FACTUAL INFORMATION
History of the flight During the pre-flight inspection, the pilot in command noticed that the elevators were drooping. He checked that the control lock was engaged and found that while the aileron and rudder systems were locked, the elevator system was not. He attempted to lock the elevators but was unable do so, nor could the engineer on tarmac duty. The engineer assured the pilot that, as the control lock system was rendered inoperative in flight, it would be safe to fly the aircraft and that the defect would be rectified when the aircraft returned to Brisbane later that day. The engineer was correct as the control locks are rendered inoperative in flight. The defect was then correctly deferred in accordance with Sunstate CAA approved Volume No.1 procedures, and the aircraft was subsequently despatched. Soon after the aircraft became airborne, the co-pilot, who was the pilot flying the aircraft, notified the pilot in command that he believed there was a control abnormality in that more aft elevator than normal was required to rotate the aircraft. Upon reaching cruise altitude, the pilot in command took over the controls and confirmed that the control column was aft of its normal position when the aircraft was in level flight. Following a controllability check in the landing configuration, the aircraft returned to Brisbane. A subsequent inspection revealed that a rudder control rod had been fitted to the elevator control system, altering the geometry of that system and causing the abnormal control column position. Maintenance aspects The elevator and rudder control rod systems run parallel to each other and are routed through the ceiling of the aircraft in the area above the galley. Each system has a number of interconnecting rods which run fore and aft between roller guides. The elevator and rudder control rods are similar in appearance but the elevator control rod is 35 mm longer than the rudder control rod. On 3 October 1994, a licensed aircraft maintenance engineer had raised a deferred maintenance control sheet for replacement of the "elevator control rod L/H above toilet cabin dividing wall". (When facing forward in the aircraft, the left rod is the rudder control rod). A parts order form was submitted to order a new elevator control rod. On 11 November 1994 another maintenance engineer found that the elevator control rod referred to on the deferred maintenance control sheet did not require replacement. Consequently, the elevator control rod which had been ordered was not required and was returned to the parts store. However, this engineer noticed that the adjacent rudder control rod was excessively worn so he raised a deferred maintenance control sheet for that item. A replacement rudder control rod was ordered on 15 November 1994 and arrived on 9 December 1994. A periodic maintenance inspection was carried out on the aircraft during the weekend of 10 and 11 December along with maintenance which had been deferred. On 10 December work was started on the control rod change as required by the deferred maintenance control sheet form SA113. The form was part of a work package which detailed the tasks to be carried out during the maintenance period. The engineer who recorded the elevator control rod defect on 3 October assigned himself to the task of changing the rod. The word "RUDDER", approximately 100 mm long, was pencilled on the old rudder control rod and the elevator rod was marked with the letters "ELEV". During discussions the Maintenance Manager indicated that the wording may have been placed on the rods in order to prevent confusion at aircraft assembly. It has since been noted that various rods throughout several aircraft have the particular system name pencilled on them. This appears to have been an unofficial factory procedure. The local Short Brothers Technical Representative was advised by the factory that "the operator should read the part number". The engineer who replaced the rod incorrectly identified the worn rod as the rudder control rod. He then removed that rod, which was in fact the elevator rod, without positively identifying it. After obtaining the new rudder rod from the parts store he did not compare it with the old rod because he was called away to do another job and placed the new rod, still in its container, on a workbench. When he returned to the task, he removed the new rod from its container and fitted it to the aircraft. He did not notice that the old rod had a different part number printed on it, had the letters "ELEV" pencilled on it, and was longer than the new rod. On completion of the work another engineer was asked to perform a "dual inspection." This inspection was required by the maintenance control manual volume one, the manufacturer's maintenance manual where it is referred to as a "duplicate inspection", and Civil Aviation Regulation 42G(1) where it is referred to as an "independent inspection". The engineer who performed this inspection had been multi-tasked and was doing unplanned work when he was asked to carry out the duplicate inspection. After being shown the rod that had been changed he checked it for security and freedom of movement. He subsequently countersigned the duplicate inspection certification sheet. The duty senior engineer reported that towards the end of his shift, when he was compiling the paperwork, he found that the signatures on the duplicate inspection sheet had been incorrectly placed in the aileron column at the top of the sheet. He said that he had pointed this out to the engineer who performed the inspection, who subsequently took the sheet to the engineer who had changed the rod. The inspecting engineer returned the sheet to the senior engineer with the word 'aileron' crossed out and the word 'rudder' written above it. The work was completed by 0830 hours on 11 December. As a result of the incorrect rod being installed in the elevator system, the elevator control lock was rendered inoperative due to the altered geometry of the control system. At about 1745 hours on 11 December, the aircraft was towed from the hangar for an engine run. The flying controls are required to be locked during towing, when the aircraft is parked, and when it is taxied by engineers. The engineer who towed the aircraft from the hangar did not notice that the elevator control could not be locked. Standard company procedure is to engage the flight control lock prior to commencing an engine ground run. The elevator system could not be locked so the engine run was commenced with the elevator control lock disengaged. The control lock must be disengaged if ground runs in excess of idle are required in order for power levers to be advanced past the control lock baulk. A daily inspection certificate was signed on the Maintenance Log of the day at 0300 hours on 12 December, certifying that the items on the daily inspection schedule in the maintenance control manual volume two had been carried out. The last item on the schedule states: "Flight controls and trim controls full and free and correct operation". The certifying engineer for this inspection did not notice that the elevator control lock could not be engaged. The aircraft was then towed from the hangar to the apron on the opposite side of the airport. The fact that the elevator control lock could not be engaged was not noticed. Maintenance manuals The Shorts SD3-60 maintenance manual, the Civil Aviation Regulations and the operator's maintenance control manual volume one, contain specific details regarding maintenance practices with control rods. Both engineers involved in the rectification work indicated that these publications had not been consulted before or during the performance of the work. A new version of the operator's maintenance control manual volume one was approved by the Civil Aviation Authority on 11 February 1994 and was implemented by the operator thereafter. Copies of the maintenance control manual volume one were located in the company's technical library and also in the hangar at a workstation which houses other paperwork and forms. Investigation of staff awareness and training revealed that both engineers had undergone familiarisation with the maintenance control manual volume one on Tuesday 15 March 1994. Personnel information The engineer who performed the rudder rod replacement was appropriately licensed and endorsed to perform the task. He joined the airline in March 1991 and held airframe and engine ratings. He had two rostered days off immediately prior to the occurrence, but had worked three night shifts before that. He indicated that, despite the two days off, he still felt tired on the day of the incident and thought this was because he had not fully recovered from the three night shifts. He did not at any time advise his immediate supervisor or senior managers that he was fatigued. The engineer had been involved in three car accidents which affected his ability to work on stands, operate some tools, and write legibly. The company had not at any time been made aware of the car accidents. The management was aware of the engineer's unsteadiness whilst he was working on stands, and the engineering manager had discussed the problem with him some weeks prior to the incident. He had agreed to see a company doctor. The engineer who performed the dual inspection was correctly licensed and qualified to carry out the task. He held engine and airframe ratings. He had been rostered off for four days prior to the occurrence. Shift roster The operation of the airline is dependent on co-ordinating maintenance requirements with operational requirements to achieve the schedule. This involves the conduct of the maintenance at night and on weekends. The shift roster consists of two crews of seven engineers and four crews of two engineers. The seven-person crews work three night shifts, two days off, two day shifts, three days off, two night shifts, and then two days off. The two-person crews work two day shifts followed by two night shifts and then have four days off. The two night shifts commence at 1715 and finish at 0415 the following morning. The remaining seven-person crew commence at 1800 and finish at 0425, while the day shift commences at 0600 and finishes at 1700. The engineer who fitted the rod incorrectly was on the two-day roster after having worked three nights. He did not consider two days off adequate time to recover after working three 10.4 hour night shifts. Some engineers felt that their health suffered because of the roster, while others indicated that they felt fatigued much of the time because of the interrupted sleep pattern. The matter was an industrial issue at the time, and when the company recently announced that four permanent day shift positions would become available (with corresponding reduction of penalties and allowances) no engineers were forthcoming for the shift change. As a result company management considered the shift structure was not a serious issue. The night shift engineers were isolated from the day crews as the shifts did not overlap. Some engineers felt that management did not appreciate their concerns about matters that had safety implications. This latter issue seemed to be more a result of inadequate communication between management and the engineering staff, but nevertheless resulted in discontent and attitudinal problems for some engineers. Working environment The maintenance facility is approximately 3 km from the airline's apron and this reportedly caused inconvenience as aircraft had to be towed or taxied from one side of the airport to the other for maintenance. The airline used the parent company's hangar for maintenance and did not have a dedicated area that was close to the parts store and the technical records. This often required engineers to walk long distances from the working area to the other facilities and was an annoying aspect of the work environment. Regulatory aspects During the Bureau of Air Safety Investigation's survey of the maintenance facility, some regulatory discrepancies were identified. The discrepancies included aspects of training, daily inspections, and quality assurance. Training There was no training program in place in accordance with Civil Aviation Regulation 214. This regulation refers to the training of maintenance personnel, and states that the operator shall make provision for the proper and periodic instruction of all maintenance personnel, and the training program shall be subject to the approval of the regulatory authority. Daily inspections Reference copies of the daily inspection schedule were not located in the aircraft or the tarmac office. At ports where engineering staff were not available to conduct daily inspections, pilots signed the maintenance log to reflect that they had completed the daily inspection schedule when the check was actually completed in accordance with a pre-flight check schedule. Consequently, some items on the daily inspection schedule were being signed for when in fact they had not been performed. Quality assurance The company did not employ a quality assurance inspector but was subject to periodic inspections from the parent company. This did not facilitate a day to day, hands on approach to quality assurance. However, systems that exceeded Civil Aviation Authority requirements were in place at the time of the incident and both licensed aircraft maintenance engineers had attended a briefing on the Volume No 1 procedures following their introduction.
ANALYSIS
The engineer who had incorrectly identified the rod tasked himself with fitting the new rudder rod. He did not follow basic procedure and practices and fitted the incorrect rod. A "safety net" failed when an adequate duplicate inspection of the system was not carried out. The engineer responsible for the duplicate inspection had been multi-tasked and was doing unplanned work when he was asked to do the inspection. His attention was divided at the time and this may have influenced the amount of time he spent on the inspection. There was however adequate time to correctly carry out the inspection. The written procedures were not adhered to, and the independent inspection failed to detect that the wrong control system had been worked on. Training No formal training course had been conducted for the aircraft type, nor was one required, as it is a 'Group One' aircraft. Familiarisation training had been conducted by the aircraft manufacturer prior to the incident and one of the involved engineers had attended this training. The non-adherence to established procedures may indicate a poor attitude toward compliance with the maintenance control manual and manufacturer's maintenance manuals. Design Although the rods were clearly marked with identification numbers, and the attachment fittings were identical, the length of the rudder control rod was not compatible with the design requirement of the elevator control system. A more effective design is necessary to prevent the inadvertent interchange of incompatible components. This could be achieved by the use of dissimilar attachment fittings.
CONCLUSIONS
Findings 1. The maintenance engineers were correctly licensed to carry out the task. 2. The engineer incorrectly identified the worn rod as an elevator control rod. 3. A new rudder rod was fitted to the elevator control system. 4. The effect of the new rod on control deflections was not checked after work was completed. 5. The engineer responsible for carrying out a duplicate inspection did not recognise that the elevator system had been worked on instead of the rudder system. 6. The duplicate inspection was not carried out in accordance with published procedures. 7. The elevator control lock could not be engaged. This was not detected by the engineer who conducted the daily inspection 8. The pilot was unable to lock the controls during his pre-flight inspection. 9. An engineer advised the pilot that the malfunctioning control lock was not a major defect. 10. There was no formal SD3-60 training course for engineering staff. Significant factors 1. The worn control system was incorrectly identified by the engineer who replaced the rod. 2. The new control rod to be fitted was not compared with the old rod which had been removed. The rudder rod and the elevator rod were similar in appearance. 3. The duplicate inspection was not carried out in accordance with published procedures. 4. The elevator control lock malfunction was not diagnosed fully, and to allow the aircraft to be despatched, the item was deferred in accordance with company procedures.
SAFETY ACTION
The Bureau of Air Safety Investigation issues safety advisory notice SAN 960055 to the Civil Aviation Safety Authority. The Bureau of Air Safety Investigation highlights this occurrence to the Civil Aviation Safety Authority (CASA) with particular reference to the transposition of the elevator and rudder control rods. The Bureau suggests CASA review certification standards to prevent the possibility of incorrect components being fitted to primary flight control systems and bring this to the attention of recognised authorities. The Bureau also draws CASAs attention to the findings regarding maintenance surveillance, and suggests that CASA review its surveillance activities with regard to RPT operators to ensure compliance with Civil Aviation Regulation 214. The operator has advised that the following actions have now been taken: 1. Basic familiarisation training on the Shorts SD3-60 aircraft for some company maintenance employees. Each employee will have all documentation relating to training placed upon his or her personal file following a particular training exercise. 2. Revision and update of the maintenance control manual and associated documentation including daily inspection schedules for pilots and maintenance engineers. The pilot's daily inspection schedule appears in Part B of the company's Shorts SD3-60 operations manual. Pilots and maintenance engineers certify completion of the daily inspection in the maintenance log form SA102.