest Requirements.”

NTSB Aircraft Accident Report 3.2.1.1 Effects of Fatigue on Maintenance The evidence indicates that both the mechanic and the inspector were likely experiencing fatigue during the shift in which the maintenance was performed and that they both made errors during their shift. For example, the mechanic did not properly secure the fore/aft servo connection hardware and did not properly install the hydraulic belt, and the inspector did not detect that these errors had been made. All of these errors are consistent with the known effects of fatigue.

Fatigue can adversely affect performance in various ways that have been demonstrated in scientific research and accident investigations. For example, fatigue associated with sleep loss, shift work, and long duty cycles can lead to increased difficulty in sustaining and directing attention, memory errors, and resultant lapses in performance. Performance may not be universally degraded, but individuals show increased variability in performance as a result of these lapses. Sleepiness can be differentiated into two components: physiological, which is the result of sleep loss, and subjective, which is an individual’s introspective self -report regarding their level of sleepiness. However, factors such as caffeine or stimulating environments can aff ect an individual’s subjective rating of sleepiness and mask their level of physiological sleepiness. Therefore, an individual may not be aware of his or her actual level of physiological sleepiness. Interruptions are an inherent part of the maintenance e nvironment and fatigue’s effects on attention and memory can lead to interruption-induced omissions if appropriate controls are not in place to ensure steps have been completed.

In this accident, the specific sequence of events that led to the maintenance errors on the part of the mechanic and the inspector cannot be determined. However, the fundamental characteristic of the errors made is one of omission – that is, a step was not performed or not As part of the 100-hour inspection, the mechanic also removed the hydraulic belt and then reinstalled it.

During his initial BFF check, the check pilot noted that the tension on the belt for the hydraulic pump was loose.

After a dayshift mechanic checked and retightened the hydraulic belt, the check pilot re-inspected the belt, completed his preflight check, and then proceeded with the check flight.

For the scientific research, see G.P. Kruger, “Sustained Work, Fatigue, Sleep Loss, and Performance: A Review of the Issues,” Work and Stress 3 (1989): 129-141; and F.H. Previc and others, “The Effects of Sleep Deprivation on Flight Performance, Instrument Scanning, and Physiological Arousal in Pilots,” The International Journal of Aviation Psychology 19, no. 4 (2009): 326-346. For the accident investigations, see Crash During Attempted Go-Around After Landing, East Coast Jets Flight 81, Hawker Beechcraft Corporation 125-800A, N818MV, Owatonna, Minnesota, July 31, 2008 , Aircraft Accident Report NTSB/AAR-11/01 (Washington, DC: National Transportation Safety Board, 2011); and Collision with Trees and Crash Short of Runway, Corporate Airlines Flight 5966, British Aerospace BAE-J3201, N875JX, Kirksville, Missouri, October 19, 2004 , Aircraft Accident Report NTSB/AAR-06/01 (Washington, DC: National Transportation Safety Board, 2006), available online at http://www.ntsb.gov .

J.A. Caldwell, “Fatigue in the Aviation Environment: An Overview of the Causes and Effects as Well as Recommended Countermeasures,” Aviation, Space, and Environmental Medicine 68 (1997): 932-938.

M.R. Rosekind, K.B, Gregory, D.L Miller, E.L. Co, and J.V. Lebacqz, Analysis of Crew Fatigue Factors in AIA Guantanamo Bay Aviation Accident (Washington, DC: National Aeronautics and Space Administration, 1994).

The fore/aft servo mechanic assisted the engine mechanic more than once during the engine swap. Although it cannot be determined with certainty at what point throughout his duty day he was assisting the engine mechanic, it is possible that interruptions and distractions were introduced into his work during the fore/aft servo installation. For more information, see A. Chaparro and L.S. Groff, Human Factors Survey of Aviation Maintenance Technical Manuals, 16th Human Factors in Aviation Maintenance Symposium (San Francisco, California: April 2 to 4, 2002).

NTSB Aircraft Accident Report performed properly, whether that step involved installation of the securing hardware (mechanic) or the inspection of the hardware (inspector). Available evidence indicates that both the mechanic and inspector were experiencing fatigue, and the known effects of fatigue can lead to the type of errors that they made . Therefore, the NTSB concludes that both the mechanic’s performance and the inspector’s performance probably were degraded by fatigue, which contributed to the improper securing of the fore/aft servo connection hardware, the improper installation of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively. However, it is important to note that other recognized human factors can also contribute to maintenance errors; accordingly, fatigue cannot singularly explain the maintenance errors related to this accident.

3.2.1.2 Lack of Maintenance Personnel Duty-Time Limitations The NTSB has had longstanding concerns about the effects of fatigue on maintenance personnel. On September 9, 1997, as a result of the May 11, 1996, accident in which a McDonnell Douglas DC-9-32 operated by ValuJet Airlines, Inc., as ValuJet flight 592 crashed into the Everglades swamp shortly after takeoff from Miami International Airport, Miami, Florida, the NTSB issued Safety Recommendation A-97-71, which asked the FAA to do the following: Review the issue of personnel fatigue in aviation maintenance; then establish duty time limitations consistent with the current state of scientific knowledge for personnel who perform maintenance on air carrier aircraft.

The NTSB notes that on November 17, 1997, in response to Safety Recommendation A-97-71, the FAA stated that its data suggested that night shift and/or mixing of day/night work schedules affect performance more than an extended length of duty time but that no current definitive studies were available to evaluate these parameters as comparative measurements. The FAA stated that it was going to expand its human factors research program to include studies regarding duty length and shift scheduling and that at the conclusion of this research, it would implement appropriate policy or regulatory change.

The NTSB notes that in the 15 years since the issuance of Safety Recommendation A-97-71, the FAA has conducted additional research regarding the effects of duty length and shift scheduling as factors contributing to fatigue. Fatigue has been linked to a decrease in cognitive performance, including reduced attention (for example, overlooked and/or misplaced sequential task elements, preoccupation with single tasks, and breakdowns in systematic For more information, see In-Flight Fire and Impact With Terrain, Valujet Airlines Flight 592, DC-9-32, N904VJ, Everglades, Near Miami, Florida, May 11, 1996, Aircraft Accident Report NTSB/AAR-97/06 (Washington, DC: National Transportation Safety Board, 1997), available online at http://www.ntsb.gov .

For more information, see FAA Fatigue Management Symposium, Partnerships for Solutions (Vienna, Virginia: June17-19, 2008), available online at http://www.faa.gov/about/office_org/headquarters_offices/a vs/offices/afs/afs200/media/aviation_fatigue_symposium/aviation_fatigue_symposium.pdf and C.A. Hackworth, J.O. Banks, K.A. Holcomb, W.B. Johnson, and J.J. Hiles, Aviation Safety Inspector’s (ASIs) Maintenance Human Factors Survey , Memorandum Internal FAA Report, FAA Civil Aerospace Medical Institute (Oklahoma City, Oklahoma: 2007).

NTSB Aircraft Accident Report scanning ability) and diminished memory (for example, inaccurately recalling operational events, forgetting peripheral tasks, and reverting to “old” habits). However, the FAA has not taken any regulatory actions in these areas. As a result, on October 7, 2009, the NTSB classified Safety Recommendation A-97- 71 “Open―Unacceptable Response” pending the issuance of duty-time requirements.

Because the Sundance inspector’s fatigue was caused, in part, by extended duty ti me, the NTSB continues to believe that establishing duty-time limitations is a key strategy to reducing the risk of fatigue-related errors in aviation maintenance. The NTSB notes that an even more robust base of scientific knowledge and industry best practices exists on which to formulate such rules than existed when Safety Recommendation A-97-71 was issued. As a result, the NTSB concludes that sufficient scientific research on fatigue and knowledge of industry practices currently exists from which to establish duty-time limitations for maintenance personnel that would help reduce the risk of fatigue-related errors in aviation maintenance. Therefore, the NTSB recommends that the FAA establish duty-time regulations for maintenance personnel working under 14 CFR Parts 121, 135, 145, and 91 Subpart K that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and other factors shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness. Because of the FAA’s inactivity, the NTSB classifies Safety Recommendation A-97- 71 “Closed―Unacceptable Action/Superseded” and classifies Safety Recommendation A-13- 01 “Open―Unacceptable Response.” 3.2.2 Need for Work Cards With Delineated Steps It is likely that the maintenance personnel’s performance was also affected by human factors that have been identified through research to affect the reliability of maintenance and inspections. For example, research suggests that even well-trained, experienced mechanics can inadvertently fail to detect a defect. These failures can occur for various reasons, including the inherent challenges associated with conducting systematic visual inspections, complacency For more information, see B. Sian and J. Watson, Study of Fatigue Factors Affecting Human Performance in Aviation Maintenance, chapter 11 (Washington, DC: Federal Aviation Administration, 1999).

The need to address deficiencies in flight crew duty limitations by incorporating contemporary scientific knowledge on human fatigue factors was on the NTSB’s Most Wanted List for many years. In January 2012, the FAA updated duty and rest requirements for pilots by issuing final rule 14 CFR Parts 117, 119, and 121: “Flightcrew Member Duty and Rest Requirements.” The rule incorporates scientifically based information to recognize the universality of factors that lead to fatigue in most individuals and helps to regulate these factors to protect against flightcrew members in passenger operations from accumulating dangerous amounts of fatigue. For more information, see http://www.faa.gov/regulations_policies/rulemaking/recently_published/media/2120-AJ58-FinalRu le.pdf .

NTSB Aircraft Accident Report and expectations, overreliance on memory for performing tasks or identifying critical areas for inspection, and interruptions (which are common in the maintenance environment).

Using documentation that clearly delineates the steps to be performed and critical areas to be inspected to support the maintenance and inspection task is one way to mitigate these factors.

For example, having clearly delineated steps can help prevent errors associated with interruptions because they aid maintenance personnel’s notation of steps completed and steps remaining, and clearly identifying critical areas helps in the preparation and execution of the task or inspection by directing personnel’s at tention to these areas.

The documentation used by Sundance Helicopters’ maintenance personnel for the fore/aft servo replacement included the paperwork for the 100-hour inspection. This paperwork listed the servo replacement task as an item to be accomplished with a reference to the AMM subsection, “ 4-1 Removal/Installation ―Main Rotor Servocontrols” (reference number 67-32-00, 4-1), which contains a listing of the tools, parts, and delineated sequential steps required to accomplish the task. According to Sundance’s GMM, maintenance procedures requiring the installation of a safety device (for example, a split pin or a safety wire), such as the fore/aft servo replacement, were also required to have an inspector sign off to approve the helicopter for return for service.

However, even though the fore/aft servo replacement task had delineated sequential steps to follow, including several i n which installing a safety was required, the company’s 100 -hour inspection paperwork had only one place for the inspector to sign off for the overall fore/aft servo installation rather than individual places for the inspector to sign off for each step.

Work cards (also known as “job cards”) contain specific instructions for accomplishing a maintenance task and are derived from the AMM guidance. They are designed as self-contained documentation to be used by maintenance personnel in the preparation, performance, and verification of a maintenance task and are designed with usability as a key objective. For example, critical steps are well marked, cautions are noted, blocks are available for recording critical parameters such as torque values, and parallel columns are provided for both mechanics and inspectors to verify completion of related groupings of steps in the task.

Work cards, which are used much like checklists are used in the cockpit, can help to ensure that steps in a maintenance task have been performed and protect against errors. A work card for the fore/aft servo replacement that incorporated Sundance Helicopters’ inspection policy from its GMM would likely have expanded upon steps in the AMM to include at least discrete (separate and distinct) verification blocks for the steps requiring safeties. As a result, both the FAA-H-8083- 30 “Aviation Maintenance Handbook Addendum,” c hapter 14, “Human Factors , ” states the following, “ Complacency is a human factor in aviation maintenance that typically develops over time. As a technician gains knowledge and experience, a sense of self-satisfaction and false confidence may occur. A repetitive task, especially an inspection item, may be overlooked or skipped because the technician has performed the task a number of times without ever finding a fault. The false assumption that inspection of the item is not important may be made. However, even if rare, a fault may exist. The consequences of the fault not being detected and corrected could cause an incident or accident. Routine tasks performed over and over allow time for the technician’s mind to wander, which may also result in a req uired task not being performed.” In addition, no documents required the mechanic to verify completed steps or record critical parameters such as torque values.

NTSB Aircraft Accident Report inspector and the mechanic would have had additional directive aids to help ensure completion of all steps for the task.

Work cards can be developed by the operator or the aircraft manufacturer. Although work cards are not required, AC 120-16E, “Air C arrier Maintenance Programs, ” chapter 3, “Air Carrier Maintenance Manual,” section 302, “Major S ections of the Typical Air Carrier Maintenance Manual ,” b. “Work Cards,” states the following: Work cards, while not a regulatory requirement, have evolved as a best practice.

Work cards are considered part of your air carrier manual and the air carrier mai ntenance program. They are the “what to do” and the “how to do it” part of your airworthiness responsibility. Work cards are used as a simple means of complying with regulations for performing maintenance, as well as maintenance recordkeeping. Work cards provide detailed, concise procedural instructions that organize and control your maintenance activities while providing a means to ensure that your maintenance activities comply with your air carrier maintenance manual. It is an easy way to make sure maintenance, as well as other personnel are following your procedures. The second primary function is to document your maintenance activities, providing a means to comply with your air carrier maintenance recordkeeping requirements.

The FAA also has guidance available to aid in the development of work cards. Further, in FAA Order 8900.1, “Flight Standards Information Management System,” volume 3, “General Technical Administration,” chapter 43, “Evaluate Continuous Airworthiness Maintenance Program/Revision,” dated October 29, 2010, the FAA encourages its inspectors to develop work cards, giving special attention to work cards involving required inspections and flight control systems, and to include delineated tasks with individual inspection sign-off requirements for postrigging verification.

The circumstances of this accident illustrate that the reliability of inspections of critical flight system components can be affected by a number of inherent human factors. Although some manufacturers and operators have established best practices for the development and use of work cards to help protect against human errors in maintenance, aviation safety could be improved through a more widespread application of these best practices. The NTSB concludes that the use of work cards can help prevent and trap errors in the performance and verification of maintenance tasks. Therefore, the NTSB recommends that the FAA encourage operators and manufacturers to develop and implement best practices for conducting maintenance under 14 CFR Parts 135 and 91 Subpart K, including, but not limited to, the use of work cards for maintenance tasks, especially those involving safety-critical functions, that promote the recording and verification of delineated steps in the task that, if improperly completed, could lead to a loss of control.

For example, see C.G. Drury, FAA Human Factors Guide for Aviation Maintenance and Inspection , chapter 6, “Procedures and Technical Documentation,” which can be found online at http://www.hf.faa.gov/hfguide/06/06.pdf .

NTSB Aircraft Accident Report 3.2.3 Lack of Human Factors Training for Maintenance Personnel Currently, federal regulations do not require maintenance personnel to receive human factors training. However, some foreign authorities do require human factors training for their maintenance personnel and have developed human factors guidance and curriculums that address various issues, including fatigue. The NTSB has not previously made a specific recommendation that maintenance personnel should be provided human factors or fatigue training. However, on March 5, 2004, as a result of the January 8, 2003, accident in which a Raytheon (Beechcraft) 1900D, operated by Air Midwest (doing business as US Airways Express) as flight 5481, crashed shortly after takeoff from runway 18R at Charlotte-Douglas International Airport, Charlotte, North Carolina, the NTSB issued Safety Recommendation A-04-16, which asked the FAA to do the following: Require that 14 Code of Federal Regulations Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance.

On June 18, 2004, the FAA agreed that a human factors component should be part of a maintenance training program and stated that it would address this recommendation via future guidance and rulemaking on air carrier maintenance training programs. On October 12, 2005, the NTSB stated that its recommendation for a human factors program was broader than simply providing human factors training to maintenance personnel and, therefore, classified Safety Recommendation A-04- 16 “Open―Unacceptable Response.” Subsequent FAA correspondence on Safety Recommendation A-04-16 described the development and availability of guidance material on maintenance human factors and outreach activities in this area. On February 15, 2011, the FAA reasserted its position that the best strategy to address this recommendation was through a requirement for initial and recurrent training in maintenance human factors. The FAA further stated that it had initiated the Air Carrier Maintenance Training Program rulemaking project to develop a notice of proposed rulemaking (NPRM) proposing to require the approval of air carrier maintenance training programs and set clear training standards that include comprehensive human factors training. On July 7, 2011, the NTSB acknowledged that training could be an effective component of a human factors program but stated that pending a requirement for air carriers to implement comprehensive human factors programs, Safety Recommendation A-04- 16 would remain classified “Open― Unacceptable Response.” On November 16, 2011, the FAA stated that the NPRM addressing air carrier maintenance training programs that includes comprehensive human factors training and FAA approval of maintenance training programs was expected to be published by June 30, 2012. On March 6, 2012, the NTSB reiterated its position and classification of Safety Recommendation For example, see European Aviation Safety Authority Regulation Part 145 Section ANNEX II, Section 30 (e).

For more information, see Loss of Pitch Control During Takeoff; Air Midwest Flight 5481, Raytheon (Beechcraft) 1900D, N233YV, Charlotte, North Carolina, January 8, 2003, Aircraft Accident Report NTSB/AAR-04/01 (Washington, DC: National Transportation Safety Board, 2004), available online at http://www.ntsb.gov .

NTSB Aircraft Accident Report A-04-16. Therefore, although the FAA has developed substantial guidance for the industry about maintenance human factors in the almost 9 years that have elapsed since Safety Recommendation A-04-16 was issued and has repeatedly stressed the importance of human factors training as a way to address the intent of this recommendation, there remains no requirement for human factors training for maintenance personnel involved in air carrier operations. On November 6, 2012, the FAA provided an update stating that it expected to issue the NPRM sometime in 2013.

The NTSB notes that the FAA issued an NPRM on May 21, 2012, proposing that repair stations operating under 14 CFR Part 145 provide human factors training relevant to aviation maintenance for employees performing maintenance, preventive maintenance, alterations, or inspection functions. However, if adopted, the rule would not require maintenance personnel working for Part 121 and 135 operators or Part 91 Subpart K programs to receive human factors training.

The FAA has also developed guidance, which contains sample educational materials, that addresses human factors affecting maintenance personnel, including ways to prevent fatigue during maintenance activities, in its online resources addressing human factors in maintenance and inspection. As discussed in section 3.2.1.2, one strategy to prevent human error in maintenance resulting from fatigue is through the implementation of duty-time limitations.

Another important strategy to help reduce the risk of fatigue-related errors in maintenance is to train and educate maintenance personnel through human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue.

The NTSB concludes that all maintenance personnel would benefit from receiving human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue, which would help to reduce the likelihood of human errors in aviation maintenance. Because comprehensive human factors programs could reduce the likelihood of human error in aviation maintenance, the NTSB reiterates Safety Recommendation A-04-16. Further, the NTSB recommends that the FAA require that personnel performing maintenance or inspections under 14 CFR Parts 121, 135, 145, and 91 Subpart K receive initial and recurrent training on human factors affecting maintenance that includes a review of the causes of human error, including fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue.

See “Repair Stations; Proposed Rule” published at 77 Federal Register 30054-30086 on May 21, 2012.

For example, see https://hfskyway.faa.gov/hfskyway/fatiguehome.aspx .

NTSB Aircraft Accident Report

4. Conclusions

4.1 Findings 1. The bolt connecting the control input rod to the fore/aft servo’s input lever must have been present at the start of the flight to allow normal flight up until the time of the catastrophic upset, but it was not present immediately before the impact and postimpact fire.

2. The most likely explanation for the in-flight loss of control is that the fore/aft servo bolt disengaged in flight, which resulted in the separation of the control input rod to the fore/aft servo’s input lever, rendering the helicopter uncontrollable.

3. The fore/aft servo bolt most likely disengaged because the split pin was installed improperly or it was not installed and a self-locking nut that either was degraded or not torqued was used when the fore/aft servo was replaced. This allowed the nut to unthread and separate from the bolt.

4. The mechanic, inspector, and check pilot each had at least one opportunity to observe the fore/aft servo self-locking nut and split pin; however, they did not note that the split pin was installed improperly or not present.

5. Because a self- locking nut’s locking ability degrades with use, it is critical that maintenance personnel follow manufacturer and Federal Aviation Administration self-locking nut reuse guidance to prevent the improper reuse of degraded nuts.

6. At the time of the accident, Sundance Helicopters was not following Eurocopter and Federal Aviation Administration self-locking nut reuse guidance, which led to the repeated improper reuse of degraded nuts on its helicopters.

7. Sundance Helicopters did not meet the Tour Operators Program of Safety (TOPS) audit requirements because Sundance’s director of maintenance misinterpreted the TOPS maintenance standards regarding training and qualifications of mechanics.

8. Because both the mechanic and the inspector had insufficient time to adjust to working an earlier shift than normal, they were experiencing fatigue during the December 6 shift. In addition, the mechanic had an inadequate amount of sleep and the inspector had a long duty day, both of which also contributed to the development of their fatigue.

9. Both the mechanic’s performance and the inspector’s performance probably were degraded by fatigue, which contributed to the improper securing of the fore/aft servo connection hardware, the improper installation of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively.

NTSB Aircraft Accident Report 10. Sufficient scientific research on fatigue and knowledge of industry practices currently exists from which to establish duty-time limitations for maintenance personnel that would help reduce the risk of fatigue-related errors in aviation maintenance.

11. The use of work cards can help prevent and trap errors in the performance and verification of maintenance tasks.

12. All maintenance personnel would benefit from receiving human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue, which would help to reduce the likelihood of human errors in aviation maintenance.

4.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was Sundance Helicopters’ inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate postmaintenance inspections, which resulted in the in-flight separation of the servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable.

Contributing to the improper or lack of installation of the split pin was the mechanic’s fatigue and the lack of clearly delineated maintenance task steps to follow. Contributing to the inadequate postmaintenance inspection was the inspector’s fatigue and the lack of clearly delineated inspection steps to follow.

NTSB Aircraft Accident Report

5. Recommendations

5.1 New Recommendations The National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Establish duty-time regulations for maintenance personnel working under 14 Code of Federal Regulations Parts 121, 135, 145, and 91 Subpart K that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and other factors shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness.

(A-13-01) (Supersedes Safety Recommendation A-97-71 and is classified “Open―Unacceptable Response”) Encourage operators and manufacturers to develop and implement best practices for conducting maintenance under 14 Code of Federal Regulations Parts 135 and 91 Subpart K, including, but not limited to, the use of work cards for maintenance tasks, especially those involving safety-critical functions, that promote the recording and verification of delineated steps in the task that, if improperly completed, could lead to a loss of control. (A-13-02) Require that personnel performing maintenance or inspections under 14 Code of Federal Regulations Parts 121, 135, 145, and 91 Subpart K receive initial and recurrent training on human factors affecting maintenance that includes a review of the causes of human error, including fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue. (A-13-03) 5.2 Previously Issued Recommendation Reiterated in This Report Safety Recommendation A-04-16, to the FAA, is reiterated in section 3.2.3 of this report.

Require that 14 Code of Federal Regulations Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance.

5.3 Previously Issued Recommendation Reclassified in This Report Safety Recommendation A-97-71, to the FAA, is classified “Closed― Unacceptable Action/Superseded” in section 3.2.1.2 of this report. The recommendation is superseded by Safety Recommendation A-13-01 above.

Review the issue of personnel fatigue in aviation maintenance; then establish duty time limitations consistent with the current state of scientific knowledge for personnel who perform maintenance on air carrier aircraft. (A-97-71) NTSB Aircraft Accident Report BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member EARL F. WEENER Member Adopted : January 29, 2013 Member Rosekind filed the following concurring statement on February 5, 2013.

NTSB Aircraft Accident Report

Board Member Statements

Member Mark R. Rosekind, Concurring Member Rosekind filed the following concurring statement on February 5, 2013; Chairman Hersman, Vice Chairman Hart, and Members Sumwalt and Weener joined in the statement: On December 7, 2011, a Sundance Helicopters, Inc., helicopter operating on a “Twilight Tour” sightseeing trip crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada.

The pilot and four passengers were killed, and the helicopter was destroyed. The safety issues identified in this accident investigation included the fatigue experienced by both the mechanic and the quality control inspector. For both individuals, fatigue was due to insufficient time to adjust to working an earlier shift than normal. Also, the mechanic had an inadequate amount of sleep and the inspector had a long duty day, both of which also contributed to the development of their fatigue. The investigation found that their performance was degraded by fatigue, which contributed to securing the fore/aft servo connection improperly, and their failure to identify this deficiency in the post-maintenance inspection of the accident helicopter.

Maintenance Personnel Duty Limits – Long Overdue Addressing the need for maintenance personnel duty limits is not a new issue. The NTSB has had longstanding concerns about the effects of fatigue on all safety-critical operations including maintenance. Over 15 years ago, the Board issued Safety Recommendation A-97-71 that asked the FAA to review fatigue in aviation maintenance personnel and then establish duty-time limitations consistent with the current state of scientific knowledge. This recommendation resulted from a 1996 accident in which ValuJet flight 592 crashed into the Everglades shortly after takeoff from Miami International Airport. The crash was caused, in part, by the aircraft inspector’s fatigue due to extended duty time. The FAA subsequently responded to the NTSB that because of a lack of scientific data in this area, it would expand its human factors research program to include studies regarding duty length and shift scheduling. At the conclusion of this research, the FAA was to implement an appropriate policy or regulatory change.

In that decade and a half since the issuance of Safety Recommendation A-97-71, the FAA has conducted additional research regarding the fatigue effects of duty length and shift scheduling with results that show substantial decreases in cognitive performance, reductions in attention, and degradations in memory. Even with this additional information, the agency has not acted to address this issue or the 15-year old NTSB recommendation. As a result, at the Sundance Helicopter accident Board Meeting, Safety Recommendation A-97-71 was classified “Closed― Unacceptable Response/Superseded ” and was superseded by a new safety recommendation A-13-01 that was classified as “ Open ― Unacceptable Response. ” In the intervening 15 years, there is an even more robust base of scientific knowledge and industry best practices to substantiate the fact that duty-time limitations are a critical strategy for NTSB Aircraft Accident Report reducing the risks of fatigue in aviation maintenance. Much of this science led to, and is the basis for, the FAA’s new hou rs of service rules for flight crews that were issued in December 2011.

Fatigue is fatigue and a tired maintenance employee suffers from the same performance decrements experienced by a tired pilot. The alertness of both is crucial to safe aircraft operations. As the FAA said in its hours of service rule, “ Fatigue threatens aviation safety because it increases the risk of pilot error that could lead to an accident. ” This is particularly a concern for crews that fly “… o n the back side of the clock.” M aintenance personnel can easily be substitute d here for “pilot” and “crew;” fatigue creates parallel risks to flight safety for all humans involved in any aspect of operations.

The time is long overdue for the FAA to issue duty-time regulations for maintenance personnel that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and data shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness.

Human Factors Training ― Critical Complement to Duty Limits Duty limits are necessary to ensure maintenance personnel alertness and operational safety, but they alone are insufficient. A comprehensive and complementary strategy for reducing the risks of fatigue in aviation maintenance must go beyond duty limits and include human factors training for all maintenance personnel. Based on the Sundance helicopter accident, the NTSB recommended that this human factors training be required, and include fatigue education and training on: (1) the causes of fatigue; (2) its effects on performance; and (3) actions individuals can take to prevent the development of fatigue. Like duty limits, this training is long overdue.

As a result of the 2003 US Airways Express flight 5481 crash at Charlotte-Douglas International Airport, the NTSB issued Safety Recommendation A-04-16 for the FAA to require that Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance. In the intervening nine years, the FAA has developed substantial guidance for the industry about maintenance human factors and has repeatedly stressed the importance of human factors training as a way to address the intent of this recommendation. Yet there remains no requirement for human factors training for maintenance personnel involved in air carrier operations. Safety Recommendation A-04-16 remains classified “ Open – Unacceptable Response. ” Even though the FAA issued a notice of proposed rulemaking last year that would someday require repair stations to provide human factors training for employees performing maintenance, preventive maintenance, alterations, or inspection functions, these regulations would not include maintenance personnel working for Part 121 and 135 operators or Part 91 Subpart K programs. Based on the Sundance Helicopter accident, the NTSB reiterated Safety Recommendation A-04-16.

The Sundance investigation illustrates that human factors training for ALL aircraft maintenance classifications, including the type of fatigue training outlined above, is essential for NTSB Aircraft Accident Report reducing the likelihood of human error in aviation maintenance. The nine-year old outstanding, unacceptable status of Safety Recommendation A-04-16 on human factors training needs action.

Conclusion Aircraft maintenance personnel have an invaluable role in safe aircraft operations, with their work often conducted “behind the scenes.” This Sundance helicopter accident highlights that their work is equally important to the work performed by the more visible pilot and flight crew. It is unacceptable that the duty limits and training opportunities for maintenance personnel have not kept pace with what is required of their other industry colleagues. No matter how accomplished and professional the Sundance helicopter pilot was, the deficiencies in the fore/aft servo connection ― in part due to maintenance personnel fatigue ― resulted in an unrecoverable crash. By acting on the NTSB Safety Recommendations on duty limits and human factors training in this report, the industry can make real progress to prevent future accidents of this kind and the resulting loss of life. Maintenance errors have been the cause of numerous tragedies over the course of aviation history, and it is unacceptable to wait another decade or more before regulations, duty-time limitations, and human factors training fully recognize and address the known safety gaps.

NTSB Aircraft Accident Report

6. Appendix

NTSB Analysis of Possible Bolt Loss Scenarios Scenario 1. Shearing of the Bolt If the bolt was sheared either during operation or impact, the high loads needed to shear the bolt would be expected to cause elongation or deformation of the clevis holes on the servo; however, no such evidence was found. Further, if the bolt was sheared, scrape marks might have been left on the inside surfaces of the clevis from the fragments of the bolt being forcibly dragged out of it; however, no such evidence was found. Further, if shearing occurred during impact, it is likely that at least pieces of the bolt or other parts of the connection hardware would have been found at the accident scene because the deformation in the bolt pieces would not allow the pieces to be easily liberated. As noted in this report, no pieces of the fore/aft servo connection hardware were found.

To further investigate the possibility of the bolt shearing, Eurocopter supplied the NTSB with its calculations of the ultimate structural load capacity of several components. These calculations showed that the weakest component in the servo input area was the input rod. If loaded in compression, a buckling failure would be expected at a load of about 3,752 lbf.

Physical examinations of the input rod did not reveal any indications of a buckling failure. The input rod is also the weakest member under tension loads with a calculated tensile capacity of 6,775 lbf. These compare to the calculated minimum double shear load of 7,868 lbf for the bolt.

The clevis fracture load was estimated to be at least 6,700 lbf for one side and 13,400 lbf for both sides. For control system design, 14 CFR 27.397 (a)(2) specifies a limit pilot force of 100 pounds for fore and aft motion of stick controls. Eurocopter reports a force ratio of 1:5.12 from the collective to the servo input. Therefore, a 100-lbf pilot input to the collective would result in a 512-lbf load into the input rod and bolt, which is a force at least 7 times less than that required to cause these components to fail. Therefore, although the magnitude of the loads needed to break the bolt and the clevis could easily have been generated by impact forces, it is well beyond the capability of the pilot.

It could be argued that 14 CFR 27.397 does not realistically describe a helic opter’s collective lever, which requires an upward motion, and that a pilot under duress could exert a much greater load. The FAA Human Factors Design Standard presents static muscle strength The NTSB notes that the tight fit of the bolt in the clevis hole would limit the deformation of the hole. The differential hardness of the components is a large factor in determining the locations of damage with the softer component typically showing the majority of the damage. In this case, the bolt is the softer component; therefore, it would be expected to have accumulated the most damage. However, as noted, this piece was not found for examination.

The estimation was based on a measured cross section of the lug (0.1 inch x 0.338 inch) and a conservative 100,000 pounds per square inch tensile strength.

V. Ahlstrom and K. Longo, Human Factors Design Standard (HF-STD-001) (Atlantic City International Airport, New Jersey: Federal Aviation Administration, William J. Hughes Technical Center, 2003).

NTSB Aircraft Accident Report data that closely represent the motion of a collective lever. The data show that a 95th-percentile male in weight can produce a peak force of 246 lbf, or only about 33 percent of the force needed to buckle the input rod and only 16 percent of the force needed to shear the bolt.

Scenario 2. Fracturing of the Bolt A second scenario to remove the bolt would be for the bolt to fracture in a low-deformation mode, such as fatigue or an embrittlement process. Eurocopter reported no history of bolt fatigue or embrittlement. However, following the fracture, the separated bolt pieces must still exit the joint to fully disengage the input rod from the servo. The process of bolt extraction could occur by either energetic extraction or progressive movement. For energetic extraction, sufficient energy would have to be released by the fracture process to rapidly eject the bolt pieces out of the joint without damage. Although some fracture processes can generate these kinds of energies, it is very unlikely in this instance because normal input rod loads are low and limited by the pilot’s control force ability and the leverage associated with the linkage, and the assembly torque (strain) is relatively low. Slower progressive extraction might leave physical evidence, such as edge deformation of the clevis holes, and no such damage was found.

Scenario 3. Nut Separating From the Bolt The nut could separate from the bolt by (1) shearing of the nut or bolt threads, (2) fracturing of the nut, or (3) unthreading of the nut, all of which presume the use of a degraded nut and the lack or loss of the split pin for the bolt to separate from the joint. A self-locking nut that was not torqued could also unthread from the bolt.

To shear the nut or bolt threads, axial loads must be applied to the bolt. However, the only significant axial loads are from the tightening torque on the bolt. These are estimated to be between 475 and 1,600 lbf, well below the estimated 4,000 lbf load needed to shear the nut or bolt threads; therefore, shearing of the nut or bolt threads is unlikely.

With little or no load on the nut, hydrogen embrittlement from processing is one of the few possible nut fracture modes. However, like the bolt, the nut has a low probability of fracture due to its low hardness. Further, Eurocopter reported no history of nut fractures.

In the normal high-vibration environment of the helicopter, the nut could also become loose and unthread by vibration until it falls off the bolt. In accordance with 14 CFR 27.607, the nut has two separate locking devices (the self-locking nut and split pin) to prevent this. In a March 7, 2012, letter to the NTSB, Eurocopter stated that if there was no split pin behind an airworthy self-locking nut and the nut was correctly torqued, the nut should not loosen and unthread. However, the turning resistance (locking capability) of the nut is degraded with repeated use as demonstrated by the minimal locking capability found on half of the nuts removed from Sundance Helicopters’ in -service helicopters after the accident.

If the split pin was installed improperly or not at all, there would be no backup mechanism for a nut with a degraded locking ability to secure the input rod to the fore/aft servo.

Eurocopter stated that even if the bolt and nut were improperly torqued and t he nut’s locking ability was degraded, the split pin should have prevented the loss of the nut. With the pin installed properly, the nut can only be removed with very high torque shearing of the pin, but it is NTSB Aircraft Accident Report highly improbable that this occurred. However, if the split pin is installed without properly spreading the tangs, the pin can fall out with little effort. Eurocopter stated that this scenario would result in a loss of the nut after a “short period of time.” Scenario 4. Nut and Split Pin Not Installed The shortest path to a disconnect of the bolt from the joint would be if the nut and split pin were not installed at all, which would only require enough time and vibration for the bolt to work its way out of the joint. However, with a properly installed servo, the fore/aft servo nut and split pin are clearly visible for inspection when the left MGB cowl is open, and this area of the helicopter was inspected at least twice on the day of the accident. Although the QC inspector and check pilot most likely did not notice the improperly installed or missing split pin, it is more likely that they would have noticed a missing nut and split pin. Further, it is unlikely that the helicopter could have flown safely for 3.5 hours before the accident if neither of these components had been installed.