Flight control systems

On 30 April 2005, the pilot of a Beech Aircraft Corporation V35A Bonanza aircraft, registered VH-FWE, was conducting a private flight from Lilydale, Vic. to Temora, NSW. The pilot reported that while cruising at 7,500 ft, there was a loss of aileron control. Initially the aircraft tended to drift to the right, which he corrected by rolling the aircraft to the left. He then felt something break and the right wing dropped. He turned the aileron control yoke to the left, until it was almost upside down, but the aircraft continued rolling to the right and entered a progressively steeper descent. The pilot broadcast a PAN¹advising air traffic control that he had an aileron control problem and that he would attempt to land the aircraft on a local glider field. He reported that he arrested the roll by extending the landing gear, adjusting engine power and applying full left rudder. The pilot subsequently landed the aircraft without the use of wing flaps.

Aircraft

The aircraft was manufactured in 1969 and had recorded 6,154.8 hours in service at the time of the incident. It was maintained in accordance with the applicable maintenance requirements and had a valid Maintenance Release. It had flown approximately 22.9 hours since the last periodic inspection completed in March 2005.

Aileron control examination

When examined, the aircraft's left aileron was found deflected to the fully down position and the right aileron fully up. To return the ailerons to their neutral position, a force was required to overcome the tension of the rudder interconnect bungee spring. Once the force was removed, both ailerons returned to the fully deflected positions. The examination of the aileron control cables revealed that the right aileron 'up' cable terminal, located in the rear spar carry through structure, had failed.

The aircraft manufacturer advised that since the aileron control cables are connected to the rudder interconnect bungee spring, the separation of the right aileron up cable would result in that spring forcing the left aileron down and the right aileron up (Figure 1).

Figure 1: Aileron control system

Terminal examination

The failed control cable terminal was sent to the Australian Transport Safety Bureau (ATSB) for examination. The terminal shaft that is screwed into the turnbuckle had fractured close to the locking wire attachment point (Figure 2). The examination revealed that the fracture was initiated by stress corrosion cracking² that had propagated under the surface of the shaft and weakened it to the point of failure.

Figure 2: Failed control cable terminal

The cable terminal was a standard swaged fitting designated AN669. Chemical analysis of the material showed that its composition closely matched that of SAE-AISI 303 stainless steel. A recent US National Transportation Safety Board (NTSB) Safety Recommendation³ identified SAE-AISI 303 stainless steel as being susceptible to stress corrosion cracking when used in a corrosive environment. The Safety Recommendation mentioned that cracking propagates as a function of the time a component is exposed to the corrosive environment rather than its actual time in service and that 'about 18 to 20 years is required for terminals exposed to the most damaging environment to reach their fracture point'.

Terminal inspection

During routine aircraft maintenance inspection of control system cables, corrosion pits on the surface of the cable terminal shaft may be the only visual indication of a potential problem. With the shaft area being typically wrapped with safety wire, the shaft can be difficult to inspect.

In August 2001, The Civil Aviation Safety Authority (CASA) issued Airworthiness Bulletin 27-1 Issue 1, Control Cable Terminal Inspection that was also published on the CASA web site www.casa.gov.au. The Airworthiness Bulletin provided information regarding the susceptibility of control cable terminals made of SAE-AISI 303 stainless steel to failure due to stress corrosion and highlighted the 'importance of meticulous inspection of the terminals'. It recommended that aircraft older than 15 years, and using terminals constructed of SAE-AISI 303 stainless steel, should have their control cable terminals visually inspected on an annual basis.

A review of the aircraft's logbooks found no evidence of the aileron controls having been subjected to any specific inspections to detect corrosion, including the removal of lock wire, within the previous 15 years. Routine maintenance inspections had been conducted during that period.

Both the ATSB and CASA databases contained four reports of similar control cable terminal failures in the period between 1995 and 2004. The NTSB Safety Recommendation mentioned 10 instances of aircraft that were found having fractured or cracked control cable terminals.

1. PAN is a radio code indicating uncertainty or alert.
2. A cracking process that requires the simultaneous action of a corrosive environment, such as a chlorine-rich atmosphere in moist coastal areas, and sustained tensile stress.
3. US National Transportation Safety Board Safety Recommendation A-01-6 through -8 of April 16, 2001.

The Australian Transport Safety Bureau did not conduct an on-site investigation of this occurrence.

A Beech V35A Bonanza sustained a loss of aileron control while cruising at 7,500 ft. The pilot reported turning the aileron control yoke to the left, but the aircraft continued rolling to the right and entered into a progressively steeper descent. He arrested the roll by extending the landing gear, adjusting engine power and applying full rudder.

On 17 February 2005, a Boeing Company 737-838 aircraft, registered VH-VXN, with seven crew and 150 passengers, was being operated on a scheduled passenger flight from Adelaide, SA to Sydney, NSW. The crew reported that, as the aircraft was climbing through flight level (FL) 180 (18,000 ft), they noticed the stabiliser trim wheel moving opposite to the direction of the control column (elevator) movement.

The pilot in command was the handling pilot for the sector and was manually flying the aircraft when the movement was observed. The crew considered that the trim movement was uncommanded and consequently completed the non-normal procedure for a runaway stabiliser. As the non-normal checklist did not contain the words 'Plan to land at the nearest available airport', the crew levelled the aircraft at FL270 and continued the flight to Sydney.

Following the occurrence, a built in test equipment check was carried out on the flight control system and no faults were found. The two flight control computers were subsequently removed from the aircraft and tested at the operator's avionics workshop with no faults being found in either unit.

Previous flight

A different flight crew operated the aircraft on the preceding flight to Adelaide. That crew reported uncommanded stabiliser trim wheel movement while the aircraft was being taxied to the terminal, after landing at Adelaide. The crew also reported that when the aircraft was shutdown, the autopilot warning horn sounded. They did not notice any autoflight flight director system status annunciations on their respective Electronic Attitude Director Indicator (EADI), nor did they observe the illumination of the autopilot disengage indicator lights on the pilot and copilot instrument panels when the warning horn sounded. The operator's engineering personnel were advised about the apparent uncommanded movement of trim. A built-in test equipment check was subsequently carried out prior to the flight to Sydney but no fault was detected in the flight control system.

Stabiliser trim

The horizontal stabiliser is positioned by the main electric trim motor and is controlled through either of the stabiliser trim switches on each pilot's control column, or by the autopilot trim servo motor. The stabiliser may also be positioned by manually rotating the stabiliser trim wheels located on the control stand between the two pilots.

Pitch control of the aircraft includes a speed trim system. This system is used to improve flight handling characteristics during operations with low gross weight, rearward centre of gravity and high thrust when the autopilot is not engaged. The system provides positive speed stability characteristics to the pilot by adjusting the control column force so that the pilot must provide a significant amount of 'pull' force to reduce airspeed, or a significant amount of 'push' force to increase airspeed. The system trims the stabiliser in the direction calculated to provide the pilot positive speed stability characteristics. Since pilots typically attempt to trim control column force to zero and the speed trim system attempts to trim to positive stick force, the speed trim system operation may be opposite to the direction the pilot is trimming.

Autopilot flight director system

The autopilot flight director system is a dual system consisting of two individual flight control computers and a single mode control panel. The two flight control computers are identified as 'A' and 'B'. For autopilot operation, the computers send control commands to their respective pitch and roll hydraulic servos, which operate the flight controls through two separate hydraulic systems. For flight director operation, each computer positions the flight director command bars on the respective EADI located on the instrument panel for each pilot.

Either autopilot can be engaged in command mode or control wheel steering mode by pushing the appropriate engage switch on the mode control panel, which is located on the glare shield in front of each pilot (Figure 1).

If the autopilot flight director system is engaged in control wheel steering mode, the following system status annunciations will appear above the attitude indications on each pilot's EADI:

Flight data recorder information

Following the occurrence, data from the aircraft's flight data recorder (FDR) was downloaded and analysed by the aircraft manufacturer and the Australian Transport Safety Bureau (ATSB). The data indicated that during the previous flight the autopilot was engaged after landing at Adelaide. The autopilot was engaged by pushing the control wheel steering mode autopilot engage switch for the 'B' autopilot flight director system. The autopilot engagement occurred when the 'B' system flight director switch was selected to the OFF position while the aircraft was taxiing to the terminal. The flight director switches are usually selected to the OFF position by the crew while carrying out the 'taxi in' normal procedures when the aircraft has vacated the runway after landing.

The 'B' system flight director switch and the control wheel steering engage switch are in close proximity to each other on the glare shield mode control panel, above the centre instrument panel (Figure 1).

The data showed that various up and down trim movements were commanded by the autoflight flight director system following engagement of the control wheel steering mode after landing at Adelaide. The data also showed that the 'B' autopilot flight director system remained engaged when the FDR recording ended for that flight. The aircraft manufacturer advised that 'it is expected that it [the autopilot] disengaged later on (with warning horn) when additional power switching or configuration changes occurred.' The aircraft operator advised that the autopilot would have disengaged when the engines were shutdown and the electrical power source to the autoflight flight director system transferred from the engine driven generators to the auxiliary power unit driven generator.

The aircraft manufacturer also advised that, from their review of the FDR data, 'no trim anomalies could be seen on the following climb out [the occurrence flight]'.

On 17 February 2005, a Boeing Company 737-838 aircraft, registered VH-VXN, with seven crew and 150 passengers, was being operated on a scheduled passenger flight from Adelaide, SA to Sydney, NSW. The crew reported that, as the aircraft was climbing through flight level (FL) 180 (18,000 ft), they noticed the stabiliser trim wheel moving opposite to the direction of the control column (elevator) movement.

The pilot in command was the handling pilot for the sector and was manually flying the aircraft when the movement was observed. The crew considered that the trim movement was uncommanded and consequently completed the non-normal procedure for a runaway stabiliser. As the non-normal checklist did not contain the words 'Plan to land at the nearest available airport', the crew levelled the aircraft at FL270 and continued the flight to Sydney.

Following the occurrence, a built-in test equipment check was carried out on the flight control system and no faults were found. The two flight control computers were subsequently removed from the aircraft and tested at the operator's avionics workshop with no faults being found in either unit.

The pilot in command of the Fairchild Industries SA-227 aircraft, registered VH-HPE, operating a scheduled Regular Public Transport flight, reported that excessive forward control column force had been required 'to trim the aircraft nose down' during departure from Sydney Airport.

The Australian Transport Safety Bureau did not conduct an on-scene investigation of this occurrence.

On Monday, 22 March 2004, the pilot in command of the Fairchild Industries SA-227 aircraft, registered VH-HPE, operating a scheduled Regular Public Transport flight, reported that excessive forward control column force had been required 'to trim the aircraft nose down' during departure from Sydney Airport. The pitch trim selector was switched to the copilot position, control was passed to the copilot, who was then able to trim the aircraft, and the flight continued to Taree, NSW.  After landing, an examination by the crew revealed that the pilot in command's (left side) control yoke pitch trim switch was operating in the reverse sense from normal operation.

Discussions were held between the flight crew and the operator's chief pilot and chief engineer and a decision was made to continue with the following two scheduled flights before the aircraft returned to a suitable maintenance facility for rectification.  A subsequent engineering examination revealed that the pilot in command's pitch trim switch had been installed upside-down and had to be removed and re-installed in the correct orientation (refer figure 1).  The pitch trim system was checked for correct operation and the aircraft was returned to service.

Figure 1:  Left side pitch trim control switch

In the days preceding the occurrence, the aircraft underwent scheduled maintenance at a contractor maintenance facility.  During maintenance, there was a requirement to replace the left side control column pivot bearings.  To access the bearings, it was necessary to remove the control yoke and the control yoke pitch trim switch by de-soldering the switch wiring and removing the switch from the yoke housing.  After the control column bearings were replaced, the control yoke was re-installed and the trim switch wiring was re-soldered to the respective terminals.  The trim switch was then re-installed into the control yoke and the engineers reported that they conducted a full installation and duplicate functional check of the pitch trim system and completed the documentation in the aircraft maintenance worksheets.

During the investigation, the aircraft maintenance engineers responsible for the switch installation and functional check indicated that they had completed the work and that the duplicate functional check was conducted with no apparent discrepancies.  The aircraft was then handed over to other maintenance engineers for the completion of further maintenance tasks.  The following day, the scheduled departure of the aircraft was delayed due to on-going maintenance rectifications.  None of these further maintenance tasks involved the aircraft pitch trim system.  Following the delay, the aircraft departed on the occurrence flight after the crew had conducted pre-flight checks, including a check of the pitch trim system cockpit indication for correct operation.  The aircraft maintenance engineers had been assigned the maintenance tasks away from their normal location on a weekend and the aircraft was required for scheduled operations on the Monday morning.

The maintenance contractor and the aircraft operator conducted separate investigations into the trim switch misalignment and concluded that the only plausible scenario leading to the misalignment was that the engineers responsible for the pitch trim switch installation had installed the switch incorrectly. The discrepancy had not been detected during the installation and duplicate functional checks or the flight crew's pre-flight checks.

The type certificate data sheet holder for the aircraft type reported that the aircraft Minimum Equipment List (MEL) provides no relief for flight with one pitch trim system inoperative and so the decision to continue the scheduled flights in this condition was contrary to the requirements of the operator's flight operations manual.