Virgin Australia AT72 near Sydney on Feb 20th 2014, control disagreement causing excessive G-forces injures cabin crew and pitch controls disconnect

Last Update: May 24, 2019 / 17:10:11 GMT/Zulu time

Bookmark this article
Incident Facts

Date of incident
Feb 20, 2014

Classification
Accident

Aircraft Registration
VH-FVR

Aircraft Type
ATR ATR-72-200

ICAO Type Designator
AT72

On May 24th 2019 the ATSB released their final report concluding the probable causes of the accident were:

Contributing factors

- During the descent, when the sterile flight deck policy was applicable, the flight crew engaged in non-pertinent conversation. This distracted the crew and probably reduced their ability to monitor and respond to fluctuations of airspeed.

- While passing through about 8,500 ft on descent into Sydney, the aircraft encountered a significant windshear that resulted in a rapidly decreasing tailwind. This led to a rapid increase in the airspeed, with the airspeed trend vector likely indicating well above the maximum operating speed (VMO).

- Although the first officer (pilot flying) was in the process of attempting to control the airspeed, in response to the unexpectedly high airspeed trend indication, and their proximity to VMO, the captain (pilot not flying) perceived a need to immediately intervene, and made pitch control inputs before following the normal take-over procedure and alerting the first officer.

Inflight upset

- The addition of the captain’s and first officer’s nose-up control inputs resulted in a pitching manoeuvre that exceeded the limit load factor for the aircraft of 2.5 g.

- The magnitude of the captain's nose-up control input was probably greater than he intended, due to his response to a high stress level, but increased the probability that the aircraft's limit load factor would be exceeded.

Pitch disconnect

- Shortly after the captain initiated the nose-up control inputs, the first officer reversed his control input. The differential forces in the left (captain) and right (first officer) pitch control systems were sufficiently large to inadvertently activate the pitch uncoupling mechanism, disconnecting the left and right pitch control systems.

- Given the high airspeed, the asymmetric elevator deflections that occurred immediately following the pitch disconnect event resulted in aerodynamic loads on the tailplane that exceeded its strength and damaged the horizontal stabiliser.

- The design of the ATR 72 pitch control system resulted in limited tactile feedback between the left and right control columns, reducing the ability of one pilot to detect that the other pilot is making control inputs. In addition, there were no visual or auditory systems to indicate dual control inputs. (Safety issue)

Other factors that increased risk

- Inadvertent application of opposing pitch control inputs by flight crew on ATR aircraft can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react. (Safety issue)

- The aircraft manufacturer did not account for the transient elevator deflections that occur as a result of the system flexibility and control column input during a pitch disconnect event at all speeds within the flight envelope. As such, there is no assurance that the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect. (Safety issue)

- Flexibility in the ATR 72’s pitch control system between the control columns results in a change in the aircraft’s longitudinal handling qualities and control dynamics when dual control inputs are made. This could result in an aircraft-pilot coupling event where flight crew may find it difficult to control the aircraft. (Safety issue)

- The design standard for large transport aircraft, Joint Aviation Requirements - Part 25 (JAR-25), did not require that the demonstrated potential for flexibility in the control system to develop transient dynamic loads, be considered during certification. Similarly, the current certification standard for Large Aeroplanes (CS-25) does not address this issue. (Safety issue)

- Although the design standard for the aircraft (JAR-25) required the control system to be of sufficient strength to withstand dual control inputs, it did not require consideration of the effect that dual control inputs may have on control of the aircraft. Similarly, the current design standard (CS-25) does not address this issue. (Safety issue)

Other findings

- The pitch disconnect warning system in the ATR 72 did not alert the flight crew to the pitch disconnect until after the resulting aerodynamic loads had exceeded the strength of the horizontal stabiliser.

- The aircraft manufacturer and aircraft operator provided limited guidance to flight crew regarding the management of airspeed on descent and appropriate handling for recovery from an imminent VMO exceedance.

- Senior Cabin Crew Member received serious injuries as a result of the recovery manoeuvre from the in-flight upset.

Inspection and continued operation

Contributing factors

- The licenced aircraft maintenance engineers involved in the Inspection after flight in turbulence and/or exceeding VMO did not carry out the specified general visual inspection of the stabilisers probably because of a breakdown in the coordination and certification of the inspection tasks. As a result, the damage was not detected and the aircraft was released to service.

Other factors that increased risk

- ATR did not provide a maintenance inspection to specifically assess the effect of an inflight pitch disconnect. As a result, if an in-flight pitch disconnect occurred, the aircraft may not be inspected at a level commensurate with the criticality of the event. (Safety issue)

- As a legacy of there being no inspection specific to an in-flight pitch disconnect, there is potential for other ATR aircraft to have sustained an in-flight pitch disconnect in the past and be operating with undetected horizontal stabiliser damage. (Safety issue)

- In the job instruction card JIC 05-51-11 DVI 10000 Inspection after flight in turbulence and/or exceeding VMO, the aircraft manufacturer did not specify the ground support equipment required or clearly state that the general visual inspection (GVI) of the stabilisers included a close examination of the upper surface. Given engineers tasked with the inspection may not be aware that ATR referred to the standard definition of a GVI, there was a risk that engineers tasked with the inspection would not interpret the card correctly.

- Toll Aviation Engineering did not define, document, or otherwise assure the intended arrangements for coordination of maintenance at line maintenance stations, which allowed for the development of local operating practices that were not consistent with the expectations of AMO management.

- Although Toll Aviation Engineering (approved maintenance organisation) specified fatigue management procedures, the licenced aircraft maintenance engineers (LAMEs) who were involved in the inspection after flight in turbulence and/or exceeding VMO operated outside the nominated hours of work. As such, the LAMEs were at risk of fatigue on the day of the inspection and/or the day following.

Other findings

- Maintenance engineers carried out line maintenance and flight crew carried out pre-flight inspections in the 5 days after the in-flight upset and inadvertent pitch disconnect without detecting the damage to the tailplane.

- The captain of the thirteenth flight of VH-FVR since the flight control event was diligent in the post-flight inspection of the aircraft following a suspected bird strike and having detected some damage to the tailplane prompted an effective engineering examination that identified the serious structural damage.

The ATSB released a number of safety recommendations, operator, maintenance organisation and ATR undertook a number of immediate safety actions.

The ATSB analysed the inflight upset stating, that while climbing through 8500 feet MSL the aircraft encountered a significant windshear resulting in a rapidly decreasing tail wind and associated increase in indicated airspeed with a speed trend indicating above maximum operating speed (VMO). Although there is no mention of this in the standard operating procedures it is implied that only one pilot at a time provides control inputs with specific procedures to transfer control from one pilot to the other.

The ATSB wrote:

The captain reported that he took the controls and disengaged the autopilot when he considered that the first officer’s actions were not going to prevent the aircraft from exceeding VMO. The information recorded on the FDR and CVR indicates that the captain made the ‘I have control’ call about 5 to 6 seconds after the first indications that he had taken hold of the control column, and about 3 seconds after the pitch disconnect. Additionally, the captain made what sounded like an instruction to the first officer to ‘pull it up’, after he had taken hold of the controls and at about the same time that the autopilot was disconnected. Thus, there was no communication to the first officer to alert him to the captain’s intention to take control of the aircraft until after the pitch disconnect. As such, there was no reason for the first officer to have stopped making control inputs to control the aircraft’s speed during that time. Indeed, there was a requirement that he not release the controls until the pilot not flying had advised that he/she had taken control of the aircraft.

The initially low loads in the left control system suggest that the captain had simply taken hold of the controls, possibly in anticipation of taking control, but about 1 second before the pitch disconnect, around the time that the autopilot disengaged, the captain’s side pitch axis effort loads increased. This indicated that the captain started to make a positive nose-up pitch control input.

This nose-up input occurred almost simultaneously with the first officer’s third nose-up input. This was probably coincidental because there was no verbal communication recorded and neither pilot indicated in interview that they were aware of the other pilot making coordinated control inputs.

The ATSB found that: In response to the unexpectedly high airspeed trend indication, and their proximity to VMO, the captain (pilot not flying) perceived a need to immediately intervene, and made pitch control inputs before following the normal take-over procedure and alerting the first officer (pilot flying).

The ATSB was not able to conclusively determine why the captain took so long to make the standard take-over call. However, as discussed below, there were a couple of aspects that probably occupied the captain’s attentional resources, distracting him from making the appropriate calls at the appropriate time.

There was some concern from the captain regarding a rescheduling of the next flight, resulting in a tight turnaround time. The concern was sufficient enough that the captain spent some time during this flight preparing for the next, rather than actively monitoring the current flight. In addition, the captain was engaged in operationally non-pertinent conversation in the 2 minutes leading up to the pitch disconnect. The cognitive resources that his concern about the tight turnaround and the non-pertinent conversation consumed probably degraded the captain’s ability to actively monitor the aircraft’s airspeed. It was not until the aircraft was rapidly approaching VMO that the captain’s attention returned to the task of monitoring the aircraft’s state, at which point his attention was probably captured by the large airspeed trend vector. At this point, there was very little time for the captain to follow the normal support process to escalate the response and instinctively decided that he needed to take immediate action to avoid a VMO exceedance.

The captain had sufficient experience on the aircraft type to have attained a ‘feel’ for how the aircraft would respond to his control inputs. He reported that he was expecting a ‘slight jolt’ as the autopilot disengaged and a gentle pitch-up. However, when he took the controls and disengaged the autopilot, the aircraft and control column did not feel, or respond, as he expected it to. The rapidly changing situation, and this difference in control feel, possibly distracted the pilot’s attention away from the standard take-over procedure, delaying the standard ‘I have control’ call until after the dual control inputs had resulted in a pitch disconnect. During this time, both flight crew made simultaneous control inputs without any indication of coordination.

The captain reported to the ATSB that he intended taking over control of the aircraft. There was no indication from the captain that his intention was to assist the first officer by adding to his control input. As such, it is unlikely that the captain was expecting the first officer to have been making control inputs after the captain took over. Given he was possibly distracted by the difference in control feel, the captain probably didn’t perceive the changes in the control forces to be related to the first officer’s control inputs.

During the investigation, the ATSB identified that the design of the pitch control system in the ATR 72 results in a degraded tactile feedback between the control columns, diminishing the effectiveness of an important communication channel. This aspect is examined in detail in the section of this analysis titled Control system design effects on pitch control system ‘feel’ - Degraded tactile feedback.

The dual control inputs resulted in two distinct safety outcomes; an in-flight upset (limit load exceedance) and the pitch disconnect. These are examined separately, in the following sections.

In-flight upset

The third nose-up control input made by the first officer was only marginally (about 8 per cent) greater than his previous, second, input. The second input resulted in an elevator deflection of about 3.5° and a maximum flight load factor of about 1.7g, about 70 per cent of the limit flight load factor of 2.5g. By comparison, it would be expected that had the third input been purely made by the first officer, the elevator deflection would have been marginally greater than the second, and the subsequent maximum load factor would have been well within the flight load limit. However, the addition of the captain’s nose-up input to the first officer’s nose-up control input produced a significantly greater elevator deflection, of about 8°. This resulted in a pitching manoeuvre that exceeded the limit load factor by about 34 per cent.

When assessing the effect of a single 45 daN control input, the manufacturer calculated that the elevator deflection from such an input would be about 4.7°. Noting that neither the first officer’s nor captain’s control column deflections alone should have resulted in the 8° elevator deflection recorded during the event, the ATSB carried out an engineering assessment of the ATR 72’s pitch control system design. The aim of this assessment was to determine why the elevator deflection from dual control inputs was significantly greater than a single control input. Detail of that assessment is contained in the section in this analysis titled Control system design effects on pitch control system ‘feel’ - Effects of dual control inputs on elevator response.

Pitch disconnect

Shortly after the captain and first officer made nose-up inputs, the first officer reversed his input, to nose-down. This resulted in a dynamic situation with an interchange of loads between the captain’s (left) and first officer’s (right) control channels over a very short period of time.

Because the FDR only recorded the master warning at 1 second intervals, and latencies within the warning system, it was not possible to determine precisely when the pitch disconnect occurred. As such, the pitch disconnect was deemed to have occurred at the first positive indication that the elevators were no longer moving in unison and were moving in opposite directions. At this time, the pitch control channel loads recorded by the FDR were 67 daN on the captain’s side and -8.5 to -19 daN on the first officer’s side, a difference of up to 86 daN.

According to the manufacturer, opposing forces of 50 to 55 daN applied simultaneously to each control column is required to activate the pitch uncoupling mechanism (PUM). Thus, the total differential control input loads required to activate the PUM would be 100 to 110 daN (102 to 112 kg force).

In this case, the difference between the pitch axis efforts at the time of the pitch disconnect were below the defined threshold for activation of the PUM, potentially casting some doubt that the pitch disconnect was purely the result of dual control inputs. However, the manufacturer’s analysis of the system found that the actual in-flight PUM activation loads could be less than those indicated by the documentation. Their analysis identified that aerodynamic effects and trim rigging differences could result in activation loads as low as a differential of 87 daN. Additionally, the accuracy of the sensors measuring the control system loads could result in recorded loads lower than the actual loads.

Consequently, the differential forces in the left (captain) and right (first officer) pitch control channels were sufficiently large to activate the PUM, disconnecting the left and right pitch control channels.

The ATSB reported that two LAME (licensed aircraft maintenance engineers) were on duty when the aircraft arrived in Sydney following the accident flight. They were aware that the crew had requested maintenance to attend to the aircraft and that the aircraft arrived with emergency services in attendance. The LAMEs learned through a brief conversation with the flight crew through the open cockpit window that the aircraft had encountered a pitch disconnect and a possible overspeed. The LAMEs read out the relevant parameters, found the pitch disconnect confirmed however no indication of exceeding VMO. However, they noticed a vertical acceleration of +3.34G in flight, the flight crew was surprised when LAMEs brought this up in the discussion.

The ATSB described the subsequent maintenance actions:

LAME 1 established from the aircraft maintenance manual that the maximum ‘g’ was outside of the acceptable limits for the aircraft weight. As a result, he grounded the aircraft. He identified the applicable maintenance as the Inspection after flight in turbulence and/or exceeding VMO. The data from the quick access recorder15 was downloaded, at around this time, and transferred electronically to VARA maintenance watch. This data was forwarded to the ATR Airlines Technical Response Centre.

Based on the information provided by LAME 1, the maintenance watch engineer on duty in Brisbane confirmed the inspection that would be required and arranged for the Sydney engineers to carry out that task. Consistent with common practice at the time, maintenance watch did not issue any documentation to the engineers.

Maintenance watch requested the engineers download the cockpit voice recorder (CVR) and advised that the necessary tooling for that task had been dispatched to Sydney. Maintenance watch also advised the Sydney engineers that the aircraft was scheduled for a flight at 0800 the next morning. The Sydney engineers accepted the tasking and did not make any requests to maintenance watch for additional time, technical advice or specialist equipment.

While LAME 1 was liaising with the flight crew and accessing the post-flight reports, the senior base engineer took the opportunity to walk around the aircraft and look for damage. The senior base engineer reported that this walk-around was based on his experience that an overspeed often required a visual inspection. During the walk-around the senior base engineer stood below the tail and looked up. No damage was observed.

At 1837, the aircraft was towed off the arrival bay to a remote parking area. It was parked and secured. The LAMEs then left the area to prepare for the inspection.

The next morning the LAMEs were tasked to another aircraft and decided they needed additional help to take care of the accident aircraft. Another LAME (called LAME 2) was called in and tasked with an inspection of the aircraft. The ATSB wrote:

LAME 2 recalled that when he arrived at the office, the other engineers were printing job instruction cards for inspection of the wing attach fittings and discussing the requirements. He was advised that the g loading was outside of the acceptable limits and that maintenance watch had requested a turbulence inspection. LAME 2 was also made aware that a cabin crew member was injured and the only information provided by the crew was that the pitch disconnected in moderate turbulence.

In regard to the initial engineering response, LAME 2 recalled that the senior base engineer advised him he had carried out quite a detailed walk-around of the aircraft in daylight and found no signs of defects. From what the senior base engineer said, LAME 2 understood that the general visual inspection of the aircraft had been done and he was now required to assist with a detailed visual inspection of the wing attachment fittings. LAME 2 recalled that there was no discussion about who was running the inspection or how the inspection would be coordinated.

From about 2000, LAME 2 with the assistance of LAME 1 worked on disassembling some of the aircraft interior to access the wing attachment fittings. The senior base engineer viewed his role during this period as keeping an overview, and providing support, without being completely involved in the inspection. For some of the time, the senior base engineer was attending to another matter.

While the LAMEs were inspecting the aircraft, maintenance watch completed an event notification for ATR with the following event description (with ATSB editing for clarity):

During descent with autopilot engaged both pilots noticed the airspeed rapidly accelerate and have both reached for the controls causing pitch disconnect. During this event, the aircraft sustained 3.34 G in-flight acceleration causing the flight attendant to become injured.

The notification indicated that an in-flight turbulence inspection was being carried out and the pitch disconnect test had been carried out with nil defects reported. Maintenance watch subsequently transferred a copy of the QAR data to the ATR centre.

At about 2200, the detailed visual inspection of the wing attach area was completed with nil defects identified. All of the engineers returned to the office and the two engineers who had been on duty for up to 16 hours 30 minutes, signed off at about 2230.When the senior base engineer left the office, he considered the general visual inspections were still to be completed and this would be done by LAME 2. It should be noted that from the time maintenance watch requested the inspection, no arrangements were made by the senior base engineer or the LAMEs to borrow or hire a high-access platform such as a cherry picker or scissor lift as would be required for close inspection of the horizontal stabilisers.

After attending to an arriving aircraft, LAME 2 returned to VH-FVR at about 2300. The engineer borrowed a nearby fixed-height stand to provide an elevated platform and positioned it to the rear of the left wing. That stand was described as the best he could get at that time and was of a height that provided a view of the top of the wing but not the top of the stabilisers. While on the stand, the engineer shone a torch over the upper surface of the wing, rear fuselage and tail (Figure 3). The engineer was on the stand for about a minute and the torchlight was directed to the rear fuselage and tail for a couple of seconds. No damage was identified.

The following morning the LAMEs attempted to download the CVR, however, were unsuccessful. Therefore a replacement CVR had to be shipped in. LAME 2 took the opportunity to inspect the interior of the aft fuselage, where the recorders were mounted, while waiting for the replacement CVR, but did not notice any anomaly, and replaced the CVR after the new recorder had arrived. The ATSB continued:

Other maintenance carried out was an operational test of the pitch uncoupling mechanism re-engagement system and a check that the pitch uncoupling mechanism had reconnected. The rear cabin area where the senior cabin crew member was injured was also checked and no damage was identified.

On the basis that all of the maintenance log entries had been certified as closed, LAME 3 issued a certificate of release to service at 1330.

The ATSB wrote with respect to continuation of service:

Subsequent to the post-occurrence maintenance completed on 21 February 2014, the aircraft was operated on a further 13 flights. The respective flight crews did not record any anomalies or defects during their pre-flight inspections and there were no reports of any abnormal aircraft handling characteristics.

On 25 February, aircraft VH-FVR was operated on a scheduled passenger flight from Sydney to Albury, NSW. On descent into Albury, the aircraft passed in close proximity to birds, which alerted the captain to the possibility of a birdstrike on the left side of the aircraft. There were no in-flight indications that a bird had struck the aircraft but after landing, the captain noticed the aircraft’s pitch trim system fluctuated abnormally.

The captain conducted a walk-around inspection and, although there was no evidence of a birdstrike on the left of the aircraft, he identified a dent in the top leading edge of the vertical stabiliser. The captain advised the operator’s maintenance watch who dispatched a LAME to Albury to inspect the aircraft.

The LAME, who was LAME 1 from 20 February, used scissor lift equipment to gain access to, and inspect the stabiliser. The LAME did not find any evidence of a birdstrike, such as blood or feathers. However, the LAME did find indications of significant structural damage to the horizontal stabiliser, and contacted maintenance watch to cancel the following flights. Upon further examination and discussion with VARA, it became evident that the damage found at Albury was probably a consequence of the occurrence on 20 February.

Late the next day, VARA emailed to the ATSB photos of the damage and advice that the damage found at Albury was probably a consequence of the occurrence on 20 February. On the following day, the ATSB upgraded the investigation and assigned a senior investigator to lead a team of investigators.
Incident Facts

Date of incident
Feb 20, 2014

Classification
Accident

Aircraft Registration
VH-FVR

Aircraft Type
ATR ATR-72-200

ICAO Type Designator
AT72

This article is published under license from Avherald.com. © of text by Avherald.com.
Article source

You can read 2 more free articles without a subscription.

Subscribe now and continue reading without any limits!

Are you a subscriber? Login
Subscribe

Read unlimited articles and receive our daily update briefing. Gain better insights into what is happening in commercial aviation safety.

Send tip

Support AeroInside by sending a small tip amount.

Related articles

Newest articles

Subscribe today

Are you researching aviation incidents? Get access to AeroInside Insights, unlimited read access and receive the daily newsletter.

Pick your plan and subscribe

Partner

Blockaviation logo

A new way to document and demonstrate airworthiness compliance and aircraft value. Find out more.

ELITE Logo

ELITE Simulation Solutions is a leading global provider of Flight Simulation Training Devices, IFR training software as well as flight controls and related services. Find out more.

Blue Altitude Logo

Your regulation partner, specialists in aviation safety and compliance; providing training, auditing, and consultancy services. Find out more.

AeroInside Blog
Popular aircraft
Airbus A320
Boeing 737-800
Boeing 737-800 MAX
Popular airlines
American Airlines
United
Delta
Air Canada
Lufthansa
British Airways