Swedish Stick Shake: Dormant Sensor Defect not Detected on Installation
A serious incident occurred on 29 September 2016 to BAE Systems 146 / Avro RJ100 SE-DSP operated by Braathens Regional Aviation on departure from Malmö Airport in Sweden, when the stick shaker and the stick pusher were erroneously activated.
The Swedish Accident Investigation Board (the Statens Haverikommission [SHK]) explain in their final report:
At the pre-flight inspection the operator’s engineer detected damage on the left airflow sensor. The sensor was replaced, which caused a delay of more than 30 minutes.
The take-off was normal until lift off, when the stick shaker was activated. However, the flight crew quickly identified the warning as false.
A warning was indicated on the instrument panel, (IDNT 1). The commander pressed the IDNT/INHIB 1 button and the INHIB part of the button lit up, but felt that nothing happened.
[The] memory action to inhibit stick push was not performed.
Later during the climb, when they got into clouds at 660 feet above the ground the stick push was activated, which means that the control column is pushed forward. By following the emergency checklists, the systems could be shut down which solved the problems. Thereafter a normal landing was performed.
Safety Investigation: Failure Mode
The SHK say:
An examination of the left hand airflow sensor showed that the unit was incorrectly assembled and that it was 45–50 degrees out of the specification for all angle readings.
To get a stick shake it is sufficient for one sensor to indicate a high angle of attack. In order for the stick push to be activated, one sensor must have a high angle of attack and the other must have a high angle or a high rate of change.
The most likely explanation for stick push activation is that the turbulence caused the change rate of the serviceable airflow sensor to become large enough.
Safety Investigation: Maintenance
The SHK examined the maintenance:
Initially the idea was to just replace the damaged vane assembly. However, there was no vane in the store, but only a complete airflow sensor.
The engineer printed out instructions for removal and installation of airflow sensor from the aircraft maintenance manual [AMM] and commenced the removal. At the same time as the new airflow sensor was delivered, the crew also arrived and received information that the flight would be delayed.
The airflow sensor [authorised release] certificates were reviewed and accepted, and the installation commenced.
A frequent feature in such investigations:
During the installation, the engineers were interrupted several times by different people who wondered when they should be ready. This was perceived as stressful by the engineers.
After completing the installation, the engineers:
…browsed through to the last page of text in the manual, where the tests to be carried out after installation usually is written.
The engineers read the test instructions for the “vane assembly”, i.e. installation of the vane, and not for replacement of the airflow sensor. After installation of the vane, only one test of the heating should be performed, which was also done with approved results. However, the engineers thought that this test seemed insufficient, why they decided to also perform a return to service test (RTS) for the airflow sensor and a sensor screen test. Both of these additional tests were performed with approved results.
Because of their misinterpretation of the AMM a functional test of the airflow sensor was not performed. Additionally:
In the aircraft technical log it was documented that the installation was performed according to the reference AMM 27-33-37 401 which is the installation of the airflow sensor. That a sensor screen test was performed was not documented.
Neither double inspection [i.e. independent inspection], according to the maintenance manual, or re-inspection according to the company’s MOE [Maintenance Organisation Exposition, which defined this as a critical task] was performed.
The SHK note that the AMM describes the removal/installation of the airflow sensor and replacing the vane in the same chapter:
The design of the chapter and its underlying tasks do not have clearly defined sections between the two different tasks.
Typically, assembled parts are described as an assembly, in this case the vane is referred to as an assembly. Airflow sensor is described as a sensor although this component consists of two assembled parts.
This however does not explain the dormant sensor failure, only why the aircraft released as serviceable.
Safety Investigation: Sensor
The sensors history is as follows:
The SHL arranged for a laboratory inspection of the sensor:
At the examination it was noted that the vane shaft gear clamp was tight but was not oriented per the drawing. In addition, the two potentiometer shaft gear clamps were tight but not oriented correctly. One of the potentiometer clamps was interfering with the spring that connects the two potentiometer gears when the vane was moved to the corresponding stop (See fig. 10 and 11). This resulted in the spring stretching, and returning the vane gear to a neutral position when the vane was let go. When the spring was removed, the vane shaft appeared to balance normally.
At the examination the unit was found to be 45 to 50 degrees out of specification on all the angle readings. The unit could operate normally after calibration.
The component maintenance organisation, Safe Flight Instrument Corporation (SFIC), do not conduct an independent inspection after maintenance on these sensors and do not apply tamper or warranty seals.
In the absence of tampering or warranty seals, it is impossible to determine if the device has been delivered incorrectly or if someone has manipulated it at a later stage.
The serious incident was caused by the mix up of test instructions for installation of “Vane assembly” and “Airflow sensor” which led to a prescribed functional test was not performed and the fault in the airflow sensor was not detected.
- The different component names ‘Vane assembly’ and ‘Airflow sensor’ enhance the risk of confusion between tasks.
- The interruptions during the change of the airflow sensor were a stress factor which increased the risk of mistakes.
- Re-inspection after replacement of airflow sensor was not performed.
Actions taken by the operator and its maintenance organisation:
- A Safety Bulletin has been issued specially focused on “Memory Actions” and the current event.
- “Memory Action Sheet” that will be available on board to help the pilot.
- Recurrent training has been introduced regarding the incident and affected systems.
- CVR routines is trained in the flight simulator at OPC [Operators Proficiency Check]
- The MOE revised 3 October 2016 and updated in accordance with Commission Regulation (EU) 2015/1536, ED 2016/011/R (AMC+GM), critical maintenance tasks and aircraft continuing airworthiness monitoring.
The type certificate holder took the following actions:
- An information leaflet has been issued to all operators specially focused on “Memory Actions” and the current event. Flight Operations Support Information Leaflet (FOSIL 17-005).
- Introducing changes of the AMM section 27-33-37. The name Vane Assembly has been changed to Vane.
SHK Safety Recommendations
The SHK issued recommendations to the FAA and EASA to:
Encourage that components that require specially approved maintenance facilities are sealed to detect unauthorized manipulation. (RL 2017:18 R1 and R2)**
* It is a little odd that the sensor assembly anomalies are not listed as either a cause or contributing factor.
** Its not clear if the SHK thought tampering may have occurred or whether they see these recommendations as simply a prudent safety enhancement.
UPDATE 31 May 2019: The Portuguese accident investigation agency, GPIAAF, issued a safety investigation update on a serious in-flight loss of control incident involving Air Astana Embraer ERJ-190 P4-KCJ that occurred on 11 November 2018. The aircraft was landed safely after considerable difficulty, so much so the crew had debated ditching offshore. GPIAAF conformed that incorrect ailerons control cable system installation had occurred in both wings during a maintenance check conducted in Portugal.
GPIAFF note that: “By introducing the modification iaw Service Bulletin 190-57-0038 during the maintenance activities, there was no longer the cable routing and separation around rib 21, making it harder to understand the maintenance instructions, with recognized opportunities for improvement in the maintenance actions interpretation”. They also comment that: “The message “FLT CTRL NO DISPATCH” was generated during the maintenance activities, which in turn originated additional troubleshooting activities by the maintenance service provider, supported by the aircraft manufacturer. These activities, which lasted for 11 days, did not identify the ailerons’ cables reversal, nor was this correlated to the “FLT CTRL NO DISPATCH” message.”
GPIAFF comment “deviations to the internal procedures” occurred within the maintenance organisation that “led to the error not being detected in the various safety barriers designed” in the process. They also note that the error ” was not identified in the aircraft operational checks (flight controls check) by the operator’s crew.”
UPDATE 1 June 2019: Our analysis: ERJ-190 Flying Control Rigging Error
Aerossurance is pleased to be supporting the annual Chartered Institute of Ergonomics & Human Factors’ (CIEHF) Human Factors in Aviation Safety Conference for the third year running. We will be presenting for the second year running too, this time on the subject of the FSF‘s Maintenance Observation Programme concept.
This year the conference takes place 13 to 14 November 2017 at the Hilton London Gatwick Airport, UK with the theme: How do we improve human performance in today’s aviation business?