Maintenance and Certification

Cargo Hook Release Mechanism-Inconsistent Configurations
by Serge Massicotte, Engineering Test Pilot, Flight Test, Aircraft Certification, Civil Aviation, Transport Canada

Helicopters have long been recognized for their ability to perform various types of operations throughout the world. The basic design and performance characteristics of this aerial vehicle make it particularly ideal for vertical reference work of all kinds. Vertical referencing, more commonly known as "slinging" or "long lining," involves specific risks due to the very nature of these operations. Unfortunately, the industry has seen a number of slinging accidents and incidents in the past where various causes and contributing factors have been identified. One particular risk factor that keeps resurfacing is the location and/or arrangement of the cargo hook release mechanism, or more specifically, the electrical sling release switch. There is significant variability in the location of this critical switch, not only between different aircraft types, but often within the same operator fleet. The inconsistent location and arrangement of these switch installations may have contributed to a number of inadvertent load release incidents, or even worse, it may have impaired the pilot's ability to quickly release the load in a critical situation. For decades, pilots have dealt with it as best they could. The time has come to re-assess this valid concern.

The Canadian aircraft certification process has been in place for many years to ensure that all new and modified aircraft meet the safety standard. Compliance to federal regulation [the Canadian Aviation Regulations (CARs)], application of guidance material [Advisory Circulars(AC)], as well as the experience of certification personnel and common sense, all serve to achieve this very important goal. Since cargo hook systems are normally considered optional equipment, they often get installed and approved under the Supplemental Type Certificate(STC) process after initial certification has been completed. As a result, design options are often limited by existing aircraft configurations and other installed STCs.

So far, there has been no published standard or guidance specifying that a particular switch must be assigned to the quick-release function for the external cargo hook. This is reflected by the various flight control configurations offered by aircraft manufacturers worldwide. Without a specific standard or guidance to be applied, the certification authority must often approve an "acceptable" design rather than enforce an "ideal" or "standard" configuration.

From a certification point of view, an "acceptable" design is one that meets Airworthiness Manual (AWM) 527.865 and 529.865, which requires installation of a primary and back-up quick-release system (more stringent requirements are applicable for human external cargo operations, but that topic will not be addressed in this discussion). AWM 527.777 and 529.777 also states that such cockpit controls must be located to provide convenient operation and to prevent confusion and inadvertent operation. In general, primary quick-release systems that get Transport Canada approval usually consist of a switch that is clearly identified, not easily confused with another switch, and properly located so that it is easily reached and activated by the pilot while maintaining both hands on primary flight controls. These requirements prove to be especially important during degraded flight conditions, such as power-off or hydraulics-off when the need for quick load release may be most critical. With regard to smaller helicopters, they don't always have switches available on primary flight controls to be used to that effect; however, for certification purposes, the same philosophy is generally applied.

From an operational point of view, it is not uncommon for commercial pilots to fly different types or models involving different configurations. Some contracts and some operators are only seasonal, which tends to further reduce pilot exposure (and familiarity) to specific systems. Although operators must ensure that company pilots are current and properly trained on the aircraft they will be flying, different configurations between types, or even between aircraft of the same model in the operator's fleet, may cause confusion during emergencies. According to W.James, author of Principles of Psychology, "studies in human behaviour suggest that, amongst other variables, relative and finite amounts of practice influence which automatic behaviour occurs in an emergency situation; the more practiced behaviour will be the default behaviour. The studies conclude that a pilot would require practice with a new switch configuration for 30 days, or 85hours or 1 000 repetitions or more than with the known configuration, for it to become an automatic behaviour. With less practice, it would be difficult for the pilot to automatically and correctly select the appropriate switch to jettison the external load from the helicopter." [Excerpt from Transportation Safety Board of Canada (TSB) Report # A03P0247.] Obviously, pilots flying similar aircraft types or similar configurations for extended periods of time are more likely to properly respond to a critical, time-sensitive emergency situation.

Example of a floor-mounted,
mechanical cargo emergency release handle

Example of a cyclic-mounted, electrical cargo release switch

As previously discussed, it is obvious that the situation surrounding the arrangement of the primary cargo release switch needs to be addressed carefully. An option would be to amend the current regulation and force all operators to adopt a "new standard." We all agree this is not a viable approach at this time. Another option would be to apply this "new standard" for load release switch position and arrangement to all future Canadian installations; however, this may have very limited impact on the situation, as installations approved by foreign authorities would still not meet this expectation for consistency, and the concern would persist. For the time being, a more practical approach is to strongly encourage operators of diversified fleets to make every effort to standardize their cockpit configurations as much as possible. An excellent proposal for operator consideration is one recently published in an article in the Helicopter Association of Canada (HAC) newsletter that suggested using the "bottom/lowest switch on the cyclic" to release cargo.

It may take some time before the perfect solution is agreed upon and implemented; however, there are steps that can be taken right now to mitigate some of the risks inherent to this business, such as repositioning the release switch to a common location, offering company-conducted awareness training, or modifying company standard operating procedures (SOP) that address this issue. Even a mandatory daily check of the electrical and mechanical releases before the first flight by the pilot, will reinforce the importance of knowing where the switch is found. After all, any confusion or inability to release the load during an emergency may be catastrophic.

Transport Canada, Aircraft Certification is always open to comments and suggestions, and these may be addressed directly to the author, Serge Massicotte, by e-mail (, or by phone (613-941-6212). Fly safe!

Click on image to enlarge

What's an MRB?
by John Tasseron, Civil Aviation Safety Inspector, Aircraft Evaluation, Standards, Civil Aviation, Transport Canada

The acronym "MRB" is one that is widely used in connection with maintenance schedules for transport aircraft, but is often somewhat mysterious to many who come in contact with it. This is partly to do with the fact that, like many acronyms, this one is used (and misused) in conversation and is not frequently explained in maintenance documentation. To make matters even less clear, it is also often used in connection with references made to "Chapter 5" (more on that later). Let's provide some clarification to put this jargon into perspective.

Strictly speaking, the acronym "MRB" stands for Maintenance Review Board. This is actually a clearly understood term, since it concerns a board that reviews maintenance schedules. The board is one made up of regulatory personnel, whose job it is to review an aircraft manufacturer's recommended maintenance schedule and approve it for use by operators. The particular kind of maintenance schedule being reviewed is one that the manufacturer has created by using working groups, who perform an analysis, based on reliability-centered maintenance concepts, to derive a minimum maintenance schedule required to ensure that an aircraft will still be safe to fly. The whole idea behind the exercise is to be able to market a product (aircraft) requiring less maintenance.

Although it is now clear that an MRB is a (regulatory) board, confusion can still creep in when the acronym is used in conversation. This is because it is also used to describe a process, namely that of setting up the previously-mentioned working groups and an industry steering committee, and doing the analysis, compiling the results into a proposal (called an MRB Report) and completing the regulatory review and approval of this report.

Since the major activity within the process is the analysis, let's look at this for a moment. As stated, the analysis is based on the principles of reliability-centered maintenance (RCM). These principles may be applied to almost any kind of complex situation (nuclear plants, hospitals, food processing facilities, etc.), but for aircraft maintenance purposes, they are applied by using a set of rules called MSG-3. This stands for Maintenance Steering Group 3, which has its origins in the Air Transport Association of America (ATA). The analysis typically splits an aircraft up into distinct units, each of which is analyzed according to its own set of rules, and managed by its respective working group, consisting of the aircraft manufacturer, operator and regulatory participants. For a large transport aircraft, this process may take up to two years to complete, and is performed prior to aircraft type certification. The analysis results are given to an Industry Steering Committee who finalizes the proposed MRB Report proposal, which is subsequently approved by the MRB and is then published in the aircraft's maintenance manual.

ATA has also cleverly provided a standard (iSpec 2200) that describes a maintenance manual format including, you guessed it, Chapter 5. The title of this chapter is "Time Limits/Maintenance Checks" and it is the place where an aircraft maintenance schedule (tasks and intervals) fits itself into the maintenance instructions. Currently, for aircraft that have been subjected to an MSG-3 analysis, Chapter 5 frequently contains the entire MRB Report. Note that Chapter 5 may also contain maintenance tasks and intervals that have not been derived from MSG-3 analysis. This occurs because the application of MSG-3 is not mandatory for developing a maintenance schedule, and aircraft maintenance manual formatting likewise does not have to conform to ATA standards. Consequently, there will be variations in what is found in various manuals. Suffice it to say that if there is an MRB Report, it will be in Chapter 5, since it makes sense to use these two ATA standards together.

Once a manufacturer elects to utilize the MRB process to produce a maintenance schedule, there is an automatic obligation to gather in-service information from aircraft operators and analyze that information. This is done in order to determine what adjustments need to be made to inspection tasks and intervals in an MRB Report during the life of the aircraft. The MRB process is therefore described as a "living" process subject to continuous review and change. Note that the content of an MRB Report does not automatically constitute the content of an operator's maintenance program. Operators of a newly acquired aircraft with an MRB Report are only required to incorporate the tasks and intervals in that report into their approved maintenance programs when the new aircraft is first put into service. They may subsequently make changes to their individual maintenance programs, based on substantiation that supports and is approved by their local regulatory authorities. Conversely, changes to an MRB Report are made by the manufacturer, approved by the MRB and published as revisions to the maintenance instructions.

Use of the acronym "MRB" therefore requires some caution in order to avoid misinterpretation and subsequent confusion. Hopefully the above will contribute to providing clarification.

Were Any Parts Left Over?
by John Tasseron, Civil Aviation Safety Inspector, Aircraft Evaluation, Standards, Civil Aviation, Transport Canada

Yes, occasionally it does happen. A complex aircraft component has been re-assembled, and a part that should have been included in the installation has miraculously appeared on the workbench! Two thoughts immediately come to mind: "now we have to disassemble and re-assemble the entire item again," and "luckily it didn't go flying!"

That's one scenario. Another one is that the part did not get installed, but was not found on the workbench, and the component did go flying! In such cases, this may result in severe damage to the asset, injury or death. In a very few cases, the component will function flawlessly and may continue to do so for an unexpectedly long period of time. But don't bet on it!

Human error is a reality thoroughly embedded in aerospace maintenance activities, with legions of examples of how maintenance mistakes can be made, and an equal number of reasons to remind ourselves, and each other, that the problem continues. The problem is so persistent that there are regulations in place intended to combat it. These regulations address the need to have instructions for continued airworthiness (ICA) that will explain how to avoid maintenance-induced problems. In everyday language, ICAs are quite simply the maintenance instructions that need to be followed to maintain safety.

A recent discovery that a part had mistakenly been left out of a component resulted in an interesting scenario. The maintenance organization that made the discovery reported it to their regulatory authority. The report contained statements that prompted a detailed regulatory review of the maintenance instructions referenced. The regulatory review intended to verify that statements made in the report about deficiencies in the maintenance instructions, were correct.

The maintenance organization reported that they had disassembled the component and subsequently re-assembled it with the parts missing, because the parts were not present prior to disassembly, and the re-assembly instructions made no mention of them. Since no parts were left over after re-assembly, the aircraft went flying. The regulatory review of the maintenance instructions in effect at the time the re-installation was done, revealed three things. First, the missing parts were not illustrated in the diagram showing the make-up of the assembly; second, the missing parts were not identified in the parts listing associated with the diagram; and third, reference was made to the missing parts in the text explaining the re-installation steps! It was also evident that the maintenance instructions in effect at the time of the discovery of the missing parts now illustrated and showed them in a parts listing and identified them more clearly in the re-assembly instructions. Obviously, someone had become aware of the errors and corrected them.

So what was done wrong? The parts that should have been installed by the original equipment manufacturer may or may not have been installed during initial assembly of the component. The parts that should have been installed during re-assembly of the component while at the maintenance organization were not re-installed and may or may not have gone missing. The maintenance organization specialists doing the re-installation did not follow all of the maintenance instructions provided in the manual. In this case, they would have become aware of the missing parts from the illustration and from the parts list if they had read the re-assembly instructions carefully, since the proper installation of one of the other parts they did install depended on first confirming the installation of the missing parts. They followed the incorrect illustration and parts listing, but did not read all of the assembly instructions accompanying the illustration!

The message is clear. Treat the text of a maintenance instruction as the principal one to follow. Any illustrations or tables accompanying the text should be referenced in the text, and treated as secondary instructions supporting it. Always be aware of the possibility of errors in the text or in the illustrations or tables (someone discovered the errors in this manual and had them corrected). And finally, double-check the facts supporting any statements made in reports resulting from in-service difficulties that are encountered.

Some good things did come out of this: maintenance specialists made a discovery that avoided a potential accident, the discovery was reported, everyone was reminded of the importance of double-checking, and action was taken to assess the impact on the fleet.

Date modified: