UK AAIB: Boeing Safety Responses ‘Not Adequate’

Six months ago we published an article that discussed the UK Air Accidents Investigation Branch (AAIB) report into a serious incident involving a Boeing 747-443 G-VROM on 29 December 2014.  AAIB has recently published an update on responses to their recommendations by Boeing.  Two were classed ‘Not Adequate’, one ‘Partially Adequate’ and one ‘Adequate’.  The AAIB was, we feel, generous in that last case!  We look at the responses in more detail below.

The Incident and Investigation

After take-off the 747 developed hydraulic problems while retracting its landing gear. The required checklists were completed and the aircraft returned to land back at London Gatwick Airport.

On approach, as the landing gear was extended, the right wing landing gear struck the gear door, preventing the gear leg from fully deploying, after a go-around and troubleshooting, landing on the three remaining main gear was successfully competed.  This also resulted in 5kg ‘strike board’ becoming detached and falling into a field in Kent.

On investigation it was found that an 85 kg actuator that had been changed the day before due to a leak.

Wing Landing Gear Actuator (Credit: Boeing via AAIB)

Wing Landing Gear Actuator (Credit: Boeing via AAIB)

The Boeing Aircraft Maintenance Manual (AMM) did reference the part number for a sling to use with a hoist but gave no instruction on how to use it.  Instead AAIB say:

The team…manhandled the actuator between the two technicians standing in the lifter and the engineer standing on the steps. The weight of the actuator was then supported by the two technicians, while the engineer attempted to install the pin which secured the actuator to the hanger.

…the task became so physically demanding that the maintenance team became entirely focused on just attaching the actuator to the aircraft, in order to relieve themselves of the 85 kg weight they had manually supported for over 30 minutes. As such, they had no remaining capacity to ensure they installed the actuator in the correct orientation. It was subsequently determined that they had rotated it 180° about its long axis during installation, effectively installing it upside down.

The AAIB note that:

…the design of the actuator itself increased the probability of the error remaining undetected. The actuator was virtually uniform in shape and colour, such that there was no obvious top or bottom to it. The structural connections could be installed in either orientation and the use of flexible hoses meant the hydraulic connections could be made to fit an incorrectly installed actuator.

Finally, the hydraulic port on the bottom of the actuator was labelled ‘UP’, with the one on the top labelled ‘DN’, which was inherently open to misinterpretation.

These markings relate to the movement of the gear not the orientation of the actuator.  The AMM also did not require a functional test either, so the error was not detected.

The operator conducted what the AAIB praised as “a detailed investigation”, culminating in a “comprehensive” report with 28 recommendations, which they openly shared with the AAIB.

The majority of these related to internal improvements in process, but a number also related to possible improvements in the aircraft manufacturer’s documentation to remove ambiguity.

While, the specific investigation methodology used by the operator is not discussed this sounds like the sort of suite of improvement actions you might expect a diligent organisation to identify, using an approach similar to Boeing’s own Maintenance Error Decision Aid (MEDA).  MEDA is a tool developed over 20 years ago which “Boeing decided to offer…to all of its airline customers as part of its continued commitment to safety”.

AAIB Safety Recommendations and Boeing Safety Responses

We look at the four recommendations, though in reverse order:

Safety Recommendation 2015-029: Quick Reference Handbook  - ‘Partially Adequate’

The AAIB said:

It is recommended that Boeing amend the 747-400 Quick Reference Handbook to warn flight crews of the potential for, and provide guidance in the event of, an unsuccessful extension of the wing landing gear, when the alternate gear extension system is used following hydraulic system 4 low quantity and pressure warnings.

Boeing give a long response that can be generally summarised with one quote: “it is not possible to develop checklists for all conceivable situations”.  We do have sympathy for this logic, but Boeing do start with the admission that:

Boeing’s Quick Reference Handbook (QRH) procedures are designed assuming a single fault is present and the actionable event is the only event.

This does seem to be a rather optimistic and simplistic assumption!

Safety Recommendation 2015-028: Strike Board – ‘Not Adequate’

The AAIB said:

It is recommended that Boeing modify the design of the 747-400 wing landing gear door mechanism to prevent release of the strike board from the aircraft when the alternate gear extension system is used following a loss of hydraulic fluid.

The AAIB had noted that:

The aircraft was at an altitude of approximately 3,000 ft and travelling at 180 kt when this [component loss] occurred. The 5 kg strike board would therefore have reached the ground with sufficient energy to cause significant damage or injury.

That is around 20.5kJ of energy (about 40 times the energy of a 9mm parabellum pistol bullet!).

Boeing responded:

As of this date we have not found any other instances of a strike board release from the aircraft under the event circumstances. Boeing does not believe a change is necessary or warranted.

Its possible that this response might have been accepted if robust action was being taken to reduce the probability of the failure that resulted excessive load being applied to the strike board, causing its release.  But as we see next this was not the case.

Safety Recommendation 2015-027 Actuator Modification  - ‘Not Adequate’

The AAIB said:

It is recommended that Boeing modify the 747-400 wing landing gear actuator to reduce the likelihood of incorrect installation occurring or remaining undetected.

Such error proofing is also known elsewhere as poke yoke and can involve design features that mean only one installation orientation is possible.

Boeing disagree.  Stating:

The wing gear retract actuator has been in service for over 45 years and Boeing is not aware of any instances of confusion regarding the installed position.  Airplane Maintenance Manual has very clear instructions to ensure the actuator is installed correctly…

However, as we published 3 months before the date of the Boeing response:

…in 2006, another UK operator had received 747 Body Landing Gear from a non-EU EASA Part 145 Approved Maintenance Organisation.  After fitment to an aircraft, but before flight, it was noticed that “the steering actuator attachment yoke [was] fitted upside down”.

This at very least suggests there are other cases were similar confusion and errors have occurred, undermining Boeing comments that the manual was clear.  In fact the ‘clarity’ Boeing claim in this specific case is only that that the AMM has a note that states UP is at the bottom and DN at the top of the actuator…which we see only as a warning of a source of potential confusion not clarity!

They go on to say that such installation errors “do not affect continued safe flight and landing of the aircraft”.  Strictly this is true, but they miss the very clear AAIB point that it is the third part risk from falling debris which is their concern.

An actuator change is a relatively rare event and not something that maintenance engineers will do frequently.  On legacy types like the 747, as the fleet shrinks the probability of error is likely to increase when doing error-prone tasks with less recent experience of them and especially if aircraft sold on to smaller, less experienced operators.  This might be offset by the smaller fleet, but then again an ageing fleet may see more leaks requiring actuator removal.  There is no evidence in their responses that any great thought has been given to the future likelihood of re-occurrence by Boeing.

It is also noticeable that if this were only time a misorientated actuator has flown, it is reasonable, based on the information in the AAIB report, to assume that every such case will result in the release of a strike board.

Safety Recommendation 2015-026: Enhance the AMM – ‘Adequate’

The AAIB said:

It is recommended that Boeing amend the 747-400 Approved Maintenance Manual task for removal and installation of the wing landing gear actuator, to provide clear instructions for the safe manoeuvring of the actuator in or out of its location in the wing landing gear bay.

Boeing say:

Boeing does believe the figure of the retract actuator in the AMM could be improved and it is planned to update this figure to add callouts to the UP and DN hydraulic ports. This update is planned to be incorporated in the 3rd quarter 2016 publishing of the AMM.

This action, which does perhaps undermine their assertions of clarity in response to Safety Recommendation 2015-027, seems to have earned them their only ‘Adequate’ rating from AAIB.  However their response is rather spoiled by this statement:

The recommended technique for manoeuvring the actuator into or out of the installation location are [sic] not included in the AMM. The AMM is a procedural manual that assumes the maintenance called for will be performed by qualified mechanics who have received training in the use of the required tooling and in the maintenance techniques that may be necessary to complete the procedure.

This could be paraphrased as:

  • “we do have a recommended technique but we didn’t put it in the AMM”
  • “our AMM contains ‘procedures’ that don’t actually tell you how to do the job”

These suggest a lack of attention to human factors, aggravated by what appears to be a prejudicial assumption that:

  • “we assume that if parts are incorrectly installed the maintainers haven’t been trained adequately”

The AAIB concluded that the orientation of this actuator is not obvious and there is no suggestion in their report of a lack of qualification, competence or motivation amongst the maintainers involved, who were employed by a reputable major airline.

Our Thoughts

While the AAIB work with a specific taxonomy for classifying responses, we feel ‘could try harder’ is a suitable summary in this case both in relation to the limited action proposed by Boeing and the minimal effort justifying their position to AAIB.

On future designs, users will be hoping to do even less scheduled or un-scheduled maintenance, meaning that tasks, when they do occur, will be rarer and so AMM clarity and detail will be even more important.  However we would hope that future designs were error-proofed so components could only be fitted one way.

The Royal Aeronautical Society (RAeS) Human Factors Group: Engineering (HFG:E) has published a short guidance document on 11 steps an aviation Design Organisation (DO) can take to “deliver safer, more effective and reliable aircraft through improved design for maintenance”: First Eleven: Guidance for Designers on Maintenance Human Performance

UPDATE 14 August 2016: We do wonder if in this case the TC Holder should show more empathy to the maintainers who have to cope with their designs.

UPDATE 28 October 2016: Its worth noting that some commentators expect the 747 to continue in-service as a type for 40 more years: How Long Will The Boeing 747 Be Flying? (MRO Network)

UPDATE 2 March 2018: An excellent initiative to create more Human Centre Design (HCD) by use of a Human Hazard Analysis (HHA) is described in Designing out human error

HeliOffshore, the global safety-focused organisation for the offshore helicopter industry, is exploring a fresh approach to reducing safety risk from aircraft maintenance. Recent trials with Airbus Helicopters and HeliOne show that this new direction has promise. The approach is based on an analysis of the aircraft design to identify where ‘error proofing’ features or other mitigations are most needed to support the maintenance engineer during critical maintenance tasks.

The trial identified the opportunity for some process improvements, and discussions facilitated by HeliOffshore are planned for early 2018.

Aerossurance is pleased to support the Chartered Institute of Ergonomics & Human Factors’ (CIEHFHuman Factors in Aviation Safety Conference that takes place at the Radison Blu HotelEast Midlands Airport, 7-8 November 2016.  Our presentation will discuss the importance of HCD.

Aerossurance has extensive design, air safety, design, airworthiness, maintenance human factors and safety analysis experience.  For practical aviation advice you can trust, contact us at: