Aviation Investigation Report A02O0406

At approximately 1607 Eastern standard time (EST), Air Canada Flight 457 (ACA457), an Airbus A321-211 aircraft (registration C-GJVX, serial number 1726) was on approach to Toronto/Lester B. Pearson International Airport (LBPIA), Ontario, with 123 passengers and 6 crew on board. At approximately 140 feet above ground level (agl), on final approach to Runway 24R with full flaps selected, the aircraft experienced roll oscillations. The flight crew levelled the wings and the aircraft touched down firmly. During the approach, the aircraft had accumulated mixed ice on areas of the wing and the leading edge of the horizontal stabilizer that are not protected by anti-ice systems.

Approximately three hours later on the same day, Air Canada Flight 1130 (ACA1130), an Airbus A321-211 aircraft (registration C-GIUF, serial number 1638), with 165 passengers and 7 crew on board was on approach to Runway 24R at LBPIA. At 1859 EST and approximately 50 feet agl, the aircraft experienced roll oscillations. The flight crew conducted a go-around, changed flap settings, and returned for an uneventful approach and landing. At the gate, it was noted that the aircraft had accumulated ice on areas of the wing and the leading edge of the horizontal stabilizer that are not protected by anti-ice systems. There was no damage to either aircraft nor injury to the crew or passengers.

Given the similarities between these two occurrences, this report presents the Board's investigations of both occurrences: A02O0405 (C-GJVX) and A02O0406 (C-GIUF).

General

Both aircraft were dispatched in accordance with Air Canada's dispatch system, which included up-to-date meteorological information issued by NAV CANADA and Environment Canada. En route, the pilots received updated weather information through the datalink systems; consequently, the pilots of both aircraft were aware that moderate icing conditions were forecast for the region during the period the aircraft were scheduled to arrive at Toronto/Lester B. Pearson International Airport (LBPIA), Ontario.

As the aircraft were being vectored for landing, ¼ to ½ inch of ice accumulated on the visual ice indicators. Both aircraft used engine and wing anti-ice while flying in the icing conditions. In addition, as both aircraft were landing with full flaps (CONFIG FULL), their approach speeds (V_app) were increased, in accordance with Air Canada's A321 Aircraft Operating Manual, to VLS (lowest selectable airspeed) plus five knots to accommodate an approach conducted with CONFIG FULL in icing conditions. The autopilot systems were selected OFF between 500 and 1000 feet above ground level (agl) in preparation for landing.

The two aircraft performed as expected until the roll oscillations began at approximately 140 feet agl during the approach of ACA457 and at approximately 50 feet agl for ACA1130. At that point the pilot at the control of each aircraft attempted to bring the wings level by initiating side-to-side stick movement up to the stops at a frequency of approximately 0.5 hertz. Although the pilots attempted to dampen these oscillations by applying right and left stick inputs up to the stops, the magnitude of the oscillations actually increased. At this point, the pilot flying the first aircraft (ACA457) decreased power, and the aircraft touched down. In the second aircraft (ACA1130), the pilot flying decided to advance the throttles and conduct a go-around. Both decisions resulted in successful landings. In preparation for their second landing attempt, the pilots of ACA1130 decided to use CONFIG 3 and adjusted the approach speed accordingly. The second approach and landing were uneventful. No other landing anomalies were reported at LBPIA during this time frame.

Weather

It was noted during post-landing observations by Air Canada personnel that the aircraft had accumulated as much as ¾ inch of mixed ice on those areas of the wing and horizontal stabilizer not equipped with wing anti-ice. For both flights these observations did not include information specific to ice accretion on the flap leading edge.

Weather reports for the periods covering both flights forecasted icing in the region of LBPIA at altitudes between 2000 feet and 9000 feet above sea level (asl). Cloud top temperature was estimated to be -10°C. An outside air temperature of -10°C was recorded at 6000 feet asl. Pilot reports (PIREPs) of moderate icing were received, the first approximately three minutes after ACA457 had landed and the second approximately one hour later. Cloud tops were reported at 5000 and 7000 feet asl, respectively. The PIREPs received approximately 30 to 40 minutes after the second occurrence indicated moderate-to-severe icing in cloud. The moderate icing reports were close to Toronto, with the cloud tops at 6000 feet asl.

Drizzle was reported at LBPIA at 2000 feet by an observer at the surface, with the temperature at 0°C, approximately 45 minutes after ACA1130 landed. A surface-based precipitation occurrence sensor system at LBPIA also noted drizzle between 1929 and 2015,^{Footnote 1} approximately 15 minutes after ACA1130 landed. No drizzle was observed during the ACA457 occurrence earlier in the day. Drizzle droplet size ranged from 100 to 500 microns. Federal Aviation Regulation (FAR) 25.1419, Appendix C envelope for certification of flight in icing conditions has maximum mean effective drop diameter between 40 and 50 microns.

The 1600 LBPIA METAR^{Footnote 2} was winds 220° true (T) at 13 knots, visibility 5 statute miles (sm) in haze, ceiling 2200 feet agl overcast and temperature 0°C. The 1900 LBPIA METAR was winds 230° T at 13 knots, visibility 6 sm in haze, ceiling 1800 feet agl overcast and temperature 0°C.

Roll Oscillations

Flight data recorder (FDR) data relative to the occurrences were available for both aircraft. In each occurrence, the roll oscillations began at approximately 140 agl for ACA457 and at approximately 50 feet agl for ACA1130. Aileron inputs were applied to counter the roll oscillations with side-to-side lateral sidestick movement at a frequency of about 0.5 hertz, and aileron and spoiler response appeared consistent with roll commands.

There were no registered faults with the yaw damper or with any other flight control systems. The occurrence aircraft were equipped with the elevator aileron computer (ELAC) L81 software.

Airbus Testing

Image

In December 1998, two similar events occurred involving a foreign carrier's A321 aircraft landing in CONFIG FULL in icing conditions. The roll oscillations were attributed to ice accretion, particularly on the flap leading edges, affecting the slot between the main flaps and wing box. Because the main flaps are similar on the A320 and A321, and no events of this nature were ever reported on the A320, the icing conditions were considered to have caused the events and no changes to the aircraft were deemed necessary. Although main flaps are similar on A320 and A321, the flap design on A321 is different: the A321 has a double-slotted flap system, whereas the A320 has a single-slotted flap system.

Modifications to the A321 ELAC software were made after a landing occurrence in February 2001 in which there was wing-tip damage. This occurrence also involved roll oscillations in a significant crosswind but with no icing. Consequently, revision L82 to the ELAC software was introduced to reduce the roll sensitivity while in CONFIG FULL. L82 modifications concern the normal, lateral flight control laws. Specifically, roll and yaw damper orders were modified to reduce roll rate and bank angle associated with rudder pedal input in CONFIG FULL below 150 knots. In addition, in CONFIG 3 and in CONFIG FULL in response to a roll sidestick input turn coordination, rudder activity, and lateral load factor are optimized and in response to a lateral gust induced roll effect is minimized. The L82 software modification was certified and installed in four Air France A321 aircraft in April 2003 for a six-month in-service evaluation. The in-service evaluation of the Air France aircraft showed a reduction in roll control activity.

Following the Air Canada A321 occurrences of 07 December 2002, Airbus analysed the available FDR data. Engineering simulations were carried out using an A321 aerodynamic model to match theoretical behaviour with the actual behaviour of the aircraft on approach as observed in the ACA1130 FDR data. The simulations, however, did not take into account the actual winds nor the effects of icing on the aerodynamic response, and the model did not accurately simulate ground effect. In addition, poor sampling rates of some of the FDR parameters affected the accuracy of the simulations. Taking into account these limitations, the results suggested that there was an increase in spoiler roll efficiency during the ACA1130 occurrence compared with the theoretical model, possibly due to ice on the flaps, the effects of which were not aerodynamically modelled. The fact that ACA1130 did not encounter the roll oscillations during its second approach could be partially explained by the fact that, in CONFIG FULL, any sidestick roll demand produces immediate spoiler extension, thereby increasing roll response, whereas in CONFIG 3, the spoilers will extend only if the roll order exceeds a threshold. As a result of the Air Canada occurrences, Airbus issued a Flight Operations Telex in December 2002 that recommended that CONFIG 3 be used for landing in conditions of anticipated moderate-to-severe icing. The Flight Operations Telex also recommended that flight in icing conditions be minimized with flaps extended, and, in the case of significant ice accumulation, the approach speed should be no lower than VLS plus 10 knots.

To determine the effects of significant ice accretion when flaps are extended, Airbus conducted flight tests in natural icing conditions using both the A321 and the A320 for comparison purposes. The aircraft were flown into icing conditions with flaps extended in CONFIG 2, as was the case during the initial descent of ACA1130 and ACA457. Test points were conducted to assess both the clean and iced aircraft response using both roll direct and normal, lateral flight control laws.^{Footnote 3} The testing indicated that similar amounts of ice accreted on both the non-de-iced slat and flap leading edges on both aircraft types. It was found that, in the roll direct mode, on both aircraft similar ice accretion on flaps induces a similar spoiler roll efficiency increase in both CONFIG 3 and CONFIG FULL, but with the effects more pronounced in CONFIG FULL. Furthermore, ice trials performed in the normal, lateral, flight control law mode, have shown that in these conditions, roll sensitivity was increased on the A321 but not on the A320.

In January 2003, another roll oscillation event involving another operator occurred in crosswind landing conditions, similar to the February 2001 event. Further analysis by Airbus of the normal, lateral flight control laws indicated that even without ice, the A321 has less stability margin than the A320, in both CONFIG 3 and CONFIG FULL. The icing trials showed that the reduction in stability margin was more significant in the A321 when iced up, compared to the A320 under similar conditions. It was concluded that the roll sensitivity and stability margin are affected by the aerodynamic response, the normal, lateral flight control law, and resultant pilot input.

To recover adequate stability margins on the non-iced A321 comparable with the non-iced A320 and to improve roll response in icing conditions, Airbus designed new A321 normal, lateral flight control laws, which were introduced in 2004. As part of this effort, wind tunnel tests were performed in August 2003 using different ice shapes based on the icing trials. The goal was to develop an aerodynamic model incorporating icing effects on flaps. Following the icing tests, a further review of the crosswind events indicated that roll difficulties could be encountered under significant crosswind or moderate to severe turbulence when landing in CONFIG FULL, depending on factors such as rudder pedal inputs and gusts. The new software standards, ELAC L83 and L91, consist of modifications to the normal, lateral flight control laws, which will incorporate changes based on both the crosswind and icing analyses. Airworthiness Directive F-2004-147, issued by France's Direction Générale de l'Aviation Civile (DGAC) on 18 August 2004 and adopted as is by Transport Canada (TC), mandates the installation of ELAC L83 or L91 software in A321 aircraft before 31 December 2005.

Airbus A321 Certification

The degree of TC's involvement in the Airbus A321 certification was governed by the international bilateral "Agreement Between the Government of Canada and the French Republic on Airworthiness." This agreement requires that the importing authority accept findings of compliance made by the exporting authority as if it had made them itself. However, the bilateral agreement also allows the importing authority to become familiar with the product and the certification process applied by the exporting authority. Using a risk management philosophy, TC determines the extent of any such familiarization on a case-by-case basis. Certification items determined to warrant more detailed familiarization are addressed by a visit to the factory. For the A321, TC did conduct a familiarization site visit to France, but the team did not include a member of the flight test group, who would normally conduct a review of performance and handling in icing.

The Airbus A321-211 was certified by TC as a derivative of the Airbus A320 aircraft certification. The basis of certification for the A320 is defined in TC's Type Certificate Data Sheet A-166, Appendix X1. This document details the exporting authority's certification requirements and additional Canadian requirements. That same document also defines the basis of certification for the A321 and details the requirements related to icing certification as Joint Aviation Requirement (JAR) 25.1419 (Ice Protection) at Change 11 (identical to Federal Aviation Regulation [FAR] 25.1419 at amendment number 25-23).

For the A320, to demonstrate compliance with these regulations, the exporting authority accepted the methods described in Advisory Circular-Joint ACJ 1419 (Ice Protection - Interpretive Material and Acceptable Means of Compliance) in conjunction with Appendix C of FAR/JAR 25. Transport Canada found that this advisory material did not adequately address the evaluation of performance and handling qualities in icing conditions. Therefore, TC imposed the additional Canadian requirement of complying with TC's Airworthiness Manual Advisory 525/2 (Flight in Icing Conditions - Performance) and Airworthiness Manual Advisory 525/5 (Flight in Icing Conditions - Flight Characteristics). Compliance was shown on the A320 using a combination of flight tests in natural icing and in artificial ice shapes. However, the effect of ice accretion on the leading edge of the flaps was not examined during the A320 certification.

At the time of the A321 certification, the exporting authority (DGAC) required that Airbus use the Joint Aviation Authorities' "Acceptable Means of Compliance" document AMC-F14 (Flight in Icing Conditions, derived from JAA NPA 25F-219 at issue 2, dated 22 January 1992) as a means of demonstrating compliance. In part, this document suggested that the certification programme address flight in icing conditions during landing. Compliance was shown on the A321 using a combination of artificial ice shapes on the A321 and data from A320 flight tests in natural icing. Since this document adequately addressed performance and handling qualities, TC accepted it instead of the two Airworthiness Manual Advisories it had required earlier for the A320.

Airplane-pilot Coupling

Airplane-pilot coupling (APC) is commonly referred to as pilot-induced oscillations and describes a situation in which the aircraft's response is approximately 180 degrees out of phase with the pilot's control input. Airplane-pilot coupling occurs when the dynamics of the aircraft, including the flight control system, and the dynamics of the pilot combine to produce an unstable aircraft. Research indicates that APC usually occurs when a pilot is engaged in a highly demanding task combined with an unforeseen external influence that causes a disturbance requiring the pilot to engage in an aggressive recovery. Typically, such disturbances happen when the aircraft is subjected to strong winds in the approach, or when airframe or controls system changes result in non-linearities in the aerodynamics of the aircraft. FAR 25.143(a) and (b)^{Footnote 4} require that an aircraft be safely controllable and manoeuvrable, without exceptional piloting skill and without danger of exceeding the aircraft limiting load factor, under any probable operating conditions.

The Air Canada Flight Crew Training Manual does not contain any information regarding APCs, nor does Air Canada provide training in APC, nor is it required by regulation.

The roll oscillations encountered during the occurrences investigated in this report resulted from a combination of environmental conditions, modified aircraft aerodynamics in the roll axis, and APC. Crosswinds were not considered a factor in these incidents.

The weather reports of drizzle at the time of the ACA1130 occurrence suggest water droplet size in the range of 100 to 500 microns. Based on this, large droplet icing (supercooled large droplet or SLD) was likely encountered by both aircraft on approach to LBPIA, as cloud conditions were similar during each event. If the droplet size was in fact greater than the range of 40 to 50 microns, the conditions encountered would have been outside the FAR 25 Appendix C certification envelope.

Although the actual size of SLD at the time cannot be clearly determined, the fact remains that other aircraft types made successful landings under similar conditions. It is, therefore, unlikely that the moderate-to-severe icing conditions alone induced these roll oscillations in the occurrence aircraft.

Prior to the occurrences of 07 December 2002, data regarding the A321 aircraft performance in icing were based on its certification and in-service history. As a derivative of the A320, the extent of the A321 icing trials was based in part on the A320 certification results. Specifically, although the A321 has a double-slotted flap system rather than the single-slotted flap arrangement in the A320, both aircraft were considered similar, and the effect of ice accretion on the leading edge of the flaps was not examined during A321 certification. Similarly, any A321 in-service icing anomalies were viewed in the context of the in-service performance of the entire A320 fleet, which revealed no systemic problem. Indeed, for all its certification programmes Airbus considers that ice is accreted in clean configuration.

Analysis of the post-occurrence icing trials concluded that ice accretion on the leading edge of the flaps of both the A320 and A321, and on the flap tabs of the A321, contributed to unusual roll behaviour by modifying the aerodynamic characteristics. Flights performed in roll direct laws on both aircraft showed that both A320 and A321 ice accretion with flaps extended induces an increase in roll spoiler efficiency in both CONFIG 3 and CONFIG FULL. This increase was higher in CONFIG FULL than in CONFIG 3.

Further examination of the phenomenon using the normal, lateral flight control laws determined that the increase in roll sensitivity was a significant factor only on the A321 aircraft. Specifically, analysis of the normal, lateral flight control laws for both aircraft concluded that the roll sensitivity stability margin on an A321 in icing conditions in CONFIG FULL was significantly reduced compared to the A320. Changes to the ELAC software would alter the normal, lateral flight control laws to establish an acceptable roll sensitivity stability margin under these conditions.

FAR 25.143(a) and (b)^{Footnote 5} require that an aircraft be safely controllable and manoeuvrable, without exceptional piloting skill and without danger of exceeding the aircraft limiting load factor, under any probable operating conditions. The roll sensitivity is a function of pilot input; the normal, lateral flight control law; and the aircraft aerodynamic response. With ACA457 and ACA1130, the ice accretion on the flaps contributed to unusual roll behaviour by modifying the aerodynamic response in the roll axis. This change in aerodynamic characteristics, when combined with normal, lateral flight control law and pilot input, resulted in an unstable aircraft.

Findings as to causes and contributing factors

1. The A321 normal, lateral flight control laws programmed into the elevator aileron computer provided higher roll efficiency in CONFIG FULL than in CONFIG 3, which resulted in a reduced stability margin in icing conditions.
2. The external influence of the ice on the leading edge of the flaps changed the aircraft aerodynamics, which, when combined with pilot input and the normal, lateral flight control law, resulted in airplane-pilot coupling, which produced an unstable aircraft.

Findings as to risk

1. Flight tests in natural icing conditions were not accomplished in any configuration in the A321 to determine if an acceptable level of safety existed in the handling characteristics.
2. It is likely that the icing conditions encountered by both aircraft were outside the Federal Aviation Regulation 25, Appendix C envelopes used for certification of the A321.
3. After these occurrences, flight tests in natural icing confirmed that with flaps extended, ice accretion on the flap leading edges increased roll sensitivity in the normal, lateral flight control law on the A321.

Other findings

1. The flight crews of both aircraft had received up-to-date weather information prior to the approach and landing.
2. The flight crews of both aircraft followed the applicable Air Canada A321 Aircraft Operating Manual instructions for flight in icing conditions by adding five knots to the VLS.
3. The flight crews were not trained in recovery from airplane-pilot coupling oscillations. Such training was not required by regulation.

Safety action taken

Airbus

As a result of these occurrences, Airbus issued a Flight Operations Telex (FOT) STL 999.138/02 on 20 December 2002 to all A321 operators on the subject of "Lateral Control Event During Landing in Icing Conditions." The FOT provided information on the reason for issue, the technical explanation, further action to be taken, an operational recommendation, and follow-up information. Airbus offered the following operational recommendation:

When moderate-to-severe icing conditions are anticipated, the use of CONFIG 3 for landing is recommended.

Time for flight in icing conditions with the flaps extended should be minimized (refer also to [Flight Crew Operating Manual] FCOM 3.04.30 page 1).

In addition, if during the approach, significant ice accumulation is suspected on the non-de-iced parts of the airframe (using the visual ice indicator), the minimum approach speed must not be lower than VLS plus 10 knots, and the landing distance should be multiplied by 1.15, as already stated in FCOM 3.04.30 page 1.

In June 2003, Airbus issued Operations Engineering Bulletin No. 153/1, which provided A321 operators with an explanation of potential roll control difficulties being experienced in icing conditions. Essentially, ice accretion on the leading edge of the flaps and flap tabs contributed to unusual roll behaviour by modifying the aerodynamic characteristics in the roll axis. The bulletin went on to repeat its recommendation, that when moderate-to-severe icing conditions are anticipated during approach, CONFIG 3 be used for landing. The bulletin also advised that Airbus corrective action consisted of redesign to the elevator aileron computer (ELAC) software (ELAC L83 and L91 standards) to improve the stability margins of the A321 normal, lateral flight control laws.

Subsequently, Airbus issued an aircraft flight manual (AFM) revision (AFM TR 4.03.00/20) requiring that the operational limitations dealing with using CONFIG 3 when landing in icing conditions, previously promulgated through the FOT and Operations Engineering Bulletin No. 153/1, be added to the A321 AFM.

As indicated in its previous communications to operators, between 09 March and 04 June 2004, Airbus issued service bulletins (SB A320-27-1151 and SB A320-27-1152) to provide the required ELAC software updates. Incorporation of these service bulletins will rescind the operational limitations.

Air Canada

On 09 December 2002, the Chief Pilot, A319/A320/A321 at Air Canada issued A321 Aircraft Technical Bulletin No. 124. It stated:

We are investigating two cases of reduced roll response on approach with significant airframe ice accretion. As a precaution and until further notice, CONFIG FULL landings are prohibited under these conditions. Refer to QRH [Quick Reference Handbook] 2.25 for VLS additive with ice accretion.

Crews are reminded of the SOP [standard operating procedure] caution: "Prolonged flight in icing conditions with slats extended should be avoided."

Direction Générale de l'Aviation Civile

On 15 October 2003, Direction Générale de l'Aviation Civile (DGAC) issued Airworthiness Directive 2003-388(B), which mandated the A321 operational limitations introduced by Airbus' Aircraft Flight Manual TR 4.03.00/20. On 18 August 2004, the DGAC issued Airworthiness Directive F-2004-147, which restated the operational limitations imposed by Airworthiness Directive 2003-388(B) and further mandated that, before 31 December 2005, ELAC L83 or L91 software be implemented in accordance with SB A320-27-1151 or SB A320-27-1152, respectively.

Transport Canada and Federal Aviation Administration

By 18 February 2004, both Transport Canada and the Federal Aviation Administration (FAA) had adopted Airworthiness Directive 2003-388(B). Transport Canada has adopted DGAC's Airworthiness Directive No. F-2004-147; however, the FAA advises that an FAA Airworthiness Directive will be issued after the FAA's Notice of Proposed Rulemaking process is complete.

Safety concern

The redesigned ELAC software should prevent any future A321 APC events during similar icing conditions and have a positive effect on future flight control system designs. Despite these technological improvements, the APC phenomenon is not well known within the pilot community. The Board is concerned that the absence of APC recognition within the pilot training syllabus contributes to the lack of awareness of the APC phenomenon.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 14 July 2005.