AVIATION Reports - 2005 - A05F0047

1.13 Organizational and Management Information

1.13.1 Company Operations

Air Transat is authorized by TC to provide the types of services specified in its air operating certificate (AOC). Part I of the AOC, in part, authorizes non-scheduled and scheduled international operations between Canada and points abroad and between points abroad using its A310 aircraft.

1.13.2 Maintenance Organization

Since February 2002, the occurrence aircraft was maintained by Air Transat, which operates a fleet of 14 wide-body aircraft (A310 and A330) under a quality safety management system (QSMS). Air Transat's QSMS is a component of a management control system that deals with quality and safety. Air Transat's QSMS includes an accountable executive, a safety management plan, safety oversight, training, quality assurance, documentation, and an emergency response plan.

The Air Transat maintenance program in place at the time of the occurrence was approved by TC on 10 December 2004 under approval number Q-0188. Air Transat holds a TC-approved maintenance organization (AMO) certificate, as per Part 5, Sub-Section 73, of the CARs, under AMO 32-87. The company has approximately 285 employees in the maintenance department. The company is capable of doing line and heavy maintenance, minor and major repairs, and modifications for Lockheed 1011, Airbus 310 series, Airbus 330 series, and Boeing 757 series aircraft.

Air Transat also holds the privileges of specialized maintenance rating on sheet metal structure, composite structure, arc welding, avionic systems, and components, as per Section 573.02 of the CARs. The review of the Air Transat AMO showed that the organization has up-to-date Maintenance Control and Maintenance Policy manuals that outline the requirements for the technical operation.

Air Transat was last audited by TC from 06 to 17 May 2002. Air Transat was not approved to perform C-checks on its Airbus aircraft. The last C-check on C-GPAT was completed by TAP Portugal in May 2004. Air Canada Technics has been used for C-checks on the occurrence aircraft as well as on other Air Transat aircraft.

1.14 Additional Information

1.14.1 All Operators Telex-Fleet Inspection of Rudder

1.14.1.1 AOT-1-Fleet Inspection of Rudder Exteriors

As a result of this investigation, the aircraft manufacturer issued AOTs A310-55A2035, A300-55A6035, A330-55A3035, and A340-55A4030 on 17 March 2005 for the inspection of all aircraft with part number A55471500 series rudders (Figure 9). These AOTs were subsequently made mandatory by an Airworthiness Directive issued by the Direction Générale de l'Aviation Civile (DGAC) of France, the State of manufacture. This inspection included 222 A310s, 146 A300-600s, 6 A330s, and 34 A340s. The aim was to verify the structural integrity of the rudder and its attachment by means of one-time visual and tap-test inspections. This included a GVI of the VTP rear spar aft face, DVI of the hinge arms and actuator support fittings, DVI of the rudder hinge fittings, and a tap test of the rudder side panels. The tap test was conducted around the exterior perimeter of the rudder side panels as per the normal five-year inspection, as well as the inspection of additional bands through the centre as shown in Figure 9. It is noted that an exterior tap test is unable to detect disbonds on the interior face sheets. Airbus obtained results from operators for over 80 per cent of the affected aircraft, with the following results:

• Side panel disbonds and delaminations were found on a small number of aircraft but were all within SRM repair limits.
  
• Damage at hoisting points was found but the damage was below the size requiring immediate repair and was within SRM repair limits.
  
• Some corrosion was reported at hinge fittings but was assessed as having no impact on structural integrity.
  
• Some free play was reported at hinge bearings but was assessed as having no impact on structural integrity.
  
• No trends were observed in the damage data, which would suggest batch tendencies.
  
• None of these findings approached a level that could result in failure in flight.

1.14.1.2 AOT-2-Fleet Inspection of Rudder Interiors

On 02 March 2006, the aircraft manufacturer issued a second series of AOTs (AOT A310-A552043, AOT A300-A556042, AOT A330-A553036, and AOT A340-A554031) for the inspection of all aircraft with rudder part number A55471500 series rudders. These AOTs were subsequently made mandatory by two Airworthiness Directives issued by the European Aviation Safety Agency (EASA), representing the State of manufacture. The aim was to verify the structural integrity of the rudder by means of a one-time tap-test inspection to the interior face sheets of the rudder side panels, as well as checking the drainage holes at the bottom of the rudder and cleaning hydraulic fluid from the external surfaces. Access to the interior of the rudder was through the inspection holes in the front spar of the rudder. It is noted that the access to inboard surfaces from the inspection holes is limited. Figure 10 shows the areas of inspection. Airbus obtained results from operators for over 90 per cent of the affected aircraft and no disbonds were found.

2.0 Analysis

2.1 General Information

TSC961 departed Varadero on a scheduled flight and was being flown by qualified crew members in accordance with applicable regulations and procedures. Documentation indicates that the aircraft was equipped and operated in accordance with applicable regulations and procedures. Weather and navigation aids were not considered as factors in this occurrence.

2.2 Flight Control System

2.2.1 General

The investigation of the aircraft flight control system and related subsystem components revealed that there were no control system anomalies or conditions that could have led to the breakup of the rudder.

2.2.2 Ability to Diagnose the Source of Flight Control Difficulty

Throughout the flight, the nature of the structural damage could not be precisely identified. Only when rudder inputs were made in the final stages of approach and landing did it become apparent that rudder response was abnormal and inadequate.

The problem the crew was facing could be described as "flight control difficulties of unknown origin." There is no established procedure for this problem. The ambiguous nature of the symptoms made it difficult for the crew to assess the situation and to form a clear diagnosis of what had caused the control problems that they had experienced.

2.2.3 Dutch Roll Recovery

During their initial training, the pilots were shown a Dutch roll in the simulator; this was their only encounter with this situation. The integrity of any abnormal procedure checklist relies on the premise that only the correct procedure should be used for a given situation, and that the procedure should be completed in its entirety. On the A310, most procedures are displayed on the ECAM, and as each procedure item is properly completed, the item is removed from the display screen. Completing the associated procedure ensures best safety of the flight. There is no procedure in the QRH or on the ECAM that deals with Dutch roll. Only the Airplane Upset Recovery Training Aid gives general guidelines, and it does not deal specifically with systems such as the autopilot. There was insufficient guidance regarding Dutch roll recovery technique. Additional information may have prevented the crew from worsening the flight characteristics as was the case when the autopilot was re-engaged.

2.2.4 Decision to Return to Varadero

Shortly after the rudder loss, the crew took steps to descend and divert to a nearby airport. As the flight progressed, the Dutch roll decreased and then ceased as they descended. By the time the crew was in a position to complete an approach to either Miami or Fort Lauderdale, there were indications that the aircraft would continue to fly normally. The determination of where to land was influenced by the following: there were no symptoms remaining related to the noise, vibration, or Dutch roll; there were no ECAM messages, warning lights or cockpit indications related to the control problems; the flight could continue at low altitude; and the company was better equipped to deal with the passengers and aircraft at Varadero.

The investigation determined that the aircraft was not in danger of losing the VTP during the flight, either through loss of static strength or loss of stiffness.

2.2.5 Decision not to Declare an Emergency

The timely declaration of an emergency allows the aircrews to be helped to the greatest possible extent when dealing with abnormal or emergency situations.

Declaring an emergency and clearly communicating the nature of the problem allows ATC to more easily coordinate between units and anticipate the needs of the crew in planning traffic management. It also serves to ensure that the flight will get immediate attention from controllers should the situation change. If ATC is aware that an aircraft is having control difficulties, it can incorporate this knowledge into its planning, and provide, among other things, more manoeuvring space and a longer final approach. Without this information, there could be unexpected and undesirable consequence such as the aircraft being unable to comply with ATC requests resulting in the requirement to execute a missed approach or other manoeuvre that would delay landing.

Air Transat's operations manual recognizes that there are a wide variety of possible emergency situations and leaves it to the discretion of the crew as to when an emergency should be declared. In this occurrence, by the time the crew was in a position to communicate to ATC, they had full control of the aircraft and did not feel it necessary to declare an emergency.

2.2.6 Crew Communication and Decision Making

In abnormal and emergency situations, effective crew communication enhances effective pilot decision making in that decisions will be based on all available information. In this occurrence, information that might have been relevant, specifically the magnitude of the forces incurred in the aft galley and the subsequent adverse effects or a description of the noise (volume and type of sound) heard by the FAs, was not communicated to the flight crew.

This information was not communicated because, given the intensity of the noise and vibration, all members of the cabin crew assumed that their experience was representative of the experience throughout the cabin. In addition, the captain assumed that, if potentially valuable information existed within the cabin, the FD would have such information and would provide it without being asked.

The assumptions persisted despite training given to all crew members that emphasized the importance of sharing all information and not assuming other crew members have a complete understanding of events. Air Transat's written procedures provide a structured format for the flight crew to provide a briefing to cabin crew but there is no requirement for the FD to seek information from the rest of the crew.

In this case, the provision of information related to the severity of events experienced in the aft cabin may not have had a significant impact on the decisions taken by the crew or the outcome of the occurrence. However, in other circumstances, the lack of information could have severe consequences. Procedures and practices that do not facilitate information sharing between crew members increase the likelihood that decisions will be based on incomplete or inaccurate information, placing passengers and crew at risk.

2.3 Maintenance

2.3.1 Maintenance Program

No shortcomings were found in the Air Transat maintenance organization, facilities, procedures, the control of maintenance activities, or personnel qualifications. It was concluded that the aircraft was maintained in accordance with the approved maintenance program.

2.3.2 Maintenance Records

The investigation examined the maintenance records of Air Transat as well as those of the aircraft's previous owner. There were no remarkable issues with the rudder, apart from the repair of some minor lightning strike damage at the tip of the rudder approximately eight years prior.

2.3.3 Hinge Bearing Condition

Although the occurrence aircraft had one rudder hinge line bearing at position 2 that exceeded the AMM tolerances and 3 of 10 VTP side hinge arm bearings that were partly seized, there had been no reports of rudder vibration on the occurrence aircraft, no significant free play was measured on the residuals, and partially seized bearings could still be rotated. It is therefore concluded that the general condition of the rudder hinges indicates that they were not a factor in the occurrence.

2.3.4 Adequacy of Rudder Inspection Program

Daily and transit checks of the rudder consist of a GVI conducted from the ground. These inspections can only detect significant external damage because the rudder is as high as 15 m in the air, and the view of the rudder is partially blocked by the horizontal stabilizer. Therefore, the daily and transit checks are limited in their effectiveness to detect rudder damage.

Air Transat conducts the 2-C check of the rudder every 30 months and it consists of a GVI conducted at arm's length. This inspection can only detect externally visible damage. It does not assess the inside condition of the rudder, nor detect such anomalies as inner skin disbonds or fluid ingress. Therefore, the 2-C check is limited in its effectiveness.

A tap test of the rudder side panels is conducted every five years. This tap test is limited to a 40 mm-wide strip along the front edge of the rudder side panels, and a similar narrow strip along the lower part of the trailing edge. This inspection cannot detect damage in the side panels outside these limited areas, and the tap test will only detect large inner-skin disbonds. Therefore, the five-year inspection is limited in its effectiveness.

During the fleet-wide inspection that followed the occurrence, other NDI techniques were used such as ELCH, X-ray, ultrasonic, and thermography, and they demonstrated their effectiveness in finding damage not detected by tap test or visual inspection. For example, these techniques were responsible for finding cases of water ingress and inner-skin disbond. Although these alternate NDI techniques are available, and even used on other parts of the aircraft (that is, thermography is used to inspect the elevators), they are not part of the scheduled maintenance program for the rudder. Therefore, there are more effective NDI techniques available than those used by the current maintenance program.

An effective inspection program must offer an acceptable probability of detecting damage before it can grow to critical size. The occurrence rudder did receive its five-year tap-test inspection in May 2001, and during the intervening period, it was visually inspected in accordance with the maintenance program with no finding. Nevertheless, the limitation of the inspection techniques does not guarantee that there was no damage present that could grow to critical size without detection. Therefore, the current inspection program is not adequate to detect damage to the rudder assembly in a timely and consistent manner.

2.4 Recorders

2.4.1 Cockpit Voice Recorder Duration

The lack of information from the 30-minute CVR regarding the rudder-loss event, including the noises heard by the cockpit and cabin crew and the associated vibrations, hindered the investigation. A two-hour CVR would have captured the sounds of the vibrations on the cockpit area microphone, providing important information on the vibration frequencies. The lack of adequate data increased the workload of investigators and hampered their ability to obtain a timely, complete, and accurate understanding of the event.

2.4.2 Digital Flight Data Recorder Data Sampling

A two-second highly dynamic event was identified when the DFDR and the DAR data were merged and lateral accelerations were compared. The determination of the frequencies involved was not possible due to the low sampling rates of the recorded accelerations. Although the sampling rates meet current performance standards required by regulation, they were not adequate for capturing the highly dynamic conditions that may exist during an accident.

2.4.3 Digital Flight Data Recorder Filtered Data

To investigate the rudder failure and resulting aircraft response, a performance analysis was undertaken that required accurate control surface position data. The DFDR - recorded control surface position data are not the raw sensor data. The raw sensor data are filtered by the system data analog converter before being recorded. The probable rudder position history was calculated using filtered information. The analysis suggested that the filtering produced 0.4-second data latency and reduced the amplitude by up to 1º during the initial high-frequency oscillations. The rudder position filtering and the necessity for additional analysis adversely affected the accuracy and effectiveness of the investigation efforts.

2.4.4 Preservation of Recorder Information

In this occurrence, disabling the CVR at engine shutdown would not have prevented the loss of information recorded at the time of the rudder failure, because the CVR was a 30-minute device, and the event occurred more than one hour before landing in Varadero. Nevertheless, there are situations for which securing the recorders after landing will preserve valuable evidence, as past investigations have shown (TSB reports A00A0185, A00P0040, and A01W0117). No procedure for disabling recorders after landing was available to the crew.

2.5 Analysis of Rudder Failure Mechanism

2.5.1 General

The investigation studied the possibility of the rudder failing either as a result of a static loading phenomenon or of a dynamic loading phenomenon.

2.5.2 Static Loading Phenomenon

2.5.2.1 Large Rudder Deflection

The rudder control system was operating correctly and no indications were found that the rudder made a deflection beyond authorized deflection limits. It is concluded that the failure was not caused by a large rudder deflection.

2.5.2.2 High Static Load

The investigation reviewed the static load tests, sub-component tests, and damage tolerance tests that had been conducted during initial certification, and concluded that the rudder was designed with adequate strength to react to static loads encountered within the structural design envelope. A review of recorder information revealed that the aircraft was operating within its design envelope and that it did not experience a high load event either on the occurrence flight or on an earlier flight. It is concluded that the failure was not caused by a high static load.

2.5.3 Dynamic Loading Phenomenon

The analysis of the lateral load signal from the DFDR and DAR found an indication that the occurrence was associated with a dynamic event. The following were examined as possible causes of this dynamic event.

2.5.3.1 High-Frequency Control Input

The investigation of the aircraft systems did not reveal any conditions that would have resulted in a control-induced dynamic event. DFDR and DAR recordings did not show any indications of high-frequency control movement in the period leading up to the occurrence. It is concluded that the dynamic event was not caused by a high-frequency input from the control system.

2.5.3.2 Flutter

The lateral load signals recorded, the damage to the VTP main attachment fittings, the damage to the rudder hinge arms at positions 5 and 6, as well as the noise and vibrations felt during the event are consistent with flutter.

2.5.4 Possible Causes of Flutter

2.5.4.1 Flutter without Prior Structural Deviation

Flutter analysis confirmed that a rudder with no structural deviations will not flutter within the design envelope. The investigation showed that the rudder was operated within the design envelope; therefore, the rudder did not experience flutter without a prior structural deviation.

2.5.4.2 Flutter Following Structural Deviation

The investigation revealed that rudder imbalance and hinge free play would not have led to flutter. It was determined that the most probable cause of flutter was a large disbond-type damage. The presence of additional minor factors such as possible water trapped in the honeycomb and excess paint would marginally reduce the size of the disbond necessary to cause the flutter.

2.5.5 Growth of Rudder Damage

Vacuum cycling tests conducted resulted in damage growth. Therefore, the pressure differential between the air inside the honeycomb and the reduced external air pressure at cruise altitude might have acted as the driving force for the growth of core/face sheet separations or in-plane core fractures.

This particular rudder design does not include any damage growth arrest features in the side panels such as a mechanical barrier. Once damage starts to grow, it can continue to grow until it reaches critical size. Such a feature was not specifically demanded for certification.

2.5.6 Possible Causes of Rudder Damage

2.5.6.1 Manufacturing Process

Examination of the rudder residuals determined that correct resin systems had been used and that the degree of cure was adequate. Although this analysis was based on the examination of only the small amount of the rudder that remained - since each side panel, spar, or rib is cured as a unit - the state of the small residuals is representative of the overall components. Therefore, the entire rudder was most probably constructed using the correct resin system and was adequately cured.

Some non-conformities in the occurrence rudder were found by quality assurance at manufacture, and corrected. Since most of the rudder was missing, it was not possible to examine each of these locations on the residuals and formally exclude them as a cause of the occurrence. However, a review of the repair schemes, repair procedures, and quality assurance used to correct these non-conformities was conducted, and did not reveal any inadequacies. It is considered improbable that these particular repairs led to the occurrence.

The residuals showed indications of possible insufficient bonding pressure during cure at the bond between the honeycomb and the inner skin along the edges of the z-section of the left side panel within a width of 20 mm. Subsequent investigation revealed that low bonding just aft of the z-section could be caused by insufficient caul plate pressure during cure as a result of mispositioning of the z-section, or of adverse accumulation of tolerances. This deviation would not necessarily be open to the outside air and could grow by vacuum cycling loads into a disbond. Further computer analysis determined that it was possible for such a disbond to grow under the influence of vacuum cycling. This deviation would have been present since manufacture and is a possible cause of the initial damage to the rudder.

2.5.6.2 Material Degradation

It is improbable that the occurrence rudder was damaged due to degradation by fatigue, aging, chemical contamination, or exposure to high temperature.

2.5.6.3 Mechanical Damage

It is improbable that the initial damage to the rudder was caused as a result of grinding damage, water ingress in the honeycombs, a seized hinge point, or the LPP repair.

Impact damage tests conducted during the course of this investigation demonstrated that, although blunt impact could cause core crush, it could not cause disbonds. Subsequent vacuum cycling tests demonstrated that core crush damage did not grow. Therefore, it is improbable that the initial damage was caused by a blunt impact. Since the misuse of high-pressure spray jets would likely result in damage similar to blunt impacts, it is also improbable that the initial damage to the rudder was caused by the misuse of high-pressure spray jets.

There was no evidence of impact damage on the residuals, but only a small amount of rudder survived for examination. The investigation was not able to discount the possibility that the rudder may have experienced a discrete event¹² that resulted in significant damages either on the ground or in flight.

The lightning strike to the tip of the rudder approximately eight years prior was a discrete event that could not be discounted as a possible cause of the initial damage since the entire upper end of the rudder was missing and could not be examined.

2.5.7 Failure Scenarios

2.5.7.1 Summary of Important Points

• The dynamic event was most probably caused by rudder flutter. Flutter analysis showed that the rudder would only flutter under the occurrence conditions if it were damaged. Therefore, the rudder was most probably damaged. Flutter analysis determined that the amount of damage necessary to cause flutter was significant. The occurrence conditions had been experienced by the aircraft many times previous, but the rudder had not experienced vibration, flutter, or failure. Therefore, the original damage was most likely small and grew over time.
  
• Although the mechanical cycling tests that were conducted during the original certification showed no damage growth, vacuum cycling tests conducted during this investigation demonstrated that it is possible for an initial damage to grow due to pressure differential associated with altitude.
  
• Results of investigative activity did not support the likelihood of a blunt impact scenario. A discrete event could not be discounted as a possibility since most of the rudder was not recovered for examination. Positive indications were found suggesting the possibility of a weak z-section bond at the interior lower front of the left side panel, and analyses showed that such damage could grow under vacuum loads.
  
• The interior skin is not easily accessible for inspection, and at the time of the occurrence, there was no inspection program for the inner skin. If the damage had been growing on the interior, it would not have been found by the existing inspections. A weak z-section bond would manifest itself in the bond of the inner skin.
  
• In the time leading up to, and at the time of the occurrence, the aircraft was neither manoeuvring nor experiencing turbulence. Therefore, the most significant load on the rudder would have been pressure differential between the core interior and the ambient air at altitude. This suggests that differential pressure may have driven the event.
  
• The investigation revealed that the first event in the occurrence sequence was a loud bang. Vacuum cycling damage growth tests found that, when the damage reached critical size, it grew explosively with a sudden violent release of energy, which caused a loud noise.
  
• The vacuum cycling tests found that explosive damage growth was so violent that it damaged the interior of the test chamber. In flight, such a violent event could possibly damage the opposite side panel. The flight dynamics analysis found that there was a large lateral force at the rudder, possibly the explosive damage growth in one side panel striking the other side panel.
  
• The sudden explosive growth of damage in one side panel and possible collateral damage to the adjacent panel would have resulted in a sudden reduction of rudder stiffness. The flutter analysis indicated that such a loss in stiffness could lead to flutter under the occurrence conditions.
  
• The time-domain flutter analysis for the large disbond case found that, shortly after the initiation of flutter, a large aft force at hinge 5 would exceed the failure load. This is consistent with the flight dynamics analysis that found that, shortly after the initial event, there was a large aft and downward tug on the tail. This is also consistent with the damage observed at hinge 5.
  
• The time-domain flutter analysis for the large disbond case also found that the next hinge to fail would be hinge 6, and that the loads on the rear VTP main attachment fittings would exceed ultimate strength. This is consistent with the damage observed at hinge 6 and at the VTP attachments.

2.5.7.2 Most Likely Failure Scenario

Some time before the occurrence flight, a disbond or in-plane core fracture occurred. The cause of this initial damage may have been a discrete event or a weak bond at the z-section. An indication of weak bonding was found at the z-section along the interior lower front of the left side panel. This damage then grew, possibly due to reduced pressure cycling loads associated with normal flight, without detection until it reached a critical size.

During the occurrence flight, having reached the critical size, the damage rapidly propagated, resulting in a loud and sudden explosion of the skin. This separation could have damaged the opposite side panel and created a large sideways force on the empennage. The resulting sudden reduction in torsional stiffness led to the onset of rudder flutter. About one second later, there was a large aft and downward force associated with failure of the upper hinge points, as the rudder separated. The rudder-separation event lasted about seven seconds, after which only 16 per cent of rudder effectiveness remained. During the remainder of the flight, more rudder pieces separated, and the aircraft landed with no aerodynamically effective rudder remaining.

3.0 Conclusions

3.1 Findings as to Causes and Contributing Factors

1. The aircraft took off from Varadero with a pre-existing disbond or an in-plane core fracture damage to the rudder, caused by either a discrete event, but not a blunt impact, or a weak bond at the z-section of the left side panel. This damage deteriorated in flight, ultimately resulting in the loss of the rudder.
   
2. The manufacturer's recommended inspection program for the aircraft was not adequate to detect all rudder defects; the damage may have been present for many flights before the occurrence flight.
   
3. This model of rudder does not include any design features in the sandwich panels to mechanically arrest the growth of disbond damage or in-plane core failure before the damaged area reaches critical size (such a feature was not specifically demanded for certification).

3.2 Findings as to Risk

1. A cockpit voice recorder with a 30-minute recording capacity was installed on the aircraft, and its length was insufficient to capture the rudder-loss event, resulting in critical information concerning the rudder failure not being available to investigators.
   
2. There was no published procedure for disabling the recorders once the aircraft was on the ground; valuable investigation information can be lost if the data are not preserved.
   
3. The sampling intervals for lateral and longitudinal acceleration captured by the digital flight data recorder were insufficient to record the highly dynamic conditions present at the time of the occurrence. This resulted in incomplete information being recorded.
   
4. The rudder position filtering and the necessity for additional analysis adversely affected the accuracy and effectiveness of the investigation efforts.
   
5. There are insufficient published procedures available to flight crew members to assist in recovering from a Dutch roll.
   
6. Declaring an emergency and clearly communicating the nature of the problem allows air traffic control to more easily coordinate between units and anticipate the needs of the crew in planning traffic management.
   
7. Procedures and practices that do not facilitate information sharing between crew members increase the likelihood that decisions will be based on incomplete or inaccurate information, potentially placing passengers and crew at risk.

3.3 Other Findings

1. Throughout the event, the crew received no electronic centralized aircraft monitor message relating to the control problem that the aircraft had experienced, and there were no other warning lights or cockpit indications of an aircraft malfunction.
   
2. After the rudder-separation event, the aircraft was not in danger of losing the vertical tail plane during the flight, either through loss of static strength or loss of stiffness.

4.0 Safety Action

4.1 Action Taken

4.1.1 Transportation Safety Board of Canada

4.1.1.1 TSB Recommendations-Airbus Composite Rudder Inspection Program

The separation of the rudder from Air Transat Flight 961 and the damage found during the post-occurrence fleet inspections suggest that the current inspection program for Airbus composite rudders may not be adequate to provide for the timely detection of defects. In addition, preliminary tests demonstrating that disbonds can grow due to altitude-related pressure differential suggest that increased attention is warranted to mitigate the risk of additional rudder structural failures. The consequences of a rudder separation include reduced directional control and possible separation of the vertical tail plane (VTP).

Therefore, on 27 March 2006, the Board recommended that:

The Department of Transport, in coordination with other involved regulatory authorities and industry, urgently develop and implement an inspection program that will allow early and consistent detection of damage to the rudder assembly of aircraft equipped with part number A55471500 series rudders.
(A06-05, issued March 2006)

Assessment/Reassessment Rating: Fully Satisfactory

On 14 June 2006, Transport Canada (TC) responded to Board Recommendation A06-05. TC concurs with the TSB suggestion that the current A310-300 inspection program may not be adequate to provide timely detection of defects to the rudder assembly.

Specifically, TC has indicated that the following corrective actions will be taken:

• A letter will be sent to Airbus and the Direction Générale de l'Aviation Civile (DGAC) of France detailing the results of additional inspection on a Canadian-registered A310-300 series aircraft.
  
• TC will recommend that a detailed inspection of the drainage path of the rudder for blockage be added to the current inspection program to ensure that there is adequate drainage.
  
• TC will request that Airbus review the current inspection program for the vertical stabilizer and rudder assembly for the A300/A310 aircraft series.
  
• A tap test is potentially not effective in determining small areas of delamination or disbond of composite materials; therefore, TC is working with the National Research Council of Canada to identify more suitable inspection techniques to detect failures in composite materials.
  
• To better identify failures in composite material, TC will coordinate with the International Maintenance Review Board to review the logic used in developing maintenance programs.

The TSB has reviewed TC's response and assessed it as Satisfactory Intent.

Further, on 27 March 2006, the Board recommended that:

The European Aviation Safety Agency, in coordination with other involved regulatory authorities and industry, urgently develop and implement an inspection program that will allow early and consistent detection of damage to the rudder assembly of aircraft equipped with part number A55471500 series rudders.
(A06-06, issued March 2006)

Assessment/ReassessmentRating: Fully Satisfactory

On 22 November 2006, the European Aviation Safety Agency (EASA) stated that it agreed with Board Recommendation A06-06 and that Airworthiness Directive 2006-0066 issued on 24 March 2006 requiring a mandatory one-time inspection satisfactorily addressed the Board recommendation.

Although the EASA agreed with the Board recommendation, Airworthiness Directive 2006-0066 referenced in its 22 November 2006 response does not provide for a repetitive inspection cycle that will allow early and consistent detection of damage, as is implied in the core of Recommendation A06-06. Nevertheless, the TSB assessed that the EASA is well positioned to take a leadership role within the industry in advocating for the development and integration of an inspection program dealing with composite materials. On that basis, a conference call was initiated on 20 December 2006.

Following the conference call, the EASA released a further response dated 17 January 2007. This response stated that all elements that may have potentially caused the damage growth were still being investigated. Furthermore, the EASA stated that, within the Continued Airworthiness process and in cooperation with Airbus, it continues its efforts to determine the most appropriate corrective actions. Subsequently, the EASA will consider mandating those actions, including amending the maintenance program to require repetitive inspections.

The 17 January 2007 response reflects EASA's commitment to continue to develop corrective actions that may include amending the maintenance program to require repetitive checks. Because EASA's most recent response contains a proposed action that, if implemented, will reduce or eliminate the risks associated with this deficiency, the response to Recommendation A06-06 is assessed as Satisfactory Intent.

4.1.1.2 TSB Safety Advisory-Cockpit Voice Recorder Duration

The cockpit voice recorder (CVR) installed on Air Transat Flight 961 employed a continuous-loop magnetic tape of 30-minute duration. The event of the rudder separation on the Air Transat Flight 961 CVR was recorded approximately 60 minutes before landing. Crew conversations and cockpit sounds before the event of the CVR recording may have provided substantial insight into any initiating or precursor events that led to the accident. Given the need for longer periods of recorded sound to capture the initiating events of aviation accidents and the availability of two-hour CVRs, the Board believes that such recorders should be mandated by regulatory authorities worldwide.

Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC re-addressing its concern that, in 2005, there are still commercial aircraft not equipped with a CVR with at least two-hour recording capacity.

4.1.1.3 TSB Safety Advisory-Digital Flight Data Recorder Recording of Filtered Data

With filtering, the ability to differentiate between a rudder excursion and a data filtering artefact is limited. The filtering of raw sensor data necessitated additional analysis to estimate the probable rudder position history, ultimately affecting the accuracy and timeliness of the investigation efforts. The Canadian Aviation Regulations (CARs) do not address the requirement to test parameter accuracy under both static and dynamic conditions as does 14 CFR (Code of Federal Regulations) of the United States. The CARs continue to refer to the previous minimum operational performance specifications (MOPS) for flight recorders (ED55), rather than the current ED112, which offers guidelines on data filtering. The current Federal Aviation Administration (FAA) Notice of Proposed Rule Making (issued 28 February 2005) regarding revision of digital flight data recorder (DFDR) regulations does not address the recurring problem of filtered data.

Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC addressing its concern that data filtering may prevent investigators from determining accurate control surface positions from recorded data, particularly under dynamic conditions.

4.1.1.4 TSB Safety Advisory-Digital Flight Data Recorder Low Recording Rates

The Air Transat occurrence demonstrated that further improvements to DFDRs are needed to more effectively determine the sequence of events in an accurate and timely manner. Specifically, due to the low recording rates for acceleration data, the existence of aeroelastic effects as a possible failure mode could not be positively identified. The limited lateral acceleration data also prevented the characterization of the initiating event.

Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC addressing the possible conduct of a review of recording rates of DFDR data to ensure that adequate information is made available to analyze dynamic flight events.

4.1.1.5 TSB Safety Advisory-Dutch Roll Recovery Procedure

For this loss of rudder occurrence, the absence of sufficient guidance in Dutch roll recovery resulted in a situation wherein the crew engaged the autopilot, which led to a worsening of the flight characteristics. Although the engagement of the autopilot did not increase the severity of consequences for this occurrence, under other circumstances, such action might have led to an aircraft upset.

Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC suggesting that TC, in concert with industry, FAA, DGAC, and EASA, may wish to conduct a review of the adequacy of published procedures to ensure that pilots have the required knowledge to safely recover from a Dutch roll situation.

4.1.2 National Transportation Safety Board

As a result of its investigation into an Airbus A300-600 aircraft operated by FedEx Express that was damaged during routine maintenance on 27 November 2005, the National Transportation Safety Board (NTSB) recommended on 24 March 2006 that the FAA

Require that all operators of Airbus A-300 series airplanes immediately [possibly before further flight] comply with four Airbus All Operators Telexes (AOT) A300-55A6042, A310-55A2043, A330-55A3036, and A340-55A403 dated March 2, 2006. Any disbonding to the rudder skins that occurs in the presence of hydraulic fluid contamination should be repaired or the rudder should be replaced as soon as possible, well before the 2,500 flights specified in the AOTs. (A-06-27, issued March 2006)

The NTSB further recommended that the FAA

Establish a repetitive inspection interval for Airbus premodification 8827 rudders until a terminating action is developed. The interval should be well below 2,500 flights. (A-06-28, issued March 2006)

4.1.3 Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile

On 10 March 2006, the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile recommended that [translation] the EASA impose as soon as possible an appropriate inspection program for the concerned rudders (part number A55471500). (000153/BEA/D, issued March 2006)

4.1.4 Airbus

4.1.4.1 All Operators Telex (AOT-1)

Based on the initial information uncovered during this TSB investigation, Airbus, on 17 March 2005, issued an AOT for the inspection of all aircraft equipped with part number A55471500 series rudders. This one-time visual and tap-test inspection involved 222 Airbus A310s, 146 Airbus A300-600s, 6 Airbus A330s, and 34 Airbus A340s, for a total of 408 aircraft. In addition, a more detailed inspection of rudder side panels on over 20 aircraft was conducted using the elasticity laminate checker (ELCH) test method. Finally, the attention drawn to rudders by the occurrence resulted in operators examining their rudders more closely during maintenance. These various inspections found examples of disbonds, damage around hoisting points and trailing edge fasteners of the rudder, corrosion and abrasion at hinges, seized hinges, hinges with excessive free play, and water ingress.

4.1.4.2 All Operators Telex (AOT-2)

On 02 March 2006, the aircraft manufacturer issued a second series of AOTs for the inspection of all aircraft with rudder part number A55471500 series rudders. These AOTs were subsequently made mandatory by an Airworthiness Directive issued by the EASA, representing the State of manufacture. The aim was to verify the structural integrity of the rudder by means of one-time tap-test inspection to the interior face sheets of the rudder side panels, as well as checking the drainage holes at the bottom of the rudder and cleaning hydraulic fluid from the external surfaces. Access to the interior of the rudder was through the inspection holes in the front spar of the rudder. It is noted that the access to inboard surfaces from the inspection holes is limited. No disbonds have been found.

4.1.5 Air Transat

4.1.5.1 Abnormal Situation

Based on the initial information uncovered during this investigation, Air Transat issued, on 10 November 2006, new procedures for situations that are not typical. The following text was added to the Cabin Attendant Operation Manual:

Never assume that others experienced the same effects that you have or are fully aware of the events taking place. Communication is the key for a proper evaluation of the situation and appropriate corrective measures. If the Flight Director can not be reached and time is critical, Cabin Attendants must contact the Flight Deck Crew without delay.

4.1.5.2 Preservation of Recorder Information

Air Transat issued, on 16 May 2006, a new Accident/Incident Response Checklist as part of the Flight Crew Operating Manual for the A-310. A procedure to disable the appropriate circuit breakers to preserve the recorded data for both the CVR and the DFDR is described. This new standard operating procedure also highlights that preserving the recorded information is critical to the investigative process after an occurrence.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 21 June 2007.

Appendices

Appendix A - Direct Access Recorder/Digital Flight Data Recorder Data Comparison

Appendix B - Glossary

AFD	assistant flight director
AFRP	aramid fibre-reinforced plastic
agl	above ground level
AIM	Aeronautical Information Manual
AMM	aircraft maintenance manual
AMO	approved maintenance organization
AOC	air operating certificate
AOT	all operators telex
APYA	autopilot yaw actuator
ARINC	aeronautical radio incorporated
asl	above sea level
ASTM	American Society for Testing and Materials
ATC	air traffic control
ATPL	airline transport pilot licence
CARs	Canadian Aviation Regulations
CFRP	carbon fibre-reinforced plastic
CG	centre of gravity
cm	centimetre(s)
cm2	square centimetre(s)
CVR	cockpit voice recorder
daN	decanewton(s)
DAR	direct access recorder
DCB	double cantilever beam
DFDR	digital flight data recorder
DGAC	Direction Générale de l'Aviation Civile (France)
DVI	detailed visual inspection
EASA	European Aviation Safety Agency
ECAM	electronic centralized aircraft monitor
EDX	energy dispersion X-ray spectroscopy
ELCH	elasticity laminate checker
EUROCAE	European Organisation for Civil Aviation Equipment
FA	flight attendant
FAA	Federal Aviation Administration
FCC	flight control computer
FD	flight director
FL	flight level
FOD	foreign object damage
g	load factor
GFRP	glass fibre-reinforced plastic
GVI	general visual inspection
GVI (G)	general visual inspection from the ground of empennage
GVI (A)	general visual inspection at arm's length of empennage
GVT	ground vibration test
HIRF	high-intensity radiated fields
Hz	hertz
IR	infrared
KCAS	knot(s) calibrated airspeed
KFLL	Fort Lauderdale/Hollywood International Airport
kg	kilogram(s)
KIAS	knot(s) indicated airspeed
KMIA	Miami International Airport
kN	kilonewton(s)
LPP	lightning protection plate
m	metre(s)
m2	square metre(s)
m3	cubic metre(s)
mm	millimetre(s)
mm2	square millimetre(s)
MOPS	minimum operational performance specifications
MRTT	multi-role tanker transport
MSN	manufacturer's serial number
MUVR	Varadero/Juan Gualberto Gómez International Airport
N	newton(s)
NDI	non-destructive inspection
nm	nautical mile(s)
NTSB	National Transportation Safety Board
PPC	pilot proficiency check
QRH	quick reference handbook
QSMS	quality safety management system
RTL	rudder travel limiter
SB	Service Bulletin
SRM	structural repair manual
TC	Transport Canada
Tg	glass transition temperature
TSB	Transportation Safety Board of Canada
TSC921	Air Transat Flight 921
UFDR	universal flight data recorder
UTC	Coordinated Universal Time
VTP	vertical tail plane
XPS	X-ray photoelectron spectroscopy
YD	yaw damper
º	degree(s)
ºC	degree(s) Celsius

Previous | Table of Contents

---

1. See Glossary at Appendix B for all abbreviations and acronyms.

2. All times are Coordinated Universal Time (UTC) unless otherwise noted.

3. Dutch roll is a motion of an aircraft that consists of simultaneous oscillations of the bank (or roll) angle, the sideslip angle, and the heading angle. The roll manifests itself as an out-of-phase combination of "tail wagging" and rocking from side to side. The motion is normally well damped in most light aircraft, though some aircraft with well-damped Dutch roll modes can experience a degradation of damping as airspeed and altitude increase. Dutch roll stability can be artificially increased by the installation of a yaw damper, as is the case with most swept-wing aircraft (see also Section 1.5.8.3).

4. The Airplane Upset Recovery Training Aid was developed by aircraft manufacturers, airlines, pilot associations, flight training organizations, and government and regulatory agencies to help pilots recover from unintentionally exceeding parameters normally experienced during line operations or training.

5. This is not the case for A310 Dutch roll for which Dutch roll characteristics remain convergent in the whole flight envelope.

6. These allowable values are in the process of being reviewed as a result of damage propagation studies that were conducted during the course of this investigation.

7. A tap test is a non-destructive inspection technique that involves gently striking the inspected component with a hand-held mass and evaluating the resulting sound to identify the presence of damage.

8. Control input where one rudder pedal is depressed for a short period followed by immediate depression of the other rudder pedal for an equal period.

9. Sampling theory indicates that, to measure certain frequency components, sampling must occur at a frequency that is twice that of the frequency components of interest (Shannon's theorem).

10. The adhesive at the joint between the honeycomb and the face sheet forms a curved surface known as a meniscus.

11. EDX and XPS percentages are measured using different scales (that is, 1 per cent phosphorus measured using EDX does not equal 1 per cent phosphoric acid-ester measured using XPS).

12. The term discrete event is used to refer to an occurrence that could have resulted in significant damages to the rudder either on the ground or in flight. Possibilities include, but are not limited to, impact by foreign objects or a lightning strike. Such damage cannot be discounted as a possible cause because only a small amount of the rudder survived for examination, and because visual inspection of the rudder from the ground is limited.