Control - Other

History of the flight

The Airbus A330-341 aircraft was operating a scheduled international fare-paying passenger service from Adelaide to Melbourne and the pilot in command was the handling pilot for the flight. During the initial descent into Melbourne, the crew configured the auto flight system to the approach mode. That action armed the auto flight system localiser and glideslope modes for the runway 16 instrument landing system (ILS), and permitted the crew to engage the second autopilot for the approach. As the aircraft descended through 2,500 ft, the crew placed the ground spoiler handle to the armed position. Shortly after, the radio altimeter indications disappeared from both pilots' electronic flight instrument displays. Both autopilots then disengaged. About 20 seconds later, both flight directors disengaged from the localiser and glideslope modes but re-engaged in the basic modes of current vertical speed and heading.

The pilot in command elected to continue the approach and to manually fly the aircraft, because he considered that he would be able to control the aircraft without auto flight system approach commands or radio altimeter information. The autothrust was unaffected by the disengagement of the autopilots, and remained engaged.

At the completion of the landing approach, the pilot in command flared the aircraft for the landing, and retarded both thrust levers, which disengaged the autothrust system. The aircraft landed on the left and right main landing gears, bounced, and became airborne for four and a half seconds before touching down again on both main landing gears. The aircraft bounced again, became airborne for one second, and then touched down for a third time on both main landing gears. The right main landing gear then lifted off the runway for about one second, after which the aircraft settled onto both main landing gears. Two seconds later, the thrust levers were advanced to go-around power, and after a further five seconds, the aircraft became airborne again. The nose landing gear remained airborne throughout this sequence. Additionally, the ground spoilers did not deploy, and the thrust reversers did not activate.

The pilot in command repositioned the aircraft for another approach onto runway 16. During the second landing, the aircraft again bounced following the touchdown, then settled onto the runway. Four seconds later, the ground spoilers deployed; however, the thrust reversers did not activate when selected by the crew. The landing rollout was completed without further incident, and the aircraft was taxied to the terminal.

There were no injuries to any persons on board the aircraft.

Aircraft information

The aircraft was a fly-by-wire type. Three flight control primary computers and two flight control secondary computers controlled the flight control system. The computers processed crew and autopilot inputs to provide appropriate electrical output signals to the hydraulically powered flight control surfaces.

Crew input to the flight control computers was made via electrical signals from either of the two side stick controllers, and autopilot input was made via an interface with the aircraft's Flight Management and Guidance System.

The inputs to the flight control computers were processed in accordance with respective flight control 'laws'. Regardless of the pilot's inputs, the control computers will prevent excessive manoeuvres and/or exceedance of the safe flight envelope. Those laws were dependent on whether the aircraft was in the ground, flight or flare mode of flight. In the ground mode, there was a direct relationship between sidestick deflection and the flight control surfaces. In the flight mode, deflection of the flight control surfaces was governed to achieve a load factor proportional to sidestick deflection, independent of speed. Flight mode provided 3-axis control of the aircraft, and provided flight envelope protection and manoeuvre load alleviation.

In the flight mode, the normal laws were:

• Nz law for pitch control, including load factor protection. (Nz law is vertical acceleration in the normal axis of the aircraft);
• lateral normal law for lateral control (roll and yaw), including bank angle protection; and
• protection against high speed (VMO), pitch angle (theta), and stall (angle of attack).

In flare mode, the normal laws were:

• flare law in place of Nz law for pitch control to allow for conventional flare;
• lateral normal law for lateral control (roll and yaw) including bank angle protection; and
• protection against stall.

Flare mode permitted crews to use the same landing technique as for non-fly-by-wire aircraft. Transition from flight mode to flare mode occurred when the aircraft's radio altimeters sensed that the aircraft altitude was less than 100 ft above ground level.

If faults were detected in both radio altimeters, switching from flight mode to flare mode would occur when the landing gear was extended, provided the autopilot was off. If the autopilot was engaged, switching from flight mode to flare mode would occur when the autopilot was disengaged, provided the landing gear was extended.

The manufacturer reported that flight tests for the A330 type included landing in flight mode. ie without transition to flare mode. Landing in that condition was not considered difficult, however, it required a different handling technique than would otherwise apply for non-fly-by-wire aircraft. In such circumstances, a pilot would need to apply back pressure on the sidestick to initiate the landing flare, then release that back pressure to maintain the desired pitch attitude until touchdown.

The aircraft was equipped with two radio altimeter systems that provided information about the aircraft height above ground level. Data from the radio altimeters was also used by many of the aircraft systems' logic sequences to determine whether certain operating parameters had been met to permit operation of a particular system. The radio altimeter antennas were located along the keel of the aft fuselage of the aircraft, and were connected to the aircraft electronic system by coaxial cables. Inspection of the radio altimeter system antennas subsequent to the occurrence revealed that they had sustained water ingress at the antenna coaxial cables. The water ingress into the radio altimeter antennas resulted in the radio altimeter signals being interpreted as out of range signals, rather than as a failure of the radio altimeters.

During the period 11 June 2001 to the date of the occurrence, there were 19 entries in the aircraft's maintenance log reporting problems with the radio altimeters fitted to the aircraft. Repairs had been carried out on the radio altimeters, including replacement of a transceiver unit and cleaning of components due to water ingress.

The aircraft was equipped with autoflight and flight director systems. Radio altitude signals from the aircraft radio altimeters were used to engage the autoflight system into the LAND mode when the aircraft altitude was 400 ft above ground level. The loss of valid radio altimeter signals in LAND mode would result in the loss of both autopilots and the flight directors reverting to the basic modes of vertical speed and heading. The autopilot also used radio altitude signals to adapt the autopilot gains during an ILS approach, with the required gain being dependent upon the distance of the aircraft from the runway threshold. Any involuntary disconnection of the autopilot triggered an AP OFF INVOLUNTARY warning message to the crew.

The aircraft was equipped with wing mounted ground spoilers. The ground spoilers would arm when the crew placed the speed brake control lever to the armed position, and would activate after landing provided certain parameters had been met. Those parameters included both main landing gears transitioning from flight to ground ('weight on wheels'), and a radio altitude of less than 6 ft or a wheel speed higher than 72 kts on the front and rear wheels of the main landing gears.

The aircraft's engines were equipped with thrust reversers. Deployment of the thrust reversers would not occur unless the aircraft was on the ground with the ground spoilers extended, radio altitude less than 6 ft, and the engine thrust levers in the reverse position.

The aircraft was equipped with an Allied Signal solid state digital flight data recorder. The recorded data was examined and revealed that each of the flight control primary and secondary computers had operated normally throughout the flight. The recorded data revealed that during both approaches, the autopilots oscillated in the lateral and longitudinal axes.

Both autopilots disconnected simultaneously, but an AP OFF INVOLUTARY warning did not accompany the disconnection. The LAND mode engaged at 400 ft radio altitude. One second later, both flight directors disengaged from the localiser and glideslope modes, then re-engaged in the basic modes of current vertical speed and heading. The recorded data also revealed that the signals from both radio altimeters were invalid throughout most of both approach sequences into Melbourne.

The investigation was unable to determine the relevant experience and training of the crew.

A Cessna 404 Titan aircraft was engaged in low level geophysical survey work near Tennant Creek, NT. The pilot reported that as he was manoeuvring the aircraft at the completion of a survey run, he became aware that the aircraft's response to aileron control input was reduced. He was able to roll the aircraft to wings level attitude using a combination of aileron and rudder, before climbing the aircraft to approximately 6,000 ft and returning to Tennant Creek aerodrome.

Examination of the aileron control system by company maintenance personnel revealed that one of the aileron cables had separated near a change of direction pulley below the control pedestal in the cockpit. Company maintenance personnel reported that there were no obvious signs of fatigue or wear at the failure point and that the reason for the failure was not immediately apparent. The cable could not be identified by manufacturer or part number.

The aircraft had undergone a routine scheduled maintenance inspection 29 hours prior to the event. The engineer reported that it was difficult to inspect the cable in the area beneath the control pedestal during normal scheduled inspections. It was suggested that the only way to adequately examine it would be to disconnect and remove it in accordance with the manufacturers major maintenance requirements.

The aircraft logbooks showed that the aircraft was manufactured in 1981, and had been imported into Australia from Indonesia. At the time of the occurrence, it had a total time in service of 3,853 hours. The aircraft logbooks did not indicate any previous replacement of the aileron cable.

The maintenance engineer advised that, following the incident, he submitted the cable and a detailed major defect report to the local CASA office. CASA Airworthiness advised that their examination was not able to identify the reason for the failure with any certainty. They confirmed that there were no serial or part numbers on the cable and that it was probably not the correct specification for this type of installation. The most likely scenario was that the cable was manufactured and fitted to the aircraft in Indonesia.

The aircraft was being operated as a scheduled passenger service from Sydney to Seoul, with the co-pilot as the handling pilot. The crew reported that the pre-departure flight control checks were normal. Shortly after becoming airborne from runway 34L, the co-pilot advised the pilot in command (PIC) that his control wheel had become jammed when attempting to make right wing down aileron inputs. The PIC took control of the aircraft and confirmed that his control wheel also had become jammed. He retained control of the aircraft and the co-pilot advised Air Traffic Services (ATS) that the aircraft was unable to turn to the right. He requested left turns and radar vectors to the south for fuel dumping prior to returning to land. ATS initiated a distress phase. The crew actioned the emergency/abnormal checklist for jammed or restricted flight controls, which includes the statement "use maximum force, including a combined effort by both pilots, if required", but they reported that their attempts made no change to the system. After fuel dumping was completed, the aircraft was vectored, using left turns only, to the runway 34L localiser and configured for the landing. At about 400 ft on final approach, the aileron controls became free and an uneventful landing was carried out.

Inspection by ground engineers determined that a plastic cable guard in the left aileron control cable system had broken. Pieces of shattered plastic were found in the vicinity of the left lower cable pulley system in the vertical cable run behind the cabin sidewall, forward of door 1L. The debris and all the remaining guards were removed from both left and right side vertical cable runs. The lateral control system, including the load limiter system, could not be faulted during full system testing. As there were no replacement cable guards available, the aircraft was approved to return to service with the guards removed.

The lateral controls on the aircraft consist of hydraulically powered inboard and outboard ailerons and flight spoilers on each wing. The controls are connected to the cockpit control wheels by cables, for pilot input. The cable runs are duplicated on each side of the aircraft. The left and right cable runs terminate at quadrants at the bases of the left and right control columns respectively. The control columns are interconnected by a cable loop connected to separate quadrants at the bases of the columns. The right quadrant includes a load limiter which consists of a detent and spring-loaded cam assembly. The load limiter is designed to "break away" under applied force by the crew to enable one control wheel to provide lateral control input should the other side jam for any reason. Roll control is then available, but considerable force is required to overcome the detent cam in the load limiter. Other Boeing aircraft types utilise similar systems.

The aircraft manufacturer issued a Service Letter, 747-SL-27-134, in December 1993, advising that broken cable guards could result in high control wheel forces and suggesting that operators should replace the guards with improved parts when replacement is required. The guards on the right control system on the incident aircraft showed evidence of deterioration, as one guard had been previously repaired with adhesive tape.

The aircraft was leased from an overseas operator. Under the terms of the lease agreement, all major maintenance was conducted by the lessor. The last major maintenance inspection was completed on 25 August 1995. At the time of the incident the aircraft total time in service time was 50,400 hours.

The crew remained at the aircraft whilst the defect was rectified. Both crewmembers remarked that they were surprised at the force required to overcome the load limiter when the system was tested. Though they were aware of the load limiting system from ground training instruction, they had never been physically exposed to the forces required to operate the system.