AAIB Bulletin: 9/2010

two observers representing the aircraft owner and the airline due to take delivery of the aircraft. No problems were identified during the pre-flight preparation and the aircraft departed at 1400 hrs with the commander as the handling pilot. The commander climbed the aircraft to FL410, conducted a series of checks and, after about 45 minutes, descended to FL150 where an APU bleed check was performed and the aircraft was configured for the flight control manual reversion check. The aircraft was flown at FL150, 250 kt3, with the fuel balanced, the autopilot and autopilot selected off, the sTAB TriM MAiN ELEC and AUToPiLoT TriM switches set to the CUToUT position, and the aircraft in trim. The CDFs also required sPoiLEr A and B switches to be selected off. All these checks were conducted using the operator’s CDFs and not the AMM extracts as the guiding reference. Before the manual reversion check began, the individual hydraulic systems were isolated in turn by placing the FLT CoNTroL switches A and B to the oFF position individually and reinstating each in turn enabling the flight controls to be checked for normal operation on a single hydraulic system. operation was confirmed as satisfactory on both systems. The commander then released the controls and the co-pilot selected both FLT CoNTroL swiTCHEs (A and B) to the oFF position, removing all hydraulic assistance from the primary flight controls. As he did so the aircraft pitched rapidly nose-down. The commander pulled back on the control column with considerable force but was unable to prevent the aircraft from maintaining a nose-down pitch attitude of 2.8° and descending at up to 3,100 ft/min. The commander decided to abandon the check and reinstate the hydraulics. However, he did not wish to re-engage them immediately as he stated that he had been trained that, should the aircraft pitch up or down uncontrollably during a manual reversion check, the aircraft should be rolled to unload the pressure on the elevators and the controls released before the hydraulics are reinstated. it was his understanding that not releasing the controls prior to reinstating the hydraulics could overstress the airframe or cause serious injury to the handling pilot. He therefore rolled the aircraft left to 70° before releasing the controls and calling for the co-pilot to re-engage the flight control switches. The aircraft continued to roll to 91°. The recording from the Cockpit Voice recording indicates that at this point there was confusion between the two pilots. The commander believed that hydraulic power had been restored to the flight controls although there is no evidence that the FLT CoNTroL switches had been moved from the oFF position. The commander retarded the thrust levers and selected the speed brakes but the spoilers had been selected oFF as part of the Footnote 3 All airspeeds in this report refer to computed airspeed. Computed airspeed is the airspeed displayed to the crew and recorded on the Flight Data recorder. 3 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 test procedure and the speed brakes, therefore, did not deploy. He then rolled the wings level and attempted to arrest the rate of descent. This had peaked at 20,000 ft/min with the aircraft pitched 30° nose-down after the aircraft had been rolled to the left. The control forces remained high but the commander considered this to be due to the aircraft’s speed, which he observed at a maximum of 447 kt. The commander continued to maintain backpressure on the controls and made a PAN call to ATC. The aircraft eventually recovered from the dive at about 5,600 ft amsl having entered a layer of cloud. The pilots reviewed the situation and selected the FLT CoNTRoL switches, which had remained oFF throughout the flight excursion, to the oN position. The control forces returned to normal. The commander stated he had considered repeating the test, but was concerned that, as a result of the incident, the aircraft might have sustained damage. The check flight was abandoned and the aircraft returned to Southend. Considering possible structural damage, the commander kept the speed below 250 kt and configured the aircraft for landing early during the approach. The aircraft appeared to operate normally and landed without further incident at 1606 hrs. The aircraft was inspected after landing for damage or deformation in accordance with AMM task 05-51-04 titled ‘severe or unusual turbulence, stall, or speeds more than design limits – maintenance practices (conditional inspection)’. No evidence of damage or deformation of the structure was found. During the AAIB’s investigation it was noted that the second observer’s seat in the cockpit was not fitted. one of the observers confirmed that throughout the incident flight he had sat on a storage cupboard behind the commander’s seat, and was not restrained by a safety harness. Weight and Centre of Gravity The aircraft’s takeoff weight was 47,633 kg and MACToW 20.6%. The centre of gravity remained within limits throughout the flight. Flight Recorders and Radar The aircraft was fitted with a 25-hour Flight Data recorder (FDR) and 2-hour Cockpit Voice Recorder (CVR). These were both removed from the aircraft following the incident and taken to the AAIB for analysis. Mode S Secondary Surveillance radar (SSr) data was also recorded for the incident flight, providing information about time and position of the aircraft, and a number of aircraft airborne parameters that matched those recorded on the FDR. Figure 1 shows part of the aircraft’s track derived from the radar, annotated with extracts of speech recorded on the CVR. A time history of salient parameters from the FDR for the incident is shown at Figure 2. The graphical presentation starts just after the aircraft was trimmed, at FL150, at a computed airspeed of 245 kt, the STAB TriM MAin eleCT and AUTo PILoT TRIM switches were selected to their CUToUT positions, and Spoiler A and B switches were selected to oFF. In this trimmed condition (with zero stick force) the elevator position was about 5º trailing edge down. The FLT CoNTRoL B switch was then put in the oFF position and the flight controls were moved slightly. The switch was then put back to the oN position and the FLT CoNTRoL A switch was then put in the oFF 4 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 position and the flight controls again moved slightly. The co-pilot sought confirmation from the commander that he was prepared before each selection and verbally confirmed each action. With the FLT CoNTRoL A switch still in the oFF position, the co-pilot asked the commander if he was ready for the FLT CoNTRoL B switch to be selected oFF (putting the aircraft in manual reversion). The commander replied “yeS go AheAD”. The hydraulics to the B system were turned off (time 15:36:47). The elevator position rapidly moved to just over 8º trailing edge down (an increase in 3º trailing edge down from the trimmed position), and the aircraft pitched from 2º nose up to 2º nose-down. The commander immediately pulled back on the control column, reaching full aft stick five seconds later. This was enough to return the elevators to their trimmed position. He was, however, unable to maintain this control column position and the aircraft remained in a nose-down attitude. The amount of column movement and force required with the hydraulics off increases to produce the same elevator deflection with the hydraulics on. The column force being pulled throughout this time was in excess of 170 pounds-force. Ten seconds after system B had been selected off (time 15:36:57), the aircraft had descended almost 300 ft and was continuing to descend at a rate of about 2,200 ft/min. The airspeed had increased by 10 kt to 255 kt and was still accelerating. Figure 1 G-EZJK radar track with extracts from CVR 5 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 The commander then rolled the aircraft to the left at a little under 8º/second and, as the aircraft passed through 50º bank angle (time 15:37:04) said “geT ready To puT iT baCk”. The co-pilot responded with “hey” and “say again” to which the commander said “and baCk”. Then, as the bank angle passed through 70º, the commander released the pressure on the control column, allowing the elevator to move back to just under 8º trailing edge down. The descent rate was now 6,000 ft/ min and increasing, and the aircraft had descended a further 400 ft to FL143 while accelerating to 270 kt. The commander pulled back on the control column, reducing the elevator deflection a little and, as the bank angle approached 91º (maximum recored), put in a wheel input to roll the wings level. The engine thrust was also reduced and the speed brakes selected but the speedbrakes did not extend as spoiLer a and b switches were still in the oFF position. The aircraft’s descent rate increased considerably, reaching a maximum of 20,000 ft/min as it descended through about FL110. at this point the bank angle was reducing through 40º, the pitch attitude was 30º nose-down, and the airspeed was 320 kt (Mach 0.60) but still accelerating. as the aircraft’s descent rate started to reduce, the commander made a pan call (time 15:37:20). This call coincided with the sounding of the aural overspeed warning which remained active for the next 48 seconds. The maximum recorded airspeed during the recovery was 429 kt (Mach 0.719). The maximum recorded vertical acceleration was 1.6 g and the minimum recorded altitude was 5,655 ft amsl. The Mach trim was in operation above Mach 0.615 making pitch-up commands to the elevator in addition to deflections demanded by the commander’s control column inputs. There was no recorded discussion between anyone on the flight deck during the event. The first comment was recorded 76 seconds after the commander called “and baCk” and shortly after the aircraft had levelled at 7,000 ft amsl. The commander then said “are They aLL baCk on – puT aLL The [unintelligible] ConTroLs baCk on”. Both flight control system A and B hydraulics were then reinstated (time 15:38:27). a transmission was made by the commander 15 seconds later cancelling the pan. Flight ‘tests’ and flight ‘checks’ The Caa Check Flight handbook states that: ‘Flight testing of aircraft provides a basis to establish compliance with certification requirements for new aircraft and changes to aircraft. Other flight testing referred to as Check Flights or in-flight surveys can be carried out periodically on in-service aircraft as one of the processes to ensure that an aircraft continues to comply with the applicable airworthiness requirements. Additionally, maintenance Check Flights may be carried out following a maintenance activity on an aircraft to provide reassurance of performance or establish the correct functioning of a system that cannot be fully established during ground checks.’ easa issued npa 2008-20 in august 2008 on the subject of flight testing. This NPA introduced a proposed change to Part 21 regulations with regard to flight testing by design and production organisations. it takes the approach of defining test flights into four categories of reducing risk based on the nature of the testing being carried out. These range from initial envelope definition and expansion flights at the top end through to production and certification compliance demonstration 6 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 2 Salient FDr parameters for the serious incident to g-eZJk 7 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 flights at the lower end. The npA specifies the different qualifications, competence and experience required by pilots and engineers operating these different flights. it also introduces requirements for company procedures and documentation to support their operation. The npA specifically states that the new proposals are applicable to design and production organisations only. The rationale behind this is explained in the NPA by drawing the distinction between flight ‘tests’ (performed by manufacturers) and flight ‘checks’ (performed by operators) as follows: ‘Flight tests may be broadly defined as flights necessary during the development phase of a new design (aircraft, engine, parts and appliances) to show compliance to certification requirements. Therefore, during such flights there is a certain amount of “unpredictability”, which does not happen in the case of check flights and acceptance flights. Maintenance activities should only use approved data. Therefore, flights performed after maintenance should be for the purpose of performing checks. Such checks are performed by flight crews in accordance with EU-OPS and national rules implementing JAR-OPS 3 and JAR-FCL.’ Upset recovery technique Several publications available to the crew contained information concerning flight upset recovery techniques. The relevant extracts are as follows: ● Aircraft Qrh (see Figures 3 and 4) ● Boeing 737-700 AMM (see Figures 5 to 8) The Boeing 737-700 AMM extract given to the crew referred to recovery techniques in the Flight Crew Training Manual to be used in the event of a pitch upset being encountered during the manual reversion test. ● CAA Check Flight handbook. Section 3, Tech 2, part 10 of the CAA Check Flight Handbook, published in April 2006, covering flying control checks states: ‘It might be possible to put some bank on the aircraft to turn a large pitch up or pitch down into a turn manoeuvre before re-powering the system. This might prevent an unusually high or low pitch manoeuvre developing.’ The qualified test pilot who was the author of this section stated that this was intended as a banking manoeuvre conducted momentarily before re-powering the system. If conducted in accordance with the CAA schedules the availability of the rudder would ensure the ability to roll the aircraft readily which, in the pitch-down case, would ensure minimal height loss prior to re-powering the controls. The purpose of the bank in the pitch down case is to limit the effect of the pitch-up moment resulting from the re-establishing of power to the controls. The CAA Check Flight Handbook also advises that where significant unexpected results are encountered no attempt should be made to rectify or explore them through experimentation or repetition. 8 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 3 extract one from Aircraft Qrh 9 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 4 extract two from Aircraft Qrh 10 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 5 Extract one from Boeing 737-700 AMM 11 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 6 Extract two from Boeing 737-700 AMM 12 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 7 Extract three from Boeing 737-700 AMM 13 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Figure 8 Extract four from Boeing 737-700 AMM 14 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Maintenance Background The operator was beginning the process of handing back aircraft previously on lease. To minimise disruption to their operation, the operator and their base maintenance provider (referred to as MRo A) put in place various contracts with third party companies to carry out and supervise any associated maintenance as discrete packages of work. These contracts included a second Part 145 approved MRo (referred to as MRo B) and two project management and oversight consultancy companies (referred to as consultancy companies A and B). These arrangements are shown schematically in Figure 9. The consultancy companies each placed an on-site representative at MRo B’s facility where the work was to be carried out. (The Representatives are referred to as Rep A and Rep B, where A and B correspond to the consultancy companies they represent.) These representatives were contracted by the consultancy companies to manage the day-to-day progress of the maintenance input and to handle any additional work requests. Manual reversion test The manual reversion test schedule (included in the CDFS) is carried out by switching off hydraulic systems A and B (removing power from the flight controls) and then trimming the aircraft in pitch using the manual trim wheel to determine the amount of adjustment required to trim the aircraft for level flight. The AMM limit, for aircraft configured as in this case, was 12 turns. Figure 9 Chart of parties involved in aircraft hand-back (direct involvement in the incident is highlighted in yellow.) 15 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Check flight documentation The commander of the flight stated that he found the AMM to be poorly constructed and difficult to follow. He also believed that the operator’s own check schedule (CDFS) encompassed the requirements of the check and therefore chose not to use the AMM, either before or during the flight check. Comparison of the AMM with the operator’s CDFS identified a number of differences. The most significant related to the AMM procedure requiring the selection of the cockpit switches for hydraulic systems A and B to be placed directly to the STAnDBy ruDDer position during the test. This removes hydraulic power to the flying controls, except the rudder as it requires control forces that are too great for manual control. in contrast, the operator’s CDFS called for the switches to be selected to the oFF position, as part of an additional, unrelated test. The CDFS did not then require them to be selected to the STAnDBy ruDDer position prior to conducting the manual reversion test, thereby rendering the rudder inoperable by the pilots during the incident. In addition, the AMM procedure called only for the autopilot stabiliser trim cutout switch to be selected to the CUToUT position, whereas the operator’s CFDS called for the main autopilot switch to be selected to the CUToUT position as well. operation of the stabiliser trim autopilot function during the test would interfere with the manual wheel crank procedure. The main trim, however, should be available to assist recovery during an upset. Maintenance delivery flight The aircraft was ferried to Southend for its end-of-lease maintenance on 1 December 2008. During this flight the crew used their CDFS to carry out checks to identify any previously unrecorded defects and allow rectification work to be planned into the forthcoming maintenance input. one of the checks was a manual reversion test. During the test the commander identified that 11.5 turns of nose-up trim were required to trim the aircraft for level flight in the test configuration. Technical log entries The operator’s policy was not to include ‘for information’ items in the technical log. The commander considered the policy was applicable to the maintenance delivery flight and, as the manual reversion test result had been within the prescribed AMM limits, he did not record the results of the test he carried out. However, he did record in the margin of the check schedule, next to the manual reversion test item, the words: ‘11.5 NU [nose up] turns reqd.’ and on the following page of the CDFS he circled the limits applicable to the CG and wrote ‘11.5 act’. Post-flight handover when the aircraft arrived at Southend the commander delivered the aircraft to the MRo B facility and spoke to Rep B as he was representing the operator. (It is possible that Rep A and a member of staff from MRo B were also present for some or all of this discussion.) They discussed the CDFS check findings and the commander reported the result of the manual reversion test, before handing over a copy of his annotated check schedule. Both Rep A and Rep B recalled the commander suggesting that as the test result of 11.5 turns was 16 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 close to the limit of 12 turns it should be examined and rectified during maintenance. After the incident, the commander explained that the results of the manual reversion test could be variable and his comments were focused on his concerns that if the aircraft trim was not adjusted, a repeat test during the end-of-lease acceptance flight might identify the aircraft as out of limits and subsequently be rejected by the lessor. Later the commander stated that he only highlighted the result of the test and did not request that any rectification work should be carried out. Rep B considered the information provided by the commander to relate to an issue which was present before the aircraft commenced the hand-back process. He therefore judged that it was the responsibility of MRo A to deal with the problem and thus it was a task to be managed by Rep A on their behalf. Rep B stated that he placed the copy of the flight schedule, given to him by the commander, on his desk and did nothing further with it. Staff communications and company procedures The quality manager for MRo B reported that it was normal to have a full debrief between their staff, the representatives and the flight crew following a check flight at the end of a maintenance input at their facility. As this was a pre-input delivery flight, which they had not been briefed would include a shakedown check, no debrief meeting was scheduled. He also reported that the aircraft commander had not discussed the pitch trim issue with any of their staff after the flight, and that no MRo B staff had seen or been given a copy of the commander’s annotated schedule until after the incident. Rep A reported that he saw the commander in the hangar after the ferry flight. The commander verbally recounted the results of the manual reversion test, and reportedly suggested this was something that needed to be ‘addressed’. Rep A then continued with his day-to-day tasks and did not immediately write down the information provided by the commander during their conversation. He also stated that he had been unaware of the commander’s annotated flight schedule and did not see a copy until after the incident flight. About 10 days later, the Rep A remembered the conversation with the commander and raised the subject at a review meeting. As the issue was still outstanding, he compiled a customer request form annotating the task description box with the words: ‘Ref crew report I/B to Southend stab trim requires 11 turns nose down. Carry out adjustment and check during maintenance input.’ Rep B was not available for consultation at this time and Rep A submitted the form directly to MRo B staff for action. The form was reviewed and signed by individuals from MRo B’s production, commercial and planning departments on 19 December 2008. No additional technical review of the task took place. MRo B’s planning staff raised a work card for the adjustment task the same day, transcribing the description given in the customer request form directly onto a work card. Rep B reported that he remembered inspecting this work card in the rack next to the aircraft, but only to ensure that the work had been raised and would be carried out, not to check the technical content. The work card was actioned by the maintenance team responsible for the aircraft on 10 January 2009. The 17 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Work Performed section of the work card was annotated with the following: ‘Elevator tab rods shortened by half a turn at eye end i.a.w. AMM 27-31-00.’ The licensed engineer amended the work card by hand to include a duplicate inspection task and a flight check task in accordance with the AMM. The duplicate inspection was then carried out, a technical log item was raised to complete the required flight check and the card was certified complete. The AMM task for the elevator power-off flight test includes troubleshooting steps to be taken in the event of an out-of-limits result, before adjustment of the pushrods is directed. By referring only to the AMM task for adjusting the tab pushrods these steps were overlooked. MRO B management and hangar staff reported that a request for this type of work was unusual in that it did not relate to a defect in the aircraft technical log and was not accompanied by any source data (eg a crew report). However, as it was in the form of a signed customer request, they carried out the work as specified. Although routinely used, the customer work request form process had not been defined within MRO B’s procedures and existed only as a contractual requirement. As such there was no definition of what supporting source data was necessary for a request to be accepted by their production and planning staff. Following completion of the maintenance input, a combined post-maintenance check flight and end-of-lease customer demonstration flight was scheduled. The engineering team from MRO B printed extracts from the AMM relating to the post-tab adjustment flight check and gave these to the commander of the aircraft prior to the flight. Previous incident The CAA MOR database revealed four other reported incidents where the incorrect adjustment of the elevator balance tabs of B737 aircraft had led to an uncontrolled pitch-up or pitch-down during the subsequent check flight. In all cases the aircraft had been safely recovered. This was achieved in two of the incidents by reinstating the hydraulic systems and in a third incident by use of the trim system. In one of the nose-down events there was a reported altitude loss of 900 ft. The fourth event had occurred to the commander involved in this incident when, in November 2005, he experienced an uncommanded pitch-up during a manual reversion test on a B737-36N with the same operator. Although a different MRO carried out the maintenance and the contributory factors were not the same, the cause of the incident was identified as an incorrect adjustment of the elevator balance tabs. This resulted in a large pitch-up reaction when the hydraulics were switched off during the flight check at FL350. The commander had, in response, rolled the aircraft through about 65° before releasing the controls and reselecting the hydraulics. He was able to re-establish control and repeated the test, this time managing to control the pitch, before landing. The commander informed the CAA Flight Test Department of the event and subsequently received a letter from the CAA’s Chief Test Pilot congratulating him on the handling of the situation. As a result of this incident the commander had acquired a procedure of unknown origin which purported to define a visual check of the elevator balance tabs, intended as part of the post-maintenance walk round checks, to show that they were correctly rigged. 18 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Subsequent incident The same operator suffered a further incident on 19 May 2009 during another post-maintenance air test to check asymmetrical flight control forces to another Boeing 737-73V, G-EZJN. This was to be conducted together with a Customer Demonstration Flight as the aircraft was about to be returned to its owner at the end of its lease. The crew was composed of three management captains; one of these was the commander of the incident involving G-EZJK who acted as the co-pilot on this occasion. The commander of this flight reported that prior to departure there had been confusion between the three pilots as to which procedure should be followed to conduct the asymmetrical check. After consultation by telephone with the Air operations Check Flight Manager, the commander finally opted to use the appropriate AMM procedure rather than the check contained in the CDFS. During the check, some of the required procedures were unintentionally missed and the aircraft experienced a large pitch-down and a moderate roll to the right. The crew were unsure how to proceed with the AMM procedure under these circumstances and opted to use the CFDS instead. in doing so they again unintentionally omitted one of the procedures which resulted in the rudder PCU being un-powered. This made attempts to correct the roll using rudder trim unsuccessful. B737-700 pitch control system Description The B737-700 is fitted with tabs on the trailing edges of the elevator control surfaces. These act as balance tabs to reduce the control forces required to move the elevators and are critical for manual control of the aircraft in the event of a double hydraulic system failure. Two control rods link each tab to the elevator control system such that when the elevators are deflected the tabs also deflect. The position of the tab relative to the elevator is controlled by the length of the rods. Coarse adjustments to the pushrod length are made by rotating the ‘eye’ end of the pushrods, fine adjustments are made by rotating a vernier fitting (see Figure 10). Maintenance adjustment Based on the pilot’s report, a 0.05 inch trailing edge down adjustment of the tab was required to achieve neutral trim (although the aircraft was within AMM limits). A review of the adjustment task completed by MRo B staff, as a consequence of the information provided in the customer work request, showed that they calculated an adjustment of 0.105 inch trailing edge up was necessary to achieve neutral trim. The AMM recommends that the tab is only rigged to the nearest 0.01 inch. They noted that a half turn adjustment of the rod ‘eye’ end gave a 0.1 inch adjustment in the tab trailing edge position, and so elected to round down to this figure to avoid the need to adjust the vernier bushing. A duplicate inspection of the task was completed in line with requirements, but this did not identify any issues. However, the difference between the required and actual adjustment of the tab trailing edge position was roughly equivalent to applying 18 nose-down turns of the trim wheel to a balanced aircraft. System testing Currently, the only means of assessing the effect of the balance tab rigging on aircraft trim is to conduct an in-flight check. The procedure for carrying out this elevator power-off flight check is documented in the aircraft manufacturer’s AMM. The AMM is primarily an engineering document and is not used routinely by flight crew. The schedule format differs from the types of checklists and schedules normally used by flight crews in that it also contains engineering information. 19 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Maintenance contractual agreements A general terms agreement was signed between MRo B and the operator for the end-of-lease work being carried out. This agreement contained several relevant clauses: ● The operator was required to appoint a local representative who had power to act on behalf of the operator in respect to all aspects of the contract. Elevator balance tab Elevator Pushrods ‘Eye’ end and vernier adjustment of pushrod length Elevator balance tab Elevator Pushrods ‘Eye’ end and vernier adjustment of pushrod length Elevator balance tab Elevator Pushrods ‘Eye’ end and vernier adjustment of pushrod length Elevator balance tab Elevator Pushrods ‘Eye’ end and vernier adjustment of pushrod length Elevator balance tab Elevator Pushrods ‘Eye’ end and vernier adjustment of pushrod length Figure 10 Elevator tab pushrods 20 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 ● MRO B would afford reasonable access to the operator’s quality department to perform quality surveillance and audits pursuant to the obligations of the operator’s AOC approval. ● The UK CAA was the responsible authority with regard to the contract. ● No unscheduled defect rectification could be deferred or carried out by MRO B unless prior approval was granted by the operator. ● Any check flights were to be performed in accordance with the operator’s Continuing Airworthiness Management Exposition (CAME). The agreement was signed by both parties and accepted by the UK CAA, but had nothing which clearly identified the process, specific approval requirements or responsibilities for technical decision making. The operator’s Technical Procedures Manual (TPM) had a whole chapter covering outsourced maintenance and the selection of suppliers. However, these related only to Part 145 maintenance providers. The TPM also had a provision for exchange of information during outsourced maintenance, with a table of required meetings to cover various topics and a schedule of when they should be carried out. This included the requirement for technical review meetings, but did not define a schedule for when these meetings should take place. It was reported that no technical review meetings were carried out during the maintenance input for G-EZJK although daily meetings addressed the progress of the maintenance input. Additionally, the operator’s CAME contained only very brief references to conducting test/check flights. It referenced the TPM, but this also contained no detail regarding how, when, and by whom these flights should be carried out. The operator’s Operations Manual covered, in more detail, the flight operations aspects of conducting check flights, but there was no detail concerning the requirements for interfacing with the maintenance organisations involved. The operator has since produced a detailed Flight Check Supplement in line with advice issued by the UK CAA and has included detailed requirements for check flights in their TPM. MRO B was audited by the operator’s quality department before the first aircraft underwent ‘end-of-lease’ maintenance. There were no significant findings. End-of-lease maintenance activity MRO A and MRO B developed an interface document to cover the end-of-lease maintenance activity. The document covered, in detail, the paperwork, roles and responsibilities, and planning aspects of the working relationship between the two MROs and the operator. It made extensive provision for quality processes and auditing and defined the role of the on-site representative for MRO A. The clause relating to this stated that the representative (Rep A) was required to ‘monitor the technical activity of base maintenance work’ at MRO B but then expanded this point in terms of planning and progress chasing activities only. It also identified that although MRO A’s technical department was responsible for the preparation of engineering orders and repair schemes for the aircraft, the operator’s technical department was responsible for in-service issues being raised at the pre-input meeting; Rep A was the ‘only person authorised to accept/agree additional work’. 21 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 The document referenced a specific procedure for raising additional work requests but this related to the planning and paperwork aspects only. As with the operator’s agreement, no reference was made specifically regarding the technical decision making process. The only item requiring additional approval from Mro A’s design office related to structural repairs. The document appendices did contain a communication plan that stated incoming defects should be taken from the technical log for the aircraft on the first day of the maintenance input. Continued airworthiness check flights prior to 28 September 2005 all uk registered aircraft were required to undergo periodic check flights to demonstrate their continued airworthiness in accordance with British Civil Airworthiness Requirements (BCARs). These requirements provided information on flight checking for the following purposes: ● Flight testing for type certification ● Flight checking for the issue of a certificate of airworthiness ● Flight checking for the renewal of certificates of airworthiness ● Flight testing after modification or repair Flight tests required under BCARs are overseen by the CAA which publishes appropriate flight test schedules for the purpose and provides approvals for pilots undertaking the tests. All non-CAA pilots seeking approval are required to undergo a briefing by a CAA flight test specialist. Those pilots checking aircraft at or above 5,700 kg AUW are, in addition, required to have flown an Aircraft Flight Test Schedule on the relevant type with a CAA test pilot. From 28 September 2005, BCArs no longer applied to those aircraft subject to eASA regulations (this included all variants of the Boeing 737). These aircraft became subject to European Regulations 1702/2003, incorporating Part 21, and 2042/2003, incorporating Part M. This brought about considerable change in the requirement and conduct of airworthiness flight testing, which the CAA attempted to summarise in a document published in April 2006 entitled ‘CAA Check Flight Handbook’. one of the principal changes was that aircraft regulated by eASA were not subject to the systematic programme of continuing airworthiness flight test (CAFT), previously carried out under the CAA regime at the time of the Certificate of Airworthiness (CofA) renewal or to an agreed flight test sampling programme, under BCAr A/B 3-5. The eASA regulations do, however, place obligations on the CAA, as the National Airworthiness Authority, in respect of aircraft continuing airworthiness monitoring (Part M M.B.303). This can include, as one element, in-flight surveys, although eASA has not published guidance material to define their scope. The CAA has repeatedly sought such guidance from eASA but in the absence of such guidance has not re-introduced in-flight surveys. The CAA considered withdrawing the flight test schedules from other than their own use but have reconsidered doing so following demands from operators. The schedules remain available together with guidance on their use. This guidance warns of the applicability of schedules which might not have remained valid due to changes to aircraft modification states, especially those from other eASA states. 22 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 CAA guidance material when discussing crewing of check flights the CAA guidance emphasises the importance of the crew fully understanding the significance and intent of the tests, as well as the techniques used to minimise any associated risks. It also warns of the continued suitability of pilots who might have been previously authorised by the CAA, but who will not have been subject to their continued oversight. It recommends that the minimum crew is supplemented by at least one additional person to help record the results and carry out additional tasks such as helping with the lookout. Where additional personnel are carried it also states they should be: ● capable of performing the relevant duties on the Check Flight, ● familiar with the checks to be carried out and their own duties in relation to such checks, ● adequately insured, ● briefed on emergency procedures and use of safety equipment. Regulatory requirements The various requirements relating to operator and MRo responsibilities with regard to maintenance and continuing airworthiness are laid out in eu opS 1, part M Section A, sub-parts A and g and part 145. These regulations detail the roles and responsibilities of the operator and any delegated Continuing Airworthiness Maintenance organisation (CAMo) to which the operator sub-contracts work. The local CAA surveyor completed an audit of MRo B in May 2008. All findings were closed prior to the start of work on the incident aircraft. Operator oversight The company operations Manual stated that test flights would be performed in accordance with programs issued by the technical department (in effect the Boeing fleet’s Technical Captain) in agreement with the flight operations department. It further stated that crews would be assigned by the Flight policy and Standards Manager. Responsibility for all these functions had, however, been delegated to the commander of the incident flight. The commander had developed the CDFS and been responsible for the selection and training of pilots conducting flight checks. The processes involved in developing and undertaking check flights appear to have been conducted on a largely informal basis by the operator and there is no evidence that they were subject to audit, either internally or by the CAA. Check pilot selection and training Commanders The commander had first conducted check flights whilst employed as the chief pilot of an air taxi and aircraft maintenance company between 1990 and 1994. He had been approved to conduct Air Worthiness Flight Checks on light aircraft after a day’s briefing by the CAA. He had subsequently been employed as a co-pilot on the Boeing 737 for another operator where he had flown in this capacity on CofA renewal and post-maintenance check flights. he had gained promotion to Captain and then moved to his current operator, where he volunteered to become involved in company aircraft flight check operations. In 2005 this had led to his approval by the CAA to conduct CofA flight checks. This involved further 23 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 briefing by the CAA and conducting a check flight under their supervision. At this time the operator also implemented a policy of simulator training for all pilots involved in flight checking. The commander had undertaken two such simulator sessions. This policy was, however, not documented and was later discontinued. The commander believed that he had conducted approximately 150 flight checks on the B737. At the time of the incident he was the operator’s only qualified flight-check captain current on the Boeing 737. Co-pilots Selection of co-pilots for undertaking flight checks was done on an informal basis by selecting from a pool of First officers who had volunteered and been deemed suitable. There were no required qualifications or training for the role. The co-pilot for the incident flight had recently volunteered and had been selected on the basis that he had once flown as a co-pilot during a post-maintenance check flight on an ATr 72 with a previous company. He had received no formal training to conduct such flights but had been sent a copy of the CDFS and some briefing notes prior to the flight. he had also been briefed by the commander during their two-hour taxi journey to the maintenance facility at Southend. Customer Demonstration Flight Schedule (CDFS) The operator had previously used the continued airworthiness flight test schedules published by the CAA as their CDFS. however, the operator stated that there was no appropriate schedule available for the Boeing 737-73V at that time. The commander, as part of his delegated role organising flight checks, had produced a new CDFS based on Boeing document D541A015 737 ‘Next Generation Series Production Flight Test Procedures’, Revision G Nov 2003. This was the schedule used by the manufacturer to check aircraft after production prior to their delivery. The schedule is specific to each aircraft at the time of the check and is carried out by qualified test pilots. The manufacturer is unwilling to release flight check information without assurance that the information is relevant to the specific aircraft under test and that the test is conducted by appropriately qualified pilots. They were therefore not prepared to release a copy of this document to the operator, who acquired an uncontrolled copy unofficially from another source. This was then adapted to serve the purpose of the customer demonstration flights. The operator stated that, to reduce risk, certain items deemed unnecessary, including all single engine tests, pressurisation leak check and some configuration checks near the ground, were removed from their adapted version of the schedule. The finished document was provided in paper form to the pilots conducting the test. The format did not provide specific boxes next to the relevant text for the recording of information required. Instead this was intended to be recorded on a separate sheet of paper attached to the front of the document. FAA Safety Alert for Operators 08024 This safety alert, released in october 2008, stated that over the past decade approximately 25% of accidents to turbine powered aircraft have occurred during non- revenue flights. Other current investigations The AAiB is currently investigating a fire which occurred whilst a Falcon 2000 aircraft was undergoing tests to establish the cause of a braking defect (AAIB 24 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Ref EW/C2009/11/03/03). The investigation identified various issues including suitability of the crew for the task, the status of the tests conducted and the manner in which the test was carried out. This had resulted in a sustained brake fire causing extensive damage to the aircraft. The French Bureau d’Enquêtes et d’Analyses (BEA) are investigating an accident on 27 November 2008 to an Airbus A320 in which all seven occupants were killed. The aircraft had been on a demonstration flight in France as part of the hand-back process at the end of its lease, when the crew lost control and the aircraft flew into the sea off the coast of Canet-Plage. An interim report was released in 2008 (ISBN: 978-2-11-098614-6) which made the following three recommendations: ‘● that EASA detail in EU-OPS the various types of non-revenue flights that an operator from an EU state is authorised to perform, ● that EASA require that non-revenue flights be described precisely in the approved parts of the operations manual, this description specifically determining their preparation, programme and operational framework as well as the qualifications and training of crews, ● that as a temporary measure, EASA require that such flights be subject to an authorisation, or a declaration by the operator, on a case-by-case basis.’ Analysis At the time of the incident the aircraft had been undergoing a combined post-maintenance and end‑of‑lease check flight. The investigation considered the requirement for and conduct of these flights. Customer demonstration flights Customer demonstration flight checks result from contractual arrangements between different parties and stem from the desire to demonstrate that the aircraft is in an acceptable condition. The extent of the demonstration varies depending on the agreement, but it is likely that the aircraft will be flown with systems deliberately degraded, situations unfamiliar to most pilots. Indeed the demonstration, or elements of it, may duplicate the tests undertaken by the manufacturer at the end of each aircraft’s production to satisfy themselves, and their customers, that it is functioning properly. Airbus and Boeing both consider it necessary to use trained test pilots to conduct these production test flights. This attitude conflicts with the widespread practice of operators producing their own generic demonstration flight schedules, which are then likely to be flown by pilots without any formal flight test qualifications. Manufacturers are reluctant to provide test schedules suitable to demonstrate the condition of in-service aircraft because they are unable to exert the same control over the procedure that they would themselves if conducting the same tests. There remains a current need for operators to demonstrate an aircraft’s state of serviceability under certain circumstances. Operators have few options other than to devise their own demonstration schedule that meets with the required aims. The CAA airworthiness flight test schedules have proved a popular basis so long as one for 25 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 the appropriate type exists. Copies of manufacturer’s test schedules are also used unofficially. This raises concern as to whether the schedules actually in use have been produced by those with an appropriate depth of knowledge and that they have been subjected to proper scrutiny. In this incident, the operator was using an out-of-date document obtained unofficially and not subject to any control. The schedule appears to have been produced by one individual and it is unclear what level of scrutiny was applied. It is apparent, however, that elements were not clearly understood, as demonstrated by the switching conducted prior to the test. This switching left the rudder unpowered. The significance of doing so was that any subsequent rolling manoeuvre was reliant on the ailerons alone, which is less effective. This was of significance when considering the CAA advice in their Check Flight Handbook, valid at the time of the incident, to bank the aircraft to prevent unusually high or low pitch manoeuvres developing. The switching also resulted in the main trim being unavailable for use during recovery from any pitch upset, the use of which is referred to in relevant sections of the aircraft Qrh and Flight Crew Training Manual. AMM flight test schedule The anomalies with the customer delivery schedule should not have been a factor in this incident as the flight was intended to carry out a post-maintenance check for which the correct schedule existed and was available. it is of significance therefore that the commander chose not to use it. His main reason for not doing so was that he found the layout of the AMM schedule unclear. This lack of clarity stems from the inclusion of engineering information which may not be directly relevant to the pilot undertaking the test. The following Safety recommendation is made: Safety Recommendation 2010-071 It is recommended that Boeing review their published B737 flight test schedules to improve their clarity and suitability for use by pilots conducting such tests. Flight crew selection and qualification The nature of the flight being conducted at the time of the incident did not require it to be undertaken by specifically trained or qualified pilots and neither pilot involved had any formal flight test qualification. The commander had been involved in check flights for several years, but had only received one day’s briefing from the CAA Flight Test Department with whom he had also carried out a supervised airworthiness flight test. The CAA test pilot who had conducted the commander’s briefing stated that the full relevance of the section on flying control checks in the CAA Check Flight Handbook would have been explained to the commander. This was some years prior to the incident, during which time there had been no further briefing or evaluation by the CAA. The commander’s recollection of the CAA briefing was that a banking manoeuvre was necessary to recover from either a nose-up or a nose down unusual attitude. This was reinforced both by the wording of the CAA Check Flight Handbook and the letter he received condoning his handling of his previous pitch-up incident. The commander had also undertaken in-house training with the operator but again this was some time prior to the incident. Information on dealing with unusual aircraft attitudes was contained in the aircraft Qrh and it should therefore be expected that he would have had knowledge of this. 26 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 The co-pilot for the flight had been briefed on the flight during the taxi journey to the maintenance base but had otherwise not received any additional training. He had only previously conducted one post-maintenance check flight. Qualification as a test pilot requires considerable time and expense and as a result is normally limited to military and production applications. The commander was not a qualified test pilot and lacked the depth of knowledge and understanding that such a qualification would confer and which cannot be replaced by experience alone. The distinction between test pilot qualification and experience was not necessarily fully applied by the operator and pilot. Courses exist which are designed to meet the needs of commercial aviation maintenance check flights. Some operators also choose to create small dedicated departments to undertake such tasks staffed by test pilots who obtained their qualifications prior to joining. Operations management oversight It is considered that the operator’s perception of the commander’s experience and technical knowledge of the Boeing 737 led to them relying on him to oversee the fleet check flights more or less single-handedly. The level of oversight afforded to normal operations within the company did not seem to have been applied to this area, despite the increased risk presented by operating outside the normal flight regime. As an example, the commander was not able to supply the source of the visual check used by him for correct adjustment of the flying controls post-maintenance. This lack of oversight extended to the regulatory bodies which see this area of operation as falling outside their area of competence. This is reflected in the sparse detail required and supplied on non-revenue flights in the company’s operations manual. The operator adopted various measures intended to address these matters after the incident. The subsequent incident to G-EZJN occurred when it was operated by the minimum crew required to conduct the tests, which included an observer to note all the required readings. They were all management pilots involved in the conduct of such testing within the company, yet despite this, there was still a lack of clear understanding about which checklist should be used. Equally, they were unsure how to progress the AMM checklist when the result of the test was not as expected. This lack of full understanding also potentially contributed to their oversight in not complying with the procedures required in the AMM and possibly the CFDS. Conduct of the flight Various elements of the flight demonstrated practices which would have been deemed unacceptable in normal operations. The commander was unaware until the last moment which observers would be joining the flight and there was no formal briefing or recognition of their role during the check. This possibly explains why the commander accepted that one observer remained unsecured on the flight deck and without a seat for the duration of the flight, a position he would not have entertained on a normal revenue flight. This was particularly hazardous considering the subsequent nature of manoeuvres conducted as part of the flight. To allow the co-pilot to concentrate on the flight schedule the commander took on the flying, navigation and radio tasks which in normal events would have been shared. This, in part, was to compensate for the co-pilot’s lack of familiarity with that type of flight. The independence of the commander’s actions became apparent when things started to go wrong. There was a lack of positive communication when trying to re-establish hydraulic 27 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 power to the flying controls. This was followed by a lack of any kind of communication between the four people occupying the flight deck for over 1¼ minutes, covering the duration of the event. The co-pilot only realised something was seriously wrong when he heard the commander make a PAN call. Co-operation amongst the crew would have been enhanced had they all shared a similar level of training and understanding of the procedures they were undertaking. By carrying an observer engaged in the check on the flight deck this would have freed the co-pilot to take a more active role in the flight, allowing him to relieve the commander of some of his workload. The need to carry any more personnel on the flight would be questionable due to the potentially increased risk associated with test/ check flights. Aircraft response during the incident During the incident flight, the elevator response was always normal when the hydraulics were selected on. The control force provided by the hydraulic system was easily sufficient to overcome the aerodynamic force generated by the elevator tab, giving a level flight position of the elevator of 5° trailing edge down. However, when both hydraulic systems were selected off, the control force applied to the control surface was reduced to that provided by the pilot on the control column. This was insufficient to resist the aerodynamic load caused by the incorrectly rigged balance tab, which subsequently moved the elevator to a zero hinge moment position of 7° to 8° trailing edge down, creating a nose-down pitching moment on the aircraft. Consequently, the aircraft settled at a constant -2.8° pitch attitude with a corresponding increasing airspeed, despite the commander applying as much back column force as he was able. The commander reported that he did not use the manual trim wheel during the attempted recovery, because he did not want the aircraft to be grossly out of trim when hydraulics were reselected. Movement of the trim wheel changes the angle of incidence of the horizontal stabiliser and therefore the angle of attack of the horizontal stabiliser and elevators for a given airflow. use of the stabiliser trim would have reduced the incremental lift force generated by the tail and thus decreased the nose-down moment acting on the aircraft. Use of trim is recommended in the AMM to assist recovery and is also a fundamental aspect of this particular test. Following the commander’s roll input, the aircraft banked 91° to the left. In the absence of any other control inputs, this resulted in the continued reduction in pitch attitude and corresponding increase in rate of descent and airspeed. After several seconds the commander began to roll the aircraft level and pull back on the control column again. He applied the same rearward force on the controls as previously but the increased aerodynamic load on the elevators, due to the higher airspeed of the aircraft, meant that control column movement was now less than half of that he had achieved in response to the initial pitch moment after the hydraulics were removed. The commander could not apply sufficient force to the elevator controls to overcome the airloads generated as a consequence of the balance tab position and the high speed of the aircraft. Had no other factors assisted in the recovery, the commander’s actions alone would not have been sufficient to prevent the continued descent. The manufacturer advised the investigation that the aircraft requires an increasing trailing edge down elevator position to maintain level pitch attitude with increasing aircraft speed, otherwise the aircraft will 28 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 gradually pitch up. During the recovery the commander managed to maintain a constant elevator position of approximately 6° trailing edge down by pulling back on the control column. As the speed increased the aircraft slowly began to pitch nose-up, thereby gradually reducing the forces on the control column and arresting the rate of descent. once the commander considered that the aircraft attitude had recovered sufficiently, he assessed the switch positions and reinstated hydraulic power to the flying controls to recover the aircraft fully. Systemic maintenance issues contributing to the incident This incident raised several systemic issues. The organisational structure created by the large number of individual elements was fragmented and lacked coherence. The key individuals involved, to a greater extent, defined their own boundaries of responsibility and completed only the tasks they felt were encompassed by those boundaries. From a regulatory perspective the Continuing Airworthiness Management remained with the operator. They complied with this responsibility but the management focus was weighted on the project management aspects of the arrangement rather than the technical elements. The technical decision making responsibilities were devolved to a number of unconnected organisations without a clear organisational structure or adequate definition of interfaces, reporting lines, roles and responsibilities. The interface document between MRos A and B covered most of the necessary elements but did not provide a clear review or approval process for technical decision making. MRo A placed this responsibility in the hands of an individual on-site representative, who was sub-contracted by a sub-contract company. The situation was compounded by the existence of a second technical representative who had a similar level of responsibility and authority, but was sub-contracted through a separate arrangement with the operator and had a completely unconnected line of report. The interaction and roles and responsibilities of these two individuals were not defined in any common agreement or procedure and clearly became a significant factor leading to the incident. The consultancy companies and their representatives considered that as they were working under the structure and authority of the operator and MRo, they had no need for their own quality system or procedures. It also meant that neither the companies nor their staff were ever directly audited or assessed by any competent Airworthiness Authority. This placed the burden of responsibility on the contracting customers to have in place defined procedures and roles and responsibilities for the sub-contract staff and to maintain close oversight to ensure integration and compliance with these procedures. The existing procedures in the operator’s TPM covering selection of sub-contract suppliers and outsourcing of maintenance specified that all the companies involved would be fully approved Part 145 organisations. A level of technical competency and existence of a quality system could be assumed by virtue of the competent Airworthiness Authority granting Part 145 approval. The procedures did not take into account unapproved organisations operating in conjunction with an approved company. As such, any assumptions regarding a default level of technical competency for the consultancy companies were no longer valid. This resulted in a high level of technical autonomy in the role of the representatives that lacked any cross-checks 29 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 or approval processes to address the potential for human factor issues. Quality audits took place during 2008 which assessed MRO B’s operation in isolation, but no audits were carried out, either by the operator, the authority or MRO A, which assessed procedures used by the consultancy company representatives or those requiring interaction of the multiple sub-contract organisations in combination. The tiered sub-contract arrangement for the maintenance meant that MRO B was only contracted to complete specific packages of work. They adopted an unquestioning approach to customer maintenance requests, thereby negating any benefit that may have been gained from their technical expertise or quality system as an approved Part 145 organisation. Had they been more integrated into the hand-back process or had a more robust and properly defined procedure regarding customer work requests, this may have provided the necessary additional checks that could have identified the discrepancy in the wording of the maintenance task instructions. The lack of coordination of the disparate roles and responsibilities of individuals within all the companies involved resulted in poor communication of important issues and prevented a cohesive response. This allowed a single human factors issue to progress unchallenged through the entire maintenance process to affect a critical aircraft system, almost resulting in the loss of the aircraft. The UK CAA maintained a responsibility as the nominated competent authority to ensure that delegation of responsibility through sub-contract arrangements met the necessary standards. In this case the operator and MROs were well established and individually had organisations and procedures which were fully compliant, as confirmed by various CAA audits. However, the contractual agreement documents viewed by the CAA did not cover in detail all aspects of the arrangement, particularly the level of involvement of the consultancy companies. The CAA was therefore unaware of the degree of complexity in the organisational structure and the lack of integration. The oversight of the organisational structure by the UK CAA was not sufficiently informed or detailed enough to have identified the potential issues. This is an area authorities need to be aware of when reviewing future sub-contract arrangements, particularly when responsibility for key technical decision making is delegated to sub-contract staff from companies which would not otherwise be audited or assessed by an airworthiness authority. However, the regulations and regulatory guidance provided by EU OPS 1, Part M and Part 145 do not specifically cater for arrangements involving multiple levels of sub-contracted companies, despite this being common-place within the industry, and particularly relating to non-core activities such as lease hand-backs. The following Safety Recommendation is therefore made: Safety Recommendation 2010-072 It is recommended that the European Aviation Safety Agency review the regulations and guidance in OPS 1, Part M and Part 145 to ensure they adequately address complex, multi-tier, sub-contract maintenance and operational arrangements. The need for assessment of the overall organisational structure, interfaces, procedures, roles, responsibilities and qualifications/competency of key personnel across all sub-contract levels within such arrangements should be highlighted. 30 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Specific maintenance issues contributing to the incident At a simplistic level the sequence of events leading to the in-flight incident can be directly attributed to the wording of the customer request form, which recorded the aircraft was out of trim in the nose-down direction rather than the nose-up direction identified by the pilot. Incorrect transcription of maintenance paperwork is a common human factors problem. Robust procedures and organisational safeguards should prevent the point being reached where aircraft safety is put at risk as a consequence. In this incident the circumstances which initiated the sequence of events can be traced to the fact that the pre-maintenance delivery shakedown flight was not adequately planned, controlled or communicated between the operator and the MRos. There was no written procedure available to all parties that defined the process or the key personnel and their roles and responsibilities. No formal4 mechanism or controlled paperwork existed for recording test results or significant information during the flight, there was no requirement or procedure for formally debriefing the crew with key maintenance personnel present and no procedure for storage of test results in a controlled manner for future reference. The process relied on single individuals’ actions, with no cross checks or approval processes, where critical airworthiness issues were involved. The following Safety recommendation is therefore made: Safety Recommendation 2010-073 it is recommended that the european Aviation Safety Agency require AoC operators to have, and comply with, a detailed procedure and a controlled test schedule and record of findings for briefing, conducting and debriefing check flights that assess or demonstrate the serviceability or airworthiness of an aircraft. The commander and operator had previously experienced a similar check flight loss of control incident following adjustment of the elevator balance tabs on another of their B737 aircraft, although a different MRo carried out the maintenance. A number of other mis-rigging incidents have also occurred in the UK across several operators. The inability to identify mis-rigging of the tab, either physically or procedurally, prior to flight, was common to this incident. As identified earlier under the section ‘B737-700 pitch control system’, adjustment of the tab trailing edge by just tenths of an inch can have a significant effect on the power-off handling characteristics of the aircraft. The additional safeguard of a duplicate inspection adds no benefit unless a meaningful assessment of the maintenance changes made can be made based on guidance from the AMM. At present the AMM task provides no assistance or advice in identifying mis-rigging of what is a critical flight control system. The AMM task also allows alteration of the tab rigging throughout the entire range of adjustment in a single maintenance action. This creates the potential for gross adjustment errors to be made. Such errors will result in a much more severe ‘upset’ incident during the subsequent check flight system test. The following Safety recommendation is therefore made: Footnote 4 in this context ‘formal’ is defined as being a controlled/approved process or format, that all parties involved are/were familiar with prior to the flight and anticipate(d) as a deliverable from the flight. 31 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 Safety Recommendation 2010-074 It is recommended that Boeing develop an Aircraft Maintenance Manual procedure to identify mis-rigging of the B737 elevator tab control system and amend the Aircraft Maintenance Manual tab adjustment procedure to limit the amount of trim adjustment on any one maintenance input. Notice of Proposed Amendment - NPA 2008-20 – ‘Flight Testing’ This npA draws a distinction between flight tests and flight checks as described earlier in this report under the section ‘flight ‘tests’ and flight ‘checks’’. in particular it states that: ‘during such [test] flights there is a certain amount of unpredictability which does not happen in the case of check flights and acceptance flights.’ The evidence identified during this investigation and those linked to it, show that whilst this may hold true for the majority of check flights, where no aircraft defects or issues arise, the same level of unpredictability and risk can exist in maintenance and customer demonstration flights when unidentified defects are present or the techniques used by the crew are inappropriate to the situation. The findings from the investigations also show that the existing regulatory requirements in the quoted regulations and the level of oversight of operator compliance are insufficient to prevent serious incidents and accidents occurring. If the changes discussed in the NPA are considered a minimum standard for the design and production community, (where the level of specialist flight crew training and experience relating to test and check flying is already typically much higher than amongst operator flight crews), this would support a need for the introduction of similar or more restrictive requirements and oversight for operators conducting check flights. This is particularly pertinent given that the potential consequences of operating these flights have proven to be equally severe. The following Safety recommendation is therefore made: Safety Recommendation 2010-075 It is recommended that the European Aviation Safety Agency provide guidance on minimum crew proficiency requirements and recommended crew composition and training for those undertaking check flights that assess or demonstrate the serviceability or airworthiness of an aircraft. Continuing airworthiness testing requirements This incident occurred to an operator with a positive safety culture. Evidence from this and the other referenced investigations suggest that this reflects a much wider issue within the aviation community, highlighting the vulnerability of operating outside the normal boundaries of commercial flights. There exists an eASA requirement for operators to demonstrate and NAAs to monitor the continuing airworthiness of their aircraft. Previously well established methods of doing so, such as those operated by the CAA, have fallen into disuse due to the lack of regulatory guidance. The manufacturers too, maintain a cautious approach to the issue for the reasons explained in the Customer Demonstration Flight Schedule section. This incident and the accident to the Airbus A320 in France on 28 November 2008 point to the inherent dangers of the industry attempting 32 © Crown copyright 2010 AAIB Bulletin: 9/2010 G-EZJK EW/C2009/01/02 to conduct this type of operation without suitable guidance. The following Safety recommendation is therefore made: Safety Recommendation 2010-076 it is recommended that the european Aviation Safety Agency provide guidance to National Airworthiness Authorities on monitoring continuing airworthiness. From such work it should be possible to determine a means to provide the reassurance sought when returning aircraft to their owners, whilst limiting the requirement for associated air tests. Safety action The following safety action has been taken since this incident occurred: ● Boeing has amended the wording of the flight test task in the latest revision of the AMM designed to improve ease of use and reduce the likelihood of incorrect interpretation. ● Boeing has issued Service letter 737-Sl-27-211 which provides further advice on rigging the elevator tabs and conducting post-adjustment check flights. ● The uk CAA has published Airworthiness Communication (AIRCoM) 2009/03 to raise awareness of the issues relating to the co-ordination between operators and maintenance organisations surrounding the conduct of maintenance check flights. it has also issued Flight operations Division Communication (FoDCoM) 15/2009 regarding the definition, preparation and conduct of check flights. it also advises on crew qualification requirements and the need for co-ordination with relevant maintenance organisations to ensure information is formally documented and distributed. ● The operator has carried out an internal investigation into the incident. This identified the causal and contributory factors discussed in this report and made 38 safety recommendations. ● The uk CAA has re-written Section 3, Tech 2, Part 10 of the CAA Check Flight Handbook to ensure its previous advice in dealing with a pitch down incident is not misinterpreted. ● Mro(B) conducted an internal investigation which addressed the formalisation of the customer work request procedure and introduced a procedure to improve flightcrew/maintenance interface. 33 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 SERIOUS INCIDENT Aircraft Type and Registration: Boeing 737-86n, Se-rhX No & Type of Engines: 2 SneCMA CFM 56-7B turbofan engines Year of Manufacture: 1999 Date & Time (UTC): 9 May 2010 at 0034 hrs Location: Vienna, Austria Type of Flight: Commercial Air Transport (Passenger) Persons on Board: Crew - 7 Passengers - 189 Injuries: Crew - None Passengers - None Nature of Damage: left wing firewire failed insulation check, ruptured flexible duct on right air conditioning pack Commander’s Licence: Airline Transport Pilot’s Licence Commander’s Age: 50 Commander’s Flying Experience: 11,660 hours (of which 985 were on type) Last 90 days - 93 hours Last 28 days - 9 hours Information Source: AAIB Field Investigation Synopsis During the departure from Sharm el Sheikh, the left WING-BoDy oVERHEAT caption illuminated and the crew shut down the left air conditioning pack in accordance with the non-normal checklist. After approximately 3.5 hours, the right air conditioning pack failed and cabin pressurisation was lost. The crew performed an emergency descent and diverted to Vienna. An engineering investigation determined that the left WING-BoDy oVERHEAT indication was spurious and the failure of a hose in the right pack had caused the loss of pressurisation. History of the flight The aircraft departed Manchester Airport at 1411 hrs on a charter flight to Sharm el Sheikh arriving at 1928 hrs. The flight was uneventful and following a short delay during the turnaround and refuel, it departed at 2054 hrs on the return flight to Manchester. The takeoff was from Runway 04R, in good weather with a radar vectored departure and climb initially to FL320 before a further climb to the final cruising level of Fl360. The aircraft commander was seated in the right seat and was carrying out line training for the captain in the left seat who was the pilot flying for the sector. As the aircraft passed an altitude of 6,500 ft, the master caution illuminated and a left WING-BoDy oVERHEAT 34 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 caption illuminated on the air conditioning control panel. The crew performed the non-normal checklist items which required them to close the isolation valve, select the pack valve to OFF and close the engine bleed valve. Having confirmed that the checklist was complete, the crew reviewed their options whilst continuing the climb and satisfied themselves that there was no likelihood of structural heat damage occurring. There were no limitations imposed by the non-normal checklist or the Minimum Equipment List for operating with a single pack once airborne. They elected to continue to Manchester following the flight planned route and levels with regular checks of the pressurisation system. Approximately 3.5 hours into the flight, the commander noted that the cabin differential pressure had reduced to 7 psi and the cabin altitude had risen to 9,000 ft with the outflow valve indicating fully closed. The commander was the handling pilot at this time because the captain had left the flight deck on a comfort break. As the captain returned to his seat, the master caution caption illuminated and the CABIN ALTITUDE audio warning sounded. The commander checked the position of the outflow valve which indicated closed and the cabin altitude which was climbing past 9,000 ft. Both crew members donned their oxygen masks and as the commander was still the pilot flying, he initiated an emergency descent, declared a MAYDAY and deployed the passenger oxygen masks. The descent was made straight ahead using the level change and heading modes of the autopilot with speed brakes deployed. Control of the aircraft was passed to the captain whilst the commander established that the Minimum Sector Altitude (MSA) was 8,700 ft. The crew agreed to set an initial level off altitude of 12,000 ft on the Vienna QNH of 1010 mb, which the captain selected using the altitude selector on the mode control panel. During the descent the commander made an announcement to the cabin crew using the public address system notifying them of the emergency descent. He also reviewed the cabin altitude warning and emergency descent procedures and checked the pressurisation panel to see if he could manually control the pressurisation, but this was not possible. The aircraft was levelled off at 10,000 ft and the commander and the captain removed their oxygen masks. Following a short discussion, they requested a diversion to Vienna. ATC provided radar vectors for an ILS approach to Runway 34 and descended the aircraft in order to position it. The commander called the Senior Cabin Crew Member (SCCM) to the flight deck and having established the wellbeing of the passengers and cabin crew, explained the nature of the problem, his intentions, the time scale for arrival in Vienna and that there were no special requirements. This is commonly referred to as a NITS briefing. The SCCM had no questions and returned to brief her colleagues and prepare the cabin for landing. The weather at Vienna at 0020 hrs was 310°/05 kt, visibility 30 km, cloud few at 4,100 ft, broken at 5,000 ft with an OAT of +12°C and a dew point of 9°, QNH of 1009 hPa. The aircraft made a straight-in-approach and normal landing on Runway 34 at Vienna before taxiing to the parking stand and closing down. Following the incident, the aircraft was flown unpressurised by a ferry crew, without passengers, to the maintenance organisation at Lasham Airport. Flight Recorders The aircraft was equipped with a flight data recorder (FDR) and cockpit voice recorder (CVR) capable of recording a minimum duration of 25-hours of data 35 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 and 120 minutes of audio respectively. Recorded information relating to the left and right air conditioning system included the pack on/off status, pack flow mode and engine bleed air switch positions. FDr data was available for the entire flight, with the CVR record commencing one hour twenty minutes prior to the activation of the cabin pressure warning and ending shortly after the aircraft had landed. The CVR record did not include the time period when the left wing body overheat warning had occurred. In addition to the incident flight, the FDr also contained records of four previous flights and the subsequent positioning flight from Vienna to Lasham Airport. A time history of the relevant parameters during the incident flight is provided in Figure 1. The takeoff was uneventful, but as the aircraft climbed through 6,500 ft, the master caution was activated. Shortly after, the number one engine bleed air switch was selected oFF, in accordance with the Qrh left wing-body overheat procedure. The Qrh procedure also required that the left air conditioning pack be selected oFF. The left pack flow mode parameter subsequently changed from the low flow to the high flow/off indication, as would be expected if the pack had been selected oFF, but the left pack on/off parameter continued to indicate that the left pack was still oN; a defect was subsequently identified in the left eCS, whereby the pack falsely indicated that it was oN when set to the oFF position. During all six flights, the right pack had continually indicated that it was in the high flow mode, but this was later confirmed as being an indication fault. System description The aircraft is equipped with two air conditioning packs, which are independently controlled and provide conditioned, pressurised air to the cabin. The cabin pressure is regulated by the position of the outflow valve, which allows air in the cabin to vent to atmosphere. This valve, and hence the cabin pressure, is controlled by one of two redundant Cabin Pressure Controllers when the automatic mode is used and directly by flight crew when the manual mode is used. Each pack is provided with bleed air taken from the 5th and 9th stages of the engine compressor, with the 9th stage providing compressed air at low engine speeds and the 5th stage at high engine speeds. The High Stage regulator (hSr) automatically opens a valve to switch between the two sources of air. The air then passes through the pressure regulating and Shutoff Valve (prSoV), which controls the flow of air to the pneumatic manifold (duct). An Isolation Valve in the duct isolates the left and right side of the duct such that in normal operation the left engine provides air to the left pack and the right engine to the right pack. A Flow Control and Shutoff Valve (FSoV) allows pressurised air in the duct to enter each pack. The air conditioning packs can operate in one of two modes, ‘low’ and ‘high flow’. normally the packs are selected on auto and will operate in ‘low flow’. if one pack fails, or is selected oFF, then the remaining pack will automatically switch to ‘high flow’ provided the flaps are not extended. The flight crew can also switch each pack manually to ‘high flow’. The pneumatic manifold runs from each engine, along the wing leading edge to the air conditioning packs, which are located at the bottom of the fuselage, outside 36 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 Figure 1 Salient FDr parameters (Se-rhX 9 May 2010) 37 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 the pressure hull. A firewire, routed alongside the duct, provides the flight crew with an overheat warning. Engineering examination Passenger and crew oxygen The AAIB undertook an initial examination when the aircraft landed at Lasham. All the oxygen masks in the cabin had deployed and all the oxygen generators had activated. The ‘Pass Oxygen’ switch on the flight deck had been operated. The ‘crew oxygen’ contents gauge read 1,400 psi. Fault finding An engineering investigation undertaken by the operator identified the following faults in the cabin pressurisation system: ● BITE check on the CPC showed fault Code 30 appearing on alternate legs over the last 20 flights. The Boeing fault‑finding chart attributes the possible cause to ‘low pack flow, low pneumatic pressure, or excessive fuselage leakage’. ● BITE check carried out on the Wing Body Overheat Module showed fault Code 14. Firewire M268, located along the left wing leading edge, failed the insulation check. The fault was cleared by replacing the firewire. ● An air leak was found from a split in a flexible hose (AS1505‑18A0042) located on the right pack between the Air Cycle Machine and the Condenser. The fault was cleared by replacing the flexible duct. ● A confidence check carried out on each air conditioning pack (AMM 21‑00‑05‑780‑801) found that the duct pressure was outside the published limits. With the engines at idle, the minimum duct pressure should have been between 18 and 20 psi, but was found to be 8 psi and 15 psi for the left and right engines respectively. At an engine speed of 72% Nr (33%N2), the minimum duct pressure should have been 26 psi, but was found to be 15 psi and 24 psi. The left engine PRSOV and the HSR on both engines were replaced and the aircraft passed the confidence check. The operator also carried out an investigation to establish why the indications on the FDR showed the right pack at ‘high flow’ during both the accident flight and the five previous flights, and the reason why the left pack indicated ON after the crew stated that they had turned it OFF. The investigation discovered: ● There was an open circuit in the cable (W410‑0489‑24) between the No 1 Flight Management Computer and the right Air Conditioning Accessory Unit, which provides the signal to indicate if the right pack is in ‘high’ or ‘low flow’. The fault was traced to a connection in the avionics bay where a pin had come out of its connector (Pin 3, DFD1002A). The fault was cleared by replacing the pin. ● With the left pack switched OFF, and the duct still pressurized, the pack would indicate ON and the indication would only change to OFF when the right pack, or APU, was turned OFF. The fault was cleared by replacing the left FSOV. 38 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 Examination of right duct flexible hose The flexible hose from the right pack had evidence of abrasion on the top and sides of the folds (concertinas) where the failure had occurred, (Figure 2). There was also evidence that the reinforcement metal rings had cut through the hose. The hose had been correctly fitted to the pack and there was nothing in the vicinity that might have caused the abrasions, (Figure 3). It is suspected that the some of the abrasions might have occurred as a result of the folds on the hose rubbing against each other. Previous occurrences The aircraft manufacturer advised the AAIB that there have been three reported failures of this hose since 2004. However, they were only able to inspect one of these hoses and attributed the failure to ‘the reinforcement metal rings wearing away the silicone and reinforcing fibreglass at several locations in the hose.’ Analysis The engineering investigation determined that the incident occurred as a result of two separate faults in the aircraft air conditioning system. As the aircraft reached 6,500 ft the left wing body overheat light, and the master caution, Abrasions Figure 2 Failed flexible hose from right air conditioning pack Figure 3 Flexible hose installed on the right air conditioning pack 39 © Crown copyright 2010 AAIB Bulletin: 9/2010 SE-RHX EW/C2010/05/01 illuminated as a result of a fault in the firewire. The crew acted in accordance with the Qrh by shutting down the left air conditioning pack, which would have resulted in the right pack automatically changing to ‘high’ flow. The aircraft continued to climb to its cruising level and approximately 3.5 hours later, whilst at Fl360, a flexible hose in the right pack failed. The leak was such that the single pack could no longer maintain the cabin pressure, which slowly dissipated. The investigation was unable to establish the initiating factor that caused the hose to fail. Although the air conditioning pack confidence checks established that the duct pressures were below the specified minimum, the flow from the right pack was sufficient to maintain the cabin pressure for almost 3.5 hours. Therefore, the faults on the prSoV and the hSr were not considered to be causal to this incident. The flight crew successfully carried out the emergency descent actions in accordance with the non-normal checklist and the operator’s Standard operating Procedures resulting in an uneventful diversion and landing. 40 © Crown copyright 2010 AAIB Bulletin: 9/2010 D-ACHA EW/C2008/11/03 ACCIDENT Aircraft Type and Registration: Bombardier CL600-2B19 CRJ200, D-ACHA No & Type of Engines: 2 General Electric CF34-3B1 turbofan engines Year of Manufacture: 2000 Date & Time (UTC): 13 November 2008 at 0900 hrs Location: Manchester Airport Type of Flight: no flight planned Persons on Board: Crew - None Passengers - None Injuries: Crew - N/A Passengers - N/A others - 1 (Serious) Nature of Damage: Nose landing gear damaged Commander’s Licence: N/A Commander’s Age: N/A Commander’s Flying Experience: N/A Information Source: AAIB Field Investigation This occurrence did not meet the description of an accident or serious incident, as detailed in The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996. However, considering the air safety lessons which could be drawn from it, the Chief Inspector ordered an investigation under Regulation 8(4) of those Regulations. Synopsis whilst a technician was rectifying an under-inflated tyre, a pressure of approximately six times the normal tyre pressure was developed. The tie bolts on the wheel failed, the assembly exploded and the technician was seriously injured. Two Safety recommendations are made. Background During the pre-departure inspection on the aircraft, before an evening flight, one of the flight crew noted a small cut in a main-wheel tyre tread. He reported his findings to his company’s main engineering control centre in Cologne. They determined that the damage was beyond acceptable limits and advised the crew. The flight was cancelled and preparations were made to rectify the defect. A technician from one of the operator’s bases in Germany was tasked with carrying out a wheel change and also directed to carry out the five-day maintenance check which was shortly due on the aircraft. He travelled to Manchester the following morning, taking with him a wheel-change kit and a spare main-wheel with a tyre already fitted. The latter was inflated to 41 © Crown copyright 2010 AAIB Bulletin: 9/2010 D-ACHA EW/C2008/11/03 the standard low figure of approximately 50 psi, as released from the company tyre bay. Following his arrival, the technician was met by staff of a local line maintenance company and was taken, with the spare wheel/tyre and the wheel change kit, to the remote stand to which the aircraft had been towed. A nitrogen pressure rig, the property of the company, was also taken to the aircraft in anticipation of the requirement to inflate the replacement tyre fully once it was fitted to the aircraft. As the technician worked on the aircraft, another company employee occupied its cabin, performing unrelated tasks. The maintenance task The technician elected to carry out the five-day maintenance check before the wheel change. This included a check of all tyre pressures, using a gauge carried within the wheel-change kit. He determined that the right nosewheel tyre was slightly under-inflated and utilised the nitrogen pressure rig to replenish it. The technician was unfamiliar with the rig and had difficulty operating it. He subsequently informed the BFU (German Federal Bureau of Accident Investigation) that he initially opened the valve of one of the bottles using the special spanner provided. He did not check the pressure gauges on the regulator valve, nor did he adjust the valve. Before making the connection to the tyre he confirmed that gas was flowing from the inflator when its lever was activated. He stated that he then screwe