FACTUAL INFORMATION

History of the flight

During the pre-flight inspection, the pilot in command noticed that the elevators were drooping. He checked that the control lock was engaged and found that while the aileron and rudder systems were locked, the elevator system was not. He attempted to lock the elevators but was unable do so, nor could the engineer on tarmac duty. The engineer assured the pilot that, as the control lock system was rendered inoperative in flight, it would be safe to fly the aircraft and that the defect would be rectified when the aircraft returned to Brisbane later that day. The engineer was correct as the control locks are rendered inoperative in flight. The defect was then correctly deferred in accordance with Sunstate CAA approved Volume No.1 procedures, and the aircraft was subsequently despatched.

Soon after the aircraft became airborne, the co-pilot, who was the pilot flying the aircraft, notified the pilot in command that he believed there was a control abnormality in that more aft elevator than normal was required to rotate the aircraft. Upon reaching cruise altitude, the pilot in command took over the controls and confirmed that the control column was aft of its normal position when the aircraft was in level flight. Following a controllability check in the landing configuration, the aircraft returned to Brisbane. A subsequent inspection revealed that a rudder control rod had been fitted to the elevator control system, altering the geometry of that system and causing the abnormal control column position.

Maintenance aspects

The elevator and rudder control rod systems run parallel to each other and are routed through the ceiling of the aircraft in the area above the galley. Each system has a number of interconnecting rods which run fore and aft between roller guides. The elevator and rudder control rods are similar in appearance, but the elevator control rod is 35 mm longer than the rudder control rod.

On 3 October 1994, a licensed aircraft maintenance engineer had raised a deferred maintenance control sheet for replacement of the "elevator control rod L/H above toilet cabin dividing wall". (When facing forward in the aircraft, the left rod is the rudder control rod). A parts order form was submitted to order a new elevator control rod.

On 11 November 1994, another maintenance engineer found that the elevator control rod referred to on the deferred maintenance control sheet did not require replacement. Consequently, the elevator control rod which had been ordered was not required and was returned to the parts store. However, this engineer noticed that the adjacent rudder control rod was excessively worn so he raised a deferred maintenance control sheet for that item. A replacement rudder control rod was ordered on 15 November 1994 and arrived on 9 December 1994.

A periodic maintenance inspection was carried out on the aircraft during the weekend of 10 and 11 December along with maintenance which had been deferred. On 10 December work was started on the control rod change as required by the deferred maintenance control sheet form SA113. The form was part of a work package which detailed the tasks to be carried out during the maintenance period. The engineer who recorded the elevator control rod defect on 3 October assigned himself to the task of changing the rod.

The word "RUDDER", approximately 100 mm long, was pencilled on the old rudder control rod and the elevator rod was marked with the letters "ELEV". During discussions, the Maintenance Manager indicated that the wording may have been placed on the rods in order to prevent confusion at aircraft assembly. It has since been noted that various rods throughout several aircraft have the particular system name pencilled on them. This appears to have been an unofficial factory procedure. The local Short Brothers Technical Representative was advised by the factory that "the operator should read the part number".

The engineer who replaced the rod incorrectly identified the worn rod as the rudder control rod. He then removed that rod, which was in fact the elevator rod, without positively identifying it. After obtaining the new rudder rod from the parts store, he did not compare it with the old rod because he was called away to do another job and placed the new rod, still in its container, on a workbench. When he returned to the task, he removed the new rod from its container and fitted it to the aircraft. He did not notice that the old rod had a different part number printed on it, had the letters "ELEV" pencilled on it, and was longer than the new rod.

On completion of the work another engineer was asked to perform a "dual inspection." This inspection was required by the maintenance control manual volume one, the manufacturer's maintenance manual where it is referred to as a "duplicate inspection", and Civil Aviation Regulation 42G (1) where it is referred to as an "independent inspection". The engineer who performed this inspection had been multi-tasked and was doing unplanned work when he was asked to carry out the duplicate inspection. After being shown the rod that had been changed, he checked it for security and freedom of movement. He subsequently countersigned the duplicate inspection certification sheet.

The duty senior engineer reported that towards the end of his shift, when he was compiling the paperwork, he found that the signatures on the duplicate inspection sheet had been incorrectly placed in the aileron column at the top of the sheet. He said that he had pointed this out to the engineer who performed the inspection, who subsequently took the sheet to the engineer who had changed the rod. The inspecting engineer returned the sheet to the senior engineer with the word 'aileron' crossed out and the word 'rudder' written above it. The work was completed by 0830 hours on 11 December.

As a result of the incorrect rod being installed in the elevator system, the elevator control lock was rendered inoperative due to the altered geometry of the control system.

At about 1745 hours on 11 December, the aircraft was towed from the hangar for an engine run. The flying controls are required to be locked during towing, when the aircraft is parked, and when it is taxied by engineers. The engineer who towed the aircraft from the hangar did not notice that the elevator control could not be locked.

Standard company procedure is to engage the flight control lock prior to commencing an engine ground run. The elevator system could not be locked so the engine run was commenced with the elevator control lock disengaged. The control lock must be disengaged if ground runs in excess of idle are required in order for power levers to be advanced past the control lock baulk.

A daily inspection certificate was signed on the Maintenance Log of the day at 0300 hours on 12 December, certifying that the items on the daily inspection schedule in the maintenance control manual volume two had been carried out. The last item on the schedule states: "Flight controls and trim controls full and free and correct operation". The certifying engineer for this inspection did not notice that the elevator control lock could not be engaged.

The aircraft was then towed from the hangar to the apron on the opposite side of the airport. The fact that the elevator control lock could not be engaged was not noticed.

Maintenance manuals

The Shorts SD3-60 maintenance manual, the Civil Aviation Regulations and the operator's maintenance control manual volume one, contain specific details regarding maintenance practices with control rods. Both engineers involved in the rectification work indicated that these publications had not been consulted before or during the performance of the work.

A new version of the operator's maintenance control manual volume one was approved by the Civil Aviation Authority on 11 February 1994 and was implemented by the operator thereafter. Copies of the maintenance control manual volume one were located in the company's technical library and also in the hangar at a workstation which houses other paperwork and forms. Investigation of staff awareness and training revealed that both engineers had undergone familiarisation with the maintenance control manual volume one on Tuesday 15 March 1994.

Personnel information

The engineer who performed the rudder rod replacement was appropriately licensed and endorsed to perform the task. He joined the airline in March 1991 and held airframe and engine ratings. He had two rostered days off immediately prior to the occurrence but had worked three-night shifts before that. He indicated that, despite the two days off, he still felt tired on the day of the incident and thought this was because he had not fully recovered from the three-night shifts. He did not at any time advise his immediate supervisor or senior managers that he was fatigued. The engineer had been involved in three car accidents which affected his ability to work on stands, operate some tools, and write legibly. The company had not at any time been made aware of the car accidents. The management was aware of the engineer's unsteadiness whilst he was working on stands, and the engineering manager had discussed the problem with him some weeks prior to the incident. He had agreed to see a company doctor.

The engineer who performed the dual inspection was correctly licensed and qualified to carry out the task. He held engine and airframe ratings. He had been rostered off for four days prior to the occurrence.

Shift roster

The operation of the airline is dependent on co-ordinating maintenance requirements with operational requirements to achieve the schedule. This involves the conduct of the maintenance at night and on weekends. The shift roster consists of two crews of seven engineers and four crews of two engineers. The seven-person crews work three-night shifts, two days off, two-day shifts, three days off, two-night shifts, and then two days off. The two-person crews work two-day shifts followed by two-night shifts and then have four days off. The two-night shifts commence at 1715 and finish at 0415 the following morning. The remaining seven-person crew commence at 1800 and finish at 0425, while the day shift commences at 0600 and finishes at 1700.

The engineer who fitted the rod incorrectly was on the two-day roster after having worked three nights. He did not consider two days off adequate time to recover after working three 10.4 hour night shifts. Some engineers felt that their health suffered because of the roster, while others indicated that they felt fatigued much of the time because of the interrupted sleep pattern. The matter was an industrial issue at the time, and when the company recently announced that four permanent day shift positions would become available (with corresponding reduction of penalties and allowances) no engineers were forthcoming for the shift change. As a result, company management considered the shift structure was not a serious issue.

The night shift engineers were isolated from the day crews as the shifts did not overlap. Some engineers felt that management did not appreciate their concerns about matters that had safety implications. This latter issue seemed to be more a result of inadequate communication between management and the engineering staff but nevertheless resulted in discontent and attitudinal problems for some engineers.

Working environment

The maintenance facility is approximately 3 km from the airline's apron, and this reportedly caused inconvenience as aircraft had to be towed or taxied from one side of the airport to the other for maintenance. The airline used the parent company's hangar for maintenance and did not have a dedicated area that was close to the parts store and the technical records. This often required engineers to walk long distances from the working area to the other facilities and was an annoying aspect of the work environment.

Regulatory aspects

During the Bureau of Air Safety Investigation's survey of the maintenance facility, some regulatory discrepancies were identified. The discrepancies included aspects of training, daily inspections, and quality assurance.

Training

There was no training program in place in accordance with Civil Aviation Regulation 214. This regulation refers to the training of maintenance personnel, and states that the operator shall make provision for the proper and periodic instruction of all maintenance personnel, and the training program shall be subject to the approval of the regulatory authority.

Daily inspections

Reference copies of the daily inspection schedule were not located in the aircraft or the tarmac office. At ports where engineering staff were not available to conduct daily inspections, pilots signed the maintenance log to reflect that they had completed the daily inspection schedule when the check was actually completed in accordance with a pre-flight check schedule. Consequently, some items on the daily inspection schedule were being signed for when in fact they had not been performed.

Quality assurance

The company did not employ a quality assurance inspector but was subject to periodic inspections from the parent company. This did not facilitate a day to day, hands on approach to quality assurance. However, systems that exceeded Civil Aviation Authority requirements were in place at the time of the incident and both licensed aircraft maintenance engineers had attended a briefing on the Volume No 1 procedures following their introduction.

ANALYSIS

The engineer who had incorrectly identified the rod tasked himself with fitting the new rudder rod. He did not follow basic procedure and practices and fitted the incorrect rod. A "safety net" failed when an adequate duplicate inspection of the system was not carried out. The engineer responsible for the duplicate inspection had been multi-tasked and was doing unplanned work when he was asked to do the inspection. His attention was divided at the time, and this may have influenced the amount of time he spent on the inspection. There was however adequate time to correctly carry out the inspection. The written procedures were not adhered to, and the independent inspection failed to detect that the wrong control system had been worked on.

Training

No formal training course had been conducted for the aircraft type, nor was one required, as it is a 'Group One' aircraft. Familiarisation training had been conducted by the aircraft manufacturer prior to the incident and one of the involved engineers had attended this training. The non-adherence to established procedures may indicate a poor attitude toward compliance with the maintenance control manual and manufacturer's maintenance manuals.

Design

Although the rods were clearly marked with identification numbers, and the attachment fittings were identical, the length of the rudder control rod was not compatible with the design requirement of the elevator control system. A more effective design is necessary to prevent the inadvertent interchange of incompatible components. This could be achieved by the use of dissimilar attachment fittings.

CONCLUSIONS

Findings

1. The maintenance engineers were correctly licensed to carry out the task.
2. The engineer incorrectly identified the worn rod as an elevator control rod.
3. A new rudder rod was fitted to the elevator control system.
4. The effect of the new rod on control deflections was not checked after work was completed.
5. The engineer responsible for carrying out a duplicate inspection did not recognise that the elevator system had been worked on instead of the rudder system.
6. The duplicate inspection was not carried out in accordance with published procedures.
7. The elevator control lock could not be engaged. This was not detected by the engineer who conducted the daily inspection.
8. The pilot was unable to lock the controls during his pre-flight inspection.
9. An engineer advised the pilot that the malfunctioning control lock was not a major defect.
10. There was no formal SD3-60 training course for engineering staff.

Significant factors

1. The worn control system was incorrectly identified by the engineer who replaced the rod.
2. The new control rod to be fitted was not compared with the old rod which had been removed. The rudder rod and the elevator rod were similar in appearance.
3. The duplicate inspection was not carried out in accordance with published procedures.
4. The elevator control lock malfunction was not diagnosed fully, and to allow the aircraft to be despatched, the item was deferred in accordance with company procedures.

SAFETY ACTION

The Bureau of Air Safety Investigation issues safety advisory notice SAN  960055 to the Civil Aviation Safety Authority.

The Bureau of Air Safety Investigation highlights this occurrence to the Civil Aviation Safety Authority (CASA) with particular reference to the transposition of the elevator and rudder control rods. The Bureau suggests CASA review certification standards to prevent the possibility of incorrect components being fitted to primary flight control systems and bring this to the attention of recognised authorities.

The Bureau also draws CASAs attention to the findings regarding maintenance surveillance and suggests that CASA review its surveillance activities with regard to RPT operators to ensure compliance with Civil Aviation Regulation 214.

The operator has advised that the following actions have now been taken:

1. Basic familiarisation training on the Shorts SD3-60 aircraft for some company maintenance employees. Each employee will have all documentation relating to training placed upon his or her personal file following a particular training exercise.
2. Revision and update of the maintenance control manual and associated documentation including daily inspection schedules for pilots and maintenance engineers. The pilot's daily inspection schedule appears in Part B of the company's Shorts SD3-60 operations manual. Pilots and maintenance engineers certify completion of the daily inspection in the maintenance log form SA102.

Three aircraft were in the landing sequence for runway 34R at Sydney. VH-NEK, on right downwind as number three, was given an ATC instruction to "sight and follow" the second aircraft, VH-DMO, which was on a left circuit. However, VH-NEK was seen to follow VH-SMH, the first aircraft in the sequence which was also on a right circuit. Separation was lost between VH-NEK and VH-DMO before the Approach Controller could contact the pilot of VH-NEK, who had already changed to Tower frequency before being instructed to do so. As a result, the aircraft came within 1 NM of each other before VH-NEK was vectored to follow VH-DMO.

Subsequent investigation indicated that VH-DMO, would have been in the "two o'clock" position from VH-NEK, at a range of about 10 NM, when the pilot of VH-NEK was instructed to follow the second aircraft. The first aircraft in the sequence, VH-SMH, would also have been at "two o'clock" from VH-NEK, but at a range of only 5 NM. VH-DMO was also nearly head on to VH-NEK at the time and would have been difficult to see. As a result, the pilot of VH-NEK mistook VH-SMH for the second aircraft and turned inside VH-DMO, resulting in a loss of separation. In hindsight, the "sight and follow" instruction may not have been the most suitable for this particular situation.

The temperature was about 37 degrees, a light wind was blowing straight down runway 25 and there were thermals in the area. A dual check flight of 30 minutes of circuits on runway 25 was completed with an instructor. The instructor then sent the pilot to do two solo circuits.

On the first approach for runway 25 the pilot made a touchdown in the three point attitude. After a short ground roll the right wing lifted, apparently due to an encounter with a thermal and the aircraft swung right. Left aileron and rudder and a small amount of engine power were applied but this did not prevent the aircraft from overturning.

Significant Factors

The following factors were considered relevant to the development of the accident:

1. Thermal encountered at a critical time.

2. Pilot probably too slow to react to the effects of the thermal.

The F27 was tracking from Canberra direct to Bindook VOR on climb to FL170. At about the same time, a military PC-9 was tracking from Shelleys NDB to Richmond via Bindook VOR, also at FL170.

Both aircraft had just been handed over to Sydney Arrivals by Melbourne Sector Control, with the aircraft on converging tracks at the same level.

The Arrivals Controller experienced problems with the transponder code of the PC-9 and, while attempting to correct the display errors, realised that radar separation would not be maintained. Instructions were given to the PC-9 to change heading, and for the F27 to descend to FL160. However, before the aircraft could respond, the minimum separation standards were infringed.

The pilot reported that during the landing roll the right brake failed, and the aircraft ground looped to the left. The right landing gear separated, rupturing fuel lines. The aircraft ignited when it came to rest and was totally destroyed.

The pilot stated that he noticed a large piece of timber on the runway in line with the nosewheel during the landing flare. Power was applied and the nose wheel was raised to avoid the timber. During the subsequent landing the nosewheel struck the runway prior to the mainwheels. After returning to Mackay, the aircraft was inspected by an engineer who discovered damage to the firewall.

VH-AMM departed Sydney at 1426, tracking via Nowra to Moruya and cruising at flight level 160. Nowra control zone extends approximately 19 miles south of Nowra. The base of the control area south of this is 8000 ft, until 30 miles from Nowra. From 30 miles south of Nowra to Moruya the base of controlled airspace is flight level 150.

VH-MJH departed Moruya at 1442, tracking via Nowra for Sydney and cruising at 7000 ft. Advice of this departure was passed by Melbourne flight service to Nowra air traffic control.

At 1448 Melbourne air traffic control advised Melbourne flight service that VH-AMM was on descent 12 miles south of Nowra and would be calling flight service. The descent was continued and as instructed by air traffic control the crew called on the flight service frequency. An estimate of 1501 for arrival at Moruya was given to flight service.

Nowra air traffic control had observed both aircraft on radar and contacted flight service to pass an instruction to VH-AMM to maintain 8000 ft. An error in the call sign used by Nowra air traffic control caused a delay in transmission of this instruction. When the message was passed to the crew of VH-AMM at 1451 they advised they were climbing back to 8000 ft from 7700 ft. The two aircraft passed at about this stage.

Melbourne flight service was required to pass traffic information to both aircraft about each other but had not done so. Nowra was not a compulsory reporting point, and the Melbourne air traffic controller did not pass a position report for Nowra to flight service. Because there was no position report the controller had advised flight service when the aircraft was on descent.

The flight service officer did not have the flight progress strip for VH-AMM in the active bay until after the controller's report of the aircraft being on descent. The procedures adopted left limited time for the flight service officer to assess the traffic situation.

Significant Factors

The following factors were considered relevant to the development of the incident:

1. Limited time period available to the flight service officer after advice of VH-AMM on descent.

2. Flight service officer did not pass the required traffic information to either aircraft, reasons undetermined.

In cruise at 10,000 ft the pilot noticed the left alternator light had illuminated, and that the right alternator was now taking all electrical loads. The left engine power then reduced from 31hg to 23hg, suggesting to the pilot that the turbo-charger was malfunctioning. As the aircraft was now unable to maintain its cruise altitude the pilot requested a descent to 7,000 ft. He also requested an airways clearance to return to Parafield.

He changed the left fuel tank selection from the main to auxiliary and turned the left fuel boost pump on. This restored engine power for a short period of time before it suffered a complete failure, followed by a complete loss of electrical power and smoke entering the cabin.

The pilot feathered the left propeller and turned the fuel selector and all electrical switches off. He maintained communications with Adelaide FIS using a mobile telephone. A successful single engine landing was made after the pilot manually extended the landing gear.

An investigation indicated that the alternator field wire had chaffed on the engine fuel supply line, wearing through its insulation which allowed the barbed wire to then arc on the line, eventually burning a hole through it. The ensuing loss of fuel supply through the hole, with associated loss in fuel pressure, contributed to the reduction of engine power. Activation of the fuel boost pump assisted in restoring some pressure, and power.

Fuel spraying from the holed line was ignited by the arcing alternator field wire, causing fire damage to the wing leading edge skin, wing structure rear of the firewall, oil pressure, hydraulic and fuel supply lines, and the nacelle fuel tank and vent lines. The electric loom between the engine and cabin had the insulation burnt off, allowing it to short circuit and cause the electrical failure. The magneto earth wires, being part of this loom, and also bared of insulation, grounded both magnetos, shutting down the engine.

The engine failing due to the grounded magnetos, and the pilot's action of turning the fuel off, probably deprived the fire of fuel before it became established, and self-extinguished.

The pilot of VH-UBC reported at Rugby at 1725, cruising at 10,000 ft and estimating Holbrook at 1759. The pilot of VH-MJH reported at Yass at 1730 at 10,000 ft and estimating Wagga at 1755. Both aircraft were operating outside controlled airspace and the tracks of the two aircraft crossed.

The two aircraft passed in close proximity. No traffic information had been passed by Melbourne flight service to either aircraft. The flight service position was manned by a trainee under the supervision of a flight service officer who was rated to operate that area. Neither person had noticed the potential conflict.

The area in which the aircraft were operating has a high level of complexity for flight service. The workload at the time was assessed as moderate.

Significant Factor

The following factor was considered relevant to the development of the incident:

1. Neither the flight service officer nor his trainee detected a situation of potential conflict.

The owner/pilot advised that he was practising an aerobatic sequence for a future airshow when the engine suddenly suffered a partial power loss. At the time the aircraft was vertical. The pilot pushed over to level flight at about 1000 ft AGL and 80 kts. Then the engine stopped completely. He performed a forced landing in a nearby paddock. The aircraft touched down at approximately 115 kts. During the landing roll the aircraft flipped twice onto its back before coming to rest upright but nose down.

Subsequently an engineer discovered that the crankshaft thrust bearing had seized. The pilot and the engineer believe that, during aerobatic manoeuvres, the oil pickup pipe had been exposed and sucked air, thereby starving the thrust bearing of oil.

This particular aircraft has a more powerful engine installed than the standard Pitts. The additional horsepower enables very high-performance aerobatics.

The owner/pilot, his engineer, the manufacturer and the CAA are involved in achieving an improved oil supply to the thrust bearing before the engine is returned to service.

Significant Factors

The following factors were considered relevant to the development of the accident:

1. The crankshaft thrust bearing was inadequately lubricated during aerobatic manoeuvres.

2. The crankshaft thrust bearing seized and stopped the engine.

3. During the landing roll, the aircraft encountered an undulation and overturned.