If you wish to contribute or participate in the discussions about articles you are invited to join SKYbrary as a registered user
AT76, en route, west-southwest of Sydney Australia, 2014
From SKYbrary Wiki
|On 20 February 2014, the mishandling of an ATR 72-600 during descent to Sydney involving opposite control inputs caused an elevator disconnect and a serious cabin crew injury. After recovery of control, the flight was without further event. Post flight inspection did not discover serious structural damage caused to the aircraft and it remained in service for a further five days. The complex Investigation took over five years and examined both the seriously flawed flight crew performance and the serious continued airworthiness failures. Despite extensive safety action in the meantime, the concluding report still made five type airworthiness-related safety recommendations.|
|Actual or Potential
|Airworthiness, Human Factors, Loss of Control|
|Type of Flight||Public Transport (Passenger)|
|Origin||Canberra International Airport|
|Intended Destination||Sydney Airport|
|Take off Commenced||Yes|
|ENR / APR|
|Origin||Canberra International Airport|
|Tag(s)||PIC less than 500 hours in Command on Type|
Procedural non compliance,
Dual Sidestick Input
|Tag(s)||Non-normal FBW flight control status,|
Temporary Control Loss,
Aircraft Flight Path Control Error
|Tag(s)||Low Level Windshear|
|Tag(s)||Turbulence Injury - Cabin Crew|
|Contributor(s)||Inadequate Maintenance Inspection,|
Dispatch of Unserviceable Aircraft
|Damage or injury||Yes|
|Causal Factor Group(s)|
On 20 February 2014, the crew of an ATR 72-600 (VH-FVR) being operated by Skywest Airlines for Virgin Australia Regional Airlines on a scheduled passenger flight from Canberra to Sydney as VA657 experienced an in-flight upset during descent in day VMC involving a pitch control disconnect and serious injury to the senior member of the cabin crew. Following recovery, the remainder of the flight was without further event but after flight, extensive structural damage to the aircraft was not discovered and it continued in service operating 13 flights over five days before being grounded for major repairs.
An Investigation into the Accident was carried out by the Australian Transport Safety Bureau (ATSB). Initially, it was planned as a shortened investigation but when the extent of the structural damage caused was subsequently advised, it was upgraded to a major investigation. Relevant FDR and CVR data were successfully downloaded and used in the Investigation and equivalent QAR data was made available to the aircraft manufacturer. It took over five years to complete what turned out to be a very complex Investigation which after examining the immediate issues of flight crew performance and continuing airworthiness issues then disclosed contextual airworthiness issues in relation to the aircraft type and, potentially, into general type certification processes. During the Investigation, a Preliminary Report was published on 10 June 2014, and two Interim Reports were published, the first on 15 June 2016 and the second on 5 May 2017.
The Captain had a total of 3,453 hours flying experience almost all of which (2,929 hours) had been gained whilst employed as a pilot operating unspecified aircraft types in the Australian military. The remainder of his experience had all been on the ATR72 having joined Skywest Airlines as a direct entry Captain on the ATR72 and being released for unsupervised line flying on the ATR-72-500 eleven months prior to the accident. After Skywest Airlines had become wholly owned by Virgin Australia Regional Airlines later in 2013 (although continuing operations under its own AOC), he had undertaken the ATR72-600 differences course in August 2013. His civil flying experience at the time of the accident was made up of 241 hours on the ATR72-600 and 282 hours on the ATR72-500.
The First Officer had a total of 3,816 hours flying experience of which 3,072 hours was on the ATR72 made up of 583 hours on the ATR72-600, 1,607 hours on the ATR72-500 and 882 hours on the ATR72-100/200/210. He had joined Skywest Airlines in April 2012 having already gained 3,046 hours flying experience which had included 686 hours as an ATR42/72 Captain. On joining Skywest, he had initially operated on the ATR72-500 bur had then completed the ATR72-600 differences course. It was noted that “throughout the First Officer’s training records there were notes indicating that he had good aircraft handling/flying skills and situation awareness”.
What Happened on the Flight
It was established that the First Officer had been PF and noted that from about 10,600 feet during the descent towards Sydney there had been “operationally non-pertinent conversation” between the pilots initiated primarily by the Captain. During this conversation, the First Officer was attempting to maintain the target airspeed of 235 KIAS with the AP engaged in VS mode. After he had begun to slowly increase power to correct a decrease in speed below the target, it had then, without any concurrent change in power or pitch increased from 228 KIAS to 237 KIAS over about 13 seconds and in response the First Officer reduced power. Initially, this had the desired effect but when the speed started to increase again, he reduced the power to flight idle.
When the aircraft was at about 8,500 feet, the Captain stopped his “non-pertinent conversation” and soon afterwards, the First Officer used the control wheel steering (CWS) facility to de-clutch the AP and manually raise the aircraft nose expecting that this would help arrest the speed trend. This was initially successful, but when he returned the control column to neutral, the airspeed started to increase again so he repeated the process but with a larger control input. At the same time, the CVR recorded the Captain telling the First Officer to “grab it”. The effect of the second CWS intervention was the same as the first and the Captain, who stated that he had been unsure that the First Officer’s actions were sufficient to avoid exceeding Vmo, and “decided to take control”. Without announcing this intention, he then disconnected the AP and made a nose-up control input whilst almost simultaneously instructed the First Officer to “pull it up”,
The First Officer responded by making another slightly larger nose-up control input so that both pilots were simultaneously making nose-up control inputs. The First Officer then “eased off on his input in a manner and timing consistent with his two previous control inputs” but the Captain continued his. As the aircraft pitch and vertical acceleration increased, the First Officer, unaware of the Captain’s intervention, immediately reversed his control input to nose down. FDR data showed that as this input was made, “the left and right elevators stopped moving in unison and rapidly moved in opposite directions”. The Captain’s control column moved slightly further back before quickly returning to a neutral position as the First Officer’s moved to a full forward position and the master warning was activated. The First Officer then returned his control to neutral, reporting that the airspeed trend indication had been “off the chart” and that he believed Vmo had been exceeded.
A Master Warning and a series of system status warnings were annunciated and about 2 seconds later, the Captain announced that he had control and the First Officer acknowledged this by releasing his control column. Both pilots then reported noticing that “the controls suddenly felt different and ‘spongy’". The First Officer then announced that the Master Warning had activated due to a pitch disconnect. The crew “verified that the aircraft was under control at a stable attitude and speed” and noted that it was more of less at about 230 KIAS. The Captain asked for the selected speed to be set to 200 knots but as they then actioned the pitch disconnect procedure, noted it required a maximum speed of 180 knots so the selected speed was reduced to 170 knots. About 1½ minutes after the pitch disconnect, the junior cabin crew contacted the flight crew to advise that the SCCM had been injured and couldn’t feel her leg. The AP was re-engaged shortly after this and remained engaged until manually disengaged at about 2,400 ft during the approach to land. The SCCM then spoke personally with the Captain by interphone and reported that “while waiting for a passenger to return to their seat, she was thrown from her seat and believed that her leg was broken”. The crew responded by declaring a ‘PAN’ and requesting an ambulance to meet the flight and the remainder of the fight was without further event.
FDR data showed that there had been no atmospheric turbulence prior to crew intervention but that there had been an encounter with windshear which had been the cause of the difficulty maintaining the target descent speed during automatic flight in VS mode.
It was subsequently confirmed that the control disconnect had occurred as per the system design when apparently “jammed controls” were detected. At disconnect, vertical acceleration was increasing through +2.8g to reach a maximum of 3.34g one second later and aircraft pitch attitude was increasing. FDR data showed peak elevator deflections of +10.4° and -9.3° the time of the pitch disconnect. During the disconnect, the aircraft pitch attitude changed from about 4.5º nose down to about 9º nose up. CVR data showed that the first verbal indication of flight crew awareness that a pitch disconnect had occurred was about 6 seconds after the master warning caused by it had activated.
After flight, the Captain made a Technical Log defect entry of “pitch disconnect in flight” but when one of the attending engineers from the station maintenance contractor for all Virgin Regional Airlines operators at Sydney told him that a maximum of 3.43 g had been recorded around the time of the disconnect, he added “associated with moderate turbulence”. He then called the Duty Pilot to report that “turbulence during the flight had resulted in a pitch disconnect and an injury to one of the cabin crew”.
The Post-Flight Inspection and Continued Operation
Although no finding of an overspeed was made, as a result of the recorded vertical acceleration being outside limits, the aircraft was grounded pending an appropriate engineering inspection. This was identified as the “Inspection after flight in turbulence and/or exceeding VMO”. This was commenced the same day and completed the following day with no defects found and the aircraft was released to service.
It then operated a further 13 flights over five days during which respective flight crews did not record any airworthiness findings during their pre-flight inspections or report any abnormal aircraft handling characteristics. Each day, a routine maintenance check which included a visual inspection of the aircraft during a ‘walk-around’ at ground level was carried out at Sydney by the maintenance contractor. On 25 February, the aircraft operated a scheduled passenger flight from Sydney to Albury and on descent into Albury it passed sufficiently close to birds to alert the Captain to the possibility of a bird strike on the left side of the aircraft.
Although there were no in-flight indications that a bird had struck the aircraft, after landing the Captain “noticed the aircraft’s pitch trim system fluctuated abnormally”. He then carried out an external inspection and although he found no evidence of any bird strike on the left side of the aircraft, he did notice a dent in the upper leading edge of the vertical stabiliser and reported this to Maintenance Control who arranged for an engineer from Sydney to travel to Albury. On arrival, the engineer used scissor lift equipment to access and inspect the stabiliser and found “indications of significant structural damage to the horizontal stabiliser” with no indication that they might have resulted from a bird strike. It was concluded that the damage found was probably a consequence of the upset event five days earlier.
The full extent of the significant structural damage to the horizontal stabiliser to the aircraft was finally documented after ATSB Investigators assisted by ATR representatives had made a comprehensive examination of it. This included:
- external damage to both the left and right horizontal stabilisers
- fracture of the composite structure around the rear horizontal-to-vertical stabiliser attachment points
- fracture of the front spar web
- cracking of the horizontal-to-vertical stabiliser attachment support ribs
- cracking of the attachment support structure
- cracking and delamination of the skin panels at the rear spar
Following these findings, ATR required that both the horizontal and vertical stabilisers should be replaced before release for any further flight.
An analysis by ATR based on data from the QAR showed that at the point of control disconnect, the Ultimate Load on the horizontal stabiliser had been very briefly exceeded by almost 50%. It also showed that the Limit Loads for the vertical load on the horizontal stabiliser, the asymmetric moment on the horizontal stabiliser, the bending moment on the wing and the engine mounts had all been exceeded and that the vertical load on the wing had been reached.
The Investigation looked in detail at both the operational and airworthiness aspects of the event and found that some had implications for other operators of ATR 42/72 aircraft. Whilst addressing the direct causes of both the upset and the flawed initial maintenance response proved to be relatively straightforward, the systemic airworthiness findings turned out to be more complex and considerably extended the Investigation.
The formally documented Findings of the Investigation were subdivided into those related to the flight in which the damage to the aircraft was caused and the subsequent inspection and continued operation of the aircraft when it was not airworthy.
(A) In-flight upset and pitch disconnect
- During the descent, when the sterile flight deck policy was applicable, the flight crew engaged in non-pertinent conversation. This distracted the crew and probably reduced their ability to monitor and respond to fluctuations of airspeed.
- While passing through about 8,500 feet on descent into Sydney, the aircraft encountered a significant windshear that resulted in a rapidly decreasing tailwind. This led to a rapid increase in the airspeed, with the airspeed trend vector likely indicating well above the maximum operating speed (Vmo).
- Although the First Officer as Pilot Flying was in the process of attempting to control the airspeed, in response to the unexpectedly high airspeed trend indication and their proximity to Vmo, the Captain perceived a need to immediately intervene and made pitch control inputs before following the normal take-over procedure and alerting the First Officer.
- The addition of the Captain’s and First Officer’s nose-up control inputs resulted in a pitching manoeuvre that exceeded the limit load factor for the aircraft of 2.5 g.
- The magnitude of the Captain's nose-up control input was probably greater than he intended due to his response to a high stress level, but increased the probability that the aircraft's limit load factor would be exceeded.
- Shortly after the Captain had initiated nose-up control inputs, the First Officer reversed his control input. The differential forces in the left (Captain) and right (First Officer) pitch control systems were sufficiently large to inadvertently activate the pitch uncoupling mechanism, disconnecting the left and right pitch control systems.
- Given the high airspeed, the asymmetric elevator deflections that occurred immediately following the pitch disconnect event resulted in aerodynamic loads on the tailplane that exceeded its strength and damaged the horizontal stabiliser.
- The design of the ATR 72 pitch control system resulted in limited tactile feedback between the left and right control columns, reducing the ability of one pilot to detect that the other pilot is making control inputs. In addition, there were no visual or auditory systems to indicate dual control inputs. [Safety Issue AO-2014-032-SI-03]
Other Factors that increased risk:
- Inadvertent application of opposing pitch control inputs by flight crew on ATR aircraft can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react. [Safety Issue AO-2014-032-SI-01]
- The aircraft manufacturer did not account for the transient elevator deflections that occur as a result of the system flexibility and control column input during a pitch disconnect event at all speeds within the flight envelope. As such, there is no assurance that the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect. [Safety Issue AO-2014-032-SI-02]
- Flexibility in the ATR 72’s pitch control system between the control columns results in a change in the aircraft’s longitudinal handling qualities and control dynamics when dual control inputs are made. This could result in an aircraft-pilot coupling event where flight crew may find it difficult to control the aircraft. [Safety Issue AO-2014-032-SI-04]
- The design standard for large transport aircraft, Joint Aviation Requirements - Part 25 (JAR-25), did not require that the demonstrated potential for flexibility in the control system to develop transient dynamic loads, be considered during certification. Similarly, the current certification standard for Large Aeroplanes (CS-25) does not address this issue. [Safety Issue AO-2014-032-SI-05]
- Although the design standard for the aircraft (JAR-25) required the control system to be of sufficient strength to withstand dual control inputs, it did not require consideration of the effect that dual control inputs may have on control of the aircraft. Similarly, the current design standard (CS-25) does not address this issue. [Safety Issue AO-2014-032-SI-06]
- The pitch disconnect warning system in the ATR 72 did not alert the flight crew to the pitch disconnect until after the resulting aerodynamic loads had exceeded the strength of the horizontal stabiliser.
- The aircraft manufacturer and aircraft operator provided limited guidance to flight crew regarding the management of airspeed on descent and appropriate handling for recovery from an imminent Vmo exceedance.
- The Senior Member of the Cabin Crew received serious injuries as a result of the recovery manoeuvre from the in-flight upset.
(B) Inspection and continued operation
- The licensed aircraft maintenance engineers involved in the Inspection after flight in turbulence and/or exceeding Vmo did not carry out the specified general visual inspection of the stabilisers probably because of a breakdown in the coordination and certification of the inspection tasks. As a result, the damage was not detected and the aircraft was released to service.
Other factors that increased risk:
- The aircraft manufacturer, ATR, did not provide a maintenance inspection to specifically assess the effect of an in-flight pitch disconnect on the structural integrity of the horizontal stabilisers. As a result, if an in-flight pitch disconnect occurred, the aircraft may not be inspected at a level commensurate with the criticality of the event. [Safety Issue AO-2014-032-SI-07]
- As a legacy of there being no inspection specific to an in-flight pitch disconnect, there is potential for other ATR aircraft to have sustained an in-flight pitch disconnect in the past and be operating with undetected horizontal stabiliser damage. [Safety Issue AO-2014-032-SI-08]
- In the Job Instruction Card (JIC) 05-51-11 ‘DVI inspection after flight in turbulence and/or exceeding Vmo’, the aircraft manufacturer did not specify the ground support equipment required or clearly state that the General Visual Inspection (GVI) of the stabilisers included a close examination of the upper surface. Given engineers tasked with the inspection may not be aware that ATR referred to the standard definition of a GVI, there was a risk that engineers tasked with the inspection would not interpret the card correctly.
- Toll Aviation Engineering (the responsible MRO (maintenance, repair and overhaul company)) did not define, document, or otherwise assure the intended arrangements for coordination of maintenance at line maintenance stations, which allowed for the development of local operating practices that were not consistent with the expectations of MRO management.
Although Toll Aviation Engineering had specified fatigue management procedures, the Licensed Aircraft Maintenance Engineers (LAMEs) who were involved in the inspection after flight in turbulence and/or exceeding Vmo operated outside the nominated hours of work. As such, the LAMEs were at risk of fatigue on the day of the inspection and/or the day following.
- Maintenance engineers carried out line maintenance and flight crew carried out pre-flight inspections in the 5 days after the in-flight upset and inadvertent pitch disconnect without detecting the damage to the tailplane.
- The Captain of the thirteenth flight of VH-FVR since the flight control event that caused the damage was diligent in their post-flight inspection of the aircraft following a suspected bird strike and having detected some damage to the tailplane prompted an effective engineering examination that identified the serious structural damage.
Safety Action known to have been taken by ATR as a result of the event whilst the Investigation was in progress was noted to have included but not been limited to the following in respect of all ATR42/72 aircraft:
- In September 2015, they issued a new Job Instruction Card (JIC) in respect of the DVI which must be completed following an in-flight pitch disconnect. This specifies the use of an access platform to remove panels and conduct a detailed visual inspection of the tailplane attachment fittings and structural components. They also revised an existing JIC dealing with the inspection required after any in service uncoupling of the pilots’ pitch control systems
- In February 2016, they released an AOM informing operators of ATR 42/72 aircraft of revised maintenance and operational documentation relating to the pitch control system and pitch disconnect occurrences.
- In July 2016, they issued an AOM advising operators of stabiliser damage found during a scheduled maintenance check on another aircraft which might be related to aircraft use beyond normal operation limitations (including but not limited to the combination of in-flight dual inputs, a pitch disconnect and large opposite elevator deflection at high speed). This recommended that all ATR42/72 operators perform a one-time inspection of the horizontal to vertical stabiliser junction as per the instructions provided in the applicable extant SBs not later than six months from the AOM release date.
A total of six Safety Recommendations were issued during the course of the Investigation as a result of its Findings as follows:
On 5 May 2017:
- that ATR complete the assessment of transient elevator deflections associated with a pitch disconnect as soon as possible to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that ATR take immediate action to ensure the ongoing safe operation of ATR42/72 aircraft. [AO-2014-032-SR-014]
- that The European Union Aviation Safety Agency (EASA) monitor and review ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that the EASA take immediate action to ensure the ongoing safe operation of ATR42/72 aircraft. [AO-2014-032-SR-015]
- that The Civil Aviation Safety Authority (CASA) review ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect, to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that CASA take immediate action to ensure the ongoing safe operation of Australian-registered ATR42/72 aircraft. [AO-2014-032-SR-016]
On 24 May 2019:
- that ATR assess the operational risk associated with limited tactile feedback between left and right control columns in the context of no visual or auditory systems to indicate dual control inputs. [AO-2014-032-SR-057]
- that ATR perform a detailed review of the effects of dual control inputs on the aircraft’s longitudinal handling qualities and control dynamics to determine if there are any detrimental effects that could lead to difficulty in controlling the aircraft throughout the approved flight envelope and operational range. Any issues identified should be appropriately dealt with. [AO-2014-032-SR-058]
- that The European Union Aviation Safety Agency (EASA) take further action to review the current design standard (CS-25) in consideration of effect that dual control inputs may have on control of aircraft. [AO-2014-032-SR-054]
The following ‘Safety Message’ was formally documented upon completion of the Investigation:
- This occurrence was a complex event with a number of safety factors and issues identified in different domains. As such, stakeholders should study the parts of the report that are relevant to their domain and consider the applicable safety implications. The ATSB draws attention to the following:
- From an operational perspective, the event shows how a flight crew whose intention was to keep the aircraft within the prescribed limitations, can inadvertently expose the aircraft to a higher level of risk. When taking action to address potential aircraft exceedances, flight crew should consider the serious consequence of applying aggressive or large control inputs at high speed relative to the risk posed by the exceedance. Flight crew should also adhere to sterile cockpit procedures to optimise their performance in the higher risk phases of flight and apply the handover/takeover procedures to ensure dual control inputs are avoided or coordinated to maintain effective control.
- In terms of continuing airworthiness, the conduct of an inspection may be the sole opportunity to detect aircraft damage. As such, to avoid a single point failure it is imperative that the form of the inspection be fit-for-purpose and for inspections to be effectively coordinated and certified.
- For aircraft manufacturers and airworthiness authorities, there can be unforeseen consequences of aircraft design characteristics. It is important that when identified, these are recognised and addressed during operational service of the aircraft type.
The Final Report of the Investigation was published on 24 May 2019.