ATR72 In-Flight Pitch Disconnect and Structural Failure

ATR72 In-Flight Pitch Disconnect and Structural Failure (Virgin Australia Regional Airlines [VARA] VH-FVR)

In 2014 we reported on the preliminary information from the Australian Transport Safety Bureau (ATSB) on a serious incident with a Virgin Australia Regional Airlines (VARA, formerly Perth, WA based SkyWest) ATR 72, registered VH-FVR on 20 February 2014.  While operating a scheduled passenger flight from Canberra to Sydney the aircraft sustained a pitch disconnect on final descent. The aircraft was significantly damaged during the occurrence.  On 15 June 2016 the ATSB issued an Interim Report.

The Incident Flight

During the initial climb, while:

…Passing 8,500 ft above mean sea level (AMSL), the crew noticed a rapid airspeed increase. The FO [the Pilot Flying] reported that the airspeed trend indicator was ‘off the chart’, indicating a very rapid increase in airspeed. The FO reduced engine power and …temporarily disconnect[ed] the autopilot before manually raising the aircraft’s nose to control the speed.

The FO reported that the aircraft felt ‘heavy’, as was normal for this aircraft at that speed, requiring two hands on the controls to move from the then -4° pitch angle.

The captain [the Pilot Monitoring] reported being unsure if the FO’s control inputs would be sufficient to avoid exceeding the maximum operating speed limitation, so put one of his hands on the controls and disconnected the autopilot to raise the nose further.

ATSB do not comment on any verbal communication between the crew and in particular if the Captain announced his intentions.

Shortly after, with both flight crew making simultaneous nose up pitch inputs on the controls, the aircraft rapidly pitched up with an associated increase in the g load.  The FO responded by immediately reversing the control input to nose down. Both flight crew noticed that the controls suddenly felt different and ‘spongy’. At about the same time, aural and visual cockpit warnings activated. The crew verified that the aircraft was under control at a stable attitude and speed, observing that it was level or in a slight descent at an airspeed of about 230 kt.

One of the cockpit warnings was ‘pitch disconnect’, indicating that the left and right elevator control systems had uncoupled from each other. This allowed for independent movement of the left and right elevators via the captain’s and FO’s control columns respectively.

Pitch disconnect is a safety feature intended to allow control of the aircraft in the event of a pitch control system jam.

The crew consulted the pitch disconnect checklist and worked to identify which control column was free and working normally. After determining that both controls were free, it was decided that the captain would be pilot flying for the remainder of the approach and landing at Sydney Airport.

ATR72 VH-FVR taxiing inbound at Sydney on 20 Feb 2014 following the in-flight pitch disconnect (still image from CCTV). Note angle of the horizontal stabiliser relative to the wings. (Credit: via ATSB)

The aerodynamic loads generated during the pitch disconnect resulted in serious injury to the senior cabin crew member and significant damage to the aircraft’s horizontal stabiliser.

It is also noticeable that:

Although the aircraft was inspected after the pitch disconnect, the damage was not identified until 25 February 2014.

On 25 February 2014, after a further 13 sectors, the aircraft suffered what the crew initially believed was a bird strike after the pitch trim system fluctuated abnormally following an approach in close proximity to birds.

Subsequent inspections did find bird debris but did discover damage that ultimately was found to include:

• External damage to the left and right horizontal stabilisers (aka tailplanes)
• Fracture of the composite structure around the rear horizontal-to-vertical stabiliser attachment points

• Fracture of the front spar web

• Cracking of the horizontal-to-vertical stabiliser attachment support ribs
• Cracking of the attachment support structure
• Cracking and delamination of the skin panels at the rear spar

Only then did the operator identified that the two incidents may be linked. Subject to further assessment and non-destructive testing (NDT), ATR recommended replacement of the horizontal stabiliser, elevators, and vertical stabiliser.

Analysis of the Flight Data Recorder (FDR) showed:

• The Captain started to make a nose up pitch input shortly before the FO made the third nose up input
• When the FO started moving the control column forward (nose down), the load on the Captain’s control increased (nose up) at about the same rate that the FO’s decreased
• 0.3s later the elevators uncoupled.

A load analysis by ATR found:

…the maximum load on the horizontal stabiliser coincided with the maximum elevator deflection that occurred 0.125 seconds after the elevators uncoupled. At that point, the ultimate load was exceeded by about 47 per cent, and the exceedance lasted about 0.125 second.

Analysis

The ATSB say:

The actions taken by the flight crew were consistent with an attempt to prevent an increase in the aircraft’s speed. It was not consistent with a conscious attempt to disconnect the left and right elevator systems due to a control jam…

The recorded data from the flight showed that both flight crew made simultaneous but opposite direction control inputs at the time of the pitch disconnect. Thus, it is most likely that the pitch disconnect was a result of an inadvertent application of opposing control inputs by the flight crew while attempting to prevent an exceedance of the aircraft’s maximum operating speed. The factors that led to both flight crew members making those control inputs will be examined in detail in the final report…

At the time of the pitch disconnect, the aircraft was near its maximum permitted operating speed. Because of this high speed, the resulting asymmetric elevator deflections resulted in a large asymmetric aerodynamic load being generated on the horizontal stabiliser. That load exceeded the design strength requirements for the stabiliser structure, resulting in significant damage. Such a large exceedance has the potential to result in catastrophic damage to the stabiliser and a subsequent loss of control.

Consequently the ATSB found that:

Inadvertent application of opposing pitch control inputs by flight crew can activate the pitch uncoupling mechanism which, in certain high-energy situations, can result in catastrophic damage to the aircraft structure before crews are able to react. [Safety issue]

 Safety Actions

As a result of this occurrence and a briefing from the ATSB on 5 February 2016 on the safety issue, ATR released an All Operators Message (AOM). The message informed operators of ATR 42/72 aircraft of revised maintenance and operational documentation relating to the pitch control system and pitch disconnect occurrences as follows:

Additionally the operator and maintenance organisation (Toll) have taken a number of actions.

Other Investigation Aspects

To date, the ATSB has collected information about the following, which will be discussed in the final report:

• The sequence of events before and after the pitch disconnect, including the post-occurrence maintenance and initial investigation by Virgin Australia Regional Airlines (VARA) and ATR
• Flight and cabin crew training, qualifications, and experience
• The meteorological conditions
• VARA policy and procedures
• VARA training courses
• VARA’s safety management system
• VARA’s maintenance program
• The aircraft’s systems
• The relationship between VARA and the maintenance organisation
• Maintenance engineer training, qualifications, and experience
• The maintenance organisation’s policy and procedures
• The maintenance organisation’s training courses
• The maintenance organisation’s quality and safety management
• The Civil Aviation Safety Authority’s (CASA) surveillance of VARA
• CASA’s approvals granted to VARA
• CASA’s surveillance of the maintenance organisation
• CASA’s approvals granted to the maintenance organisation
• ATR’s flight crew type training
• ATR’s maintenance engineer type training
• ATR’s maintenance instructions for continuing airworthiness
• Known worldwide in-flight pitch disconnect occurrences involving ATR 42/72 aircraft.

The final report is due in December 2016.

Another Possible Occurrence

On 14 June 2016, the day before the ATSB update, an ATR 72-212A (ATR-72-600), PK-WGL, of Indonesian operator Wings Air, was found to have a cracked horizontal stabilizer fitting.  ASN report:

The last flight prior to maintenance was on June 5 when the aircraft arrived at Surabaya Airport from Yogyakarta as flight IW1817. The damage must have occurred some time before the aircraft went into maintenance.

Initial examination of this damage suggested similarities with…VH-FVR…

Investigations Updates

UPDATE 20 December 2016:  The European Aviation Safety Agency (EASA) issue Safety Information Bulletin (SIB) 2016-20  ATR Flight Controls – Crew Resource Management – Avoiding Dual and Opposite Flight Control Inputs.  This references the earlier ATR AOM and says:

Crew Resource Management principles should be emphasized to avoid abrupt, harsh, dual or antagonist inputs by operating crews.  At high speed, pitch control inputs should be done with care, as resulting vertical acceleration may lead to overstressing the airframe.

An FCOM Temporary Revision (TR), is expected to be issued first quarter of 2017.

UPDATE 30 December 2016: This was our 4th most popular article in 2016.

UPDATE 30 March 2017: The ATSB have slipped the estimated date for the final report to April 2017.

UPDATE 5 May 2017: Rather than issue a final report, the ATSB today issued a second interim report and an associated media statement.  The main focus is on design matters.   They also reveal that the UK Air Accident Investigations Branch (AAIB) had conducted a ‘peer review’ of their investigation at the ATSB’s invitation.

The ATSB say:

As a result of that further investigation, the ATSB has obtained an enhanced understanding of the dynamics of the pitch control system during a pitch disconnect event and identified an additional safety factor that relates to the potential loads generated during such an event.

The design of the pitch control system is such that the crew is required to apply a load to the control column in order to separate the left and right pitch control systems in the event of a jam. The ATSB has identified that this has three effects on the controls during a pitch disconnect event.

Those effects are:

1. rebalancing of the loads in the system following activation of the pitch uncoupling mechanism (PUM)
2. dynamic transient elevator deflections in the short period after activation of the PUM
3. unavoidable movement of the control column(s) following activation of the PUM.

The first two of these effects are a consequence of the flexibility within the control system and the PUM being located between the elevators.

Each of these effects may contribute to elevator deflections greater than the aircraft manufacturer considered during the design and certification of the aircraft.

The ATR 72 was designed and certified to the Joint Airworthiness Requirements Part 25 (JAR 25). The applicable change status of JAR 25 used for the certification was change 13.

The certification documents provided to the ATSB indicated that the aerodynamic loads on the horizontal stabiliser generated by the elevator deflections from a pitch disconnect had not been considered during the design and certification of the pitch control system in the ATR 72. However, the recorded data from the occurrence flight and a certification flight test show that there are elevator deflections during a pitch disconnect event.

During the investigation, the aircraft manufacturer reassessed the likelihood of an untimely pitch disconnect due to inadvertent opposing dual control inputs. The reassessment was based upon the number of incidents reported to the manufacturer and the number of hours flown by the world‑wide fleet of ATR aircraft. This reassessment determined that the occurrence rate was 4.23xE-7 occurrences per flight hour.

The ATSB’s investigation identified that the dynamic transient elevator deflections and unavoidable control column movement will result in greater elevator deflections than those calculated by the manufacturer. Those deflections increase the aerodynamic loads generated by the horizontal stabiliser, and in turn the potential to overstress the structure.

During the intentional pitch disconnect done in preparation for the certification flight testing, the ultimate load was not exceeded. However, the elevator deflections encountered were only about 2° less than the ultimate load case. According to the manufacturer, a speed increase of only about 7 knots was required to reach the ultimate load with those elevator deflections.

During the VH-FVR occurrence, the resulting elevator deflections were sufficient to exceed the ultimate load by about 47 per cent. This indicates that there is potentially a speed below the maximum operating speed at which the ultimate load case can be exceeded during a pitch disconnect event.

Because there has been no detailed engineering to assess the transient elevator deflections and unavoidable control movements, there is no assurance that the aircraft has sufficient strength to sustain the aerodynamic loads generated by a pitch disconnect event at all speeds within the approved operating envelope.

While it is accepted that dual control inputs are not a normal piloting practice, it is considered by the ATSB to be a foreseeable error. Indeed this appears to have been considered by the manufacturer during certification; however, the resulting effect was categorised as ‘major’. Given the understanding of the effect of a pitch disconnect at that time, this categorisation was considered reasonable. However, an improved understanding of the transient elevator deflections that occur during a pitch disconnect, may conclude that a ‘major’ categorisation may no longer adequately estimate the hazard to the aircraft. For any categorisation more severe than major, neither the predicted nor the reassessed occurrence rate meet the accepted standard.

The ATSB makes the following new finding:

The aircraft manufacturer did not account for the transient elevator deflections that occur as a result of the system flexibility and control column input during a pitch disconnect event at all speeds within the flight envelope. As such, there is no assurance that the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect. [Safety issue]

Notwithstanding a range of proactive activity by ATR:

ATSB’s retains a level of ongoing concern as to whether the aircraft has sufficient strength to withstand the loads resulting from a pitch disconnect. Consequently, while the ATSB accepts that the current level of safety action partially addresses the safety issue; the ATSB makes the following safety recommendations:

Action organisation: Civil Aviation Safety Authority
Action number: AO-2014-032-SR-016
Date: 05 May 2017
Action status: Monitor
The ATSB recommends that CASA review ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect, to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that CASA take immediate action to ensure the ongoing safe operation of Australian‑registered ATR42/72 aircraft.

Action organisation: European Aviation Safety Agency
Action number: AO-2014-032-SR-015
Date: 05 May 2017
Action status: Monitor
The ATSB recommends that EASA monitor and review ATR’s engineering assessment of transient elevator deflections associated with a pitch disconnect to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that EASA take immediate action to ensure the ongoing safe operation of ATR42/72 aircraft.

Action organisation: ATR
Action number: AO-2014-032-SR-014
Date: 05 May 2017
Action status: Monitor
The ATSB recommends that ATR complete the assessment of transient elevator deflections associated with a pitch disconnect as soon as possible to determine whether the aircraft can safely withstand the loads resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies that the aircraft does not have sufficient strength, it is further recommended that ATR take immediate action to ensure the ongoing safe operation of ATR42/72 aircraft.

We would expect the final report, expected now in August to reveal more information about the maintenance actions and the delay in identifying the damage.

The Sydney Morning Herald  reports that a spokesman for CASA said “the agency had been closely monitoring the investigation”:

CASA continues to audit ATR aircraft operators to ensure appropriate actions have been taken to reduce the likelihood of the aircraft being mishandled in a manner similar to the incident flight.   Flight procedures and pilot refresher training for the ATR aircraft operated in Australia have been amended since the event occurred.  CASA will look carefully at the findings of the aircraft manufacturer’s engineering analysis of the issues associated with a pitch disconnect when this work is completed.  If this analysis raises any ongoing safety issues CASA will take appropriate action.

In other recent, but unrelated news Virgin Australia is reducing its use of ATRs in Queensland, and thus reducing their ATR fleet from 14 to 6.

UPDATE 10 January 2018: The final report is expected in June 2018.

UPDATE 27 May 2018: Publication of the final report has slipped to 2018Q3 say NTSB.

UPDATE 23 July 2018: Publication of the final report is now expected in 2018Q4.

UPDATE 18 February 2019: The report is now in ‘external review’, but publication has again slipped further to 2019Q2.

UPDATE 24 May 2019: Final report published.

…as part of its final report, the ATSB has issued a Safety Recommendation to EASA, recommending taking “further action to review the current design standard (CS-25) in consideration of effect that dual control inputs may have on control of aircraft.”  In addition, the ATSB has issued two Safety Recommendations to aircraft manufacturer ATR.

…the investigation also highlights the importance of a full and proper inspection to detect aircraft damage and the need for the inspection to be fit for purpose and for inspections to be coordinated and certified to avoid a single point failure.

We will be doing a fuller update in due course.

UPDATE 12 October 2019: ATR72 VH-FVR Missed Damage: Maintenance Lessons Unclear communications, shift handover & roles and responsibilities, complacency about fatigue and failure to use access equipment all feature in this serious incident.

UPDATE 30 December 2019: White Air ATR-72-212A CS-DJG, operating for TAP Portugal, landed at Fez on 6 July 2018 after an unstabalised approach according to Portuguese accident investigators (the Gabinete de Prevenção e Investigação de Acidentes com Aeronaves [GPIAA]) but struck its tail onto the runway, touching down hard (+2.88G).  The aircraft sustained abrasion damage to the  aft fuselage, deformation between frames 35-38, sheared rivets and wear on the tail-skid.

The Aircraft Commander prepared for the return flight by performing a walk-round, carrying out a general inspection, looking for problems on the main landing gear and checking the tail strut (‘pogo stick’) fitted under the bumper when parked.  He did not detect any anomalies and the aircraft was flown back to Lisbon before the damage was detected.  GPIAA comment on:

….excessive reliance on aircraft acceptance without sharing and discussing with the operator’s technical services [and a] organizational culture with inadequate or nonexistent procedures and individual centered decision-making without effective implementation of the CRM philosophy.

---

Corporate Background

Virgin Australia had made an offer to purchase SkyWest in late 2012, which was completed in April 2013, just weeks before this Serious Incident.  VARA continues to operate on a separate Air Operators Certificate to Virgin Australia.  While the HQ is in Perth, WA most of their ATR operations are in the East of Australia.  These ATRs, first introduced in 2011, were primarily flown on behalf of Virgin Australia, even before the purchase.  The acquisition signalled a period of growth for Virgin Australia, seen as a move to challenge Qantas, although VARA did delay ATR72 deliveries in January 2014 as part of a move to cool their expansion.

---

We have previously reported on another VARA serious incident: Multiple TAWS Warnings Reveal Safety Reporting Issue.  The ATSB in the first of three investigation reports on incidents with the same individual aircraft, identified ‘significant underreporting…of…TAWS-related occurrences’ by the airline.

---

Other Cases of Missed Damage

UPDATE 21 February 2018:  Flawed Post-Flight and Pre-Flight Inspections Miss Propeller Damage (Regional Express (Rex) Saab 340B VH-ZRL, 22 February 2013)

UPDATE 14 April 2018: Air Mandalay Embraer ERJ-145 XY-ALE was damaged after a heavy landing during an unstabilised approach on 18 Sept 2017.  the First Officer did a walkaround but did not spot the damage so the aircraft flew two more sectors before an engineer found the damage, according to the Aircraft Accident Investigation Bureau (AAIB) of Myanmar report.

UPDATE 11 July 2018: The TSB of Canada has released their report on the hard landing during wind shear of Jazz Aviation  Bombardier Dash 8 Q400 C-GYJZ on 9 November 2017 which substantially damaged the aircraft and generated enough load to trigger the CVR/FDR crash switch.  They report that the flight crew were unsure if this 5.7g touchdown was a hard landing or not.  Rather than wait for maintenance personnel to travel to the airport the pilots therefore conducted a visual inspection of the aircraft and finding nothing abnormal, decided to operate the return flight, landing uneventfully back in Montreal. Subsequent maintenance inspection found:

…buckling of the skin below the windows on the right fuselage [and] the right main landing gear during the second touchdown exceeded its ultimate design criteria, which resulted in failure of the orifice support tube during the in-stroke. Once the orifice support tube failed, shock strut damping was effectively lost, thereby generating significant bottoming loads.

TSB comment:

Neither the aircraft manufacturer nor Jazz provide the flight crew with a definition of a hard landing or criteria to determine what a hard landing is. Pilots are expected to rely on their personal experience to make such a determination. In some cases, operational pressures may influence this assessment.

The operator’s safety actions reported were:

• providing additional training on how to recognize hard landings,
• strengthening and clarifying procedures and guidance associated with suspected or actual hard landings,
• adding a warning within flight crew guidance to inform crews of the risk of a hard landing if a landing is continued following a bounce with the power levers at flight idle or disc, and
• conducting a review of flight data analysis practices and effectiveness as they relate to preventing a departure when the aircraft’s airworthiness is concerned.

UPDATE 11 August 2019: Severe Propeller Vibrations on ATR 72-212A: BEA Report: A vibratory phenomena that was not uncovered in certification testing and in one case resulted in a failure that did not get detected initially by maintenance inspections.

UPDATE 30 December 2019: White Air ATR-72-212A CS-DJG, operating for TAP Portugal, landed at Fez on 6 July 2018 after an unstabalised approach according to Portuguese accident investigators (the Gabinete de Prevenção e Investigação de Acidentes com Aeronaves [GPIAA]) but struck its tail onto the runway, touching down hard (+2.88G).  The aircraft sustained abrasion damage to the  aft fuselage, deformation between frames 35-38, sheared rivets and wear on the tail-skid.

The Aircraft Commander prepared for the return flight by performing a walk-round, carrying out a general inspection, looking for problems on the main landing gear and checking the tail strut (‘pogo stick’) fitted under the bumper when parked.  He did not detect any anomalies and the aircraft was flown back to Lisbon before the damage was detected.  GPIAA comment on:

….excessive reliance on aircraft acceptance without sharing and discussing with the operator’s technical services [and a] organizational culture with inadequate or nonexistent procedures and individual centered decision-making without effective implementation of the CRM philosophy.

Aerossurance has extensive air safety, airworthiness, safety culture development and accident analysis experience. For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com

Follow us on LinkedIn and on Twitter @Aerossurance for our latest updates.