Aviation Investigation Report A95P0073

• Table of contents

  1. Factual information
  2. Analysis
  3. Findings
  4. Safety action
  5. Appendices

Summary

Following maintenance activity involving the right off-wing slide system, the aircraft had a slide door alert message illuminate while being de-iced. The aircraft was released for the flight under the authority of the minimum equipment list. During the approach to the Vancouver International Airport, the right off-wing slide compartment door opened, and the right off-wing slide separated from the aircraft. The aircraft landed without further incident.

The Board determined that the right off-wing slide compartment door opened in flight because the secondary lock shear-pin had been inadvertently sheared during recent inspection; this maintenance error remained undetected because existing required inspection procedures had not been followed. Contributing to the deviations from formal standard practices was inadequate understanding of the system on the part of the maintenance technicians and supervisor.

1.0 Factual Information

1.1 History of the Flight

C-GAUH, a Boeing 767-233 aircraft, was undergoing a scheduled maintenance "A" check at Toronto during the night shift. The check was near completion when the right off-wing slide deployment system was inadvertently initiated, which fired the spoiler override actuator, the latch opening actuator, and the door opening actuators; a job ticket was raised to replace these actuators. The aircraft was ready for service at 0930 eastern daylight saving time (EDT) <1> and the aircraft arrived at the gate at 1020 for a planned push-back at 1045 as flight 899. Flight 899 completed loading, pushed back from the gate at 1116, and taxied to the designated de-ice area where the aircraft was de-iced. There were 2 pilots, 6 cabin crew, and 95 passengers on board.

During the taxi following de-icing, the overhead EMERGENCY DOOR warning illuminated, and the engine indication and crew alerting system (EICAS) displayed a R WING SLIDE message. The flight crew consulted the minimum equipment list (MEL), and found that they were required to return-to-gate. They taxied back to the ramp and advised Air Canada ramp maintenance by radio; maintenance dispatched a certified aircraft technician to investigate the problem. The ramp technician examined the door, which appeared faired and closed, and visually inspected the integrator to confirm that the door was latched and closed. During this examination, the door alert message went out, and the technician verbally released the aircraft.

The aircraft was de-iced a second time and, during de-icing, the right slide door alert message activated again and stayed on. Ramp maintenance was again advised of the situation; they did not investigate further but informed the flight crew that there was no actual problem with the door, and that the door indication system was faulty. They released the aircraft verbally with the steady door alert under the provisions of the MEL. The aircraft had been delayed a total of one hour and fifteen minutes when it finally departed at noon from Toronto/Lester B. Pearson International Airport, Ontario, on a scheduled domestic flight to Vancouver, British Columbia. The right slide door warning light and the EICAS message stayed on for the duration of the flight.

On the downwind leg for runway 08 at Vancouver, one of the flight attendants reported to the captain that a loud bang had been heard in the passenger cabin. The crew checked their instrumentation for any abnormality, and noted that the aircraft was performing normally. They suspected that cargo may have shifted and they radioed this information ahead for the ground crew. They landed and taxied to the gate at the terminal. After shutdown, the ground crew reported finding the right off-wing slide compartment door open, and the off-wing slide missing.

The occurrence took place at latitude 49·15'N, longitude 123·25'W, during the hours of daylight, at 1359 Pacific daylight saving time (PDT).

1.2 Injuries to Persons

1.3 Damage to Aircraft

The aircraft sustained only minor damage as the unfurled slide abraded the paint on the side of the fuselage before it separated.

1.4 Other Damage

The missing slide was not recovered, and is believed to have fallen into Georgia Straight and sunk. There have been no reports of other damage caused by the falling slide.

1.5 Personnel Information

The flight crew was certified and qualified for the flight in accordance with existing regulations.

1.6 Aircraft Information

1.7 Meteorological Information

Weather at Vancouver at the time of the occurrence was as follows: scattered cloud layers at 1,800 and 2,200 feet, broken ceiling at 3,500 feet, visibility 15 miles in light rain, and the wind from 060· at 9 knots.

1.8 Off-wing Slide System

1.8.1 System Overview

The Boeing 767 incorporates an inflatable slide at the inboard rear of each wing to allow the evacuation of passengers who use the over-wing exits during an emergency. Slide deployment is initiated by opening the exit hatch from the inside. The hatch opening motion actuates electrical switches that simultaneously (1) operate a relay to ground out any position command going to the main hydraulic spoiler power controller actuator, and (2) fire the spoiler override actuator which rotates the inboard spoiler to the down position. After a two-second time delay (from the spoiler actuator firing), the latch opening actuator is fired. The latch opening actuator opens the escape slide compartment door latches and fires the door opening actuators located in the escape slide compartment. The slide compartment door, with the escape slide packboard assembly attached, is rotated outboard by the actuators. When the door opens, a mechanical link to a high pressure inflation cylinder triggers the release of gas that inflates the slide. Proximity sensors monitor the position of the door latches, and are used to trigger warning lights and EICAS messages on the flight deck.

During maintenance such as "A" checks, the off-wing slide system is de-activated and a safety pin is inserted in the high pressure inflation cylinder to prevent inadvertent deployment and inflation which could cause injury to personnel and damage to equipment.

1.8.2 Design and History of the Integrator

The integrator was originally designed and manufactured without a secondary lock. After many incidents in the early 1980s of the off-wing slide compartment door opening in flight, the integrator was re-designed. A secondary lock mechanism was included on new integrators to prevent vibrations from causing the latch shaft to migrate to the unlatched position. Existing integrators were also modified to incorporate this feature. A key characteristic of the secondary lock is the shear pin which holds the secondary lock lever in place during normal operation, but easily shears to allow the actuator to release the door latches. The shear pin is designed to shear at a pre-determined force, and thus allow the opening of the door latches, and in turn, the door. The design of the off-wing slide system is such that the actuator cannot be fired without shearing the secondary lock shear pin.

Because of an ongoing number of incidents in the industry, even after the first rework of the secondary lock mechanism, the off-wing slide integrator was redesigned to simplify deactivation procedures. This elective rework was not incorporated on this aircraft.

1.8.3 Inspection after the Landing in Vancouver

Inspection of the aircraft after it had landed in Vancouver revealed that the slide inflation trigger was disconnected and the high pressure inflation cylinder was full; the door opening actuators and the latch opening actuator had not fired and the latch pins were in good condition; the sensors and the door warning system functioned normally; and the integrator was found unlatched but in good condition, except for the secondary lock shear pin which had sheared in three pieces but remained in place. A visual inspection of the secondary lock would not reveal that the pin was sheared.

1.9 Restoration of the Off-wing Slide System

1.9.1 Job Ticket

Following the inadvertent deployment of the off-wing slide compartment door actuator during the return to normal after the "A" check, a 12-page job ticket, entitled "Off-Wing Escape System - Restoration - 6-225", was generated which listed 31 sign-off items. Not all of the 31 items had to be actioned, because the safety pin that was inserted in the inflation mechanism for the "A" check prevented the slide from inflating when the off-wing slide compartment door opened. However, replacement of most items was required to restore the system, including replacement of the latch opening actuator, off-wing slide compartment door actuators, and the spoiler blow-down squib.

1.9.2 Disconnection of the Inflation Trigger

The night-shift certified aircraft technician who organized the restoration of the system disconnected the mechanical linkage from the off-wing slide compartment door to the trigger on the inflation cylinder both for safety reasons and to allow the slide to lie back down to facilitate maintenance. Disconnection of the inflation trigger was not an item on the job ticket; the job ticket assumes that the inflation cylinder has emptied as a result of the slide having been purposely deployed and inflated during operation of the aircraft rather than inadvertently deployed when the inflation cylinder was safetied with a pin during maintenance.

The work required to restore the system extended into the morning shift. The night-shift technician who had disconnected the inflation trigger verbally briefed one of the morning-shift certified aircraft technicians about the disconnection; however, the night-shift technician did not raise a snag or make a written record of it or attach a warning flag. The morning shift technician who had been briefed about the disconnection was subsequently assigned to work on a different aircraft, and the inflation trigger was not reconnected before the aircraft was released for service.

1.9.3 Replacement of the Secondary Lock Shear Pin

In addition to the replacement of the fired actuators, the job ticket also required the replacement of the secondary lock shear pin (item 18). The morning-shift certified aircraft technician who readied the aircraft for service signed item 18, which called for the replacement of the secondary lock shear pin, as being completed, but the shear pin was not replaced. The technician reported that there was no replacement shear pin available on the shear pin ring, as stated on the job ticket.

Although the pin was sheared into three pieces, the pieces stayed in place in the secondary lock. Thus, it was not readily apparent upon visual inspection that the pin was sheared. Instead of acquiring a new shear pin from the stores department, or from the left off-wing slide integrator, the technician conducted an external visual inspection of the shear pin, and concluded that it did not need to be replaced.

Previous shearing of the secondary lock mechanism shear pin and migration of the primary lock permitted the door latch train to migrate from vibration, thus allowing the door to unlatch and open under flight aerodynamic and inertial side loads.

1.10 Minimum Equipment List

1.10.1 Minimum Equipment List Inspection

The 767 MEL manual states that the R WING SLIDE message, which first appeared on the EICAS during taxi after the aircraft was de-iced the first time, indicates that the right off-wing slide compartment door is unlatched, and that it must be checked by maintenance personnel to confirm that it is closed and latched. The MEL procedure requires the completion of twelve steps before the aircraft is released as serviceable for each flight until the snag is rectified. These steps include a detailed inspection of the integrator and associated linkage, the actuation of the integrator to unlatch and properly re-latch the off-wing slide compartment door, the placarding of the cockpit warning light, and the placement of an entry in the journey log-book.

With the exception of opening the integrator access door to visually inspect the integrator, none of the required maintenance actions took place. Although the ramp maintenance supervisor had access to the requirements of the MEL, the certified aircraft technician conducting the inspection on the ramp was not given the MEL to work from. Furthermore, he did not have ready access to the MEL carried on board the aircraft. The inspecting technician and the ramp maintenance supervisor agreed that there was no need to delay the plane any further and carry out the MEL inspection. They informed the crew that they had determined that the off-wing compartment door was locked and that the steady warning light was an erroneous indication problem; however, there was no discussion between the flight crew and maintenance as to how this determination was made.

The ramp maintenance supervisor and the technician were aware of the inadvertent off-wing slide compartment door actuation during the "A" check, and the subsequent maintenance activity that had just taken place to restore the system. However, the maintenance personnel were generally apprehensive about handling anything associated with the slides for fear of an inadvertent deployment, which can result in personal injury and equipment damage, or delays in aircraft operations.

1.10.2 Flight Crew Acceptance of the Aircraft

When the fault warning illuminated and the EICAS message appeared, the flight crew followed standard procedure by consulting the MEL. They returned to the ramp to have the door inspection carried out by maintenance. Although they had no knowledge that the MEL inspection requirements were not carried out by maintenance, they did know that the requirement to placard the warning light and make a log-book entry was not met. They accepted the aircraft as airworthy based on a verbal release from maintenance.

1.11 Qualifications and Training of Maintenance Personnel

1.11.1 Certified Aircraft Technician who Replaced the Actuator

The morning-shift certified aircraft technician who completed the "A" check and readied the aircraft for service was an Air Canada employee who was licensed and endorsed on the Boeing 767-233. He received his initial training on the aircraft in 1991, and since then his only training relative to the B767 was a Difference course on the 767-300 model. He had never previously worked on his own on the off-wing slide system and had worked on the system under supervision on only one occasion, which had been more than two years previously.

1.11.2 Certified Aircraft Technician who Inspected the Aircraft on the Ramp

The certified aircraft technician who inspected the aircraft on the ramp was an Air Canada employee who was licensed and endorsed on the Boeing 767-233. He received his initial training on the B767 in early 1990, and had not received any recurrent training since then. In addition, although not endorsed, he had worked on Boeing 747, Lockheed L1011, and McDonnell Douglas DC-9. He had not seen an integrator in about four years; however, he had worked on the off-wing slide system a few times many years ago.

1.11.3 Ramp Maintenance Supervisor

The ramp maintenance supervisor was a certified aircraft technician employed by Air Canada. He was filling the position of acting mobile foreman the morning of the incident, when he was called in to carry out the duties of the ramp maintenance supervisor. He had only taken the position for a few minutes when the flight 899 snag arose. Although endorsed for the Boeing 767, he did not have much experience with the aircraft or the off-wing slide system. He was not aware of what was required to release the aircraft in accordance with the MEL.

2.0 Analysis

2.1 Introduction

The separation of the off-wing slide during the approach into Vancouver was caused by an undetected maintenance error as a result of a series of actions and inactions that took place in Toronto prior to the departure of flight 899. The analysis examines how these events interacted to culminate in a potentially dangerous in-flight incident.

2.2 Restoration of the Off-Wing Slide System

The breakdown in acceptable and standard maintenance practices began when the inflation bottle was disconnected with no formal record made of the fact to ensure that the bottle was reactivated before the aircraft was released for service. Continuity was lost when the morning-shift technician who had been briefed about the disconnection was subsequently assigned to work on another aircraft. Contributing to the consequence of this error was the lack of requirement for an adequate inspection of the area before the access panel was reinstalled. The aircraft was eventually dispatched on flight 899 in an unsafe condition: the right off-wing slide was inoperative and would not have been available had an emergency required the evacuation of the occupants through the right over-wing exits.

From the standpoint of the in-flight opening of the off-wing slide compartment, the more significant deviation began when the morning-shift certified aircraft technician did not install a new shear pin in the secondary lock, as required by the job ticket. Had the technician understood the operation of the off-wing slide system, he would have realized that the shear pin had to have been sheared during the inadvertent actuation and, therefore, replacement of the shear pin was mandatory. Even though the presence of the sheared shear pin fragments in position on the integrator gave the false impression that the pin was intact, the morning-shift technician's decision not to replace the shear pin as required was influenced primarily by the lack of a replacement close at hand. Since the aircraft was already late, pressure to expedite the release of the aircraft possibly influenced the technician in his decision to certify on the job ticket that the shear pin had been replaced when it had not.

The shear pin problem would have been detected had the integrator been manually cycled, as called for by the 767 airplane Maintenance Manual procedures for replacement of the latch actuator.

2.3 Door Warning Inspection

The certified aircraft technician who was sent on the ramp to inspect the right off-wing slide compartment door had virtually no experience with this system and had retained limited knowledge of it from his endorsement course four years previously. The technician's unfamiliarity with the slide system and the history of inadvertent deployments reinforced his apprehension about handling anything associated with the slides for fear of an inadvertent deployment that might result in personal injury and equipment damage, or delays in aircraft operations. As a result, the inspection on the ramp was cursory and inadequate to ensure that the door warning was false, the premise under which the aircraft was released.

2.4 Minimum Equipment List Inspection Requirements

Although the ramp technician and the ramp maintenance supervisor knew that a detailed inspection was mandatory before the aircraft could be released, this inspection was not done. The complete actuation of the integrator as called for in the MEL inspection would have allowed detection of the sheared pin. The fact that maintenance activity had just taken place on the slide system should have raised greater concern about a potential problem. However, the MEL inspection was not followed; instead, an informal procedure was conducted which allowed the sheared condition of the pin to remain undetected.

Although the flight crew had no knowledge that the MEL inspection requirements were not carried out by maintenance, they did know that the requirement to placard the warning light and make a log-book entry was not met. They accepted the aircraft as airworthy based on a verbal release from maintenance, which again was a deviation from the required formal procedures.

2.5 Door Warning and Opening

The sheared shear pin allowed the secondary lock latch lever to rotate out of position and the latch shaft to migrate out of position towards the unlatched position, likely due to vibration. At the first movement, the proximity switches that monitor the system triggered the warning lights and the EICAS message during de-icing of the aircraft prior to departure. The warnings temporarily disappeared when the ramp technician handled the system during inspection, but the primary cause was not resolved.

Some of the previous incidents of off-wing slide compartment door opening in flight occurred during approach. It is likely that the off-wing compartment door became unlocked due to vibration and opened due to aerodynamic and inertial loads during approach. The slide did not inflate, but simply unfurled and tore away.

3.0 Conclusions

3.1 Findings

1. The right off-wing slide compartment door and spoiler squib were inadvertently activated during the return-to-normal procedure after an "A" check.
2. The right off-wing slide inflation trigger was disconnected during the actuator replacement, and was unintentionally not reconnected.
3. Because the inflation cylinder was disconnected, the right off-wing slide was unserviceable for flight 899.
4. The shear pin in the secondary lock sheared during the inadvertent actuation, and was not replaced during restoration of the system as required by the job ticket.
5. The sheared condition of the pin allowed the latch shaft to migrate to the unlatched position, likely as a result of vibration.
6. In response to the door warning light and the EICAS alert message, an informal inspection, which did not include the items listed for the MEL inspection, was done on the right off-wing slide compartment door.
7. The sheared condition of the pin remained undetected as a result of the MEL inspection not being completed.
8. The aircraft was released for the flight under the authority of the MEL, even though the MEL inspection had not been completed.
9. The flight crew accepted the aircraft without the required placard and log-book entry.
10. The maintenance personnel who were directly involved with this incident had inadequate experience and knowledge of the system.

3.2 Causes

The right off-wing slide compartment door opened in flight because the secondary lock shear-pin had been inadvertently sheared during recent inspection; this maintenance error remained undetected because existing required inspection procedures had not been followed. Contributing to the deviations from formal standard practices was inadequate understanding of the system on the part of the maintenance technicians and supervisor.

4.0 Safety Action

4.1 Action Taken

4.1.1 Action by the Operator

Subsequent to this occurrence, Air Canada took the following actions:

• to confirm the integrity of the secondary lock shear pin, the MEL was revised to require turning one end of the pin while observing the other end; also, a once-around check is underway to ensure that five spare shear pins are stowed at the integrator on each side of the aircraft;
• "A" Check Job Tickets were changed so that the off-wing door is no longer deactivated during an "A" Check and a warning sign is placed over the interior of the door to reduce the possibility of inadvertent over-wing slide deployment; and
• maintenance procedures for the door indication system were revised, and two projects are in the approval process (Service Bulletin (SB) 25A0131 to replace the integrator, and SB 25-0212 to improve the off-wing slide arm/disarm mechanism).

4.1.2 Action by Aircraft Manufacturer

Boeing has released Service Bulletins 767-25-0051, 767-25A0104, and 767-25-0185 to provide more direct verification of slide door latching, and to improve the integrator locking and latching mechanism.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson John W. Stants, and members Zita Brunet and Maurice Harquail, authorized the release of this report on 28 February 1996.

Appendix A - Glossary

ATPL - Airline Transport Pilot Licence
EDT - eastern daylight saving time
EICAS - engine indication and crew alerting system
hr - hour(s)
kg - kilogram(s)
MEL - Minimum Equipment List
PDT - Pacific daylight saving time
SB - service bulletin
TSB - Transportation Safety Board of Canada
UTC - Coordinated Universal Time
' minute(s)
'' second(s)
· degree(s)

<1>All times are EDT (Coordinated Universal Time [UTC] minus four hours) unless otherwise stated.