The aircraft manufacturer did not account for the transient elevator deflections that occur as a result of the system flexibility and control column input during a pitch disconnect event at all speeds within the flight envelope. As such, there is no assurance that the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect.
The ATSB acknowledges the considerable efforts of ATR with regard to the detailed engineering analysis of the transient elevator deflections. The ATSB is satisfied that the results of that analysis, through the acceptance by the European Aviation Safety Agency, ensure compliance with the existing certification standard for the aircraft.
The ATSB also acknowledges that ATR dispute that dual control inputs are required by the certification standard, however, the ATSB considers the transport mode as a whole, including the limitations of human performance. While procedures, training, and crew resource management techniques reduce the likelihood of uncoordinated dual control inputs, they continue to occur and will likely continue to occur. To ensure that the occupants are provided with the highest reasonable level of protections, the aircraft structure needs to be resilient to foreseeable crew failures, just as they are for foreseeable system failures.
The ATSB does not consider this safety issue to have been completely addressed until the effects of uncoordinated dual control inputs that result in a pitch disconnect have been fully considered and any design improvements, if required, have been implemented. As such, the ATSB is closing this safety issue noting that it has been partially addressed.
The ATSB recommends that CASA review ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect, to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that CASA take immediate action to ensure the ongoing safe operation of Australian‑registered ATR42/72 aircraft.
CASA's position is informed by the ongoing certification status of the aircraft together with an adequate response from the two Australian ATR 42/72 operators in terms of their safety management and training and checking systems. In response to the ATSB safety recommendation, CASA advises the following:
CASA and EASA are maintaining close and regular communication in relation to this matter. EASA continues to liaise regularly with ATR as part of their continued investigation and CASA will review each new development on its merits, and subsequently determine whether any further action may be required. In particular, if the completed ATR engineering analysis identifies any ongoing concerns, CASA will take appropriate action, taking into account any measures taken by EASA, in consultation with the Australian operators of this aircraft.
CASA will continue to provide updates to the ATSB as our own investigations progress.
The ATSB accepts that the Civil Aviation Safety Authority (CASA) has been monitoring ATR’s engineering assessment of the transient elevator deflections following an in-flight pitch disconnect.
The ATSB acknowledges that CASA will continue to monitor the ATR engineering assessment and consult with EASA regarding the implications of the assessment results. If the completed ATR engineering results identify any ongoing concerns, the ATSB expects that CASA will take appropriate action, taking into account any measures taken by the European Aviation Safety Agency (EASA), and in consultation with Australia operators of the aircraft type.
Due to the ongoing nature of the engineering assessment, the ATSB will continue to monitor the actions taken by CASA with regard to Safety Recommendation AO-2014-032-SR-016. Any further progress updates will be made on the ATSB website.
CASA advised that since 10 February 2016, they have been involved in a comprehensive dialogue with ATR and EASA regarding the assessment of the transient elevator deflections associated with pitch disconnect to address this safety recommendation. CASA has also engaged with the ATSB throughout the investigation. CASA provided an interim response to the ATSB safety recommendation on 15 June 17. CASA intends to provide a further response to the ATSB safety recommendation following the release of the final report. That response, in part, depends on EASA’s response to the same safety recommendation.
Since February 2016, CASA has been monitoring ATR and EASA detailed engineering analysis of the aircraft’s pitch control system. However due to inherent conservatism in design ATR have now demonstrated the aircraft has sufficient strength to withstand an intentional pitch disconnect at almost any reasonable operating condition and the aircraft meets its certification requirements. For a worst possible case of factors, the conditions of which have never been encountered in the life of the type, it is possible the maximum load can be marginally exceeded during an intentional pitch disconnect. ATR propose to remove this risk by implementing a further updated pitch disconnect procedure. EASA is have provided that the review on ATR's engineering assessment of transient elevator deflections associated with a pitch disconnect is finalised to EASA's satisfaction. EASA are in the process to compile a final submittal regarding the results. EASA plan to provide this submittal by latest Q2/2021.
CASA's position is informed by the ongoing certification status of the aircraft together with an adequate response from the two Australian ATR 42/72 operators in terms of their safety management and training and checking systems. CASA and EASA are maintaining close and regular communication in relation to this matter. EASA continues to liaise regularly with ATR as part of their continued investigation and CASA will review each new development on its merits, and subsequently determine whether any further action may be required. In particular, if the completed ATR engineering analysis identifies any ongoing concerns, CASA will take appropriate action, taking into account any measures taken by EASA, in consultation with the Australian operators of this aircraft.
As CASA is not the State of Design for the ATR 42/72 aircraft, CASA issued a Type Acceptance Certificate (TAC) for the ATR 42 and 72 models and does not hold any type design data for these aircraft. Therefore, CASA relies on EASA as the NAA for the State of Design to conduct the assessment and correct any identified deficiencies in the aircraft. EASA has been working with ATR on resolution of the transient elevator deflection with pitch disconnect and providing CASA with updates when necessary.
CASA has been monitoring the progress of the review and assessment by EASA of ATRs analysis. Details provided below:
1. EASA and ATR have been working on the issue to understand the loads and demonstrate compliance with the relevant airworthiness standard. Certification Review Item (CRI) D-24 Issue 3 dated 25 January 2019 was raised. This CRI relates to demonstrating compliance with airworthiness requirements JAR 25.671(C (3) and CS 25.671(c)(3) and has been finalise, and closed. This CRI was intended as the method to be used to address AO-2014-032-SI-02.
2. EASA advised CASA on 18 March 2020 the following:
a. That they had reviewed preliminary data that indicates the aircraft can safely withstand the loads from a pitch disconnect within the operational envelope.
b. In context of the preliminary data review, ATR and EASA found potential for improvement of the pitch uncoupling function at high speeds. Consequently the priority shifted to work on an improved the pitch uncoupling AFM procedure. This AFM procedure review is currently in the final phase.
c. In parallel, EASA is progressing the review on ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect. Finalisation of the assessment is planned for the first half of 2020.
d. Routinely, the status of the pitch uncoupling occurrences is reviewed at regular Airworthiness Review Meetings three times per year.
3. CASA contacted EASA on 16 March 2021 for an update on their review of the ATR engineering assessment of transient elevator deflections associated with a pitch disconnect.
4. EASA responded on 16 March 2021 advised that the review on ATR's engineering assessment of transient elevator deflections associated with a pitch disconnect is finalised to EASA's satisfaction. EASA are in the process of compiling a final submittal regarding the results. EASA plan to provide this submittal by latest Q2/2021.
CASA will continue to monitor the actions of EASA on the closure of this safety recommendation as part of its business as usual.
If EASA issues corrective action, such as an airworthiness directive, under Part 39 of the Civil Aviation Safety Regulations this corrective action would be automatically mandatory for all operators of the affected aircraft in Australia. Any other action taken by the State of Design will be handled by the usual processes and procedures CASA already have in place.
As the monitoring of this issue is now business as usual, CASA recommends that the ATSB closes AO-2014-032-SR-016.
The ATSB accepts that CASA will continue to monitor the actions of EASA relating to this safety issue as part of their business as usual and take appropriate action when EASA take corrective action.
On 1 December 2016, in response to the identified safety issue, ATR advised the ATSB that they intended to:
Short term risk assessment
On 15 December 2016, ATR provided the ATSB with the results of their assessment of the short term risks of continued operation awaiting the complete engineering work associated with the issue. Their assessment concluded that:
ATR considers that continued safe operation is ensured by considering
- In the jamming situation, the ultimate loads cannot be exceeded through the control column input (excessive effort and mechanical stops). At high speed, the differential elevator deflection has margin to accommodate the transient load.
- The probability of a repeat occurrence of the MSN1058 [VH-FVR] event defeating all the barriers inherent in the design and standard operating procedures.
- The quantitative analysis results showing no immediate action is required.
Detailed engineering analysis of transient elevator deflections
On 11 April 2017, ATR provided the ATSB with an update on the detailed engineering analysis of the transient elevator loads. The briefing included an overview of the analysis methodology and preliminary results.
The analysis being conducted is based upon an analytical model supported by both ground and flight testing. The analytical model represents the ATR pitch control system and has system component masses and stiffness represented as group blocks. This includes a block representing the pitch uncoupling mechanism (PUM), which was modelled to represent the behaviour of the PUM before, during and after activation.
ATR has compared the model to the behaviour of the system recorded during ground test and has identified a favourable correlation. The results of the model showed that, following activation of the PUM on the ground, without aerodynamic loads, the flight control system responded in an underdamped oscillatory manner.
For analysis of the inflight situation, ATR has used the aerodynamic model that was developed during certification. Preliminary results for the jamming scenarios was provided. Those results showed that the inflight system response is also that of an underdamped oscillatory system. It also indicates that the magnitude of the system response is dependent upon the pilot input to the control column, and how quickly the flight crew respond to PUM activation. The system has margin for jams at the elevator. ATR are continuing the analysis of jams at the control column.
ATR are continuing with the detailed analysis. Further work includes:
The ATSB acknowledges the efforts of ATR to resolve the safety issue. The ATSB also notes that, while the short‑term risk assessment does not account for the transient elevator deflections associated with a pitch disconnect, until the results of the detailed engineering analysis are available it is not possible to accurately quantify the transient elevator loads. Consequently, it is not possible to fully determine the magnitude of the risk associated with continued operation of ATR42/72 aircraft until the engineering analysis is complete.
Noting the above, the ATSB’s retains a level of ongoing concern as to whether the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect. Consequently, while the ATSB accepted that the current level of safety action partially addresses the safety issue; the ATSB made the following safety recommendations on 5 May 2017, as released in the second interim report.
The ATSB recommends that ATR complete the assessment of transient elevator deflections associated with a pitch disconnect as soon as possible to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that ATR take immediate action to ensure the ongoing safe operation of ATR42/72 aircraft.
In an update provided on 11 August 2017, ATR briefed the ATSB on the results of:
The flight testing identified a consistent post-disconnect pilot input profile for use in the dynamic model and indicated that there was no discernible difference in the profile across the tested speed range. Also, the results from the dynamic (engineering) model compared well with the flight test results, indicating that the dynamic model satisfactorily represents the aircraft behaviour during an in-flight pitch disconnect.
ATR applied the dynamic model to assess the effect of an in-flight pitch disconnect at the maximum operating speed (VMO) in two representative pitch system jamming cases. The results indicate that there is a margin between the peak elevator deflection during the pitch disconnect and the deflections required to generate the ultimate loads, at VMO.
The ATSB accepts that ATR has completed part of the engineering assessment of the transient elevator deflections following an in-flight pitch disconnect.
The ATSB notes that to date, we have only been provided with basic analysis results and that those results have been presented to EASA in a similar timeframe. The ATSB has not yet been provided with documentation showing an independently reviewed engineering assessment, but acknowledges that this would not be practical until the engineering assessment has been completed.
The ATSB also notes that the following engineering analyses will be required to meet the intent of this Safety Recommendation:
The ATSB will continue to monitor the work carried out by ATR in response to the identified safety issue.
On 11 June 2018, ATR reported to the ATSB that:
Since August 11, 2017, further analyses using the dynamic model were performed to evaluate the effect of variation of the pitch channel stiffness on the results previously shared with EASA and ATSB. Stiffness variations considered were based on stiffness measurements made on several new production aircraft. Considering the sampling taken, and the evaluation of control channel stiffness potential variation with ageing, it was agreed by EASA that the data used are representative of the in‐service fleet. In the worst scenario considered in terms of jamming location (control column jamming) and with an extreme low stiffness value, the loads resulting from transient elevator deflections associated to a pitch disconnect at VMO would slightly increase with regards to certification ultimate loads. Structural assessment performed for the jamming loads envelope demonstrates that the structure is capable to sustain this load increase with positive strength margins.
The engineering analysis conducted evidenced that under the scenario of control column jamming, the elasticity of the cables provides a level of control on aircraft pitch axis through elevators deflection before PUM activation. As a result, the effort required to activate the PUM is increased compared to the 50 daN necessary to activate the mechanism when the elevators are totally blocked. Indeed, the pilot effort to activate the pitch uncoupling mechanism can reach up to 78 daN at VMO.
On the other side, this residual pitch authority can enable the crew to decelerate the aircraft. At lower airspeed the effort required to activate the PUM is lowered and margin with regards to the certification ultimate loads is increased. Based on this analysis and several simulations and flight tests, ATR proposes a revised pitch channel jamming procedure providing effective guidance to slow down the aircraft prior to PUM activation. This procedure has been successfully verified in flight test with ATR and EASA test pilots.
All the above activities have been performed under the oversight of EASA. The consolidation of the applicable requirements and EASA position has been formalized through a Certification Review Item (CRI) that is still open at the moment. Next iteration of the CRI with EASA is scheduled end of June 2018.
Also note that with regards to the risk associated to dual input, the following actions have been taken at various industry levels:
- ATR released the AOM42/72/2016/03 and revised the FCOM to raise crew awareness regarding the potential detrimental effect of uncoordinated crew input and/or large and aggressive flight control input at high speed.
- EASA released the SIB 2016‐20 to highlight the risks associated to rapid and large alternating control inputs.
- EASA added the ‘Inappropriate Flight Control Inputs’ item to its risk portfolio in the frame of their risk management system, recognizing this is an industry concern. It will cover the issue of simultaneous inputs, as well as inputs of large amplitude or frequency inadequate for the flight phase at the event.
- Paragraph 5.3 of the ICAO Airplane Upset Prevention and Recovery Training Aid revision 3 (AUPRTA https://www.icao.int/safety/LOCI/AUPRTA/index.html) highlights the risk of upset induced by pilot excessive input.
ATR subsequently advised that, from their perspective, at this point the continued airworthiness of the ATR 42/72 fleet is assured, but recognise they must continue to analyse threats such as these. Indeed, ATR is also part of a working group at EASA level re-examining industry wide experience.
The ATSB notes the work carried out by ATR in assessing the post-PUM activation transient behaviour of the pitch control system. To date, the ATSB has received a number of briefs from ATR on the results of their detailed engineering work regarding the assessment of the certification jamming scenarios. From this, the ATSB notes:
ATR demonstrated, for a number of scenarios, the aircraft structure capability with the pitch uncoupling mechanism activated. ATR will continue to review the risk of dual opposite inputs on the control columns, based on in-service experience, with the oversight of EASA.
In more details, ATR collaborated with EASA and CASA on the elaboration of conditions to be considered in terms of pilot effort maximum levels and scenarios addressing the requirement JAR/CS 25.671 (c) (3) for transient conditions following system override activation. These scenarios and maximum levels of pilot efforts are described in CRI-D24 document that has been agreed by ATR and EASA.
To answer the CRI, ATR and EASA agreed on the delivery of the following technical notes:
Consistently with scenarios described in the CRI-D24, ATR has built a jamming loads cases envelope combining worst altitudes and worst range of cables elasticity. Loads envelope is also made up by combining maximum speed and most critical jamming location:
Stress technical note (including structural assessment of jamming loads cases).
ATR has performed structural assessment for the jamming loads envelope for the Carbon Fiber center box with GFEM model and methodologies used for Certification.
Structural results show positive strength margins in all parts of the Carbon Fiber Center box.
Operational Flight procedure technical note
To update the value of the stiffness tolerance of pitch control linkage, a MOD 10 000 « Change Tolerance Value for elevator control max elasticity » has been open. This will be followed by an update of the procedure in FAL.
All the results gathered so far show that the continued airworthiness of the fleet is assured.
The ATSB acknowledges the progress made in response to the recommendation.
On 1 March 2023, the ATSB asked ATR: In our last communication copied below you advised May as target for a response. How are the teams progressing and are you able to advise an updated response date?
On 6 July 2023, ATR responded:
As you are aware the incident from February 20th , 2014 led to consider transient structural loads following the activation of the system for pitch disconnection that were not required in the loop load at the time of the composite empennages initial certification.
To answer the EASA certification review item ref D-24 issue 03, ATR has developed a brand-new finite element model and has performed a static test to validate the results of the model. The structural strength of the centerbox is ensured with the compliance of the following regulation: JAR 25.301,25.303,25.305,25.307,25.603,25.613,25.671.
The compliance of these requirements has been demonstrated on our 72 fleet. As of today, ATR is still working on the result of the test to demonstrate the compliance of our 42 fleet.
ATR would like to provide the ATSB with a complete picture of the fleet center box structural assessment. We are currently finishing the computations and should be able to provide you with a clearer picture of the strategy by October 2024. [ATSB note: this was later confirmed to by October 2023]
As of 26 November 2024, the ATSB has not yet received the finalised structural assessment of the centre box structure. However, the ATSB acknowledges the work carried out to date and that ATR is working with the European Aviation Safety Agency to demonstrate that the aircraft complies with the design standard.
In response to an email sent on 16 February 2024 requesting an update on ATR response to ATSB recommendations, ATR coordinated a teleconference to provide an update on some internal considerations being made with respect to the recommendations.
In that teleconference, ATR safety reported that they had conducted a 'bow tie' analysis that indicated several solutions they considered could address the recommendations that involved varying levels of design change/modification. ATR safety stressed that these were only internal consideration that were going to be put to senior management in the coming weeks.
Despite several requests to ATR, as of 26 November 2024, the ATSB is yet to receive an update on the outcome of those proposals.
The ATSB recommends that EASA monitor and review ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that EASA take immediate action to ensure the ongoing safe operation of ATR42/72 aircraft.
EASA advised they were in regular contact with ATR about the second step of the analysis regarding scenarios that will be evaluated based on current certification practices with regards to CS 25.671. It was found that this has a repercussion on the first step which was focused on the certification practices at time of initial type certification.
The plan is expected to be completed in by end 2018. Should an unsafe condition be identified then ATR and EASA will take action as per Annex I paragraph 21.A.3 of Commission Regulation (EU) No 748/2012 to ensure the ongoing safe operation of the ATR42/72 aircraft.
The European Union Aviation Safety Agency (EASA) has reviewed the ATR assessment of transient elevator deflections associated with a pitch disconnect. It has been based on a study of the control cable elasticity, the results from a full-scale static test as well as a dedicated flight testing campaign, on top of other analysis. EASA agrees with ATR that the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope.
The ATSB considers that this recommendation has been adequately addressed.
