FAA Rules Applied: So Misrigged Flying Controls Undetected (Maintenance Human Factors and Independent inspections)

On 30 April 2018, Cessna 172M Skyhawk II, N9085H, crashed shortly after takeoff in Bermuda.

Cessna 172 N9085H Accident Bermuda (credit: AAIB)

Cessna 172 N9085H Accident Bermuda (credit: AAIB)

The Accident Flight

In their investigation report the UK Air Accidents Investigation Branch (AAIB) say:

The flight was planned to consist of a number of circuits and landings to refamiliarise the pilot with the aircraft [after it] had undergone a prolonged maintenance input. As this was the aircraft’s first flight after maintenance, the pilot fully checked the flying controls and their range of movement during the pre-flight checks. On completion of the in-cockpit pre-flight checks, the pilot confirmed that the elevator trim was set to the correct position for takeoff by checking that the trim indicator was in the takeoff position. Shortly after takeoff the aircraft exhibited a tendency to pitch nose down despite the application of nose up trim. The pilot decided to terminate the flight… During the final approach, the pitch-down tendency increased to the point where the pilot was unable to maintain the glidepath. The aircraft struck the ground approximately 15 metres from the runway threshold.

The aircraft received significant damage and the pilot had minor injuries.

N9085H was operated and maintained by a Bermuda-based organisation, holding [Bermuda Civil Aviation Authority] BCAA approvals for the continued airworthiness and maintenance of several aircraft. Prior to the leasing of N9085H, the BCAA had requested changes to the aircraft’s maintenance program, which were implemented, but responsibility for airworthiness regulatory oversight remained with the [Federal Aviation Administration] FAA and the maintenance of the aircraft was carried out by two FAA-licensed engineers.

The Safety Investigation

Given the pilot’s account, the investigators focussed on the aircraft’s flying controls.

No defects were found within the aileron, rudder or elevator control circuits or the range and freedom of control surface movement. Photographs of the aircraft, taken immediately after the accident showed the elevator trim tab in a position which corresponded to a nose down trim position.

The AAIB explain that:

The Cessna 172 is fitted with a moveable trim tab on the right elevator. The trim tab is used to ‘trim’ the aircraft and allow it to be flown at various attitudes with minimal pilot control force.

Cessna 172 Pitch Trim System (Credit: via AAIB)

Cessna 172 Pitch Trim System (Credit: via AAIB)

AAIB comment:

Operation of the elevator trim system showed that the elevator trim tab moved in the opposite sense to the movement of the elevator trim wheel in the cockpit, with movement of the trim wheel to increase nose up trim resulting in movement of the trim tab to increase the aircraft’s tendency to pitch nose down. Detailed examination…confirmed that the trim tab drive chain was engaged on the actuator drive sprocket and that the chain guard was correctly fitted. Further examination showed that the elevator trim system cables were correctly routed through the fuselage but the section of the cables and chain in the horizontal stabiliser had been rotated through 180º, crossing the cables and drive chain. This resulted in the trim tab moving in the opposite sense to that commanded by the trim wheel input.

The AAIB go on to say:

…the aircraft’s maintenance records showed that the aircraft had undergone a prolonged maintenance input…during which the elevators, rudder and horizontal and vertical stabilisers had been removed to allow replacement of the horizontal stabiliser’s forward spar. Interviews with the mechanics involved…confirmed that reference had been made to the [Aircraft Maintenance Manual] AMM, including the warning relating to the trim tab movement, when reinstalling the flying controls. c172 amm warning No abnormalities were identified during any of the post-installation function checks. The movement of the elevator trim tab in the opposite sense to the movement of the control wheel, highlighted in the warning at the end of the AMM trim system reinstallation procedure, provided an opportunity for an incorrectly-connected trim system to be identified and corrected.

Despite promoting maintenance human factors (HF) for many years, there is still no FAA requirement to do an independent inspection on this size of US aircraft and so no independent inspection was done.  In contrast:

The maintenance organisation’s procedures for Bermuda-registered aircraft included a requirement to carry out duplicate inspections of all flight-critical components, including flying controls and trim systems, after any maintenance action.

The AAIB go on to say:

The behaviour of the aircraft shortly after takeoff did not match the behaviour anticipated by the pilot. It has been demonstrated that such situations induce a significant increase in the pilot’s mental workload which greatly increases the time taken to assess the unexpected situation and carry out corrective actions. The pilot’s lack of recent flying experience in the aircraft, and the increase in physical workload, required to control the aircraft, would have compounded this effect.

Safety Action

The Bermuda-based maintenance organisation has introduced procedures to ensure that duplicate inspections of all flight critical systems are carried out, in line with its BCAA-approved maintenance procedures, on any aircraft that they operate or maintain, regardless of its State of Registration.

Sadly the AAIB choose not to make the obvious safety recommendation to the FAA, despite the large number of N registered aircraft operating in the UK (and here in an Overseas Territory).

Safety Resources

We have previously discussed very similar cases here Misrigged Flying Controls: Fatal Maintenance Check Flight Accident, involving a more modern Piper PA-46-350P Malibu Mirage (N962DA) in 2015 and here Too Rushed to Check: Misrigged Flying Controls involving a Piper PA-12 (N3280M) in 2017.  We also wrote Crossed Cables: Colgan Air B1900D N240CJ Maintenance Error  In 2003 a B1900D crashed on take off after errors during flying control maintenance. We looked at the maintenance human factors safety lessons from this and another B1900 accident that year. We also discuss two cases were the normal sound airmanship of pre-flight ‘full and free’ control checks would have prevented an accident:

In 1992 the gust locks had not been fully disengaged on a third-party DHC-4T Turbine Caribou conversion, N400NC, leading to a horrific fatal accident that killed 3. https://youtu.be/YydkHy2P0dU We have previously written:

UPDATE 31 May 2019: The Portuguese accident investigation agency, GPIAAF, issued a safety investigation update on a serious in-flight loss of control incident involving Air Astana Embraer ERJ-190 P4-KCJ that occurred on 11 November 2018.  The aircraft was landed safely after considerable difficulty, so much so the crew had debated ditching offshore.  GPIAAF conformed that incorrect ailerons control cable system installation had occurred in both wings during a maintenance check conducted in Portugal.

Misrigged Flying Control Cable, Air Astana Embraer EJ-190 P4-KCJ (Credit: GPIAFF)

Misrigged Flying Control Cable, Air Astana Embraer EJ-190 P4-KCJ (Credit: GPIAFF)

GPIAFF note that: “By introducing the modification iaw Service Bulletin 190-57-0038 during the maintenance activities, there was no longer the cable routing and separation around rib 21, making it harder to understand the maintenance instructions, with recognized opportunities for improvement in the maintenance actions interpretation”.  They also comment that: “The message “FLT CTRL NO DISPATCH” was generated during the maintenance activities, which in turn originated additional troubleshooting activities by the maintenance service provider, supported by the aircraft manufacturer. These activities, which lasted for 11 days, did not identify the ailerons’ cables reversal, nor was this correlated to the “FLT CTRL NO DISPATCH” message.”

GPIAFF comment “deviations to the internal procedures” occurred within the maintenance organisation that “led to the error not being detected in the various safety barriers designed” in the process.  They also note that the error ” was not identified in the aircraft operational checks (flight controls check) by the operator’s crew.”

UPDATE 1 June 2019: Our analysis: ERJ-190 Flying Control Rigging Error

Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements: mop Aerossurance can provide practice guidance and specialist support to successfully implement a MOP. Aerossurance is pleased to be both sponsoring and presenting at a Royal Aeronautical Society (RAeSHuman Factors Group: Engineering seminar Maintenance Error: Are we learning? to be held on 9 May 2019 at Cranfield University. raes are we learning 43,000 C172s have been produced.

Aerossurance has extensive air safety, operations, airworthiness, human factors, aviation regulation and safety analysis experience.  For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com