This is an extension of discussions started on Comparing RCM with PMO2000.
I mentioned that I had seen a lot of activities that seemed crazy.
Here is what I wrote on this thread.
quote:
I'd like to learn about such examples....could you please give a few....I'm not interested in 'who' but in 'what'. Thanks

There seem to be two areas where things seem stupid.
The first is running dangerous tests for what might be considered hidden failures.
The second is performing intrusive maintenance on equipment that is in good condition.

Dangerous tests - Three examples.
The first caused me a lot of grief. I was the line manager for three Boeing 707 aircraft and after I left the maintenance squadron, we lost one of them and the entire crew, most of who I knew, and some I knew their families well.
B707 has a characteristic that when two engines on one wing fail at the same time, the aircraft goes into a spin. The aircraft has four engines. The test for trainee pilots was for the instructor to shutdown both engines on one wing to simulate the problem and test if the student can recover. One of my good friends, Tim Ellis was the student and was not able to pass this test. The aircraft spun into the ocean.
The second test that made headlines was the electricians testing the UPS supporting communications and computer systems in Sydney's airport air traffic control on one Friday afternoon - peak time. The tests created the very problem the UPS was designed to avoid - a total blackout of controlled airspace. Yep... the test blacked out controlled airspace for about 30 minutes so you have the skies full of aircraft in various holding patterns at various levels coming into land on visual and radar and no coordinated management.
Third is the testing of the lifts in underground mines. These lifts are a cable arrangement where people get in the cage and they are lowered down using the cable and the spool to control the speed. If the speed gets out of control then there are mechanical brakes but there are also dynamic brakes which use a governor to detect the speed and activate hydraulically driven disc brakes - high speed then low speed. How do they test the high and low speed brakes. They put a proof load of 1000 kg in the lift and make it run without control. When the activation speed on the governor is reached, the hydraulic disc brakes cut in and stop the lift quite suddenly. I would think there would be at least 2G (2* Gravity) maybe more. The point is, the proof load has now increased by the rate of deceleration created by these brakes and this is likely to have a quite damaging effect on the cable and the lugs joining the cable to the cage. Yet immediately after the test and the 1000kg test load removed, the supervisor says to the miners, get in the lift - it is now safe.
The analysis we did showed that all the hidden failures could be tested without this destructive method.
Now to intrusive maintenance.
Shipping regulations require engines and many other components to be stripped and inspected at varying intervals. This means that, for example, engines which have been subject to well documented oil analysis, compression testing and a host of other methods to understand that the engine is in very good health, with no corrosion and no wear, need to be opened up and inspected. The marine engineers pull the engine apart for the inspector to see. They then put it back together. Then away we go on our long voyage with all the potential failures caused by the intrusion and potential maintenance errors or bad gaskets etc.
Other stupid things I have seen - pods containing electronics which are sent to the seabed in deep water drilling operations are opened up on the surface to check that the components look ok. They are then resealed and sent back down - and guess what - they fail because of sealing problems.
Anyone got others to add?

This message has been edited. Last edited by: Steve Turner,

Here are my comments:

OK Steve, it sounds more confident now. The examples of danagerous tests you gave appears old cases, which we already know not giving much benefits:

1) Testing pilot to recover from aircraft spinning - why did they allows this real-life testing in the first place? The recovery is supposed to be by the pilot or automatic recover by the aircraft? It's human=error in decision making, isn't it?

2) UPS testing - we also do this in plants but during shutdown when the usage is very minimum. Why test it during peak time? Isn't it a human-error?

3) Lift testing - In offshore, the crew test lifeboat as well. Yes, after frequent testing, the lifitng equipement can wear down and periodic inspection and maintenance should be done thoroughly to ensure tip-top conditions.

4) Instrusive maintenance - Do when necessary only as pointed out by N&H.

Josh,

It certainly is massive human error. All test programs are developed by humans and the others I have mentioned are also human error.

quote:

1) Testing pilot to recover from aircraft spinning - why did they allows this real-life testing in the first place? The recovery is supposed to be by the pilot or automatic recover by the aircraft? It's human=error in decision making, isn't it?

The recovery is supposed to be by the pilot and failing that, the instructor.
I know the pilot example was not testing mechanical devices, but to me it sits in the same logic path. Why do some people think that making something behave in a dangerous manner or creating the disastrous situation and testing it, somehow reduces risk.
I have heard of cases where turbine overspeed switches are tested by running the turbines to overspeed testing the switch and control system, and if that fails, they have someone (jokingly referred to as the apprentice electrician) standing by on the shut down switch.
Some of the incidents I listed were not prevented before they resulted in problems. Our role of analysing the needs of protective devices and procedures, is to find ways to test them without incurring risk. We did that with the Underground Lift. With the testing of the life boats, one hopes they are not testing the systems to or beyond proof load.

quote:

to find ways to test them without incurring risk. We did that with the Underground Lift.

OK I agree. pls share your safe way to test the lift?

How do you propose to test the turbine overspeed switches?

For the underground lift testing, do you mean the 1000 kg load test reached the proof load of the lift?

How do you test the lift?
Well you dont have to test the lift. All you need to do is test all the systems work and that they will all work together. And then because these are hidden failures, you can never remove the possibility that there will be a multiple failure. All you can do is reduce the level of risk to a tolerable level.
The first thing to do is identify all the possible (or reasonably likely) failure modes. This was done. Some of the failure modes were evident (cable wear for example) hence failure finding was inappropriate. Condition based or hard time maintenance was selected. Same for all structural components.
Hidden failures included he governor system and braking system. The governor could be tested without the 1000 Kg mass. The brake operation could be verified via a number of condition based or failure finding tasks without the proof load either. There was a possibility that the brakes would work at low load but not at high. They may slip or slow down the rate of deceleration, but the group considered the likelihood of such an occasion, given the discs and pads were in good condition and that the hydraulic pressure was ok, was almost inconceivable.
Of course this is my recollection of the case and it went to the site engineers for review. And might I add, I am not an underground lift expert. I just led the mechanics and electricians through the process and tested their logic.

This message has been edited. Last edited by: Steve Turner,

quote:

How do you propose to test the turbine overspeed switches?

Josh,
Dont know. I have never studied a turbine overspeed switch.
The same process applies.
Define the failure modes.
Decide whether each failure mode on its own is hidden or evident. First of all you dont test for evident failure modes. Use the RCM decision logic for evident failure modes on those.
For the hidden failure modes, use the RCM decision logic and if the decision is to use failure finding, compute the risks and test frequencies using the correct set of mathematics.
Many of these control systems seem to be complex and have enormous redundancy. If you want to be sure, a detailed analysis might be worthwhile, however some quick mathematics over some basic assumptions might show that the likely frequency of the control system failing in a hidden position is far less frequent than other hidden failures,hence for the level of tolerable risk, the calculation might show that testing of control failures for hidden conditions is a one in a thousand year requirement hence you might find that test is unnecessary.
Hope my suggestion helps.

French police lose explosives on jet
Thought you might like this one too.
Monday, December 6, 2004 PARIS —
Police at Paris' top airport lost track of a passenger's bag in which plastic explosives were placed to test bomb-sniffing dogs, police said Saturday. Warned that the bag may have gotten on any of nearly 90 flights from Charles de Gaulle, authorities searched planes upon arrival in Los Angeles and New York.
In the same vane as the pilot test but with a little more humour.

Careless French bomb squad causes terror alert
Buzz up!
Google for French police explosives and dec 2004
Digg it
Amelia Gentleman in Paris
The Guardian, Monday 6 December 2004 00.02 GMT
Article history
A moment of carelessness had humiliating consequences for French bomb squad officers, when they accidentally mislaid an explosive device, hidden for training purposes in an unknown passenger's suitcase, triggering a global terror alert.
Officers training sniffer-dogs at Roissy airport outside Paris this weekend slipped 150 grams of plastic explosive in the side pocket of a blue bag, selected randomly from luggage waiting to be loaded on to a plane.

While they went to find a trainee dog to sniff it out, baggage handlers put the suitcase on a conveyor belt, where it was swiftly dispatched on to a waiting plane.

Last night the explosive was still missing.

Since the bomb squad officers had failed to check where the bag was travelling to, they had no option but to inform staff on 90 flights heading out of Roissy-Charles de Gaulle airport on Friday evening of the possible presence of explosives in the hold. Police, airlines and airport officials all over the world were put on standby.

French police admitted that there had been "a momentary lack of surveillance", but in a damage limitation exercise, tried to reassure their colleagues internationally that the small package had no detonator, and would not react to movement, shock or fire, and was therefore "no more dangerous than a bar of chocolate".

The embarrassment was nevertheless profound.

Four of the flights were en route to the United States, some were domestic French flights and others took off for Japan and Brazil.

The 362 passengers on an Air France flight to Los Angeles were evacuated from their plane and delayed for three hours while their luggage was inspected.

The US Transportation Security Administration said several planes were searched on arrival in New York. US news channels carried reports of the oversight hourly.

The two officers responsible are to face an internal investigation.

"It's clear that there was an error. This kind of thing should not happen," a police spokesman said last night.

French airports have intensified their anti-bomb surveillance measures after Richard Reid passed through security with explosive hidden in his shoe two years ago and boarded a flight to Miami.

No passenger has yet reported finding bomb-making materials in their baggage.
A police spokesman conceded that the owner of a dark blue suitcase with a retractable handle and wheels might be in for an unpleasant shock when he discovered the lump of clay-like explosives planted in a side pocket.

"One could imagine that the passenger might feel annoyed," he said