Flight control systems

The grade one flying instructor was ferrying the kit helicopter to Mangalore where he planned to teach the owner/builder how to fly it.

About five minutes after departure, at 2000 feet, the pilot noticed an abnormal forward position for the cyclic in the cruise.  Fearing that there may be a problem with the cyclic control rigging, he elected to turn back to the nearest airfield which was Pakenham.  The cyclic control suddenly became very heavy and difficult to push to the left. However, for a short time it remained free to move in other directions.  Then, without pilot input, the helicopter rolled to the right.  The pilot was unable to prevent a right turn.  When the helicopter had turned onto south, the cyclic suddenly became loose and then stiff intermittently.

Fearing that something in the control system was about to fail completely, the pilot entered autorotation in an attempt to descend and land as quickly as possible.  During the descent, the helicopter pitched nose high then low severely, to the extent that the pilot thought the main rotor might cut off the tail boom.  He discovered that by maintaining rotor RPM and raising the collective lever when the nose pitched down, and lowering the collective when the nose pitched up, he was able to use the secondary effects of collective control to counteract some of the uncommanded pitching and rolling.

Nearing the ground the pilot was able to execute a flare to eliminate all forward speed.  At about ten feet AGL, the helicopter pitched nose up and rolled to the right.  The pilot closed the throttle and allowed the helicopter to sink, expecting it to roll over on the ground.  However, he managed to land firmly without damage.  While shutting down, the pilot noticed that the cyclic was stirring in circles by itself.

Subsequently, the helicopter was inspected by engineers.  No restriction of the cyclic control system was detected.

The helicopter owner subsequently advised the investigating CAA Airworthiness Surveyor that there was mention in the manufacturer's data that cyclic control problems may occur in hot conditions.  On the day of this incident the outside temperature was 34 degrees Celsius.

The investigation by the CAA has revealed that the friction adjustment of the slider ball (uniball) was temperature sensitive and caused binding of the cyclic control system. The CAA considered that the instructions provided by the kit helicopter manufacturer to address the cyclic binding problem were unacceptable.

The CAA was not made aware of the potentially hazardous problem during the application for the amateur built aircraft approval process.  Until improved, the Rotorway EXEC 90 does not comply with the Australian flight characteristics requirements for amateur built helicopters.

Significant Factors

The following factors were considered relevant to the development of the incident:

1. The friction adjustment of the slider ball (uniball) was temperature sensitive.
2. Cyclic control binding resulted in significant loss of primary control in flight.
3. According to the CAA, manufacturer's instructions to rectify the potential cyclic control problem were inadequate.
4. Neither the helicopter manufacturer nor the Australian agent made the CAA aware of potential loss of cyclic control during the application for the amateur built aircraft approval.
5. The helicopter does not meet Australian design standards.
6. The pilot was unaware of a potential cyclic control problem until he encountered it in flight.

SAFETY ACTION

The CAA has withdrawn permits to fly the Rotorway EXEC 90 and will not issue a Certificate of Airworthiness to the helicopter type until convinced that the cyclic control system will operate in a satisfactory manner, with no mechanical degradation, and with a useful life, over a full range of temperatures including hot and cold soak likely to be encountered in normal Australian operations from minus 15 degrees Celsius to plus 45 degrees.

FACTUAL INFORMATION

History of the flight

During the pre-flight inspection, the pilot in command noticed that the elevators were drooping. He checked that the control lock was engaged and found that while the aileron and rudder systems were locked, the elevator system was not. He attempted to lock the elevators but was unable do so, nor could the engineer on tarmac duty. The engineer assured the pilot that, as the control lock system was rendered inoperative in flight, it would be safe to fly the aircraft and that the defect would be rectified when the aircraft returned to Brisbane later that day. The engineer was correct as the control locks are rendered inoperative in flight. The defect was then correctly deferred in accordance with Sunstate CAA approved Volume No.1 procedures, and the aircraft was subsequently despatched.

Soon after the aircraft became airborne, the co-pilot, who was the pilot flying the aircraft, notified the pilot in command that he believed there was a control abnormality in that more aft elevator than normal was required to rotate the aircraft. Upon reaching cruise altitude, the pilot in command took over the controls and confirmed that the control column was aft of its normal position when the aircraft was in level flight. Following a controllability check in the landing configuration, the aircraft returned to Brisbane. A subsequent inspection revealed that a rudder control rod had been fitted to the elevator control system, altering the geometry of that system and causing the abnormal control column position.

Maintenance aspects

The elevator and rudder control rod systems run parallel to each other and are routed through the ceiling of the aircraft in the area above the galley. Each system has a number of interconnecting rods which run fore and aft between roller guides. The elevator and rudder control rods are similar in appearance, but the elevator control rod is 35 mm longer than the rudder control rod.

On 3 October 1994, a licensed aircraft maintenance engineer had raised a deferred maintenance control sheet for replacement of the "elevator control rod L/H above toilet cabin dividing wall". (When facing forward in the aircraft, the left rod is the rudder control rod). A parts order form was submitted to order a new elevator control rod.

On 11 November 1994, another maintenance engineer found that the elevator control rod referred to on the deferred maintenance control sheet did not require replacement. Consequently, the elevator control rod which had been ordered was not required and was returned to the parts store. However, this engineer noticed that the adjacent rudder control rod was excessively worn so he raised a deferred maintenance control sheet for that item. A replacement rudder control rod was ordered on 15 November 1994 and arrived on 9 December 1994.

A periodic maintenance inspection was carried out on the aircraft during the weekend of 10 and 11 December along with maintenance which had been deferred. On 10 December work was started on the control rod change as required by the deferred maintenance control sheet form SA113. The form was part of a work package which detailed the tasks to be carried out during the maintenance period. The engineer who recorded the elevator control rod defect on 3 October assigned himself to the task of changing the rod.

The word "RUDDER", approximately 100 mm long, was pencilled on the old rudder control rod and the elevator rod was marked with the letters "ELEV". During discussions, the Maintenance Manager indicated that the wording may have been placed on the rods in order to prevent confusion at aircraft assembly. It has since been noted that various rods throughout several aircraft have the particular system name pencilled on them. This appears to have been an unofficial factory procedure. The local Short Brothers Technical Representative was advised by the factory that "the operator should read the part number".

The engineer who replaced the rod incorrectly identified the worn rod as the rudder control rod. He then removed that rod, which was in fact the elevator rod, without positively identifying it. After obtaining the new rudder rod from the parts store, he did not compare it with the old rod because he was called away to do another job and placed the new rod, still in its container, on a workbench. When he returned to the task, he removed the new rod from its container and fitted it to the aircraft. He did not notice that the old rod had a different part number printed on it, had the letters "ELEV" pencilled on it, and was longer than the new rod.

On completion of the work another engineer was asked to perform a "dual inspection." This inspection was required by the maintenance control manual volume one, the manufacturer's maintenance manual where it is referred to as a "duplicate inspection", and Civil Aviation Regulation 42G (1) where it is referred to as an "independent inspection". The engineer who performed this inspection had been multi-tasked and was doing unplanned work when he was asked to carry out the duplicate inspection. After being shown the rod that had been changed, he checked it for security and freedom of movement. He subsequently countersigned the duplicate inspection certification sheet.

The duty senior engineer reported that towards the end of his shift, when he was compiling the paperwork, he found that the signatures on the duplicate inspection sheet had been incorrectly placed in the aileron column at the top of the sheet. He said that he had pointed this out to the engineer who performed the inspection, who subsequently took the sheet to the engineer who had changed the rod. The inspecting engineer returned the sheet to the senior engineer with the word 'aileron' crossed out and the word 'rudder' written above it. The work was completed by 0830 hours on 11 December.

As a result of the incorrect rod being installed in the elevator system, the elevator control lock was rendered inoperative due to the altered geometry of the control system.

At about 1745 hours on 11 December, the aircraft was towed from the hangar for an engine run. The flying controls are required to be locked during towing, when the aircraft is parked, and when it is taxied by engineers. The engineer who towed the aircraft from the hangar did not notice that the elevator control could not be locked.

Standard company procedure is to engage the flight control lock prior to commencing an engine ground run. The elevator system could not be locked so the engine run was commenced with the elevator control lock disengaged. The control lock must be disengaged if ground runs in excess of idle are required in order for power levers to be advanced past the control lock baulk.

A daily inspection certificate was signed on the Maintenance Log of the day at 0300 hours on 12 December, certifying that the items on the daily inspection schedule in the maintenance control manual volume two had been carried out. The last item on the schedule states: "Flight controls and trim controls full and free and correct operation". The certifying engineer for this inspection did not notice that the elevator control lock could not be engaged.

The aircraft was then towed from the hangar to the apron on the opposite side of the airport. The fact that the elevator control lock could not be engaged was not noticed.

Maintenance manuals

The Shorts SD3-60 maintenance manual, the Civil Aviation Regulations and the operator's maintenance control manual volume one, contain specific details regarding maintenance practices with control rods. Both engineers involved in the rectification work indicated that these publications had not been consulted before or during the performance of the work.

A new version of the operator's maintenance control manual volume one was approved by the Civil Aviation Authority on 11 February 1994 and was implemented by the operator thereafter. Copies of the maintenance control manual volume one were located in the company's technical library and also in the hangar at a workstation which houses other paperwork and forms. Investigation of staff awareness and training revealed that both engineers had undergone familiarisation with the maintenance control manual volume one on Tuesday 15 March 1994.

Personnel information

The engineer who performed the rudder rod replacement was appropriately licensed and endorsed to perform the task. He joined the airline in March 1991 and held airframe and engine ratings. He had two rostered days off immediately prior to the occurrence but had worked three-night shifts before that. He indicated that, despite the two days off, he still felt tired on the day of the incident and thought this was because he had not fully recovered from the three-night shifts. He did not at any time advise his immediate supervisor or senior managers that he was fatigued. The engineer had been involved in three car accidents which affected his ability to work on stands, operate some tools, and write legibly. The company had not at any time been made aware of the car accidents. The management was aware of the engineer's unsteadiness whilst he was working on stands, and the engineering manager had discussed the problem with him some weeks prior to the incident. He had agreed to see a company doctor.

The engineer who performed the dual inspection was correctly licensed and qualified to carry out the task. He held engine and airframe ratings. He had been rostered off for four days prior to the occurrence.

Shift roster

The operation of the airline is dependent on co-ordinating maintenance requirements with operational requirements to achieve the schedule. This involves the conduct of the maintenance at night and on weekends. The shift roster consists of two crews of seven engineers and four crews of two engineers. The seven-person crews work three-night shifts, two days off, two-day shifts, three days off, two-night shifts, and then two days off. The two-person crews work two-day shifts followed by two-night shifts and then have four days off. The two-night shifts commence at 1715 and finish at 0415 the following morning. The remaining seven-person crew commence at 1800 and finish at 0425, while the day shift commences at 0600 and finishes at 1700.

The engineer who fitted the rod incorrectly was on the two-day roster after having worked three nights. He did not consider two days off adequate time to recover after working three 10.4 hour night shifts. Some engineers felt that their health suffered because of the roster, while others indicated that they felt fatigued much of the time because of the interrupted sleep pattern. The matter was an industrial issue at the time, and when the company recently announced that four permanent day shift positions would become available (with corresponding reduction of penalties and allowances) no engineers were forthcoming for the shift change. As a result, company management considered the shift structure was not a serious issue.

The night shift engineers were isolated from the day crews as the shifts did not overlap. Some engineers felt that management did not appreciate their concerns about matters that had safety implications. This latter issue seemed to be more a result of inadequate communication between management and the engineering staff but nevertheless resulted in discontent and attitudinal problems for some engineers.

Working environment

The maintenance facility is approximately 3 km from the airline's apron, and this reportedly caused inconvenience as aircraft had to be towed or taxied from one side of the airport to the other for maintenance. The airline used the parent company's hangar for maintenance and did not have a dedicated area that was close to the parts store and the technical records. This often required engineers to walk long distances from the working area to the other facilities and was an annoying aspect of the work environment.

Regulatory aspects

During the Bureau of Air Safety Investigation's survey of the maintenance facility, some regulatory discrepancies were identified. The discrepancies included aspects of training, daily inspections, and quality assurance.

Training

There was no training program in place in accordance with Civil Aviation Regulation 214. This regulation refers to the training of maintenance personnel, and states that the operator shall make provision for the proper and periodic instruction of all maintenance personnel, and the training program shall be subject to the approval of the regulatory authority.

Daily inspections

Reference copies of the daily inspection schedule were not located in the aircraft or the tarmac office. At ports where engineering staff were not available to conduct daily inspections, pilots signed the maintenance log to reflect that they had completed the daily inspection schedule when the check was actually completed in accordance with a pre-flight check schedule. Consequently, some items on the daily inspection schedule were being signed for when in fact they had not been performed.

Quality assurance

The company did not employ a quality assurance inspector but was subject to periodic inspections from the parent company. This did not facilitate a day to day, hands on approach to quality assurance. However, systems that exceeded Civil Aviation Authority requirements were in place at the time of the incident and both licensed aircraft maintenance engineers had attended a briefing on the Volume No 1 procedures following their introduction.

ANALYSIS

The engineer who had incorrectly identified the rod tasked himself with fitting the new rudder rod. He did not follow basic procedure and practices and fitted the incorrect rod. A "safety net" failed when an adequate duplicate inspection of the system was not carried out. The engineer responsible for the duplicate inspection had been multi-tasked and was doing unplanned work when he was asked to do the inspection. His attention was divided at the time, and this may have influenced the amount of time he spent on the inspection. There was however adequate time to correctly carry out the inspection. The written procedures were not adhered to, and the independent inspection failed to detect that the wrong control system had been worked on.

Training

No formal training course had been conducted for the aircraft type, nor was one required, as it is a 'Group One' aircraft. Familiarisation training had been conducted by the aircraft manufacturer prior to the incident and one of the involved engineers had attended this training. The non-adherence to established procedures may indicate a poor attitude toward compliance with the maintenance control manual and manufacturer's maintenance manuals.

Design

Although the rods were clearly marked with identification numbers, and the attachment fittings were identical, the length of the rudder control rod was not compatible with the design requirement of the elevator control system. A more effective design is necessary to prevent the inadvertent interchange of incompatible components. This could be achieved by the use of dissimilar attachment fittings.

CONCLUSIONS

Findings

1. The maintenance engineers were correctly licensed to carry out the task.
2. The engineer incorrectly identified the worn rod as an elevator control rod.
3. A new rudder rod was fitted to the elevator control system.
4. The effect of the new rod on control deflections was not checked after work was completed.
5. The engineer responsible for carrying out a duplicate inspection did not recognise that the elevator system had been worked on instead of the rudder system.
6. The duplicate inspection was not carried out in accordance with published procedures.
7. The elevator control lock could not be engaged. This was not detected by the engineer who conducted the daily inspection.
8. The pilot was unable to lock the controls during his pre-flight inspection.
9. An engineer advised the pilot that the malfunctioning control lock was not a major defect.
10. There was no formal SD3-60 training course for engineering staff.

Significant factors

1. The worn control system was incorrectly identified by the engineer who replaced the rod.
2. The new control rod to be fitted was not compared with the old rod which had been removed. The rudder rod and the elevator rod were similar in appearance.
3. The duplicate inspection was not carried out in accordance with published procedures.
4. The elevator control lock malfunction was not diagnosed fully, and to allow the aircraft to be despatched, the item was deferred in accordance with company procedures.

SAFETY ACTION

The Bureau of Air Safety Investigation issues safety advisory notice SAN  960055 to the Civil Aviation Safety Authority.

The Bureau of Air Safety Investigation highlights this occurrence to the Civil Aviation Safety Authority (CASA) with particular reference to the transposition of the elevator and rudder control rods. The Bureau suggests CASA review certification standards to prevent the possibility of incorrect components being fitted to primary flight control systems and bring this to the attention of recognised authorities.

The Bureau also draws CASAs attention to the findings regarding maintenance surveillance and suggests that CASA review its surveillance activities with regard to RPT operators to ensure compliance with Civil Aviation Regulation 214.

The operator has advised that the following actions have now been taken:

1. Basic familiarisation training on the Shorts SD3-60 aircraft for some company maintenance employees. Each employee will have all documentation relating to training placed upon his or her personal file following a particular training exercise.
2. Revision and update of the maintenance control manual and associated documentation including daily inspection schedules for pilots and maintenance engineers. The pilot's daily inspection schedule appears in Part B of the company's Shorts SD3-60 operations manual. Pilots and maintenance engineers certify completion of the daily inspection in the maintenance log form SA102.

The aircraft made a normal approach and landing on runway 05. As the aircraft was approaching the parking bay tarmac personnel noticed that a section of leading-edge flap was missing from the right wing outboard leading edge. This was later found by the aerodrome safety officer during a runway inspection.

The crew reported that the aircraft had operated normally during the flight.

Investigation revealed that after departure from Melbourne, as the leading-edge flaps retracted, the follow-up mechanism malfunctioned allowing the flap actuator to continue driving the flaps when fully retracted. This caused a flap attachment bracket to fail. When the flaps were selected down the actuator operated normally, with no abnormal indications noticed by the crew. The section of flap associated with the failed bracket separated from the aircraft after landing.

The cause for the follow up mechanism to malfunction could not be determined, and a report from the company has not been forthcoming.

More than usual forward trim was required during and after take-off. The autopilot trim actuator ran out of forward trim and then ran continuously to full aft. The crew were unable to adequately manually trim forward. The aircraft returned for a normal descent and landing.

The autopilot Mach trim actuator was found to be inoperative. The actuator had been fitted during overnight maintenance and the observed problem occurred on the first flight after installation. Ground test procedures after installation had not shown up any problems.

Workshop rectification found anomalies with the backlash on the jackscrew and with the actuator length. The manufacturer advised that these anomalies would not have caused the problem that was experienced.

The actuator was refitted four days after the workshop check and has since operated satisfactorily. The cause of the inflight problem was not discovered.

Because of the condition of the strip, the technique the pilot used for take-off was to set 20 degrees flap and apply almost full back elevator control to lift the aircraft off the ground at low airspeed and to then accelerate in ground effect before climbing away. On this occasion, after lift-off at 55 kts, the control column became jammed near the fully back position. The aileron control was partially jammed.

At about 300 ft, with the aircraft in a high nose attitude and the airspeed decreasing through 40 kts, the pilot reduced engine power and the nose attitude decreased. He was able to climb the aircraft to about 500 ft and maintain pitch control through the use of engine power and flap. The rudder was used for roll control.

The pilot conducted a straight-in approach to Inverell and landed safely.

Post-flight inspection revealed that a multi-pin plug had become detached from an ADF indicator unit in the instrument panel. The plug had lodged in the slide channel for the control column, thus causing the restriction.

On 7 March 2014, a Fokker 100 aircraft, registered VH-FZO, departed Perth on a scheduled passenger flight to Argyle, Western Australia. On board was a captain designated as the pilot flying (PF), and a training captain, seated in the right seat, designated as the pilot monitoring (PM).

During the cruise, the aircraft pitched down and both thrust levers came back towards idle to maintain the selected speed during the descent. The rate of descent reached about 1,700 feet per minute and the aircraft descended about 300 ft. The PF then disconnected autopilot 1 and connected autopilot 2.

The aircraft continued to Argyle and the crew commenced descent to the aerodrome. When at about 1,000 ft above ground level (AGL) and about 3 NM from the runway threshold, the PF stated that the thrust levers were stuck. The PM then tried to move the thrust levers and confirmed they were stuck. The PM applied force with both hands on the thrust levers and they jerked forwards, resulting in about a quarter of the normal available thrust. The PM directed the PF to get the aircraft back onto the normal profile and the PF extended full flap. Just prior to touchdown, the PM extended the speed brake and when at about 10 ft AGL, he applied sufficient force to move the thrust levers to the idle position. Engineers found that an elevator servo and a thrust lever servo had failed.

This incident provides an excellent example of how an experienced crew faced with a novel and unanticipated threat, were able to modify their roles and work together to safely complete the flight.

Aviation Short Investigations Bulletin - Issue 33

On 7 June 2013, during a routine inspection at Auckland International Airport, New Zealand of a Jetconnect Boeing 737-800 aircraft, registered ZK-ZQG, maintenance personnel discovered damage to the horizontal stabiliser mechanism.

An investigation into the circumstances of this incident is being conducted by the Transport Accident Investigation Commission (TAIC) of New Zealand. The TAIC investigation reference is 13-007/AO-2013-007.

On 29 January 2014 the TAIC requested Australian Transport Safety Bureau (ATSB) assistance in gathering aircraft maintenance information from the Australian-based maintenance provider and certain of its personnel. In accordance with paragraph 5.23 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation, the ATSB appointed an accredited representative to the TAIC investigation. To facilitate this support, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003. The information gathered by the ATSB was provided to the TAIC on 28 March 2014.

The TAIC is responsible for, and will administer the release of the final investigation report into this incident. Any enquiries regarding the TAIC investigation should, in the first instance, be directed to:

Deputy Chief Investigator of Accidents
Transport Accident Investigation Commission
PO Box 10323, The Terrace
Wellington 6143, New Zealand.

Telephone: +64 4 473 3112
Facsimile: +64 4 499 1510

www.taic.org.nz

______________

Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

On 5 August 2013, a Cirrus SR22T aircraft, registered VH-LBQ, was being operated on a private flight from Archerfield to Kingaroy, Queensland.

On approach to Kingaroy, at about 500 above ground level (AGL), the pilot extended the flaps and shortly after, disconnected the autopilot (AP). Upon disconnecting the AP, the pilot reported that the aircraft pitched-up violently due to trim runaway. The AP pitch trim was trimming the aircraft for a nose-up position, even though the AP was disconnected. This required the pilot to use a large amount of forward physical force to maintain stable flight. He attempted to resolve the problem by pressing and holding the autopilot disconnect switch (AP DISC), however, this had no effect. The pilot conducted a go-around.

He then used the manual electric trim (MET) hat switch located on the control yoke, in an attempt to trim the aircraft nose-down. The pilot was able to regain sufficient control of the aircraft and land safely at Kingaroy.

On the basis of the evidence available to the ATSB, it was not possible to determine, with any certainty, the reason for the pitch-up event.

This occurrence highlights the safety benefit to be gained from going around, which allowed the pilot time to troubleshoot and prepare for landing with the pitch trim difficulties. This decision helped ensure the aircraft landed safely.

Aviation Short Investigation Bulletin - Issue 26

On 20 September 2011, a Cessna Aircraft 550 Citation II aircraft, registered VH-INT, was involved in a ground towing accident when a Fokker F100 under tow collided with the tail of the parked Citation. The collision resulted in damage to the left elevator, rudder and rudder trim control surfaces that necessitated the Citation undergoing repairs.

On 06 December 2011, while conducting a post-maintenance flight, the crew experienced control problems. The resulting post-flight inspection found several maintenance procedural omissions and rigging inconsistencies.

A review of the maintenance system and processes for return to flight and the acceptance flight versus training flight protocols was conducted respectively by both the maintenance and operator organisations and corrective actions taken.

The pilot was conducting a flight to check the output of the spray system fitted to the aircraft. During the take-off he heard a noise from the rear of the aircraft and noticed something moving away from the aircraft. He continued with the take-off and two spray runs before positioning the aircraft on a downwind leg for landing. As the aircraft was turned onto the base leg the pilot realised that he could not apply left rudder. The pilot stated that he then intended landing the aircraft on the base leg but found that cone markers blocked the path. The aircraft was then lined up with and landed on runway 22. An inspection determined that the leaf-spring mounting that retains the tailwheel had failed due to fatigue. The loss of rudder control experienced by the pilot resulted from the bending of the left rudder to tailwheel control arm so that adequate left rudder could not be applied. It is considered that the leaf-spring failure should have been detected during routine maintenance or pre-flight inspection.