Description

On 9 April 2017, an ATR 72-500 (ZK-MCY) being operated by Mount Cook Airline on a scheduled domestic passenger flight from Auckland to Nelson was unable to obtain a right main landing gear locked-down status indication on approach to Nelson in day VMC and after declaring a ‘PAN’ diverted to the longer runway at Palmerston North where despite the same unsafe indication for the right gear, it did not collapse and the aircraft was stopped on the runway for disembarkation.

Investigation

An Investigation into the accident was carried out by the Transport Accident Investigation Commission (TAIC). The CVR was removed from the aircraft and the QAR was downloaded. When the CVR data were subsequently downloaded, it was found that although the crew had tripped the corresponding CB before leaving the aircraft, the first few minutes of relevant data had been overwritten because this CB had been reset when the aircraft was later removed from the runway.

It was noted that the Captain, who was a current Training Captain with the operator had a total of 5,500 hours flying experience of which over 2000 hours were on type. He had joined the operator four years earlier as a First Officer and been promoted to Captain in September 2015. The First Officer, who was designated as PF for the flight, had 3,107 hours flying experience of which 1,870 were on type, and had joined the operator in October 2013. The senior member of the two-person cabin crew was undergoing a routine line check conducted by a supernumerary cabin crew trainer.

What happened

The flight had proceeded uneventfully until the landing gear was selected down during the approach to runway 02 at Nelson, following which the status indication for the right main gear showed red rather than the expected green on both the primary and secondary indicators. After making a go around and being unable to resolve the problem, the flight declared a ‘PAN’ and advised an intention to divert to Palmerston North which had a longer runway available. After making this transit at 15,000 feet, the Captain took control and, after further unsuccessful attempts to get an indication that all landing gear legs were locked down, made a visual daylight approach to runway 07. On touchdown leading with the left main gear, the power levers were closed and the aircraft was brought to a stop approximately 500 metres prior to the end of the 1900 metre-long runway on a heading of about 10° left of the centreline. The right main gear outer tyre was found deflated and a skid mark showed that it had skidded about 150 metres before bursting. The passengers were subsequently disembarked from the aircraft and taken to the terminal by bus.

The origin of the ‘gear-unsafe’ Indication

An examination of the right main landing gear assembly found that two locking springs which are intended to pull the secondary alignment brace into an over-centre locked position had broken and this locking mechanism had not fully engaged (see the illustration below). It was noted that the complete right main landing gear assembly involved had originally been fitted to another of the operator’s ATR72 aircraft during manufacture in 2002. The applicable maintenance schedule required that a full overhaul should occur after the first of either 18,000 cycles or 8 eight years and after completion of this overhaul, the assembly had then been refitted to a different aircraft - the one involved - in November 2009.

The right main gear side brace assembly in its extended position showing the locking springs. [Reproduced from the Official Report]

It was also noted that the complete landing gear assembly was also subject to inspection every 5,000 flight hours as part of each ‘C Check’. But this “was a visual inspection and did not require the removal of components”. The most recent of eight ‘C Check’ inspections of the failed locking springs was found to have occurred in mid-2016 following which the side brace assembly had accumulated 1,420 flight hours and 1,456 flight cycles. In total in the 14 years since its original installation in the previous aircraft, the side brace had accumulated a total 35,829 flight hours and 36,366 flight cycles.

An independent specialist examination established that both locking springs had failed due to “stress corrosion cracking followed by fatigue initiated corrosion” with the cracking then propagating until the spring was no longer capable of supporting the load and failure occurred. The fracture surfaces of the two springs were almost identical but it was not possible to determine whether they had failed simultaneously. This examination also noted that although the springs were made of stainless steel, they would not have been immune to salt-induced corrosion and stress cracking. One of the failed springs was, on request, forwarded to the OEM along with another, still-intact but higher life spring taken from another aircraft in the Mount Cook fleet for comparison. The OEM advised that the failure of the spring was attributable to “intergranular corrosion that then expanded by stress corrosion cracking followed by fatigue” and that their inspection of it had identified both chlorine and sodium, suggesting that the onset of corrosion may well have been attributed to the operational environment. ATR and the spring OEM advised the Investigation that they had records of 19 previous locking spring failures, all of which had involved the failure of only one of a spring pair.

The effect of the double spring failure

It was noted that whilst the failure of both springs would have resulted in a large sideways force whilst there was little or no downward force on the wheels and would thus have triggered - as intended by design - the ‘gear unsafe’ indication as long as the aircraft remained airborne. However, once the aircraft was on the ground with its full weight on the wheels, collapse of the gear leg was no longer possible. The manufacturer’s ‘system safety assessment’ for the failure of a single locking spring in service was that it would have ‘no safety effect’ because the failure of one spring “did not induce additional stress on the remaining spring". However, the corresponding assessment for a double spring failure was ‘major’ for which the applicable definition was “a condition which would reduce the capability of the aeroplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or discomfort to the flight crew, or physical distress to passengers or cabin crew, possibly including injuries”. The Investigation considered that although the fact that the double spring failure had been the first such occurrence in more than 30 million aircraft type flight hours and therefore fell into the applicable definition of an ‘extremely remote’ occurrence probability, “nevertheless, as locking springs remain in service in potentially corrosive environments, it is important that appropriate maintenance and inspection procedures are in place to ensure that double-spring failures do not occur”.

One Safety Issue was therefore indentified as being that “the maintenance inspection programme for the locking springs would have been unlikely to detect the corrosion cracking in the locking springs prior to their failing, and that there was no required preventive maintenance of the locking springs to limit the extent of corrosion damage”.

The operational response of the crew to the occurrence

It was considered that the decision to divert to Palmerston North was an appropriate one and that the deceleration and directional control of the aircraft after touchdown in the absence of engine power, nose wheel steering and normal braking (which follow from the actions in the ‘landing with abnormal gear indication’ checklist) was well handled. However, recorded data from the flight showed that the response of the crew to the ‘gear unsafe’ indication had not fully followed the correct and trained procedures. Although the required ‘landing gear gravity extension’ and ‘landing with abnormal landing gear’ checklists were eventually followed, the crew had initially responded by recycling the landing gear without any evidence that they had comprehensively assessed the potential consequences of this, which could have been expected to identify that the landing gear may have become stuck at an intermediate position. It was considered that such a ‘comprehensive assessment’ would have also involved a consultation with the operator for which there would have been ample fuel endurance and time. It was concluded that although this deviation had not affected the outcome, in other circumstances such recycling might have made matters worse.

The Findings of the Investigation were formally documented as follows:

• The unsafe condition of the landing gear was caused by the dual failure of the two landing gear locking springs to hold the right hand landing gear in a down and locked position.
• The two right main landing gear locking springs failed because of corrosion cracking, likely initiated by salt.
• The severe corrosion environment in which the aeroplane operated increased the likelihood of corrosion occurring.
• It could not be determined whether one locking spring failed before the other, or whether they failed simultaneously.
• The maintenance inspection programme for the locking springs would have been unlikely to detect the corrosion cracking in the locking springs prior to their failing.
• There was no required preventive maintenance of the locking springs to limit the extent of corrosion damage.
• The crew’s decision to divert to Palmerston North Aerodrome was sound and the preparation for the emergency landing was well conducted and in accordance with company procedures.
• The recycling of the landing gear several times before the emergency landing was outside documented procedures, and had the potential to exacerbate the condition.

Safety Action taken as a result of the event and whilst the TAIC Investigation was in progress were noted as having included the following:

• Mount Cook Airline replaced all landing gear locking springs which had accumulated 30,000 or more cycles and introduced a limit on the service life of these springs to the first nine years or 20,000 cycles since installed new. They also introduced a new cleaning and lubrication task for the springs as part of each 500-hour maintenance check.
• ATR updated the aircraft CMM to add a new inspection tasks for the springs at overhaul in order to prevent reoccurrence.

The Key Lessons arising from the Investigation were recorded as:

• The importance of a pre-flight visual inspection of critical components such as those of the landing gear, particularly when the integrity of the components relies on pre-flight visual inspections.
• Although on this occasion re-cycling the faulty landing gear did not have any adverse outcome, this action was not in accordance with flight crew operating manual procedures. In other failure cases, recycling can exacerbate the extent of the problem.
• Aircraft recorders provide a valuable source of information for an investigation. Operators should enforce strict adherence to post-accident and incident procedures for preserving the data on any on-board record.

The Final Report was approved for publication by the Commission on 16 October 2019 the published on 5 December 2019. No Safety Recommendations were made.

Related Articles

• Landing Gear Problems: Guidance for Flight Crews
• Ageing Aircraft - Structural Failure
• Aircraft Maintenance
• Maintenance Programme
• Flight Crew Pre Flight External Check
• Standard Operating Procedures (SOPs)