Aviation Investigation Report A95H0004

The flight was in cruise, en route from Chicago, Illinois, USA, to Amsterdam, the Netherlands, at FL330 at a speed of Mach 0.83, with autopilot 2 engaged. Shortly after the crew received a clearance to proceed to the ocean-boundary fix, the autopilot disengaged. The aircraft climbed rapidly with a maximum vertical g of 1.94 recorded within five seconds of the autopilot disconnect. At times during the rapid ascent, the rate of climb exceeded 12,000 feet per minute and the maximum pitch angle was nearly 30 degrees. The aircraft reached a maximum altitude of FL385, at a minimum indicated speed of 155 knots. Four stall warning events occurred, commencing at the peak altitude of the manoeuvre and continuing as the aircraft began a rapid descent. The descent continued at rates sometimes greater than 12,000 feet per minute, to FL315 where the aircraft began a rapid climb again. Autopilot 1 was successfully engaged (several engagement attempts were made during the descent) and the climb moderated. The aircraft levelled at FL350 and was then cleared by Moncton Centre (New Brunswick) to maintain that altitude. The flight continued to its destination with no further reported problems. There was no traffic conflict during the flight upset, and no injuries or aircraft damage were reported.

The Board determined that the flight upset manoeuvre was caused by a misrigged autopilot elevator servo control, which led to an initial pitch-up, and by the crew's ineffective or inappropriate pitch control inputs which led to aircraft stall. Contributing factors in the flight upset were the aft centre of gravity position and the aircraft's high speed.

1.1 History of the flight

The scheduled international passenger flight (TAROM - ROT 006), with a crew of 14 and 80 passengers on board, was en route from Chicago, Illinois, USA, to Amsterdam, the Netherlands. The aircraft was in cruise at flight level (FL)^{Footnote 1} 330, at a speed of Mach 0.83, near Rivière-du-Loup, Quebec. The captain was the pilot at the controls. The autopilot was engaged (CMD2) in altitude hold (ALT) and navigation (NAV) modes, and the flight management system (FMS) was providing navigation guidance. Autothrottle was engaged in the Speed/Mach mode.

Shortly after checking in with Moncton Centre (New Brunswick), at 0252:40 UTC^{Footnote 2}, the flight was cleared direct to SCROD, the flight's North Atlantic Track (NAT) ocean boundary point. The controller asked for an estimate for SCROD. The captain had just completed a direct to (DIR) input for SCROD in the FMS and was in the process of providing a SCROD estimate to Moncton Centre from the FMS Flight Plan page of the control display unit (CDU), when he sensed a "whooshing" noise which he associated with turbulence. The autopilot disengaged, and the aircraft pitched up with a maximum normal acceleration of 1.94 g within five seconds of the disengagement.

The aircraft commenced a climb with peak rates of climb greater than 12,000 feet per minute^{Footnote 3} (fpm) and a maximum pitch angle of nearly 30 degrees. The flight climbed about 5,500 feet above its cleared altitude, peaking at FL385, and reached a minimum indicated airspeed (KIAS) of 155 knots. Stall warning events occurred, commencing at the peak altitude of the manoeuvre, and continued as the aircraft began a rapid descent. When the stall warning system activated, the pilot commenced recovery procedures; a total of four stall warning activations were recorded on the flight recorder.

A descent from the minimum speed point was commenced with high levels of thrust on the engines. At about FL350, an unsuccessful attempt was made to engage autopilot 2. About five seconds later, as the aircraft was descending through FL340, autopilot 1 was engaged. Maximum descent rates exceeding 12,000 fpm down were recorded during the descent. As the flight was descending through FL320, the captain reported on the radio to Moncton centre "...sorry, we have a very big problem." The flight descended 7,000 feet to about FL315, whereupon autopilot 1 disconnected, and the aircraft then commenced a rapid climb again. The captain indicated that, at times, both pilots were likely operating the flight controls, perhaps at cross-purposes.

As the aircraft was climbing through FL320, autopilot 1 (CMD1) was engaged, and the ascent rate was moderated. The aircraft climbed to FL350 and the flight commenced cruising at that level at about 0256:30, approximately three minutes after the start of the flight upset. At this time, the flight called Moncton Centre and provided the estimate for SCROD. The Moncton Centre controller, who was observing the flight's altitude deviations, asked the flight "what was your problem?" The flight crew indicated that there was a problem with their autopilot, but that they had "recovered the plane" and that "everything was okay." Approximately a minute later, the flight was asked by the controller if they wished to continue maintaining FL350; the crew indicated that they would "like to maintain this level." ROT 006 was then cleared to maintain FL350. There was no indication that the crew wished to divert the flight. No traffic conflict occurred. The flight continued to Amsterdam with no further problems reported.

The incident occurred on 01 March at 2253 Atlantic standard time (02 March 0253 UTC), during conditions of darkness at latitude 48°22′N, longitude 070°08′W.

1.2 Injuries to persons

	Crew	Passangers	Other	Total
Fatal	-	-	-	-
Serious	-	-	-	-
Minor/None	14	80	-	94
Total	14	80	-	94

1.3 Damage to aircraft

The operator indicated that there was no damage to the aircraft.

1.4 Other damage

No other damage was incurred.

1.5 Personnel information

1.5.1 General

	Captain	First Officer
Age	46	43
Pilot Licence	ATPL	ATPL
Medical Expiry Date	Valid Medical	Valid Medical
Total Flying Hours	12,717	7,568
Hours on Type	1,532	837
Hours Last 90 Days	181	90
Hours on Type Last 90 Days	181	30
Hours on Duty Prior to Occurrence	4.5	4.5
Hours Off Duty Prior to Work Period	36	36

1.5.2 Captain

The captain commenced his flying career following graduation from Aurel Vlaicu Military Aviation School, Civil Section, in 1969. The captain received his Commercial Licence in 1970, and he was issued an Airline Transport Licence in 1980. The captain flew a variety of aircraft for TAROM, including the LI-2, IL-14, AN-24, BAC 1-11, IAR 818, and Boeing 707. Following training at the Aeroformation facility in Toulouse, France, he completed his A310 captain's checkout on 23 February 1993. Training and authorization for NAT-MNPS-ETOPS were completed on 23 April 1993. No training problems were noted.

The captain was the pilot at the controls. This was planned to be the co-pilot's sector, and the co-pilot had been the pilot at the controls for the first portion of the flight. However, prior to the upset, the co-pilot indicated that he wanted to relax for a few minutes, and the captain assumed control. Normally, in accordance with TAROM procedures, autopilot 1 (CMD1) would be selected if the captain is flying the sector, but the autopilot selection remains for the appropriate pilot for the sector. As the co-pilot was the appropriate pilot, the autopilot was in CMD2 at the time of the occurrence.

1.5.3 Co-pilot

The co-pilot graduated from the Aurel Vlaicu Military Aviation School, Civil Section, in 1975 and received his Commercial Licence in the same year. He was issued his Airline Transport Licence in 1981. While employed by TAROM, he flew as a co-pilot in a variety of aircraft, including the AN-2, AN-24, and BAC 1-11. In 1992, the co-pilot was upgraded to captain on the BAC 1-11. He qualified on the A310 as a co-pilot on 03 May 1993 following training at the Aeroformation facility in Toulouse, France; he completed NAT-MNPS-ETOPS training on 11 February 1994. No training problems were noted.

1.6 Aircraft information

1.6.1 General

Manufacturer	Airbus Industrie
Type	A310-325
Year of Manufacture	1991
Serial Number	636
Certificate of Airwothiness (Flight Permit)	Valid
Total Airframe Time	8,587 hours
Engine Type (number of)	Pratt & Whitney PW4156 (2)
Maximum Allowable Take-off Weight	164,000kg
Recommended Fuel Type(s)	Jet Fuel (A ,B, JP, 4, 5, 8)
Fuel Type Used	Jet A

1.6.2 Hydraulic systems

1.6.3 Flight controls

1.6.3.1 General

All control surfaces are actuated by three irreversible servo controls, each supplied by one of the three independent hydraulic systems (B,G,Y). The trimmable horizontal stabilizer (THS) is powered by the green and yellow systems. Pitch trim control is achieved by the horizontal stabilizer hinged on the aircraft structure. Maximum allowable vertical acceleration (g) with the flaps up is +2.5 g and −1.0 g.

1.6.3.2 Elevators

The A310 pitch control is achieved by two elevators hinged on the horizontal stabilizer. Each elevator is actuated by three servo motors controlled by a dual mechanical linkage through dynamometric rods, cable runs, an artificial feel system linked to the cable run of the left-hand control column, and load limiting rods. An autopilot-servo actuator is connected to the left elevator, which is mechanically linked to the right elevator. In cruise, if the crew applies a force greater than 150 newtons on the control column, the autopilot will disconnect.

In normal operation, the two elevators are controlled together. The maximum mechanical deflection ranges from -30 degrees (nose-up) to +15 degrees (nose-down) with the autopilot disengaged. When the autopilot is engaged, the maximum mechanical deflection range is from 18 degrees nose-up to 9 degrees nose-down. A pitch uncoupling unit is designed to prevent accidental asymmetric deflection of the elevators during flight and allows uncoupling of the left and right elevator systems during take-off (speed below 195 KIAS).

1.6.3.3 Pitch trim

There are two pitch trim computers, each comprising two independent computing channels for command and monitoring. Each pitch trim system provides pitch commands to the horizontal stabilizer. The range of travel is from +3 degrees (aircraft nose-down) to -14 degrees (aircraft nose-up). Trim rotation is inhibited when the horizontal stabilizer reaches +2.5 degrees (nose-down) and -13 degrees (nose-up) to prevent it from reaching the mechanical stops. Horizontal stabilizer travel rate and trim authority depend on the mode and aircraft configuration. Normally both pitch trim systems are engaged, with system 1 automatically active and system 2 synchronized in standby. In normal operation, pitch trim 1 has priority over pitch trim 2.

For the aircraft configuration during the flight upset incident, there are four pitch trim functions: electric trim, auto trim, Mach/Vc trim, and angle of attack (alpha) trim.

The electric trim functions by moving the horizontal stabilizer to provide full elevator authority on either side of the flight-neutral position. Trim action is initiated by two trim rocking levers on each control wheel. If the rocking levers are operated simultaneously in opposition, trimming stops. The control wheel trim rocking levers on the control wheels are deactivated when an autopilot is engaged. Horizontal stabilizer movement rate depends on the aircraft speed. At speeds above 240 KIAS, the horizontal stabilizer moves at 0.17 degrees/second; the rate increases linearly to a maximum rate of 0.9 degrees/second at (and below) 200 KIAS.

Auto trim functions with an autopilot engaged and is designed to perform an integration of the autopilot elevator order in order to keep the elevators neutral. The elevator neutral position at a speed of Mach 0.83 is about 0.4 degrees nose-up due to aerodynamic force which deforms the elevators slightly. With the flaps retracted, the auto trim system moves the horizontal stabilizer at a rate which depends on the autopilot elevator order; 0.066 degrees/second is the maximum rate. Auto trim is designed to prevent bumping when the autopilot is disengaged.

The Mach/Vc trim function is used to improve the aircraft's longitudinal stability by varying the horizontal stabilizer position for Mach number or Vc (computed airspeed) changes. As speed increases, the Mach/Vc trim system causes a nose-up pitch moment to create normal increasing speed stability characteristics. As speed decreases, a nose-down pitch moment is developed. The maximum horizontal stabilizer authority is 0.7 degrees due to Mach trim and 0.82 degrees due to Vc trim.

The angle of attack (alpha) trim system functions by countering pitch-up which occurs at high Mach and at excessive angle of attack at low speed. The alpha trim function is active in manual mode (autopilot not engaged) with the flaps, slats, and airbrakes retracted, regardless of landing gear position. The maximum horizontal stabilizer authority is 1.0 degrees pitch-down.

1.6.4 Autoflight systems

The autopilot can be engaged in CMD to provide three-axis aircraft control. Many conditions exist that allow for autopilot engagement and continued engagement. Some of the conditions for continuous autopilot (CMD) operation are as follows:

• correct electrical power;
• hydraulic pressure available from appropriate system(s);
• no failure detection in pitch (and roll) servo motors;
• appropriate flight control computer (FCC) operative (AP2 uses FCC2);
• pitch trim lever 1 or 2 engaged;
• yaw damper 1 or 2 engaged; IRS (inertial reference system) 1 (CMD1) or 2 (CMD2) and one other IRS;
• air data computer 1 (ADC1) operative for CMD1 or ADC2 operative for CMD2; and
• flight control unit (FCU) operative.

In cruise, the autopilot disconnects if a force greater than 150 newtons is applied to the control column (pitch axis).

The electrical autopilot commands are transmitted to the mechanical linkage by means of autopilot-servo actuators. Autopilot 1 (CMD1) receives its hydraulic power from the green system. When autopilot 2 (CMD2) is in use, the autopilot receives its hydraulic power from the yellow system. Some operators tend to favour the use of autopilot 1 (CMD1) because of the greater number of hydraulic pumps for the green system.

The autothrottle system, when armed, responds by modulating the thrust through the movement of the throttles. The normal rate of throttle movement is approximately one degree per second; go-around (GA) mode and thrust latch (alpha floor) command a throttle speed of about eight degrees per second.

1.6.5 Flight envelope protection

There are several systems in the aircraft which are designed to prevent excursions from the normal flight envelope. These systems include the stick shaker, Vmax (maximum selectable speed), and alpha floor.

The aircraft's stick shaker system provides a warning of impending stall condition to the pilots through vibrating motors on the control columns. The stick-shaker speed (Vss) in the clean configuration is equal to 1.138 of the stall speed (Vs), and is g-load dependent.

Maximum selectable speed (Vmax) protection does not allow a Mach number greater than 0.84 to be selected. If excessive speed is selected, the thrust computers or flight control computers limit the speed.

The alpha floor function is active if the autothrottle system is armed when an angle of attack of more than 8.5 degrees is detected with a clean aircraft configuration. When a too-high angle of attack is detected, thrust latch is engaged, producing thrust corresponding to the mode selected on the thrust rating panel.

1.6.6 Fuel system

The aircraft fuel system consists of four wing tanks, a centre tank, an auxiliary tank, and a trim tank located in the horizontal stabilizer. The fuel feed sequence is automatic and is designed to maintain an aft centre of gravity (C of G) for lower aircraft drag and hence reduced fuel consumption. The centre tank fuel is normally burned first, and fuel is transferred between the trim tank and the centre tank, as required, to maintain a C of G between approximately 37% MAC (high weight) and 35% MAC (low weight). The aft C of G limit is 40% MAC (for flight above 20,000 feet). An ECAM pre-warning (amber) is activated when the C of G reaches 41% MAC, and an ECAM warning (red) is triggered when a value of 43% MAC is reached.

The automatic fuel transfer between the trim tank and the centre tank is controlled by the centre of gravity control computer (CGCC). TAROM and other operators have reported problems with the CGCC serviceability rates leading to problems in the automatic fuel transfer for the maintenance of C of G.

During the flight of ROT 006, the automatic fuel transfer had failed ("TRIM TK SYS FAULT") and the crew was maintaining the centre of gravity through the manual manipulation of the fuel valves and pump selections. The checklist action for this fault requires that as much fuel as will fit in the centre tank be transferred forward to the centre tank from the trim tank. The captain indicated that he commenced a fast forward transfer of fuel from the trim tank during the incident sequence.

The aircraft manufacturer indicated that positive longitudinal stability was demonstrated up to 43% MAC, but that longitudinal stability would be less at aft C of G values than at mid-range values.

1.6.7 Maintenance history

TAROM has a maintenance facility at their main base at Bucharest, Romania, and line maintenance progressive checks are performed by TAROM personnel. Heavy checks and major overhauls are conducted by Swissair, normally at Zurich, Switzerland.

Aircraft maintenance logs were reviewed for time periods before and after the flight-upset incident. Technical items of possible relevance were found.

1.6.7.1 Flight control maintenance

It appears that the TAROM maintenance organization was not immediately aware of the altitude excursion incident because the captain had not made a log-book entry regarding the flight upset and flight control problems.

After the completion of the trip from Amsterdam to Bucharest following the incident flight, the aircraft flew about 31 more hours and then was flown from Bucharest to Zurich for a routinely scheduled "C" check on 05 March 1995. During the "C" check, both flight control computers were removed in order to perform the modifications outlined in AD 94-185-165. The memory information from the units, which would have revealed the reason for the autopilot disengagement that started the incident, could not be retrieved because the units were not available when the need for the memory information had been identified.

During the "C" check, both elevators were changed. The reason for the elevator change was related to inspection for the possible infiltration of water in its structure. A check of autopilot elevator servo rigging was not part of the reinstallation process of the elevators.

Airbus Industrie issued All Operator Telex (AOT) 27-20, dated 19 December 1994, to notify the operators of the A310 of maintenance action to deal with possible autopilot servo rigging problems. AOT 27-20 was received by TAROM, and the incident aircraft was scheduled for a check of autopilot servo rigging. The aircraft log shows that the work, along with other maintenance items, was completed on 06 January 1995 by TAROM maintenance personnel. The maintenance entry read "A/P actuators rigging." This was the first time rigging checks had ever been performed on the A310 by TAROM personnel.

Following the incident, TAROM requested maintenance assistance from the manufacturer to verify the operation of the pitch control system. Personnel from Airbus travelled to Bucharest and performed a check of the autopilot elevator servo rigging on 16 March 1995. During the check by the Airbus team, it was found that the autopilot elevator servo was misrigged; "one turn" of adjustment was required during the check. Some maintenance personnel suggested the possibility that the incorrectly fitting pin, specified in the Maintenance Manual, might have been used in the 06 January rigging checks. TAROM, during their review of the maintenance carried out during the 06 January check of the rigging, indicated that the correct rigging pin may have been used but that the pin may not have been inserted fully, because of personnel inexperience in conducting rigging procedures.

After the 16 March maintenance action, TAROM pilots were asked to check the aircraft pitch control characteristics upon autopilot disengagement. They found relatively benign pitch "bumps" when the autopilot was disconnected. The maintenance entry stated "tendency to climb with 100-200 ft/min."

1.6.7.2 Fuel system

The incident aircraft had a recurring problem with the fuel-system C of G trimming. From 23 January to 10 March 1995, there were at least 11 log entries related to the fuel trim tank system. The usual rectification was the resetting of the CGCC system. The maintenance entry following the incident was "trim tank syst fault"; the rectification was "reset CGCC."

TAROM and Swissair maintenance personnel indicated that A310 aircraft have had recurring problems with the CGCC system; other A310 operators have reported similar problems. It has been suggested that water condensation in the horizontal stabilizer trim tank or fuel density might be a factor leading to fuel trim problems.

1.6.7.3 Hydraulic system

Several maintenance entries were made concerning the yellow hydraulic system as follows:

• 05 February - "yellow hyd pump lo press"
• 13 March - "After 4 hr FL350 AP2 and yaw damper trips to off, and on ECAM wd, 'yellow pump lo press' for 2 sec."
• 09 April - "lo pressure"

Maintenance action included checks and replacement of pumps, and the cleaning of cannon plugs. Ultimately, it was determined by maintenance, in April 1995, that the fluid low quantity was giving an intermittent false warning, which was causing the shut-off valve to close.

1.6.7.4 Autopilot disconnects

There were maintenance entries made in the weeks after the incident regarding autopilot 2 disconnects. In addition to the 13 March event noted above with yellow system low pressure, another disconnect occurred on 04 April with a report "FMS2 and A/P 2 u/s for 1 min."

No disconnects were noted for autopilot 1 during the two months prior to, or two months after, the incident.

1.7 Meteorological information

Weather information was obtained from the Atmospheric Environment Branch Weather Centre for the time of the incident. No SIGMETs were reported in the area of the flight, turbulence was not forecast in the area of the incident, and there were no pilot reports (PIREP) of turbulence in the area.

The forecast wind at FL340 for Rivière-du-Loup was 240 degrees true with a speed of 107 knots. The vertical wind speed change (vertical shear) was, on average, about 2.2 knots per 1,000 feet above FL340, and less than 1 knot per 1,000 feet below FL340. Clear air turbulence is considered to be improbable with such vertical wind shear values. The wind direction and speed at the nearby stations of Sept-Îles, Quebec, and Mont-Joli, Quebec, had forecast wind direction and speed, as well as temperature, nearly identical to that of Rivière-du-Loup, indicating a low probability of horizontal wind shear.

1.8 Aids to navigation

There is no indication of problems with the available aids to navigation.

1.9 Communications

Transcripts were prepared of the radio conversations between the flight and Moncton Centre, as well as of land-line dialogue between the controllers from Montreal and Moncton. No difficulties were noted in the quality of the radio transmissions.

The flight was in contact with Moncton Centre using very high frequency (VHF) radio. Although the flight was still in Montreal airspace, it had been directed to contact Moncton, which was a normal handoff procedure in the area. Shortly after contacting Moncton Centre, at 0252:40, the flight was cleared to SCROD; the controller requested an estimate for SCROD. ROT 006 acknowledged the clearance and gave an estimate for SCROD as 0402 UTC. The controller asked the flight crew to confirm the estimate; the crew replied that they would check the estimate again. The flight crew did not contact Moncton Centre again for nearly two minutes.

The crew of ROT 006 transmitted at 0255:02 UTC that the flight had "a very big problem"; the Moncton controller replied "go ahead." ROT 006 replied with "standby." About 30 seconds later, there was a land-line conversation initiated by the Montreal Centre controller concerning ROT 006. The Moncton controller indicated that he did not want to "bother" the crew by calling the flight.

At 0257:17, the captain indicated to the Moncton controller that the autopilot had disconnected unexpectedly and he had "... finally ... recovered the plane." The possibility of turbulence problems was suggested by the controller. In further radio conversation, ROT 006 indicated that "...everything is fine now."

1.10 Aerodrome information

Not relevant to the incident.

1.11 Flight recorders

1.11.1 Available recordings

The TAROM A310 aircraft is fitted with a flight data recorder (FDR), a cockpit voice recorder (CVR), and a digital aircraft integrated monitoring system recorder (DAR). Because the CVR had a recording time of only 30 minutes, the applicable voice data had been overwritten and was, therefore, not available for analysis. On 03 March 1995, the TSB requested that the FDR be provided for analysis. The operator, through the Romanian Civil Aviation Authority (CAA), indicated that the FDR was not available. The FDR had been overwritten because the aircraft had already flown more than 25 hours since the incident. The operator did provide a 3.5-inch copy disc of the DAR data for the time of the occurrence. Duplicate discs were also provided to the Bureau Enquêtes-Accidents (BEA) of France and the aircraft manufacturer, Airbus Industrie of Toulouse. Detailed plots of the DAR data are contained in Appendix A.

Radar data analysis (RDA) information was available from the Transport Canada Radar Data Processing System from Moncton Centre using the Sept-Îles radar site. Plots of the radar data were produced by the TSB Engineering Branch using the RADEX software program. The radar data and DAR data are consistent. The radar data plots are found in Appendix A.

1.11.2 Description of DAR

The Penny and Giles DAR is used by TAROM as a flight monitoring tool, and TAROM has a facility in Bucharest equipped to analyze DAR data. The DAR uses the same parameter transducers as the FDR, but the recording medium is not impact protected. The data recordings are quickly retrieved without the removal of any aircraft components.

The DAR, as operated at the time of the flight-upset incident, did not record data continuously. A data drop-out occurred until just before the autopilot disconnect, and another drop-out occurred before the aircraft regained level flight at FL350. All the parameters appeared to record correctly.

The DAR data disc was analyzed by the TSB Engineering Branch Laboratory. Calibration data were provided to the TSB by Airbus Industrie and TAROM.

1.11.3 Recorded parameters

The DAR records more than 230 parameters. The sampling rates for the parameters vary from once per four seconds (control wheel force and column force) to eight per second (normal acceleration, or g). The parameters of primary interest used for this investigation were as follows:

• elevator (RH) position;
• trimmable horizontal stabilizer position;
• engines - EPR, N1, N2;
• throttle angle;
• control column force (pitch);
• control wheel force (roll);
• roll angle;
• magnetic heading;
• pitch angle;
• angle of attack;
• airspeed and Mach number;
• vertical g;
• centre of gravity - % MAC;
• yellow hydraulic system pressure (once/4 sec);
• autoflight features (discretes);
• spoilers;
• stall warning (discrete);
• static air temperature (SAT); and
• VHF keying (for time correlation with ATC).

1.11.4 Initial conditions

At the start of the available DAR data (0253:20 UTC), the aircraft was in cruise at FL330 with a computed airspeed of 296 knots or 0.83 Mach. This speed was higher than the normal fuel-efficient cruise speed of about Mach 0.80. The aircraft was in a slight left turn with a roll angle (bank) of 7 degrees, and the heading was decreasing from 073 degrees magnetic. The discrete autopilot parameters show that AP2 was engaged and AP1 was not engaged. The autothrottle system was engaged in the Speed/Mach mode. AP2 shows a disconnect at 0253:28.

1.11.5 Manoeuvre characteristics

Following the AP2 disengagement, the aircraft pitched up. A maximum vertical acceleration (load factor) of 1.94 g was developed within five seconds; the aircraft pitch angle increased to a peak value of 29.5 degrees nose-up within 25 seconds. At the point of maximum pitch, the vertical g decreased to less than 1 g (minimum 0.5 g) and remained at less than 1 g values until the aircraft was descending through FL362. The maximum nose-down pitch was 15 degrees at time 0254:35, as the aircraft was descending through FL365. At 0254:42, AP2 was re-engaged and then was quickly disengaged when AP1 was selected at 0254:45. The minimum recorded pressure altitude was 31,580 feet (at time 0255:10); the airspeed had increased to 292 knots (calibrated air speed). At this minimum-altitude point, AP1 disengaged again. A rapid climb developed again, but was moderated at 0255:20 when AP1 was successfully engaged.

At the time of the AP2 disengagement that started the event, the aircraft was in a left bank of 8 degrees. The aircraft rolled to the right at a low rate until the bank angle reached 10 degrees right. The bank angle varied left and right with a maximum angle of 12 degrees left roll, and then stabilized in level flight with the final successful engagement of AP1 at time 0255:20.

1.11.6 Elevator travel

The elevator position was at 1.05 degrees nose-down prior to AP2 disengagement. As soon as the autopilot disengaged, the elevator moved quickly toward 1.76 degrees nose-up. The first counter movement of the elevator was recorded at 0253:33, as the elevator moved to 0.3 degrees nose-down. This counter motion occurred as a nose-down column force was recorded. The elevator angle then varied with an amplitude of one degree, centred about 1.5 degrees nose-up. The maximum nose-up elevator was 4.5 degrees at time 0254:14. At 0254:45, AP1 was engaged; the elevator angle then moved to 1.0 degree nose-down and was centred about the 1.0 degree nose-down angle.

1.11.7 Horizontal stabilizer

Prior to the AP2 disengagement, the horizontal stabilizer angle was maintained at 1.4 degrees nose-up, and just after the disengagement, the horizontal stabilizer angle moved to about 0.4 degrees nose-up. The horizontal stabilizer initially made only small movements centred about the approximate zero-degree-angle position. At the point of maximum pitch (0253:53), the THS was at a 0.5 degree nose-down position. The horizontal stabilizer then moved toward 1.0 degree nose-down at 0254:07 and returned to 0.4 degrees nose-up at 0254:47. The horizontal stabilizer moved toward the pre-disengagement value of about 1.4 degrees nose-up as the aircraft resumed level flight at FL350.

1.11.8 Airspeed/Angle of attack

Airspeed began to decrease steadily from the FL330-cruise value of 296 knots just after AP2 disengaged. Coincident with the airspeed decrease was an increase in pitch angle and angle of attack. At a time of 0253:32 (about 4 seconds after the autopilot 2 disengagement), the angle of attack increased rapidly from its cruise value (approximately +1 degree) to 9.5 degrees. Just after this time, the highest total (left and right) nose-up column force of at least 110 newtons (about 24 pounds force) was recorded.

The airspeed decreased to a minimum recorded value of 154.5 knots as the aircraft reached a peak pressure altitude of 38,470 feet (FL385). At the apogee of the manoeuvre, the angle of attack increased to about +11.2 degrees. At the same time (0254:10), the stall warning discrete was recorded. The angle of attack then decreased quickly to approximately +7 degrees. About 10 seconds later, the angle of attack again increased and reached a value of +12.1 degrees as the pitch angle was reducing through 3 degrees; again, the stall warning was activated and the angle of attack reduced. Two more +11 degree angle-of-attack values were recorded, each accompanied by stall warnings. The last stall warning occurred at 0254:40, as the airspeed was increasing through 205 knots and while the aircraft was descending through FL358.

1.11.9 Throttles and EPR

The recorded engine pressure ratios (EPR) of the left and right engines, as the aircraft was in cruise at FL330, were at the same value of 1.21. The recorded EPR of the two engines remained at even levels throughout the occurrence. The throttle angles increased within one second of the autopilot 2 disengagement; EPR increases followed to a peak of approximately 1.42 within five seconds. The throttle angle then reduced rapidly at a rate greater than 19 degrees per second. The throttle angle then increased again at about 7 degrees per second; EPR followed and stabilized at an average value of about 1.58. As the aircraft was climbing through FL375 at an airspeed of 172 knots, the throttle angle again increased rapidly; the EPR peaked at 1.65. A throttle angle reduction was recorded and the EPR again stabilized at 1.58 at 0254:04. After passing the maximum aircraft altitude, a small increase of EPR was noted at 0254:27 (peak EPR 1.60), coincident with a rapid throttle angle increase. After 1.5 seconds, the throttle angle decreased and then began increasing five seconds later, at a rate of about 2 degrees per second, as the aircraft was descending through FL365; the throttle angle peaked at 81 degrees. The EPR then peaked at 1.67 and reduced slowly to the previous average value of about 1.58 while the throttle remained at about 81 degrees.

The Airbus review of the throttle movement indicated that the throttle movements at 0253:34, 0254:04, and 0254:27 were the result of pilot movement of the throttle levers.

The Flight Manual charts indicated that the maximum continuous thrust level at FL360 for a total air temperature (TAT) range from -20 to -40 degrees Celsius is 1.675 EPR.

1.11.10 Control forces

For some portions of the flight-upset manoeuvre there were diverging column forces. At 0253:45, as the aircraft was climbing through FL350 with a pitch angle of 22 degrees, the left column force was nose-up and the right column force was nose-down. Because of the geometry of the control system, the forces should be summed and this resulted in a net nose-up force.

At 0254:42, the co-pilot wheel force increased to about 80 newtons and remained at that value for about 15 seconds; the aircraft rolled to the left and stabilized at a left-bank angle of 8 to 12 degrees during the same time period.

1.11.11 Performance and systems parameters

The DAR shows the aircraft mass to be 131,000 kg at the time of the upset. The wind at the time of the upset shows a fairly steady speed of 112 to 114 knots from a direction of 233 degrees true.

The C of G prior to the event was steady at 38.6% MAC. During the upset, the C of G moved aft and reached a maximum value of 39.6% MAC at the apogee of the manoeuvre. At 0254:23 the C of G started to move forward and reached approximately 33% MAC as the flight was approaching stabilized cruise flight at FL350.

There were no recorded pressure drops below minimum values in the yellow hydraulic system; the "pressure" parameter and the "servo control no low pressure" parameter are each sampled every four seconds. The maximum time difference between sampling of each of the two parameters is approximately 2.2 seconds.

1.12 Wreckage and impact information

Not relevant to the incident.

1.13 Medical information

There are no known medical problems that would have affected the crew's performance.

1.14 Fire

There was no fire.

1.15 Survival aspects

Reports from the cabin crew did not indicate any significant problems for the crew or passengers as a result of the flight manoeuvres during the incident. The flight forces were more noticeable in the aft portion of the aircraft. No injuries were reported.

1.16 Tests and research

1.16.1 Research

TAROM, in addition to providing DAR data to the TSB, supplied the manufacturer with a copy of the DAR data on disc. Airbus Industrie reviewed that data and provided information as to the actions of various systems during the incident manoeuvre. Also, the manufacturer provided some performance information related to the incident.

1.16.2 Autothrottles

Only one thrust control computer (TCC 1) operation is recorded by the flight recorder. However, the aircraft manufacturer indicated that its research showed that the autothrottle system was engaged throughout the manoeuvre. This conclusion was based on the throttle motion rates and system redundancy features.

1.16.3 Trimmable horizontal stabilizer motion

Airbus Industrie's study of the horizontal stabilizer movement during the flight upset indicated that the crew did not make trim inputs during the manoeuvre. The nose-down movement of the horizontal stabilizer from 0253:28 to 0254:45 followed by nose-up travel appeared to assist the crew in the recovery from the manoeuvre. This horizontal stabilizer motion was assessed to be the result of Alpha/Mach/Vc trim features, and the manufacturer indicated that horizontal stabilizer operation was normal.

1.16.4 Centre of gravity warning

The manufacturer reviewed the aft C of G situation of the incident flight. Their research showed that the crew likely received an "Aft CG" warning which caused the action to commence the forward transfer of fuel. The "Aft CG" warning is based on the flight warning computer (FWC) computation of an "aerodynamic" centre of gravity, which is derived in part from the horizontal stabilizer position. During the flight upset event, the elevator moved upward and the horizontal stabilizer moved downward, which led the FWC to compute a C of G further aft than it actually was. The manufacturer assessed that it was highly probable that the "Aft CG" amber warning (normally activated at 41% MAC) was triggered at a lower value.

1.16.5 A310 stall characteristics

The manufacturer was asked to provide FL370 data for the speeds and angle of attack of stall onset indications and the stall itself. Airbus Industrie stated that buffet onset occurs at Mach 0.63 for an angle of attack of 6.5 degrees. The stall warning is triggered at an angle of attack of 10 degrees, with aerodynamic stall occurring at angles of attack greater than 10.6 degrees. It was further stated that, at altitudes greater than 30,000 feet, "buffet onset appears before the stall warning giving a warning through the inherent aerodynamic qualities of the airplane as requested by FAR 25.207."

1.16.6 Control forces

Review of the control forces measured by the FDR indicated to Airbus Industrie that there were nose-up control inputs that were inappropriate, very early in the pitch-up. Because its research and tests had shown that the elevator motion to neutral would move the elevator to a maximum value of 0.4 degrees nose-up, the manufacturer also attributed some of the initial elevator movement, following autopilot disconnect, to pilot control input. The manufacturer's review also indicated that considerably more nose-down control authority was available to the crew than was used during the climbing phase of the flight upset.

1.17 Organizational and management information

TAROM is a state-owned airline. The maintenance activity at TAROM is led by the airline's Technical Director. Swissair provides contract maintenance support to TAROM, and to many airlines in countries throughout the world, including Canada. The Swissair Technical Advisor stationed in Bucharest monitors the line maintenance activity of TAROM. Scheduling of heavy checks and special maintenance to be performed by Swissair is coordinated through the Swissair representative in consultation with the maintenance organization of TAROM.

Airbus Industrie has a Resident Customer Support Manager in Bucharest to provide assistance to TAROM regarding the A310 and to conduct liaison between the manufacturer and the airline.

1.18 Additional information

1.18.1 Navigation track

Just prior to the autopilot disconnect that initiated the flight-upset event, the flight had been cleared from its position (approximately 48°22′N, 070°08′W), directly to SCROD (54°37.0′N, 055°52.0′W). Prior to that time, the flight had been proceeding to reporting point ANCER (48°33.5′N, 06°25.3′W).

An 18-degree ground track change to the left would have been required to change course from the aircraft's position to SCROD vice ANCER.

1.18.2 Orly incident

On 24 September 1994, while on final approach at Paris Orly Airport, the incident aircraft, YR-LCA, had a 60-degree pitch-up excursion, followed by a pitch-down of more than 30 degrees. The BEA released a preliminary report which indicates that the event was initiated by the selection of 20/20 slat/flap at a speed slightly above the limiting speed of 195 KIAS. During this incident, the autopilot was not in use. The horizontal stabilizer moved more than 10 degrees from its stable position, just prior to the event, while the aircraft was on final approach.

1.18.3 Other A310 pitch incidents

On 25 November 1994, an A310 operated by an Asian airline had an upset manoeuvre following a disconnect of the autopilot at a speed of 0.83 Mach. Following the disengagement, the elevator moved from 0.7 degrees nose-down to 1.05 degrees nose-up, resulting in a load factor of 1.78 g. The elevator was moved to 3.52 degrees nose-down, leading to a slightly negative load factor. The elevator then moved in the opposite direction to produce a load factor of 2.15 g. Some passengers were injured during the manoeuvre as a result of negative and positive g forces.

A test flight following the upset demonstrated that pitch-up occurred on autopilot disengagement. Ground tests confirmed that the elevator movement occurred each time that the autopilot was disengaged. The airline replaced various components, including the autopilot pitch-servo motor, and carried out a complete re-rigging of the autopilot and elevator control linkage, yet the elevator movement continued with autopilot disengagement. Ultimately, with the assistance of Airbus Industrie, it was determined that the Maintenance Manual specified a rigging pin that was not satisfactory. As a result of the Asian flight upset, an All Operator Telex (AOT 27-20) was issued. At least three other unexpected pitch problems, on autopilot disconnect, were reported by other airlines.

1.18.4 All operator Telex 27-20

AOT 27-20, which applied to all A300, A300-600, and A310 aircraft, was issued by Airbus Industrie on 19 December 1994. The AOT (attached as Appendix B)indicated that mechanical zero rigging of the autopilot could not be achieved when using the rigging pin specified (part number OU131388) in the Aircraft Maintenance Manual (AMM) 27-31-00 page block 501, para 1.a. The pin is not long enough to go through the torque limiter lever and to internally rig the autopilot actuator. AOT 27-20, under "consequences", further stated:

In case of autopilot incorrect rigging, sudden A/C pitch up or pitch down could be experienced at the time of unforeseen A/P disconnection. The amplitude of elevator deflection and associated load factor will depend on the rigging offset. In addition as the rigging pin and principle is similar on the yaw autopilot actuator, the same incorrect rigging could be introduced during adjustment of this actuator, such an incorrect rigging could generate yaw jerk at A/P disconnection.

AOT 27-20 requested a rigging check of both the pitch and yaw autopilot actuator using a standard 8 mm diameter by 200-mm long pin (P/N 98A27307541000). Figure 4 shows the two rigging pins for comparison.

The rigging check was requested at the "next convenient opportunity but not exceeding 500 flight hours after receipt of this AOT." The estimated elapsed time for the check was one man-hour per aircraft. The AOT indicated that a temporary revision to the Aircraft Maintenance Manual chapters specifying the unsuitable rigging pin would be issued by early January 1995. In addition, the manufacturer requested that the results of the AOT 27-20 rigging checks be sent to them. A 25 January 1995 message sent from the Airbus Resident Customer Support Manager, following inspection by TAROM, reported "AOT performed on A/C MSN 450-636-644 check results are correct."

2.1 Introduction

The flight was in cruise at FL330 and was proceeding normally; the captain was the pilot at the controls and was performing routine navigation tasks. The analysis will deal with the autopilot event that triggered the flight-upset event, the subsequent reaction of the aircraft and the crew, as well as the recovery and post-recovery portions of the flight and the return to cruise flight. Maintenance events prior to, and after, the flight upset will also be discussed.

2.2 Autopilot disconnect

Autopilot 2 (CMD2) was in use at the time of the start of the upset event. The captain was using the FMS in the NAV mode and had just entered the oceanic boundary point SCROD in the FMS and was in the process of looking at the CDU to note the new estimate, as requested by the air traffic controller. At that point, the captain heard a "whooshing" sound which seemed like the noise created by turbulence; at the same time, the autopilot disengaged and the aircraft began to pitch up.

The noise heard by the pilot suggested turbulence as a possible reason for the initiation of the upset. A review of the weather in the area of the incident did not indicate the likely presence of turbulence. The wind, although strong (greater than 100 knots), had low values of vertical and horizontal shear. The temperature gradients forecast for adjacent areas were very low. There were no other reports of clear air turbulence (CAT) in the area of the incident. The incident flight did not report any more flight disturbances when level cruise was reattained. Noises of the type heard by the captain can be the result of rapid changes in flight path angle, angle of attack, or yaw. The rapid change of pitch and angle of attack experienced at the start of the incident could account for the noise heard by the captain. The noise likely occurred as the autopilot disengaged and was a consequence of the reaction of the aircraft, not an external force such as clear air turbulence.

Because the flight control computers were removed from the aircraft after the incident and were not available for examination, the disconnect reasons could not be determined. A factor which prevented the timely maintenance analysis of the units was the absence of a report of autopilot problems in the aircraft log following the incident flight. Clearly, the event required some type of entry in the aircraft log.

Some of the conditions required to have the autopilot remain engaged were reviewed in an attempt to narrow down the possible reason for the disengagement. There were no reports of problems with several systems under review. For example, no problems were indicated with the pitch and roll servo motors. The flight control computers, the pitch and roll servo motors, and the pitch trim systems did not exhibit any failures in the weeks before or after the incident. There was no indication of problems with the yaw damper systems; IRS 1,2, and 3 functioned normally on the incident flight. ADCs 1 and 2, as well as the FCUs, were apparently operative for the entire incident flight. Neither crew member was manually operating the controls at the time of the disengagement; the possibility of crew nose-up control inputs, shortly after autopilot disconnect, cannot be eliminated.

Because the aircraft was in a left turn as the autopilot disengaged, followed by aircraft pitch-up, the possibility of asymmetric elevator travel was considered. The two elevators are designed to not allow independent movement at the aircraft's airspeed regime at the time of the upset. There were no reports or indications of asymmetric elevator movement, and roll control response appeared normal. The left turn was a normal reaction to the input of the new waypoint SCROD, and does not indicate any abnormal or asymmetric elevator behaviour to be a factor in starting the upset.

Two possible autopilot engagement requirements, correct electrical power and hydraulic system pressure, could not be eliminated as possibilities leading to the disengagement of autopilot 2. Crew-induced column force or the crew's use of the instinctive disconnect button seem to be unlikely causes of the autopilot disconnect.

There is no specific maintenance entry that would indicate that incorrect electrical power was applied to the autopilot 2 system, which led to the disengagement. However, the possibility of a rapid, undetected, transient-type interruption of electrical power to the autopilot cannot be eliminated.

Study of the maintenance history of the incident aircraft showed several entries related to yellow hydraulic system pressure. Many weeks after the incident, the recurring pressure problem was determined to be related to erroneous sensing of the reservoir fluid low-level (LOLVL) warning, leading to closing of a shutoff valve, a design feature to maintain yellow system fluid for the RAT. The intermittent failures of the yellow system, and in some cases the short-term loss of autopilot 2, were noted in the aircraft log before and after the flight upset incident. Autopilot 2 receives hydraulic power from only the yellow system.

The DAR data did not reveal a loss of yellow system hydraulic pressure at the time of the autopilot disengagement. However, the yellow system pressure is only sampled a maximum of 2.2 seconds apart and it is possible that a momentary pressure loss could have gone undetected by the DAR. The 13 March 1995 maintenance entry indicated that a loss of yellow system pressure lasted only two seconds.

Review of the systems affecting the autopilot's ability to remain engaged leads to a conclusion that a possible reason for the spontaneous disengagement of autopilot 2 was the momentary loss of yellow hydraulic system pressure. This pressure loss may have been due to slight fluid motion resulting from the left turn to SCROD, leading to a false low-level warning.

2.3 Aircraft reaction

2.3.1 Introduction

A maximum vertical acceleration (load factor) of 1.94 g was developed within four seconds of the autopilot disengagement. Review of the elevator and horizontal stabilizer system movement reveals that the aircraft reacted as a result of a sudden nose-up movement of the elevator from +1.05 degrees nose-down to 1.76 degrees nose-up when the autopilot disconnected. The consequence of the elevator action was a rapid pitch-up moment. The horizontal stabilizer had only minor motion as compared to the 24 September 1994 incident at Orly, involving the same aircraft. The characteristics and genesis of the two incidents are different and appear to be technically unrelated.

The g load on the aircraft during the Canadian event was less than the maximum permissible of 2.5 g, but was a large amount for this category of aircraft. Discussion follows on the reasons for the elevator motion.

2.3.2 Elevator motion

Operators of the A310 had noted incidents of uncommanded climb or descent when autopilots disconnected in cruise. During an incident in Asia in November 1994, an A310 commenced a rapid climb following an autopilot disengagement; several passengers were injured when aggressive control inputs were used to stop the climb, and negative g forces ensued. The autopilot disconnect, as well as the severity of the event, were attributed to crew pitch inputs. Another European A310 operator reported similar, but less serious, occurrences. A common element in these events was autopilot elevator servo misrigging. The misrigging was attributed to the use of a rigging pin of an incorrect size. The incorrect rigging pin was specified by the approved Maintenance Manual. As a result of the 1994 Asian incident, the manufacturer sent AOT 27-20 to all A310 operators advising that the suspect rigging be checked. TAROM received AOT 27-20, and the aircraft log showed that the work was conducted in efforts to comply with the AOT. Fifteen days after the TAROM occurrence near Rivière-du-Loup, technicians from the manufacturer assisted TAROM in checking the rigging of the autopilot elevator-servo. The Airbus team found problems with rigging and adjusted the rigging to conform to AOT 27-20. Incorrect autopilot elevator-servo rigging existed at the time of the incident.

The incorrect rigging skews the neutral position of the elevator when the autopilot is engaged. With correct servo rigging, the elevator remains in the neutral position and on automatic autopilot disengagement does not move, avoiding a "bump" or pitching moment. For level-flight situations with an engaged autopilot and incorrect elevator servo rigging, the horizontal stabilizer compensates for the off-neutral position of the elevators by producing opposing trim. If the elevator is out of position down (+), the horizontal stabilizer compensates by trimming nose-up. This was the situation at the time of the upset incident.

The DAR shows that the elevator moved from 1.05 degrees nose-down to 1.76 degrees nose-up, a nose-up change of about 2.8 degrees. The manufacturer indicated that possible misrigging of the autopilot elevator servo would not account for the total amount of elevator motion. The manufacturer indicated that the elevator would have moved to a maximum of 0.4 degrees nose-up and the rest of the travel could be explained by pilot input. The activity of the captain in using the FMS, and the non-activity of the co-pilot, appears to counter the suggestion of crew pitch control input at the exact time of the autopilot disengagement. However, the possibility of an inappropriate reactive pitch control input by a pilot, causing some of the initial nose-up elevator travel, cannot be discounted.

It is concluded that the initial pitch-up reaction of the aircraft was a direct consequence of the misrigged autopilot elevator servo.

2.3.3 Aircraft speed

The aircraft's speed of 0.83 Mach at the start of the flight upset, although 0.01 Mach less than the limiting speed, was faster than the normal fuel-efficient cruise speed of 0.8 Mach. Higher dynamic pressure augmented the pitch response of the aircraft because of the elevator motion. The Mach/Vc trim system would have had little or no effect on the pitch-up at the moment of autopilot disconnect because there was no increase of airspeed. As the airspeed decreased in the climb, Mach/Vc trim would have provided nose-down trim changes; during the descent, nose-up trim changes would have been developed.

2.3.4 Centre of gravity

The C of G was aft of the normal maximum of about 37% MAC because of apparent problems with the CGCC system and fuel transfer sequencing. The contribution to the initial pitch-up moment would have been minimal, in that the horizontal stabilizer would have trimmed most of the effect of the aft C of G. However, during the ascent, the C of G moved further aft of the cruise value of 38.5% MAC to 39.3% MAC. As the aircraft reached the minimum speed in the flight-upset manoeuvre, the captain opened fuel valve switches to move the C of G forward.

The aft C of G reduced the stall speed of the aircraft slightly. The manufacturer indicated that aircraft longitudinal stability would have been positive with the C of G near the aft limit of 40%, but the aircraft would have been more stable with a forward C of G. The action of the captain in transferring the fuel forward during the descending portion of the manoeuvre produced a nose-down effect and would not have aided the recovery as the aircraft reached FL315. It appears that the crew's management of the CGCC failure did not comply with the checklist procedure.

2.3.5 Throttles

At several portions of the upset manoeuvre, the throttles moved, resulting in thrust (EPR) changes. During the initial portions of the upset, the throttles were moved by the autothrottle system because the airspeed was reducing below the target speed. As evidenced by the rate of throttle movement, the crew manually reduced the throttle lever angle from 72 degrees as the EPRs reached 1.4. As a consequence, the EPRs reduced to approximately cruise values. The autothrottle system then dutifully moved the throttles forward again to an angle of 72 degrees, and the EPRs stabilized at about 1.6. The thrust of the engines was maintained at high levels as the autothrottle attempted to achieve the target speed, which was not possible because of the high rate of climb. Thrust latch occurred as part of the flight envelope protection as the aircraft reached high angles of attack.

2.4 Crew reaction

The workload of the crew was not high at the start of the flight upset. The captain was performing all the flight tasks because the co-pilot was taking a short rest. The captain was carrying out normal navigation tasks that required him to have his head down as he looked at the CDU. The captain's focus was on the CDU when the autopilot disengaged.

The captain sensed a noise that he associated with turbulence, and he reacted to the pitch up by pushing opposite elevator about five seconds later. The amount of opposite elevator succeeded in temporarily arresting the g forces back to less than 1 g. There is no doubt that the forces experienced by the crew would have seemed extreme for the A310. Several oscillations of pitch rate, elevator travel, and vertical g were noted. The vertical g remained less than 1 g after the maximum pitch angle was reached. It was physically possible for the pilots to exert more pitch-control force to prevent the high pitch angle or to use pitch trim inputs to reduce the control forces. In not using all the pitch-control authority and trim available, the crew avoided negative g forces and consequential passenger and crew injuries, but they allowed the aircraft to enter the stall regime. At some points in the flight upset, commencing just after the autopilot disconnected initially, aircraft control was not effective and the control inputs were inappropriate for recovery of the aircraft. Recovery at the start of the second climb after the descent to FL315 was effected by the engagement of the autopilot.

There was obvious concern that the flight had a serious problem and the captain's radio transmission reflected this. The crew were very busy in their attempts to recover the aircraft; the co-pilot had also joined in to input some control forces. Their activity was not necessarily coordinated, which had the potential to lead to problems. The decision by the Moncton controller not to bother the crew when he observed the altitude deviation reduced that pilot's workload. Such a conscious decision would have been difficult if conflicting air traffic had existed. The crew's recovery to cruise 2,000 feet above their cleared altitude shows that they were distracted by the flight upset. However, there was no indication that the crew was concerned enough to divert the flight for maintenance action, or to enter the incident in the aircraft log.

2.5 Maintenance

The incident was precipitated by a maintenance problem, the misrigging of the autopilot elevator servo. The problem had been identified by the manufacturer, and operators of the A310 had been notified by AOT 27-20 of both the problem and the interim fix.

Despite a rigging check of the autopilot elevator servo nearly two months prior, the incident aircraft was misrigged. There are two possibilities as to why the incorrect rigging existed. Either the incorrect rigging pin was used or the correct rigging pin was not inserted fully, due to the inexperience of the airline maintenance personnel performing the rigging check.

1. The aircraft rigging procedure in the maintenance manual allowed incorrect autopilot elevator servo rigging because the procedure specified an inappropriate rigging pin.
   
2. The specified rigging pin was an incorrect size to use for rigging the autopilot servo.
   
3. The manufacturer had advised the operators of the A310, including TAROM, of the necessity to recheck the rigging of the autopilot servos with a different rigging pin, specified in AOT 27-20.
   
4. The operator carried out an autopilot-servo rigging check, but the aircraft autopilot elevator servo remained incorrectly rigged, either because the incorrect rigging pin was used or because the correct rigging pin was not inserted fully.
   
5. When the autopilot disconnected, the elevator was offset from neutral and the horizontal stabilizer was mistrimmed because of automatic horizontal stabilizer adjustments made to compensate for the incorrect rigging.
   
6. Autopilot number two (CMD2), which is hydraulically powered by the yellow system, was in use at the time of the incident.
   
7. The yellow hydraulic system had a quantity transmitter problem that occasionally caused a temporary shutoff of yellow hydraulic pressure on other flights.
   
8. Autopilot number two disconnected, possibly as a result of a momentary indication of low yellow hydraulic system quantity or pressure; other momentary interruptions of autopilot engagement conditions cannot be ruled out as the cause of the autopilot disengagement.
   
9. Nose-up elevator motion and the mistrimmed horizontal stabilizer position produced a pitch-up moment when the autopilot disengaged.
   
10. The high Mach number of the aircraft added to the pitch-up moment.
    
11. At some points in the flight upset, commencing just after the autopilot disconnected initially, aircraft control was not effective and some control inputs were inappropriate for recovery of the aircraft.
    
12. The A310 fuel system has recurring CGCC problems.
    
13. The centre of gravity was further aft than normal because of a fault in the CGCC system and the procedures used by the crew in dealing with the fault.
    
14. The aircraft flight envelope protection system assisted the crew in the recovery from the low speed portion of the upset manoeuvre and attempted to provide beneficial pitch trim changes during the ascent and descent.
    
15. The crew did not make a required entry in the aircraft log regarding the flight upset.
    
16. The decision by the Moncton air traffic controller not to "bother" the crew at a critical time removed possible distractions from the crew as they attempted to deal with the flight upset.

3.1 Causes and contributing factors

The flight upset manoeuvre was caused by a misrigged autopilot elevator servo control, which led to an initial pitch-up, and by the crew's ineffective or inappropriate pitch control inputs which led to aircraft stall. Contributing factors in the flight upset were the aft centre of gravity position and the aircraft's high speed.

4.1 Safety action taken

There are two operators of the A310 in Canada: Air Club International and the Department of National Defence (DND). (Canadian Airlines International provides maintenance support to DND.) Each operator was contacted in May 1995 to determine if AOT 27-20 had been carried out. All Canadian aircraft had undergone the autopilot-servo rigging checks specified in AOT 27-20.

As planned and indicated in AOT 27-20, an A310 (and A300-600) Aircraft Maintenance Manual amendment indicating the use of rigging pin 98A27307541000 was published on 01 June 1995.

Consigne de Navigabilité (CN, or Airworthiness Directive) 95-164-183 (B) was released by the Direction Générale de l'Aviation Civile of France on 30 August 1995, with an effective date of 09 September 1995. Airworthiness Directives issued by the country of manufacture are mandatory in Canada. The Airworthiness Directive specified that, within 500 flight hours, operators action AOT 27-20 and check that specific chapters of the Aircraft Maintenance Manual documentation had been correctly updated.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board, consisting of Chairperson Benoît Bouchard, and members Maurice Harquail and W.A. Tadros, authorized the release of this report on 12 November 1996.

Appendix A - Radar data and additional digital aircraft integrated monitoring system recorder (DAR) information

Appendix B - Transcription of AOT 27-20

ALL OPERATORS TELEX - ALL OPERATORS TELEX SUBJECT: A300/A300-600/A310/AUTOPILOT ACTUATORS RIGGING CHECK.
OUR REF: A300/A300-600/A310/AOT 27-20/19 DEC 1994

1. AIRCRAFT AFFECTED
   ALL DELIVERED A300, A300-600, AND A310 AIRCRAFT.
2. REFERENCED DOCUMENTATION
   AMM 22-13-23 AUTOPILOT PITCH ACTUATOR REMOVAL/INSTALLATION
   (A300-600 AND A310)
   AMM 22-13-24 PITCH TORQUE LIMITER LEVER REMOVAL/INSTALLATION
   (A300-600 AND A310)
   AMM 22-13-27 AUTOPILOT YAW ACTUATOR REMOVAL/INSTALLATION
   (A300-600 AND A310)
   AMM 22-13-28 YAW TORQUE LIMITER LEVER REMOVAL/INSTALLATION
   (A300-600 AND A310)
   AMM 22-11-28 AUTOPILOT YAW SERVOMOTOR REMOVAL/INSTALLATION (A300)
   AMM 22-11-29 YAW TORQUE LIMITER LEVER REMOVAL INSTALLATION (A300)
   AMM 22-12-28 AUTOPILOT PITCH ACTUATOR REMOVAL/INSTALLATION (A300)
   AMM 22-12-29 PITCH TORQUE LIMITER LEVER REMOVAL/INSTALLATION (A300)
   AMM 27-31-00 PAGE BLOCK 501 PITCH MECHANICAL CONTROL ADJUSTMENT/ TEST (A300, A300-600 AND A310).
3. REASON REASON
   3.1. FACTS
   DURING A TEST FLIGHT, ONE OPERATOR HAS REPORTED A/C PITCH UP AT AUTOPILOT 1/2 DISENGAGEMENT DURING CRUISE. AFTER REPLACEMENT OF THE PITCH AUTOPILOT ACTUATOR, ANOTHER FLIGHT TEST WAS CARRIED OUT AND SIMILAR PHENOMENON WAS REPORTED. THE ASSOCIATED UPWARD DEFLECTION OF THE ELEVATOR SURFACE AT THE TIME OF A/P DISCONNECTION WAS AROUND 1.5 DEG. DURING TROUBLE SHOOTING AND RIGGING CHECK, IT WAS FOUND THAT THE MECHANICAL ZERO RIGGING OF THE A/P ACTUATOR COULD NOT BE ACHIEVED WHEN USING THE PIN P/N OU131388 AS RECOMMENDED IN A300-600 AND A310 AMM 27-31-00 PAGE BLOCK 501 PARA 1.A (4). FURTHER INVESTIGATIONS REVEALED THAT THIS PIN IS NOT LONG ENOUGH TO GO THROUGH THE TORQUE LIMITER LEVER AND TO INTERNALLY RIG THE A/P ACTUATOR.
   AFTER ADJUSTMENT OF THE MECHANICAL ZERO RIGGING USING A LONGER PIN, AN UNEVENTFUL FLIGHT TEST WAS PERFORMED.
   3.2. CONSEQUENCES
   IN CASE OF AUTOPILOT INCORRECT RIGGING, SUDDEN A/C PITCH UP OR PITCH DOWN COULD BE EXPERIENCED AT THE TIME OF UNFORESEEN A/P DISCONNECTION. THE AMPLITUDE OF ELEVATOR DEFLECTION AND ASSOCIATED LOAD FACTOR WILL DEPEND ON THE RIGGING OFFSET.
   IN ADDITION AS THE RIGGING PIN AND PRINCIPLE IS SIMILAR ON THE YAW AUTOPILOT ACTUATOR, THE SAME INCORRECT RIGGING COULD BE INTRODUCED DURING ADJUSTMENT OF THIS ACTUATOR, SUCH AN INCORRECT RIGGING COULD GENERATE YAW JERK AT A/P DISCONNECTION.
   3.3. AIM
   AIM OF THIS AOT IS TO REQUEST THE RIGGING CHECK OF BOTH PITCH AND YAW AUTOPILOT ACTUATOR USING A STANDARD 8 MM DIA AND 200 MM LONG PIN P/N 98A27307541000 WHICH IS EASIER TO USE THAN THE PIN P/N OU131388 AND PROVIDES A MORE POSITIVE INDICATION CONCERNING THE RIGGING CONDITION.
4. SHORT TERM ACTION
   4.1. PLANNING
   IT IS REQUESTED TO CHECK THE RIGGING OF THE PITCH AND YAW AUTOPILOT ACTUATOR AT THE NEXT CONVENIENT OPPORTUNITY BUT NOT EXCEEDING 500 FLIGHT HOURS AFTER RECEIPT OF THIS AOT.
   THE CORRESPONDING ELAPSED TIME IS ONE MAN HOUR PER A/C FOR BOTH CHECKS (HALF AN HOUR PER ACTUATOR).
   4.2. DESCRIPTION
   FOR A300-600 AND A310:
   - CHECK THE PITCH AUTOPILOT ACTUATOR RIGGING AS DESCRIBED IN AMM 27-31-00 PAGE BLOCK 501 PARA 1.D (4). AT STEP (B) DO NOT RIG THE AUTOPILOT SERVO MOTOR WITH PIN P/N OU131388 BUT WITH PIN P/N 98A27307541000, FULLY INSERT RIGGING PIN TO ASCERTAIN CORRECT RIGGING.
   - CHECK THE YAW AUTOPILOT ACTUATOR RIGGING AS DESCRIBED BELOW:
   MAKE SURE THAT RUDDER TRIM IS SET AT ZERO AND THAT RUDDER PEDAL ARE SET AT NEUTRAL.
   INSTALL RIGGING PIN P/N 98A27307546000 IN THE RUDDER CONTROL MAIN BELLCRANK.
   INSTALL RIGGING PIN P/N 98A27307541000 IN THE YAW AUTOPILOT ACTUATOR AND CHECK RIGGING. IN CASE THE PIN CANNOT FULLY ENGAGE, THEN JUST THE LENGTH OF THE PUSHROD (10) AS DESCRIBED IN ABOVE
   AMM 22-13-27 PAGE BLOCK 401 PARA 1.B (4) (C) 3.
   FOR A300:
   - CHECK THE PITCH AUTOPILOT ACTUATOR RIGGING AS DESCRIBED IN AMM 27-31-00 PAGE BLOCK 501 PARA 1.B (4).
   - CHECK THE YAW AUTOPILOT ACTUATOR RIGGING AS DESCRIBED BELOW:
   MAKE SURE THAT RUDDER TRIM CONTROL WHEEL IS SET AT ZERO AND THAT RUDDER PEDALS ARE SET AT NEUTRAL.
   INSTALL RIGGING PIN P/N 98A27307546000 IN RUDDER CONTROL MAIN BELLCRANK.
   INSTALL RIGGING PIN P/N 98A27003001000 IN THE YAW AUTOPILOT ACTUATOR AND CHECK RIGGING. IN CASE THE PIN CANNOT FULLY ENGAGE, THEN ADJUST THE LENGTH OF THE PUSHROD (10) AS DESCRIBED IN ABOVE AMM 22-11-28 PAGE BLOCK 401 PARA 1.B (4) (C) 3.
   4.3. MATERIAL TOOLING.
   FOR A300-600 AND A310
   THE FOLLOWING RIGGING PINS ARE REQUIRED: P/N 98A27307549000, 98A27307541000, AND 98A27307546000.
   FOR A300
   THE FOLLOWING RIGGING PINS ARE REQUIRED: P/N 98A27003001000, 98A27307549000 AND 98A27307546000.
5. FURTHER ACTION
   A TEMPORARY REVISION WILL BE ISSUED BY EARLY JAN 95 TO AMEND ALL AMM CHAPTERS LISTED IN PARA.2 (EXCEPT AMM 27-31-00 PAGE BLOCK 501 FOR A300 WHICH IS CORRECT) IN ORDER TO DELETE THE RIGGING PIN P/N OU131388 AND REPLACE IT BY PIN P/N 98A277003001000 FOR A300 A/C AND BY PIN P/N 98A27307541000 FOR A300-600 AND A310 A/C.
6. REPORTING/ACKNOWLEDGEMENT
   OPERATORS ARE REQUESTED TO ACKNOWLEDGE RECEIPT OF THIS AOT TO AI/SE-EQ R. LASCOURS WITHIN 48 HOURS AFTER RECEIPT. THIS ACKNOWLEDGEMENT CAN BE MADE THROUGH THE AIRBUS CUSTOMER SUPPORT OFFICE WHEN AVAILABLE.
   RIGGING CHECK RESULTS (CORRECT OR INCORRECT) AND PERFORMED RE-ADJUSTMENT (MODIFICATION OF PUSHROD LENGTH, SHORTENED OR LENGTHENED) ARE TO BE SENT TO AIRBUS ENGINEERING SERVICES ATTENTION AI/SE-E42, AS SOON AS POSSIBLE, AFTER THE AOT APPLICATION.
   BEST REGARDS
   D. THERIAL
   DIRECTOR OF ENGINEERING SERVICES
   CUSTOMER SERVICE DIRECTORATE.

Appendix C - List of Supporting Reports

The following TSB Engineering Branch Report was completed:

• LP 046/95 - Flight Recorder Analysis.

This report is available upon request from the Transportation Safety Board of Canada.

Appendix D - Glossary

AD

Airworthiness Directive

ADC

air data computer

ALT

altitude hold

AOT

All Operator Telex

AP

autopilot

A/P

autopilot

ATC

air traffic control

ATPL

Airline Transport Pilot Licence

B

blue (hydraulic system)

BEA

Bureau Enquêtes-Accidents

CAA

Civil Aviation Authority

CGCC

centre of gravity control computer

C of G

centre of gravity

CDU

control display unit

CMD (1,2)

Command, an autopilot engaged indication

CVR

cockpit voice recorder

DAR

digital aircraft integrated monitoring system recorder

DIR

direct to

DND

Department of National Defence

EPR

engine pressure ratio

ETOPS

extended twin (engine) operations

FAR

Federal Aviation Regulation

FCC

flight control computer

FCU

flight control unit

FDR

flight data recorder

FL

flight level

fpm

feet per minute

FMS

flight management system

FWC

flight warning computer

G

green (hydraulic system)

g

G load factor

hr

hour(s)

KIAS

knots, indicated airspeed(s)

kg

kilogram(s)

LOLVL

low level

MAC

mean aerodynamic chord

mm

millimetre(s)

MNPS

minimum navigation performance specification

N

nordt

NAT

North Atlantic track

NAV

navigation FMS mode

PIREP

pilot report of weather conditions in flight

psi

pounds per square inch

RAT

ram air turbine

RDA

radar data analysis

ROT

Romania Air Transport - flight plan assignment

SAT

static air temperature

SIGMET

significant meteorological (forecast)

TAT

total air temperature

THS

trimmable horizontal stabilizer

TSB

Transportation Safety Board of Canada

UTC

Coordinated Universal Time

Vc

computed airspeed

Vmax

maximum selectable speed

Vs

stall speed

Vss

stick-shaker speed

W

west

Y

yellow (hydraulic system)

VHF

very high frequency

′

minute(s)

″

second(s)

°

degree(s)