## AVIATION INVESTIGATION REPORT

**A05F0047**

**LOSS OF RUDDER IN FLIGHT**

**AIR TRANSAT**

**AIRBUS A310-308 C-GPAT**
**MIAMI, FLORIDA, 90 nm S**

**06 MARCH 2005**The Transportation Safety Board of Canada (TSB) investigated this occurrence for the purpose of advancing transportation safety. It is not th e function of the Board to assign fault or determine civil or criminal liability.



# Aviation Investigation Report

Loss of Rudder in Flight

Air Transat

Airbus A310-308 C-GPAT
Miami, Florida, 90 nm S

06 March 2005

Report Number A05F0047

Synopsis

At 0645 Coordinated Universal Time (UTC), Air Transat Flight 961 (TSC961), an Airbus A310-308 aircraft, departed Varadero, Cuba, fo r QuÈbec, Quebec, with 9 crew members and 262 passengers on board. At approximately 0702 UTC, the aircraft was 90 nautical miles south of Miami, Florida, United States, and in level flig ht at flight level (FL) 350, when the flight crew heard a loud bang and felt some vibration. Th e aircraft entered a Dutch roll and the captain disconnected the autopilot to manually fly the aircraft. The aircraft climbed nearly 1000 feet while the captain tried to control the Dutch roll. The crew initiated a descent back to FL 350 and requested further descent and a possible diversio n to Fort Lauderdale, Florida. During the descent, the Dutch roll intensity lessened and then stopped when the aircraft descended through FL 280. No emergency was declared. When the aircraft was abeam Miami, the crew

decided to return to Varadero.

During the landing flare, the rudder control inputs were not effective in correcting for a slight crab. The aircraft landed and taxied to the ga te. After shutdown, it was discovered that the aircraft rudder was missing. Small pieces of the rudder were still attached to the vertical stabilizer. One flight attendant suffered a minor back injury during the event.

Ce rapport est Ègalement disponible en franÁais.© Minister of Public Works and Government Services Canada 2007 Cat. No. TU3-5/05-2E

ISBN 978-0-662-46783-0T ABLE OF C ONTENTS

T RANSPORTATION S AFETY B OARD iii 

## 1.0 Factual Info rmation ........................................................................ 1

1.1 History of the Flight ............................................................................................. 1

1.2 Injuries to Persons ................................................................................................ 2

1.3 Damage to the Aircraft ........................................................................................ 2

1.4 Personnel Information ......................................................................................... 3

1.4.1 Captain Information............................................................................................. 3

1.4.2 First Officer Information...................................................................................... 4

1.4.3 Flight Attendants.................................................................................................. 4

1.5 Aircraft Information............................................................................................. 5

1.5.1 General Information............................................................................................. 5

1.5.2 Aircraft History..................................................................................................... 5

1.5.3 Vertical Tail Plane Design ................................................................................... 5

1.5.4 Rudder Information ............................................................................................. 6

1.5.4.1 General................................................................................................................... 6

1.5.4.2 Rudder Design ...................................................................................................... 7

1.5.5 Rudder Manufactur ing Method......................................................................... 9

1.5.6 Rudder Manufactur ing Records......................................................................... 9

1.5.7 Rudder Modification Status.............................................................................. 10

1.5.8 Rudder Control System ..................................................................................... 10

1.5.8.1 Rudder Control System Components.............................................................. 10

1.5.8.2 Rudder Control System Operation .................................................................. 11

1.5.8.3 Dutch Roll Description ...................................................................................... 12

1.5.8.4 Dutch Roll Recove ry Training .......................................................................... 13

1.5.8.5 On-Board Documentation ................................................................................. 13

1.5.9 Certification Information................................................................................... 13

1.5.9.1 Type Certificate................................................................................................... 13

1.5.9.2 Rudder Certification Tests ................................................................................ 13

1.5.10 Inspection Schedule ........................................................................................... 14

1.5.10.1 Scheduled Inspection Cycle .............................................................................. 14

1.5.10.2 Scheduled Rudder Inspections......................................................................... 15

1.5.10.3 Recently Completed Inspections...................................................................... 15

1.5.10.4 Rudder Damage Structural Repair Manual Limits........................................ 15

1.5.11 Maintenance Actions.......................................................................................... 16

1.5.11.1 General................................................................................................................. 16

1.5.11.2 Rudder Synchronization Check........................................................................ 16

1.5.11.3 Lightning Protection Plate Replacement......................................................... 16

1.5.11.4 Lightning Strike Repair ..................................................................................... 16

1.5.11.5 Miscellaneous Rudder Servo- Controls Maintenance .................................... 17

1.5.11.6 Maintenance Facilities........................................................................................ 17

1.6 Meteorological Information .............................................................................. 17

1.7 Aids to Navigation ............................................................................................. 17T ABLE OF C ONTENTS

iv T RANSPORTATION S AFETY B OARD 1.8 Communications................................................................................................. 17

1.8.1 Air Traffic Control.............................................................................................. 17

1.8.2 Crew/Company Communications .................................................................. 17

1.8.3 Communication Between the Flight De ck and the Flight Attendants........ 18

1.9 Aerodrome Information .................................................................................... 19

1.10 Flight Recorders.................................................................................................. 19

1.10.1 Digital Flight Data Recorder ............................................................................. 19

1.10.2 Cockpit Voice Recorder ..................................................................................... 20

1.10.3 Direct Access Recorder ...................................................................................... 20

1.10.4 Data Sampling Rates .......................................................................................... 21

1.10.5 Filtering of Recorded Data ................................................................................ 21

1.10.6 Summary of Flight Recorder Data ................................................................... 21

1.11 Wreckage and Impact Information .................................................................. 22

1.11.1 Miscellaneous Damage ...................................................................................... 22

1.11.2 Vertical Tail Plane Damage............................................................................... 23

1.11.2.1 General................................................................................................................. 23

1.11.2.2 Main Attachment Fittings ................................................................................. 23

1.11.2.3 Hinge Arms ......................................................................................................... 24

1.11.3 Rudder Damage.................................................................................................. 26

1.11.3.1 General................................................................................................................. 26

1.11.3.2 Detailed Description of Rudder Damage........................................................ 26

1.11.4 Chemical Attack and Contamination .............................................................. 29

1.11.5 System Inspection and Testing......................................................................... 30

1.11.6 High-Intensity Radiated Fields Investigation ................................................ 31

1.11.7 Examination of Pre-Occurrence Photos........................................................... 31

1.12 Tests and Research ............................................................................................. 32

1.12.1 General................................................................................................................. 32

1.12.2 Examination of Two Sister Rudders ................................................................ 32

1.12.3 Elasticity Laminate Checker Test ..................................................................... 32

1.12.3.1 Elasticity Laminate Checke r Test Description................................................ 32

1.12.3.2 ELCH 1óComplete Grid Examination of 24 Rudders of Similar Design.. 32

1.12.3.3 ELCH 2óFocused Examination of Rudders .................................................. 33

1.12.4 Examination of Other Rudders......................................................................... 33

1.12.5 Fluid Contamination Program ......................................................................... 34

1.12.6 Impact Damage Tests......................................................................................... 35

1.12.7 Laboratory Tests of Rudder Residuals ............................................................ 35

1.12.7.1 General................................................................................................................. 35

1.12.7.2 Bond Between Honeycomb and Face Sheets.................................................. 35

1.12.7.3 Bond at z-Section ................................................................................................ 36

1.12.7.4 Inter-laminar Bond Between Face Sheet Layers............................................. 36

1.12.7.5 Splice Bond .......................................................................................................... 36

1.12.7.6 Type of Resins..................................................................................................... 36T ABLE OF C ONTENTS

T RANSPORTATION S AFETY B OARD v 1.12.7.7 Cure of Resins ..................................................................................................... 37

1.12.7.8 Lightning Protection Plate Replacement......................................................... 37

1.12.7.9 z-Strut Paint Chips ............................................................................................. 37

1.12.7.10 Explosion Damage.............................................................................................. 37

1.12.8 Double Cantilever Beam Tests.......................................................................... 37

1.12.9 Disbond Growth ................................................................................................. 37

1.12.9.1 History of Earlier Design Aramid FibreñReinforced Plastic Rudders ........ 37

1.12.9.2 Temperature Effects ........................................................................................... 38

1.12.9.3 Vacuum Cycling Tests ....................................................................................... 38

1.12.10 Computer Simulation of Disbond Growth ..................................................... 39

1.12.11 Effects of Temperature and Moisture.............................................................. 40

1.12.12 Age-Related Structures and Materials Degradation ..................................... 40

1.12.13 Flight Dynamics Analysis ................................................................................. 41

1.12.13.1 Background ......................................................................................................... 41

1.12.13.2 Initial Simulations .............................................................................................. 41

1.12.13.3 Simulations to Determine the Lateral Force at Tail During the Event........ 42

1.12.13.4 Simulations to Determine the Long itudinal/Vertical Force at Tail During the Event ................................................................................................ 42

1.12.13.5 Additional Simulations...................................................................................... 42

1.12.13.6 Yaw Damper Modelling .................................................................................... 43

1.12.14 Effect of Disbond Bubble on Static Aerodynamic Loads.............................. 43

1.12.15 Flutter Analysis................................................................................................... 44

1.12.15.1 Analysis of a Dynamic Event............................................................................ 44

1.12.15.2 Method of Analysis ............................................................................................ 44

1.12.15.3 Baseline Analysis................................................................................................ 44

1.12.15.4 Failure Scenarios................................................................................................. 45

1.12.15.5 Summary of Flutter Analyses ........................................................................... 47

1.12.16 Time-Domain Flutter Analysis ......................................................................... 48

1.12.16.1 General................................................................................................................. 48

1.12.16.2 Method of Analysis ............................................................................................ 48

1.12.16.3 Results .................................................................................................................. 48

1.12.17 Summary of Flutter and Time -Domain Flutter Analyses............................. 49

1.12.18 National Transportation Safety Board Radar Data Analysis Study............ 49

1.12.19 Other Aircraft in Vicinity .................................................................................. 49

1.12.20 Space Objects....................................................................................................... 49

1.13 Organizational and Management Information .............................................. 50

1.13.1 Company Operations......................................................................................... 50

1.13.2 Maintenance Organization................................................................................ 50

1.14 Additional Information ..................................................................................... 51

1.14.1 All Operators TelexóFleet Inspection of Rudder ......................................... 51

1.14.1.1 AOT-1óFleet Inspection of Rudder Exteriors ............................................... 51

1.14.1.2 AOT-2óFleet Inspection of Rudder Interiors ................................................ 52T ABLE OF C ONTENTS

vi T RANSPORTATION S AFETY B OARD 

## 2.0 Analysis .......................................................................................... 53

2.1 General Information........................................................................................... 53

2.2 Flight Control System ........................................................................................ 53

2.2.1 General................................................................................................................. 53

2.2.2 Ability to Diagnose the Source of Flight Control Difficulty......................... 53

2.2.3 Dutch Roll Re covery .......................................................................................... 53

2.2.4 Decision to Return to Varadero........................................................................ 53

2.2.5 Decision not to Declare an Emergency............................................................ 54

2.2.6 Crew Communication and Decision Making................................................. 54

2.3 Maintenance ........................................................................................................ 55

2.3.1 Maintenance Program........................................................................................ 55

2.3.2 Maintenance Records......................................................................................... 55

2.3.3 Hinge Bearing Condition .................................................................................. 55

2.3.4 Adequacy of Rudder Inspection Program ...................................................... 55

2.4 Recorders ............................................................................................................. 56

2.4.1 Cockpit Voice Reco rder Duration .................................................................... 56

2.4.2 Digital Flight Data Recorder Data Sampling.................................................. 56

2.4.3 Digital Flight Data Recorder Filtered Data ..................................................... 56

2.4.4 Preservation of Recorder Information............................................................. 57

2.5 Analysis of Rudder Failure Mechanism.......................................................... 57

2.5.1 General................................................................................................................. 57

2.5.2 Static Loading Phenomenon ............................................................................. 57

2.5.2.1 Large Rudder Deflection ................................................................................... 57

2.5.2.2 High Static Load ................................................................................................. 57

2.5.3 Dynamic Loading Phenomenon....................................................................... 57

2.5.3.1 High-Frequency Control Input......................................................................... 57

2.5.3.2 Flutter................................................................................................................... 58

2.5.4 Possible Causes of Flutter.................................................................................. 58

2.5.4.1 Flutter without Prior St ructural Deviation ..................................................... 58

2.5.4.2 Flutter Following Structural Deviation ........................................................... 58

2.5.5 Growth of Rudder Damage............................................................................... 58

2.5.6 Possible Causes of Rudder Damage ................................................................ 58

2.5.6.1 Manufacturing Process ...................................................................................... 58

2.5.6.2 Material Degradation......................................................................................... 59

2.5.6.3 Mechanical Damage........................................................................................... 59

2.5.7 Failure Scenarios................................................................................................. 60

2.5.7.1 Summary of Important Points .......................................................................... 60

2.5.7.2 Most Likely Failure Scenario ............................................................................ 61T ABLE OF C ONTENTS

T RANSPORTATION S AFETY B OARD vii 

## 3.0 Conclusio ns.................................................................................... 63

3.1 Findings as to Causes and Contributing Factors ........................................... 63

3.2 Findings as to Risk ............................................................................................. 63

3.3 Other Findings .................................................................................................... 64



## 4.0 Safety Ac tion.................................................................................. 65

4.1 Action Taken ....................................................................................................... 65

4.1.1 Transportation Safety Board of Canada.......................................................... 65

4.1.1.1 TSB RecommendationsóAirbus Composite Rudder Inspection Program ............................................................................................................... 65

4.1.1.2 TSB Safety AdvisoryóCockpit Voice Recorder Duration............................ 66

4.1.1.3 TSB Safety AdvisoryóDigital Flight Data Recorder Recording of

Filtered Data........................................................................................................ 67

4.1.1.4 TSB Safety AdvisoryóDigital Flight Data Recorder Low Recording

Rates ..................................................................................................................... 67

4.1.1.5 TSB Safety AdvisoryóDutch Roll Recovery Procedure............................... 67

4.1.2 National Transportation Safety Board............................................................. 68

4.1.3 Bureau díEnquÍtes et díAnalyses pour la SÈcuritÈ de líAviation Civile .... 68

4.1.4 Airbus................................................................................................................... 68

4.1.4.1 All Operators Telex (AOT-1)............................................................................. 68

4.1.4.2 All Operators Telex (AOT-2)............................................................................. 69

4.1.5 Air Transat........................................................................................................... 69

4.1.5.1 Abnormal Situation............................................................................................ 69

4.1.5.2 Preservation of Recorder Information............................................................. 69



## Appendices

Appendix A ñ Direct Access Recorder/Digital Flight Data Recorder Data Comparison .................................................................................................71
Appendix B ñ Glossary.........................................................................................................7 3



## Photos

Photo 1. Right-Side View of Vertic al Tail Plane and Rudder Residuals ......................... 3

Photo 2. Removal of the VTP and a View of the Position of the Main Attachment Fittings..................................................................................................................... 23

Photo 3. LeftñSide View of VTP and Rudder Residuals................................................... 26
Photo 4. Pre-Occurrence Photograph of Aircraft............................................................... 31
Photo 5. MSN 361 Honeycomb Showing Stain Caused by Hydraulic Fluid Ingress .. 33

Photo 6. Fluid Accumulation in the Nose of the Rudder of Aircraft MSN 701............. 34
Photo 7. Damage Growth After one Vacuum Cycle (Rudder of Aircraft MSN 361).... 39T ABLE OF C ONTENTS

viii T RANSPORTATION S AFETY B OARD 

## Figures

Figure 1. Schematic of the Vertical Tail Plane...................................................................... 5
Figure 2. Schematic of Hinge Arm Details ........................................................................... 6
Figure 3. Schematic of the Rudder......................................................................................... 7
Figure 4. Rudder Side Panel Construction ........................................................................... 8
Figure 5. Schematic of Ru dder Hinge Fitting Details ......................................................... 9
Figure 6. Low Bonding Pressure Next to the z-Section .................................................... 36
Figure 7. Disbond Scenarios St udied in Flutter Analysis................................................. 45
Figure 8. Typical Load Response fr om Time-Domain Flutter Analysis......................... 48
Figure 9. Schematic of AOT-1 Areas of Inspection............................................................ 51
Figure 10. Schematic of AO T-2 Areas of Inspection.......................................................... 52F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 1 

# 1.0 Factual Information

1.1 History of the Flight

The pre-flight inspection was carried out by th e captain before departure from Varadero; no damage was observed on the rudder. The inspecti on was conducted at night, the logo light was on, and the pilot was using a flashlight. However, it was difficult to see the entire rudder, especially the bottom part, which is partially conc ealed by the elevators. To see the bottom part, the pilot has to step back from the aircraft, thus reducing the acuity of the observation.

The crew engaged autopilot system No. 2 on de parture from Varadero. The flight progressed normally until the aircraft reached flight level (FL) 1 350, its assigned altitude. At approximately 0702 Coordinated Universal Time (UTC), 2 the flight crew heard a loud bang immediately followed by several seconds of vibration. Cabin cr ew members located in the back of the aircraft were thrown to the floor and unsecured galley ca rts moved freely. The aircraft started to Dutch
roll, 3 and the captain took control and disconnected the autopilot. The aircraft was difficult to control in the lateral axis. In an attempt to better manage the cockpit workload, the other autopilot system (No. 1) was engaged. As the Dutch roll movement started to intensify, autopilot No. 1 was disengaged and the aircraft was hand-flown.

During these actions, the aircraft climbed to about FL 359. The flight crew requested a descent and informed air traffic control (ATC) that th ey had experienced an autopilot problem and had reverted to flying manually. While descendi ng, the crew cycled through the electronic centralized aircraft monitor (ECAM) system pa ges in an attempt to diagnose the problem. Throughout the event, there was no ECAM message relating to the control problem that the aircraft had experienced, and there were no warn ing lights or cockpit indications of an aircraft

malfunction. Even with limited clues as to th e cause of the Dutch roll, the crew knew that descending to a lower altitude might lessen or st op the Dutch roll motion. Initial indications led to the possibility of the loss of both yaw damper s (YD) but both YD switches were engaged. Had a dual YD failure occurred, the flight wa rning computer would have triggered appropriate warnings and messages, and the autopilot would have disconnected.

1 See Glossary at Appendix B for all abbreviations and acronyms.

2 All times are Coordinated Universal Time (UTC) unless otherwise noted.

3 Dutch roll is a motion of an aircraft that consists of simultaneous oscillations of the bank (or roll) angle, the sideslip angle, and the heading angle. The roll manifests itself as an out-of-phase combination of ìtail waggingî an d rocking from side to side. The motion is normally well damped in most light aircraft, though some aircraft with well-damped Dutch roll modes can experience a degradation of damping as airspeed and altitude increase. Dutch roll stability can be artificially increased by the installation of a yaw damper, as is the case with most swept-wi ng aircraft (see also Section 1.5.8.3).F ACTUAL I NFORMATION

2 T RANSPORTATION S AFETY B OARD The Dutch roll gradually decreased in the descent and ceased when the aircraft passed FL 280.

The crew continued the descent to 10 000 feet ab ove sea level (asl) in preparation for a landing in Fort Lauderdale. The captain returned control of the aircraft to the first officer and called the flight director (FD) to provide the standard briefing to the cabin crew for emergency or

abnormal situations.

The crew contacted company dispatch to disc uss the situation and elected to return to Varadero, where the company was better equipped to deal with the aircraft and the passengers. At 0739, the flight was cleared to Varadero at FL 190.

During the climb to FL 190, the crew engaged auto pilot No. 1 and disengaged it during the final portion of the visual approach to Runway 06 at Varadero. During the landing flare, nose wheel steering was used for directional control on th e runway. An uneventful landing was completed

at 0819.

The crew conducted a flight control check after landing and the ECAM indicated that everything was normal. The aircraft was taxied to the gate where the passengers were deplaned normally through the main door. After shutdown, a visual inspection revealed that the aircraft rudder had broken and most of it was missing.



## 1.2 Injuries to Persons

Crew Passengers Others Total

Fatal ñ ñ ñ ñ

Serious ñ ñ ñ ñ

Minor/None 9 262 ñ 271

Total 9 262 ñ 271



## 1.3 Damage to the Aircraft

The rudder was substantially damaged (see Photo 1), and the rear attachment fittings of the vertical tail plane (VTP) were delaminated loca lly. There was minor damage to the tail cone.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 3 Photo 1. Right-side view of vertical tail plane

and rudder residuals



## 1.4 Personnel Information

Captain First Officer

Licence Airline Transport Commercial

Medical Expiry Date 01 September 2005 01 July 2005

Total Flying Hours 10 795 11 305

Hours on Type 450 500

Hours Last 90 days 75 200

Hours on Type Last 90 Days 75 200

Hours on Duty Prior to Landing 4.6 4.6

Hours off Duty Prior to Work Period 60 60



### 1.4.1 Captain Information

The captain held a Canadian airline transport p ilot licence (ATPL) ñ aeroplane, endorsed for single- and multi-engine land aeroplanes, with type ratings on Boeing 727, Boeing 737, Boeing 757, Convair 580, Airbus A310, Fokker 100, and Lockheed 1011 aircraft. His licence was endorsed with a Group 1 instrument rating valid until 01 September 2005.F ACTUAL I NFORMATION

4 T RANSPORTATION S AFETY B OARD The captain started working for the company as a captain on the Boeing 757 on 18 March 1996. In 1997, he qualified as captain on the Boeing 737-400 and flew it for about six months before returning as captain on the Boeing 757. In 2003, he began his conversion to the A310, and under the supervision of an Air Transat instructor , completed the A310 computer-based ground school. The flight simulator portion of the init ial A310 training was conducted by Air Transat instructors at a training centre in Miami, Florid a, from 12 to 27 August 2003. All training was in accordance with the company A310 training program.

The captain passed his initial pilot proficiency check (PPC) as an A310 captain on 27 August 2003, and his last line check was performed on 17 September 2004. His last PPC was performed on 14 December 2004. Company training records in dicate that he had successfully completed all required recurrent training.



### 1.4.2 First Officer Information

The first officer held a commercial pilot lic ence ñ aeroplane, endorsed for single- and multi-engine land aeroplanes, with type ratings on Convair 580, Airbus A310, and

Lockheed 1011 aircraft. His licence was endorsed with a Group 1 instrument rating valid until

01 December 2005.

The first officer started working for the company on 15 February 1988 as a flight engineer on the Lockheed 1011 aircraft, accumulating 8500 hours of flight time. He was qualified as first officer on the Lockheed 1011 on 18 June 2002. In 2004, he began conversion to the A310. Under the supervision of an Air Transat instructor, he co mpleted the A310 computer-based training. The flight simulator portion of the initial A310 traini ng was conducted by Air Transat instructors at a training centre in MontrÈal, Quebec, from 25 May to 15 June 2004. All training was in accordance with the company A310 training program.

The first officer passed his initial PPC as an A310 first officer on 15 June 2004, and his last line check was performed on 07 July 2004. His last PPC was performed on 08 October 2004. Company training records indicate that he had successfully completed all required recurrent training.



### 1.4.3 Flight Attendants

The cabin crew comprised seven flight attendants (FAs), including a flight director (FD) and an assistant flight director (AFD), all of whom had 10 to 16 years of service. They were qualified and trained in accordance with the requirem ents of Transport Canada and Air Transat.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 5 

## 1.5 Aircraft Information

1.5.1 General Information

The occurrence aircraft was an Airbus A310- 308, manufacturerís seri al number (MSN) 597. Transport Canada issued the certificate of registration on 16 May 2001 and the certificate of airworthiness on 16 June 2001, both valid at the time of the occurrence.



### 1.5.2 Aircraft History

The occurrence aircraft had its first flight in September 1991 and was delivered to a Middle Eastern airline in August 1992, where it remained until acquired by Air Transat in May 2001. At
the time of the occurrence, the aircraft had accumulated 49 224 flight hours and 13 444 flight cycles. By comparison, the flight hour and flight cy cle fleet leader aircraft for this aircraft type had accumulated 75 675 hours and 34 384 cycles respectively.



### 1.5.3 Vertical Tail Plane Design

The VTP consists of a spar box, leading edge fairing, trailing edge panels, and tip (see Figure 1). The spar box consists of left and right side panels each composed of solid carbon fibreñreinforced plastic (CFRP) laminate skin and interior

stiffeners. At the bottom of each side panel, there are three large integrally constructed CFRP lugs,

known as the main attachment fittings, which attach to the fuselage. At the front and rear of
the box, there are solid CFRP laminate spars running the length of the VTP, joining the left and right skin panels, forming the front and rear faces of the spar box.

In the centre of the box, there is a shorter solid CFRP laminate spar, which extends only up to rib 5. At

the bottom of each of these three spars are two integrally constructed lugs, known as transverse load fittings, which attach to the fuselage. Within the box, there are a total of 18 solid CFRP laminate ribs, including closing ribs at the bottom and to p. The leading edge and the tip are constructed of sandwich composite. Attached to each side of the rear spar, and extending aft, there is a flat trailing edge panel that acts as an aerodynamic fa iring to fill the gap between the rear spar of the VTP and the leading edge of the rudder. Figure 1. Schematic of the vertical tail planeF ACTUAL I NFORMATION

6 T RANSPORTATION S AFETY B OARD There are seven hinge positions along the VTP rear spar for the attachment of the rudder. These are numbered 1 through 7, from bottom to top. Fi gure 2 shows the design details at these hinge points. At each hinge position, there is a CFRP fitting attached to the rear spar. Each CFRP fitting has two lugs, one on the left and one on the right. The two front arms of each V-shaped metal hinge arm fit into these lugs on the rear of the VTP spar.

Figure 2. Schematic of hinge arm details

The hinge arms are attached to the CFRP fittings with spherical bearings, so they are free to pivot up and down. The rear of each hinge arm contains a hinge point for the attachment of the rudder. The hinge arm at hinge position 4 is su pported in the vertical direction by a metal

structural tube referred to as the z-strut. All th e vertical loads from the rudder are transferred to the VTP through the z-strut. Rudder movement is controlled by three hydraulic actuators located inside the VTP at hinge positions 2, 3, and 4. The forward ends of the actuators are attached to CFRP fittings on the rear spar of th e VTP, and the aft ends are attached to aluminum alloy fittings on the front spar of the rudder.



### 1.5.4 Rudder Information

1.5.4.1 General

The occurrence rudder, serial nu mber 1331, was of the part numb er series A55471500, which is in use on earlier production A310, A300-600, A3 30, and A340 aircraft. It was the same rudder that had been originally installe d on the occurrence aircraft at the time of manufacture in 1991.

This rudder was one of the first in a batch of fi ve rudders whose side panels were manufactured by the company Soko in Mostar, former Yugoslavia . The side panels were shipped from Soko to Airbus in Stade, Germany, where they were assembled into rudders.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 7 

### 1.5.4.2 Rudder Design

The rudder consists of a single spar at the front, two side panels that fasten together at the trailing edge, and top and bottom closing ribs (see Fi gure 3). The side panels are of single-piece construction and do not include any design features to mechanically arrest the growth of disbond damage. Each side panel is a sandwi ch composite constructed of a non-metallic NomexÆ aramid-based honeycomb core, with CFRP face sheets, and a glass fibreñreinforced plastic (GFRP) intermediate layer between the CF RP and the honeycomb as shown in Figure 4. The GFRP intermediate layer does not have a struct ural purpose. It is simply a carrier for the resin that bonds the CFRP to the honeycomb. There is a layer of TedlarÆ on the interior face to provide a moisture barrier, and a layer of film ad hesive (AF 126) on the exterior face to provide aerodynamic smoothness. The density and thickness of the honeycomb and the number of face sheets vary with location because they are designed to react to applicable loads.

Figure 3. Schematic of the rudder

Different pieces of honeycomb are bonded togeth er along their side edges by a splice bonding adhesive. This same adhesive is also used to bond the side edges of the honeycomb to the z-section. The forward and bottom edges of the side panels are made with a pre-cured CFRP z-section. The side panels are fastened to the spar and ribs using blind mechanical fasteners.

There are three aluminum lightning protection plates (LPPs) ru nning chordwise on each side panel. To avoid galvanic reaction between th ese metal plates and the CFRP, there is an intermediate insulating layer of GFRP. There is a single spar, located along the front edge of theF ACTUAL I NFORMATION

8 T RANSPORTATION S AFETY B OARD rudder and running the entire length of the rudder. The spar is a sandwich composite constructed of a NomexÆ honeycomb core with CFRP face sheets. There are seven lightening holes distributed along the length of the spar.

There are only two ribs within the rudder. Rib 0 is the closing rib at the bottom of the rudder and is a sandwich composite constructed of a NomexÆ honeycomb core
with CFRP face sheets. Rib 54a, constructed of aluminum, is the closing rib at the top of the rudder. The leading edge fairing of the rudder is divided into multiple sections along its length, each constructed of sandwich composite (see Figure 4). The leading edge fairing sections are fastened to the side panel z-sections with threaded fasteners. There is an aluminum alloy strip along this row of fasteners as part of the lightning-protection system. Attached to the z-section at the bottom of each side panel is a rubber weatherstrip that covers the gap between the bottom of the rudder and the top of the tail cone. The weatherstrip is attached with threaded fasteners, and a metal strip is used as a washer pl ate along this row of fasteners. The side panels attach together at the rear of the rudder by a ro w of mechanical fasteners running parallel to the trailing edge, roughly 30 cm ahead of the trailing edge. A metal protective strip runs down the entire length of the rudder trailing edge, which is also attached using mechanical fasteners. There are three hoisting poin ts on each side panel.

There are seven hinge positions, numbered 1 through 7, from botto m to top. Figure 5 shows the design details at these hinge points. At each hi nge position, aluminum alloy fittings are attached to solid GFRP blocks integrated locally into th e side panels and to the spar web by mechanical fasteners. The core of the spar web, where the fa steners pass through, is filled by core filler and reinforced by an aluminum backing plate. The th ree control actuators attach to the rudder at hinge positions 2, 3, and 4. The metal hinge fitti ngs at these locations have two lugs, one to act as the hinge point, and one to attach to a hydraulic actuator. Figure 4. Rudder side panel constructionF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 9 Figure 5. Schematic of rudder hinge fitting details



### 1.5.5 Rudder Manufacturing Method

The rudder side panels, rudder spar, and rib 0 ar e manufactured and cured separately and then

assembled with mechanical fasteners into a rudde r. Each side panel is assembled in a mold, with the exterior face on the bottom agains t the face of the mold. During curing, the manufacturing process results in the lower (outer ) skin having a stronger bond. Although both bonds exceed design requirements, the inner skin bond does so by a smaller margin. The three LPPs are integrally manufactured an d co-cured with the side panel.



### 1.5.6 Rudder Manufacturing Records

Some manufacturing records for the side panels of the occurrence rudder were lost when the factory was bombed during the Yu goslavian war. Manufacturing re cords available at Airbus in Stade, Germany, and Toulouse, France, were revi ewed for the occurrence rudder. This review found that non-conformities were detected by the quality assurance system, corrective actions were defined, rework was conducted, and the final product was inspected and released as airworthy. These non-conformities included such items as the position of hoisting points, the resistance of the anti-static pain t, and various splice bond, skin and core filler re-works. The quality assurance of the Soko components was always under the responsibility of Airbus. The manufacturing records indicated that the rudde r was in an airworthy condition at final assembly.F ACTUAL I NFORMATION

10 T RANSPORTATION S AFETY B OARD 

### 1.5.7 Rudder Modification Status

The following is the modification status of the occurrence rudder:

• Modification 5844 (Glass Intermediate Layer). The occurrence rudder was a post-modification 5844 (Service Bulle tin [SB] A310-55-2012) design, which incorporated a GFRP layer between the honeycomb and the CFRP skin, rather than aramid fibreñreinforced plastic (A FRP) as used in earlier design.

• Modification 8408 (Change in Honeycomb Size). The occurrence rudder was a post-modification 8408 configuration, which incorporated increased density honeycomb at certain locations.

• Modification 8827 (Change in Spar Cons truction). The occurrence rudder was pre-modification 8827, meaning its sp ar had the earlier design NomexÆ honeycomb/CFRP sandwich spar, rather th an the solid CFRP spar of later design.

• Modification 5185 (Single-Piece Side P anels). The occurrence rudder was postserial 1035, which means that the side panels were each constructed as a single panel. Earlier side panels were constructed of tw o parts, top and bottom, with a chordwise joint.

• Modification SRM (structural repair manu al) 55-41-12 (Reinforcing Bolts in GFRP Blocks). The occurrence rudder had re ceived modification SRM 55-41-12, Paragraph 27, during manufacture. This modification added reinforcing bolts through the GFRP blocks at the hinge point level.



### 1.5.8 Rudder Control System

1.5.8.1 Rudder Control System Components

The following is a descriptive list of the Airbus A310 rudder control system components:

• The rudder pedals, the rudder trim actuator, the two YD actuators, and the autopilot yaw actuator (APYA), which command the rudder to move.

• The push rods, the bell cranks, and the tens ion regulator and cables, also referred to as linkage, which transmit rudder commands.

• The three servo-controlsóupper, middle, and lowerówhich operate the rudder. (The

maximum rudder actuation rate with no lo ad is 60 ± 5° per second. The maximum rudder deflection is 30° either left or right.)

• The differential unit, a mechanical device , which sends a command to the rudder servo-controls. This unit sums the pilot or the autopilot input and the YD input.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 11 • The two rudder travel limiter (RTL) systems, which provide a variable stop, limiting the travel of the rudder mechanical linkage downstream of the differential unit, and thus the input to the three servo-co ntrols as the airspeed increases.

• The transmitter, located on the fin at rib 1 and connected to the rudder with a rod attached to fitting No. 1, which indica tes the rudder surface position to the appropriate ECAM display unit.



### 1.5.8.2 Rudder Control System Operation

The YD actuators are electro-h ydraulic mechanisms that operate the YD system. The YD system has three functions: Dutch roll damper; turn coordinator; and yaw compensator during an engine failure on take-off or go-around. The YD commands are limited by software in the flight augmentation computers to a maximum of 39° of rudder movement per second. The maximum allowable displacement of the rudder by the YD is ±10° at indicated airspeeds up to 165 knots. The maximum allowable displacement at indi cated airspeeds greater than 165 knots is determined by a formula (10 x (165/k nots indicated airspeed [KIAS])2).

As the aircraft was flying at an indicated airspe ed of 270 knots at the time of the occurrence, the maximum displacement of the rudder by the YD was of ±3.7 ° . The YD and the rudder pedals are not linked, so YD inputs do not result in pedal motion. Rudder pedal and YD commands are restricted to the limits imposed by the RTL syst em. Rudder position is determined by the sum of the pilot or autopilot input and the YD co mmands limited by the travel limitation unit.

The APYA, which produces yaw autopilot comm ands, is a single unit that houses two electro-hydraulic actuators, each controlled by a flight control computer (FCC). The APYA has an output lever that is connected through a torq ue limiter to the main bell crank. The torque limiter allows a pilot to override autopilot output by applying about 65 decanewtons (daN) more than the rudder pedal feel forces. Autopilot yaw control commands are limited by

software in the FCC to a maximum of 34 ° of rudder per second. The APYA and the rudder pedals are rigidly linked; therefore, auto pilot yaw input results in pedal motion.

The RTL system reduces the maximum allowable ru dder deflection as airspeed increases. The

limitation is such that the maximum deflection that can be achieved by the rudder remains

lower than the deflection that would induce limi t loads on the structure throughout the flight envelope.F ACTUAL I NFORMATION

12 T RANSPORTATION S AFETY B OARD 

### 1.5.8.3 Dutch Roll Description

The Airplane Upset Recovery Training Aid 4 describes the Dutch roll as follows:

Static directional stability is a measur e of the tendency of an airplane to

weathervane into the free stream air ma ss. The vertical fin and distribution of flat plate area aft of the CG [centre of gravity] tend to reduce sideslip and add to good directional stability. All conventional airplanes require positive static directional stability. In simple terms, an airplane with good directional stability always wants to po int directly into the relative windó zero sideslip. As directional stability increases, the speed at which the aircraft returns to zero sideslip af ter being disturbed increases (higher frequency). In order to minimize oversh oots in sideslip, the damping in the

directional axis must be increased as the directional stability is increased.

An undesirable characteristic can deve lop when the directional damping is not adequate enough to prevent over shoots in sideslip. A phenomenon known as ìDutch rollî (based on the similarity with the motions of highspeed ice skaters) can occur. A Dutc h roll occurs when yaw rates produce sideslips, which produce roll rates. If the sideslips are not adequately damped, the aircraft nose will swing back and forth with respect to the relative wind, and the aircraft will roll right and left due to the dihedral effect (the wingsweep results in asymme tric lift, depending on the relative wind). Airplanes designed to fly at higher Mach numbers have more wingsweep to control the critical Mach number (the speed at which shock waves begin to form on the wing). As wingsweep increases, the dihedral effect increases, and if the airplane is not adequately damped in the directional axis, a Dutch roll might occur if the airplane is upset directionally. Yaw dampers were design ed to minimize yaw rates, which result in sideslip rates, and are very effective in modern transports in damping the Dutch roll. However, some transport airplanes have a neutral or slightly divergent Dutch roll if th e yaw damper is off or inoperative. 5 Conventional airplanes ex hibit more of a Dutch roll tendency at higher altitude (less damping) and higher speed (more directional stability). Therefore, if a pilot encounters a Dutc h roll condition, every effort should be made to ìslow down and go down.î With a properly functioning yaw damper, Dutch rolls will not occur in modern transport aircraft. Transport airplanes are certificated to demons trate positively damped Dutch roll oscillations. The rudder should not be used to complement the yaw damper system. If the yaw damper system is inoperative, the rudder should not be used to dampen Dutch roll.

4 The Airplane Upset Recovery Training Aid was developed by aircraft manufacturers, airlines, pilot associations, flight training organizations, and government and regulatory agencies to help pilots recover from unintentionally exceeding parameters normally experienced during line operations or training.

5 This is not the case for A310 Dutch roll for which Dutch roll characteristics remain convergent in the whole flight envelope.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 13 

### 1.5.8.4 Dutch Roll Recovery Training

During Air Transat initial training, pilots are exposed to Dutch roll recovery. The exercise is conducted with YDs engaged to demonstrate the automatic damping, and with the YDs disengaged to practice the recovery technique and to demonstrate the natural damping. During the exercise, at the request of th e pilot flying, the pilot not flying rapidly applies rudder until 40 °

of bank is achieved and then releases the rudde r pedal. The rudder should not be used during recovery and the rudder control should remain in the neutral position. Transferring fuel forward will improve Dutch roll characteristic s, and flying at or below FL 310 will improve aircraft directional stability.



### 1.5.8.5 On-Board Documentation

The A310 quick reference handbook (QRH) does no t include procedures for abnormal flight
conditions related to Dutch roll. However, the ex panded checklist in the Flight Crew Operating Manual provides information to control Dutch roll in case of a yaw damper fault. A yaw damper fault was not the problem in this event.



### 1.5.9 Certification Information

1.5.9.1 Type Certificate

This model of aircraft is covered by Transport Canada type certificate A-151. The data sheet provides the following information applicable to this occurrence:

• maximum operating speed: 340 KIAS

• maximum operating Mach: 0.84

• flight load factor with flaps up: -1.0 to +2.5



### 1.5.9.2 Rudder Certification Tests

The manufacturer conducted the following struct ural and flutter tests during the original

certification of the rudder:

Static Load TestóThe rudder was tested and sustained 1.6 times the limit load at high temperature/ high humidity conditions. Fatigue TestóThe rudder was cycled fo r three lifetimes (3 x 48 000 flight cycles) between -35°C and 70°C and varying moisture content. Structural Tests

Damage Tolerance TestsóFollowing the fatigue test, artifi cial damage was introduced to the specimen and it wa s subjected to one further lifetime of fatigue. No damage growth was obse rved. Following this fourth fatigue life of cycling, the specimen was su bjected to 1.8 times the limit load without failure. The specimen was then loaded several times to 2.3 times

the limit load without failure. The specimen was then subjected to increased damage sizes and finally faile d at 2.15 times the limit load. The applied load during these tests was mechanical only and did not include vacuum cycling tests. Vacuum cycl ing tests were not specifically

demanded for certification.F ACTUAL I NFORMATION

14 T RANSPORTATION S AFETY B OARD

Sub-Component TestsóTests were conducted on the anchor nuts used to attach the leading edge to the z-sectio n, the trailing edge connection, the connection of the side panel to the front spar, the load introduction area at the hydraulic actuators, and the front spar. Theoretical Investigation (Normal Ca ses)óA theoretical dynamic model

was constructed. The vibration be haviour was calculated using the MSC Nastran finite element software program, and the model was adjusted to match ground vibration test (GVT) results. A more complex finite element model was subsequently developed for the multi-role tanker transport (MRTT) conversion. Th is model was accurate to within 3 per cent of the GVT results. Analysis fo und the aircraft to have satisfactory flutter margins up to the certification limit of 1.2 times the operating dive speed at less than Mach 1.0, meeting certification requirements. Theoretical Investigation (Failure Cases)óFlutter analysis was conducted
for a number of failure cases, includin g cracks in spar or skin, failure of two of three hydraulic circuits, ice a ccretion on leading edges, and water ingress into honeycomb core. Satisfac tory flutter margins were found for

all failure conditions.

Ground Vibration TestsóGVTs were conducted on the A310-200, A310-300, and A310-300 MRTT versions to calibrate the computer models. Flutter Tests

Flight Vibration TestsóFlight vibration tests were conducted on the
A310-200, A310-300, and A310-300 MRTT ve rsions. No flutter or critical damping reduction occurred up to the demonstrated flight diving speed of 410 knots calibrated airspeed (KCAS), Mach 0.9.



### 1.5.10 Inspection Schedule

1.5.10.1 Scheduled Inspection Cycle

The scheduled aircraft inspection cycle is as follows:

Transit check Before each flight

Daily check 36 hours of lapse time

Weekly check 8 calendar days

A-check (1 through 12) 450 flight hours

C-check (1 through 8) 15 months

Note: Aircraft utilization is approximately 300 hours per month (3600 hours per year).F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 15 

### 1.5.10.2 Scheduled Rudder Inspections

The rudder is inspected during the following inspections:

General visual inspection (GVI) from the ground of empennageóGVI (G) daily/transit check

GVI at armís length of empennageóGVI (A) 2-C check

GVI (A) of rudder 2-C check

Rudder hinge free-play measurement 4-C check

Detailed visual inspection (DVI ) of rudder hinge arms 5 years

DVI of rudder hinge fittings 5 years

DVI of rudder front spar 5 years

Non-destructive inspection (NDI) of rudder side panels 5 years



### 1.5.10.3 Recently Completed Inspections

The most recently completed major inspection s before the occurrence were the following:

May 2001 5-year rudder NDI ñ 34 415 hours and 10 037 cycles

May 2004 2-C check (at TAP Portugal) ñ 46 198 hours and 12 809 cycles

01 March 2005 A-11 check ñ 49 156 hours and 13 429 cycles

05 March 2005 daily/transit check (b efore departure from QuÈbec to Varadero) ñ 49 197 hours and 13 439 cycles



### 1.5.10.4 Rudder Damage Structural Repair Manual Limits

Chapter 55-41-00, Figure 105, of the structural repa ir manual (SRM) specifies that damage to the rudder side panels of the type ìimpact and delami nation without visible crac ks or holesî is to be repaired according to the following requirements:

• below 1000 mm2: allowable damage

• 1000 to 10 000 mm2: monitor damage and repair if it grows

• 10 000 to 40 000 mm2: monitor damage and repair within 2500 hours in accordance

with the SRM

• above 40 000 mm2: repair immediat ely and refer to manufacturer 6

6 These allowable values are in the process of being reviewed as a result of damage propagation studies that were conducted during the course of this investigation.F ACTUAL I NFORMATION

16 T RANSPORTATION S AFETY B OARD 

### 1.5.11 Maintenance Actions

1.5.11.1 General

All inspection and maintenance work reports were analyzed from the date of the aircraftís first flight in September 1991 until the time of the oc currence. All records of structural repairs were examined, including all maintenance activities reported for components of the rudder control surface and system components, as well as spec ial inspections. The investigation determined

that the aircraft was maintained in ai rworthy condition in accordance with the Transport Canada (TC)ñapproved maintenanc e program. Significant rudder-related

maintenance actions are described below.



### 1.5.11.2 Rudder Synchronization Check

There is a requirement every 1300 flight hours to conduct a rudder synchronization check as specified in Airbus SB A310-27-2082. This inspecti on requires the technicians to access the area at the base of the rudder. Although it does not include a structural inspection of the rudder, any significant external damage would be visible. This inspection had been carried out concurrently with the A-11 inspection on 01 March 2005, five days before the occurrence. No abnormalities were reported.



### 1.5.11.3 Lightning Protection Plate Replacement

On 20 May 2004, less than one year before the occu rrence and during the aircraft 2-C inspection, the rudder lower right-side LPP was found to be corroded in the aft attachment area. It was subsequently replaced, and tap tests 7 of the affected area following the replacement showed no indications of inadequate bonding. Because this was one of the few rudder maintenance activities that were recorded, the complete repl acement process of the LPP was investigated. No

anomalies were found that could have contributed to the occurrence.



### 1.5.11.4 Lightning Strike Repair

On 12 August 1997, during the aircraft 4-C inspec tion, a non-routine inspection card was raised to address suspected lightning strike damage. The defect was written as ìupper corner of rudder, lightning strike mark,î and the corrective action was written as ìrudder upper corner lightning strike area repaired in accordance with SRM 51-73-10.î This was a minor repair within
SRM limits; the manufacturer was not advised. No photos or other records of the damage were available. This damage occurred more than seven years before the occurrence, and the aircraft was subject to all regular inspec tions in the intervening time.

7 A tap test is a non-destructive inspection technique that involves gently striking the inspected component with a hand-held mass and evaluating the resulting sound to identify the presence of damage.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 17 

### 1.5.11.5 Miscellaneous Rudder Servo-Controls Maintenance

In December 1999, the number 7 rudder hinge ar m was found to have excessive play and it was repaired. In May 2004, the rudder servos we re modified according to SB A310-27-2091.



### 1.5.11.6 Maintenance Facilities

Inspection of the operator mainte nance base facility in MontrÈal showed no indication that the aircraft rudder suffered an impact against crew lifting devices, other devices on the ramp, or hangar door frame. The investigation also determin ed that the tail of the aircraft could not have been affected by the heating or lighting systems in place or at the previous location of the company in Mirabel, Quebec.



## 1.6 Meteorological Information

The reported weather at the time of departur e from Varadero (0600) was as follows: winds variable at two knots, visibility 8000 m, few cl ouds (less than 2/8 sky coverage) at 1800 feet above ground level (agl), temperature 14°C, de w point 12°C, altimeter setting 1021 millibars. The weather at Varadero at the time of landing (0800) was reported as follows: winds variable at two knots, visibility 7000 m, few clouds at 1800 feet agl, temperature 12°C, dew point 11°C, altimeter setting 1020 millibars.

At the time of the occurrence, the flight crew was in night visual flight conditions, and no turbulence was reported.



## 1.7 Aids to Navigation

There were no reported problems with navigational aids.



## 1.8 Communications

1.8.1 Air Traffic Control

TSC961 levelled off at FL 350 at 0701. As a result of the in-flight problem, TSC961 climbed nearly 1000 feet, but there was no other traffic in the area; this altitude incursion did not result in a loss of separation. TSC961 was initially bein g guided for an approach in Fort Lauderdale, but the aircraft subsequently returned to Varadero.

The crew was in contact with the controllers of four separate ATC sectors between the time of the occurrence and landing at Varadero. An emergency was not declared.



### 1.8.2 Crew/Company Communications

At 0717, a phone patch was initiated with Air Tr ansat dispatch in MontrÈal through New York aeronautical radio incorporated (ARINC) using th eir high frequency radio. The flight problem was discussed with dispatch and maintenance.F ACTUAL I NFORMATION

18 T RANSPORTATION S AFETY B OARD 

### 1.8.3 Communication Between the Flight Deck and the Flight Attendants

After hearing the abnormal loud noise, the FD contacted the flight deck via the interphone. The flight crew was unable to respond at the time be cause of the control situation. Shortly thereafter, as per the companyís prescribed abnormal/eme rgency communication procedure, the captain called the FD and provided the TESTRA briefing:

• T ó Type of problem: autopilot not respondi ng, flight diverting to Fort Lauderdale

• E ó Evacuation (land or ditch): no evacuation

• S ó Signals (standard or al ternate): standard signals

• T ó Time available before landing: 10 minutes

• R ó Relocation of passengers: not necessary

• A ó Announcement to passengers done by (captain or FD): captain

The captain did not ask the FD for a briefing wi th respect to the cabin environment and none was provided. In abnormal and em ergency situations, it is neithe r the flight crew procedure nor practice to ask the FD if he/she has information to provide. It is assumed that any information that may assist in decision making will automa tically be provided. Air Transatís procedure for communicating in abnormal situations calls for flight crew to ask if there are any questions following the TESTRA briefing, which they did. None of the FAs that were in the area of the aft galley contacted the FD or the flight crew to pr ovide information in reference to the abnormal events encountered because they assumed that the flight crew and the FD were aware of the severity of what was felt in the back.

In accordance with the applicable regulations an d standards and as per the operatorís approved training program, all crew members, pilots and FAs had received training with respect to crew communication. As well, they attended crew resource management training, which also

addresses crew communications. Su ch training is provided duri ng initial and annual training. During annual training, FA s and pilots also participate in joint crew communication training sessions during which communication skills and procedures are review ed during simulated emergency situations.

For initial FA training, the prescribed communi cation training objective is to teach the importance of, and the procedures for, effect ive communication in normal, abnormal, and emergency situations. Emphasis is placed on

• the responsibility of FAs to provide complete and accurate information to the pilot-in-command to assist in decision making;

• the potential hazards to flight safety if communication is not effective; and

• the consequence of poor communica tion in aviation occurrences.

FAs are taught that they must communicate any on-board safety concerns they may have witnessed or that may have been communicated to them by passengers. When communicating safety concerns during normal or abnormal operations, FAs are to adhere to the line of authority when possible.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 19 However, if FAs notice an emergency situation de veloping, including unusual noises, they must contact the flight crew immediately via the inte rphone, stating their position and the nature of the problem. Training stresses that FAs should ne ver assume that the flight crew is aware of everything that is happening. When informatio n is not communicated, its potential value to flight safety is lost.

There are procedures that set out the requirement for and the manner in which the FD must provide information to the FAs in abnormal and emergency situations. However, no such procedure or guideline was identified with resp ect to the FD collecting information from the FAs. As well, there is no requirement for the FD to provide flight crew with a structured briefing regarding the cabin environment in those situations.



## 1.9 Aerodrome Information

TSC961 used Runway 06 at Varadero/Juan Gual berto GÛmez International Airport (MUVR), Cuba, for the initial arrival, departure, and th e subsequent return that night. Runway 06 is 11 490 feet long and 148 feet wide, with an asp halt surface, and is served by an instrument landing system. Air Transat had maintenance personnel on site at the airport.

The Fort Lauderdale/Hollywood International Ai rport (KFLL), Florida, has a set of parallel runways and a crossing runway. TSC961 was bein g guided to Runway 27R, which is 9000 feet long and 150 feet wide, with an asphalt surface, and is served by an instrument landing system. Air Transat had maintenance personnel availabl e at KFLL, but customs services were not available at night.

The Miami International Airport (KMIA), Miami, Florida, has four runways: 08/26L, 08/26R, 09/27 and 12/30. Runways 12, 08R, 09, 26L an d 27 are equipped with an instrument landing system. Air Transat did not have maintenance personnel on site in Miami.

The Aircraft Rescue and Fire Fighting category of the three airports that could potentially have received TSC961 on the night of the incident exceeded the minimum response requirement for rescue and firefighting services for an aircraft the size of an Airbus A310.



## 1.10 Flight Recorders

1.10.1 Digital Flight Data Recorder

The aircraft was fitted with a Honeywell/Sundst rand model universal flight data recorder (UFDR), part number 980-4100-DX UN, serial number 10623. The re corder used an eight-track Mylar tape. The recording system consisted of a data frame of 64 words per second, recording over 300 parameters, with a minimum capacity of 25 hours. The digital flight data recorder (DFDR) was received in very good condition. The recorder was disassembled and the tape was removed from the crash-protected memory cartridge for playback on an eight-track reel-to-reel instrumentation recorder at slower speed. A total of 25.3 hours of data were recovered from the

recorder.F ACTUAL I NFORMATION

20 T RANSPORTATION S AFETY B OARD 

### 1.10.2 Cockpit Voice Recorder

The cockpit voice recorder (CVR ) on the aircraft was a Loral Fairchild model A100-A, part
number 93-A100-80, seri al number 60662, and was received in very good condition. The

recorder contained four 30-minute audio tracks. Tracks 1 and 2 contained the radio channels of the captain and co-pilot, track 3 was the cockpit area microphone channel, and track 4 contained public address/interphone and radio communicati ons. The quality of the recording was good.

The aircraft flew for 1 hour 17 minutes after the loss of the rudder. The CVR audio of the rudder-loss event was overwritten, resulting in the loss of information, including the noises heard in the cockpit during the rudder failure. The CVR recording started with the aircraft en route to Varadero, approximately 15 minutes before landing. The last 15 minutes were recorded on the ground in Varadero; the crew had not disabled the recorders. As a result of the TSB investigation into the Swissair Flight 111 acci dent in Nova Scotia, the Board, in 1999, made

two recommendations that CVRs installed on airc raft be required to have a recording capacity of at least two hours (A99-01 and A99-02). As a re sult, aircraft manufactured after 31 December 2002 must retain information recorded during the last two hours of aircraft operation. Aircraft
manufactured before this date, however, co ntinue to require CVRs with a minimum of 30-minute recording capacity.

There was no company procedure describing ho w to disable the recorders after landing. Current requirements in Canada are set out in TCís Aeronautical Information Manual (AIM) under General Information, Section 3.0, Transpo rtation Safety Board of Canada, Subsection
3.4.3, Protection of Occurrence Sites, Aircraft, Components and Documentation, which states in

part

Where a reportable incident occurs, the pilot-in-command, operator, owner and any crew member of the aircraft involved shall, as far as possible, preserve and protect:

a) the flight data recorders and the information recorded thereon. . .

The AIM is consistent with the Transportation Safety Board Regulations , Section 9 (1), Preservation of Evidence Respecting Reportable Accidents and Incidents.



### 1.10.3 Direct Access Recorder

On the aircraft, there is a direct access record er (DAR) with an optical disk device having a storage capacity of 128 megabytes. The data frame had a configuration of 128 words per second, recording approximately 127 parameters, identical to that of the DFDR. Both the DAR and DFDR recorded flight data from identical sour ces; however, the recorded samples were not identical due to differing sample times. Data acquisition for both DAR and DFDR is handled by the digital flight data acquisition monitori ng unit. The unit, manufactured by SAGEM, combines both the digital flight data acquisition unit function for the DFDR and the data management unit function for the DAR, feeding da ta to both recorders. The DAR optical disk was not originally requested by the TSB. Arrang ements were subsequently made to transfer all applicable DAR data to the TSB. A total of 977 ho urs (not continuous) of DAR data applicable to the incident aircraft, including the incident flight, were obtained from Air Transat.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 21 The DAR data were scanned for possible airb orne and ground events. From the DAR data available, there were no significant events recorded that indicate d lateral acceleration
excursions, severe turbulence, or rudder doublets. 8 Similarly, there were no significant ground events recorded that might indicate an impact to the rudder.



### 1.10.4 Data Sampling Rates

The DFDR and DAR data were manually time -synchronized and the data showed good correlation, with the exception of the lateral acce leration data for approximately two seconds at

the start of the rudder-loss event (see Appendix A). The differing data were the result of a highly dynamic event. Both the DFDR and DAR sa mpled lateral acceleration at a rate of 4 Hz. At this rate, it was not possible to identify any lateral acceleration frequencies above 2 Hz. 9 The determination of the specific frequencies involv ed in the rudder-loss event was not possible due to these low sampling rates of the recorded lateral accelerations.

Under current regulations (Standard 625, Schedule 3, Aeroplane Digital Flight Data Recorder (DFDR) Specifications, of the Canadian Aviation Regulations [CARs], which are harmonized with Part 121, Appendix M, of the United States Federal Aviation Regulations ), the sampling intervals for lateral and longitudinal acceleration are 4 Hz and vertical acceleration is 8 Hz. These rates meet the performance standards as recommend ed by the European Organisation for Civil Aviation Equipment (EUROCAE) minimum operatio nal performance specifications (MOPS) for Crash Protected Airborne Recorder Systems (ED112).



### 1.10.5 Filtering of Recorded Data

The control surface position data recorded on the DFDR and DAR, including rudder position, were filtered by the system data analogue conver ter before recording. The filtered data are fed to the cockpit instrument displays, and the filter ing process is designed to smooth out the data to remove unwanted spikes and prevent erratic indications. This same information is also recorded on the DFDR, and due to sampling and filt ering, does not accurately represent the true control surface positions under dynamic condit ions. Since the rudder loss on TSC961 was a dynamic event, critical informat ion concerning the flight controls was potentially lost due to filtering.



### 1.10.6 Summary of Flight Recorder Data

At the time of the occurrence, the aircraft was in steady level flight at approximately 35 000 feet and 270 knots (Mach 0.795), with no significant control movements or turbulence. The aircraft had not exceeded any load or airspeed boun daries of its structural design envelope.

8 Control input where one rudder pedal is depressed for a short period followed by immediate depression of the other rudder pedal for an equal period.

9 Sampling theory indicates that, to measure certain frequency components, sampling must occur at a frequency that is twice that of the frequency components of interest (Shannonís theorem).F ACTUAL I NFORMATION

22 T RANSPORTATION S AFETY B OARD Approximately 50 seconds after levelling off at FL 350, a dynamic oscillation in lateral acceleration occurred, lasting for approximately two seconds. This was the first indication in the DFDR/DAR data of the rudder-loss event. At the st art of the oscillations, the lateral acceleration changed from +0.006 g to -0.073 g, indicative of a lateral force applied to the aircraft. Within one second of the dynamic oscillations in latera l acceleration, the heading decreased by 2 ° and the aircraft began to roll left from wings level. At the same time, the autopilot commanded aileron and spoiler deflections (right-hand spoilers 5, 6 and 7 extended) for right roll. The recorded rudder position indicated movement to the right from 1.2 ° left of neutral (0 ° with the 1.2 ° bias removed) to approximately 0.3 ° left of neutral (0.9 ° right of neutral, with the 1.2 ° bias removed). A pitch increase from 2 to 3 ° nose-up occurred, with a corresponding increase in vertical acceleration to +1.28 g.

A yawing/rolling oscillatory mode, consistent wi th Dutch roll, commenced within two seconds of the rudder-loss event, as the dynamic oscillatio ns in lateral accelerati on decreased. At this time, a slight increase in altitude was followed by a decrease in pitch (from 3 ° to 2 ° nose-up), and a reduction in engine thrust (N 1 decreased from 90 to 77 per cent). A gradual reduction in speed followed. The roll attitude reached 6° left-wing-low and then reversed direction. Approximately six seconds into the event, the recorded rudder position reached 6.2 ° right of neutral (approximately 7.4 ° right, with the bias removed). At the speed of 270 KIAS, the recorded rudder deflection was beyond the YD authority of ±3.7 °

.

Approximately seven seconds into the event, the No. 2 autopilot was disengaged, followed immediately by disengagement of the auto thru st mode (manual throttle armed). The aircraft began to climb above FL 350 approximately 18 se conds into the event. With the autopilot disengaged, the oscillatory motion decreased in amplitude as the aircraft climbed through 35 200 feet, and as airspeed decreased through 256 KIAS. The speed decreased to a minimum of 248 KIAS. The altitude briefly peaked at 35 900 feet and the aircraft then began to descend.

Autopilot No.1 command mode was briefly en gaged as the aircraft descended through 35 000 feet. With autopilot engagement, the yawi ng/rolling oscillatory motion increased in amplitude. After approximately 17 seconds, the autopilot was disengaged and the oscillations subsequently began to decrease in amplitude. As the aircraft descended through 27 900 feet and the speed decreased through 258 KIAS , the oscillatory motion ceased.



## 1.11 Wreckage and Impact Information

1.11.1 Miscellaneous Damage

Some ceiling panels inside the passenger cabi n had partially popped out of position. The displacement was very slight and did not impede passenger movement. The interior of the fuselage compartment behind the aft pressure bulkhead was inspected; there were no

indications that the loads and vibrations associ ated with the rudder separation had caused any structural damage.

The aircraft exterior was inspected, and there we re no missing panels or structural components that may have come loose and struck the rudder. Apparent scrapes on the fuselage side, directed upward toward the tail, were determined to be poorly adhered, peeling paint and were not the result of foreign object damage (FOD). There was also blue-colou r paint transfer visibleF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 23 on the left side of the tail cone, just aft of the rudder, probably the result of a piece of the rudder striking the tail cone during separation. There was a series of puncture holes in the fuselage skin on the upper right side near the base of the VTP. These punctures were the result of the impact, during rudder breakup, of the mechanical fasteners that attach the rudder leading edge fairing

to the rudder.



### 1.11.2 Vertical Tail Plane Damage

1.11.2.1 General

Photo 2 shows the VTP and its rudder residuals being removed from the aircraft. The damage to the VTP trailing edge panels was generally limited to minor paint chipping. There was no damage suggesting

that the rudder had been battered due to

extreme travel from side to side.



### 1.11.2.2 Main Attachment Fittings

The VTP main attachment fittings were examined. On the fuselage side, these fittings are constructed of metal. Following the occurrence, they were subjected to visual and NDI, and no damage was found. The six CFRP main attachment fittings on the VTP side were subjected to ultrasonic NDI. Delami nation damage was found in the two aft main attachment fittings.

When the VTP is loaded in lateral bending, the two rear main attachment fittings are the most severely loaded. A full-scale test of the VTP cond ucted during the initial certification involved fatigue testing for three lifetimes followed by static testing, where the specimen main attachment fittings failed at over 1.9 times the lim it load. In addition, three further static load tests conducted during an earlier investigation resu lted in attachment fitting failures at greater than 1.8 times the limit load. It is noted that design ultimate load corresponds to 1.5 times the
limit load and that, in order to meet certific ation requirements, a structure must withstand design ultimate load for at least three seconds. These tests demonstrated that the design exceeds certification load requirements.

An analysis conducted in support of this occurre nce investigation determined that, in order to cause the damage observed to the VTP main atta chment fittings, the load experienced during the occurrence exceeded the design ultimate la teral fin bending load. However, it was not possible to quantify the precise load value attained.

A 3D finite element analysis was conducted and in cluded details of the main attachment fittings delamination on the occurrence aircraft, as reported by the NDI. This analysis was validated by a test on a damaged rear attachment fitting. It indicated that, when ultimate loads were applied to the model, strain levels varied only slight ly from those of the undamaged model and were Photo 2. Removal of the VTP and a view of the position of the main attachment fittingsF ACTUAL I NFORMATION

24 T RANSPORTATION S AFETY B OARD well below the levels required to cause a fracture of the main attachment fittings. Therefore, the delamination had a minimal effect on the strength and stiffness of the main attachment fittings. Consequently, after the rudder-separation event, the aircraft was not in danger of losing the VTP during the flight either through loss of static strength or loss of stiffness.



### 1.11.2.3 Hinge Arms

Laboratory examination of hinge arm 1 found the right bolt under tolerance at the attachment of the hinge arm to the VTP. The fitting on the af t face of the VTP showed no visible signs of damage, such as cracks in the paint or sealant , but ultrasonic NDI found delamination around

the mechanical fasteners. The forward ends of the hinge arms did not show any indication of upward travel as found at hinge arm 5. The rudder residuals were still attached. All three electrical grounding wires, two on VTP side and one on rudder side, were fastened with no indication of burning. There was no sign of any extreme side-to-side trav el as with hinge arms 5 and 6. There were impact marks on the rudder le ading edge fairing caused by the hinge arms. This damage was restricted to the centre regi on, and the damage lines up with the hinge arms

when the rudder is not deflected.

At the hinge arm 2, 3, and 4 positions, the hinge arms are co-located with the hydraulic actuators. De-synchronization of the hydraulic ac tuators can result in force-fighting between them, which could lead to damage at their attachment points. Visual and NDI of the attachments did not find any sign of damage to the structure or to the mechanical fasteners. There was no indication of any structural da mage that would degrade the stiffness of the

actuator attachment. All the electr ical grounding wires were fasten ed with no sign of burning. There was no indication of any extreme rudder trav el as was the case at hinge arms 5 and 6. The z-strut located above hinge position 4 is designed to transfer vertical loads from the rudder into the VTP. The attachment fitting at the upper en d of the z-strut showed no visual sign of damage, such as cracking of the paint or sealant , but there were paint chips on its top surface. This damage was probably caused by the uppe r end of the rudder separating and dropping vertically.

At the hinge arm 5 position, the metal hinge arms were still secure ly fastened to the fitting on the aft face of the VTP rear spar, and the fitting showed no visible signs of damage, such as cracks in the paint or in the sealant. The forward ends of the hinge arms showed damage consistent with the hinge arms having moved up wards. The rudder-side hinge fitting was still attached along with a short section of the ru dder spar, roughly 23 cm high by 26 cm wide.

Ultrasonic NDI found no delamination around th e mechanical fasteners that attach the CFRP fitting to the VTP rear spar, but the shim layer us ed to adjust the thickness of the CFRP fitting was mostly disbonded.

All the electrical grounding wire s were fastened with no sign of burning. The rudder-side bonding cable was badly frayed at the forward en d, roughly at the position of the hinge bolt. The hinge arm was damaged by extreme side-to-side travel of the rudder hinge fitting, reaching nearly 90 ° deflection in each direction.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 25 Manufacturerís drawings indicate that, at a rudder deflection of 45 ° , the rudder leading edge fairing cut-out strikes the hinge arm. At 60 ° , the rudder-side hinge fitti ng strikes the hinge arm.

At 84 ° , the rudder side panel strikes the VTP trailin g edge panel. There was no damage to the hinge arm where the leading edge fairing woul d have struck as the rudder passed through 45 ° of travel, and no damage to the VTP trailing edge where the rudder would have struck while passing through 84 ° of travel. The absence of such damage indicated that the damage from the

extreme side-to side travel occu rred after detachment of the rudder and would have started as the rudder passed through 60 ° of travel, progressing until the rudder reached about 90 ° of

travel.

At the hinge arm 6 position, the metal hinge arms were still secure ly fastened to the fitting on the aft face of the VTP. The fitting showed no visible signs of damage. The forward ends of the hinge arms did not show any sign of upwards travel. The rudder-side hinge fitting was still attached along with a short section of the ru dder spar, roughly 15 cm high by 22 cm wide.

Ultrasonic NDI found delamination around the mechanical fasteners that attach the CFRP fitting to the VTP rear spar. All the electrical grounding wires we re fastened, with no sign of burning. The bolt that attaches the left side of the hinge arm to the VTP was nearly seized.

The hinge arm had been damaged by extreme si de-to-side travel of the rudder, where the rudder-side hinge fitting had struck the hinge arm, reaching nearly 90 ° deflection in each direction. The damage was less severe than t hat at hinge arm 5. Manufacturerís drawings
indicated that, at a rudder deflection of 43 ° , the rudder leading edge fairing cut-out strikes the hinge arm. At 70 ° , the rudder-side hinge fitting strikes the hinge arm. At 84 ° , the rudder side panel strikes the VTP trailing edge panel.

There was no damage to the hinge arm where the leading edge fairing would have struck as the rudder passed through 43 ° of travel, and no damage to the VTP trailing edge where the rudder would have struck while passing through 84 ° of travel. The absence of such damage indicated that the damage from the extreme side-to-side travel occurred after detachment of the rudder; the damage would have started as the rudder passed through 70 ° of travel and would have progressed until the rudder had reached about 90 ° of travel.

At the hinge arm 7 position, the VTP-side CFRP attachment fitting had fractured and separated.F ACTUAL I NFORMATION

26 T RANSPORTATION S AFETY B OARD 

### 1.11.3 Rudder Damage

1.11.3.1 General

As will be discussed later in this report, subsequent analysis found that the rudder loss during flight was progressive, and by the time
the aircraft landed, most of the rudder had separated from the aircraft. Photo 3 shows the empennage after landing in Varadero. The separated pieces fell into the ocean and none
were recovered. Rib 0 remained attached, as did the length of rudder spar up to hinge point 4. A small piece of rudder side panel from each side remained attached to the spar in the region between hinge points 2 to 4, and also in the corner where the spar meets rib 0. The leading edge fairings between hinge points 2 and 4, and below hinge point 1, were still attached. The leading edge fairing between hinge points 1 and 2 had separated and some pieces were found jammed between the rudder and the VTP. At hinge points 5 and 6, small pieces of the rudder spar remained attached to the hing e arm. At hinge point 7, the VTP-side hinge bracket had fractured and separated, so none of the rudder remained.



### 1.11.3.2 Detailed Description of Rudder Damage

The front face of the rudder spar was cleaner at the hinge positions, consistent with what would be expected if the hinge areas had been cleaned for inspection. The aft face of the rudder spar was generally clean along its entire length, beco ming slightly dirtier toward the bottom. There were drip stains oriented downwards originat ing at the lightening holes, consistent with normal in-service staining caused by dripping hydraulic fluid, corrosion inhibitor, or other

fluids. There were dark stains observed on the in terior of the side panels where the reinforcing bolts pass through the GFRP blocks at the hinge points. These stains originated at the bolts and progressed in a downward direction. The foils, which normally cover the lightening holes on the rudder spar, were missing, and the pattern of dirt around each lightening hole suggested that the foils had been removed for a considerable period before the occurrence. The top surface of rib 0 was visibly dirty. There were no stains on the interior bottom of the rudder to suggest that fluid had been pooling in the bottom of th e rudder. The fluid drain holes and drain paths at the bottom of the rudder were not plugged. There were no stains in the honeycomb cells to suggest the presence of trapped fluids; howeve r, very little of the honeycomb remained for

examination.

Cross-section examination of the rudder exterior skin revealed 10 layers of paint composed of primer, anti-static, filler, and topcoat. There was an accumulation of three paint re-sprays. It was calculated that the mass of the extra two re-sprays was approximately 19.3 kg. The total mass of a rudder with the nominal paint system is approximately 190 kg. Photo 3. Leftñside view of VTP and rudder

residualsF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 27 The small amount of surviving rudder was ex amined for indications of contact with maintenance equipment, FOD, or damage by misu se. The only finding was a circular grinding mark on the exterior of the right rudder side pa nel. Cross-section examination determined that the grinding mark only extended down into the fi rst few layers of paint, with no damage to the CFRP or discolouration due to heating.

On each side of the rudder, there are three LP Ps running chordwise. On the occurrence rudder, recent maintenance had involved the replacement of the lower right LPP in May 2004. A short length of this LPP remained and its fractured end was bent forward. A section of the side panel at this LPP was taken for subsequent laboratory analysis.

The right side panelís outer face sheet exhibite d many small multidirectional surface marks.

There were similar marks on another aircra ft (MSN 600), whose rudder was inspected and found undamaged. A section cut through these ma rks on the occurrence rudder revealed that they were cracks that had originated in the pain t, caused by excessive paint thickness. It was further found that, when a paint crack was parallel to the direction of the CFRP fibres, the crack

could extend down into the CFRP resin matrix. Th ese cracks were limited to the matrix and did not damage the fibres.

The CFRP face sheets had separated from the honeycomb core and the separation had a different appearance depending on whether it was an interior or exterior face sheet. The interior face sheets had generally separated from the honeycomb very cleanly near the bond line. However, the exterior face sheets had separate d from the honeycomb in a very jagged manner with separations occurring at different depths in the honeycomb.

Microscopic examination of the inner skin separation found that they were mostly cohesive failures within the bond line through the meniscus. 10 Since the honeycomb had been so badly damaged during the occurrence, it was not possib le to distinguish damage to honeycomb cells that may have been caused by freezing of trapped water. At the actuator locations, the interior CFRP face sheets had separated into four plies. There were no significant gaps in the coverage of the splice bond adhesive at the edges of the honeycomb sheets. In regions where a separation occurred near a honeycomb splice bond, the separation tended to occur in the weaker density honeycomb, and not in the bond line. Exposed regions of honeycomb that were no longer supported by the CFRP had tended to split into many small chordwise ìfingers,î each about

25 to 50 mm wide.

The rudder spar had fractured just above the h ydraulic actuator attachments. Examination of fractured fibres indicated that the spar separa ted in an up and aft direction. The metal strip along the z-section at the front edge of each side panel had also fractured at this location, and

examination revealed that it was a ductile overload failure.

Photo 1 shows that there was no significant amou nt of rudder side panel still attached between hinge positions 1 and 2. In this region, more honeycomb remained on the right side, but more inner skin remained on the left side. The joint between the side panels and the spar, which uses
blind mechanical fasteners, had not failed and the fasteners were intact. Examination of the

10 The adhesive at the joint between the honeycomb and the face sheet forms a curved

surface known as a meniscus.F ACTUAL I NFORMATION

28 T RANSPORTATION S AFETY B OARD fractures at the joint between the front spar and th e side panels revealed that the side panels or part of the side panels separated toward the ou tboard. Along the length of rudder spar between hinge points 1 and 2, the z-sections had fractu red and separated along with the side panel on both sides. Since the leading edge fairing atta ches to the z-sections, this explains why the leading edge fairing was missing in this region . The metal actuator attachment fittings at the hinge point 2, 3, and 4 positions did not show in dications of damage, deformation, or looseness.

The joint between the side panels and rib 0, which uses blind mechanical fasteners, had not

failed and the fasteners were intact. There was a wipe mark across the top of rib 0, consistent with a fractured section of the left side panel moving towards the right and downwards. At the left side panel separation, more of the z-section had remained than on the right side. The

fastener holes had been torn out towards the bott om, suggesting that the left side panel or part of the side panel separated from rib 0 in a downwa rds or outwards direction. The left side panel also had compression damage, suggesting the inboard skin moved downwards during separation. A failure in the z-se ction remains suggests that the outboard skin moved outboard during separation.

At the right side panel separation, a length of the z-section had fractured and separated. Marks were observed on the remaining CFRP edge an d their spacing corresponded to the spacing of the missing mechanical fasteners. These marks sugge st that the right side panel or part of the side panel separated in an upwards direction. Examination of the right side panel showed that it separated from rib 0 in a tension flexion failu re. The metal strips along the z-section had failed by overstress, a combination of tension and bending to the outside. There was a skin buckle on each side panel consistent with rib 0 moving upwards. There was a crack at the tip of rib 0 whose orientation was consistent with rib 0 twisting to the right.

Examination of other rudders as part of the fleet inspections following the occurrence found side panel damage at the hoisting points and th e trailing edge fasteners. Since none of these

areas of the occurrence rudder were recovere d, it was not possible to examine them. Furthermore, since the entire upper end of the rudder was not recovered, the area around the 1997 lightning strike damage could not be examined.

Only a short section of the rudder spar at hing e point 5, roughly 23 cm high by 26 cm wide, remained attached. The lower surface of the spar section included the edge of a lightening hole. The rear reinforcement plate was still securely fast ened to the spar and all its fasteners were still present and appeared undamaged. The separati on between the honeycomb and the CFRP skin had generally occurred in the honeycomb, at varying depths and not along the honeycomb/CFRP bond line. On the front surfac e of the spar, the rudder-side hinge bracket

had fractured. The fractured surf ace appeared typical of a tensile /bending overload failure with no indication of fatigue. Meta llurgical analysis determined that the fittings were made of the correct aluminum alloy and temper.

Only a short section of the rudder spar at hing e point 6, roughly 15 cm high by 22 cm wide, remained attached. The lower surface of the spar section included the edge of a lightening hole. The rear reinforcement plate was still securely fa stened to the spar, and all its fasteners were still present and appeared undamaged. The sepa ration between the honeycomb and the CFRP skin had generally occurred in the honeycom b, at varying depths, and not along the honeycomb/CFRP bond line. On the front surfac e of the spar, the rudder-side hinge bracketF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 29 had fractured. The fractured surf ace appeared typical of a tensile /bending overload failure with no indication of fatigue. Meta llurgical analysis determined that the fittings were made of the correct aluminum alloy and temper.



### 1.11.4 Chemical Attack and Contamination

The rudder residuals were examined to study th e possibility that they had been contaminated and degraded by exposure to chemicals. Th e manufacturer provides a list of approved consumables, as well as procedures to follow for the approval of materials not on that list. No indication was found that unapproved consumable s were being used by the operator. There is no in-service experience to suggest that there was a systemic problem with chemical attack by approved consumables. During the material qua lification process at certification, extensive testing was conducted to understand the in teraction between the materials and possible contaminants, including hydraulic fluid. Howe ver, the bond between the honeycomb and the

CFRP face sheets was not included in these test s because it was in the interior structure and considered to be sealed from such exposure.

A water and hydraulic fluid mixture may react unde r certain concentrations to form phosphoric acid, which can attack epoxy resin creating irreve rsible damage to the core/face sheet interface. Microscopic examination of the rudder of aircraft MSN 361, which was known to be contaminated by hydraulic fluid, revealed that hydraulic fluid had attack ed the matrix of the GFRP layer adjacent to the honeycomb, weakening the bond, but not leading to a disbond.

Based on service experience with the aircra ft MSN 361 and MSN 545 rudders, the access path for hydraulic fluid into the sandwich structure is around the blind fasteners at the front and bottom edges of the side panels. Three methods were used to search for the presence of hydraulic fluid contamination: energy disp ersion X-ray spectroscopy (EDX), X-ray photoelectron spectroscopy (XPS), and infrared (IR) spectroscopy. The rudder of aircraft MSN 361, which was known to be contaminated by hydraulic fluid, was used to calibrate these three analysis methods. EDX testing of regions that were visibly stained by hydraulic fluid found roughly 2 per cent phosphorus content, and XPS testing found roughly 0.8 per cent phosphoric acidñester content.

The top surface of rib 0 of the occurrence aircraft was visibly dirty, and an area at the front near the spar was analyzed. EDX results indicated 0.4 per cent 11 phosphorus, considerably lower than the 2 per cent associated with the visibly contaminated region of the rudder of aircraft MSN 361. An area of inner skin (non-honeycomb side) from the left side panel front bottom corner was analyzed. EDX results indicated less than 0.1 per cent phosphorus, considerably

lower than values from the aircraft MSN 361 rudde r. An area of the inner skin (honeycomb side) from the left side panel front bottom corn er was analyzed. EDX results indicated 0.3 per cent phosphorus, and XPS results indicated 0. 18 per cent phosphoric acidñester, both considerably lower than values from the rudder of aircraft MSN 361. An area of inner skin

11 EDX and XPS percentages are measured us ing different scales (that is, 1 per cent phosphorus measured using EDX does not equal 1 per cent phosphoric acidñester measured using XPS).F ACTUAL I NFORMATION

30 T RANSPORTATION S AFETY B OARD (honeycomb side) from the right side panel front bottom corner was analyzed. EDX results showed less than 0.1 per cent phosphorus and XP S results indicated 0.07 per cent phosphoric acidñester, both considerably lower than th e values from the aircraft MSN 361 rudder.

Since the suspected hydraulic fl uid ingress path was around th e blind fasteners, specimens

were taken around blind fasteners on both si de panels at the front spar and at rib 0.

Measurements were taken inside the sandwich structure at the inner face of the skin. EDX results for phosphorus on interior surfaces were all below the 0.1 per cent detection limit. EDX

results on the external surfaces at rivet positions showed readings as high as 3.0 per cent. In addition, cross-section microscopic examinatio n of the bond area did not reveal visual
indication of chemical attack. Therefore, thes e results show the presence of hydraulic fluid
contamination on exterior surfaces, but no indication of seepage into the structure.



### 1.11.5 System Inspection and Testing

The inspection of the rudder system on the occu rrence aircraft showed that the rudder control, in cruising flight at 270 knots, would not have exceeded 7 ° of travel per side; the RTL control would have prevented it (RTL systems do not only limit the pedal inputs, but also limit the sum of inputs from trim, pedals or APYA, and YD). The autopilot was active at the time of the occurrence. The YD was also active (YD is active in manual flight also). The YD was restricted to moving the rudder to no further than 3.7 ° either side to compensate for the natural Dutch roll tendency of the aircraft.

The last rudder servo-control synchronization ch eck, performed by Air Transat maintenance on 01 March 2005, revealed that no anomalies and no adjustments were required. In Varadero, the synchronization check showed no movement between the neutral position of the three servo-controls; there was no force-fighting between servo-controls. Therefore, the synchronization between the servo-controls was wi thin the Airbus aircraft maintenance manual (AMM) parameters before and after the event.

The inspection and investigation of the aircraft flight control system and related subsystem components was performed by the investigation team in Varadero after the occurrence and revealed no anomalies. The rudder control system was checked and tested for proper operation

in Varadero with no anomalies found. The rudde r servo-controls and actuating spring rods were then removed, inspected, and laboratory tested, and no anomalies that would have affected the normal operation of the rudder system were found. In addition, all safety features that are part of the servo-controls and spring rods to ensure safe operations in case of servo-control malfunction were operational.

The free play was measured from hinge point 1 to hinge point 6; one free-play measurement was out of tolerance on the hinge line bearing at hi nge point 2. In addition, 3 out of 10 VTPñside hinge arm bearings were partly seized but could still be rotated. Airbus specifies that the hinge arm bearing free play has no impact on the struct ural integrity of the rudder. Free play at the hinge arm bearings would result in detectable rudder vibration that will trigger a specific troubleshooting inspection process. No in-flight rudder vibrations had been reported. Operators are provided with some troubles hooting guidelines that list the most probable causes when
vibrations are felt. However, the main cause of rudder vibration is play at the servo-control bearings, rather than at the hinge arms. The Airb us troubleshooting philosophy is such that, ifF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 31 there are no findings of free play at the servo-co ntrol bearings, or if they are replaced and the situation is not improved, the operator will contac t Airbus for investigation. Airbus in-service experience has confirmed the relevancy of this approach.



### 1.11.6 High-Intensity Radiated Fields Investigation

The possibility that high-intensity radiated fiel ds (HIRF) interference could affect the normal in-flight operation of the rudder system was inve stigated. Any oscillation from the YD system at a frequency of 20 Hz, representing the diffe rence of frequency between the radar and rudder synchronization frequencies, will be attenuated by the YD actuator and the three servo-controls that would be acting as filters. A review of the theoretical rudder deflection when the YD system is subjected to HIRF, assuming suscepti bility at 20 Hz, led to the conclusion that the

maximum rudder deflection would be less than 0. 1°. Therefore, the investigation determined that the effect of HIRF would have a negligible impact on the rudder surface control.



### 1.11.7 Examination of Pre-Occurrence Photos

Photographs of the aircraft taken before the

occurrence showed curious visual features on the rudder. Photo 4 shows an example of one of these features. It was taken 11 days before the occurrence and shows light-coloured vertical

lines on the left side of the rudder below the hydraulic actuators. There were also earlier photographs that showed arc-shaped lines on the left side panel just aft of the hydraulic actuators, and white spots on the trailing edge. These features were not present on the most recent photographs.

There was insufficient resolution in the photographs to conduct a photogrammetric analysis that would determine whether these vertical lines represented an out-of-plane

deformation such as a disbond bubble. Since the

vertical line features were observed on photographs taken on different days under different lighting conditions by different photographers, they were actual physical featur es on the rudder, and not simply reflections or

dirt on the camera lens.

The vertical line features first appeared in phot ographs starting in early 2003, and the aircraft was subject to all its regular inspections in the intervening time. Examination of other aircraft found that staining of the rudder near the h ydraulic actuators was not unusual. Subsequent testing found that hydraulic fluid could dissolve the Air Transat tail decal material and analysis

of a vertical streak on sister aircraft MSN 600 fo und the streak to be composed of a mixture of hydraulic fluid and dissolved decal material. Photo 4. Pre-occurrence photograph of aircraftF ACTUAL I NFORMATION

32 T RANSPORTATION S AFETY B OARD 

## 1.12 Tests and Research

1.12.1 General

A series of laboratory examinations and tests we re conducted on the residuals of the occurrence rudder, on other rudders, and on test specimen s. In addition, analyses of flight dynamics,
flutter, and radar data were conducted. This work was performed by the manufacturer at its facilities, with the participation of the involved national investigation authorities and specialist advisors from France, Germany, United States, and Canada. Test progress was monitored and validated by the investigation team.

A number of the tests and analyses helped to eliminate avenues of inquiry and allowed the investigation to concentrate on others that prov ed germane. For the sake of clarity, the report focuses on this second group of activities.

A small number of test programs developed as a consequence of this occurrence are being continued under the auspices of other entities. In each case, the objectives of the program have shifted away from this investigation to broader issues.



### 1.12.2 Examination of Two Sister Rudders

The rudders from aircraft MSN 592 and MSN 614 were removed from service and inspected at

the manufacturerís facilities. These two rudders were selected because their side panels were produced by Soko as part of the same production batch as the occurrence rudder. Both of these rudders were subjected to visual inspection and elasticity laminate checker (ELCH) testing under TSB supervision. No damage was found.



### 1.12.3 Elasticity Laminate Checker Test

1.12.3.1 Elasticity Laminate Checker Test Description

The ELCH test is an NDI method developed by Airbus to detect disbonded face sheets on honeycomb-core panels. The machine applies a vac uum to a small area of the outer surface of a panel and measures deflection. If there is a disb ond of either the inner or outer face sheet, a greater-than-normal deflection will be measured. Th e advantage of this test method is that it

can be used to find disbonds on the inner face sheets, which are not easily accessible. Airbus Report TN-EV37-579/90 (18 December 1990) desc ribes the qualification results for the ELCH inspection procedure.



### 1.12.3.2 ELCH 1óComplete Grid Examination of 24 Rudders of Similar Design

The exteriors of the rudder side panels were marked with a 75 mm grid, and an ELCH reading was taken at each grid point. There were a pproximately 2000 test points per side on each rudder. This would permit finding defects down to a size of 120 mm in diameter. A total of 24 rudders were tested, which included the flight cycle and flight hour fleet leaders. No

disbonds were found.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 33 

### 1.12.3.3 ELCH 2óFocused Examination of Rudders

Thirteen rudders close in serial number to rudder serial number HF1090 (aircraft MSN 361) were selected for further ELCH examination. The test area was a 50 mm grid along the complete z-section, around the hoist points, and along the trailing edge fasteners. No large disbonds were

found.



### 1.12.4 Examination of Other Rudders

During the course of the investigation, some rudders of other operators that had been damaged were inspected in greater detail.

The rudder from aircraft MSN 251 was accidentally damaged at its lower end by contact with maintenance equipment during normal scheduled maintenance activities. A repair was carried out, which included the replacement of the lowe r LPP using heat-assisted cure. A tap test was conducted following the repair, and no defects were found. An ELCH test was then conducted as a precaution. It found that the heat applie d during the LPP replacement had not caused a

disbond of the inner skin in the area of the LPP replacement. However, the area aft of the trailing edge fasteners around the repair to the contact damage failed a tap test, and subsequent laboratory examination found that the inner skin was almost completely disbonded within the repair area.

The rudder from aircraft MSN 361 was damaged at the trailing edge by

unintentional contact with a maintenance dock during maintenance. Subsequent inspection found a disbond on the left

inner-face sheet near the front bottom corner, approximately 830 mm long by 350 mm high. Stress analysis determined that the disbond was not caused by the impact with the maintenance dock. This internal disbond had not been detected by the AOT-1 (all operators telex ñ see Section 1.14.1) external tap test. Further examination revealed that hydraulic fluid had seeped into the left side panel around the blind fasteners at the front spar as shown
in Photo 5, and that this fluid had weakened the bond between the honeycomb and the face sheet. In addition to the hydraulic fluid contamination, this rudder exhibited signs of wa ter ingress around some trailing edge fasteners and at the leading edge immediately aft of the z-section.

Approximately one litre of water was drained from the area around the right lower aft hoisting point of the rudder from aircraft MSN 378 duri ng inspection before re-paint. Subsequent inspection revealed that excessive grinding of the old paint had resulted in exposed cells in the upper GFRP area. The manufacturer then subjected the entire area of both side panels to X-ray Photo 5. MSN 361 ho neycomb showing stain caused by hydraulic fluid ingressF ACTUAL I NFORMATION

34 T RANSPORTATION S AFETY B OARD examination and found additional water ingress at some of the tr ailing edge screws. Endoscopic examination around the hoist points revealed that honeycomb cell walls had been damaged or

torn in some affected areas.

During the AOT-1 inspection of the rudder from aircraft MSN 530, two indications of possible irregularities were found on the exterior face of the right side panel. These were 80 cm2 and

670 cm2 in size. There was no visual indication of impact damage at these locations. Destructive laboratory examination determined that it was a core crush, not a disbond. It was further determined that the core crush had occurred during cure at original manufacture. A review of manufacturing records did not indicate any conc ession related to this damage. There was no indication that this manufacturing deviation had grown in service. Stress analysis determined that this deviation had a negligible effect on the rudder structural strength. This rudder was pre-modification 8408 and had lower density hone ycomb, which was more susceptible to core crush. The occurrence aircraft was post-modific ation 8408, with higher density honeycomb.

Trapped fluid was found in the lower nose area of the rudder of aircraft MSN 701 during the AOT-2 inspection (see Photo 6). The fluid was not formally identified, but was reported to be mostly water with some dirt, possibly containing hydraulic fluid and sealant chips. The fluid level was reported to be up to the lower inspection hole. The rudder box aft of the spar was dry. The two drain openings in the nose section were found to be clogged. The tap test did not show any sign of disbond. An X-ray and thermography inspection of side panels adjacent to the fluid did not reveal any fluidity entrapped inside the

sandwich.



### 1.12.5 Fluid Contamination Program

As a result of the findings on aircraft MSN 361, a separate investigation was launched by the National Transportation Safety Board (NTSB) with support from Airbus to address the issue of hydraulic fluid contamination and its effect on st ructural strength. This program is ongoing, but preliminary conclusions include the following:

• Hydraulic fluid contamination does not have an immediate effect on mechanical strength; the effect takes time to develop.

• The effect of a hydraulic fluid/water mixtur e is more severe than that of hydraulic

fluid alone.

• The effect of hydraulic fluid/water or hydr aulic fluid is not reversible whereas the

effect of water alone is reversible. Photo 6. Fluid accumulation in the nose of the

rudder of aircraft MSN 701F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 35 

### 1.12.6 Impact Damage Tests

A series of impact tests was conducted to determ ine whether it was possible to cause a disbond between the honeycomb and the CFRP face shee ts. Drop tower tests were conducted with spherical impactors of nose radii of 12.5 to 100 mm. The test panels had honeycomb cores 40 mm thick with 32 kg/m3 density, and face sheets with one CFRP ply and one GFRP ply. Advanced drop tower tests were conducted with a spherical impactor of 2000 mm nose radius and a cylindrical impactor of 100 mm radius. These tests resulted in crushed core or face sheet perforation depending on the energy level, but no disbonds.

Chapters 12-21-11 (Cleaning), 12-31-11 (Anti Icing), and 12-31-12 (Ice & Snow Removal) of the Airbus AMM warn that the impact pressure from fluid jets must not be more than 0.35 bar. High-pressure jets can potentially damage hone ycomb structure. A survey of maintenance and de-icing facilities found that nozzle pressures in the range of 3.4 to 4.1 bars were common, with maximum up to 10.2 bars. However, the impact force that results from a spray jet depends on many factors, including the width of the spray an d the distance of the nozzle from the aircraft. Airbus reports that it has no knowledge of damage occurring with pressures as high as 1 bar at the impact point. No fluid impact damage te sts were conducted in the course of this investigation. However, it is considered that the misuse of a high-pressure spray would most likely result in damages similar to those caused by blunt impact, and would include core crush but no disbonds. It was reported that the occu rrence aircraft was last de-iced on 19 February 2005, approximately two weeks before the occurrence.



### 1.12.7 Laboratory Tests of Rudder Residuals

1.12.7.1 General

Only a small amount of the occurrence rudder was recovered. The remaining honeycomb was examined and its density was consis tent with production drawings.

Light microscopy examination of specimen s from the occurrence rudder showed the characteristic kidney-shaped cross-section of Toray T300 carbon fibres, consistent with the design specification.

Specimens were taken from the CFRP face sheets of both side panels, rib 0, the front spar, and the hinge point 7 fin-side bracket. Only one de viation from drawings was found; an additional reinforcement layer on the front spar around one of the access holes was in the wrong orientation. A review of manufacturing records di d not indicate any concession related to this deviation. The rupture of the front spar did not pass through this deviated lay-up. Stress analysis determined that this deviation had a neg ligible effect on strength and stiffness. Apart from this exception, all the lay-ups co rresponded to manufacturerís drawings.



### 1.12.7.2 Bond Between Honeycomb and Face Sheets

The quality of the bond between the honeycomb and the face sheets is normally evaluated using a climbing drum peel test. Insufficient undamage d residuals of the occurrence rudder remained to conduct drum peel tests. The sole alternativ e approach to evaluating this bond was byF ACTUAL I NFORMATION

36 T RANSPORTATION S AFETY B OARD examining the shape of the meniscus at the interface between the honeycomb and the face sheets. A number of cross-sectional specimens were taken to examine the meniscus. Meniscus formation was generally found to be sim ilar to the baseline comparison panels.



### 1.12.7.3 Bond at z-Section

The front and bottom edge of each rudder side panel is trimmed with a z-section. Specimens of the inner skin bond taken near the z-section along the front edge of the left side panel of the occurrence rudder had a meniscus whose appearance was consistent with insufficient bonding

pressure within a width of 20 mm. The investigation revealed that this condition could be caused by insufficient caul plate pressure during cure, either resulting from mispositioning of the z-section or

accumulation of tolerances of the components. In Figure 6, the upper sketch shows correct orientation during cure. The

lower sketch shows how dimensional tolerances can result in low bonding pressure next to the z-section.



### 1.12.7.4 Inter-laminar Bond Between Face Sheet Layers

The quality of the inter-laminar bond between the individual face sheet la yers was evaluated by examining sections under micros cope. No unusual features were observed that suggested a poor laminate quality.



### 1.12.7.5 Splice Bond

A compound was used to bond around the perime ters of the honeycomb blocks. Small gaps in the bonding were observed at some locations, bu t these had a minimal effect on the strength of the joint. IR spectroscopy tests confirmed that the correct splice bonding material had been

used.



### 1.12.7.6 Type of Resins

Resins in the residuals were identified using a combination of IR spectr oscopy tests and visual microscopic examination. Results found that the resins in the occurrence rudder were consistent with Hexcel F550 for the CFRP and EHG250 or EP112 for the GFRP. It was not possible to distinguish between EHG250 and EP112 since they are identical in formulation and manufacturing process. It was confirmed th at approved resin types had been used. Figure 6. Low bonding pressu re next to the z-sectionF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 37 

### 1.12.7.7 Cure of Resins

Differential scanning calorimetry tests were conduc ted to determine the adequacy of curing. All cures exceeded 98 per cent. For these resin systems, any value greater than 95 per cent is acceptable.



### 1.12.7.8 Lightning Protection Plate Replacement

The region of the recently repaired lower righ t LPP was examined. IR spectroscopy found that the adhesive used to fasten the new LPP was Hysol EA934 NA, as specified in the SRM. A cross-section specimen of the CFRP layer be neath the LPP was examined under microscope, and the only unusual feature was matrix crac king in the CFRP. To provide a baseline for comparison, an LPP was peeled from a comparis on rudder side panel. A tap test of that comparison specimen found that the peeling had not resulted in a disbond, and a microscopic

examination of the CFRP cross-section found matr ix cracking similar to that in the occurrence

rudder.



### 1.12.7.9 z-Strut Paint Chips

The area around the paint chips on the z-strut was examined by EDX. This analysis found no

traces of titanium or steel resi dues in the paint chipped areas that would have been caused by contact with mechanical fasteners from the upper part of the rudder separating in a downward

direction.



### 1.12.7.10 Explosion Damage

The rudder residuals and the VTP were visually examined by explosives specialists from the German police. There was no indication of da mage or residue radiating outwards from an origin point, as would be the case if there had been an explosion.



### 1.12.8 Double Cantilever Beam Tests

The American Society for Testing and Material s (ASTM) Specification D5528 DCB test was adapted to determine the fracture toughness of the interface between the core and the face sheet. The standard test coupon is 50 mm wide, 220 mm long, and has an initial crack length of 35 mm. For this particular investigation, the te st coupon was modified from the standard to

include 0.8 mm and 1.6 mm-thick aluminum double rs over the face sheets to achieve peel angles that were more representative of disbon d growth. Static and fatigue tests of double cantilever beam (DCB) specimens are ongoing.



### 1.12.9 Disbond Growth

1.12.9.1 History of Earlier Design Aramid FibreñReinforced Plastic Rudders

In the earlier design of the rudder, GFRP was used as the bridging layer between honeycomb and CFRP only in the reinforced region around the hydraulic actuators. Elsewhere, AFRP was used. The AFRP system resulted in poor bond strength of the interior skin. Those rudders experienced large in-service disbonds of the inne r skins. Early AFRP rudders were of the designF ACTUAL I NFORMATION

38 T RANSPORTATION S AFETY B OARD type that had two-part side panelsóupper and lower. In the rudder of aircraft MSN 237, growth of the disbond was stopped by this join t and did not progress beyond it. Disbonds were discovered in service during ro utine inspection and had not led to rudder separation or adverse aircraft performance. AFRP rudders are no longer in service.



### 1.12.9.2 Temperature Effects

Tests were conducted to investigate the effect of temperature on the out-of-plane strength in terms of climbing drum peel strength and fr acture toughness (G1c) measured by a modified DCB test. Climbing drum peel tests were conduc ted at room temperature and at -55oC. At room temperature, the failures tended to be in the ho neycomb core, whereas at -55oC, they tended to be in the interface bond line between the honeyc omb and the face sheet. It was found that the peel strength at cold temperature was significant ly reduced to about 45 to 67 per cent of its value at room temperature. The steep angle involved in this method of test is not representative of the shallow angle at which a disbond in th e rudder would propagate; therefore, DCB tests

were also conducted.

DCB tests were conducted at room temperature and at -55oC. In all the tests, the failure tended to be in the honeycomb core, regardless of temp erature. However, the cold temperature tests had fracture toughness values about 20 per cent lower. In addition, disbond growth at room temperature was steady and continuous, wherea s at cold temperature, it was unstable.



### 1.12.9.3 Vacuum Cycling Tests

Test panels with various natural and artificial damage were placed in a vacuum chamber and cycled to a differential pressure of -0.7 bar to simulate ground-to-air cycles. The tests were accelerated, with each cycle lasting 90 seconds fr om ground to altitude and back to ground. In real time, a flight cycle lasts 540 minutes. On e aircraft lifetime is 48 000 cycles. To provide conservative results, the test panels were fu lly sealed at the edges to impede breathing.

The following results were obtained:

• A specimen from the damaged left side panel of the rudder of aircraft MSN 361, which included the disbonded area (appr oximately 2256 cm2), was subjected to vacuum cycling at room temperature. Th e area of the damage almost doubled instantly at a pressure of 0.44 bar (absolute). The rapid propagation event was reported to be explosively loud and violent, resulting in some damage to the interior of the test chamber. During the test, a surface crack developed in the CFRP face sheet at the panel edge (Photo 7). This fracture halted any further damage growth by removing the pressure differential.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 39 Photo 7. Damage growth after one vacuum cycle (rudder of aircraft MSN 361)

• A specimen from the right side panel of aircraft MSN 361 rudder was also tested. Since it was undamaged, an artificial disbond (approximately 338 cm2) was introduced. It was subjected to vacuum cycling with a change of pressure ( Δ P) of -0.7 bar at room temperature. The spec imen completed the test program without

failure.

! Eight test panels were constructed, which included 24 and 32 kg/m 3 core densities and 30 and 40 mm thicknesses. Damage was introduced by sweeping out a disbond damage with a knife. The artificial dama ges had diameters of 100 to 250 mm. When exposed to cyclic vacuum loading, four of these panels demonstrated slow steady growth of the disbond and eventua lly failed in rapid propagation.

• A test specimen from the blunt impact te st program, which had experienced crushed core but no disbond, was cycled for 10 000 flight cycles and showed no propagation of the damage.



### 1.12.10 Computer Simulation of Disbond Growth

Computer simulations were conducted using the LS-DYNA software to study the growth of the MSN 361 rudder disbond. The following conclusions were drawn:

• The MSN 361 rudder side panel with the disbond damage as found at the time of detection was sufficiently large to achiev e unstable growth at reduced pressure altitude. Since it did not propagate in flight , it is most probable that it experienced leakage during the period before detection.

• A disbond of a size corresponding to the initial contaminated region of the MSN 361 rudder did not grow under reduced pressure altitude.

• When a disbond size corresponding to the initial contaminated region of the MSN 361

rudder was combined with a disbond at the z- sections at the lower front corner of the side panel, unstable disbond growth o ccurred at reduced pressure altitude.F ACTUAL I NFORMATION

40 T RANSPORTATION S AFETY B OARD 

### 1.12.11 Effects of Temperature and Moisture

Liquid water trapped in the honeycomb will expand as it freezes, and the repeated freeze-thaw cycle can gradually damage the cell walls. In other rudders where water ingress into the honeycomb has been documented, this infiltrati on has tended to occur around the hoisting points or near the trailing edge fasteners. Thes e areas are the most likely entry paths for water since these design features involve a break in th e continuity of the CFRP face sheets. On the
occurrence aircraft, these areas of the rudder were not recovered, and it was not possible to

determine whether the occurrence rudder had ex perienced liquid water ingress into the honeycomb.

The epoxy matrix in the face sheets and the No mexÆ core material can absorb moisture from

humid air or condensed water. Moisture abso rption degrades the mechanical properties, especially of face sheets that are matrix or ma trix-interface dominated, pa rticularly at elevated temperatures. At certification, static strength of the composite structure was substantiated assuming a worst case of maximum service mo isture content and by conducting tests at elevated temperature.

The temperature of an aircraft can reach extreme levels while parked on the ground due to the ambient temperature, solar radiation, and th e colour of the aircraft. The rudder of the occurrence aircraft was painted dark blue, and its previous paint scheme had a black stripe across the rudder. United States Departme nt of Transport paper DOT/FAA/AR-04/30 describes tests involving CFRP laminate panels of different colours, whose temperature was measured during exposure to sunlight. The hi ghest measured value was 82oC at an ambient temperature of 33oC. No thermal analysis was conducted for the A310 rudder, but a thermal analysis for the VTP fin box of another mo del of transport aircraft found maximum temperatures of 91oC in still air on the ground, and 76oC when moving.

High temperature can have an adverse effect on the mechanical properties of composite materials. If the materialís gl ass transition temperature is exceeded while under load, the structure can experience plastic deformation. The onset glass transition temperature for F550/EHG250 resin is 102oC dry or 75oC wet. Give n the occurrence rudderís age, its onset glass transition temperature had most probably reache d its saturated or equilibrium state, and was

closer to the 75oC value.



### 1.12.12 Age-Related Structures and Materials Degradation

The possibility was studied that there might be some unknown phenomenon at work that could cause a reduction in structural stiffness with age. Such a reduction in stiffness could result in a reduced flutter speed and lead to flutter. In 200 4, Airbus conducted GVT in support of its MRTT program. The testing was conducted on an aged A310 aircraft (MSN 523) that had accumulated over 28 000 flight hours. This test aircraft had the same design of VTP and rudder as the

occurrence aircraft. GVT results found that fin bending and rudder rotation frequencies of the

MRTT test aircraft were consistent with those obtained during the original A310-300 certification. No indication was found to suggest that stiffness had reduced with age.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 41 Airbus Report TN-ESWCG-1181/02 documents an ea rlier investigation of material properties changes with age. The glass transition temperat ure (Tg) was measured for specimens of CFRP
materials Hexcel F913 and F550, and GFRP materi al EHG250. These results were compared with those from specimens analyzed 14 years earlier during material qualification, and there was no indication of age-related Tg degradation.

Climbing drum peel tests were conducted wi th specimens from the two unused baseline reference panels, which were roughly the same ag e as the occurrence rudder. Tests results were in the range expected, and there was no indication of age-related degradation in peel strength.



### 1.12.13 Flight Dynamics Analysis

1.12.13.1 Background

To study the aircraft response during the occurrence, the Airbus A310 flight model was configured to simulate the aircraftís behaviour following a loss of rudder surface area. It was first necessary to determine the movement of the flight controls (ailerons, rudder, elevator, and spoilers). This was done using the merged DFDR and DAR data. It was also necessary to derive parameters not available directly from the DFDR , such as sideslip, and to modify existing parameters to take into account data latencies. The mass properties of the aircraft (that is, weight, inertia, CG) at the time of the incident were derived using the load and trim sheet for TSC961. Modifying the aircraft configuration to simulate rudder loss required modification of lateral-directional aerodynamic coefficients to ta ke into account the loss of surface area. This modification was done by applying an adjust able ratio to the appropriate aerodynamic coefficients, allowing investigation of differing amounts of rudder loss.



### 1.12.13.2 Initial Simulations

Seven initial simulations were performed and the outputs were compared to the existing DFDR

and DAR data to determine their applicability to th e occurrence scenario. Of these seven simulations, four were performed with differe nt amounts of rudder loss and with different aircraft mass properties. Three simulations were performed to evaluate additional aircraft

behaviour related to the incident. The timefram e of interest was from 0701:57 (approximately 4 seconds before autopilot 2 was disconnect ed) to 0702:14 (approximately 13 seconds after autopilot 2 was disconnected). The actual event was not simulated, since there were significant structural dynamics issues with which the flight dynamics simulator could not deal.

The results of the simulations were presented gr aphically showing different lateral-directional flight parameters as determined by the simulati on compared with flight data derived from the DFDR and DAR. In all cases, the properties of in terest for comparison with the flight data were the magnitude and the frequency. Matching these two properties of interest for all aircraft parameters would indicate a simulation configurat ion similar to the aircraft at the time of the

occurrence.F ACTUAL I NFORMATION

42 T RANSPORTATION S AFETY B OARD The only simulation that reasonably matched the frequency and amplitude of the DFDR and DAR data was one in which there was a reduction of the useable rudder by 84 per cent and a reduction in the yaw moment of inertia by 10 per cent. The moment of inertia calculations for

the aircraft at the time of the incident were on ly accurate to 10 per cent, which means that the mass properties for this simulation were within the limits of the calculations for the aircraft.



### 1.12.13.3 Simulations to Determine the Latera l Force at Tail During the Event

The initial event was characterized by significant lateral acceleration excu rsions, suggesting that a lateral force was applied to the right-hand side of the aircraft during the event. The Airbus flight dynamics simulator was unable to investig ate structural dynamic aspects of the initial event but could provide an indication of the magn itude of the force required to initiate the

Dutch roll motion.

The only way the simulation co uld introduce this force into the aircraft was through rudder movement. The rudder input was constrained by the limitation of the rudder control jacks of 60 ° per second. The simulated lateral acceleration resulting from the rudder input was then compared to the DFDR and DAR data. The rudde r motion required to obtain the lateral acceleration was significant wh en compared to the DFDR and DAR data. A movement of this magnitude and duration would have been record ed on the DFDR and DAR; therefore, the

rudder was not the source of the force. The forc e generated by this rudder motion had a peak value of 108 000 newtons (N) applied at 0701:54. Alth ough the source of the force is not known, this does give an indication of the magnitude of the lateral force involved in the initial event.



### 1.12.13.4 Simulations to Determine the Longitudinal /Vertical Force at Tail During the Event

In addition to the lateral acce leration, increases in pitch angle, angle of attack, and vertical

acceleration were observed in the DFDR and DA R data during the initial event, indicating a nose-up motion, whereas the st abilizer position was command ing a nose-down motion. The Airbus flight dynamics simulator was used to investigate the magnitude of longitudinal and vertical forces required to produce this motion.

The forces were simulated through changes to the pitching moment coefficient, lift coefficient, and drag coefficient. The combination of thes e changes that best matched the DFDR and DAR

data indicated that a downward vertical force of approximately 36 000 N at 28 m aft of the CG and a rearward horizontal force of approximat ely 35 000 N at approximately 9.5 m above the CG were applied to the aircraft approximately one second after the application of the lateral

force described above or at 0701:55.



### 1.12.13.5 Additional Simulations

Additional simulations were conducted to be tter understand the results of the initial

simulations. These additional simulations cove red the time period from 0701:50 to 0702:15 and

included the time of the excessive rudder deflection. Four simulations were performed with different rudder breakup scenarios. The simulati on that best matched the DFDR and DAR data was 76 per cent rudder loss at 0701:28, increasing to 80 per cent rudder loss at 0701:32.5 toF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 43 0701:33, and increasing again to 84 per cent rudder loss at 0701:34.5 to 0701:35. An important

result of these simulations was that the rudde r movement recorded on the DFDR and DAR was made by a part of the rudder that was not aerodynamically effective.

Combining the results from these simulations with the investigation of the lateral, longitudinal, and vertical forces suggests the following scenario:

• At 0701:54, a lateral force of approximately 108 000 N was applied to the aircraft.

• One second later, at 0701:55, a horizontal force of 35 000 N was applied 9.5 m above the CG, and a vertical force of 36 000 N was applied 28 m behind the CG.

• The application of the horizontal and vert ical force coincided with an initial rudder loss of 76 per cent.

• Over a period of approximately seven seco nds after the initial rudder loss, the rudder continued to break up, with 80 per cent rudder loss occurring between 0701:59.5 and 0702:00, and 84 per cent rudder loss occurring at 0702:02.

• The results also suggest that the excessive rudder deflection recorded on the DFDR and DAR at 0702:00 was made by a part of the rudder that was not aerodynamically

effective.



### 1.12.13.6 Yaw Damper Modelling

After the initial event, the DFDR and DAR data indicated that the rudder was moving in a sinusoidal pattern, which frequency analysis showed to be similar to the frequency of the lateral

acceleration. This would indicate that the mo vement of the rudder was connected with the aircraft movement. One theory proposed for the rudder movement was the operation of the YD. To confirm this theory, the YD system was mo delled after information on YD mechanization provided by Airbus.

When the YD model output was compared with DFDR and DAR rudder movement data,

corrected to remove a rudder motion sensor bias and a time lag introduced by the system data acquisition concentrator, it showed that the rudder movement closely matched the predicted YD output. The only significant deviation occurre d approximately five seconds after the initial
event, where the DFDR and DAR data showed a large rudder motion that exceeded the

mechanical limits of the rudder. This motion was a ttributed to the loss of rigidity in the rudder due to the breakup.



### 1.12.14 Effect of Disbond Bubble on Static Aerodynamic Loads

A rudder side panel disbond or in-plane core fracture, under the influence of aerodynamic loads, could result in the affected area bulg ing outwards with a bubble-like appearance. An analysis was conducted to determine the effect of such a bubble on static aerodynamic loads. The analysis was conducted using computatio nal fluid dynamics based on geometrical information from the finite element analysis model. The analysis was repeated for rudder deflection angles of 1 ° and 6 ° , under the flight conditions that existed at the time of theF ACTUAL I NFORMATION

44 T RANSPORTATION S AFETY B OARD occurrence. At 6 ° deflection, the disbond bubble caused a 1 per cent increase in rudder force and a 2.4 per cent increase in total VTP force. At 0 ° rudder deflection, which was the situation at the
time of the occurrence, the disbond bubble had a negligible effect on rudder and VTP loads. Therefore, the presence of a disbond bubble wo uld have a comparatively small effect on static aerodynamic loads.



### 1.12.15 Flutter Analysis

1.12.15.1 Analysis of a Dynamic Event

The lateral load traces obtained from the DFDR and DAR were coincident except for a two-second period at the beginning of the o ccurrence. This suggested the possibility of a dynamic event. Since the sampling rate was only 4 Hz, it was not possible to determine the amplitude and frequency of the dynamic signal . Therefore, the signal was analyzed using a simplistic manual experimental curve-fitting a pproach. Using this method of analysis, it was not possible to find a unique solution.

However, it was possible to fit the DFDR and DAR data by assuming both a high- and low-frequency component, a loss in damping, and by assuming that the first part of the signal was divergent and the second part was stable. Si nce there was a dynamic event, and flutter is a dynamic phenomenon, a flutter analysis was conduc ted to determine whether it was possible to find a scenario involving flutter before or after the rudder rupture, consistent with the available

data.



### 1.12.15.2 Method of Analysis

A theoretical flutter analysis was conducted to st udy the effects of various failure scenarios on

the aircraftís flutter characteri stics. The analysis was done using a complete aircraft model, flutter computations with 70 modes, and 1 per ce nt structural damping. This same method of flutter analysis was used for the original certificat ion, and at the time, was substantiated both by GVT and flight testing. The doublet lattice analysis method that was used does have limitations that may affect the accuracy of predictions in ca ses such as a disbonded skin panel on one side panel only. A preliminary investigation of advanc ed techniques was conducted, but the state of development of these approaches was not sufficien tly advanced to be useful in the analysis.



### 1.12.15.3 Baseline Analysis

The baseline case represented an aircraft with no structural damage. The flutter analysis found that the basic coupling mechanism involved a 6.76 Hz fin bending mode and a 13.18 Hz rudder rotation mode. There were sufficient dampin g margins at both the occurrence speed of 270 KCAS and the design dive speed of 406.5 KCAS.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 45 

### 1.12.15.4 Failure Scenarios

Flutter analyses were conducted to study the effect of the following structural failure scenarios:

• **Disbond** óThe

scenarios involved varying degrees of

disbond between the honeycomb core and
the inner face sheet, as shown in Figure 7. Single-sided

disbonds were

studied on the left panel, the right panel, and both panels. Simulating a

disbond between the core and the face sh eet was accomplished in the analysis by reducing the stiffness of the face sheet to 0 or 20 per cent of its original value in the affected area. The analysis found that ther e was an increase in flutter tendency with greater disbonds, and that double-sided disbonds were more critical than single-sided ones. There was no significant difference between left-side and right-side

disbonds. No flutter was observed when sti ffness was reduced to 20 per cent. When it was reduced to 0 per cent, the double-sided 2.9 m2 disbond scenario and the single-sided 5.6 m2 disbond scenario resu lted in violent flutter below 150 KCAS. A more detailed examination of the single-sid ed 5.6 m2 disbond scenario, within the range between 0 and 20 per cent stiffness, found that the flutter speed decreased as the stiffness was reduced, and that this decrease was steady and continuous down to about 5 per cent stiffness where flutter st arted. Below 5 per cent stiffness, the frequency and damping decreased rapi dly leading to flutter conditions.

• **Free Rudder** óThis scenario simulated a chordwise fracture of the rudder just above the hydraulic actuators, resulting in a fr ee upper rudder. This model demonstrated flutter of several modes below 270 KCAS, the speed at the time of the occurrence.

• **Trailing Edge Screws Removed** óThis scenario simulated the removal of all the trailing edge screws. The analysis found that the flutter behaviour of this model was nearly unchanged relative to the baseline sc enario. The reason for this was that the trailing edge connection was still intact so the torsion cell was still closed.

• **Trailing Edge Connection Removed** óThis scenario simulated the removal, to varying degrees, of the trailing edge connect ion. The analysis found that the tendency to flutter increased with the increasing size of the damage, and that flutter within the flight envelope was possible wi th the larger damage areas. Figure 7. Disbond scenarios studied in flutter analysisF ACTUAL I NFORMATION

46 T RANSPORTATION S AFETY B OARD • **Fractured Front Spar** óThis scenario assumed that the rudder front spar was fractured above the hydrauli c actuators. The analysis found that there was only a slight deterioration in the rudder-rotation/f in-bending flutter coupling relative to the

baseline scenario.

• **Loss of Rudder Below Hinge 2** óThis scenario assumed that the section of rudder below hinge point 2 was lost. The analysis found that the rudder rotation frequency increased significantly due to the missing rudder mass, but there was no coupling.

• **Upper-End Disbond** óThis scenario assumed a large one-sided disbond at the upper end of the rudder. Twenty percent stiffness was assumed in the disbonded area. The analysis found that there was only a small c hange in damping relative to the baseline

scenario.

• **Hinge Failures** óFive scenarios were evaluated involving the following failures: failure of hinge 1; failure of hinge 7; failure of hinges 1 and 7; failure of hinges 6 and 7; and failure of hinges 5, 6, and 7. The analysis found that scenarios for failures of hinge 7, and failures of hinges 1 and 7 did le ad to flutter, but this occurred beyond 400 KCAS, outside the design envelope. The remainder of the scenarios did not show any flutter-critical couplings.

• **Hinge Stiffness** óThree scenarios were evaluated involving the following failures: 75 per cent of nominal stiffness, all 7 hinges; 50 per cent of nominal stiffness, all 7 hinges; and 25 per cent of nominal stiffness, all 7 hinges. The analysis results showed that none of these scenarios pr esented any significant deterioration in coupling of the fin bending and rudder ro tation modes compared to the baseline

scenario.

• **Hydraulic Actuator Stiffness** óThree scenarios were evaluated involving the following failures: 75 per cent of nominal st iffness, all 3 hydraulic actuators; 50 per cent of nominal stiffness, all 3 hydraulic actuators; and 25 per cent of nominal stiffness, all 3 hydraulic actuators. The an alysis results showed that decreasing the hydraulic actuator stiffness increased the tend ency to flutter. At 25 per cent stiffness, a flutter speed of 268 KCAS was calculated.

• **Single Hydraulic Actuator Disconnection** óThree scenarios were evaluated involving the following failures: disconnect ion of actuator at hinge position 2; disconnection of actuator at hinge position 3; and disconnection of actuator at hinge position 4. The analysis found no flutte r with the disconnection of one actuator. Further analysis found that, when simula ting a double hydraulic failure, the reduction of rudder rotation mode frequenc y was only 0.33 Hz and did not lead to

flutter.

• **Actuator Stiffness versus Actuator Disconnection** óA comparative analysis of the two previous scenarios found that disconne cting one hydraulic actuator has the same effect as all three actuators having 66 per cent of their nominal stiffness.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 47 • **VTP Attachment Failure** óA flutter analysis was conducted to determine the effect of failed VTP main attachment fittings on flutter. The analysis found that the

disconnection of one or both of the VTP rear attachments did not provide a fluttercritical coupling.

• **Extra Rudder Mass** óThis design of rudder is not mass-balanced. Any condition that adds mass to the rudder and moves its CG aft, further away from the hinge line, has an adverse effect on the flutter margin. Ex cessive paint layers or fluid ingress are examples of conditions that could cause such an effect.

- **Extra Mass at Trailing Edge** óThe analysis simulated extra rudder mass by increasing the mass of the trailing edge screws. This analysis found that 142 kg distributed at the trailing edge was necessa ry to produce flutter at the occurrence speed of 270 knots. The analysis also foun d that, with 71 kg of extra mass, there was adequate damping at the occurrence conditions.

- **Extra Paint** óThe analysis simulated extra mass distributed evenly over the surface of the rudder. This analysis found that, at the occurrence speed of 270 knots, the addition of mass did not sign ificantly reduce the damping. At high speeds, the addition of the initial 19.3 kg of extra paint significantly reduced the damping.

- **Pooled Fluid in Rudder** óA flutter analysis was conducted to determine the effect of pooled fluid in the rudder lead ing edge as was found in the rudder of
aircraft MSN 701. It was found that, since this extra mass is concentrated so close to the hinge line, it had a negligible effect on flutter.



### 1.12.15.5 Summary of Flutter Analyses

The analyses found that flutter could occur within the certification envelope for three damage

scenarios:

• free rudder or free rudder section;

• significant decrease in hydrau lic actuator stiffness; and

• significant reduction in rudder torsion sti ffness by extensive disbond or failure of trailing edge connection.

In all these scenarios, the necessary damage was significant and exceeded certification requirements.F ACTUAL I NFORMATION

48 T RANSPORTATION S AFETY B OARD 

### 1.12.16 Time-Domain Flutter Analysis

1.12.16.1 General

The flutter analysis results described above we re presented graphically by frequency and damping curves versus speed. In order to correlate this flutter analysis with the results of the flight dynamics analysis and the recorder data, wh ich were presented as curves versus time, the following time-domain flutter analysis was conduc ted to observe the flutter amplitude versus

time.



### 1.12.16.2 Method of Analysis

A time-domain flutter analysis was conducted for two of the failure scenarios: single-sided 5.6 m2 disbond with less than 5 per cent stiffn ess of the original panel and free upper rudder. The aim was to produce time histories and co rrelate the resulting loads. The analysis was conducted in time steps of 0.001 second. The structure was excited with a lateral force of 1 kilonewton (kN) at the VTP tip acting as a step pulse starting at time step 100 with a

0.1-second duration.

The following variables were examined:

• rudder deflection (top, middle, bottom);

• loads at all seven hinges;

• forces at all three actuators;

• loads at VTP attachments (front, middle, rear); and

• lateral accelerations (cockpit, CG/DFDR, VTP attachment, VTP tip, rudder top and bottom)



### 1.12.16.3 Results

Upon excitation, the amplitudes of all the responses started to grow. Figure 8 shows a typical load response at the left rear VTP attachment. At design ultimate load, the maximum force acting at the aft VTP attachment is approximately
700 kN, and based on the attachment fittings damage, it is known that loads during the occurrence did exceed ultimate strength. Therefore, the time step where the load peaked

above 700 kN was selected as a reference point for each scenario. All the remaining monitored variables were measured within an envelope around the reference time step, since all the maxi ma did not occur at the same time. Their peak value within this envelope was recorded. Both in vestigated scenarios showed no contradictions Figure 8. Typical load response from time-domain flutter analysisF ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 49 with respect to restraints like VTP attachment rupture load and maximum rudder rotation. The free upper rudder scenario did not exhibit any significant hinge loads in the fore/aft direction,

and the VTP attachments would have failed befo re the hinges. Since this contradicts the observed damage, this scenario is excl uded as a realistic damage scenario.

The single-sided 5.6 m2 disbond with less than 5 pe r cent stiffness of the original panel scenario did exhibit significant hinge loads in the fore/a ft direction. The time-domain flutter analysis determined that hinge 5 would be the first to fail and that it would fail before the VTP main attachment fittings were damaged. A second time-domain flutter analysis was conducted to study this scenario with a disconnected hinge 5. That analysis found that, after the failure of hinge 5, the loads of hinge 6 exceed allowable loads while VTP rear attachments reached a level above ultimate but below rupture.



### 1.12.17 Summary of Flutter and T ime-Domain Flutter Analyses

Flutter and time-domain flutter analyses were cond ucted for a number of failure scenarios. One scenario, the single-sided 5.6 m2 disbond with less than 5 per cent stiffness of the original panel, provided a credible response and showed good correlation with the observed damage, the recorder data, and the flight dynamics analysis.



### 1.12.18 National Transportation Safety Board Radar Data Analysis Study

The NTSB conducted a trajectory analysis of the Florida Keys (KEY), Melbourne (MEL), Tamiami (TMA), and Cudjoe Key (CUD) air rout e surveillance radar data to identify the numerous tracks in the vicinity of the trac k of TSC961 at the approximate time the rudder separated from the aircraft. The aim was to dist inguish larger pieces of debris from smaller shards and examine relative timing of events. Th e caveat was that radar has many variables that cannot always be reverse-engineered. No disc ernable track of an initial separation or a sustained track that would resemble a large piece of aeroplane part was evident. The tracks of the returns resembled numerous small pieces floating with the prevailing winds.



### 1.12.19 Other Aircraft in Vicinity

ATC records indicated that there were no other ai rcraft with an instrument flight rules discrete transponder code at a similar altitude within 60 nautical miles (nm) of the occurrence aircraft at

the time of the event. The nearest aircraft was at FL 320 feet approximately 70 nm to the east. All other aircraft were considerably lower and further away.



### 1.12.20 Space Objects

Military authorities reported that, at the time and place of the occurrence, records did not indicate any man-made objects re-entering th e atmosphere. Records were unavailable for natural objects re-entering the atmosphere.F ACTUAL I NFORMATION

50 T RANSPORTATION S AFETY B OARD 

## 1.13 Organizational and Management Information

1.13.1 Company Operations

Air Transat is authorized by TC to provide the types of services specified in its air operating certificate (AOC). Part I of the AOC, in part, authorizes non-scheduled and scheduled international operations between Canada and points abroad and between points abroad using

its A310 aircraft.



### 1.13.2 Maintenance Organization

Since February 2002, the occurrence aircraft was maintained by Air Transat, which operates a fleet of 14 wide-body aircraft (A310 and A330) under a quality safety management system (QSMS). Air Transatís QSMS is a component of a management control system that deals with quality and safety. Air Transatís QSMS includes an accountable executive, a safety management plan, safety oversight, training , quality assurance, documentat ion, and an emergency response plan.

The Air Transat maintenance program in place at the time of the occurrence was approved by TC on 10 December 2004 under approval numb er Q-0188. Air Transat holds a TCñapproved maintenance organization (AMO) certificate, as pe r Part 5, Sub-Section 73, of the CARs, under AMO 32-87. The company has approximately 285 employees in the maintenance department. The company is capable of doing line and heavy maintenance, minor and major repairs, and
modifications for Lockheed 1011, Airbus 310 seri es, Airbus 330 series, and Boeing 757 series

aircraft.

Air Transat also holds the privileges of specializ ed maintenance rating on sheet metal structure, composite structure, arc welding, avionic system s, and components, as per Section 573.02 of the CARs. The review of the Air Transat AMO showed that the organization has up-to-date Maintenance Control and Maintenance Policy manuals that outline the requirements for the technical operation.

Air Transat was last audited by TC from 06 to 17 May 2002. Air Transat was not approved to perform C-checks on its Airbus aircraft. Th e last C-check on C-GPAT was completed by TAP Portugal in May 2004. Air Canada Technics has been used for C-checks on the occurrence

aircraft as well as on other Air Transat aircraft.F ACTUAL I NFORMATION

T RANSPORTATION S AFETY B OARD 51 

## 1.14 Additional Information

1.14.1 All Operators TelexóFleet Inspection of Rudder

1.14.1.1 AOT-1óFleet Inspection of Rudder Exteriors

As a result of this investigation, the

aircraft manufacturer issued AOTs

A310-55A2035, A300-55A6035,
A330-55A3035, and A340-55A4030 on 17 March 2005 for the inspection of all aircraft with part number A55471500 series rudders (Figure 9). These AOTs were subsequently made mandatory by an Airworthiness Directive issued by the

Direction GÈnÈrale de líAviation Civile (DGAC) of France, the State of manufacture. This inspection included
222 A310s, 146 A300-600s, 6 A330s, and 34 A340s. The aim was to verify the structural integrity of the rudder and its attachment by means of one-time visual and tap-test inspections. This included a GVI of the VTP rear spar aft face, DVI of the hinge arms and actuator su pport fittings, DVI of the rudder hinge fittings, and a tap test of the rudder side panels. The tap test was conducted around the exterior perimeter of the rudder side panels as per the normal five-year inspection, as well as the inspection of additional bands throug h the centre as shown in Figure 9. It is noted that an exterior tap test is unable to detect disb onds on the interior face sheets. Airbus obtained results from operators for over 80 per cent of th e affected aircraft, with the following results:

• Side panel disbonds and delaminations were found on a small number of aircraft but were all within SRM repair limits.

• Damage at hoisting points was found but the damage was below the size requiring immediate repair and was within SRM repair limits.

• Some corrosion was reported at hinge fittings but was assessed as having no impact on structural integrity.

• Some free play was reported at hinge bearings but was assessed as having no impact on structural integrity.

• No trends were observed in the damage data, which would suggest batch tendencies.

• None of these findings approached a level that could result in failure in flight. Figure 9. Schematic of AOT-1 areas of inspectionF ACTUAL I NFORMATION

52 T RANSPORTATION S AFETY B OARD 

### 1.14.1.2 AOT-2óFleet Inspection of Rudder Interiors

On 02 March 2006, the aircraft

manufacturer issued a second series of AOTs (AOT A310-A552043,

AOT A300-A556042, AOT A330-A553036, and AOT A340-A554031) for the inspection of all aircraft with rudder part number

A55471500 series rudders. These AOTs were subsequently made mandatory by two Airworthiness Directives issued by the European Aviation Safety Agency (EASA), representing the State of manufacture. The aim was to verify the structural integrity of the rudder by means of a one-time tap-test inspection to the interior face sheets of the rudder side panels, as well as checking the drainage holes at the bottom of the rudder and cleaning hydraulic fluid from the

external surfaces. Acce ss to the interior of the rudder was through the inspection holes in the front spar of the rudder. It is note d that the access to inboard surfaces from the inspection holes is limited. Figure 10 shows the areas of inspection. Airbus obtained results from operators for over 90 per cent of the affe cted aircraft and no disbonds were found. Figure 10. Schematic of AOT-2 areas of inspectionA NALYSIS

T RANSPORTATION S AFETY B OARD 53 

# 2.0 Analysis

2.1 General Information

TSC961 departed Varadero on a scheduled flig ht and was being flown by qualified crew members in accordance with applicable regula tions and procedures. Documentation indicates that the aircraft was equipped and operated in accordance with applicable regulations and procedures. Weather and navigation aids were no t considered as factors in this occurrence.



## 2.2 Flight Control System

2.2.1 General

The investigation of the aircraft flight cont rol system and related subsystem components revealed that there were no control system anomalies or conditions that could have led to the breakup of the rudder.



### 2.2.2 Ability to Diagnose the Source of Flight Control Difficulty

Throughout the flight, the nature of the structur al damage could not be precisely identified. Only when rudder inputs were ma de in the final stages of approach and landing did it become apparent that rudder response was abnormal and inadequate.

The problem the crew was facing could be descri bed as ìflight control difficulties of unknown origin.î There is no established procedure fo r this problem. The ambiguous nature of the symptoms made it difficult for the crew to assess the situation and to form a clear diagnosis of what had caused the control proble ms that they had experienced.



### 2.2.3 Dutch Roll Recovery

During their initial training, the pilots were sh own a Dutch roll in the simulator; this was their only encounter with this situation. The integrit y of any abnormal procedure checklist relies on the premise that only the correct procedure should be used for a given situation, and that the procedure should be completed in its entirety. On the A310, most procedures are displayed on the ECAM, and as each procedure item is proper ly completed, the item is removed from the display screen. Completing the associated procedur e ensures best safety of the flight. There is no procedure in the QRH or on the ECAM that deals with Dutch roll. Only the Airplane Upset Recovery Training Aid gives general guidelines, and it does not deal specifically with systems such as the autopilot. There wa s insufficient guidance regarding Dutch roll recovery technique. Additional information may have prevented the cr ew from worsening the flight characteristics as was the case when the autopilot was re-engaged.



### 2.2.4 Decision to Return to Varadero

Shortly after the rudder loss, the crew took steps to descend and divert to a nearby airport. As the flight progressed, the Dutch roll decreased and then ceased as they descended. By the time the crew was in a position to complete an approa ch to either Miami or Fort Lauderdale, thereA NALYSIS

54 T RANSPORTATION S AFETY B OARD were indications that the aircraft would continue to fly normally. The determination of where to land was influenced by the following: there were no symptoms remaining related to the noise,
vibration, or Dutch roll; there were no ECAM messages, warning lights or cockpit indications related to the control problems; the flight could continue at low altitude; and the company was better equipped to deal with the pa ssengers and aircraft at Varadero.

The investigation determined that the aircraft was not in danger of losing the VTP during the flight, either through loss of static strength or loss of stiffness.



### 2.2.5 Decision not to Declare an Emergency

The timely declaration of an emergency allows the aircrews to be helped to the greatest possible extent when dealing with abno rmal or emergency situations.

Declaring an emergency and clea rly communicating the nature of the problem allows ATC to more easily coordinate between units and anticip ate the needs of the crew in planning traffic management. It also serves to ensure that the flight will get immediate attention from controllers should the situation change. If AT C is aware that an aircraft is having control difficulties, it can incorporate this knowledge into its planning, and provide, among other things, more manoeuvring space and a longer fi nal approach. Without this information, there could be unexpected and undesirable consequence such as the aircraft being unable to comply with ATC requests resulting in the requirem ent to execute a missed approach or other manoeuvre that would delay landing.

Air Transatís operations manual recognizes that there are a wide variety of possible emergency

situations and leaves it to the discretion of the crew as to when an emergency should be declared. In this occurrence, by the time the crew was in a position to communicate to ATC, they had full control of the aircraft and did no t feel it necessary to declare an emergency.



### 2.2.6 Crew Communication and Decision Making

In abnormal and emergency situations, effectiv e crew communication enhances effective pilot decision making in that decisions will be based on all available informatio n. In this occurrence, information that might have been relevant, specif ically the magnitude of the forces incurred in the aft galley and the subsequent adverse effects or a description of the noise (volume and type of sound) heard by the FAs, was not communicated to the flight crew.

This information was not communicated because, gi ven the intensity of the noise and vibration,

all members of the cabin crew assumed that their experience was representative of the experience throughout the cabin. In addition, th e captain assumed that, if potentially valuable
information existed within the cabin, the FD would have such information and would provide it without being asked.

The assumptions persisted despite training give n to all crew members that emphasized the importance of sharing all information and not assuming other crew members have a complete understanding of events. Air Transatís written pr ocedures provide a structured format for the flight crew to provide a briefing to cabin crew but there is no requirement for the FD to seek

information from the rest of the crew.A NALYSIS

T RANSPORTATION S AFETY B OARD 55 In this case, the provision of information related to the severity of events experienced in the aft cabin may not have had a significant impact on th e decisions taken by the crew or the outcome
of the occurrence. However, in other circumstanc es, the lack of information could have severe consequences. Procedures and practices that do not facilitate information sharing between crew

members increase the likelihood that decisions will be based on incomplete or inaccurate information, placing passengers and crew at risk.



## 2.3 Maintenance

2.3.1 Maintenance Program

No shortcomings were found in the Air Tr ansat maintenance organization, facilities, procedures, the control of maintenance activities , or personnel qualifications. It was concluded

that the aircraft was maintained in accord ance with the approved maintenance program.



### 2.3.2 Maintenance Records

The investigation examined the maintenance reco rds of Air Transat as well as those of the aircraftís previous owner. There were no rema rkable issues with the rudder, apart from the repair of some minor lightning strike damage at the tip of the rudder approximately eight years prior.



### 2.3.3 Hinge Bearing Condition

Although the occurrence aircraft had one rudder hinge line bearing at position 2 that exceeded the AMM tolerances and 3 of 10 VTP side hinge ar m bearings that were partly seized, there had been no reports of rudder vibration on the o ccurrence aircraft, no si gnificant free play was measured on the residuals, and partially seized bearings could still be rotated. It is therefore concluded that the general condition of the rudder hinges indicates that they were not a factor

in the occurrence.



### 2.3.4 Adequacy of Rudder Inspection Program

Daily and transit checks of the rudder consis t of a GVI conducted from the ground. These inspections can only detect significant external damage because the rudder is as high as 15 m in the air, and the view of the rudder is partially blocked by the horizontal stabilizer. Therefore, the daily and transit checks are limited in their effectiveness to detect rudder damage.

Air Transat conducts the 2-C check of the rudde r every 30 months and it consists of a GVI conducted at armís length. This inspection can only detect externally visible damage. It does not
assess the inside condition of the rudder, nor de tect such anomalies as inner skin disbonds or fluid ingress. Therefore, the 2-C chec k is limited in its effectiveness.

A tap test of the rudder side panels is conducted every five years. This tap test is limited to a 40 mm-wide strip along the front edge of the rudder side panels, and a similar narrow strip along the lower part of the trailing edge. This inspection cannot detect damage in the side panels outside these limited areas, and the tap te st will only detect large inner-skin disbonds. Therefore, the five-year inspection is limited in its effectiveness.A NALYSIS

56 T RANSPORTATION S AFETY B OARD During the fleet-wide inspection that followed th e occurrence, other NDI techniques were used such as ELCH, X-ray, ultrasonic, and thermograp hy, and they demonstrated their effectiveness in finding damage not detected by tap test or visual inspection. For ex ample, these techniques were responsible for finding cases of water in gress and inner-skin di sbond. Although these alternate NDI techniques are ava ilable, and even used on other parts of the aircraft (that is, thermography is used to inspect the elevators), they are not part of the scheduled maintenance program for the rudder. Therefore, there are more effective NDI techniques available than those used by the current maintenance program.

An effective inspection program must offer an acceptable probability of detecting damage before it can grow to critical size. The occu rrence rudder did receive its five-year tap-test inspection in May 2001, and during the interv ening period, it was visually inspected in accordance with the maintenance program with no finding. Nevertheless, the limitation of the inspection techniques does not guarantee that th ere was no damage present that could grow to

critical size without detection. Therefore, the current inspection program is not adequate to detect damage to the rudder assembly in a timely and consistent manner.



## 2.4 Recorders

2.4.1 Cockpit Voice Recorder Duration

The lack of information from the 30-minute CV R regarding the rudder-loss event, including the noises heard by the cockpit and cabin crew and the associated vibrations, hindered the investigation. A two-hour CVR would have capt ured the sounds of the vibrations on the cockpit area microphone, providing important in formation on the vibration frequencies. The lack of adequate data increased the workload of investigators and hampered their ability to obtain a timely, complete, and accu rate understanding of the event.



### 2.4.2 Digital Flight Data Recorder Data Sampling

A two-second highly dynamic event was identified when the DFDR and the DAR data were merged and lateral accelerations were compared. The determination of the frequencies involved was not possible due to the low sampling rates of the recorded accelerations. Although the sampling rates meet current performance standar ds required by regulation, they were not adequate for capturing the highly dynamic co nditions that may exist during an accident.



### 2.4.3 Digital Flight Data Recorder Filtered Data

To investigate the rudder failure and resulting aircraft response, a performance analysis was undertaken that required accurate control su rface position data. The DFDRñrecorded control surface position data are not the raw sensor data. The raw sensor data are filtered by the system data analog converter before being recorded . The probable rudder position history was calculated using filtered information. The anal ysis suggested that the filtering produced 0.4-second data latency and reduced the amplitude by up to 1° during the initial high-frequency oscillations. The rudder position filtering and the necessity for additional analysis adversely affected the accuracy and effectiven ess of the investigation efforts.A NALYSIS

T RANSPORTATION S AFETY B OARD 57 

### 2.4.4 Preservation of Recorder Information

In this occurrence, disabling the CVR at engine shutdown would not have prevented the loss of

information recorded at the time of the rudder failure, because the CVR was a 30-minute device,

and the event occurred more than one hour before landing in Varadero. Nevertheless, there are situations for which securing the recorders afte r landing will preserve valuable evidence, as past investigations have shown 

### (TSB reports A00A0185, A00P0040, and A01W0117). No procedure for disabling recorders afte r landing was available to the crew.



## 2.5 Analysis of Rudder Failure Mechanism

2.5.1 General

The investigation studied the possibility of the rudde r failing either as a result of a static loading phenomenon or of a dynamic loading phenomenon.



### 2.5.2 Static Loading Phenomenon

2.5.2.1 Large Rudder Deflection

The rudder control system was operating correct ly and no indications were found that the rudder made a deflection beyond authorized deflec tion limits. It is concluded that the failure was not caused by a large rudder deflection.



### 2.5.2.2 High Static Load

The investigation reviewed the static load tests, sub-component tests, and damage tolerance tests that had been conducted during initial ce rtification, and concluded that the rudder was designed with adequate strength to react to static loads encountered within the structural design envelope. A review of recorder informat ion revealed that the aircraft was operating within its design envelope and that it did no t experience a high load event either on the occurrence flight or on an earlier flight. It is co ncluded that the failure was not caused by a high

static load.



### 2.5.3 Dynamic Loading Phenomenon

The analysis of the lateral load signal from the DFDR and DAR found an indication that the occurrence was associated with a dynamic even t. The following were examined as possible causes of this dynamic event.



### 2.5.3.1 High-Frequency Control Input

The investigation of the aircraft systems did not reveal any conditions that would have resulted in a control-induced dynamic event. DFDR and DAR recordings did not show any indications of high-frequency control movement in the period leading up to the occurrence. It is concluded that the dynamic event was not caused by a high-frequency input from the control system.A NALYSIS

58 T RANSPORTATION S AFETY B OARD 

### 2.5.3.2 Flutter

The lateral load signals recorded, the damage to the VTP main attachment fittings, the damage to the rudder hinge arms at positions 5 and 6, as well as the noise and vibrations felt during the

event are consistent with flutter.



### 2.5.4 Possible Causes of Flutter

2.5.4.1 Flutter without Prior Structural Deviation

Flutter analysis confirmed that a rudder with no st ructural deviations will not flutter within the design envelope. The investigation showed that the rudder was operated within the design envelope; therefore, the rudder did not experience flutter without a prior structural deviation.



### 2.5.4.2 Flutter Following Structural Deviation

The investigation revealed that rudder imbal ance and hinge free play would not have led to flutter. It was determined that the most prob able cause of flutter was a large disbond-type damage. The presence of additional minor fa ctors such as possible water trapped in the honeycomb and excess paint would marginally re duce the size of the disbond necessary to

cause the flutter.



### 2.5.5 Growth of Rudder Damage

Vacuum cycling tests conducted resulted in dama ge growth. Therefore, the pressure differential between the air inside the honeycomb and the redu ced external air pressure at cruise altitude might have acted as the driving force for the grow th of core/face sheet separations or in-plane

core fractures.

This particular rudder design does not include any damage growth arrest features in the side panels such as a mechanical barrier. Once damage starts to grow , it can continue to grow until it

reaches critical size. Such a feature was no t specifically demanded for certification.



### 2.5.6 Possible Causes of Rudder Damage

2.5.6.1 Manufacturing Process

Examination of the rudder residuals determined that correct resin systems had been used and that the degree of cure was adequate. Although this analysis was based on the examination of only the small amount of the rudder that remained ósince each side panel, spar, or rib is cured as a unitóthe state of the small residuals is repr esentative of the overall components. Therefore, the entire rudder was most probably construc ted using the correct resin system and was adequately cured.

Some non-conformities in the occurrence rudder were found by quality assurance at
manufacture, and corrected. Since most of th e rudder was missing, it was not possible to

examine each of these locations on the residuals and formally exclude them as a cause of theA NALYSIS

T RANSPORTATION S AFETY B OARD 59 occurrence. However, a review of the repair sc hemes, repair procedures, and quality assurance

used to correct these non-conformities was conduc ted, and did not reveal any inadequacies. It is considered improbable that these part icular repairs led to the occurrence.

The residuals showed indications of possible insu fficient bonding pressure during cure at the bond between the honeycomb and the inner skin along the edges of the z-section of the left side panel within a width of 20 mm. Subsequent investigation revealed that low bonding just aft of the z-section could be caused by insufficient caul plate pressure during cure as a result of mispositioning of the z-section, or of adverse accumulation of tolerances. This deviation would not necessarily be open to the outside air and could grow by vacuum cycling loads into a disbond. Further computer analysis determined t hat it was possible for such a disbond to grow under the influence of vacuum cycling. Th is deviation would have been present since manufacture and is a possible cause of the initial damage to the rudder.



### 2.5.6.2 Material Degradation

It is improbable that the occurrence rudder was damaged due to degradation by fatigue, aging,
chemical contamination, or ex posure to high temperature.



### 2.5.6.3 Mechanical Damage

It is improbable that the initial damage to the rudder was caused as a result of grinding damage, water ingress in the honeycombs, a seized hinge point, or the LPP repair.

Impact damage tests conducted during the course of this investigation demonstrated that, although blunt impact could cause core crush, it could not cause disbonds. Subsequent vacuum cycling tests demonstrated that core crush dama ge did not grow. Therefore, it is improbable that the initial damage was caused by a blunt impact. Since the misuse of high-pressure spray jets would likely result in damage similar to blunt impacts, it is also improbable that the initial damage to the rudder was caused by the misuse of high-pressure spray jets.

There was no evidence of impact damage on th e residuals, but only a small amount of rudder survived for examination. The investigation was not able to discount the possibility that the rudder may have experienced a discrete event 12 that resulted in significant damages either on the ground or in flight.

The lightning strike to the tip of the rudder appr oximately eight years prior was a discrete event that could not be discounted as a possible cause of the initial damage since the entire upper end of the rudder was missing and could not be examined.

12 The term discrete event is used to refer to an occurrence that could have resulted in significant damages to the rudder either on the ground or in flight. Possibilities include, but are not limited to, impact by foreign obje cts or a lightning strike. Such damage cannot be discounted as a possible ca use because only a small amount of the rudder survived for examination, and because visual inspection of the rudder from the ground is limited.A NALYSIS

60 T RANSPORTATION S AFETY B OARD 

### 2.5.7 Failure Scenarios

2.5.7.1 Summary of Important Points

• The dynamic event was most probably caus ed by rudder flutter. Flutter analysis showed that the rudder would only flutter un der the occurrence conditions if it were damaged. Therefore, the rudder was most probably damaged. Flutter analysis determined that the amount of damage necessary to cause flutter was significant. The occurrence conditions had been experienced by the aircraft many times previous, but the rudder had not experienced vibration, flu tter, or failure. Therefore, the original damage was most likely small and grew over time.

• Although the mechanical cycling tests that were conducted during the original certification showed no damage growth, va cuum cycling tests conducted during this investigation demonstrated that it is possi ble for an initial damage to grow due to pressure differential as sociated with altitude.

• Results of investigative activity did not support the likelihood of a blunt impact

scenario. A discrete event could not be disc ounted as a possibility since most of the

rudder was not recovered for examinatio n. Positive indications were found suggesting the possibility of a weak z-section bond at the interior lower front of the left side panel, and analyses showed t hat such damage could grow under vacuum

loads.

• The interior skin is not easily accessibl e for inspection, and at the time of the occurrence, there was no inspection progra m for the inner skin. If the damage had been growing on the interior, it woul d not have been found by the existing inspections. A weak z-section bond would manifest itself in the bond of the inner

skin.

• In the time leading up to, and at the time of the occurrence, the aircraft was neither manoeuvring nor experiencing turbulence. Ther efore, the most significant load on the rudder would have been pressure different ial between the core interior and the ambient air at altitude. This suggests that differential pressure may have driven the

event.

• The investigation revealed that the first ev ent in the occurrence sequence was a loud bang. Vacuum cycling damage growth test s found that, when the damage reached critical size, it grew explosively with a sudden violent release of energy, which

caused a loud noise.

• The vacuum cycling tests found that explosiv e damage growth was so violent that it damaged the interior of the test chamber. In flight, such a violent event could possibly damage the opposite side panel. The flight dynamics analysis found that there was a large lateral force at the rudder, possibly the explosive damage growth in one side panel striking the other side panel.A NALYSIS

T RANSPORTATION S AFETY B OARD 61 • The sudden explosive growth of damage in one side panel and possible collateral damage to the adjacent panel would have resulted in a sudden reduction of rudder stiffness. The flutter analysis indicated that su ch a loss in stiffness could lead to flutter

under the occurrence conditions.

• The time-domain flutter analysis for the larg e disbond case found that, shortly after the initiation of flutter, a large aft force at hinge 5 would exceed the failure load. This is consistent with the flight dynamics analysis that found that, shortly after the initial event, there was a large aft and downward tug on the tail. This is also consistent with the damage observed at hinge 5.

• The time-domain flutter analysis for the larg e disbond case also found that the next hinge to fail would be hinge 6, and that the loads on the rear VTP main attachment fittings would exceed ultimate strength. This is consistent with the damage observed at hinge 6 and at the VTP attachments.



### 2.5.7.2 Most Likely Failure Scenario

Some time before the occurrence flight, a disbond or in-plane core fracture occurred. The cause of this initial damage may have been a discrete event or a weak bond at the z-section. An indication of weak bonding was found at the z-se ction along the interior lower front of the left side panel. This damage then grew, possibly du e to reduced pressure cycling loads associated with normal flight, without detectio n until it reached a critical size.

During the occurrence flight, having reached the critical size, the damage rapidly propagated, resulting in a loud and sudden explosion of th e skin. This separation could have damaged the opposite side panel and created a large sidewa ys force on the empennage. The resulting sudden

reduction in torsional stiffness led to the onset of rudder flutter. About one second later, there was a large aft and downward force associated wi th failure of the upper hinge points, as the rudder separated. The rudder-separation event la sted about seven seconds, after which only 16 per cent of rudder effectiveness remained. Du ring the remainder of the flight, more rudder pieces separated, and the aircraft landed with no aerodynamically effective rudder remaining.C ONCLUSIONS

T RANSPORTATION S AFETY B OARD 63 

# 3.0 Conclusions

3.1 Findings as to Causes and Contributing Factors

1. The aircraft took off from Varadero with a pre-existing disbond or an in-plane core fracture damage to the rudder, caused by either a discrete event, but not a blunt impact, or a weak bond at the z-section of the left side panel. This damage deteriorated in flight, ultimately resulting in the loss of the rudder.

2. The manufacturerís recommended inspecti on program for the aircraft was not adequate to detect all rudder defects; th e damage may have been present for many flights before the occurrence flight.

3. This model of rudder does not include any design features in the sandwich panels to mechanically arrest the growth of disbond da mage or in-plane core failure before the damaged area reaches critical size (such a feature was not specifically demanded for certification).



## 3.2 Findings as to Risk

1. A cockpit voice recorder with a 30-minute recording capacity was installed on the aircraft, and its length was insufficient to capture the rudder-loss event, resulting in critical information concerning the rudder fa ilure not being available to investigators.

2. There was no published procedure for disab ling the recorders once the aircraft was on the ground; valuable investigation info rmation can be lost if the data are not preserved.

3. The sampling intervals for lateral and long itudinal acceleration captured by the digital flight data recorder were insufficien t to record the highly dynamic conditions present at the time of the occurrence. This resulted in incomplete information being

recorded.

4. The rudder position filtering and the nece ssity for additional analysis adversely affected the accuracy and effectiven ess of the investigation efforts.

5. There are insufficient published procedures av ailable to flight crew members to assist in recovering from a Dutch roll.

6. Declaring an emergency and clearly communica ting the nature of the problem allows air traffic control to more easily coordinat e between units and anticipate the needs of the crew in planning traffic management.

7. Procedures and practices that do not fa cilitate information sharing between crew

members increase the likelihood that deci sions will be based on incomplete or inaccurate information, potentially placing passengers and crew at risk.C ONCLUSIONS

64 T RANSPORTATION S AFETY B OARD 

## 3.3 Other Findings

1. Throughout the event, the crew received no electronic centralized aircraft monitor message relating to the control problem that the aircraft had experienced, and there were no other warning lights or cockpit in dications of an aircraft malfunction.

2. After the rudder-separation event, the aircraft was not in danger of losing the vertical tail plane during the flight, either through lo ss of static strength or loss of stiffness.S AFETY A CTION

T RANSPORTATION S AFETY B OARD 65 

# 4.0 Safety Action

4.1 Action Taken

4.1.1 Transportation Safety Board of Canada

4.1.1.1 TSB RecommendationsóAirbus Composite Rudder Inspection Program

The separation of the rudder from Air Transat Flight 961 and the damage found during the post-occurrence fleet inspections suggest that the current inspection program for Airbus composite rudders may not be adequate to prov ide for the timely detection of defects. In addition, preliminary tests demonstrating that disbonds can grow due to altitude-related pressure differential suggest th at increased attention is warranted to mitigate the risk of additional rudder structural failures. The conseq uences of a rudder separation include reduced directional control and possible separati on of the vertical tail plane (VTP).

Therefore, on 27 March 2006, the Board recommended that:

The Department of Transport, in coordination with other involved regulatory authorities and industry, urgently develop and implement an inspection program that will allow early and consistent detection of damage to the rudder assembly of ai rcraft equipped with part number A55471500 series rudders. (A 06-05, issued March 2006)

On 14 June 2006, Transport Canada (TC) responded to Board Recommendation A06-05. TC concurs with the TSB suggestion that the curre nt A310-300 inspection program may not be adequate to provide timely detection of defects to the rudder assembly.

Specifically, TC has indicated that the fo llowing corrective actions will be taken:

• A letter will be sent to Airbus and the Di rection GÈnÈrale de líAviation Civile (DGAC) of France detailing the results ofadditional inspection on a Canadianregistered A310-300 series aircraft.

• TC will recommend that a detailed inspection of the drainage path of the rudder for blockage be added to the current inspection program to ensure that there is adequate drainage.

• TC will request that Airbus review the cu rrent inspection program for the vertical stabilizer and rudder assembly for the A300/A310 aircraft series.

• A tap test is potentially not effective in determining small areas of delamination or disbond of composite materials; therefore, TC is working with the National Research Council of Canada to identify more suitable inspection techniques to detect failures in composite materials.S AFETY A CTION

66 T RANSPORTATION S AFETY B OARD • To better identify failures in composite material, TC will coordinate with the

International Maintenance Review Board to review the logic used in developing maintenance programs.

The TSB has reviewed TCís response and assessed it as Satisfactory Intent.

Further, on 27 March 2006, the Board recommended that:

The European Aviation Safety Agency, in coordination with other involved regulatory authorities and industry, urgently develop and implement an inspection program that will allow early and consistent detection of damage to the rudder assembly of ai rcraft equipped with part number A55471500 series rudders. (A 06-06, issued March 2006)

On 22 November 2006, the European Aviation Safety Agency (EASA) stated that it agreed with

Board Recommendation A06-06 and that Airworth iness Directive 2006-0066 issued on 24 March 2006 requiring a mandatory one-time inspec tion satisfactorily addressed the Board

recommendation.

Although the EASA agreed with the Board re commendation, Airworthiness Directive 2006-0066 referenced in its 22 November 2006 response does not provide for a repetitive inspection cycle that will allow early and consistent detection of damage, as is implied in the core of Recommendation A06-06. Nevertheless, the TSB assessed that the EASA is well positioned to take a leadership role within the industry in advocating for the development and integration of an inspection program dealing with composite mate rials. On that basis, a conference call was

initiated on 20 December 2006.

Following the conference call, the EASA released a further response dated 17 January 2007. This response stated that all elements that may have potentially caus ed the damage growth were still being investigated. Furthermore, the EASA stat ed that, within the Continued Airworthiness process and in cooperation with Airbus, it continues its efforts to determine the most appropriate corrective actions. Subsequently, th e EASA will consider mandating those actions, including amending the maintenance progra m to require repetitive inspections.

The 17 January 2007 response reflects EASAís commitment to continue to develop corrective actions that may include amending the mainte nance program to require repetitive checks. Because EASAís most recent response contains a proposed action that, if implemented, will

reduce or eliminate the risks associated with this deficiency, the response to Recommendation A06-06 is assessed as Satisfactory Intent

**.**



### 4.1.1.2 TSB Safety AdvisoryóCockpit Voice Recorder Duration

The cockpit voice recorder (CVR) installe d on Air Transat Flight 961 employed a continuous-loop magnetic tape of 30-minute du ration. The event of the rudder separation on the Air Transat Flight 961 CVR was recorded a pproximately 60 minutes before landing. Crew conversations and cockpit sounds before the ev ent of the CVR recording may have provided substantial insight into any initia ting or precursor events that led to the accident. Given theS AFETY A CTION

T RANSPORTATION S AFETY B OARD 67 need for longer periods of recorded sound to capt ure the initiating events of aviation accidents and the availability of two-hour CVRs, the Bo ard believes that such recorders should be mandated by regulatory authorities worldwide.

Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC re-addressing its
concern that, in 2005, there are still commercial ai rcraft not equipped with a CVR with at least two-hour recording capacity.



### 4.1.1.3 TSB Safety AdvisoryóDigital Flight Data Recorder Recording of Filtered Data

With filtering, the ability to differentiate be tween a rudder excursion and a data filtering artefact is limited. The filtering of raw sensor da ta necessitated additional analysis to estimate the probable rudder position history, ultimately affecting the accuracy and timeliness of the investigation efforts. The Canadian Aviation Regulations (CARs) do not address the requirement to test parameter accuracy under both static and dynamic conditions as does 14 CFR ( Code of Federal Regulations ) of the United States. The CARs contin ue to refer to the previous minimum operational performance specifications (MOPS) for flight recorders (ED55), rather than the current ED112, which offers guidelines on da ta filtering. The curre nt Federal Aviation Administration (FAA) Notice of Proposed Ru le Making (issued 28 February 2005) regarding revision of digital flight data recorder (DFD R) regulations does not address the recurring problem of filtered data.

Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC addressing its concern that data filtering may prevent investig ators from determining accurate control surface positions from recorded data, part icularly under dynamic conditions.



### 4.1.1.4 TSB Safety AdvisoryóDigital Flight Data Recorder Low Recording Rates

The Air Transat occurrence demonstrated that fu rther improvements to DFDRs are needed to more effectively determine the sequence of events in an accurate and timely manner. Specifically, due to the low recording rates for acceleration data, the existence of aeroelastic effects as a possible failure mode could not be positively identified. The limited lateral acceleration data also prevented the c haracterization of the initiating event.

Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC addressing the possible conduct of a review of recording rate s of DFDR data to ensure that adequate information is made available to analyze dynamic flight events.



### 4.1.1.5 TSB Safety AdvisoryóDutch Roll Recovery Procedure

For this loss of rudder occurrence, the absence of sufficient guidance in Dutch roll recovery resulted in a situation wherein the crew engaged the autopilot, which led to a worsening of the flight characteristics. Although the engagement of the autopilot did not increase the severity of consequences for this occurrence, under other circumstances, such acti on might have led to an aircraft upset.S AFETY A CTION

68 T RANSPORTATION S AFETY B OARD Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC suggesting that TC, in concert with industry, FAA, DGAC, and EASA, ma y wish to conduct a review of the adequacy of published procedures to ensure that pilots have the required knowledge to safely recover

from a Dutch roll situation.



### 4.1.2 National Transportation Safety Board

As a result of its investigation into an Airbus A300-600 aircraft operated by FedEx Express that was damaged during routine maintenance on 27 November 2005, the National Transportation Safety Board (NTSB) recommended on 24 March 2006 that the FAA

Require that all operators of Airbus A-300 series airplanes immediately [possibly before further flight] comply with four Airbus All Operators Telexes (AOT) A300-55A6042, A3 10-55A2043, A330-55A3036, and A340-55A403 dated March 2, 2006. Any di sbonding to the rudder skins that occurs in the presence of hydraulic fl uid contamination should be repaired or the rudder should be replaced as soon as possible, well before the 2,500 flights specified in the AOTs. (A-06-27, issued March 2006)

The NTSB further recommended that the FAA

Establish a repetitive inspection in terval for Airbus premodification 8827 rudders until a terminating action is de veloped. The interval should be well below 2,500 flights. (A-06-28, issued March 2006)



### 4.1.3 Bureau díEnquÍtes et díAnalyses pour la SÈcuritÈ de líAviation Civile

On 10 March 2006, the Bureau díEnquÍtes et díAnal yses pour la SÈcuritÈ de líAviation Civile recommended that [translation] the EASA impose as soon as possible an appropriate inspection program for the concerned rudders (part number A55471500). (000 153/BEA/D, issued March 2006)



### 4.1.4 Airbus

4.1.4.1 All Operators Telex (AOT-1)

Based on the initial information uncovered during this TSB investigation, Airbus, on 17 March 2005, issued an AOT for the inspection of all ai rcraft equipped with part number A55471500 series rudders. This one-time visual and tap- test inspection involved 222 Airbus A310s,
146 Airbus A300-600s, 6 Airbus A330s, and 34 Airbus A340s, for a total of 408 aircraft. In addition, a more detailed inspection of rudder si de panels on over 20 aircraft was conducted using the elasticity laminate checker (ELCH) test method. Finally, the attention drawn to rudders by the occurrence resulted in operator s examining their rudders more closely during maintenance. These various inspections found ex amples of disbonds, damage around hoisting points and trailing edge fasteners of the rudder, corrosion and abrasion at hinges, seized hinges, hinges with excessive free play, and water ingress.S AFETY A CTION

T RANSPORTATION S AFETY B OARD 69 

### 4.1.4.2 All Operators Telex (AOT-2)

On 02 March 2006, the aircraft manufacturer issued a second series of AOTs for the inspection of all aircraft with rudder part number A55471500 series rudders. These AOTs were subsequently made mandatory by an Airworthine ss Directive issued by the EASA, representing the State of manufacture. The aim was to verify the structural integrity of the rudder by means of one-time tap-test inspection to the interior face sheets of the rudder side panels, as well as checking the drainage holes at the bottom of th e rudder and cleaning hydraulic fluid from the

external surfaces. Access to the interior of the rudder was through the inspection holes in the front spar of the rudder. It is noted that the acce ss to inboard surfaces from the inspection holes

is limited. No disbonds have been found.



### 4.1.5 Air Transat

4.1.5.1 Abnormal Situation

Based on the initial information uncovered during this investigation, Air Transat issued, on 10 November 2006, new procedures for situations that are not typical. The following text was

added to the Cabin Attendant Operation Manual :

[...]

When experiencing an abnormal situation, you must report to the Flight Director as soon as possible and describe the event such as, but not limited

to:

• Unusual odour

• Unusual noise

• Presence of an unusual object

• Instability of objects, passenger or crew

• Inappropriate passenger behavious

• Medical situation

Never assume that others experienced the same effects that you have or are fully aware of the events taking pl ace. Communication is the key for a proper evaluation of the situation an d appropriate corrective measures. If the Flight Director can not be reached and time is critical, Cabin Attendants must contact the Flight Deck Crew without delay.



### 4.1.5.2 Preservation of Recorder Information

Air Transat issued, on 16 May 2006, a new Accide nt/Incident Response Checklist as part of the Flight Crew Operating Manual for the A-310. A procedure to disable th e appropriate circuit breakers to preserve the recorded data for both the CVR and the DFDR is described. This new standard operating procedure also highlights th at preserving the recorded information is critical to the investigativ e process after an occurrence.S AFETY A CTION

70 T RANSPORTATION S AFETY B OARD This report concludes the Transportat ion Safety Boardís investigation into this occurrence. Consequently, the Board authorized the release of this report on 21 June 2007.

Visit the Transportation Safety Boardís Web site ( www.tsb.gc.ca ) for information about the Transportation Safety Board and its products and services. There you will also find links to other safety organizations and related sites.A PPENDICES

T RANSPORTATION S AFETY B OARD 71 

# Appendix A ñ Direct Access Recorder/Digital Flight Data Recorder Data ComparisonA PPENDICES

T RANSPORTATION S AFETY B OARD 73 

# Appendix B ñ Glossary

AFD assistant flight director AFRP aramid fibreñreinforced plastic agl above ground level

AIM Aeronautical Information Manual

AMM aircraft maintenance manual AMO approved maintenance organization AOC air operating certificate AOT all operators telex APYA autopilot yaw actuator ARINC aeronautical radio incorporated

asl above sea level ASTM American Society for Testing and Materials

ATC air traffic control ATPL airline transport pilot licence

CARs Canadian Aviation Regulations CFRP carbon fibreñreinforced plastic CG centre of gravity cm centimetre(s)

cm 2 square centimetre(s) CVR cockpit voice recorder daN decanewton(s)

DAR direct access recorder

DCB double cantilever beam DFDR digital flight data recorder DGAC Direction GÈnÈrale de líAviation Civile (France) DVI detailed visual inspection EASA European Aviation Safety Agency

ECAM electronic centralized aircraft monitor EDX energy dispersion X-ray spectroscopy ELCH elasticity laminate checker EUROCAE European Organisation for Civil Aviation Equipment FA flight attendant

FAA Federal Aviation Administration FCC flight control computer FD flight director FL flight level FOD foreign object damage g load factor GFRP glass fibreñreinforced plastic GVI general visual inspection GVI (G) general visual inspection from the ground of empennage GVI (A) general visual inspection at armís length of empennage GVT ground vibration test HIRF high-intensity radiated fields

Hz hertz

IR infraredA PPENDICES

74 TRANSPORTATION SAFETY BOARD KCAS knot(s) calibrated airspeed KFLL Fort Lauderdale/Hollywood International Airport kg kilogram(s) KIAS knot(s) indicated airspeed KMIA Miami International Airport kN kilonewton(s) LPP lightning protection plate m metre(s) m2 square metre(s)

m 3 cubic metre(s) mm millimetre(s)

mm 2 square millimetre(s) MOPS minimum operational pe rformance specifications MRTT multi-role tanker transport

MSN manufacturerís serial number MUVR Varadero/Juan Gualberto GÛmez International Airport N newton(s) NDI non-destructive inspection nm nautical mile(s) NTSB National Transportation Safety Board PPC pilot proficiency check QRH quick reference handbook QSMS quality safety management system

RTL rudder travel limiter

SB Service Bulletin SRM structural repair manual TC Transport Canada Tg glass transition temperature TSB Transportation Safety Board of Canada TSC921 Air Transat Flight 921 UFDR universal flight data recorder

UTC Coordinated Universal Time VTP vertical tail plane XPS X-ray photoelectron spectroscopy YD yaw damper ° degree(s) °C degree(s) Celsius