Aviation safety investigations & reports

In-flight upset, inadvertent pitch disconnect, and continued operation with serious damage involving ATR 72 aircraft, VH-FVR, 47 km WSW of Sydney Airport, NSW on 20 February 2014

Investigation number:
AO-2014-032
Status: Completed
Investigation completed
Phase: Final report: Dissemination Read more information on this investigation phase

Final Report

Download final report
[Download  PDF: 7.61MB]
 

What happened

On 20 February 2014, Virgin Australia Regional Airlines (VARA) was operating an ATR 72 aircraft, registered VH-FVR, on a scheduled passenger flight from Canberra to Sydney. During descent with the autopilot in vertical speed mode, the first officer as pilot flying was manually adjusting engine power to maintain the airspeed around the target of 235 kt.

While passing through about 8,500 ft, the aircraft encountered a significant windshear that resulted in a rapidly decreasing tailwind. This led to a rapid increase in airspeed, with the airspeed trend vector (displaying predicted speed on the primary flight display) likely indicating well above the maximum operating speed (VMO) of the aircraft of 250 kt. The first officer reduced engine power and made nose-up control inputs in an attempt to slow the aircraft.

In response to the unexpectedly high airspeed trend indication and their proximity to VMO, the captain (pilot not flying) perceived a need to take over control of the aircraft, with the intention of preventing the airspeed exceeding VMO. The captain took hold of the controls and made nose-up pitch control inputs without immediately following the specified take-over procedure and alerting the first officer of his intent.

About 1 second after the captain initiated the nose-up control inputs, the first officer (unaware that the captain was also making control inputs) reversed his control input. The differential forces in the left (captain) and right (first officer) pitch control systems reached the threshold to activate the pitch uncoupling mechanism, disconnecting the left and right pitch control systems from each other.

The captain completed the take-over by announcing he had control about 5–6 seconds after taking hold of the controls. However, before the takeover procedure was completed, the addition of the captain’s and first officer’s nose-up control inputs resulted in a pitching manoeuvre that exceeded the limit load factor for the aircraft.

Given the high airspeed, asymmetric elevator deflections that occurred immediately following the pitch disconnect event resulted in aerodynamic loads that exceeded the strength of the horizontal stabiliser and resulted in significant damage to the stabiliser.

At the start of the pitching manoeuvre, the senior cabin crew member was unrestrained in the rear of the cabin as she waited for a passenger to return to their seat. When the aircraft pitched back down, the cabin crew member was thrown from her seat and suffered a broken leg.

The flight crew continued the flight using one of the pitch control systems and landed without further incident at Sydney.

Based on the crew report of an in-flight pitch disconnect associated with moderate turbulence, and data recorded by the aircraft’s on board maintenance systems, VARA maintenance watch arranged for the contracted approved maintenance organisation, Toll Aviation Engineering, to carry out the applicable maintenance. However, the licenced aircraft maintenance engineers involved in the Inspection after flight in turbulence and/or exceeding VMO did not carry out the specified general visual inspection of the stabilisers probably because of a breakdown in the coordination and certification of the inspection tasks between the engineers. The damaged horizontal stabiliser was not detected and the aircraft was released to service.

VH-FVR under tow following completion of post-occurrence maintenance. The angle of the horizontal stabiliser relative to the angle of the wings indicates substantial structural deformation.

VH-FVR under tow following completion of post-occurrence maintenance. The angle of the horizontal stabiliser relative to the angle of the wings indicates substantial structural deformation.

Source: Sydney Airport

During the next 5 days the aircraft was operated on 13 flights and was subject to routine walk‑around visual inspections by flight crew and engineers. No one identified any anomalies until flight crew observed some damage after a suspected bird strike. The aircraft was grounded and subjected to extensive maintenance that included replacement of the horizontal and vertical stabilisers.

Upper tailplane of VH-FVR showing damage to horizontal and vertical stabilisers that was evident when the damage was identified 5 days and 13 flights after the in-flight upset/pitch disconnect and associated maintenance

Upper tailplane of VH-FVR showing damage to horizontal and vertical stabilisers that was evident when the damage was identified 5 days and 13 flights after the in-flight upset/pitch disconnect and associated maintenance

Source: ATSB

What the ATSB found

In-flight upset and pitch disconnect

The ATSB identified a number of operational factors that contributed to the in-flight upset and pitch disconnect.

  • During the descent, when the sterile flight deck policy was applicable, the flight crew engaged in non-pertinent conversation. This distracted the crew and probably reduced their ability to monitor and respond to fluctuations of airspeed.
  • While passing through about 8,500 ft on descent into Sydney, the aircraft encountered a significant windshear that resulted in a rapidly decreasing tailwind. This led to a rapid increase in the airspeed, with the airspeed trend vector likely indicating well above the maximum operating speed (VMO).
  • In response to the unexpectedly high airspeed trend indication, and their proximity to VMO, the captain (pilot not flying) perceived a need to immediately intervene, and made pitch control inputs before following the normal take-over procedure and alerting the first officer (pilot flying).
  • The addition of the captain’s and first officer’s nose-up control inputs resulted in a pitching manoeuvre that exceeded the limit load factor for the aircraft.
  • The magnitude of the captain's nose-up control input was probably greater than he intended, due to his response to a high stress level, but increased the probability that the aircraft's limit load factor would be exceeded.
  • Shortly after the captain initiated the nose-up control inputs, the first officer reversed his control input. The differential forces in the left (captain) and right (first officer) pitch control systems were sufficiently large to inadvertently activate the pitch uncoupling mechanism, disconnecting the left and right pitch control systems.
  • Given the high airspeed, the asymmetric elevator deflections that occurred immediately following the pitch disconnect event resulted in aerodynamic loads on the tailplane that exceeded its strength and damaged the horizontal stabiliser.

During the course of this investigation, the ATSB became aware that other in-flight pitch disconnect occurrences had occurred in ATR 72 aircraft and considered that the related procedural controls were not sufficiently effective. To alert the effected parties, the ATSB published an interim report (15 June 2016) with the following safety issue:

Inadvertent application of opposing pitch control inputs by flight crew can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react.

After further investigation, the ATSB published a second interim report (5 May 2017) in support of another safety issue that related to concern about transient elevator deflections in ATR 72 aircraft. The ATSB issued three recommendations to key stakeholders to address the following safety issue:

The aircraft manufacturer did not account for the transient elevator deflections that occur as a result of the system flexibility and control column input during a pitch disconnect event at all speeds within the flight envelope. As such, there was no assurance that the aircraft had sufficient strength to withstand the loads resulting from a pitch disconnect.

Further ATSB analysis identified another four safety issues that relate to different aspects of the ATR pitch control system and related design standards.

  • The design of the ATR 72 pitch control system resulted in limited tactile feedback between the left and right control columns, reducing the ability of one pilot to detect that the other pilot is making control inputs. In addition, there were no visual or auditory systems to indicate dual control inputs.
  • Flexibility in the ATR 72’s pitch control system between the control columns results in a change in the aircraft’s longitudinal handling qualities and control dynamics when dual control inputs are made. This could result in an aircraft-pilot coupling event where flight crew may find it difficult to control the aircraft.
  • The (European) design standard for large transport aircraft, Joint Aviation Requirements - Part 25 (JAR-25), did not require that the demonstrated potential for flexibility in the control system to develop transient dynamic loads, be considered during certification. Similarly, the current certification standard for Large Aeroplanes (CS-25) does not address this issue.
  • Although the design standard for the aircraft (JAR-25) required the control system to be of sufficient strength to withstand dual control inputs, it did not require consideration of the effect that dual control inputs may have on control of the aircraft. Similarly, the current design standard (CS-25) does not address this issue.

Inspection and continued operation

Further to establishing that the damage went undetected because the aircraft tail was not inspected in accordance with the turbulence/VMO exceedance job instruction card, the ATSB identified other maintenance-related factors that increased risk:

  • ATR (aircraft manufacturer) did not provide a maintenance inspection to specifically assess the effect of an in-flight pitch disconnect. As a result, if an in-flight pitch disconnect occurred, the aircraft may not be inspected at a level commensurate with the criticality of the event. And, as a legacy of there being no inspection specific to an in-flight pitch disconnect, there is potential for other ATR aircraft to have sustained an in-flight pitch disconnect in the past and be operating with undetected horizontal stabiliser damage.
  • In the job instruction card JIC 05-51-11 DVI 10000 Inspection after flight in turbulence and/or exceeding VMO, ATR (aircraft manufacturer) did not specify the ground support equipment required or clearly state that the general visual inspection (GVI) of the stabilisers included a close examination of the upper surface. Given engineers tasked with the inspection may not be aware that ATR referred to the standard definition of a GVI, there was a risk that engineers tasked with the inspection would not interpret the card correctly.
  • Toll Aviation Engineering (approved maintenance organisation) did not define, document, or otherwise assure the intended arrangements for coordination of maintenance at line maintenance stations, which allowed for the development of local operating practices that were not consistent with the expectations of an approved maintenance organisation management.
  • Although Toll Aviation Engineering (approved maintenance organisation) specified fatigue management procedures, the licenced aircraft maintenance engineers (LAMEs) who were involved in the inspection after flight in turbulence and/or exceeding VMO operated outside the nominated hours of work. As such, the LAMEs were at risk of fatigue on the day of the inspection and/or the day following.

What's been done as a result

Initial safety action

In March 2014, VARA issued an airworthiness memo about release to service of ATR aircraft following an in-flight pitch disconnect. Then, in June 2014, VARA provided guidance to ATR pilots about descent procedures and potential airspeed limitation exceedances. VARA and the subsequent operator of ATR aircraft, Virgin Australia Airlines (VAA), reviewed and revised operational procedures and guidance relevant to the occurrence, and added elements to their training and checking processes.

In June 2014, Toll Aviation Engineering (TAE) provided guidance to maintenance personnel about safety reporting. Later, in February 2016, Toll Aviation and TAE issued a safety alert to affected personnel to advise that an aircraft was to be grounded for maintenance after an in-flight pitch disconnect. As the operator of ATR 42 aircraft, Toll Aviation informed flight crews of ATR and EASA communications and added applicable elements to their training and checking processes.

ATR released an All Operators Message in February 2016 to inform operators of revised maintenance and operational documentation relating to the pitch control system and pitch disconnect occurrences. The revised documentation included the requirement for a detailed visual inspection after an in-flight pitch disconnect.

The European Aviation Safety Agency (EASA) released Safety Information Bulletin 2016-20R1 in December 2016 to highlight the risks associated with rapid and large alternating control inputs and the addition of ‘Inappropriate Flight Control Inputs’ to its risk portfolio.

Further and ongoing safety action

In response to safety issues identified by the ATSB, ATR advised that they would conduct a short risk assessment of continued operation and conduct a detailed engineering analysis of the transient elevator loads during a pitch disconnect. From the risk assessment completed by December 2016, ATR found that no further action was required in the short term.

For the engineering analysis, ATR developed an analytical model supported by ground and flight testing. In the worst jammed controls scenario considered, the loads resulting from transient elevator deflections associated to a pitch disconnect at VMO would slightly exceed the certification ultimate loads. ATR considers that the structural assessment performed for the jamming loads envelope demonstrates that the structure is capable to sustain this load increase with positive strength margins.

The ATR engineering analysis also identified that the elasticity of the cables had two notable effects on the jammed control column scenario. First, the pilot effort required to activate the pitch uncoupling was excessively high at VMO. Second, the residual pitch authority allowed flight crew to decelerate the aircraft before uncoupling. In response, ATR revised the pitch channel jamming procedure.

The ATSB notes that ATR has not advised of any engineering analysis concerning the effect of transient elevator deflections resulting from pitch uncoupling activated by dual control inputs (no jamming). In that regard, ATR advise that they issued the all operators message in February 2016 and the following actions have been taken at various industry levels:

  • EASA released the SIB 2016‐20 to highlight the risks associated to rapid and large alternating control inputs.
  • EASA added the ‘Inappropriate Flight Control Inputs’ item to its risk portfolio in the frame of their risk management system, recognising this is an industry concern. It will cover the issue of simultaneous inputs, as well as inputs of large amplitude or frequency inadequate for the flight phase at the event.
  • Paragraph 5.3 of the ICAO Airplane Upset Prevention and Recovery Training Aid revision 3 (AUPRTA: www.icao.int/safety/LOCI/AUPRTA/index) highlights the risk of upset induced by pilot excessive input.

ATR advise that at this point the continued airworthiness of the ATR 42/72 fleet is assured but recognise they must continue to analyse threats such as these. Indeed, ATR is also part of a working group at EASA level re-examining industry wide experience.

The ATSB acknowledges the extensive analysis carried out by ATR under the supervision of EASA. EASA advised that should an unsafe condition be identified then ATR and EASA will take action as per Annex I paragraph 21.A.3 of Commission Regulation (EU)No 748/2012 to ensure the ongoing safe operation of the ATR42/72 aircraft.

CASA advised that they have been involved in a comprehensive dialogue with ATR and EASA regarding the assessment of the transient elevator deflections associated with pitch disconnect to address this safety recommendation. CASA has also engaged with the ATSB throughout the investigation and intends to provide a further response to the ATSB safety recommendation following the release of the final report.

The ATSB is monitoring the ongoing safety action, especially in regard to the recommendations issued, and will update the website accordingly.

Safety messages

This occurrence was a complex event with a number of safety factors and issues identified in different domains. As such, stakeholders should study the parts of the report that are relevant to their domain and consider the applicable safety implications. The ATSB draws attention to the following:

From an operational perspective, the event shows how a flight crew whose intention was to keep the aircraft within the prescribed limitations, can inadvertently expose the aircraft to a higher level of risk. When taking action to address potential aircraft exceedances, flight crew should consider the serious consequence of applying aggressive or large control inputs at high speed relative to the risk posed by the exceedance. Flight crew should also adhere to sterile cockpit procedures to optimise their performance in the higher risk phases of flight and apply the handover/takeover procedures to ensure dual control inputs are avoided or coordinated to maintain effective control.

In terms of continuing airworthiness, the conduct of an inspection may be the sole opportunity to detect aircraft damage. As such, to avoid a single point failure it is imperative that the form of the inspection be fit-for-purpose and for inspections to be effectively coordinated and certified.

For aircraft manufacturers and airworthiness authorities, there can be unforeseen consequences of aircraft design characteristics. It is important that when identified, these are recognised and addressed during operational service of the aircraft type.

Download final report
[Download  PDF: 7.61MB]
 
 
 

Part 1: The occurrence

Part 2: In-flight upset and pitch disconnect

Part 3: Inspection and continued operation

Findings

Safety issues and actions

Sources and submissions

Appendix A

Appendix B

Appendix C

Appendix D

ATSB

Interim Report 2

Download Interim Report 2
[Download  PDF: 1.16MB]
 

Second interim report - published: 5 May 2017

On 20 February 2014, a Virgin Australia Regional Airlines (VARA) ATR 72 aircraft, registered VH‑FVR, operating on a scheduled passenger flight from Canberra, Australian Capital Territory to Sydney, New South Wales sustained a pitch disconnect while on descent into Sydney. The pitch disconnect occurred while the crew were attempting to prevent the airspeed from exceeding the maximum permitted airspeed (VMO). The aircraft was significantly damaged during the occurrence.

In accordance with the Transport Safety Investigation Act 2003 (the Act), the ATSB initiated an investigation into the occurrence. On 15 June 2016 the ATSB released its first interim investigation report that contained the following safety issue:

  • Inadvertent[1] application of opposing pitch control inputs by flight crew can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react.

In the interest of transport safety, this safety issue was brought to the attention of the aircraft manufacturer (ATR) and the wider aviation industry prior to completion of the investigation.

During the continued investigation of the occurrence, the ATSB has obtained an increased understanding of the factors behind this previously identified safety issue. This increased understanding has identified that there are transient elevator deflections during a pitch disconnect event that could lead to aerodynamic loads that could exceed the strength of the aircraft structure.

The ATSB also found that these transient elevator deflections were not identified, and therefore not considered in the engineering justification documents completed during the aircraft type’s original certification process. The ATSB considers that the potential consequences are sufficiently important to release a further interim report prior to completion of the final investigation report.

This second interim report expands on information already provided in, and should be read in conjunction with, the interim report released on 15 June 2016 report and an update on the ATSB website on 10 June 2014.[2] It is released in accordance with section 25 of the Act and relates to the ongoing investigation of the occurrence.

Readers are cautioned that the factual information and analysis presented in this interim report pertains only to the safety issue discussed herein. The final report will contain information on many other facets of the investigation, including the operational, maintenance, training and regulatory aspects.

Readers are also cautioned that new evidence may become available as the investigation progresses that will enhance the ATSB’s understanding of the occurrence. However, in order to ensure the veracity of the analysis of the evidence leading to the identified safety issue, the ATSB engaged the UK Air Accidents Investigation Branch (AAIB) to conduct a peer review. The AAIB conducted an analysis of the evidence relating to the safety issue and concluded that their findings were consistent with those provided by the ATSB.

__________

  1. In the context of this safety issue, ‘inadvertent’ is taken to mean that the opposing pitch control inputs were unintended.
  2. www.atsb.gov.au/publications/investigation_reports/2014/aair/ao-2014-032.
Download Interim Report 2
[Download  PDF: 1.16MB]
 
 
 

Context

Safety analysis and finding

Findings

Safety issue and actions

Appendix A – Transient response of a simple dynamic system

Interim Report 1

Download Interim report 1
[Download  PDF: 1.38MB]
Alternate: [Download  DOCX: 6.6MB]
 

First interim report - published: 15 June 2016

Background

On 20 February 2014, a Virgin Australia Regional Airlines (VARA) ATR 72 aircraft, registered VH‑FVR, operating on a scheduled passenger flight from Canberra, Australian Capital Territory to Sydney, New South Wales sustained a pitch disconnect while on descent into Sydney. The aircraft was significantly damaged during the occurrence.

In accordance with the Transport Safety Investigation Act 2003, the ATSB initiated an investigation into the occurrence. Although the investigation is not yet complete and covers a range of areas, a safety issue has been identified that, in the interests of safety, needs to be brought to the attention of the industry before the investigation is completed. This interim report provides only the factual information and analysis associated with the identified safety issue.

This interim report complements information already provided on an update on the ATSB website on 10 June 2014.[1] It is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the ongoing investigation of the occurrence. Readers are cautioned that new evidence may become available as the investigation progresses that will enhance the ATSB’s understanding of the occurrence.

Occurrence summary

The flight departed Canberra at 1612 Eastern Daylight-saving Time[2] with the first officer (FO) as the pilot flying[3]. A steeper-than-usual climb was carried out to reduce exposure to turbulence. However, other than the expected turbulence during the first 1,500 ft, there was nothing significant during the climb to flight level (FL) 170.[4]

During cruise, the crew conducted a routine brief for the anticipated arrival to runway 16 Right, which was expected to be standard except for commencement of descent 5 NM (9 km) earlier than normal to compensate for a tailwind. The captain noted the need to be cognisant of managing airspeed during the descent as the anticipated decreasing tailwind would result in a temporary increase in the indicated airspeed.

The FO commenced descent into Sydney with the autopilot engaged in vertical speed mode and a target airspeed of 235 kt (15 kt less than the maximum operating speed of 250 kt).[5] The descent was reported to have been initially stable and smooth.

On first contact with Sydney Approach the crew were assigned runway 16 Left. This was different to the expected runway and required the crew to re‑brief the approach and change the instrument approach diagrams and navigational aid frequencies.

Passing 8,500 ft above mean sea level (AMSL), the crew noticed a rapid airspeed increase. The FO reported that the airspeed trend indicator was ‘off the chart’, indicating a very rapid increase in airspeed. The FO reduced engine power and used touch control steering[6] to temporarily disconnect the autopilot before manually raising the aircraft’s nose to control the speed. The FO expected that, in combination, the pitch correction and power reduction would be sufficient to arrest the speed trend.

The FO reported that the aircraft felt ‘heavy’, as was normal for this aircraft at that speed, requiring two hands on the controls to move from the then -4° pitch angle. [7]

The captain reported being unsure if the FO’s control inputs would be sufficient to avoid exceeding the maximum operating speed limitation, so put one of his hands on the controls and disconnected the autopilot to raise the nose further.

Shortly after, with both flight crew making simultaneous nose up pitch inputs on the controls, the aircraft rapidly pitched up with an associated increase in the g load.[8] The FO responded by immediately reversing the control input to nose down. Both flight crew noticed that the controls suddenly felt different and ‘spongy’. At about the same time, aural and visual cockpit warnings activated. The crew verified that the aircraft was under control at a stable attitude and speed, observing that it was level or in a slight descent at an airspeed of about 230 kt.

One of the cockpit warnings was ‘pitch disconnect’, indicating that the left and right elevator control systems had uncoupled from each other. This allowed for independent movement of the left and right elevators via the captain’s and FO’s control columns respectively.

The crew consulted the pitch disconnect checklist and worked to identify which control column was free and working normally. After determining that both controls were free, it was decided that the captain would be pilot flying for the remainder of the approach and landing at Sydney Airport. The aerodynamic loads generated during the pitch disconnect resulted in serious injury to the senior cabin crew member and significant damage to the aircraft’s horizontal stabiliser (Figure 1). Although the aircraft was inspected after the pitch disconnect, the damage was not identified until 25 February 2014.

Figure 1: VH-FVR (circled) taxiing inbound at Sydney Airport on 20 February 2014 following the in-flight pitch disconnect (still image copied from closed-circuit television footage). Note the angle of the horizontal stabiliser relative to the wings

Figure 1: VH-FVR (circled) taxiing inbound at Sydney Airport on 20 February 2014 following the in-flight pitch disconnect (still image copied from closed-circuit television footage). Note the angle of the horizontal stabiliser relative to the wings

Source: Sydney Airport, modified by the ATSB

Airspeed indication

ATR 72-212A ‘600-series’ aircraft have a ‘glass cockpit’ consisting of a suite of electronic displays on the instrument panel. The instrument display suite includes two primary flight displays (PFDs); one located directly in front of each pilot (Figure 2). The PFDs display information about the aircraft’s flight mode (such as autopilot status), airspeed, attitude, altitude, vertical speed and some navigation information.

Figure 2: View of the ATR 72-212A glass cockpit showing the electronic displays. The PFDs for the captain and FO are indicated on the left and right of the instrument panel in front of the control columns

Figure 2: View of the ATR 72-212A glass cockpit showing the electronic displays. The PFDs for the captain and FO are indicated on the left and right of the instrument panel in front of the control columns

Source: ATSB

Airspeed information is provided on the left of the PFD in a vertical moving tape–style representation that is centred on the current computed airspeed. The airspeed tape covers a range of 42 kt either side of the current computed speed and has markings at 10 kt increments. The current computed airspeed is also shown in cyan figures immediately above the airspeed tape.

Important references on the airspeed indicator are shown in Figure 3, including:

  1. Current computed airspeed
  2. Airspeed trend
    Indicates the predicted airspeed in 10 seconds if the acceleration remains constant. The trend indication is represented as a yellow arrow that extends from the current airspeed reference line to the predicted airspeed.
  3. Target speed bug
    Provides the target airspeed and can be either computed by the aircraft’s systems, or selected by the flight crew.
  4. Maximum airspeed – speed limit band
    Indicates the maximum speed not to be exceeded in the current configuration. The example shown shows the maximum operating speed of 250 kt.

Figure 3: Representation of the airspeed indicator on the PFD. The example shows a current computed airspeed of 232 kt (represented by a yellow horizontal line) with an increasing speed trend that is shown in this case as a vertical yellow arrow and is approaching the maximum speed in the current configuration of 250 kt. Note: the airspeed information shown in the figure is for information only and does not represent actual values from the occurrence flight

Figure 3: Representation of the airspeed indicator on the PFD. The example shows a current computed airspeed of 232 kt (represented by a yellow horizontal line) with an increasing speed trend that is shown in this case as a vertical yellow arrow and is approaching the maximum speed in the current configuration of 250 kt. Note: the airspeed information shown in the figure is for information only and does not represent actual values from the occurrence flight

Source: ATSB

Flight control system

The ATR 72 primary flight controls essentially consist of an aileron and spoiler on each wing, two elevators and a rudder. All of the controls except the spoilers are mechanically actuated.

Pitch control system

The pitch control system is used to position the elevators to control the direction and magnitude of the aerodynamic loads generated by the horizontal stabiliser. The system consists of left and right control columns in the cockpit connected to the elevators via a system of cables, pulleys, push‑pull rods and bell cranks (Figure 4). The left (captain’s) and right (FO’s) control systems are basically a copy of each other, where the left system connects directly to the left elevator and the right system connects directly to the right elevator.[9]

In normal operation, the left and right systems are connected such that moving one control column moves the other control column in unison. However, to permit continued control of the aircraft in the event of a jam within the pitch control system, a pitch uncoupling mechanism is incorporated into the aircraft design that allows the left and right control systems to disconnect and operate independently.[10] That mechanism comprises a spring-loaded system located between the left and right elevators.

The forces applied on one side of the pitch control system are transmitted to the opposite side as a torque or twisting force through the pitch uncoupling mechanism. The pitch uncoupling mechanism activates automatically when this torque reaches a preset level, separating the left and right control systems. When set correctly, the activation torque is equivalent to opposing forces of 50 to 55 daN (about 51 to 56 kg force) being simultaneously applied to each control column.

Figure 4: ATR 72 elevator/pitch control system with the pitch uncoupling mechanism circled in red

Figure 4: ATR 72 elevator/pitch control system with the pitch uncoupling mechanism circled in red

Source: ATR, annotated by the ATSB

Activation of the pitch uncoupling mechanism is signalled in the cockpit by the master warning light flashing red, a continuous repetitive chime aural alert and a flashing red PITCH DISC message on the engine and warning display (Figure 5).[11] The associated procedure to be followed in response to activation of the pitch uncoupling mechanism is presented to the right of the warning message.

Figure 5: Pitch disconnect warning presentation on the engine and warning display. The red PITCH DISC warning message, indicated by the thick yellow arrow, is located on the lower left of the screen. The pitch disconnect procedure is displayed to the right of the warning message

Figure 5: Pitch disconnect warning presentation on the engine and warning display. The red PITCH DISC warning message, indicated by the thick yellow arrow, is located on the lower left of the screen. The pitch disconnect procedure is displayed to the right of the warning message

Source: ATSB

The pitch uncoupling mechanism can be reset by the flight crew, reconnecting the left and right elevator systems. However, this can only be achieved when the aircraft is on the ground.

ATR advised that, because a jammed pitch control channel[12] can occur in any phase of flight, a spring-loaded pitch uncoupling mechanism was selected over a directly–controlled mechanism. The logic of this approach was that this type of mechanism provides an intuitive way to uncouple the two pitch channels and recover control through either channel. ATR also advised that a directly‑controlled uncoupling mechanism increased the time necessary for a pilot to identify the failure, apply the procedure and recover pitch authority during a potentially high pilot workload phase (such as take-off or the landing flare).

System testing

During examination of the aircraft by the ATSB, the pitch uncoupling mechanism was tested in accordance with the aircraft’s maintenance instructions. The load applied to the control column to activate the pitch uncoupling mechanism was found to be at a value marginally greater than the manufacturer’s required value. The reason for this greater value was not determined, but may be related to the damage sustained during the pitch disconnect event.

Aircraft damage

Examination of the aircraft by the ATSB and the aircraft manufacturer identified significant structural damage to the horizontal stabiliser. This included:

  • external damage to the left and right horizontal stabilisers (tailplanes) (Figure 6)
  • fracture of the composite structure around the rear horizontal-to-vertical stabiliser attachment points (Figure 7)
  • fracture of the front spar web (Figure 8)
  • cracking of the horizontal-to-vertical stabiliser attachment support ribs
  • cracking of the attachment support structure
  • cracking and delamination of the skin panels at the rear spar (Figure 9).

Following assessment of the damage, the manufacturer required replacement of the horizontal and vertical stabilisers before further flight.

Figure 6: Tailplane external damage (indicated by marks and stickers) with the aerodynamic fairings installed

Figure 6: Tailplane external damage (indicated by marks and stickers) with the aerodynamic fairings installed

Source: ATSB

Figure 7: Horizontal-to-vertical stabiliser attachment with the aerodynamic fairings removed. View looking upwards at the underside of the horizontal stabiliser. The thick yellow arrow indicates cracking in the composite structure around the rear attachment point

Figure 7: Horizontal-to-vertical stabiliser attachment with the aerodynamic fairings removed. View looking upwards at the underside of the horizontal stabiliser. The thick yellow arrow indicates cracking in the composite structure around the rear attachment point

Source: ATSB

Figure 8: Crack in the horizontal stabiliser front spar. The diagonal crack in the spar web is identified by a yellow arrow

Figure 8: Crack in the horizontal stabiliser front spar. The diagonal crack in the spar web is identified by a yellow arrow

Source: ATR, modified by the ATSB

Figure 9: Cracking and delamination of the upper skin on the horizontal stabiliser at the rear spar. View looking forward at the rear face of the rear spar. Damage identified by yellow arrows

Figure 9: Cracking and delamination of the upper skin on the horizontal stabiliser at the rear spar. View looking forward at the rear face of the rear spar. Damage identified by yellow arrows

Source: ATSB

Recorded data

The ATSB obtained recorded information from the aircraft’s flight data recorder (FDR) and cockpit voice recorder (CVR). Graphical representations of selected parameters from the FDR are shown in Figures 10 and 11 as follows:

  • Figure 10 shows selected data for a 60-second time period within which the occurrence took place. This includes a shaded, 6-second period that shows the pitch disconnect itself.
  • Figure 11 shows an expanded view of the 6-second period in which the pitch disconnect took place.

Figure10: FDR information showing the relevant pitch parameters for a period spanning about 30 seconds before and after the pitch disconnect

Figure 10: FDR information showing the relevant pitch parameters for a period spanning about 30 seconds before and after the pitch disconnect 

Source: ATSB

 

Figure 11: FDR information showing the relevant pitch parameters for the shaded 6‑second period in Figure 10during which the pitch disconnect took place. The estimated time of the pitch disconnect is shown with a black dashed line at time 05:40:52.6

Figure 11: FDR information showing the relevant pitch parameters for the shaded 6‑second period in Figure 10during which the pitch disconnect took place. The estimated time of the pitch disconnect is shown with a black dashed line at time 05:40:52.6

Source: ATSB

In summary, the recorded data shows that:

  • leading up to the occurrence, there was no indication of turbulence
  • the autopilot was engaged and controlling the aircraft
  • leading up to the uncoupling, both elevators moved in unison
  • in the seconds leading up to the occurrence, there were a number of rapid increases in the recorded airspeed
  • the FO made three nose up control inputs correlating with the use of the touch control steering
  • at about time 05:40:50.1, or about 2.5 seconds before the pitch disconnect, a small load (pitch axis effort) was registered on the captain’s pitch control
  • the captain started to make a nose up pitch input shortly before the FO made the third nose up input
  • when the FO started moving the control column forward (nose down) at about 05:40:52.3, the load on the captain’s control increased (nose up) at about the same rate that the first officer’s decreased
  • at 05:40:52.6 the elevators uncoupled. At that time:
  • the load on the captain’s control column was 67 daN and on the FO’s -8.5 daN
  • the aircraft pitch angle was increasing
  • the vertical acceleration was about +2.8g and increasing
  • after this time, the elevators no longer moved in unison
  • peak elevator deflections of +10.4° and -9.3° were recorded about 0.2 seconds after the pitch disconnect
  • about 0.25 seconds after the peak deflections, the captain moved the control forward until both elevators were in similar positions
  • a maximum vertical acceleration of 3.34g was recorded at about 05:40:53.0
  • the master warning activated after the pitch disconnect.[13]

A number of features in the recorded data were used to identify the most likely time the pitch uncoupling mechanism activated, resulting in the pitch disconnect (black dashed line in Figure 11). This included when the elevator positions show separation from each other and reversal of the left elevator position while the left control column position remained relatively constant.

Although not shown in the previous figures, the yaw axis effort (pilot load applied to the rudder pedals), indicated that the applied load exceeded the value that would result in the automatic disconnection of the autopilot.[14] That load exceedance occurred at 05:40:51.9, about the time that the autopilot disconnected. However, due to the data resolution and lack of a parameter that monitored the pilot’s disconnect button, it could not be determined if the autopilot disconnection was due to the load exceedance or the manual disconnection reported by the captain.

The CVR captured auditory tones consistent with the autopilot disconnection and the master warning. The first verbal indication on the CVR of flight crew awareness of the pitch disconnect was about 6 seconds after the master warning activated.

Manufacturer’s load analysis

ATR performed a load analysis based on data from the aircraft’s quick access recorder that was supplied by the operator. That analysis showed that during the pitch disconnect occurrence:

  • the limit load[15] for the:
  • vertical load on the horizontal stabiliser was exceeded
  • vertical load on the wing was reached
  • bending moment on the wing was exceeded
  • engine mounts were exceeded.
  • the ultimate load,[16] in terms of the asymmetric moment[17] on the horizontal stabiliser, was exceeded.

ATR’s analysis found that the maximum load on the horizontal stabiliser coincided with the maximum elevator deflection that occurred 0.125 seconds after the elevators uncoupled. At that point, the ultimate load was exceeded by about 47 per cent, and the exceedance lasted about 0.125 second.

History of ATR 42/72 pitch disconnect occurrences

On the ground

The ATR42/72 aircraft type had a history of occasional pitch disconnects on the ground. ATR analysed these occurrences and established that in certain conditions, applying reverse thrust on landing could lead to excitation of a structural vibration mode close to the elevators’ anti-symmetric vibration mode. This could result in a disconnection between the pitch control channels. These type of on-ground events have not resulted in aircraft damage.

Tests were performed by ATR to determine the conditions in which those events occur. It appeared that the conditions include a combination of several factors: reverse thrust application, wind conditions and crew action on the control column.

In-flight

The ATSB requested occurrence data on recorded in-flight pitch disconnections from ATR in late 2014 and received that data in late 2015. ATR provided occurrence details and short summaries for 11 in-flight pitch disconnect occurrences based on operator reports. The summaries indicated a number of factors that resulted in the pitch disconnects, including encounters with strong turbulence, mechanical failure and some where the origin of the pitch disconnect could not be established. However, for the purposes of this investigation, the ATSB has focussed on those occurrences where opposite pitch inputs (simultaneous nose down/nose up) were identified as primarily contributing to the occurrences.

Opposite efforts applied on both control columns

Three occurrences were identified where a pitch disconnect occurred as a result of the flight crew simultaneously applying opposite pitch control inputs. At the time of this interim report, two of the three occurrences are under investigation by other international agencies, so verified details of the occurrences are not available.

In the occurrence that is not being investigated, the operator reported to ATR that during an approach, severe turbulence was encountered and the pitch channels disconnected. Although the recorded flight data did not contain a direct record of the load applied by each pilot, ATR’s analysis determined that the pitch disconnect was most likely due to opposing pitch inputs made by the flight crew.

In addition, there were two occurrences where a pitch disconnect occurred due to opposing crew pitch inputs; however, the primary factor was a loss of control after experiencing in-flight icing. The pitch disconnects occurred while the flight crew were attempting to regain control of the aircraft. In one of these occurrences, the horizontal stabiliser separated from the aircraft before it impacted with the terrain. In the other, the flight crew regained control of the aircraft.

Jammed flight controls

ATR reported that they were not aware of any pitch disconnects associated with a jammed pitch control system.

A review of past occurrences by the ATSB identified one partial jammed pitch control that occurred in the United States on 25 December 2009. According to the United States National Transportation Safety Board investigation into the occurrence ‘The flight crew twice attempted the Jammed Elevator procedure in an effort to uncouple the elevators. Despite their attempts they did not succeed in uncoupling the elevators.’ [18]

Investigation activities to date

To date, the ATSB has collected information about, and analysed the following:

  • the sequence of events before and after the pitch disconnect, including the post-occurrence maintenance and initial investigation by Virgin Australia Regional Airlines (VARA) and ATR
  • flight and cabin crew training, qualifications, and experience
  • the meteorological conditions
  • VARA policy and procedures
  • VARA training courses
  • VARA’s safety management system
  • VARA’s maintenance program
  • the aircraft’s systems
  • the relationship between VARA and the maintenance organisation
  • maintenance engineer training, qualifications, and experience
  • the maintenance organisation’s policy and procedures
  • the maintenance organisation’s training courses
  • the maintenance organisation’s quality and safety management
  • the Civil Aviation Safety Authority’s (CASA) surveillance of VARA
  • CASA’s approvals granted to VARA
  • CASA’s surveillance of the maintenance organisation
  • CASA’s approvals granted to the maintenance organisation
  • ATR’s flight crew type training
  • ATR’s maintenance engineer type training
  • ATR’s maintenance instructions for continuing airworthiness
  • known worldwide in-flight pitch disconnect occurrences involving ATR 42/72 aircraft.

 

__________

  1. www.atsb.gov.au/publications/investigation_reports/2014/aair/ao-2014-032.
  2. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11.0 hours.
  3. Pilot Flying (PF) and Pilot Monitoring (PM) are procedurally assigned roles with specifically assigned duties at specific stages of a flight. The PF does most of the flying, except in defined circumstances such as planning for descent, approach and landing. The PM carries out support duties and monitors the PF’s actions and aircraft flight path.
  4. At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 170 equates to 17,000 ft.
  5. For information regarding the presentation of airspeed to the flight crew refer to the section titled REF _Ref449606208 \h \* MERGEFORMAT Airspeed indication.
  6. A feature of the autopilot that, in vertical speed hold mode, allows the pilot to change the vertical speed target without the need to disengage the autopilot mode. Touch control steering (TCS) is activated by pressing a switch on the control yoke. The revised vertical speed target is adjusted by manual control inputs and release of the TCS switch when the desired vertical speed is attained.
  7. Pitch is the nose-up, or nose-down attitude of the aircraft relative to a level attitude. A positive pitch angle indicates the nose is above the level attitude, whereas a negative value indicates that the nose is below the level attitude.
  8. G Load is the nominal value for acceleration. In flight, g load values represent the combined effects of flight manoeuvring loads and turbulence. This can be a positive or negative value.
  9. The primary differences between the left and right sides are that the stick-pusher (part of the stall prevention system) is connected to the left system only and the autopilot pitch actuator is connected to the right system only.
  10. This satisfied item 25.671 of the Joint Aviation Requirements (JAR) 25, part of the design standard to which the aircraft was certified. JAR 25.671 required that ‘The aeroplane must be shown by analysis, test or both, to be capable of continued safe flight and landing after [certain] failures or jamming of the flight control system and surfaces within the normal flight envelope, without requiring exceptional piloting skill or strength.’
  11. The engine and warning display is located in the middle of the instrument panel, refer to REF _Ref448925149 \h Figure 2.
  12. The left and right systems are referred to as pitch control channels.
  13. The FDR parameter recording the master warning recorded at 1-second intervals, whereas the flight control parameters were recorded 16 times per second. This difference in recording resolution may result in the FDR data showing an apparent lag between the pitch uncoupling and activation of the master warning.
  14. The autopilot system has a feature that will automatically disconnect the autopilot if the flight crew exceed preset control forces. This allows the flight crew to assume full control without the need to manually disconnect the autopilot.
  15. According to JAR 25.301, the limit load is the maximum load to be expected in service. JAR 25.305 requires that the aircraft structure must be able to support the limit load without detrimental permanent deformation.
  16. According to JAR 25.301, the ultimate load is the limit load multiplied by a prescribed factor of safety. JAR 25.305 requires that the aircraft structure must be able to support the ultimate load without failure for at least 3 seconds.
  17. A moment is the turning effect from a force. It is the product of the force multiplied by the perpendicular distance from the line of action of the force to the pivot point.
  18. United States National Transportation Safety Board identification: CEN10IA084
Download Interim report 1
[Download  PDF: 1.38MB]
 
 
Alternate: [Download  DOCX: 6.6MB]
 

Safety analysis and finding

Safety issue and actions

Preliminary

Preliminary: 10 June 2014

The occurrences

Flight control occurrence

On 20 February 2014, Virgin Australia Regional Airlines was operating an ATR 72 aircraft, registered VH-FVR, on two scheduled passenger flights from Sydney, New South Wales (NSW) to Canberra, Australian Capital Territory and return. This was to be followed by a charter flight to Narrabri, NSW and return.

The applicable forecasts and reports did not anticipate any significant weather with the only concern to the flight crew being an expected crosswind of up to 30 kt for landing at Canberra. This was taken into account when the captain decided to be pilot flying for the first sector.

Pushback at Sydney was on time at about 1435 Eastern Daylight-saving Time[1] but take‑off was later than planned due to a long taxi and holding for traffic. The departure, climb and cruise were normal. For the descent into Canberra the crew selected a slower airspeed due to the possibility of turbulence. No significant turbulence was encountered until the normally-expected amount of mechanical turbulence on late final approach into Canberra.

The turnaround was conducted within the allocated time and the return flight to Sydney departed Canberra at 1612 with the first officer as the pilot flying. A steeper-than-usual climb was carried out to reduce exposure to turbulence. Other than expected turbulence during the first 1,500 ft, there was nothing significant during the climb to flight level (FL) 170[2].

During cruise the captain was in radio contact with the operator’s personnel who requested that departure from Sydney for the next sector be brought forward by 5 minutes. The captain expressed his concerns about the limited time available for the turnaround to the first officer.

The crew conducted a routine brief for the anticipated arrival to runway 16 Right, which was expected to be standard except for commencement of descent 5 NM (9 km) earlier to compensate for a tailwind. The captain noted that they needed to be cognisant of managing airspeed during the descent as a result of the anticipated decreasing tailwind.

The first officer commenced descent with the autopilot engaged in vertical speed mode and a target airspeed of 235 kt (15 kt less than the maximum operating speed of 250 kt). The descent was stable and smooth.

On first contact with Sydney Approach the crew were assigned runway 16 Left. This was different to the briefed runway and required a change of instrument approach diagrams and navigational aid frequencies.

At the appropriate points the seatbelt sign was turned on and the transition-down checklist carried out. The checklist was held at the last item awaiting a report from the cabin that it was secure.

At 1640 and about 8,500 ft, the crew noticed the airspeed going up quickly and the speed trend excessively high. The first officer reduced engine power and used touch control steering to temporarily disconnect the autopilot before manually raising the nose to control the speed. The aircraft felt ‘heavy’, requiring the first officer’s two hands on the controls to move from the then -4° pitch angle (aircraft nose-up/down). The first officer expected that the pitch correction would be sufficient to arrest the speed trend.

The captain was unsure if the first officer’s control inputs were sufficient to avoid an overspeed so put one of his hands on the controls and disconnected the autopilot to raise the nose further. The captain believed he indicated his intention to take over control and while the first officer could not recall it being verbalised he was aware of the captain’s actions. The first officer recalled that he took his hands off the controls, releasing touch control steering in the process. Shortly after, concerned about a high nose-up attitude, the first officer put his hands back on the controls. To both crew members, what happened next was unexpected and unclear.

Suddenly, the crew felt high positive g,[3] the controls felt different and spongy, and cockpit warnings activated. The crew then verified that the aircraft was under control at a stable attitude and speed. It was level or in a slight descent at an airspeed of about 230 kt.

One of the cockpit warnings was ‘pitch disconnect’, indicating the left and right elevator control systems had been decoupled. This allowed for independent movement of the elevators via the captain and first officer control columns.

The crew consulted the pitch disconnect checklist and worked to identify which control column was free and working normally. Although both controls were free, it was decided that the captain would be pilot flying. During this process an intermediate airspeed around 200‑210 kt was selected before reducing the airspeed to below the 180 kt specified in the checklist.

At some point the cabin crew called the cockpit and advised that the senior cabin crew member had injured her leg and that it might be broken. In the next contact with air traffic control the crew asked for an ambulance to be available after landing. The crew also made a PAN[4] call and requested runway 16 Right to minimise taxi time on the ground. Air traffic control agreed to that request.

The captain flew the approach to runway 16 Right manually with airspeeds, power settings and configurations that were typical of any day-visual approach and landing. After landing and a slight delay the crew taxied the aircraft to the assigned bay (Figure 1).

Figure 1: Aircraft taxiing onto the bay (still image copied from closed circuit TV footage)

Figure 1: Aircraft taxiing onto the bay
Source: Sydney Airport (edited by the ATSB)

After shutdown the crew completed cockpit tasks including reconnection of the two elevator control systems and the captain checked on the condition of the cabin crew member. Airport firefighters provided first aid until an ambulance arrived at the bay 10 minutes after the aircraft parked. The cabin crew member was transported by ambulance to a hospital. The Australian Transport Safety Bureau (ATSB) was advised initially of a turbulence-related event and, based on the nature of the injuries sustained by the flight attendant, commenced an investigation.

Post-occurrence maintenance

Two aircraft maintenance engineers working for the company that provided contract maintenance services to the operator were in attendance at the aircraft. The crew advised the engineers that they weren’t sure what had happened but that the pitch controls had disconnected, with a possible overspeed. From the onboard equipment, the engineers were able to establish that there had not been an overspeed but a vertical load factor of 3.34 g was recorded that exceeded the acceptable limit for the aircraft weight. One of the engineers took the opportunity to conduct a preliminary walk-around visual inspection and did not observe any aircraft damage. The flight crew entered the pitch disconnect in the aircraft’s technical log and, after a request from the engineers for more information, added that the aircraft had sustained moderate turbulence.

The aircraft was removed from further service that day and towed to a distant parking area to allow for the resulting maintenance inspection to be carried out. The two engineers on duty, one of whom was the senior base engineer, had come in early at 0600 to work on a grounded aircraft. Given this start time and the resulting already long day, the engineers considered that they needed assistance to complete their remaining tasks, which now included an inspection of VH-FVR. An engineer on his rostered day off agreed to come into work to assist with the inspection.

This engineer arrived at work at about 1900 and, after a discussion with the duty engineers, understood that the aircraft operator (maintenance watch) had received the data from the aircraft’s quick access recorder and requested a turbulence inspection after a pitch disconnect in moderate turbulence. He also understood at the time that one of the duty engineers had done quite a detailed walk-around of the aircraft in daylight and found no signs of defects.

The aircraft manufacturer’s job card for a turbulence inspection specified a general visual inspection of the fuselage, stabilisers and wings with more detailed inspections if any anomalies were found. A detailed inspection of the wing attachment fittings was also required irrespective of the results of the general visual inspection.

Over the course of the evening the non-rostered engineer and one of the duty engineers worked on disassembling some of the aircraft interior to access the wing attachment fittings. The duty engineers left at 2200, leaving the non-rostered engineer to complete the task. At about 2300 the engineer borrowed a nearby stand to provide a platform at about wing height. While on the stand positioned behind the left wing near the fuselage, the engineer inspected the upper surface of the wing, rear fuselage and tail by torchlight. The engineer finished work shortly after and returned to work at 0600 the next morning.

No defects were identified from any of the inspections and the aircraft was returned to service the next day.

Suspected birdstrike

Subsequent to the occurrence on 20 February, the aircraft was operated on 13 sectors, the last of which was a scheduled passenger flight from Sydney to Albury, NSW on 25 February 2014. On descent into Albury the aircraft passed in close proximity to birds, which alerted the captain to the possibility of a birdstrike. There were no indications that a bird had struck the aircraft but on the ground, the aircraft’s pitch trim system fluctuated abnormally.

The captain conducted a walk-around inspection with an expectation of bird damage to the left side of the aircraft. The only abnormality found was a deformity to a fairing at the top leading edge of the vertical stabiliser, which might have been the result of a birdstrike. The captain advised maintenance watch who dispatched an engineer to inspect the aircraft.

The engineer used scissor lift equipment to inspect the tailplane and confirmed that the fairing might have been damaged by a bird but that there was also significant structural damage on top of the tailplane. The aircraft was grounded and the ATSB advised.

Later information from the operator suggested that the damage to the tailplane might have been a result of the occurrence involving VH-FVR on 20 February 2014. On this basis, the ATSB combined its investigation into the aircraft damage identified in Albury with its investigation into the earlier flight control occurrence.

The flight crew of the earlier pitch‑disconnect flight and the engineers involved in the post-flight maintenance were interviewed and the damage to the aircraft was inspected at Albury. The ATSB downloaded data for the pitch-disconnect flight and subsequent flights from the flight data recorder and data for the pitch‑disconnect flight and last flight from the cockpit voice recorders that were installed in the aircraft for those flights.

Initial examination

An initial examination of the recorded data showed that when the airspeed approached 240 kt, at about 8,500 ft during the descent into Sydney on 20 February, the first officer used touch control steering and manually pitched the aircraft up. The airspeed increased again and then both the first officer and captain pulled on the control column. Shortly after, when the vertical load factor was increasing through 1.8 g, the first officer began to push the control column. The differential force on the control column that resulted from the captain and first officer applying an opposing force exceeded the differential force required to generate a pitch disconnect. Each pilot was then controlling the elevator on their side of the aircraft in opposite directions for a brief period before the first officer released his control column.

The aircraft manufacturer inspected the aircraft and found broken carbon plies, cracked joint sealant, and deformation in and around the area where the horizontal stabiliser attaches to the vertical stabiliser (Figures 2 and 3). There was also some minor damage to the rudder. The damage was assessed as being consistent with an overstress condition. Subject to further assessment and non-destructive testing, the aircraft manufacturer recommended replacement of the horizontal stabiliser, elevators, and vertical stabiliser.

Figure 2: Tailplane external damage (indicated by marks and stickers)

Figure 2: Tailplane external damage
Source: ATSB          

 

Figure 3: Left tailplane attachments (fairing removed)

Figure 3: Left tailplane attachments
Source: ATSB

____________________

The information contained in this web update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence. Readers are cautioned that new evidence will become available as the investigation progresses that will enhance the ATSB's understanding of the accident as outlined in this web update. As such, no analysis or findings are included in this update.

 



[1]     Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11.0 hours.

[2]     At altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 170 equates to 17,000 ft.

[3]     G Load is the nominal value for acceleration. In flight, g load values represent the combined effects of flight manoeuvring loads and turbulence. This can be a positive or negative value.

[4]     An internationally recognised radio call announcing an urgency condition which concerns the safety of an aircraft or its occupants but where the flight crew does not require immediate assistance.

Safety Issues

Go to AO-2014-032-SI-01 - Go to AO-2014-032-SI-02 - Go to AO-2014-032-SI-03 - Go to AO-2014-032-SI-04 - Go to AO-2014-032-SI-05 - Go to AO-2014-032-SI-06 - Go to AO-2014-032-SI-07 - Go to AO-2014-032-SI-08 -

Inadvertent activation of the elevator control system - pitch uncoupling mechanism

Inadvertent application of opposing pitch control inputs by flight crew can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react.

Safety issue details
Issue number: AO-2014-032-SI-01
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: No longer relevant

Consideration of transient elevator deflections from a pitch disconnect

The aircraft manufacturer did not account for the transient elevator deflections that occur as a result of the system flexibility and control column input during a pitch disconnect event at all speeds within the flight envelope. As such, there is no assurance that the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect.

Safety issue details
Issue number: AO-2014-032-SI-02
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Safety action pending

Reduced flight control tactile feedback

The design of the ATR 72 pitch control system resulted in limited tactile feedback between the left and right control columns, reducing the ability of one pilot to detect that the other pilot is making control inputs. In addition, there were no visual or auditory systems to indicate dual control inputs.

Safety issue details
Issue number: AO-2014-032-SI-03
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Safety action pending

Effect of dual control inputs on elevator response

Flexibility in the ATR 72’s pitch control system between the control columns results in a change in the aircraft’s longitudinal handling qualities and control dynamics when dual control inputs are made. This could result in an aircraft-pilot coupling event where flight crew may find it difficult to control the aircraft.

Safety issue details
Issue number: AO-2014-032-SI-04
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Safety action pending

No consideration of transient control loads in the design standard

The design standard for large transport aircraft, Joint Aviation Requirements - Part 25 (JAR-25), did not require that the demonstrated potential for flexibility in the control system to develop transient dynamic loads, be considered during certification. Similarly, the current certification standard for Large Aeroplanes (CS-25) does not address this issue.

Safety issue details
Issue number: AO-2014-032-SI-05
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Safety action pending

No consideration of dual control inputs on aircraft response in the design standard

Although the design standard for the aircraft (JAR-25) required the control system to be of sufficient strength to withstand dual control inputs, it did not require consideration of the effect that dual control inputs may have on control of the aircraft. Similarly, the current design standard (CS-25) does not address this issue.

Safety issue details
Issue number: AO-2014-032-SI-06
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Safety action pending

Maintenance requirements following an in-flight pitch disconnect

The aircraft manufacturer, ATR, did not provide a maintenance inspection to specifically assess the effect of an in-flight pitch disconnect on the structural integrity of the horizontal stabilisers. As a result, if an in-flight pitch disconnect occurred, the aircraft may not be inspected at a level commensurate with the criticality of the event.

Safety issue details
Issue number: AO-2014-032-SI-07
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Adequately addressed

Undetected horizontal stabiliser damage in world fleet

As a legacy of there being no inspection specific to an in-flight pitch disconnect, there is potential for other ATR aircraft to have sustained an in-flight pitch disconnect in the past and be operating with undetected horizontal stabiliser damage.

Safety issue details
Issue number: AO-2014-032-SI-08
Who it affects: All operators of ATR 42 and ATR 72 aircraft
Status: Adequately addressed
General details
Date: 20 February 2014   Investigation status: Completed  
Time: 1641 EDT   Investigation level: Complex - click for an explanation of investigation levels  
Location   (show map): 47 km WSW Sydney   Investigation phase: Final report: Dissemination  
State: New South Wales   Occurrence type: Control issues  
Release date: 24 May 2019   Occurrence category: Accident  
Report status: Final   Highest injury level: Serious  

Aircraft details

Aircraft details
Aircraft manufacturer ATR-Gie Avions de Transport Régional  
Aircraft model ATR72-212A  
Aircraft registration VH-FVR  
Serial number 1058  
Operator Virgin Australia Regional Airlines  
Type of operation Air Transport High Capacity  
Sector Turboprop  
Damage to aircraft Substantial  
Departure point Canberra, ACT  
Destination Sydney, NSW  
Last update 24 May 2019