Jeff Guzzetti is the president of Guzzetti Aviation Risk Discovery (GuARD), an aviation safety consulting firm that he formed following a 35-year career with the National Transportation Safety Board (NTSB), Federal Aviation Administration (FAA) and other agencies. During his 18 years at NTSB, Guzzetti was a field investigator, “go-team” engineer and Deputy Director. He then served as an Assistant Inspector General at the Dept. of Transportation and testified before Congress regarding aviation safety audits. In 2014, Guzzetti served as the Director of FAA’s Accident Investigation Division in Washington, DC until his retirement in 2019. He is a graduate of Embry-Riddle Aeronautical University with a degree in Aeronautical Engineering and holds a commercial pilot certificate with multi-engine instrument ratings in airplanes, seaplanes and gliders.
The helicopter was just a few minutes into a regularly scheduled “Twilight City Tour” headed toward Hoover Dam and Lake Mead in Nevada as the sun was setting on a picture-perfect day. Two couples were onboard: newlyweds from India and a husband and wife from Kansas celebrating their 25th anniversary. Suddenly, the Eurocopter AS350-B2 unexpectedly climbed about 600 feet, turned to the left and then descended at a rate of over 2,500 feet per minute before impacting the rocky bottom of a V-shaped canyon. The helicopter caught fire after impact and burned for hours in the remote River Mountain range bordering Lake Mead (see photo of impact site). All four passengers and the 31-year-old pilot — also a newlywed — died in the fiery crash. The date of the accident was December 7, 2011. The cause of the accident was improper maintenance.
The National Transportation Safety Board (NTSB) launched a 12-person “go-team” to review the crash, Mark Rosekind, an NTSB board member who acted as the spokesperson near the crash scene told reporters that “The site is very difficult to access. It has taken four-by-fours and helicopters to get in …. It will make it harder to investigate.” Prior to being confirmed by the Senate to become a new Board Member just a year before, Dr. Rosekind directed NASA’s Fatigue Countermeasures Program and then founded a consultant business as a preeminent expert on human fatigue — a topic that would ultimately rear its ugly head as a contributor to the accident.
The chopper was operated by Sundance Helicopters as a scheduled Part 135 commercial air tour flight originating from Las Vegas with an intended route of flight to the Hoover Dam area and return (see graphic of route map). The company averaged 17,000 passengers a month by offering daily tours to the Grand Canyon area. At the time, Sundance boasted a fleet of 22 helicopters, a number that also matched the age of the accident helicopter (see helicopter image).
Recovery teams using all-terrain vehicles trekked up the rugged canyon to retrieve the five bodies from the remote site. Morning television news video showed a charred crash site amid scrub brush in a canyon west of the edge of the Colorado River reservoir some 30 miles from the Las Vegas Strip. The go-team investigators then began their grim task of documenting the accident site and sifting through whatever the fire had left them. They spent four long days at the accident site photographic and harvesting parts, followed a few weeks later sifting through giant bags of the small debris picked up by a salvage operator. Their painstaking, deliberate investigation pursued every clue and followed the evidence trail, which ultimately led to the hangar floor and maintenance operation.
Where is the Cotter Pin?
During examination of the wreckage, the investigators noticed that one of a main rotor’s “fore/aft servo” which is one of the three hydraulic servos that provide inputs to the main rotor, was found with its flight control input rod not connected. (see photo of burned input rod and servo). The bolt, washer, self-locking nut, and split pin — sometimes referred to as a “cotter pin” — that normally secure the input rod to the main rotor fore/aft servo were not found (see graphics of schematic drawings and close-up photos of servo hardware). A quick review of the maintenance records revealed that the same servo had been replaced the day before the accident. But why did the input rod become disconnected ? That is where the NTSB’s metallurgists, maintenance specialists, and human factors experts earned their salaries.
Through long arduous days in materials labs, salvage yards, and interview rooms, the investigators surmised that the hardware was improperly secured during the maintenance that had been conducted the day before the accident. The nut became loose — likely because it was degraded. And, without the split pin, the nut separated from the bolt, the bolt disconnected, and the input rod separated from the linkage while the helicopter was in flight (see close-up photo of exemplar nut and servo). Once the linkage separated, the helicopter was doomed to an uncontrollable descent.
The investigation further revealed that the mechanic, inspector, and a check pilot who test flew the helicopter after the maintenance, each had an opportunity to observe the servo self-locking nut. But none of them took note that the split pin was either installed improperly or not present at all. The act of not properly inserting a pin smaller than a paper clip — just one small step in a routine maintenance procedure— was the difference between an uneventful flight and tragedy.
Re-Use of Degraded Self-Locking Nuts
Through a sampling of maintenance records and parts supplies, investigators discovered that Sundance’s maintenance personnel were reusing self-locking nuts that did not meet the criteria specified by the helicopter manufacturer as well as guidance published by the FAA (see photo with lock nuts in “acceptable” and “degraded” condition). Federal regulations — specifically FAR Part 27.607 — require that any removable fastener whose loss could jeopardize the safe operation of the helicopter must incorporate two separate locking devices. For the AS350-B2 helicopter, the first locking device is the self-locking nut and the second one is the split pin. By using degraded lock nuts on a critical flight control component and then failing to properly install the split pin (or forgetting to install it at all), the redundancy provided by the design was unintentionally eliminated.
About half of the self-locking nuts from the servos of 13 helicopters with at least 5,000 hours of total flight time were determined to have no locking capability. A self-locking nut’s locking ability degrades with use, and it is critical that maintenance personnel follow manufacturer and FAA guidance to prevent the improper reuse of degraded nuts. But Sundance was not following this guidance.
To reinforce the importance of adhering to manufacturer and FAA self-locking nut reuse guidance, the FAA published a general aviation maintenance alert on its website at http://faasafety.gov in November 2012 and distributed the alert to over 239,000 mechanics and pilots via its e-mail registry. The information was also included in IA renewal training clinics throughout the United States. In addition, the FAA published an Aviation Maintenance Alert related to helicopter maintenance issues.
Maintenance Personnel Fatigue
Human factors investigators from the NTSB determined that the mechanic who replaced the servo and the quality control inspector who reviewed the work were called in to work on a day that they would have normally been off duty after working 4 days of 11-hour shifts. Both worked a schedule of 4-days-on, 3-days-off, 3-days-on, 4-days-off, and typically reported to work about 1200. Research shows that adjusting for changes to an early morning shift (“phase advance”) takes longer than adjusting from a day shift to a night shift (“phase delay”). Both the mechanic and the inspector would have had to attempt to compensate for this, and inconsistency in work shift has been shown to be a factor associated with the development of fatigue.
In other words, both the mechanic’s performance and the inspector’s performance were likely degraded by fatigue, investigators surmised, because they had insufficient time to adjust to working an earlier shift than normal. Adding to their fatigue was the mechanic’s lack of adequate sleep and the inspector’s long duty day. Mark Rosekind knew in his heart that their fatigue contributed to the deficient maintenance tasks, but he needed to let the non-political investigative staff of the NTSB put the evidence together and propose it to the full Board.
Need for Work Cards with Delineated Steps
To make matters even more challenging for the tired mechanic and inspector, investigators discovered that the maintenance instructions for the servo did not clearly delineate specific inspection steps on work cards (also known as “job cards”) which can allow these tasks to be more vulnerable to error. Using work cards for a mechanic is akin to a pilot using a checklist. Checklists clearly delineate the steps to be performed inspected is one way to mitigate inadvertent “errors of omission” in the performance and verification of critical tasks.
“Checklists are not rocket science, but they can have astronomical benefits,” said Debbie Hersman, the Chairman of the NTSB at the time. “Checklists can be crucial reminders and especially helpful when we are tired, or distracted, or new to a job or any number of situations so common to the human condition. They are a backstop to human error… They can make lifesaving contributions on the hangar floor, both during maintenance and in the important inspections that follow.”
The “Probable Cause” and Beyond
A year after the accident during the NTSB’s public Board Meeting in Washington DC to discuss the findings of the investigation, then-Chairman Hersman, Mark Rosekind and the other Board Members voted unanimously to adopt the proposed findings from their hard-working investigative staff and determined that the probable cause of the air tour crash was the operator’s “inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate postmaintenance inspections, which resulted in the in-flight separation of the servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable.”
The Board also asserted that “contributing” to the improper or lack of installation of the split pin was the mechanic’s fatigue, the inspector’s fatigue and “the lack of clearly delineated maintenance task steps to follow.”
The Board recommended that the FAA “establish duty-time regulations for maintenance personnel working under [rules for commercial operation] that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and other factors shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness.”
In his concurring remarks, Dr. Mark Rosekind went further and wrote: “Fatigue is fatigue and a tired maintenance employee suffers from the same performance decrements experienced by a tired pilot. The alertness of both is crucial to safe aircraft operations… The time is long overdue for the FAA to issue duty-time regulations for maintenance personnel…”
The FAA later responded that it “has done a tremendous amount of research and work in the field of human factors and personnel fatigue in aviation maintenance” and cited numerous sources. However, they stated that they “…continue to believe there is not enough significant data or justification to proceed with formal rulemaking efforts,” and that “an effective Safety Management System minimizes the need for additional fatigue-specific regulations.”
Three years later, on a Friday afternoon inside a courtroom in Las Vegas, a jury awarded $16 million to the families of the four passengers who were killed in the crash. After six hours of deliberation, the jury concluded that the company’s negligence caused the four deaths. The jurors struggled to place a dollar amount on the loss of life. “It was a tough call,” one juror said to reporters.
The lessons learned from this tragic accident are obvious: Don’t reuse degraded lock nuts, develop job cards for critical maintenance tasks and guard against having fatigued mechanics work on your aircraft.