When Down Is Up: 747 Actuator Installation Incident
The UK Air Accidents Investigation Branch (AAIB) has published their report into a serious incident involving Boeing 747-443 G-VROM on 29 December 2014.
History of the Flight
The AAIB report that:
The aircraft departed from London Gatwick Airport for a scheduled flight to Las Vegas. Following retraction of the landing gear after takeoff, low quantity and pressure warnings occurred on hydraulic system 4, due to a hydraulic fluid leak. The required checklists were completed and the aircraft returned to land at London Gatwick Airport. As the landing gear extended during the approach, the right wing landing gear struck the gear door, preventing the gear leg from fully deploying.
The crew carried out a go-around and, following a period of troubleshooting and associated preparation, a non-normal landing was successfully completed.
The Safety Investigation
The aircraft was towed from the runway to the operator’s hangar for further investigation. The AAIB report:
The damaged wing landing gear door was removed and the right wing landing gear leg fully extended. The right wing landing gear actuator was found installed 180° out of alignment. The hydraulic port boss fitting on the head end of the actuator was distorted and damaged.
The Damaged Hydraulic Port (Credit: AAIB)
Wing Landing Gear Actuator (Credit: Boeing via AAIB)
The 85 kg actuator had been changed the day before following an earlier leakage from the piston rod gland seal. AAIB say:
The actuator removal and installation was scheduled to be carried out in the operator’s hangar at London Gatwick Airport, during the day shift on Sunday 28 December. The certifying engineer who led the day shift team stated that he spent considerable time trying to locate the fishpole hoist specified in the AMM [for handling the actuator], but in the end withdrew a hoist designed for installation/removal of the aircraft Auxiliary Power Unit (APU) from the tool store.
Due to difficulty in sourcing the correct tooling for this rare task the engineer raised a Ground Occurrence Report (GOR) to highlight this to the operator’s safety department.
However, the team stated that the actuator was eventually removed from the aircraft without using either the sling or hoist. They identified that the [Boeing Aircraft Maintenance Manual] AMM did not contain instructions on how to use the sling or how to use the hoist and sling combination to manoeuvre the actuator. Once the unserviceable actuator had been removed from the aircraft, the associated fittings were transferred to the replacement actuator on the work bench.
Delays caused by the late arrival of the aircraft to the hangar and a requirement for additional parts to be sourced for the replacement actuator, meant that it could not be installed by the day shift team, so the task was handed to the night shift team who came on duty that evening. An additional engineer, with some experience of installing a landing gear actuator, was reassigned to assist due to the additional workload this task placed on the team. The night shift team reported that the task handover provided by the day shift team was “excellent”.
The installation procedure commenced at approximately 2145 hrs and began with the team positioning a set of steps and a lifter platform, carrying the replacement actuator, underneath the aircraft. In order to install the actuator it had to be passed through a section of structure in the wing. The team positioned spill bags to prevent damage from any contact between the actuator and the wing structure.
The sling and hoist were not used by the team, who instead manhandled the actuator between the two technicians standing in the lifter and the engineer standing on the steps. The weight of the actuator was then supported by the two technicians, while the engineer attempted to install the pin which secured the actuator to the hanger. After 20 minutes of unsuccessful effort, the team’s positions were rotated and they tried again to locate the pin for a further 10 minutes. Eventually the actuator was successfully secured in place by one of the technicians.
The AAIB note that by not using the sling:
…the task became so physically demanding that the maintenance team became entirely focused on just attaching the actuator to the aircraft, in order to relieve themselves of the 85 kg weight they had manually supported for over 30 minutes. As such, they had no remaining capacity to ensure they installed the actuator in the correct orientation. It was subsequently determined that they had rotated it 180° about its long axis during installation, effectively installing it upside down.
The team then continued to work through the night to reconnect the hydraulic hoses and leak check the hydraulic system. The AMM did not require a full operational test of the landing gear actuator following replacement, just a selection of the gear lever UP with the gear locking pins in place, to check the gear leg began to move before being restrained by the locking pin and to check for leaks. The aircraft was then prepared and released for service that morning.
As the AMM did not require the landing gear to be cycled, the…
…insufficient clearance between the hydraulic port and the top of the landing gear bay, when the gear was in the retracted position, was not identified until the first time the gear was retracted fully during the incident flight the following morning. The force exerted on the hydraulic port as the gear retracted, caused it to distort and release hydraulic fluid at the full system pressure of 3,000 psi. This rapidly depleted the reserve of hydraulic fluid in system 4, generating a low quantity and then low pressure warning in the flight deck.
The operator conducted what the AAIB praised as “a detailed investigation”, culminating in a “comprehensive” report with 28 recommendations, which they openly shared with the AAIB.
The majority of these related to internal improvements in process [such as availability of tooling], but a number also related to possible improvements in the aircraft manufacturer’s documentation to remove ambiguity.
That investigation noted that while the sling was mentioned in the AMM, there were no instruction on how to use it to actually achieve the difficult task of manoeuvring the actuator into place.
The AAIB note that:
Whilst the manner in which the actuator was installed by the maintenance team significantly increased the likelihood of a maintenance error occurring, the design of the actuator itself increased the probability of the error remaining undetected. The actuator was virtually uniform in shape and colour, such that there was no obvious top or bottom to it. The structural connections could be installed in either orientation and the use of flexible hoses meant the hydraulic connections could be made to fit an incorrectly installed actuator.
Finally, the hydraulic port on the bottom of the actuator was labelled ‘UP’, with the one on the top labelled ‘DN’, which was inherently open to misinterpretation.
These markings relate to the movement of the gear not the orientation of the actuator.
AAIB Safety Recommendations
The AAIB have made four recommendations, all directed to Boeing:
-
To enhancing the AMM description of the maintenance task and the use of the associated equipment
- To modify the actuator to prevent incorrect installation (such error proofing is elsewhere known as poke yoke)
- To modify the design so that a 5 kg ‘strikeboard’ is not released, with the associated third party hazard, when the alternative gear extension system is used (not discussed above – see the AAIB report)
- To enhance the Quick Reference Handbook instruction for crew in these circumstances.
Boeing’s Poor Response to AAIB Safety Recommendations
UPDATE 17 May 2016: Six months after we published our original article the AAIB publish an update on rather unimpressive responses to their recommendations.
Safety Reporting and the Importance of Appropriate Follow-Up Action
Aerossurance has recently written about the new Regulation (EU) 376/2014 on the reporting, analysis and crucially the follow-up of occurrences. We highlighted a point recently made by the European Aviation Safety Agency (EASA) in a presentation at a seminar organised by the European Helicopter Association (EHA) at Helitech. EASA commented that safety reporting is simply the first step to safety improvement:
Collection of data is meaningless if we don’t do anything meaningful with it or if we don’t use it to inform the whole industry
This observation is perhaps relevant to this occurrence, because previously, in 2006, another UK operator had received 747 Body Landing Gear from a non-EU EASA Part 145 Approved Maintenance Organisation. After fitment to an aircraft, but before flight, it was noticed that “the steering actuator attachment yoke [was] fitted upside down”. A UK Mandatory Occurrence Report (MOR) was raised and submitted to the UK Civil Aviation Authority (CAA). In that case the analysis was limited:
This can be considered to be a maintenance error caused by the engineers not correctly following the assembly instructions and performing adequate inspection of the yoke installation.
CAA Closure: The hazaard [sic] is adequately controlled by existing requirements, procedures and documentation.
One wonders how many minor occurrences, that had the potential to be worse, are inappropriately dismissed as “adequately controlled” by existing measures, despite the associated occurrence report, almost by definition, demonstrating that are not. Among the organisations working to enhance information sharing between operators and maximise learning is HeliOffshore, with their Information Exchange workstream. Earlier in 2015, the CHIRP Charitable Trust, who run the UK’s Confidential Human Factors Incident Reporting Programme (CHIRP) reported on an unrelated case where engineers at a line station wished to do a functional test on the landing gear but were overruled by the operator’s continuing airworthiness personnel. They had been working on an indication fault on an unspecified aircraft type and CHIRP report that:
What becomes apparent is that while there was a lot of communication there appeared to be a lack of focus on issue resolution from the parties involved… The UK CAA have conducted a thorough investigation and concluded the following. The Airline technical department (in conjunction with the manufacturer) made the correct decisions regarding the need for an undercarriage swing [i.e. that one was not needed] and complied with the requirements of their AOC.
CHIRP assessed this report primarily from the perspective of communication and engagement between the operators’ continuing airworthiness management organisation and maintenance organisation. It is worth reflecting on those conclusions in the light of the 747 serious incident and the lack of a manufacture requirement for an landing gear swing in that case.
UPDATE 16 October 2016: BA B747 Landing Gear Failure Due to Omission of Rig Pin During Maintenance
UPDATE 11 February 2018: Lost in Translation: Misrigged Main Landing Gear
UPDATE 2 March 2018: An excellent initiative to create more Human Centred Design (HCD) by use of a Human Hazard Analysis (HHA) is described in Designing out human error
HeliOffshore, the global safety-focused organisation for the offshore helicopter industry, is exploring a fresh approach to reducing safety risk from aircraft maintenance. Recent trials with Airbus Helicopters and HeliOne show that this new direction has promise. The approach is based on an analysis of the aircraft design to identify where ‘error proofing’ features or other mitigations are most needed to support the maintenance engineer during critical maintenance tasks.
The trial identified the opportunity for some process improvements, and discussions facilitated by HeliOffshore are planned for early 2018.
UPDATE 24 June 2018: B1900D Emergency Landing: Maintenance Standards & Practices The TSB report posses many questions on the management and oversight of aircraft maintenance, competency and maintenance standards & practices. We look at opportunities for forward thinking MROs to improve their maintenance standards and practices.
UPDATE 25 August 2018: Crossed Cables: Colgan Air B1900D N240CJ Maintenance Error On 26 August 2003 a B1900D crashed on take off after errors during flying control maintenance. We look at the maintenance human factor safety lessons from this and another B1900 accident that year.
UPDATE 12 October 2020: Frozen Dash 8-100 Landing Gear After ‘Improper Maintenance Practices’ Say NTSB
UPDATE 15 March 2021: ATR 72 Rudder Travel Limitation Unit Incident: Latent Potential for Misassembly Meets Commercial Pressure
FSF Maintenance Observation Programme (MOP)
Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine maintenance and then to initiate safety improvements:
Aerossurance can provide practice guidance and specialist support to successfully implement a MOP.
Recent Comments