Misrigged Flying Controls: Fatal Maintenance Check Flight Accident

Time pressures, a maintenance error rigging flying control cables and a potentially non-compliant design conspired to cause a fatal accident in the US in 2015.

Prior Maintenance

The 6 seat Piper PA-46-350P Malibu Mirage N962DA had undergone an annual inspection at Rocket Engineering in Spokane, WA and was due for a post-maintenance check flight on 7 May 2015. The US National Transportation Safety Board (NTSB) say in their report (and the associated public docket) that:

….routine maintenance was performed, along with the replacement of the four aileron cables in the wings, and an aft elevator cable.

An added complexity was that the owner had contracted another maintenance organisation to embody avionic modifications while the aircraft was at Rocket Engineering. The avionics maintenance organisation:

…stated that as the upgrade progressed, the owner made multiple requests to add additional items to the work scope, and due to time constraints, not all of his requests could be accommodated. The owner reported that he had made arrangements to pick up the airplane on May 5th, however as the work progressed, he was informed that the airplane would not be ready in time, and the date was pushed back to May 7 and then May 8.

The mechanic who performed and signed off on the annual inspection and who did the control cable replacement said:

….he was called multiple times by the airplanes owner for update checks during the weeks leading up to the accident. Each time additional items were discovered which needed to be repaired, further pushing back the completion date. He eventually referred the owner to the sales representative…because he felt he could be more, “diplomatic” with the owner. The mechanic…held an FAA airframe and powerplant certificate (A&P), with inspection authorization (IA). He had been an A&P mechanic for 22 years, and attained his IA rating 17 years prior. He reported replacing aileron cables in the PA-46 series about five prior times in his career. He stated that he worked exclusively on the accident airplane during the weeks leading up to the accident, and that he replaced the left and right aileron balance cables, along with the two aft aileron drive cables on May 5, 6 and 7. He reported replacing the cables in accordance with the procedures outlined in the maintenance manual, and that he removed and replaced each cable one-at-a-time to prevent inadvertent misrouting. Following completion, he checked aileron operation from both inside and outside the airplane, confirming smooth and full deflection. As part of the test procedures, he checked the neutral position on both ailerons, and then he used a protractor for angular aileron deflection measurements. [He] stated that there was no unusual rush or pressure to get the airplane finished that day [and] he was not aware of any outside pressure from the pilot to have it finished that day.

The NTSB do however comment that the pilot due to do the post-maintenance check flight:

…had an appointment with an FAA medical examiner the next morning (Friday), and he typically did not work on Fridays. It is likely that the mechanic and pilot felt some pressure to be finished that day so the owner could depart in the morning and the pilot could attend his appointment.

The NTSB say:

At the time of the accident, Rocket Engineering had a set of inspection criteria in place for aircraft that had undergone heavy modifications…. However, no formal procedures were established requiring that the work performed by a mechanic following an annual inspection be independently inspected. Furthermore, although 14 Code of Federal Regulations Part 121 and 135 [only for aircraft with 10 passenger seats or more] (air carrier, commuter, or on-demand operations) state, in part that, “No person may perform a required inspection if that person performed the item of work required to be inspected,” there is no equivalent requirement for aircraft operated under Part 91 regulations. The installing mechanic reported that once the work was completed, he asked another mechanic to check his work, asking him specifically to confirm the operation of the ailerons. In a subsequent interview, the other mechanic stated that he assisted with reattaching the ailerons, along with checking security and installation of safety wire, but he was never asked to, nor did he, confirm the correct operation of the ailerons.

The Piper Maintenance Manual includes a functional check and caution:

The Accident Flight

The pilot was a retired Air Force Lieutenant Colonel and former test pilot who was employed byRocket Engineering and typically performed post-conversion, post-maintenance and customer familiarisation flights. He was accompanied by a customer service and sales representative, who held a private pilot certificate, “as a second set of eyes”.

The preflight checklist outlined in the normal procedures section of the pilot’s operating handbook, includes a check to confirm “proper operation” of the primary flight controls from within the cockpit, along with a check of the ailerons and hinges during the walk-around. The location of the pilot’s seat within the cockpit allows for a clear view of both ailerons through the cabin windows.

In a another sign of possible haste:

According to the mechanic, the pilot performed the preflight inspection while the mechanic was still reinstalling the seats and readying the cabin. Shortly after takeoff, the airplane began to roll right. As the climb progressed, the roll became more pronounced, and the airplane entered a spiraling dive. The pilot was able to maintain partial control after losing about 700 ft of altitude; he guided the airplane away from the airport and then gradually back for a landing approach. During this period, he reported to air traffic control personnel that the airplane had a “heavy right aileron.” As the airplane passed over the runway threshold, it rolled right and crashed into a river adjacent to the runway.

Examination of the Aircraft

The NTSB say:

Examination of the right aileron control system revealed that the aileron balance and control cable routing had been crossed over in the area of the cabin floor, between the center pulleys and wing root pressure vessel seals. As such, the balance cable continued through the wing on a route to the drive side of the aileron sector wheel, and the drive cable conversely continued on a route to the balance cable side. Under this condition, both the left and right ailerons would have deflected in the same direction rather than differentially. Therefore, once airborne, the pilot was effectively operating with minimal and most likely unpredictable lateral control, which would have been exacerbated by wind gusts and propeller torque and airflow effects.

While the NTSB note that the maintenance manual contained a caution on cable reversal, we also observe that the applicable certification requirement of Part 23.685 Control System Details is:

(d) Each element of the flight control system must have design features, or must be distinctively and permanently marked, to minimize the possibility of incorrect assembly that could result in malfunctioning of the control system.

The NTSB make no direct comment on the aircraft type’s compliance with that requirement (originally dating from 1964), but they do say:

The sections of the two interchanged cables within the wing were about equal lengths, used the same style and size of termination swages, and were installed into two same-shape and -size receptacles in the aileron sector wheel. In combination, this design most likely permitted the inadvertent interchange of the cables, without any obvious visual cues to maintenance personnel to suggest a misrouting.

This implies the design was non-compliant with the applicable certification requirements. Identical requirements also exist in Part 25.671(b) Control Systems General for large aeroplanes, Part 29.671(b) for large rotorcraft and Part 27.671(b) for smaller rotorcraft.

The NTSB go on:

Although the misrouting error should have been obvious during the required post-maintenance aileron rigging or function checks, the error was not detected by the installing mechanic [or by the pilot].

NTSB Probable Cause

The mechanic’s incorrect installation of two aileron cables and the subsequent inadequate functional checks of the aileron system before flight by both the mechanic and the pilot, which prevented proper roll control from the cockpit, resulting in the pilot’s subsequent loss of control during flight. Contributing to the accident was the mechanic’s and the pilot’s self-induced pressure to complete the work that day.

Our Comments

It is disappointing that no comment is made by the NTSB on the lack of a human centred error tolerant design or the certification compliance, though they do say that:

No PA-46 accidents attributed to the reversal of the aileron cables were found in the NTSB accident database, nor did a search of FAA service difficulty reports (SDR‘s) reveal any events.

Its not clear how many misrigged cables have occurred but been caught by functional checks in the past, though reporting of near misses is not nearly as effective as an initial error proof design. We note that in a 22 year career the mechanic had only done this task just 5 times, further highlighting the importance of error tolerant human centred design (HCD).

Other Safety Resources

Aerossurance has previously looked at these associated topics:

Also see our review of The Field Guide to Understanding Human Error by Sidney Dekker presented to the Royal Aeronautical Society (RAeS): The Field Guide to Understanding Human Error – A Review

UPDATE 31 May 2019: The Portuguese accident investigation agency, GPIAAF, issued a safety investigation update on a serious in-flight loss of control incident involving Air Astana Embraer ERJ-190 P4-KCJ that occurred on 11 November 2018. The aircraft was landed safely after considerable difficulty, so much so the crew had debated ditching offshore. GPIAAF conformed that incorrect ailerons control cable system installation had occurred in both wings during a maintenance check conducted in Portugal.

GPIAFF note that: “By introducing the modification iaw Service Bulletin 190-57-0038 during the maintenance activities, there was no longer the cable routing and separation around rib 21, making it harder to understand the maintenance instructions, with recognized opportunities for improvement in the maintenance actions interpretation”. They also comment that: “The message “FLT CTRL NO DISPATCH” was generated during the maintenance activities, which in turn originated additional troubleshooting activities by the maintenance service provider, supported by the aircraft manufacturer. These activities, which lasted for 11 days, did not identify the ailerons’ cables reversal, nor was this correlated to the “FLT CTRL NO DISPATCH” message.”

GPIAFF comment “deviations to the internal procedures” occurred within the maintenance organisation that “led to the error not being detected in the various safety barriers designed” in the process. They also note that the error ” was not identified in the aircraft operational checks (flight controls check) by the operator’s crew.”

UPDATE 1 June 2019: Our analysis: ERJ-190 Flying Control Rigging Error

An excellent initiative to create more Human Centred Design (HCD) by use of a Human Hazard Analysis (HHA) is described in Designing out human error

HeliOffshore, the global safety-focused organisation for the offshore helicopter industry, is exploring a fresh approach to reducing safety risk from aircraft maintenance. Recent trials with Airbus Helicopters and HeliOne show that this new direction has promise. The approach is based on an analysis of the aircraft design to identify where ‘error proofing’ features or other mitigations are most needed to support the maintenance engineer during critical maintenance tasks. The trial identified the opportunity for some process improvements, and discussions facilitated by HeliOffshore are planned for early 2018.

Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:

Aerossurance can provide practice guidance and specialist support to successfully implement a MOP.

UPDATE 25 May 2017: Nearly 6 months after article Business and Commercial Aviation make this article available online: Two Chances Lost: Pilot And Mechanic Both Miss Aileron Hook-Up Error

UPDATE 19 May 2018: If you had spent 2 years rebuilding a classic Piper PA-12 you’d make the time to check the rigging of the flying controls before first flight, right? Sadly, the pilot in this fatal case study was in a rush: Too Rushed to Check: Misrigged Flying Controls

We will be presenting at the Flight Safety Foundation (FSF) International Air Safety Summit (IASS) in Dubai, 14-16 November 2016.

Aerossurance is pleased to be supporting the annual Chartered Institute of Ergonomics & Human Factors’ (CIEHF) Human Factors in Aviation Safety Conference for the third year running. We will be presenting for the second year running too, this time on the subject of the FSF‘s Maintenance Observation Programme concept.

This year the conference takes place 13 to 14 November 2017 at the Hilton London Gatwick Airport, UK with the theme: How do we improve human performance in today’s aviation business?

Aerossurance is also pleased to sponsor the 9th European Society of Air Safety Investigators (ESASI) Regional Seminar in Riga, Latvia 23 and 24 May 2018.

Aerossurance is pleased to be both sponsoring and presenting at a Royal Aeronautical Society (RAeS) Human Factors Group: Engineering seminar Maintenance Error: Are we learning? to be held on 9 May 2019 at Cranfield University.

Aerossurance has extensive air safety, design, airworthiness, maintenance human factors and accident analysis experience. For aviation advice you can trust, contact us at: enquiries@aerossurance.com