Trust We Must

ISTOCK/SIMONKR Photo

It takes a team to overcome single-point failures that lead to aviation accidents.

Aviation inevitably relies on physics and money, not necessarily in that order. But there’s an equally essential requirement that’s sometimes overlooked: trust.

The act of firing up the engine(s) and lifting off the ground would be almost unthinkable for a pilot without trust in the ground crew who loaded the fuel; the technicians who inspected, maintained, and repaired the machine; the factory test pilots who identified unforeseen quirks in the aircraft’s performance; and ultimately the engineers who designed the contraption in the first place—not to mention air traffic control when their services are either required or unavoidable.

Flight crews can double-check some potentially weak links, such as fuel quantity and grade, but they have no realistic way to confirm that technicians correctly performed major maintenance on inaccessible assemblies or that certification test pilots visited every corner of the flight envelope. And following maintenance, a meticulous inspection and a carefully staged test flight are essential precautions, during which discrepancies are expected to reveal themselves right away. A few subsequent hours of trouble-free operation inspire confidence that the work was indeed performed correctly.

The Mission

On Mar. 27, 2019, an Aérospatiale (now Airbus Helicopters) AS350 B3 operating under contract to the US Forest Service was dispatched to assist with a controlled burn in the Sam Houston National Forest in Texas. Two Forest Service employees were on board to initiate the burn by dispersing small incendiary devices at selected locations in the forest.

The Aircraft

The AS350 B3 is equipped with a three-blade, fully articulated, hingeless main-rotor system and a conventional two-blade tail rotor driven by a single Safran Arriel 2B1 turboshaft engine. The engine in the 2009 model helicopter tasked with the Forest Service contract was rated for 871 shaft horsepower (shp) and had been operated for approximately 1,750 hours since new; the airframe had been flown for approximately 5,027 hours. Its most recent inspection had been performed 72 hours earlier.

To conduct the fire-seeding operations, the helicopter had been fitted with an SEI Industries Premo MK III Plastic Sphere Dispenser (PSD). According to the manufacturer, this device’s function is “to inject ethylene glycol into plastic spheres containing potassium permanganate and then immediately eject the activated sphere from the aircraft. The addition of ethylene glycol to potassium permanganate creates a rapid exothermic reaction that has sufficient intensity to ignite the plastic spheres and ignite the designated burn area.”

The mechanism was mounted in the opening created by removing the helicopter’s right-side cabin doors. The first Forest Service crew member straddled the PSD to operate it, secured by a chest harness. The second Forest Service crew member sat in the left front seat, with that station’s flight controls removed.

The Pilot

The 50-year-old commercial pilot also held a helicopter instructor’s certificate and a current second-class medical certificate. His estimated 8,760 total hours of flight experience included 3,886 hours in the AS350 B3.

The Flight

The crew completed the PSD application without incident and had turned back toward their staging area. Weather was good, with clear skies and 7-kt. southeast winds. At 2:10 pm central daylight time, the engine abruptly lost power. The Forest Service crew member in the left front seat later told investigators, “The engine just quit, and everything went silent.” The pilot entered autorotation into 70-ft. trees at a descent angle later estimated as 40 to 50 degrees.

The helicopter came to rest on its right side about 60 ft. from the point of the first tree strike: a pine tree puncturing the right side of the cockpit just below the instrument panel and stretching across the pilot’s lap. The pilot was hospitalized with serious injuries. The left-seat crew member escaped with minor injuries, but the Forest Service employee operating the PSD was “partially ejected from the helicopter” and killed.

The Investigation

Investigators found two of the three main-rotor Starflex arms separated at nearly right angles to the blades and the tail boom broken in two places, all damage consistent with impact forces. The third main-rotor blade was “daggered into the ground.”

Flight control continuity was confirmed to the main- and tail-rotor systems. The hopper of the PSD machine was empty, its payload having been used up during the flight. The bottom of the fuel tank was crushed and breached, but with the helicopter resting on its side, about 20 gal. remained in the tank.

The engine’s axial compressor was free of foreign object debris, and the axial compressor/gas generator was easily rotated by hand. Sheared front-support bolts bound the freewheel shaft, preventing rotation of the free turbine.

Electrical connections were secure, and all other fuel, oil, and air lines were tight and correctly safetied. However, the main fuel line between the firewall and the hydromechanical unit (HMU), which includes the fuel shutoff valve, was found loose with no safety wire installed.

Data downloaded from the digital engine-control unit after it was returned to the engine manufacturer recorded a fault for “P3 drift or engine flameout,” with rapidly decreasing N1 (low-pressure compressor) speed.

The operator’s director of maintenance reported that on Feb. 14, about six weeks before the accident, the Forest Service had requested verification of the weight and balance of all the helicopters used on its contracts. To provide this information, the operator had to empty each helicopter of fuel to determine its basic empty weight, which in turn necessitated disconnecting the main fuel line from the HMU.

The technician who’d reconnected the line after the weighing operation on this helicopter was “confident that he had torqued and secured the line,” but no fragments of safety wire were found inside the cowling.

On Feb. 23, the helicopter failed to start, which was addressed by replacing “the engine’s igniters and/or igniter box.” No other anomalies were observed during the 25 hours it had flown since being refueled, except a brief flickering of the fuel-pressure light that the pilot reported a few days before the accident. This was resolved by briefly turning on the boost pump. The pilot was instructed to monitor the situation and report any recurrence.

A follow-up inspection confirmed that the fuel lines of all the operator’s other helicopters were correctly torqued and safety-wired.

The Takeaway

Flying anything much more complicated than a kite requires a willingness to place faith in things the flight crew can’t verify directly, from installation of the correct grade of hardware to the accuracy of charts and third-party navigation databases. The assumption of continuity can assuage some potential worries: if the main-rotor blades installed at the factory haven’t been removed, they’re probably still the right parts. Preflight inspections and run-up checks are therefore directed at components that might have been damaged or fluids that could have been compromised during or since the last flight. Notably, the AS350 B3 preflight checklist, as demonstrated by a factory test pilot in an Airbus Helicopters video, doesn’t call for opening any of the engine cowlings but merely making sure their latches are securely closed.

Not surprisingly, the National Transportation Safety Board (NTSB) found the probable cause of the accident to have been “maintenance personnel’s failure to properly reinstall and secure a fuel line, which resulted in a total loss of engine power.”

It’s also not surprising that the technician who connected the line felt sure he’d torqued and safety-wired it as required. Perhaps he did—all the operator’s other helicopters were found to be airworthy. It’s also possible he simply couldn’t imagine, much less remember, having missed such a crucial step.

The aviation industry has put immense effort into reducing the risk of single-point failures, but they haven’t been eliminated and may never be. Some large operators require that another (usually more senior) maintenance technician inspect and sign off on crucial maintenance tasks, but even that safeguard has occasionally fallen short: the failure in October 2019 of a Hawker 800XP jet’s nose gear to extend was traced to the heavy-check maintenance provider’s failure to install the washer, nut, and cotter pin on the drag stay during overhaul, although a quality-assurance inspector had signed off on the work.

The well-known tendency to see what one expects to see has proven hard to disrupt, particularly when similar assemblies are inspected in quick succession. Because the oversights are so rare, imposing further layers of scrutiny risks increasing overhead more than it improves safety.

The near-universal availability of digital photography at least offers maintenance personnel an option for rebutting accusations. Clear photos of the finished assembly from whatever angles are needed to document essential details, tagged with date and time, could settle the kind of question raised by the Texas accident—and just taking the picture might prompt a fresh look at the work. Cell phones have cameras, and almost everyone in aviation carries one. Taking a few quick snaps might not be a bad idea.