Description

On 28 February 2018, the crew of an Airbus A320 (ES-SAN) being operated by SmartLynx Airlines Estonia on a circuit training detail at Tallinn for new-to-type pilots in day VMC lost normal pitch control of the aircraft when attempting to take off to complete the ‘touch and go’ initiation of a further circuit. The aircraft settled back onto the runway damaging both engines before becoming airborne again. Another descent led to an EGPWS ‘PULL UP’ warning and after the Training Captain had recovered control, the Safety Pilot took over from the Student to assist and a ‘MAYDAY’ was declared. The aircraft was positioned to land back in the reciprocal direction of the departure runway but when both engines failed on finals, an undershoot landing followed. This resulted in two of the seven crew members on board sustaining minor injuries and was followed by an emergency evacuation. Extensive damage to the aircraft meant that it was subsequently declared a hull loss.

Investigation

An Investigation was carried out by the Estonian Safety Investigation Bureau. The FDR and CVR were recovered from the aircraft and both provided useful data. However, both recordings had been interrupted when the engines failed, the CVR recording restarting after the RAT had automatically deployed and both FDR and CVR powered up when the APU was subsequently started. Useful data were also recovered from the Non Volatile Memory (NVM) of on-board computers relevant to pitch control commands.

At the time when the loss of pitch control occurred, the 63 year-old Training Captain who had a total of 24,046 flying hours including 13,500 hours on type was acting as PM and supervising a 43 year-old Student Pilot who had a total of 228 flying hours, none of which were recorded as on type. A 34 year-old Safety Pilot who was occupying the supernumerary crew seat and had a total of 3,024 flying hours of which 2,622 hours were on type subsequently took over from the Student for the remainder of the flight.

What happened

The aircraft involved had only recently been acquired by the operator and on the day of the accident, it was being used for crew training during which each of the four Student Pilots on board were to fly a takeoff, five touch-and-go’s, one go around and a full stop landing from the right seat. An Inspector from the Estonian CAA (ECAA) was occupying a second supernumerary seat behind the Safety Pilot and the Student Pilots waiting their turn or after completing it were seated in the passenger cabin. The duration of the intended training, which was using the 3048 metre-long runway 08, was likely to be in excess of 5 hours.

The Training Captain decided not to arm the ground spoilers for each planned touch and go and after each touchdown, he used the procedure in the Airbus Flight Crew Training Manual (FCTM) to set the Trimmable Horizontal Stabiliser (THS) at the takeoff position. This involved adjusting the trim setting by grabbing the trim wheel while the THS was automatically returning to 0°. During the first student’s flying session, two of these touch-and-go sequences were accompanied by Elevator Aileron Computer (ELAC) PITCH FAULTs for both elevator aileron computers (ELAC) as the trim wheel was being manually held at “around 1° Nose Up” resulting in Normal Law flight control switching to Alternate Law. However, ELAC PITCH FAULTs on the ground don’t appear on the ECAM until the aircraft reaches 1500 feet, at which point, both ELACs were reset in accordance with Airbus procedures and this restored Normal Law flight control.

During the second student’s session, only a single ELAC1 PITCH FAULT was triggered at the same point in the THS reset operation and because only one ELAC fault was registered, Normal Law flight control was not interrupted. During the third student’s session, ELAC1 PITCH FAULTs were again registered, this time during the first and third touch-and-go cycles when faults were triggered and reset once they were annunciated on the ECAM at 1500 feet. A further similar fault was then triggered during the fourth touch-and-go but this time the single chime alert which the appearance of this message on the ECAM should (as it had previously) lead to did not occur. Probably because of this, the fault condition was not reset when it was annunciated on the ECAM on reaching 1500 feet and thereafter it remained until the end of the whole flight detail i.e. it was present when the accident occurred. The fifth and last touch and go for the third student was then accompanied by an ELAC2 PITCH FAULT which, given the existing ELAC1 fault meant reversion to Alternate Law flight control until the ELAC2 PITCH FAULT appeared on the ECAM at 1500 feet and was reset.

During the fourth student’s training session, the second touch-and-go was accompanied by an ELAC2 PITCH FAULT triggered as before during the THS reset, this time whilst the trim heel was being manually held at around 1.5° nose up. Reversion to Alternate Law flight control again occurred until a reset was performed on reaching 1500 feet. The next (third) touch-and-go again triggered an ELAC2 PITCH FAULT but although reversion to Alternate Law occurred, it lasted (unknown to the flight crew) only one second. As VR was reached, the student initiated rotation by pulling back on the sidestick and by moving the thrust levers to the TOGA detent but the aircraft did not respond. An ECAM message ‘F/CTL L+R ELEV FAULT‘ appeared accompanied by a ‘MAN PITCH TRIM ONLY’ on the PFDs and the corresponding continuous repetitive warning chime. This alert was not noticed by the fight crew given their focus on regaining control over pitch attitude.

The student continued to pull back on the sidestick - up to 13° nose up - but to little effect and the airspeed increased. FDR data subsequently showed that both elevators were at 0° and the THS was at only 1.5° nose up. At 152 knots, the aircraft began to lift off but a pitch attitude of only 0.3° nose up was recorded despite the student’s sidestick being close to full back deflection. As the Training Captain also began to pull back on his sidestick, the dual input aural warning was triggered which prompted him to select priority on his sidestick and call ‘I have control’. The recorded pitch attitude was still only 0.3° nose up. Four seconds later, with approximately 950 metres of runway 08 remaining and with airspeed increasing through 190 knots, the aircraft was only 19 feet agl and the pitch attitude had reached a maximum of 2.8° nose up. The thrust levers were moved to IDLE and the flap lever was moved from CONF2 to CONF1 followed two seconds later by the Training Captain calling “gear up” upon which the gear lever was selected accordingly. Two seconds after that, the aircraft reached its maximum height over the runway of 48 feet and began to descend. Pitch attitude was back to only 0.3° nose up and the thrust levers were returned to the TOGA detent.

With the landing gear in transit, a forward speed of 192 knots and a 0.7° nose up pitch attitude, both engines hit the ground with the vertical acceleration of 2.85 g. About 200 metres of runway remained. Two seconds after this impact, airspeed increased to 206 knots, and with pitch attitude now at 9.1° nose up after the nose landing gear had also hit the runway hard, the aircraft began to climb away at 6000 fpm.

Ten seconds later, the aircraft reached its maximum positive pitch attitude of +21.8° and shortly afterwards the Safety Pilot called out “manual pitch trim only, manual pitch trim only” as annunciated on the PFDs. The Training Captain began to control pitch using the (stabiliser) pitch trim wheel and reducing thrust to Idle. After a further 15 seconds, the aircraft had reached a maximum height of 1590 feet with the speed now down to 144 knots (position 10 on the flight path reconstruction shown below). A rapid descent at 7,200 fpm began with the pitch attitude reaching 25.7° nose down before the thrust levers were moved back to TOGA and nose up trim wheel movement arrested the descent. This descent triggered several EGPWS activations including ‘SINK RATE’, ‘PULL UP’, ‘TERRAIN-TERRAIN’ and ‘TOO LOW, TERRAIN’ and the aircraft reached a minimum of 596 feet agl (position 11) as vertical acceleration peaked at +2.44 g during the recovery.

The Training Captain then managed to stabilise the aircraft at around 1,200ft (position 12) with airspeed at around 155 knots using sidestick roll inputs and trim and thrust inputs for pitch control. He asked about the engines and the Safety Pilot responded that there was an engine 2 fire. The Safety Pilot then began to read aloud from the ECAM display “so we have flaps lock, flight control law, left right elevator fault, maximum speed 320, manual pitch trim use, do not use speed brakes”.

For the next half a minute, the aircraft remained essentially under control again at around 1,300 feet with pitch attitude varying between -8°and +16° and averaging +5°. A MAYDAY call was made to ATC and the Training Captain proposed turning right, got it confirmed by the Safety Pilot, and declared this intention to ATC, advising that they intended to continue the right turn visually to begin an approach to the reciprocal direction of the runway. The Training Captain then instructed the Safety Pilot to take the place of the student and thereafter, the student and the ECAA Inspector went to sit in the passenger cabin with the other three students. The Safety Pilot called ATC to declare the engine two fire and requested RFFS attendance for the landing. He then suggested moving the engine 2 thrust lever to idle because of the fire but this was not agreed by the Training Captain who then called for “gear down”.

Whilst the gear was in transit, engine two failed at around 1000 feet agl and the ECAM message ‘ENG 2 FAIL’ appeared accompanied by a corresponding fire warning. Twenty seconds later, passing around 750 feet agl, engine one also failed removing all electrical power from the main bus bars and after a further half minute, the aircraft touched down hard in the runway 26 undershoot bursting all the tyres. It then continued for approximately 150 metres onto the runway before veering off to the left and coming to a stop close to the left runway edge. All occupants then evacuated via the forward left exit escape slide. Damage to the aircraft structure and to both engines was severe and later led to it being assessed as a hull loss.

The cause of the pitch control difficulty

The Investigation was able to show that the ‘ELAC PITCH FAULT’ messages had resulted from the intermittent failure of the THS actuator override mechanism and had been triggered by whichever computer had been in control (ELAC1 or ELAC2) when erratic signals came from the pitch trim actuator micro-switches. The incorrect triggering of these micro-switches was found to be attributable to “a non-standard displacement of the override mechanism output piston" which, in turn, had resulted from non-standard functioning of the override mechanism clutch unit which was considered likely to have been a consequence of the oil it contained being almost twice of the specified viscosity. However, it was not possible to establish how this oil had ended up in the THS.

During the final touch-and-go with ELAC 1 still not reset, the aircraft touchdown had been slightly bounced prior to the ELAC 2PITCH FAULT being triggered. The rebound from the first touch had then been enough to cause a discrepancy between the two Spoiler Elevator Computers (SEC) which had taken over pitch control from the two ELACs, with one seeking to control pitch based on ground mode and the other seeking to do so based on flight mode. This discrepancy then led to loss of elevator control by both SECs with the elevator position defaulting to neutral where it remained locked in position for the rest of the flight. Pitch variation using sidestick control of the THS was therefore impossible.

It was observed that the time taken for the flight crew to recognise that elevator control of pitch was no longer available had demonstrated “the importance of the role of a Safety Pilot when handling abnormal situations during flight training”.

Three Causal Factors which had led to the Accident were identified as follows:

• The intermittent THS actuator override mechanism malfunction which allowed both ELACs to lose pitch control:

The repetitive triggering of the ‘ELAC PITCH’ faults was caused by the non or late activations of the pitch trim actuator micro-switches, which were due to the insufficient stroke of the override mechanism piston. This insufficient stroke was caused by non-standard friction in the override clutch unit of the THS actuator which appeared to contain oil of a higher viscosity than that specified in the CMM. This higher viscosity oil might have been the cause of reduced friction in the THS actuator override clutch unit.

• A design flaw in the Spoiler Elevator Control (SEC) computers which allowed a single event - the temporary decompression of the left main landing gear - to cause the loss of pitch control by both of them:

The absence of ground spoilers arming for landing in the context of touch and go's training may have contributed to the temporary decompression of the left main landing gear.

• The Training Captain’s decision to continue the flight detail despite annunciation of repetitive ‘ELAC PITCH FAULT’ ECAM caution messages:

The lack of clear framework of operational rules for pilot training flights, especially concerning the application of the MEL and the specific nature of operations that caused pressure to complete the training programme may have impacted the crew decision-making process.

Seven Contributory Factors were also formally documented as follows:

• The SmartLynx Estonia Approved Training Organisation (ATO) does not clearly define the need for arming spoilers when performing touch-and-go training (these procedures are not in accordance with the Airbus SOP). The fact that there is no clear reference in the SmartLynx Estonia ATO Training Manual Touch-And-Go air exercise section to additional procedures that should be used, in combination with lack of understanding of the importance for arming the spoilers during this type of flight contributed to the Captain making the decision to disarm the spoilers during touch-and-go training enabling landing gear bounce on touchdown.
• At the time of the event, the Airbus QRH did not define the maximum allowed number of resets for the flight control computers.
• At the time of the event, the Airbus FCTM did not require to consider MEL on touch-and-go and stop-and-go training.
• The oil in the Trimmable Horizontal Stabiliser (THS) Override Mechanism (OVM) casing was of a higher viscosity than that defined in the CMM. This higher viscosity might have reduced the friction of the OVM clutch unit.
• The aircraft maintenance documentation does not require any test of the OVM during regular aircraft maintenance checks.
• The SmartLynx Estonia ATO OM does not clearly specify the role of a Safety Pilot on the flight deck. The lack of task sharing during the event caused ECAM warnings to go unnoticed and unannounced for long periods.
• The flight crew not resetting ELAC 1 when the ELAC 1 PITCH FAULT was displayed which led to degraded redundancy of the normal pitch control system.

The Investigation also concluded as follows in respect of the performance of the Training Captain and the Safety Pilot following the problems with pitch control:

Considering the remoteness of the loss of control of both elevators, there is no specific crew training for MECHANICAL BACKUP in pitch during approach, landing and takeoff. This condition of the aircraft occurred for the crew in a sudden manner at rotation and during a training flight, where the experienced Training Captain is not the PF and cannot get immediate feedback on the aircraft behaviour and condition. Despite these difficult conditions, the crew managed to stabilise and land the aircraft with no significant injury to the persons on board.

The crew performance factors that contributed to the safe landing of the aircraft are the following:

• The Training Captain followed the golden rule of airmanship (aviate, navigate, communicate), by stabilising the aircraft pitch by using the trim wheel and by keeping the aircraft engine power as long as possible.
• The Safety Pilot started to play a role in the cockpit by assisting the Training Captain and the Student Pilot by informing them about the status of the aircraft and later took over as PM.

Safety Action taken as a result of the investigated accident was noted as having included but not been limited to the following:

Airbus has:

• Modified the “touch and go” and “stop and go” training procedures in Airbus A320 FCTM.
• Restricted the extent to which ELAC reset can be performed during otherwise normal operations and has initiated development of an ELAC software modification to monitor the THS as it is reset to neutral beginning 5 seconds after touchdown so as to mitigate the consequences of a non-detection of a manual takeover of the THS (the failure that caused the triggering of the ELAC PITCH FAULT). The certification of this change as a global retrofit is planned for mid-2020.
• Initiated development of a Spoiler Elevator Computer (SEC) software modification development to improve SEC robustness against landing gear bounce at touchdown with certification planned for the next SEC modification standard.

SmartLynx Estonia has made a number of changes to parts of their Approved Training Organisation OM including those dealing with:

• The Approval/Authorisation of Flight Training on an aircraft.
• The duties and responsibilities of an aircraft Commander both before and during flight.
• Flight Time Limitations applicable to Student Pilots undergoing flight training on aircraft which will be more restrictive than those which apply to line flying once qualified.

Five Safety Recommendations were made as a result of the Investigation as follows:

• that Airbus consider amending A320 maintenance program with procedures necessary to ensure that the condition override mechanism in the Trimmable Horizontal Stabiliser (THM) override clutch unit is kept as per design throughout its whole life cycle.
• that the SmartLynx Estonia ATO includes procedures clearly defining the role and the tasks of a Safety Pilot.
• that the SmartLynx Estonia ATO modifies its Training Manual so that its touch-and-go procedures match those in the corresponding Airbus’ Flight Crew Training Procedures.
• that All Aviation Safety Agencies ensure the compliance of Training Manual procedures for touch-and-go training at ATOs under their oversight which perform Airbus A320 type rating training with those in the corresponding Airbus’ Flight Crew Training Procedures.
• that All Aviation Safety Agencies promote the use of a Safety Pilot when performing flight training on complex aircraft.

The Final Report was published on 31 October 2019.

Related Articles

• Loss of Control
• Safety Pilot
• Trimmable Horizontal Stabiliser
• Electronic Centralized Aircraft Monitor (ECAM)