First interim report - published: 15 June 2016
On 20 February 2014, a Virgin Australia Regional Airlines (VARA) ATR 72 aircraft, registered VH‑FVR, operating on a scheduled passenger flight from Canberra, Australian Capital Territory to Sydney, New South Wales sustained a pitch disconnect while on descent into Sydney. The aircraft was significantly damaged during the occurrence.
In accordance with the Transport Safety Investigation Act 2003, the ATSB initiated an investigation into the occurrence. Although the investigation is not yet complete and covers a range of areas, a safety issue has been identified that, in the interests of safety, needs to be brought to the attention of the industry before the investigation is completed. This interim report provides only the factual information and analysis associated with the identified safety issue.
This interim report complements information already provided on an update on the ATSB website on 10 June 2014. It is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the ongoing investigation of the occurrence. Readers are cautioned that new evidence may become available as the investigation progresses that will enhance the ATSB’s understanding of the occurrence.
The flight departed Canberra at 1612 Eastern Daylight-saving Time with the first officer (FO) as the pilot flying. A steeper-than-usual climb was carried out to reduce exposure to turbulence. However, other than the expected turbulence during the first 1,500 ft, there was nothing significant during the climb to flight level (FL) 170.
During cruise, the crew conducted a routine brief for the anticipated arrival to runway 16 Right, which was expected to be standard except for commencement of descent 5 NM (9 km) earlier than normal to compensate for a tailwind. The captain noted the need to be cognisant of managing airspeed during the descent as the anticipated decreasing tailwind would result in a temporary increase in the indicated airspeed.
The FO commenced descent into Sydney with the autopilot engaged in vertical speed mode and a target airspeed of 235 kt (15 kt less than the maximum operating speed of 250 kt). The descent was reported to have been initially stable and smooth.
On first contact with Sydney Approach the crew were assigned runway 16 Left. This was different to the expected runway and required the crew to re‑brief the approach and change the instrument approach diagrams and navigational aid frequencies.
Passing 8,500 ft above mean sea level (AMSL), the crew noticed a rapid airspeed increase. The FO reported that the airspeed trend indicator was ‘off the chart’, indicating a very rapid increase in airspeed. The FO reduced engine power and used touch control steering to temporarily disconnect the autopilot before manually raising the aircraft’s nose to control the speed. The FO expected that, in combination, the pitch correction and power reduction would be sufficient to arrest the speed trend.
The FO reported that the aircraft felt ‘heavy’, as was normal for this aircraft at that speed, requiring two hands on the controls to move from the then -4° pitch angle. 
The captain reported being unsure if the FO’s control inputs would be sufficient to avoid exceeding the maximum operating speed limitation, so put one of his hands on the controls and disconnected the autopilot to raise the nose further.
Shortly after, with both flight crew making simultaneous nose up pitch inputs on the controls, the aircraft rapidly pitched up with an associated increase in the g load. The FO responded by immediately reversing the control input to nose down. Both flight crew noticed that the controls suddenly felt different and ‘spongy’. At about the same time, aural and visual cockpit warnings activated. The crew verified that the aircraft was under control at a stable attitude and speed, observing that it was level or in a slight descent at an airspeed of about 230 kt.
One of the cockpit warnings was ‘pitch disconnect’, indicating that the left and right elevator control systems had uncoupled from each other. This allowed for independent movement of the left and right elevators via the captain’s and FO’s control columns respectively.
The crew consulted the pitch disconnect checklist and worked to identify which control column was free and working normally. After determining that both controls were free, it was decided that the captain would be pilot flying for the remainder of the approach and landing at Sydney Airport. The aerodynamic loads generated during the pitch disconnect resulted in serious injury to the senior cabin crew member and significant damage to the aircraft’s horizontal stabiliser (Figure 1). Although the aircraft was inspected after the pitch disconnect, the damage was not identified until 25 February 2014.
Source: Sydney Airport, modified by the ATSB
ATR 72-212A ‘600-series’ aircraft have a ‘glass cockpit’ consisting of a suite of electronic displays on the instrument panel. The instrument display suite includes two primary flight displays (PFDs); one located directly in front of each pilot (Figure 2). The PFDs display information about the aircraft’s flight mode (such as autopilot status), airspeed, attitude, altitude, vertical speed and some navigation information.
Airspeed information is provided on the left of the PFD in a vertical moving tape–style representation that is centred on the current computed airspeed. The airspeed tape covers a range of 42 kt either side of the current computed speed and has markings at 10 kt increments. The current computed airspeed is also shown in cyan figures immediately above the airspeed tape.
Important references on the airspeed indicator are shown in Figure 3, including:
- Current computed airspeed
- Airspeed trend
Indicates the predicted airspeed in 10 seconds if the acceleration remains constant. The trend indication is represented as a yellow arrow that extends from the current airspeed reference line to the predicted airspeed.
- Target speed bug
Provides the target airspeed and can be either computed by the aircraft’s systems, or selected by the flight crew.
- Maximum airspeed – speed limit band
Indicates the maximum speed not to be exceeded in the current configuration. The example shown shows the maximum operating speed of 250 kt.
Flight control system
The ATR 72 primary flight controls essentially consist of an aileron and spoiler on each wing, two elevators and a rudder. All of the controls except the spoilers are mechanically actuated.
Pitch control system
The pitch control system is used to position the elevators to control the direction and magnitude of the aerodynamic loads generated by the horizontal stabiliser. The system consists of left and right control columns in the cockpit connected to the elevators via a system of cables, pulleys, push‑pull rods and bell cranks (Figure 4). The left (captain’s) and right (FO’s) control systems are basically a copy of each other, where the left system connects directly to the left elevator and the right system connects directly to the right elevator.
In normal operation, the left and right systems are connected such that moving one control column moves the other control column in unison. However, to permit continued control of the aircraft in the event of a jam within the pitch control system, a pitch uncoupling mechanism is incorporated into the aircraft design that allows the left and right control systems to disconnect and operate independently. That mechanism comprises a spring-loaded system located between the left and right elevators.
The forces applied on one side of the pitch control system are transmitted to the opposite side as a torque or twisting force through the pitch uncoupling mechanism. The pitch uncoupling mechanism activates automatically when this torque reaches a preset level, separating the left and right control systems. When set correctly, the activation torque is equivalent to opposing forces of 50 to 55 daN (about 51 to 56 kg force) being simultaneously applied to each control column.
Source: ATR, annotated by the ATSB
Activation of the pitch uncoupling mechanism is signalled in the cockpit by the master warning light flashing red, a continuous repetitive chime aural alert and a flashing red PITCH DISC message on the engine and warning display (Figure 5). The associated procedure to be followed in response to activation of the pitch uncoupling mechanism is presented to the right of the warning message.
The pitch uncoupling mechanism can be reset by the flight crew, reconnecting the left and right elevator systems. However, this can only be achieved when the aircraft is on the ground.
ATR advised that, because a jammed pitch control channel can occur in any phase of flight, a spring-loaded pitch uncoupling mechanism was selected over a directly–controlled mechanism. The logic of this approach was that this type of mechanism provides an intuitive way to uncouple the two pitch channels and recover control through either channel. ATR also advised that a directly‑controlled uncoupling mechanism increased the time necessary for a pilot to identify the failure, apply the procedure and recover pitch authority during a potentially high pilot workload phase (such as take-off or the landing flare).
During examination of the aircraft by the ATSB, the pitch uncoupling mechanism was tested in accordance with the aircraft’s maintenance instructions. The load applied to the control column to activate the pitch uncoupling mechanism was found to be at a value marginally greater than the manufacturer’s required value. The reason for this greater value was not determined, but may be related to the damage sustained during the pitch disconnect event.
Examination of the aircraft by the ATSB and the aircraft manufacturer identified significant structural damage to the horizontal stabiliser. This included:
- external damage to the left and right horizontal stabilisers (tailplanes) (Figure 6)
- fracture of the composite structure around the rear horizontal-to-vertical stabiliser attachment points (Figure 7)
- fracture of the front spar web (Figure 8)
- cracking of the horizontal-to-vertical stabiliser attachment support ribs
- cracking of the attachment support structure
- cracking and delamination of the skin panels at the rear spar (Figure 9).
Following assessment of the damage, the manufacturer required replacement of the horizontal and vertical stabilisers before further flight.
Source: ATR, modified by the ATSB
The ATSB obtained recorded information from the aircraft’s flight data recorder (FDR) and cockpit voice recorder (CVR). Graphical representations of selected parameters from the FDR are shown in Figures 10 and 11 as follows:
- Figure 10 shows selected data for a 60-second time period within which the occurrence took place. This includes a shaded, 6-second period that shows the pitch disconnect itself.
- Figure 11 shows an expanded view of the 6-second period in which the pitch disconnect took place.
In summary, the recorded data shows that:
- leading up to the occurrence, there was no indication of turbulence
- the autopilot was engaged and controlling the aircraft
- leading up to the uncoupling, both elevators moved in unison
- in the seconds leading up to the occurrence, there were a number of rapid increases in the recorded airspeed
- the FO made three nose up control inputs correlating with the use of the touch control steering
- at about time 05:40:50.1, or about 2.5 seconds before the pitch disconnect, a small load (pitch axis effort) was registered on the captain’s pitch control
- the captain started to make a nose up pitch input shortly before the FO made the third nose up input
- when the FO started moving the control column forward (nose down) at about 05:40:52.3, the load on the captain’s control increased (nose up) at about the same rate that the first officer’s decreased
- at 05:40:52.6 the elevators uncoupled. At that time:
- the load on the captain’s control column was 67 daN and on the FO’s -8.5 daN
- the aircraft pitch angle was increasing
- the vertical acceleration was about +2.8g and increasing
- after this time, the elevators no longer moved in unison
- peak elevator deflections of +10.4° and -9.3° were recorded about 0.2 seconds after the pitch disconnect
- about 0.25 seconds after the peak deflections, the captain moved the control forward until both elevators were in similar positions
- a maximum vertical acceleration of 3.34g was recorded at about 05:40:53.0
- the master warning activated after the pitch disconnect.
A number of features in the recorded data were used to identify the most likely time the pitch uncoupling mechanism activated, resulting in the pitch disconnect (black dashed line in Figure 11). This included when the elevator positions show separation from each other and reversal of the left elevator position while the left control column position remained relatively constant.
Although not shown in the previous figures, the yaw axis effort (pilot load applied to the rudder pedals), indicated that the applied load exceeded the value that would result in the automatic disconnection of the autopilot. That load exceedance occurred at 05:40:51.9, about the time that the autopilot disconnected. However, due to the data resolution and lack of a parameter that monitored the pilot’s disconnect button, it could not be determined if the autopilot disconnection was due to the load exceedance or the manual disconnection reported by the captain.
The CVR captured auditory tones consistent with the autopilot disconnection and the master warning. The first verbal indication on the CVR of flight crew awareness of the pitch disconnect was about 6 seconds after the master warning activated.
Manufacturer’s load analysis
ATR performed a load analysis based on data from the aircraft’s quick access recorder that was supplied by the operator. That analysis showed that during the pitch disconnect occurrence:
- the limit load for the:
- vertical load on the horizontal stabiliser was exceeded
- vertical load on the wing was reached
- bending moment on the wing was exceeded
- engine mounts were exceeded.
- the ultimate load, in terms of the asymmetric moment on the horizontal stabiliser, was exceeded.
ATR’s analysis found that the maximum load on the horizontal stabiliser coincided with the maximum elevator deflection that occurred 0.125 seconds after the elevators uncoupled. At that point, the ultimate load was exceeded by about 47 per cent, and the exceedance lasted about 0.125 second.
History of ATR 42/72 pitch disconnect occurrences
On the ground
The ATR42/72 aircraft type had a history of occasional pitch disconnects on the ground. ATR analysed these occurrences and established that in certain conditions, applying reverse thrust on landing could lead to excitation of a structural vibration mode close to the elevators’ anti-symmetric vibration mode. This could result in a disconnection between the pitch control channels. These type of on-ground events have not resulted in aircraft damage.
Tests were performed by ATR to determine the conditions in which those events occur. It appeared that the conditions include a combination of several factors: reverse thrust application, wind conditions and crew action on the control column.
The ATSB requested occurrence data on recorded in-flight pitch disconnections from ATR in late 2014 and received that data in late 2015. ATR provided occurrence details and short summaries for 11 in-flight pitch disconnect occurrences based on operator reports. The summaries indicated a number of factors that resulted in the pitch disconnects, including encounters with strong turbulence, mechanical failure and some where the origin of the pitch disconnect could not be established. However, for the purposes of this investigation, the ATSB has focussed on those occurrences where opposite pitch inputs (simultaneous nose down/nose up) were identified as primarily contributing to the occurrences.
Opposite efforts applied on both control columns
Three occurrences were identified where a pitch disconnect occurred as a result of the flight crew simultaneously applying opposite pitch control inputs. At the time of this interim report, two of the three occurrences are under investigation by other international agencies, so verified details of the occurrences are not available.
In the occurrence that is not being investigated, the operator reported to ATR that during an approach, severe turbulence was encountered and the pitch channels disconnected. Although the recorded flight data did not contain a direct record of the load applied by each pilot, ATR’s analysis determined that the pitch disconnect was most likely due to opposing pitch inputs made by the flight crew.
In addition, there were two occurrences where a pitch disconnect occurred due to opposing crew pitch inputs; however, the primary factor was a loss of control after experiencing in-flight icing. The pitch disconnects occurred while the flight crew were attempting to regain control of the aircraft. In one of these occurrences, the horizontal stabiliser separated from the aircraft before it impacted with the terrain. In the other, the flight crew regained control of the aircraft.
Jammed flight controls
ATR reported that they were not aware of any pitch disconnects associated with a jammed pitch control system.
A review of past occurrences by the ATSB identified one partial jammed pitch control that occurred in the United States on 25 December 2009. According to the United States National Transportation Safety Board investigation into the occurrence ‘The flight crew twice attempted the Jammed Elevator procedure in an effort to uncouple the elevators. Despite their attempts they did not succeed in uncoupling the elevators.’ 
Investigation activities to date
To date, the ATSB has collected information about, and analysed the following:
- the sequence of events before and after the pitch disconnect, including the post-occurrence maintenance and initial investigation by Virgin Australia Regional Airlines (VARA) and ATR
- flight and cabin crew training, qualifications, and experience
- the meteorological conditions
- VARA policy and procedures
- VARA training courses
- VARA’s safety management system
- VARA’s maintenance program
- the aircraft’s systems
- the relationship between VARA and the maintenance organisation
- maintenance engineer training, qualifications, and experience
- the maintenance organisation’s policy and procedures
- the maintenance organisation’s training courses
- the maintenance organisation’s quality and safety management
- the Civil Aviation Safety Authority’s (CASA) surveillance of VARA
- CASA’s approvals granted to VARA
- CASA’s surveillance of the maintenance organisation
- CASA’s approvals granted to the maintenance organisation
- ATR’s flight crew type training
- ATR’s maintenance engineer type training
- ATR’s maintenance instructions for continuing airworthiness
- known worldwide in-flight pitch disconnect occurrences involving ATR 42/72 aircraft.
- Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11.0 hours.
- Pilot Flying (PF) and Pilot Monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and aircraft flight path.
- At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 170 equates to 17,000 ft.
- For information regarding the presentation of airspeed to the flight crew refer to the section titled REF _Ref449606208 \h \* MERGEFORMAT Airspeed indication.
- A feature of the autopilot that, in vertical speed hold mode, allows the pilot to change the vertical speed target without the need to disengage the autopilot mode. Touch control steering (TCS) is activated by pressing a switch on the control yoke. The revised vertical speed target is adjusted by manual control inputs and release of the TCS switch when the desired vertical speed is attained.
- Pitch is the nose-up, or nose-down attitude of the aircraft relative to a level attitude. A positive pitch angle indicates the nose is above the level attitude, whereas a negative value indicates that the nose is below the level attitude.
- G Load is the nominal value for acceleration. In flight, g load values represent the combined effects of flight manoeuvring loads and turbulence. This can be a positive or negative value.
- The primary differences between the left and right sides are that the stick-pusher (part of the stall prevention system) is connected to the left system only and the autopilot pitch actuator is connected to the right system only.
- This satisfied item 25.671 of the Joint Aviation Requirements (JAR) 25, part of the design standard to which the aircraft was certified. JAR 25.671 required that ‘The aeroplane must be shown by analysis, test or both, to be capable of continued safe flight and landing after [certain] failures or jamming of the flight control system and surfaces within the normal flight envelope, without requiring exceptional piloting skill or strength.’
- The engine and warning display is located in the middle of the instrument panel, refer to REF _Ref448925149 \h Figure 2.
- The left and right systems are referred to as pitch control channels.
- The FDR parameter recording the master warning recorded at 1-second intervals, whereas the flight control parameters were recorded 16 times per second. This difference in recording resolution may result in the FDR data showing an apparent lag between the pitch uncoupling and activation of the master warning.
- The autopilot system has a feature that will automatically disconnect the autopilot if the flight crew exceed preset control forces. This allows the flight crew to assume full control without the need to manually disconnect the autopilot.
- According to JAR 25.301, the limit load is the maximum load to be expected in service. JAR 25.305 requires that the aircraft structure must be able to support the limit load without detrimental permanent deformation.
- According to JAR 25.301, the ultimate load is the limit load multiplied by a prescribed factor of safety. JAR 25.305 requires that the aircraft structure must be able to support the ultimate load without failure for at least 3 seconds.
- A moment is the turning effect from a force. It is the product of the force multiplied by the perpendicular distance from the line of action of the force to the pivot point.
- United States National Transportation Safety Board identification: CEN10IA084
Safety analysis and finding
The actions taken by the flight crew were consistent with an attempt to prevent an increase in the aircraft’s speed. It was not consistent with a conscious attempt to disconnect the left and right elevator systems due to a control jam.
The force differential between the captain’s and first officer’s pitch control inputs when the pitch uncoupling mechanism activated was about 75 daN. This was less than the expected combined load of about 50 to 55 daN each (that is, a total differential of about 100 to 110 daN), and would initially suggest that the pitch uncoupling mechanism may have activated below the designed force differential. However, post‑occurrence testing conducted for the ATSB identified that the pitch uncoupling force exceeded the requirement. It is therefore unlikely that the pitch disconnect was due to a pitch uncoupling mechanism malfunction or incorrect activation setting. The difference in activation loads will be examined further in the final report.
The recorded data from the flight showed that both flight crew made simultaneous but opposite direction control inputs at the time of the pitch disconnect. Thus, it is most likely that the pitch disconnect was a result of an inadvertent application of opposing control inputs by the flight crew while attempting to prevent an exceedance of the aircraft’s maximum operating speed. The factors that led to both flight crew members making those control inputs will be examined in detail in the final report.
At the time of the pitch disconnect, the aircraft was near its maximum permitted operating speed. Because of this high speed, the resulting asymmetric elevator deflections resulted in a large asymmetric aerodynamic load being generated on the horizontal stabiliser. That load exceeded the design strength requirements for the stabiliser structure, resulting in significant damage. Such a large exceedance has the potential to result in catastrophic damage to the stabiliser and a subsequent loss of control.
Despite pre-existing, well-established and trained procedural risk controls to prevent dual control inputs in normal operation, the risk controls were readily, but inadvertently, bypassed by the crew on this occasion. The factors that led to this situation will be examined in detail in the final report. However, it shows that the aircraft was in a situation where inadvertent control inputs could lead to catastrophic failure of the horizontal stabiliser.
In normal operation, flight crew should not be making uncoordinated simultaneous control inputs. However this, and a number of other in-flight pitch disconnect occurrences, indicate that the pre‑existing procedural risk controls alone may not be sufficient to prevent this type of occurrence. Also, on this occasion, significant structural damage was done to the aircraft before the crew were alerted to, and able to react to the disconnection of the left and right pitch systems. Consequently, the ATSB is investigating whether the design of the pitch control and associated warning systems increases the likelihood of potentially catastrophic damage occurring when flight crew inadvertently make opposing pitch control inputs. The final report will contain a detailed assessment of this aspect of the investigation.
Based on the circumstances of this and a number of similar occurrences, the ATSB makes the following finding:
- Inadvertent application of opposing pitch control inputs by flight crew can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react. [Safety issue]
Safety issue and actions
The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
In this case, the ATSB has assessed that the risk posed by the safety issue is of sufficient magnitude to warrant the release of an interim report. This action provides the earliest opportunity for the relevant organisation to initiate proactive safety action, rather than to wait for the final investigation report to be published.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of this and any other safety issues and actions identified by the ATSB are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Inadvertent activation of the elevator control system - pitch uncoupling mechanism
Inadvertent application of opposing pitch control inputs by flight crew can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react.
ATSB Safety Issue No: AO-2014-032-SI-01