A maintenance incident on a Boeing 747 shows that given sufficient stress, lack of proper tools, and ambiguous documentation the problem of not knowing up from down can occur on the ground as well as in the air.
It was a heavy awkward job, scheduled to be done in the dull days between Christmas and New Year. The Virgin Atlantic Boeing 747-443 had a history of hydraulic fluid leaks in its right wing landing gear, specifically, from the gear actuator piston rod gland seal. The actuator is a hydraulic piston and cylinder assembly that pushes the undercarriage wheels down into position and pulls them up again.
On Sunday 28 December 2014, the day shift team gathered for the job at Virgin Atlantic’s Gatwick maintenance hangar. But the aircraft was late, the correct tools and parts proved hard to get, and half-way through, with the actuator removed, the job of refitting it ended up being passed to the night shift team.
Several months later, the certifying engineer on the day shift team told investigators from the United Kingdom Air Accidents Investigation Branch (AAIB) that he had spent considerable time on that chilly Sunday, trying to locate the correct ‘fish-pole’ hoist for the actuator, as specified in the approved maintenance manual.
This tool could not be found, so the engineer signed out a hoist designed for installation/removal of the aircraft auxiliary power unit (APU) from the tool store.
‘He reported difficulty in sourcing the correct tooling for other elements of the task as well and raised a ground occurrence report (GOR) to highlight this to the operator’s safety department,’ the AAIB investigators wrote.
Eventually, the actuator was removed from the aircraft without using the hoist, or the wing-gear retraction sling, as specified in the maintenance manual. There were no instructions in the maintenance manual about how to use the sling, or how to use the hoist and sling combination to manoeuvre the actuator.
The actuator was removed from the aircraft, and its associated fittings were transferred to the replacement actuator waiting on a work bench.
The night shift team arrived, and the day team briefed them in a handover reported to the investigators as ‘excellent’. They began the task of fitting the new actuator, with the help of an engineer who had done this job before and had been reassigned to the night team.
They started at 9.45pm. As in the day shift, they did not use the sling, or the APU lift, but manhandled the unit, with two technicians lifting and an engineer trying to install a locking pin. They were still bearing its 85 kg weight after 20 minutes, when they rotated positions. It took 30 minutes of lifting before the actuator was fitted.
Because the aircraft was on the ground, the test required by the maintenance manual was only to see if the gear moved when the up position was selected, before striking the locking pins that are always fitted when an aircraft is in the hangar for maintenance. The new actuator passed this test.
In Chapter 32-32-01 of the maintenance manual there is a sentence that, while admirably clearly written, describes an ambiguity that would fall into Professor James Reason’s definition of an error trap.
It says: ‘NOTE: You must put the actuator in the position with the rod end adjacent to the shock strut trunnion. The UP port faces must be on the lower side of the actuator. The DN port faces must be on the top side of the actuator.’
Is that clear? Because of the semantic confusion between the state of the landing gear and the position of the actuator, up means facing down, and down faces up. The report does not mention whether the night team read this or whether their understanding of this illogical condition was distracted by the sustained weight-lifting required to fit the new actuator.
It notes: ‘The actuator was virtually uniform in shape and colour, such that there was no obvious top or bottom to it.’
The next day, at 1143, the aircraft took off from Gatwick, headed for Las Vegas.
Within three minutes of the landing gear being retracted after take-off, low quantity and pressure warnings lit up for hydraulic system 4. It had a hydraulic fluid leak, later determined to have been the result of a hydraulic fitting on the upside-down actuator striking the inside of the gear bay. The crew ran through the seven-page hydraulic system pressure loss checklist, as the aircraft flew in a racetrack pattern, jettisoning fuel over the Irish sea—as close as the flight got to Las Vegas. After about 40 minutes it began its return to Gatwick.
But as the landing gear extended during the approach, the right wing landing gear struck the gear door, which prevented the gear leg from fully deploying. This was because the alternative gear extension system required some hydraulic fluid in the system, for damping.
Without fluid, the gear fell undamped, and dislodged a strike board from the gear door. Luckily, no one in the crowded home counties of England was beneath this five-kilo piece of aluminium when it fell to earth. It was discovered by a farmer in a field, several months later. The crew flew a go-around, followed by more circling, more checklists, including the gear disagree list—and more troubleshooting.
When that was done the aircraft was circled for another 40 minutes to burn fuel. At 1546, four hours after taking off, and 15 minutes before sunset, it landed, right wing low, because of the retracted right wing gear, and with some of the left side wheels off the ground.
The AAIB report criticised the design of the actuator, calling it ‘inherently open to misinterpretation,’ and noted that because actuators were rarely replaced ‘there is limited opportunity for individual maintenance organisations to develop internal “best practice” techniques or to identify and rectify weaknesses or missing information within the manufacturer’s instructions.’
The report also noted that the flight crew spent 15 minutes performing manoeuvres to get the gear to lock down. For the specific problem that had occurred this was a waste of time, and added, however slightly, to the risk. ‘The manufacturer confirmed it had anticipated the possibility of the landing gear becoming ‘hung-up’ on the gear door following an alternate system deployment due to a loss of hydraulic fluid, and designed the door to ensure that the gear remained in this position, should it occur. However, there was no guidance in the aircraft quick reference handbook checklists to make flight crew aware of this possibility.’
Mistakes, assumptions, and practices—each near-harmless in isolation—had taken their toll. Only luck and the redundant design of the Boeing 747 had prevented death or injury. As the report tersely noted:
‘The approach paths to London Gatwick Airport mostly overfly farmland, but many other airport approaches, pass over densely populated urban areas. Release of the strike board from an aircraft has the potential to cause serious injury or death should it hit someone on the ground…’
It is unsettling to think what might have happened in a similar situation on approach to Sydney’s Runway 16.
