Aviation Investigation Report A05F0047

At 0645 Coordinated Universal Time (UTC), Air Transat Flight 961 (TSC961), an Airbus A310-308 aircraft, departed Varadero, Cuba, for Québec, Quebec, with 9 crew members and 262 passengers on board. At approximately 0702 UTC, the aircraft was 90 nautical miles south of Miami, Florida, United States, and in level flight at flight level (FL) 350, when the flight crew heard a loud bang and felt some vibration. The aircraft entered a Dutch roll and the captain disconnected the autopilot to manually fly the aircraft. The aircraft climbed nearly 1000 feet while the captain tried to control the Dutch roll. The crew initiated a descent back to FL 350 and requested further descent and a possible diversion to Fort Lauderdale, Florida. During the descent, the Dutch roll intensity lessened and then stopped when the aircraft descended through FL 280. No emergency was declared. When the aircraft was abeam Miami, the crew decided to return to Varadero.

During the landing flare, the rudder control inputs were not effective in correcting for a slight crab. The aircraft landed and taxied to the gate. After shutdown, it was discovered that the aircraft rudder was missing. Small pieces of the rudder were still attached to the vertical stabilizer. One flight attendant suffered a minor back injury during the event.

1.1 History of the Flight

The pre-flight inspection was carried out by the captain before departure from Varadero; no damage was observed on the rudder. The inspection was conducted at night, the logo light was on, and the pilot was using a flashlight. However, it was difficult to see the entire rudder, especially the bottom part, which is partially concealed by the elevators. To see the bottom part, the pilot has to step back from the aircraft, thus reducing the acuity of the observation.

The crew engaged autopilot system No. 2 on departure from Varadero. The flight progressed normally until the aircraft reached flight level (FL)^{Footnote 1} 350, its assigned altitude. At approximately 0702 Coordinated Universal Time (UTC),^{Footnote 2} the flight crew heard a loud bang immediately followed by several seconds of vibration. Cabin crew members located in the back of the aircraft were thrown to the floor and unsecured galley carts moved freely. The aircraft started to Dutch roll,^{Footnote 3} and the captain took control and disconnected the autopilot. The aircraft was difficult to control in the lateral axis. In an attempt to better manage the cockpit workload, the other autopilot system (No. 1) was engaged. As the Dutch roll movement started to intensify, autopilot No. 1 was disengaged and the aircraft was hand-flown.

During these actions, the aircraft climbed to about FL 359. The flight crew requested a descent and informed air traffic control (ATC) that they had experienced an autopilot problem and had reverted to flying manually. While descending, the crew cycled through the electronic centralized aircraft monitor (ECAM) system pages in an attempt to diagnose the problem. Throughout the event, there was no ECAM message relating to the control problem that the aircraft had experienced, and there were no warning lights or cockpit indications of an aircraft malfunction. Even with limited clues as to the cause of the Dutch roll, the crew knew that descending to a lower altitude might lessen or stop the Dutch roll motion. Initial indications led to the possibility of the loss of both yaw dampers (YD) but both YD switches were engaged. Had a dual YD failure occurred, the flight warning computer would have triggered appropriate warnings and messages, and the autopilot would have disconnected.

The Dutch roll gradually decreased in the descent and ceased when the aircraft passed FL 280. The crew continued the descent to 10 000 feet above sea level (asl) in preparation for a landing in Fort Lauderdale. The captain returned control of the aircraft to the first officer and called the flight director (FD) to provide the standard briefing to the cabin crew for emergency or abnormal situations.

The crew contacted company dispatch to discuss the situation and elected to return to Varadero, where the company was better equipped to deal with the aircraft and the passengers. At 0739, the flight was cleared to Varadero at FL 190.

During the climb to FL 190, the crew engaged autopilot No. 1 and disengaged it during the final portion of the visual approach to Runway 06 at Varadero. During the landing flare, nose wheel steering was used for directional control on the runway. An uneventful landing was completed at 0819.

The crew conducted a flight control check after landing and the ECAM indicated that everything was normal. The aircraft was taxied to the gate where the passengers were deplaned normally through the main door. After shutdown, a visual inspection revealed that the aircraft rudder had broken and most of it was missing.

1.2 Injuries to Persons

	Crew	Passengers	Others	Total
Fatal	-	-	-	-
Serious	-	-	-	-
Minor/None	9	262	-	271
Total	9	262	-	271

1.3 Damage to the Aircraft

The rudder was substantially damaged (see Photo 1), and the rear attachment fittings of the vertical tail plane (VTP) were delaminated locally. There was minor damage to the tail cone.

1.4 Personnel Information

	Captain	First Officer
Pilot Licence	Airline Transport	Commercial
Medical Expiry Date	01 September 2005	01 July 2005
Total Flying Hours	10 795	11 305
Hours on Type	450	500
Hours Last 90 days	75	200
Hours on Type Last 90 Days	75	200
Hours on Duty Prior to Occurrence	4.6	4.6
Hours off Duty Prior to Work Period	60	60

1.4.1 Captain Information

The captain held a Canadian airline transport pilot licence (ATPL) - aeroplane, endorsed for single- and multi-engine land aeroplanes, with type ratings on Boeing 727, Boeing 737, Boeing 757, Convair 580, Airbus A310, Fokker 100, and Lockheed 1011 aircraft. His licence was endorsed with a Group 1 instrument rating valid until 01 September 2005.

The captain started working for the company as a captain on the Boeing 757 on 18 March 1996. In 1997, he qualified as captain on the Boeing 737-400 and flew it for about six months before returning as captain on the Boeing 757. In 2003, he began his conversion to the A310, and under the supervision of an Air Transat instructor, completed the A310 computer-based ground school. The flight simulator portion of the initial A310 training was conducted by Air Transat instructors at a training centre in Miami, Florida, from 12 to 27 August 2003. All training was in accordance with the company A310 training program.

The captain passed his initial pilot proficiency check (PPC) as an A310 captain on 27 August 2003, and his last line check was performed on 17 September 2004. His last PPC was performed on 14 December 2004. Company training records indicate that he had successfully completed all required recurrent training.

1.4.2 First Officer Information

The first officer held a commercial pilot licence - aeroplane, endorsed for single- and multi-engine land aeroplanes, with type ratings on Convair 580, Airbus A310, and Lockheed 1011 aircraft. His licence was endorsed with a Group 1 instrument rating valid until 01 December 2005.

The first officer started working for the company on 15 February 1988 as a flight engineer on the Lockheed 1011 aircraft, accumulating 8500 hours of flight time. He was qualified as first officer on the Lockheed 1011 on 18 June 2002. In 2004, he began conversion to the A310. Under the supervision of an Air Transat instructor, he completed the A310 computer-based training. The flight simulator portion of the initial A310 training was conducted by Air Transat instructors at a training centre in Montréal, Quebec, from 25 May to 15 June 2004. All training was in accordance with the company A310 training program.

The first officer passed his initial PPC as an A310 first officer on 15 June 2004, and his last line check was performed on 07 July 2004. His last PPC was performed on 08 October 2004. Company training records indicate that he had successfully completed all required recurrent training.

1.4.3 Flight Attendants

The cabin crew comprised seven flight attendants (FAs), including a flight director (FD) and an assistant flight director (AFD), all of whom had 10 to 16 years of service. They were qualified and trained in accordance with the requirements of Transport Canada and Air Transat.

1.5 Aircraft Information

1.5.1 General Information

The occurrence aircraft was an Airbus A310-308, manufacturer's serial number (MSN) 597. Transport Canada issued the certificate of registration on 16 May 2001 and the certificate of airworthiness on 16 June 2001, both valid at the time of the occurrence.

1.5.2 Aircraft History

The occurrence aircraft had its first flight in September 1991 and was delivered to a Middle Eastern airline in August 1992, where it remained until acquired by Air Transat in May 2001. At the time of the occurrence, the aircraft had accumulated 49 224 flight hours and 13 444 flight cycles. By comparison, the flight hour and flight cycle fleet leader aircraft for this aircraft type had accumulated 75 675 hours and 34 384 cycles respectively.

1.5.3 Vertical Tail Plane Design

The VTP consists of a spar box, leading edge fairing, trailing edge panels, and tip (see Figure 1). The spar box consists of left and right side panels each composed of solid carbon fibre-reinforced plastic (CFRP) laminate skin and interior stiffeners. At the bottom of each side panel, there are three large integrally constructed CFRP lugs, known as the main attachment fittings, which attach to the fuselage. At the front and rear of the box, there are solid CFRP laminate spars running the length of the VTP, joining the left and right skin panels, forming the front and rear faces of the spar box.

In the centre of the box, there is a shorter solid CFRP laminate spar, which extends only up to rib 5. At the bottom of each of these three spars are two integrally constructed lugs, known as transverse load fittings, which attach to the fuselage. Within the box, there are a total of 18 solid CFRP laminate ribs, including closing ribs at the bottom and top. The leading edge and the tip are constructed of sandwich composite. Attached to each side of the rear spar, and extending aft, there is a flat trailing edge panel that acts as an aerodynamic fairing to fill the gap between the rear spar of the VTP and the leading edge of the rudder.

There are seven hinge positions along the VTP rear spar for the attachment of the rudder. These are numbered 1 through 7, from bottom to top. Figure 2 shows the design details at these hinge points. At each hinge position, there is a CFRP fitting attached to the rear spar. Each CFRP fitting has two lugs, one on the left and one on the right. The two front arms of each V-shaped metal hinge arm fit into these lugs on the rear of the VTP spar.

The hinge arms are attached to the CFRP fittings with spherical bearings, so they are free to pivot up and down. The rear of each hinge arm contains a hinge point for the attachment of the rudder. The hinge arm at hinge position 4 is supported in the vertical direction by a metal structural tube referred to as the z-strut. All the vertical loads from the rudder are transferred to the VTP through the z-strut. Rudder movement is controlled by three hydraulic actuators located inside the VTP at hinge positions 2, 3, and 4. The forward ends of the actuators are attached to CFRP fittings on the rear spar of the VTP, and the aft ends are attached to aluminum alloy fittings on the front spar of the rudder.

1.5.4 Rudder Information

1.5.4.1 General

The occurrence rudder, serial number 1331, was of the part number series A55471500, which is in use on earlier production A310, A300-600, A330, and A340 aircraft. It was the same rudder that had been originally installed on the occurrence aircraft at the time of manufacture in 1991. This rudder was one of the first in a batch of five rudders whose side panels were manufactured by the company Soko in Mostar, former Yugoslavia. The side panels were shipped from Soko to Airbus in Stade, Germany, where they were assembled into rudders.

1.5.4.2 Rudder Design

The rudder consists of a single spar at the front, two side panels that fasten together at the trailing edge, and top and bottom closing ribs (see Figure 3). The side panels are of single-piece construction and do not include any design features to mechanically arrest the growth of disbond damage. Each side panel is a sandwich composite constructed of a non-metallic Nomex® aramid-based honeycomb core, with CFRP face sheets, and a glass fibre-reinforced plastic (GFRP) intermediate layer between the CFRP and the honeycomb as shown in Figure 4. The GFRP intermediate layer does not have a structural purpose. It is simply a carrier for the resin that bonds the CFRP to the honeycomb. There is a layer of Tedlar® on the interior face to provide a moisture barrier, and a layer of film adhesive (AF 126) on the exterior face to provide aerodynamic smoothness. The density and thickness of the honeycomb and the number of face sheets vary with location because they are designed to react to applicable loads.

Different pieces of honeycomb are bonded together along their side edges by a splice bonding adhesive. This same adhesive is also used to bond the side edges of the honeycomb to the z-section. The forward and bottom edges of the side panels are made with a pre-cured CFRP z-section. The side panels are fastened to the spar and ribs using blind mechanical fasteners.

There are three aluminum lightning protection plates (LPPs) running chordwise on each side panel. To avoid galvanic reaction between these metal plates and the CFRP, there is an intermediate insulating layer of GFRP. There is a single spar, located along the front edge of the rudder and running the entire length of the rudder. The spar is a sandwich composite constructed of a Nomex® honeycomb core with CFRP face sheets. There are seven lightening holes distributed along the length of the spar.

There are only two ribs within the rudder. Rib 0 is the closing rib at the bottom of the rudder and is a sandwich composite constructed of a Nomex® honeycomb core with CFRP face sheets. Rib 54a, constructed of aluminum, is the closing rib at the top of the rudder. The leading edge fairing of the rudder is divided into multiple sections along its length, each constructed of sandwich composite (see Figure 4). The leading edge fairing sections are fastened to the side panel z-sections with threaded fasteners. There is an aluminum alloy strip along this row of fasteners as part of the lightning-protection system. Attached to the z-section at the bottom of each side panel is a rubber weatherstrip that covers the gap between the bottom of the rudder and the top of the tail cone. The weatherstrip is attached with threaded fasteners, and a metal strip is used as a washer plate along this row of fasteners. The side panels attach together at the rear of the rudder by a row of mechanical fasteners running parallel to the trailing edge, roughly 30 cm ahead of the trailing edge. A metal protective strip runs down the entire length of the rudder trailing edge, which is also attached using mechanical fasteners. There are three hoisting points on each side panel.

There are seven hinge positions, numbered 1 through 7, from bottom to top. Figure 5 shows the design details at these hinge points. At each hinge position, aluminum alloy fittings are attached to solid GFRP blocks integrated locally into the side panels and to the spar web by mechanical fasteners. The core of the spar web, where the fasteners pass through, is filled by core filler and reinforced by an aluminum backing plate. The three control actuators attach to the rudder at hinge positions 2, 3, and 4. The metal hinge fittings at these locations have two lugs, one to act as the hinge point, and one to attach to a hydraulic actuator.

1.5.5 Rudder Manufacturing Method

The rudder side panels, rudder spar, and rib 0 are manufactured and cured separately and then assembled with mechanical fasteners into a rudder. Each side panel is assembled in a mold, with the exterior face on the bottom against the face of the mold. During curing, the manufacturing process results in the lower (outer) skin having a stronger bond. Although both bonds exceed design requirements, the inner skin bond does so by a smaller margin. The three LPPs are integrally manufactured and co-cured with the side panel.

1.5.6 Rudder Manufacturing Records

Some manufacturing records for the side panels of the occurrence rudder were lost when the factory was bombed during the Yugoslavian war. Manufacturing records available at Airbus in Stade, Germany, and Toulouse, France, were reviewed for the occurrence rudder. This review found that non-conformities were detected by the quality assurance system, corrective actions were defined, rework was conducted, and the final product was inspected and released as airworthy. These non-conformities included such items as the position of hoisting points, the resistance of the anti-static paint, and various splice bond, skin and core filler re-works. The quality assurance of the Soko components was always under the responsibility of Airbus. The manufacturing records indicated that the rudder was in an airworthy condition at final assembly.

1.5.7 Rudder Modification Status

The following is the modification status of the occurrence rudder:

• Modification 5844 (Glass Intermediate Layer). The occurrence rudder was a post-modification 5844 (Service Bulletin [SB] A310-55-2012) design, which incorporated a GFRP layer between the honeycomb and the CFRP skin, rather than aramid fibre-reinforced plastic (AFRP) as used in earlier design.
• Modification 8408 (Change in Honeycomb Size). The occurrence rudder was a post modification 8408 configuration, which incorporated increased density honeycomb at certain locations.
• Modification 8827 (Change in Spar Construction). The occurrence rudder was pre modification 8827, meaning its spar had the earlier design Nomex® honeycomb/CFRP sandwich spar, rather than the solid CFRP spar of later design.
• Modification 5185 (Single-Piece Side Panels). The occurrence rudder was post-serial 1035, which means that the side panels were each constructed as a single panel. Earlier side panels were constructed of two parts, top and bottom, with a chordwise joint.
• Modification SRM (structural repair manual) 55-41-12 (Reinforcing Bolts in GFRP Blocks). The occurrence rudder had received modification SRM 55-41-12, Paragraph 27, during manufacture. This modification added reinforcing bolts through the GFRP blocks at the hinge point level.

1.5.8 Rudder Control System

1.5.8.1 Rudder Control System Components

The following is a descriptive list of the Airbus A310 rudder control system components:

• The rudder pedals, the rudder trim actuator, the two YD actuators, and the autopilot yaw actuator (APYA), which command the rudder to move.
• The push rods, the bell cranks, and the tension regulator and cables, also referred to as linkage, which transmit rudder commands.
• The three servo-controls - upper, middle, and lower - which operate the rudder. (The maximum rudder actuation rate with no load is 60 ± 5° per second. The maximum rudder deflection is 30° either left or right.)
• The differential unit, a mechanical device, which sends a command to the rudder servo-controls. This unit sums the pilot or the autopilot input and the YD input.
• The two rudder travel limiter (RTL) systems, which provide a variable stop, limiting the travel of the rudder mechanical linkage downstream of the differential unit, and thus the input to the three servo-controls as the airspeed increases.
• The transmitter, located on the fin at rib 1 and connected to the rudder with a rod attached to fitting No. 1, which indicates the rudder surface position to the appropriate ECAM display unit.

1.5.8.2 Rudder Control System Operation

The YD actuators are electro-hydraulic mechanisms that operate the YD system. The YD system has three functions: Dutch roll damper; turn coordinator; and yaw compensator during an engine failure on take-off or go-around. The YD commands are limited by software in the flight augmentation computers to a maximum of 39° of rudder movement per second. The maximum allowable displacement of the rudder by the YD is ±10° at indicated airspeeds up to 165 knots. The maximum allowable displacement at indicated airspeeds greater than 165 knots is determined by a formula (10 x (165/knots indicated airspeed [KIAS]) ^{Footnote 2}).

As the aircraft was flying at an indicated airspeed of 270 knots at the time of the occurrence, the maximum displacement of the rudder by the YD was of ±3.7°. The YD and the rudder pedals are not linked, so YD inputs do not result in pedal motion. Rudder pedal and YD commands are restricted to the limits imposed by the RTL system. Rudder position is determined by the sum of the pilot or autopilot input and the YD commands limited by the travel limitation unit.

The APYA, which produces yaw autopilot commands, is a single unit that houses two electro-hydraulic actuators, each controlled by a flight control computer (FCC). The APYA has an output lever that is connected through a torque limiter to the main bell crank. The torque limiter allows a pilot to override autopilot output by applying about 65 decanewtons (daN) more than the rudder pedal feel forces. Autopilot yaw control commands are limited by software in the FCC to a maximum of 34° of rudder per second. The APYA and the rudder pedals are rigidly linked; therefore, autopilot yaw input results in pedal motion.

The RTL system reduces the maximum allowable rudder deflection as airspeed increases. The limitation is such that the maximum deflection that can be achieved by the rudder remains lower than the deflection that would induce limit loads on the structure throughout the flight envelope.

1.5.8.3 Dutch Roll Description

The Airplane Upset Recovery Training Aid^{Footnote 4} describes the Dutch roll as follows:

Static directional stability is a measure of the tendency of an airplane to weathervane into the free stream air mass. The vertical fin and distribution of flat plate area aft of the CG [centre of gravity] tend to reduce sideslip and add to good directional stability. All conventional airplanes require positive static directional stability. In simple terms, an airplane with good directional stability always wants to point directly into the relative wind - zero sideslip. As directional stability increases, the speed at which the aircraft returns to zero sideslip after being disturbed increases (higher frequency). In order to minimize overshoots in sideslip, the damping in the directional axis must be increased as the directional stability is increased. An undesirable characteristic can develop when the directional damping is not adequate enough to prevent overshoots in sideslip. A phenomenon known as "Dutch roll" (based on the similarity with the motions of high-speed ice skaters) can occur. A Dutch roll occurs when yaw rates produce sideslips, which produce roll rates. If the sideslips are not adequately damped, the aircraft nose will swing back and forth with respect to the relative wind, and the aircraft will roll right and left due to the dihedral effect (the wingsweep results in asymmetric lift, depending on the relative wind). Airplanes designed to fly at higher Mach numbers have more wingsweep to control the critical Mach number (the speed at which shock waves begin to form on the wing). As wingsweep increases, the dihedral effect increases, and if the airplane is not adequately damped in the directional axis, a Dutch roll might occur if the airplane is upset directionally. Yaw dampers were designed to minimize yaw rates, which result in sideslip rates, and are very effective in modern transports in damping the Dutch roll. However, some transport airplanes have a neutral or slightly divergent Dutch roll if the yaw damper is off or inoperative.^{Footnote 5} Conventional airplanes exhibit more of a Dutch roll tendency at higher altitude (less damping) and higher speed (more directional stability). Therefore, if a pilot encounters a Dutch roll condition, every effort should be made to "slow down and go down." With a properly functioning yaw damper, Dutch rolls will not occur in modern transport aircraft. Transport airplanes are certificated to demonstrate positively damped Dutch roll oscillations. The rudder should not be used to complement the yaw damper system. If the yaw damper system is inoperative, the rudder should not be used to dampen Dutch roll.

1.5.8.4 Dutch Roll Recovery Training

During Air Transat initial training, pilots are exposed to Dutch roll recovery. The exercise is conducted with YDs engaged to demonstrate the automatic damping, and with the YDs disengaged to practice the recovery technique and to demonstrate the natural damping. During the exercise, at the request of the pilot flying, the pilot not flying rapidly applies rudder until 40° of bank is achieved and then releases the rudder pedal. The rudder should not be used during recovery and the rudder control should remain in the neutral position. Transferring fuel forward will improve Dutch roll characteristics, and flying at or below FL 310 will improve aircraft directional stability.

1.5.8.5 On-Board Documentation

The A310 quick reference handbook (QRH) does not include procedures for abnormal flight conditions related to Dutch roll. However, the expanded checklist in the Flight Crew Operating Manual provides information to control Dutch roll in case of a yaw damper fault. A yaw damper fault was not the problem in this event.

1.5.9 Certification Information

1.5.9.1 Type Certificate

This model of aircraft is covered by Transport Canada type certificate A-151. The data sheet provides the following information applicable to this occurrence:

• maximum operating speed: 340 KIAS
• maximum operating Mach: 0.84
• flight load factor with flaps up: -1.0 to +2.5

1.5.9.2 Rudder Certification Tests

The manufacturer conducted the following structural and flutter tests during the original certification of the rudder:

Structural Tests	Static Load Test - The rudder was tested and sustained 1.6 times the limit load at high temperature/high humidity conditions.
	Fatigue Test - The rudder was cycled for three lifetimes (3 x 48 000 flight cycles) between −35°C and 70°C and varying moisture content.
	Damage Tolerance Tests - Following the fatigue test, artificial damage was introduced to the specimen and it was subjected to one further lifetime of fatigue. No damage growth was observed. Following this fourth fatigue life of cycling, the specimen was subjected to 1.8 times the limit load without failure. The specimen was then loaded several times to 2.3 times the limit load without failure. The specimen was then subjected to increased damage sizes and finally failed at 2.15 times the limit load. The applied load during these tests was mechanical only and did not include vacuum cycling tests. Vacuum cycling tests were not specifically demanded for certification.
	Sub-Component Tests - Tests were conducted on the anchor nuts used to attach the leading edge to the z-section, the trailing edge connection, the connection of the side panel to the front spar, the load introduction area at the hydraulic actuators, and the front spar.
Flutter Tests	Theoretical Investigation (Normal Cases) - A theoretical dynamic model was constructed. The vibration behaviour was calculated using the MSC Nastran finite element software program, and the model was adjusted to match ground vibration test (GVT) results. A more complex finite element model was subsequently developed for the multi-role tanker transport (MRTT) conversion. This model was accurate to within 3 per cent of the GVT results. Analysis found the aircraft to have satisfactory flutter margins up to the certification limit of 1.2 times the operating dive speed at less than Mach 1.0, meeting certification requirements.
	Theoretical Investigation (Failure Cases) - Flutter analysis was conducted for a number of failure cases, including cracks in spar or skin, failure of two of three hydraulic circuits, ice accretion on leading edges, and water ingress into honeycomb core. Satisfactory flutter margins were found for all failure conditions.
	Ground Vibration Tests - GVTs were conducted on the A310-200, A310-300, and A310-300 MRTT versions to calibrate the computer models.
	Flight Vibration Tests-Flight vibration tests were conducted on the A310-200, A310-300, and A310-300 MRTT versions. No flutter or critical damping reduction occurred up to the demonstrated flight diving speed of 410 knots calibrated airspeed (KCAS), Mach 0.9.

1.5.10 Inspection Schedule

1.5.10.1 Scheduled Inspection Cycle

The scheduled aircraft inspection cycle is as follows:

Transit check	Before each flight
Daily check	36 hours of lapse time
Weekly check	8 calendar days
A-check (1 through 12)	450 flight hours
C-check (1 through 8)	15 months

Note: Aircraft utilization is approximately 300 hours per month (3600 hours per year).

1.5.10.2 Scheduled Rudder Inspections

The rudder is inspected during the following inspections:

General visual inspection (GVI) from the ground of empennage - GVI (G)	daily/transit check
GVI at arm's length of empennage - GVI (A)	2-C check
GVI (A) of rudder	2-C check
Rudder hinge free-play measurement	4-C check
Detailed visual inspection (DVI) of rudder hinge arms	5 years
DVI of rudder hinge fittings	5 years
DVI of rudder front spar	5 years
Non-destructive inspection (NDI) of rudder side panels	5 years

1.5.10.3 Recently Completed Inspections

The most recently completed major inspections before the occurrence were the following:

May 2001	5-year rudder NDI - 34 415 hours and 10 037 cycles
May 2004	2-C check (at TAP Portugal) - 46 198 hours and 12 809 cycles
01 March 2005	A-11 check - 49 156 hours and 13 429 cycles
05 March 2005	daily/transit check (before departure from Québec to Varadero) - 49 197 hours and 13 439 cycles

1.5.10.4 Rudder Damage Structural Repair Manual Limits

Chapter 55-41-00, Figure 105, of the structural repair manual (SRM) specifies that damage to the rudder side panels of the type "impact and delamination without visible cracks or holes" is to be repaired according to the following requirements:

• below 1000 mm²: allowable damage
• 1000 to 10 000 mm²: monitor damage and repair if it grows
• 10 000 to 40 000 mm²: monitor damage and repair within 2500 hours in accordance with the SRM
• above 40 000 mm²: repair immediately and refer to manufacturer^{Footnote 6}

1.5.11 Maintenance Actions

1.5.11.1 General

All inspection and maintenance work reports were analyzed from the date of the aircraft's first flight in September 1991 until the time of the occurrence. All records of structural repairs were examined, including all maintenance activities reported for components of the rudder control surface and system components, as well as special inspections. The investigation determined that the aircraft was maintained in airworthy condition in accordance with the Transport Canada (TC)-approved maintenance program. Significant rudder-related maintenance actions are described below.

1.5.11.2 Rudder Synchronization Check

There is a requirement every 1300 flight hours to conduct a rudder synchronization check as specified in Airbus SB A310-27-2082. This inspection requires the technicians to access the area at the base of the rudder. Although it does not include a structural inspection of the rudder, any significant external damage would be visible. This inspection had been carried out concurrently with the A-11 inspection on 01 March 2005, five days before the occurrence. No abnormalities were reported.

1.5.11.3 Lightning Protection Plate Replacement

On 20 May 2004, less than one year before the occurrence and during the aircraft 2-C inspection, the rudder lower right-side LPP was found to be corroded in the aft attachment area. It was subsequently replaced, and tap tests^{Footnote 7} of the affected area following the replacement showed no indications of inadequate bonding. Because this was one of the few rudder maintenance activities that were recorded, the complete replacement process of the LPP was investigated. No anomalies were found that could have contributed to the occurrence.

1.5.11.4 Lightning Strike Repair

On 12 August 1997, during the aircraft 4-C inspection, a non-routine inspection card was raised to address suspected lightning strike damage. The defect was written as "upper corner of rudder, lightning strike mark," and the corrective action was written as "rudder upper corner lightning strike area repaired in accordance with SRM 51-73-10." This was a minor repair within SRM limits; the manufacturer was not advised. No photos or other records of the damage were available. This damage occurred more than seven years before the occurrence, and the aircraft was subject to all regular inspections in the intervening time.

1.5.11.5 Miscellaneous Rudder Servo-Controls Maintenance

In December 1999, the number 7 rudder hinge arm was found to have excessive play and it was repaired. In May 2004, the rudder servos were modified according to SB A310-27-2091.

1.5.11.6 Maintenance Facilities

Inspection of the operator maintenance base facility in Montréal showed no indication that the aircraft rudder suffered an impact against crew lifting devices, other devices on the ramp, or hangar door frame. The investigation also determined that the tail of the aircraft could not have been affected by the heating or lighting systems in place or at the previous location of the company in Mirabel, Quebec.

1.6 Meteorological Information

The reported weather at the time of departure from Varadero (0600) was as follows: winds variable at two knots, visibility 8000 m, few clouds (less than 2/8 sky coverage) at 1800 feet above ground level (agl), temperature 14°C, dew point 12°C, altimeter setting 1021 millibars. The weather at Varadero at the time of landing (0800) was reported as follows: winds variable at two knots, visibility 7000 m, few clouds at 1800 feet agl, temperature 12°C, dew point 11°C, altimeter setting 1020 millibars.

At the time of the occurrence, the flight crew was in night visual flight conditions, and no turbulence was reported.

1.7 Aids to Navigation

There were no reported problems with navigational aids.

1.8 Communications

1.8.1 Air Traffic Control

TSC961 levelled off at FL 350 at 0701. As a result of the in-flight problem, TSC961 climbed nearly 1000 feet, but there was no other traffic in the area; this altitude incursion did not result in a loss of separation. TSC961 was initially being guided for an approach in Fort Lauderdale, but the aircraft subsequently returned to Varadero.

The crew was in contact with the controllers of four separate ATC sectors between the time of the occurrence and landing at Varadero. An emergency was not declared.

1.8.2 Crew/Company Communications

At 0717, a phone patch was initiated with Air Transat dispatch in Montréal through New York aeronautical radio incorporated (ARINC) using their high frequency radio. The flight problem was discussed with dispatch and maintenance.

1.8.3 Communication Between the Flight Deck and the Flight Attendants

After hearing the abnormal loud noise, the FD contacted the flight deck via the interphone. The flight crew was unable to respond at the time because of the control situation. Shortly thereafter, as per the company's prescribed abnormal/emergency communication procedure, the captain called the FD and provided the TESTRA briefing:

• T - Type of problem: autopilot not responding, flight diverting to Fort
  Lauderdale
• E - Evacuation (land or ditch): no evacuation
• S - Signals (standard or alternate): standard signals
• T - Time available before landing: 10 minutes
• R - Relocation of passengers: not necessary
• A - Announcement to passengers done by (captain or FD): captain

The captain did not ask the FD for a briefing with respect to the cabin environment and none was provided. In abnormal and emergency situations, it is neither the flight crew procedure nor practice to ask the FD if he/she has information to provide. It is assumed that any information that may assist in decision making will automatically be provided. Air Transat's procedure for communicating in abnormal situations calls for flight crew to ask if there are any questions following the TESTRA briefing, which they did. None of the FAs that were in the area of the aft galley contacted the FD or the flight crew to provide information in reference to the abnormal events encountered because they assumed that the flight crew and the FD were aware of the severity of what was felt in the back.

In accordance with the applicable regulations and standards and as per the operator's approved training program, all crew members, pilots and FAs had received training with respect to crew communication. As well, they attended crew resource management training, which also addresses crew communications. Such training is provided during initial and annual training. During annual training, FAs and pilots also participate in joint crew communication training sessions during which communication skills and procedures are reviewed during simulated emergency situations.

For initial FA training, the prescribed communication training objective is to teach the importance of, and the procedures for, effective communication in normal, abnormal, and emergency situations. Emphasis is placed on

• the responsibility of FAs to provide complete and accurate information to the pilot-in-command to assist in decision making;
  
• the potential hazards to flight safety if communication is not effective; and
  
• the consequence of poor communication in aviation occurrences.

FAs are taught that they must communicate any on-board safety concerns they may have witnessed or that may have been communicated to them by passengers. When communicating safety concerns during normal or abnormal operations, FAs are to adhere to the line of authority when possible.

However, if FAs notice an emergency situation developing, including unusual noises, they must contact the flight crew immediately via the interphone, stating their position and the nature of the problem. Training stresses that FAs should never assume that the flight crew is aware of everything that is happening. When information is not communicated, its potential value to flight safety is lost.

There are procedures that set out the requirement for and the manner in which the FD must provide information to the FAs in abnormal and emergency situations. However, no such procedure or guideline was identified with respect to the FD collecting information from the FAs. As well, there is no requirement for the FD to provide flight crew with a structured briefing regarding the cabin environment in those situations.

1.9 Aerodrome Information

TSC961 used Runway 06 at Varadero/Juan Gualberto Gómez International Airport (MUVR), Cuba, for the initial arrival, departure, and the subsequent return that night. Runway 06 is 11 490 feet long and 148 feet wide, with an asphalt surface, and is served by an instrument landing system. Air Transat had maintenance personnel on site at the airport.

The Fort Lauderdale/Hollywood International Airport (KFLL), Florida, has a set of parallel runways and a crossing runway. TSC961 was being guided to Runway 27R, which is 9000 feet long and 150 feet wide, with an asphalt surface, and is served by an instrument landing system. Air Transat had maintenance personnel available at KFLL, but customs services were not available at night.

The Miami International Airport (KMIA), Miami, Florida, has four runways: 08/26L, 08/26R, 09/27 and 12/30. Runways 12, 08R, 09, 26L and 27 are equipped with an instrument landing system. Air Transat did not have maintenance personnel on site in Miami.

The Aircraft Rescue and Fire Fighting category of the three airports that could potentially have received TSC961 on the night of the incident exceeded the minimum response requirement for rescue and firefighting services for an aircraft the size of an Airbus A310.

1.10 Flight Recorders

1.10.1 Digital Flight Data Recorder

The aircraft was fitted with a Honeywell/Sundstrand model universal flight data recorder (UFDR), part number 980-4100-DXUN, serial number 10623. The recorder used an eight-track Mylar tape. The recording system consisted of a data frame of 64 words per second, recording over 300 parameters, with a minimum capacity of 25 hours. The digital flight data recorder (DFDR) was received in very good condition. The recorder was disassembled and the tape was removed from the crash-protected memory cartridge for playback on an eight-track reel-to-reel instrumentation recorder at slower speed. A total of 25.3 hours of data were recovered from the recorder.

1.10.2 Cockpit Voice Recorder

The cockpit voice recorder (CVR) on the aircraft was a Loral Fairchild model A100-A, part number 93-A100-80, serial number 60662, and was received in very good condition. The recorder contained four 30-minute audio tracks. Tracks 1 and 2 contained the radio channels of the captain and co-pilot, track 3 was the cockpit area microphone channel, and track 4 contained public address/interphone and radio communications. The quality of the recording was good.

The aircraft flew for 1 hour 17 minutes after the loss of the rudder. The CVR audio of the rudder-loss event was overwritten, resulting in the loss of information, including the noises heard in the cockpit during the rudder failure. The CVR recording started with the aircraft en route to Varadero, approximately 15 minutes before landing. The last 15 minutes were recorded on the ground in Varadero; the crew had not disabled the recorders. As a result of the TSB investigation into the Swissair Flight 111 accident in Nova Scotia, the Board, in 1999, made two recommendations that CVRs installed on aircraft be required to have a recording capacity of at least two hours (A99-01 and A99-02). As a result, aircraft manufactured after 31 December 2002 must retain information recorded during the last two hours of aircraft operation. Aircraft manufactured before this date, however, continue to require CVRs with a minimum of 30-minute recording capacity.

There was no company procedure describing how to disable the recorders after landing. Current requirements in Canada are set out in TC's Aeronautical Information Manual (AIM) under General Information, Section 3.0, Transportation Safety Board of Canada, Subsection 3.4.3, Protection of Occurrence Sites, Aircraft, Components and Documentation, which states in part

Where a reportable incident occurs, the pilot-in-command, operator, owner and any crew member of the aircraft involved shall, as far as possible, preserve and protect:

1. the flight data recorders and the information recorded thereon. . .

The AIM is consistent with the Transportation Safety Board Regulations, Section 9 (1), Preservation of Evidence Respecting Reportable Accidents and Incidents.

1.10.3 Direct Access Recorder

On the aircraft, there is a direct access recorder (DAR) with an optical disk device having a storage capacity of 128 megabytes. The data frame had a configuration of 128 words per second, recording approximately 127 parameters, identical to that of the DFDR. Both the DAR and DFDR recorded flight data from identical sources; however, the recorded samples were not identical due to differing sample times. Data acquisition for both DAR and DFDR is handled by the digital flight data acquisition monitoring unit. The unit, manufactured by SAGEM, combines both the digital flight data acquisition unit function for the DFDR and the data management unit function for the DAR, feeding data to both recorders. The DAR optical disk was not originally requested by the TSB. Arrangements were subsequently made to transfer all applicable DAR data to the TSB. A total of 977 hours (not continuous) of DAR data applicable to the incident aircraft, including the incident flight, were obtained from Air Transat.

The DAR data were scanned for possible airborne and ground events. From the DAR data available, there were no significant events recorded that indicated lateral acceleration excursions, severe turbulence, or rudder doublets.^{Footnote 8} Similarly, there were no significant ground events recorded that might indicate an impact to the rudder.

1.10.4 Data Sampling Rates

The DFDR and DAR data were manually time-synchronized and the data showed good correlation, with the exception of the lateral acceleration data for approximately two seconds at the start of the rudder-loss event (see Appendix A). The differing data were the result of a highly dynamic event. Both the DFDR and DAR sampled lateral acceleration at a rate of 4 Hz. At this rate, it was not possible to identify any lateral acceleration frequencies above 2 Hz.^{Footnote 9} The determination of the specific frequencies involved in the rudder-loss event was not possible due to these low sampling rates of the recorded lateral accelerations.

Under current regulations (Standard 625, Schedule 3, Aeroplane Digital Flight Data Recorder (DFDR) Specifications, of the Canadian Aviation Regulations [CARs], which are harmonized with Part 121, Appendix M, of the United States Federal Aviation Regulations), the sampling intervals for lateral and longitudinal acceleration are 4 Hz and vertical acceleration is 8 Hz. These rates meet the performance standards as recommended by the European Organisation for Civil Aviation Equipment (EUROCAE) minimum operational performance specifications (MOPS) for Crash Protected Airborne Recorder Systems (ED112).

1.10.5 Filtering of Recorded Data

The control surface position data recorded on the DFDR and DAR, including rudder position, were filtered by the system data analogue converter before recording. The filtered data are fed to the cockpit instrument displays, and the filtering process is designed to smooth out the data to remove unwanted spikes and prevent erratic indications. This same information is also recorded on the DFDR, and due to sampling and filtering, does not accurately represent the true control surface positions under dynamic conditions. Since the rudder loss on TSC961 was a dynamic event, critical information concerning the flight controls was potentially lost due to filtering.

1.10.6 Summary of Flight Recorder Data

At the time of the occurrence, the aircraft was in steady level flight at approximately 35 000 feet and 270 knots (Mach 0.795), with no significant control movements or turbulence. The aircraft had not exceeded any load or airspeed boundaries of its structural design envelope.

Approximately 50 seconds after levelling off at FL 350, a dynamic oscillation in lateral acceleration occurred, lasting for approximately two seconds. This was the first indication in the DFDR/DAR data of the rudder-loss event. At the start of the oscillations, the lateral acceleration changed from +0.006 g to -0.073 g, indicative of a lateral force applied to the aircraft. Within one second of the dynamic oscillations in lateral acceleration, the heading decreased by 2° and the aircraft began to roll left from wings level. At the same time, the autopilot commanded aileron and spoiler deflections (right-hand spoilers 5, 6 and 7 extended) for right roll. The recorded rudder position indicated movement to the right from 1.2° left of neutral (0° with the 1.2° bias removed) to approximately 0.3° left of neutral (0.9° right of neutral, with the 1.2° bias removed). A pitch increase from 2 to 3° nose-up occurred, with a corresponding increase in vertical acceleration to +1.28 g.

A yawing/rolling oscillatory mode, consistent with Dutch roll, commenced within two seconds of the rudder-loss event, as the dynamic oscillations in lateral acceleration decreased. At this time, a slight increase in altitude was followed by a decrease in pitch (from 3° to 2° nose-up), and a reduction in engine thrust (N₁ decreased from 90 to 77 per cent). A gradual reduction in speed followed. The roll attitude reached 6° left-wing-low and then reversed direction. Approximately six seconds into the event, the recorded rudder position reached 6.2° right of neutral (approximately 7.4° right, with the bias removed). At the speed of 270 KIAS, the recorded rudder deflection was beyond the YD authority of ±3.7°.

Approximately seven seconds into the event, the No. 2 autopilot was disengaged, followed immediately by disengagement of the auto thrust mode (manual throttle armed). The aircraft began to climb above FL 350 approximately 18 seconds into the event. With the autopilot disengaged, the oscillatory motion decreased in amplitude as the aircraft climbed through 35 200 feet, and as airspeed decreased through 256 KIAS. The speed decreased to a minimum of 248 KIAS. The altitude briefly peaked at 35 900 feet and the aircraft then began to descend.

Autopilot No.1 command mode was briefly engaged as the aircraft descended through 35 000 feet. With autopilot engagement, the yawing/rolling oscillatory motion increased in amplitude. After approximately 17 seconds, the autopilot was disengaged and the oscillations subsequently began to decrease in amplitude. As the aircraft descended through 27 900 feet and the speed decreased through 258 KIAS, the oscillatory motion ceased.

1.11 Wreckage and Impact Information

1.11.1 Miscellaneous Damage

Some ceiling panels inside the passenger cabin had partially popped out of position. The displacement was very slight and did not impede passenger movement. The interior of the fuselage compartment behind the aft pressure bulkhead was inspected; there were no indications that the loads and vibrations associated with the rudder separation had caused any structural damage.

The aircraft exterior was inspected, and there were no missing panels or structural components that may have come loose and struck the rudder. Apparent scrapes on the fuselage side, directed upward toward the tail, were determined to be poorly adhered, peeling paint and were not the result of foreign object damage (FOD). There was also blue-colour paint transfer visible on the left side of the tail cone, just aft of the rudder, probably the result of a piece of the rudder striking the tail cone during separation. There was a series of puncture holes in the fuselage skin on the upper right side near the base of the VTP. These punctures were the result of the impact, during rudder breakup, of the mechanical fasteners that attach the rudder leading edge fairing to the rudder.

1.11.2 Vertical Tail Plane Damage

1.11.2.1 General

Photo 2 shows the VTP and its rudder residuals being removed from the aircraft. The damage to the VTP trailing edge panels was generally limited to minor paint chipping. There was no damage suggesting that the rudder had been battered due to extreme travel from side to side.

1.11.2.2 Main Attachment Fittings

The VTP main attachment fittings were examined. On the fuselage side, these fittings are constructed of metal. Following the occurrence, they were subjected to visual and NDI, and no damage was found. The six CFRP main attachment fittings on the VTP side were subjected to ultrasonic NDI. Delamination damage was found in the two aft main attachment fittings.

When the VTP is loaded in lateral bending, the two rear main attachment fittings are the most severely loaded. A full-scale test of the VTP conducted during the initial certification involved fatigue testing for three lifetimes followed by static testing, where the specimen main attachment fittings failed at over 1.9 times the limit load. In addition, three further static load tests conducted during an earlier investigation resulted in attachment fitting failures at greater than 1.8 times the limit load. It is noted that design ultimate load corresponds to 1.5 times the limit load and that, in order to meet certification requirements, a structure must withstand design ultimate load for at least three seconds. These tests demonstrated that the design exceeds certification load requirements.

An analysis conducted in support of this occurrence investigation determined that, in order to cause the damage observed to the VTP main attachment fittings, the load experienced during the occurrence exceeded the design ultimate lateral fin bending load. However, it was not possible to quantify the precise load value attained.

A 3D finite element analysis was conducted and included details of the main attachment fittings delamination on the occurrence aircraft, as reported by the NDI. This analysis was validated by a test on a damaged rear attachment fitting. It indicated that, when ultimate loads were applied to the model, strain levels varied only slightly from those of the undamaged model and were well below the levels required to cause a fracture of the main attachment fittings. Therefore, the delamination had a minimal effect on the strength and stiffness of the main attachment fittings. Consequently, after the rudder-separation event, the aircraft was not in danger of losing the VTP during the flight either through loss of static strength or loss of stiffness.

1.11.2.3 Hinge Arms

Laboratory examination of hinge arm 1 found the right bolt under tolerance at the attachment of the hinge arm to the VTP. The fitting on the aft face of the VTP showed no visible signs of damage, such as cracks in the paint or sealant, but ultrasonic NDI found delamination around the mechanical fasteners. The forward ends of the hinge arms did not show any indication of upward travel as found at hinge arm 5. The rudder residuals were still attached. All three electrical grounding wires, two on VTP side and one on rudder side, were fastened with no indication of burning. There was no sign of any extreme side-to-side travel as with hinge arms 5 and 6. There were impact marks on the rudder leading edge fairing caused by the hinge arms. This damage was restricted to the centre region, and the damage lines up with the hinge arms when the rudder is not deflected.

At the hinge arm 2, 3, and 4 positions, the hinge arms are co-located with the hydraulic actuators. De-synchronization of the hydraulic actuators can result in force-fighting between them, which could lead to damage at their attachment points. Visual and NDI of the attachments did not find any sign of damage to the structure or to the mechanical fasteners. There was no indication of any structural damage that would degrade the stiffness of the actuator attachment. All the electrical grounding wires were fastened with no sign of burning. There was no indication of any extreme rudder travel as was the case at hinge arms 5 and 6. The z-strut located above hinge position 4 is designed to transfer vertical loads from the rudder into the VTP. The attachment fitting at the upper end of the z-strut showed no visual sign of damage, such as cracking of the paint or sealant, but there were paint chips on its top surface. This damage was probably caused by the upper end of the rudder separating and dropping vertically.

At the hinge arm 5 position, the metal hinge arms were still securely fastened to the fitting on the aft face of the VTP rear spar, and the fitting showed no visible signs of damage, such as cracks in the paint or in the sealant. The forward ends of the hinge arms showed damage consistent with the hinge arms having moved upwards. The rudder-side hinge fitting was still attached along with a short section of the rudder spar, roughly 23 cm high by 26 cm wide. Ultrasonic NDI found no delamination around the mechanical fasteners that attach the CFRP fitting to the VTP rear spar, but the shim layer used to adjust the thickness of the CFRP fitting was mostly disbonded.

All the electrical grounding wires were fastened with no sign of burning. The rudder-side bonding cable was badly frayed at the forward end, roughly at the position of the hinge bolt. The hinge arm was damaged by extreme side-to-side travel of the rudder hinge fitting, reaching nearly 90° deflection in each direction.

Manufacturer's drawings indicate that, at a rudder deflection of 45°, the rudder leading edge fairing cut-out strikes the hinge arm. At 60°, the rudder-side hinge fitting strikes the hinge arm. At 84°, the rudder side panel strikes the VTP trailing edge panel. There was no damage to the hinge arm where the leading edge fairing would have struck as the rudder passed through 45° of travel, and no damage to the VTP trailing edge where the rudder would have struck while passing through 84° of travel. The absence of such damage indicated that the damage from the extreme side-to-side travel occurred after detachment of the rudder and would have started as the rudder passed through 60° of travel, progressing until the rudder reached about 90° of travel.

At the hinge arm 6 position, the metal hinge arms were still securely fastened to the fitting on the aft face of the VTP. The fitting showed no visible signs of damage. The forward ends of the hinge arms did not show any sign of upwards travel. The rudder-side hinge fitting was still attached along with a short section of the rudder spar, roughly 15 cm high by 22 cm wide. Ultrasonic NDI found delamination around the mechanical fasteners that attach the CFRP fitting to the VTP rear spar. All the electrical grounding wires were fastened, with no sign of burning. The bolt that attaches the left side of the hinge arm to the VTP was nearly seized.

The hinge arm had been damaged by extreme side-to-side travel of the rudder, where the rudder-side hinge fitting had struck the hinge arm, reaching nearly 90° deflection in each direction. The damage was less severe than that at hinge arm 5. Manufacturer's drawings indicated that, at a rudder deflection of 43°, the rudder leading edge fairing cut-out strikes the hinge arm. At 70°, the rudder-side hinge fitting strikes the hinge arm. At 84°, the rudder side panel strikes the VTP trailing edge panel.

There was no damage to the hinge arm where the leading edge fairing would have struck as the rudder passed through 43° of travel, and no damage to the VTP trailing edge where the rudder would have struck while passing through 84° of travel. The absence of such damage indicated that the damage from the extreme side-to-side travel occurred after detachment of the rudder; the damage would have started as the rudder passed through 70° of travel and would have progressed until the rudder had reached about 90° of travel.

At the hinge arm 7 position, the VTP-side CFRP attachment fitting had fractured and separated.

1.11.3 Rudder Damage

1.11.3.1 General

As will be discussed later in this report, subsequent analysis found that the rudder loss during flight was progressive, and by the time the aircraft landed, most of the rudder had separated from the aircraft. Photo 3 shows the empennage after landing in Varadero. The separated pieces fell into the ocean and none were recovered. Rib 0 remained attached, as did the length of rudder spar up to hinge point 4. A small piece of rudder side panel from each side remained attached to the spar in the region between hinge points 2 to 4, and also in the corner where the spar meets rib 0. The leading edge fairings between hinge points 2 and 4, and below hinge point 1, were still attached. The leading edge fairing between hinge points 1 and 2 had separated and some pieces were found jammed between the rudder and the VTP. At hinge points 5 and 6, small pieces of the rudder spar remained attached to the hinge arm. At hinge point 7, the VTP-side hinge bracket had fractured and separated, so none of the rudder remained.

1.11.3.2 Detailed Description of Rudder Damage

The front face of the rudder spar was cleaner at the hinge positions, consistent with what would be expected if the hinge areas had been cleaned for inspection. The aft face of the rudder spar was generally clean along its entire length, becoming slightly dirtier toward the bottom. There were drip stains oriented downwards originating at the lightening holes, consistent with normal in-service staining caused by dripping hydraulic fluid, corrosion inhibitor, or other fluids. There were dark stains observed on the interior of the side panels where the reinforcing bolts pass through the GFRP blocks at the hinge points. These stains originated at the bolts and progressed in a downward direction. The foils, which normally cover the lightening holes on the rudder spar, were missing, and the pattern of dirt around each lightening hole suggested that the foils had been removed for a considerable period before the occurrence. The top surface of rib 0 was visibly dirty. There were no stains on the interior bottom of the rudder to suggest that fluid had been pooling in the bottom of the rudder. The fluid drain holes and drain paths at the bottom of the rudder were not plugged. There were no stains in the honeycomb cells to suggest the presence of trapped fluids; however, very little of the honeycomb remained for examination.

Cross-section examination of the rudder exterior skin revealed 10 layers of paint composed of primer, anti-static, filler, and topcoat. There was an accumulation of three paint re-sprays. It was calculated that the mass of the extra two re-sprays was approximately 19.3 kg. The total mass of a rudder with the nominal paint system is approximately 190 kg.

The small amount of surviving rudder was examined for indications of contact with maintenance equipment, FOD, or damage by misuse. The only finding was a circular grinding mark on the exterior of the right rudder side panel. Cross-section examination determined that the grinding mark only extended down into the first few layers of paint, with no damage to the CFRP or discolouration due to heating.

On each side of the rudder, there are three LPPs running chordwise. On the occurrence rudder, recent maintenance had involved the replacement of the lower right LPP in May 2004. A short length of this LPP remained and its fractured end was bent forward. A section of the side panel at this LPP was taken for subsequent laboratory analysis.

The right side panel's outer face sheet exhibited many small multidirectional surface marks. There were similar marks on another aircraft (MSN 600), whose rudder was inspected and found undamaged. A section cut through these marks on the occurrence rudder revealed that they were cracks that had originated in the paint, caused by excessive paint thickness. It was further found that, when a paint crack was parallel to the direction of the CFRP fibres, the crack could extend down into the CFRP resin matrix. These cracks were limited to the matrix and did not damage the fibres.

The CFRP face sheets had separated from the honeycomb core and the separation had a different appearance depending on whether it was an interior or exterior face sheet. The interior face sheets had generally separated from the honeycomb very cleanly near the bond line. However, the exterior face sheets had separated from the honeycomb in a very jagged manner with separations occurring at different depths in the honeycomb.

Microscopic examination of the inner skin separation found that they were mostly cohesive failures within the bond line through the meniscus.^{Footnote 10} Since the honeycomb had been so badly damaged during the occurrence, it was not possible to distinguish damage to honeycomb cells that may have been caused by freezing of trapped water. At the actuator locations, the interior CFRP face sheets had separated into four plies. There were no significant gaps in the coverage of the splice bond adhesive at the edges of the honeycomb sheets. In regions where a separation occurred near a honeycomb splice bond, the separation tended to occur in the weaker density honeycomb, and not in the bond line. Exposed regions of honeycomb that were no longer supported by the CFRP had tended to split into many small chordwise "fingers," each about 25 to 50 mm wide.

The rudder spar had fractured just above the hydraulic actuator attachments. Examination of fractured fibres indicated that the spar separated in an up and aft direction. The metal strip along the z-section at the front edge of each side panel had also fractured at this location, and examination revealed that it was a ductile overload failure.

Photo 1 shows that there was no significant amount of rudder side panel still attached between hinge positions 1 and 2. In this region, more honeycomb remained on the right side, but more inner skin remained on the left side. The joint between the side panels and the spar, which uses blind mechanical fasteners, had not failed and the fasteners were intact. Examination of the fractures at the joint between the front spar and the side panels revealed that the side panels or part of the side panels separated toward the outboard. Along the length of rudder spar between hinge points 1 and 2, the z-sections had fractured and separated along with the side panel on both sides. Since the leading edge fairing attaches to the z-sections, this explains why the leading edge fairing was missing in this region. The metal actuator attachment fittings at the hinge point 2, 3, and 4 positions did not show indications of damage, deformation, or looseness.

The joint between the side panels and rib 0, which uses blind mechanical fasteners, had not failed and the fasteners were intact. There was a wipe mark across the top of rib 0, consistent with a fractured section of the left side panel moving towards the right and downwards. At the left side panel separation, more of the z-section had remained than on the right side. The fastener holes had been torn out towards the bottom, suggesting that the left side panel or part of the side panel separated from rib 0 in a downwards or outwards direction. The left side panel also had compression damage, suggesting the inboard skin moved downwards during separation. A failure in the z-section remains suggests that the outboard skin moved outboard during separation.

At the right side panel separation, a length of the z-section had fractured and separated. Marks were observed on the remaining CFRP edge and their spacing corresponded to the spacing of the missing mechanical fasteners. These marks suggest that the right side panel or part of the side panel separated in an upwards direction. Examination of the right side panel showed that it separated from rib 0 in a tension flexion failure. The metal strips along the z-section had failed by overstress, a combination of tension and bending to the outside. There was a skin buckle on each side panel consistent with rib 0 moving upwards. There was a crack at the tip of rib 0 whose orientation was consistent with rib 0 twisting to the right.

Examination of other rudders as part of the fleet inspections following the occurrence found side panel damage at the hoisting points and the trailing edge fasteners. Since none of these areas of the occurrence rudder were recovered, it was not possible to examine them. Furthermore, since the entire upper end of the rudder was not recovered, the area around the 1997 lightning strike damage could not be examined.

Only a short section of the rudder spar at hinge point 5, roughly 23 cm high by 26 cm wide, remained attached. The lower surface of the spar section included the edge of a lightening hole. The rear reinforcement plate was still securely fastened to the spar and all its fasteners were still present and appeared undamaged. The separation between the honeycomb and the CFRP skin had generally occurred in the honeycomb, at varying depths and not along the honeycomb/CFRP bond line. On the front surface of the spar, the rudder-side hinge bracket had fractured. The fractured surface appeared typical of a tensile/bending overload failure with no indication of fatigue. Metallurgical analysis determined that the fittings were made of the correct aluminum alloy and temper.

Only a short section of the rudder spar at hinge point 6, roughly 15 cm high by 22 cm wide, remained attached. The lower surface of the spar section included the edge of a lightening hole. The rear reinforcement plate was still securely fastened to the spar, and all its fasteners were still present and appeared undamaged. The separation between the honeycomb and the CFRP skin had generally occurred in the honeycomb, at varying depths, and not along the honeycomb/CFRP bond line. On the front surface of the spar, the rudder-side hinge bracket had fractured. The fractured surface appeared typical of a tensile/bending overload failure with no indication of fatigue. Metallurgical analysis determined that the fittings were made of the correct aluminum alloy and temper.

1.11.4 Chemical Attack and Contamination

The rudder residuals were examined to study the possibility that they had been contaminated and degraded by exposure to chemicals. The manufacturer provides a list of approved consumables, as well as procedures to follow for the approval of materials not on that list. No indication was found that unapproved consumables were being used by the operator. There is no in-service experience to suggest that there was a systemic problem with chemical attack by approved consumables. During the material qualification process at certification, extensive testing was conducted to understand the interaction between the materials and possible contaminants, including hydraulic fluid. However, the bond between the honeycomb and the CFRP face sheets was not included in these tests because it was in the interior structure and considered to be sealed from such exposure.

A water and hydraulic fluid mixture may react under certain concentrations to form phosphoric acid, which can attack epoxy resin creating irreversible damage to the core/face sheet interface. Microscopic examination of the rudder of aircraft MSN 361, which was known to be contaminated by hydraulic fluid, revealed that hydraulic fluid had attacked the matrix of the GFRP layer adjacent to the honeycomb, weakening the bond, but not leading to a disbond.

Based on service experience with the aircraft MSN 361 and MSN 545 rudders, the access path for hydraulic fluid into the sandwich structure is around the blind fasteners at the front and bottom edges of the side panels. Three methods were used to search for the presence of hydraulic fluid contamination: energy dispersion X-ray spectroscopy (EDX), X-ray photoelectron spectroscopy (XPS), and infrared (IR) spectroscopy. The rudder of aircraft MSN 361, which was known to be contaminated by hydraulic fluid, was used to calibrate these three analysis methods. EDX testing of regions that were visibly stained by hydraulic fluid found roughly 2 per cent phosphorus content, and XPS testing found roughly 0.8 per cent phosphoric acid-ester content.

The top surface of rib 0 of the occurrence aircraft was visibly dirty, and an area at the front near the spar was analyzed. EDX results indicated 0.4 per cent^{Footnote 11} phosphorus, considerably lower than the 2 per cent associated with the visibly contaminated region of the rudder of aircraft MSN 361. An area of inner skin (non-honeycomb side) from the left side panel front bottom corner was analyzed. EDX results indicated less than 0.1 per cent phosphorus, considerably lower than values from the aircraft MSN 361 rudder. An area of the inner skin (honeycomb side) from the left side panel front bottom corner was analyzed. EDX results indicated 0.3 per cent phosphorus, and XPS results indicated 0.18 per cent phosphoric acid-ester, both considerably lower than values from the rudder of aircraft MSN 361. An area of inner skin (honeycomb side) from the right side panel front bottom corner was analyzed. EDX results showed less than 0.1 per cent phosphorus and XPS results indicated 0.07 per cent phosphoric acid-ester, both considerably lower than the values from the aircraft MSN 361 rudder.

Since the suspected hydraulic fluid ingress path was around the blind fasteners, specimens were taken around blind fasteners on both side panels at the front spar and at rib 0. Measurements were taken inside the sandwich structure at the inner face of the skin. EDX results for phosphorus on interior surfaces were all below the 0.1 per cent detection limit. EDX results on the external surfaces at rivet positions showed readings as high as 3.0 per cent. In addition, cross-section microscopic examination of the bond area did not reveal visual indication of chemical attack. Therefore, these results show the presence of hydraulic fluid contamination on exterior surfaces, but no indication of seepage into the structure.

1.11.5 System Inspection and Testing

The inspection of the rudder system on the occurrence aircraft showed that the rudder control, in cruising flight at 270 knots, would not have exceeded 7° of travel per side; the RTL control would have prevented it (RTL systems do not only limit the pedal inputs, but also limit the sum of inputs from trim, pedals or APYA, and YD). The autopilot was active at the time of the occurrence. The YD was also active (YD is active in manual flight also). The YD was restricted to moving the rudder to no further than 3.7° either side to compensate for the natural Dutch roll tendency of the aircraft.

The last rudder servo-control synchronization check, performed by Air Transat maintenance on 01 March 2005, revealed that no anomalies and no adjustments were required. In Varadero, the synchronization check showed no movement between the neutral position of the three servo-controls; there was no force-fighting between servo-controls. Therefore, the synchronization between the servo-controls was within the Airbus aircraft maintenance manual (AMM) parameters before and after the event.

The inspection and investigation of the aircraft flight control system and related subsystem components was performed by the investigation team in Varadero after the occurrence and revealed no anomalies. The rudder control system was checked and tested for proper operation in Varadero with no anomalies found. The rudder servo-controls and actuating spring rods were then removed, inspected, and laboratory tested, and no anomalies that would have affected the normal operation of the rudder system were found. In addition, all safety features that are part of the servo-controls and spring rods to ensure safe operations in case of servo-control malfunction were operational.

The free play was measured from hinge point 1 to hinge point 6; one free-play measurement was out of tolerance on the hinge line bearing at hinge point 2. In addition, 3 out of 10 VTP-side hinge arm bearings were partly seized but could still be rotated. Airbus specifies that the hinge arm bearing free play has no impact on the structural integrity of the rudder. Free play at the hinge arm bearings would result in detectable rudder vibration that will trigger a specific troubleshooting inspection process. No in-flight rudder vibrations had been reported. Operators are provided with some troubleshooting guidelines that list the most probable causes when vibrations are felt. However, the main cause of rudder vibration is play at the servo-control bearings, rather than at the hinge arms. The Airbus troubleshooting philosophy is such that, if there are no findings of free play at the servo-control bearings, or if they are replaced and the situation is not improved, the operator will contact Airbus for investigation. Airbus in-service experience has confirmed the relevancy of this approach.

1.11.6 High-Intensity Radiated Fields Investigation

The possibility that high-intensity radiated fields (HIRF) interference could affect the normal in-flight operation of the rudder system was investigated. Any oscillation from the YD system at a frequency of 20 Hz, representing the difference of frequency between the radar and rudder synchronization frequencies, will be attenuated by the YD actuator and the three servo-controls that would be acting as filters. A review of the theoretical rudder deflection when the YD system is subjected to HIRF, assuming susceptibility at 20 Hz, led to the conclusion that the maximum rudder deflection would be less than 0.1°. Therefore, the investigation determined that the effect of HIRF would have a negligible impact on the rudder surface control.

1.11.7 Examination of Pre-Occurrence Photos

Photographs of the aircraft taken before the occurrence showed curious visual features on the rudder. Photo 4 shows an example of one of these features. It was taken 11 days before the occurrence and shows light-coloured vertical lines on the left side of the rudder below the hydraulic actuators. There were also earlier photographs that showed arc-shaped lines on the left side panel just aft of the hydraulic actuators, and white spots on the trailing edge. These features were not present on the most recent photographs.

There was insufficient resolution in the photographs to conduct a photogrammetric analysis that would determine whether these vertical lines represented an out-of-plane deformation such as a disbond bubble. Since the vertical line features were observed on photographs taken on different days under different lighting conditions by different photographers, they were actual physical features on the rudder, and not simply reflections or dirt on the camera lens.

The vertical line features first appeared in photographs starting in early 2003, and the aircraft was subject to all its regular inspections in the intervening time. Examination of other aircraft found that staining of the rudder near the hydraulic actuators was not unusual. Subsequent testing found that hydraulic fluid could dissolve the Air Transat tail decal material and analysis of a vertical streak on sister aircraft MSN 600 found the streak to be composed of a mixture of hydraulic fluid and dissolved decal material.

1.12 Tests and Research

1.12.1 General

A series of laboratory examinations and tests were conducted on the residuals of the occurrence rudder, on other rudders, and on test specimens. In addition, analyses of flight dynamics, flutter, and radar data were conducted. This work was performed by the manufacturer at its facilities, with the participation of the involved national investigation authorities and specialist advisors from France, Germany, United States, and Canada. Test progress was monitored and validated by the investigation team.

A number of the tests and analyses helped to eliminate avenues of inquiry and allowed the investigation to concentrate on others that proved germane. For the sake of clarity, the report focuses on this second group of activities.

A small number of test programs developed as a consequence of this occurrence are being continued under the auspices of other entities. In each case, the objectives of the program have shifted away from this investigation to broader issues.

1.12.2 Examination of Two Sister Rudders

The rudders from aircraft MSN 592 and MSN 614 were removed from service and inspected at the manufacturer's facilities. These two rudders were selected because their side panels were produced by Soko as part of the same production batch as the occurrence rudder. Both of these rudders were subjected to visual inspection and elasticity laminate checker (ELCH) testing under TSB supervision. No damage was found.

1.12.3 Elasticity Laminate Checker Test

1.12.3.1 Elasticity Laminate Checker Test Description

The ELCH test is an NDI method developed by Airbus to detect disbonded face sheets on honeycomb-core panels. The machine applies a vacuum to a small area of the outer surface of a panel and measures deflection. If there is a disbond of either the inner or outer face sheet, a greater-than-normal deflection will be measured. The advantage of this test method is that it can be used to find disbonds on the inner face sheets, which are not easily accessible. Airbus Report TN-EV37-579/90 (18 December 1990) describes the qualification results for the ELCH inspection procedure.

1.12.3.2 ELCH 1-Complete Grid Examination of 24 Rudders of Similar Design

The exteriors of the rudder side panels were marked with a 75 mm grid, and an ELCH reading was taken at each grid point. There were approximately 2000 test points per side on each rudder. This would permit finding defects down to a size of 120 mm in diameter. A total of 24 rudders were tested, which included the flight cycle and flight hour fleet leaders. No disbonds were found.

1.12.3.3 ELCH 2-Focused Examination of Rudders

Thirteen rudders close in serial number to rudder serial number HF1090 (aircraft MSN 361) were selected for further ELCH examination. The test area was a 50 mm grid along the complete z-section, around the hoist points, and along the trailing edge fasteners. No large disbonds were found.

1.12.4 Examination of Other Rudders

During the course of the investigation, some rudders of other operators that had been damaged were inspected in greater detail.

The rudder from aircraft MSN 251 was accidentally damaged at its lower end by contact with maintenance equipment during normal scheduled maintenance activities. A repair was carried out, which included the replacement of the lower LPP using heat-assisted cure. A tap test was conducted following the repair, and no defects were found. An ELCH test was then conducted as a precaution. It found that the heat applied during the LPP replacement had not caused a disbond of the inner skin in the area of the LPP replacement. However, the area aft of the trailing edge fasteners around the repair to the contact damage failed a tap test, and subsequent laboratory examination found that the inner skin was almost completely disbonded within the repair area.

The rudder from aircraft MSN 361 was damaged at the trailing edge by unintentional contact with a maintenance dock during maintenance. Subsequent inspection found a disbond on the left inner-face sheet near the front bottom corner, approximately 830 mm long by 350 mm high. Stress analysis determined that the disbond was not caused by the impact with the maintenance dock. This internal disbond had not been detected by the AOT-1 (all operators telex - see Section 1.14.1) external tap test. Further examination revealed that hydraulic fluid had seeped into the left side panel around the blind fasteners at the front spar as shown in Photo 5, and that this fluid had weakened the bond between the honeycomb and the face sheet. In addition to the hydraulic fluid contamination, this rudder exhibited signs of water ingress around some trailing edge fasteners and at the leading edge immediately aft of the z-section.

Approximately one litre of water was drained from the area around the right lower aft hoisting point of the rudder from aircraft MSN 378 during inspection before re-paint. Subsequent inspection revealed that excessive grinding of the old paint had resulted in exposed cells in the upper GFRP area. The manufacturer then subjected the entire area of both side panels to X-ray examination and found additional water ingress at some of the trailing edge screws. Endoscopic examination around the hoist points revealed that honeycomb cell walls had been damaged or torn in some affected areas.

During the AOT-1 inspection of the rudder from aircraft MSN 530, two indications of possible irregularities were found on the exterior face of the right side panel. These were 80 cm² in size. There was no visual indication of impact damage at these locations. Destructive laboratory examination determined that it was a core crush, not a disbond. It was further determined that the core crush had occurred during cure at original manufacture. A review of manufacturing records did not indicate any concession related to this damage. There was no indication that this manufacturing deviation had grown in service. Stress analysis determined that this deviation had a negligible effect on the rudder structural strength. This rudder was pre-modification 8408 and had lower density honeycomb, which was more susceptible to core crush. The occurrence aircraft was post-modification 8408, with higher density honeycomb.

Trapped fluid was found in the lower nose area of the rudder of aircraft MSN 701 during the AOT-2 inspection (see Photo 6). The fluid was not formally identified, but was reported to be mostly water with some dirt, possibly containing hydraulic fluid and sealant chips. The fluid level was reported to be up to the lower inspection hole. The rudder box aft of the spar was dry. The two drain openings in the nose section were found to be clogged. The tap test did not show any sign of disbond. An X-ray and thermography inspection of side panels adjacent to the fluid did not reveal any fluidity entrapped inside the sandwich.

1.12.5 Fluid Contamination Program

As a result of the findings on aircraft MSN 361, a separate investigation was launched by the National Transportation Safety Board (NTSB) with support from Airbus to address the issue of hydraulic fluid contamination and its effect on structural strength. This program is ongoing, but preliminary conclusions include the following:

• Hydraulic fluid contamination does not have an immediate effect on mechanical strength; the effect takes time to develop.
  
• The effect of a hydraulic fluid/water mixture is more severe than that of hydraulic fluid alone.
  
• The effect of hydraulic fluid/water or hydraulic fluid is not reversible whereas the effect of water alone is reversible.

1.12.6 Impact Damage Tests

A series of impact tests was conducted to determine whether it was possible to cause a disbond between the honeycomb and the CFRP face sheets. Drop tower tests were conducted with spherical impactors of nose radii of 12.5 to 100 mm. The test panels had honeycomb cores 40 mm thick with 32 kg/m³ density, and face sheets with one CFRP ply and one GFRP ply. Advanced drop tower tests were conducted with a spherical impactor of 2000 mm nose radius and a cylindrical impactor of 100 mm radius. These tests resulted in crushed core or face sheet perforation depending on the energy level, but no disbonds.

Chapters 12-21-11 (Cleaning), 12-31-11 (Anti Icing), and 12-31-12 (Ice & Snow Removal) of the Airbus AMM warn that the impact pressure from fluid jets must not be more than 0.35 bar. High-pressure jets can potentially damage honeycomb structure. A survey of maintenance and de-icing facilities found that nozzle pressures in the range of 3.4 to 4.1 bars were common, with maximum up to 10.2 bars. However, the impact force that results from a spray jet depends on many factors, including the width of the spray and the distance of the nozzle from the aircraft. Airbus reports that it has no knowledge of damage occurring with pressures as high as 1 bar at the impact point. No fluid impact damage tests were conducted in the course of this investigation. However, it is considered that the misuse of a high-pressure spray would most likely result in damages similar to those caused by blunt impact, and would include core crush but no disbonds. It was reported that the occurrence aircraft was last de-iced on 19 February 2005, approximately two weeks before the occurrence.

1.12.7 Laboratory Tests of Rudder Residuals

1.12.7.1 General

Only a small amount of the occurrence rudder was recovered. The remaining honeycomb was examined and its density was consistent with production drawings.

Light microscopy examination of specimens from the occurrence rudder showed the characteristic kidney-shaped cross-section of Toray T300 carbon fibres, consistent with the design specification.

Specimens were taken from the CFRP face sheets of both side panels, rib 0, the front spar, and the hinge point 7 fin-side bracket. Only one deviation from drawings was found; an additional reinforcement layer on the front spar around one of the access holes was in the wrong orientation. A review of manufacturing records did not indicate any concession related to this deviation. The rupture of the front spar did not pass through this deviated lay-up. Stress analysis determined that this deviation had a negligible effect on strength and stiffness. Apart from this exception, all the lay-ups corresponded to manufacturer's drawings.

1.12.7.2 Bond Between Honeycomb and Face Sheets

The quality of the bond between the honeycomb and the face sheets is normally evaluated using a climbing drum peel test. Insufficient undamaged residuals of the occurrence rudder remained to conduct drum peel tests. The sole alternative approach to evaluating this bond was by examining the shape of the meniscus at the interface between the honeycomb and the face sheets. A number of cross-sectional specimens were taken to examine the meniscus. Meniscus formation was generally found to be similar to the baseline comparison panels.

1.12.7.3 Bond at z-section

The front and bottom edge of each rudder side panel is trimmed with a z-section. Specimens of the inner skin bond taken near the z-section along the front edge of the left side panel of the occurrence rudder had a meniscus whose appearance was consistent with insufficient bonding pressure within a width of 20 mm. The investigation revealed that this condition could be caused by insufficient caul plate pressure during cure, either resulting from mispositioning of the z-section or accumulation of tolerances of the components. In Figure 6, the upper sketch shows correct orientation during cure. The lower sketch shows how dimensional tolerances can result in low bonding pressure next to the z-section.

1.12.7.4 Inter-laminar Bond Between Face Sheet Layers

The quality of the inter-laminar bond between the individual face sheet layers was evaluated by examining sections under microscope. No unusual features were observed that suggested a poor laminate quality.

1.12.7.5 Splice Bond

A compound was used to bond around the perimeters of the honeycomb blocks. Small gaps in the bonding were observed at some locations, but these had a minimal effect on the strength of the joint. IR spectroscopy tests confirmed that the correct splice bonding material had been used.

1.12.7.6 Type of Resins

Resins in the residuals were identified using a combination of IR spectroscopy tests and visual microscopic examination. Results found that the resins in the occurrence rudder were consistent with Hexcel F550 for the CFRP and EHG250 or EP112 for the GFRP. It was not possible to distinguish between EHG250 and EP112 since they are identical in formulation and manufacturing process. It was confirmed that approved resin types had been used.

1.12.7.7 Cure of Resins

Differential scanning calorimetry tests were conducted to determine the adequacy of curing. All cures exceeded 98 per cent. For these resin systems, any value greater than 95 per cent is acceptable.

1.12.7.8 Lightning Protection Plate Replacement

The region of the recently repaired lower right LPP was examined. IR spectroscopy found that the adhesive used to fasten the new LPP was Hysol EA934 NA, as specified in the SRM. A cross-section specimen of the CFRP layer beneath the LPP was examined under microscope, and the only unusual feature was matrix cracking in the CFRP. To provide a baseline for comparison, an LPP was peeled from a comparison rudder side panel. A tap test of that comparison specimen found that the peeling had not resulted in a disbond, and a microscopic examination of the CFRP cross-section found matrix cracking similar to that in the occurrence rudder.

1.12.7.9 z-Strut Paint Chips

The area around the paint chips on the z-strut was examined by EDX. This analysis found no traces of titanium or steel residues in the paint chipped areas that would have been caused by contact with mechanical fasteners from the upper part of the rudder separating in a downward direction.

1.12.7.10 Explosion Damage

The rudder residuals and the VTP were visually examined by explosives specialists from the German police. There was no indication of damage or residue radiating outwards from an origin point, as would be the case if there had been an explosion.

1.12.8 Double Cantilever Beam Tests

The American Society for Testing and Materials (ASTM) Specification D5528 DCB test was adapted to determine the fracture toughness of the interface between the core and the face sheet. The standard test coupon is 50 mm wide, 220 mm long, and has an initial crack length of 35 mm. For this particular investigation, the test coupon was modified from the standard to include 0.8 mm and 1.6 mm-thick aluminum doublers over the face sheets to achieve peel angles that were more representative of disbond growth. Static and fatigue tests of double cantilever beam (DCB) specimens are ongoing.

1.12.9 Disbond Growth

1.12.9.1 History of Earlier Design Aramid Fibre-Reinforced Plastic Rudders

In the earlier design of the rudder, GFRP was used as the bridging layer between honeycomb and CFRP only in the reinforced region around the hydraulic actuators. Elsewhere, AFRP was used. The AFRP system resulted in poor bond strength of the interior skin. Those rudders experienced large in-service disbonds of the inner skins. Early AFRP rudders were of the design type that had two-part side panels - upper and lower. In the rudder of aircraft MSN 237, growth of the disbond was stopped by this joint and did not progress beyond it. Disbonds were discovered in service during routine inspection and had not led to rudder separation or adverse aircraft performance. AFRP rudders are no longer in service.

1.12.9.2 Temperature Effects

Tests were conducted to investigate the effect of temperature on the out-of-plane strength in terms of climbing drum peel strength and fracture toughness (G1c) measured by a modified DCB test. Climbing drum peel tests were conducted at room temperature and at −55°C. At room temperature, the failures tended to be in the honeycomb core, whereas at −55°C, they tended to be in the interface bond line between the honeycomb and the face sheet. It was found that the peel strength at cold temperature was significantly reduced to about 45 to 67 per cent of its value at room temperature. The steep angle involved in this method of test is not representative of the shallow angle at which a disbond in the rudder would propagate; therefore, DCB tests were also conducted.

DCB tests were conducted at room temperature and at −55°C. In all the tests, the failure tended to be in the honeycomb core, regardless of temperature. However, the cold temperature tests had fracture toughness values about 20 per cent lower. In addition, disbond growth at room temperature was steady and continuous, whereas at cold temperature, it was unstable.

1.12.9.3 Vacuum Cycling Tests

Test panels with various natural and artificial damage were placed in a vacuum chamber and cycled to a differential pressure of -0.7 bar to simulate ground-to-air cycles. The tests were accelerated, with each cycle lasting 90 seconds from ground to altitude and back to ground. In real time, a flight cycle lasts 540 minutes. One aircraft lifetime is 48 000 cycles. To provide conservative results, the test panels were fully sealed at the edges to impede breathing.

The following results were obtained:

• A specimen from the damaged left side panel of the rudder of aircraft MSN 361, which included the disbonded area (approximately 2256 cm²), was subjected to vacuum cycling at room temperature. The area of the damage almost doubled instantly at a pressure of 0.44 bar (absolute). The rapid propagation event was reported to be explosively loud and violent, resulting in some damage to the interior of the test chamber. During the test, a surface crack developed in the CFRP face sheet at the panel edge (Photo 7). This fracture halted any further damage growth by removing the pressure differential.

• A specimen from the right side panel of aircraft MSN 361 rudder was also tested. Since it was undamaged, an artificial disbond (approximately 338 cm²) was introduced. It was subjected to vacuum cycling with a change of pressure (DELTA P) of -0.7 bar at room temperature. The specimen completed the test program without failure.
• Eight test panels were constructed, which included 24 and 32 kg/m³ core densities and 30 and 40 mm thicknesses. Damage was introduced by sweeping out a disbond damage with a knife. The artificial damages had diameters of 100 to 250 mm. When exposed to cyclic vacuum loading, four of these panels demonstrated slow steady growth of the disbond and eventually failed in rapid propagation.
• A test specimen from the blunt impact test program, which had experienced crushed core but no disbond, was cycled for 10 000 flight cycles and showed no propagation of the damage.

1.12.10 Computer Simulation of Disbond Growth

Computer simulations were conducted using the LS-DYNA software to study the growth of the MSN 361 rudder disbond. The following conclusions were drawn:

• The MSN 361 rudder side panel with the disbond damage as found at the time of detection was sufficiently large to achieve unstable growth at reduced pressure altitude. Since it did not propagate in flight, it is most probable that it experienced leakage during the period before detection.
• A disbond of a size corresponding to the initial contaminated region of the MSN 361 rudder did not grow under reduced pressure altitude.
• When a disbond size corresponding to the initial contaminated region of the MSN 361 rudder was combined with a disbond at the z-sections at the lower front corner of the side panel, unstable disbond growth occurred at reduced pressure altitude.

1.12.11 Effects of Temperature and Moisture

Liquid water trapped in the honeycomb will expand as it freezes, and the repeated freeze-thaw cycle can gradually damage the cell walls. In other rudders where water ingress into the honeycomb has been documented, this infiltration has tended to occur around the hoisting points or near the trailing edge fasteners. These areas are the most likely entry paths for water since these design features involve a break in the continuity of the CFRP face sheets. On the occurrence aircraft, these areas of the rudder were not recovered, and it was not possible to determine whether the occurrence rudder had experienced liquid water ingress into the honeycomb.

The epoxy matrix in the face sheets and the Nomex® core material can absorb moisture from humid air or condensed water. Moisture absorption degrades the mechanical properties, especially of face sheets that are matrix or matrix-interface dominated, particularly at elevated temperatures. At certification, static strength of the composite structure was substantiated assuming a worst case of maximum service moisture content and by conducting tests at elevated temperature.

The temperature of an aircraft can reach extreme levels while parked on the ground due to the ambient temperature, solar radiation, and the colour of the aircraft. The rudder of the occurrence aircraft was painted dark blue, and its previous paint scheme had a black stripe across the rudder. United States Department of Transport paper DOT/FAA/AR-04/30 describes tests involving CFRP laminate panels of different colours, whose temperature was measured during exposure to sunlight. The highest measured value was 82°C at an ambient temperature of 33°C. No thermal analysis was conducted for the A310 rudder, but a thermal analysis for the VTP fin box of another model of transport aircraft found maximum temperatures of 91°C in still air on the ground, and 76°C when moving.

High temperature can have an adverse effect on the mechanical properties of composite materials. If the material's glass transition temperature is exceeded while under load, the structure can experience plastic deformation. The onset glass transition temperature for F550/EHG250 resin is 102°C dry or 75°C wet. Given the occurrence rudder's age, its onset glass transition temperature had most probably reached its saturated or equilibrium state, and was closer to the 75°C value.

1.12.12 Age-Related Structures and Materials Degradation

The possibility was studied that there might be some unknown phenomenon at work that could cause a reduction in structural stiffness with age. Such a reduction in stiffness could result in a reduced flutter speed and lead to flutter. In 2004, Airbus conducted GVT in support of its MRTT program. The testing was conducted on an aged A310 aircraft (MSN 523) that had accumulated over 28 000 flight hours. This test aircraft had the same design of VTP and rudder as the occurrence aircraft. GVT results found that fin bending and rudder rotation frequencies of the MRTT test aircraft were consistent with those obtained during the original A310-300 certification. No indication was found to suggest that stiffness had reduced with age.

Airbus Report TN-ESWCG-1181/02 documents an earlier investigation of material properties changes with age. The glass transition temperature (Tg) was measured for specimens of CFRP materials Hexcel F913 and F550, and GFRP material EHG250. These results were compared with those from specimens analyzed 14 years earlier during material qualification, and there was no indication of age-related Tg degradation.

Climbing drum peel tests were conducted with specimens from the two unused baseline reference panels, which were roughly the same age as the occurrence rudder. Tests results were in the range expected, and there was no indication of age-related degradation in peel strength.

1.12.13 Flight Dynamics Analysis

1.12.13.1 Background

To study the aircraft response during the occurrence, the Airbus A310 flight model was configured to simulate the aircraft's behaviour following a loss of rudder surface area. It was first necessary to determine the movement of the flight controls (ailerons, rudder, elevator, and spoilers). This was done using the merged DFDR and DAR data. It was also necessary to derive parameters not available directly from the DFDR, such as sideslip, and to modify existing parameters to take into account data latencies. The mass properties of the aircraft (that is, weight, inertia, CG) at the time of the incident were derived using the load and trim sheet for TSC961. Modifying the aircraft configuration to simulate rudder loss required modification of lateral-directional aerodynamic coefficients to take into account the loss of surface area. This modification was done by applying an adjustable ratio to the appropriate aerodynamic coefficients, allowing investigation of differing amounts of rudder loss.

1.12.13.2 Initial Simulations

Seven initial simulations were performed and the outputs were compared to the existing DFDR and DAR data to determine their applicability to the occurrence scenario. Of these seven simulations, four were performed with different amounts of rudder loss and with different aircraft mass properties. Three simulations were performed to evaluate additional aircraft behaviour related to the incident. The timeframe of interest was from 0701:57 (approximately 4 seconds before autopilot 2 was disconnected) to 0702:14 (approximately 13 seconds after autopilot 2 was disconnected). The actual event was not simulated, since there were significant structural dynamics issues with which the flight dynamics simulator could not deal.

The results of the simulations were presented graphically showing different lateral-directional flight parameters as determined by the simulation compared with flight data derived from the DFDR and DAR. In all cases, the properties of interest for comparison with the flight data were the magnitude and the frequency. Matching these two properties of interest for all aircraft parameters would indicate a simulation configuration similar to the aircraft at the time of the occurrence.

The only simulation that reasonably matched the frequency and amplitude of the DFDR and DAR data was one in which there was a reduction of the useable rudder by 84 per cent and a reduction in the yaw moment of inertia by 10 per cent. The moment of inertia calculations for the aircraft at the time of the incident were only accurate to 10 per cent, which means that the mass properties for this simulation were within the limits of the calculations for the aircraft.

1.12.13.3 Simulations to Determine the Lateral Force at Tail During the Event

The initial event was characterized by significant lateral acceleration excursions, suggesting that a lateral force was applied to the right-hand side of the aircraft during the event. The Airbus flight dynamics simulator was unable to investigate structural dynamic aspects of the initial event but could provide an indication of the magnitude of the force required to initiate the Dutch roll motion.

The only way the simulation could introduce this force into the aircraft was through rudder movement. The rudder input was constrained by the limitation of the rudder control jacks of 60° per second. The simulated lateral acceleration resulting from the rudder input was then compared to the DFDR and DAR data. The rudder motion required to obtain the lateral acceleration was significant when compared to the DFDR and DAR data. A movement of this magnitude and duration would have been recorded on the DFDR and DAR; therefore, the rudder was not the source of the force. The force generated by this rudder motion had a peak value of 108 000 newtons (N) applied at 0701:54. Although the source of the force is not known, this does give an indication of the magnitude of the lateral force involved in the initial event.

1.12.13.4 Simulations to Determine the Longitudinal/Vertical Force at Tail During the Event

In addition to the lateral acceleration, increases in pitch angle, angle of attack, and vertical acceleration were observed in the DFDR and DAR data during the initial event, indicating a nose-up motion, whereas the stabilizer position was commanding a nose-down motion. The Airbus flight dynamics simulator was used to investigate the magnitude of longitudinal and vertical forces required to produce this motion.

The forces were simulated through changes to the pitching moment coefficient, lift coefficient, and drag coefficient. The combination of these changes that best matched the DFDR and DAR data indicated that a downward vertical force of approximately 36 000 N at 28 m aft of the CG and a rearward horizontal force of approximately 35 000 N at approximately 9.5 m above the CG were applied to the aircraft approximately one second after the application of the lateral force described above or at 0701:55.

1.12.13.5 Additional Simulations

Additional simulations were conducted to better understand the results of the initial simulations. These additional simulations covered the time period from 0701:50 to 0702:15 and included the time of the excessive rudder deflection. Four simulations were performed with different rudder breakup scenarios. The simulation that best matched the DFDR and DAR data was 76 per cent rudder loss at 0701:28, increasing to 80 per cent rudder loss at 0701:32.5 to 0701:33, and increasing again to 84 per cent rudder loss at 0701:34.5 to 0701:35. An important result of these simulations was that the rudder movement recorded on the DFDR and DAR was made by a part of the rudder that was not aerodynamically effective.

Combining the results from these simulations with the investigation of the lateral, longitudinal, and vertical forces suggests the following scenario:

• At 0701:54, a lateral force of approximately 108 000 N was applied to the aircraft.
• One second later, at 0701:55, a horizontal force of 35 000 N was applied 9.5 m above the CG, and a vertical force of 36 000 N was applied 28 m behind the CG.
• The application of the horizontal and vertical force coincided with an initial rudder loss of 76 per cent.
• Over a period of approximately seven seconds after the initial rudder loss, the rudder continued to break up, with 80 per cent rudder loss occurring between 0701:59.5 and 0702:00, and 84 per cent rudder loss occurring at 0702:02.
• The results also suggest that the excessive rudder deflection recorded on the DFDR and DAR at 0702:00 was made by a part of the rudder that was not aerodynamically effective.

1.12.13.6 Yaw Damper Modelling

After the initial event, the DFDR and DAR data indicated that the rudder was moving in a sinusoidal pattern, which frequency analysis showed to be similar to the frequency of the lateral acceleration. This would indicate that the movement of the rudder was connected with the aircraft movement. One theory proposed for the rudder movement was the operation of the YD. To confirm this theory, the YD system was modelled after information on YD mechanization provided by Airbus.

When the YD model output was compared with DFDR and DAR rudder movement data, corrected to remove a rudder motion sensor bias and a time lag introduced by the system data acquisition concentrator, it showed that the rudder movement closely matched the predicted YD output. The only significant deviation occurred approximately five seconds after the initial event, where the DFDR and DAR data showed a large rudder motion that exceeded the mechanical limits of the rudder. This motion was attributed to the loss of rigidity in the rudder due to the breakup.

1.12.14 Effect of Disbond Bubble on Static Aerodynamic Loads

A rudder side panel disbond or in-plane core fracture, under the influence of aerodynamic loads, could result in the affected area bulging outwards with a bubble-like appearance. An analysis was conducted to determine the effect of such a bubble on static aerodynamic loads. The analysis was conducted using computational fluid dynamics based on geometrical information from the finite element analysis model. The analysis was repeated for rudder deflection angles of 1° and 6°, under the flight conditions that existed at the time of the occurrence. At 6° deflection, the disbond bubble caused a 1 per cent increase in rudder force and a 2.4 per cent increase in total VTP force. At 0° rudder deflection, which was the situation at the time of the occurrence, the disbond bubble had a negligible effect on rudder and VTP loads. Therefore, the presence of a disbond bubble would have a comparatively small effect on static aerodynamic loads.

1.12.15 Flutter Analysis

1.12.15.1 Analysis of a Dynamic Event

The lateral load traces obtained from the DFDR and DAR were coincident except for a two-second period at the beginning of the occurrence. This suggested the possibility of a dynamic event. Since the sampling rate was only 4 Hz, it was not possible to determine the amplitude and frequency of the dynamic signal. Therefore, the signal was analyzed using a simplistic manual experimental curve-fitting approach. Using this method of analysis, it was not possible to find a unique solution.

However, it was possible to fit the DFDR and DAR data by assuming both a high- and low-frequency component, a loss in damping, and by assuming that the first part of the signal was divergent and the second part was stable. Since there was a dynamic event, and flutter is a dynamic phenomenon, a flutter analysis was conducted to determine whether it was possible to find a scenario involving flutter before or after the rudder rupture, consistent with the available data.

1.12.15.2 Method of Analysis

A theoretical flutter analysis was conducted to study the effects of various failure scenarios on the aircraft's flutter characteristics. The analysis was done using a complete aircraft model, flutter computations with 70 modes, and 1 per cent structural damping. This same method of flutter analysis was used for the original certification, and at the time, was substantiated both by GVT and flight testing. The doublet lattice analysis method that was used does have limitations that may affect the accuracy of predictions in cases such as a disbonded skin panel on one side panel only. A preliminary investigation of advanced techniques was conducted, but the state of development of these approaches was not sufficiently advanced to be useful in the analysis.

1.12.15.3 Baseline Analysis

The baseline case represented an aircraft with no structural damage. The flutter analysis found that the basic coupling mechanism involved a 6.76 Hz fin bending mode and a 13.18 Hz rudder rotation mode. There were sufficient damping margins at both the occurrence speed of 270 KCAS and the design dive speed of 406.5 KCAS.

1.12.15.4 Failure Scenarios

Flutter analyses were conducted to study the effect of the following structural failure scenarios:

• Disbond - The scenarios involved varying degrees of disbond between the honeycomb core and the inner face sheet, as shown in Figure 7. Single-sided disbonds were studied on the left panel, the right panel, and both panels. Simulating a disbond between the core and the face sheet was accomplished in the analysis by reducing the stiffness of the face sheet to 0 or 20 per cent of its original value in the affected area. The analysis found that there was an increase in flutter tendency with greater disbonds, and that double-sided disbonds were more critical than single-sided ones. There was no significant difference between left-side and right-side disbonds. No flutter was observed when stiffness was reduced to 20 per cent. When it was reduced to 0 per cent, the double-sided 2.9 m² disbond scenario and the single-sided 5.6 m² disbond scenario resulted in violent flutter below 150 KCAS. A more detailed examination of the single-sided 5.6 m² disbond scenario, within the range between 0 and 20 per cent stiffness, found that the flutter speed decreased as the stiffness was reduced, and that this decrease was steady and continuous down to about 5 per cent stiffness where flutter started. Below 5 per cent stiffness, the frequency and damping decreased rapidly leading to flutter conditions.
• Free Rudder - This scenario simulated a chordwise fracture of the rudder just above the hydraulic actuators, resulting in a free upper rudder. This model demonstrated flutter of several modes below 270 KCAS, the speed at the time of the occurrence.
• Trailing Edge Screws Removed - This scenario simulated the removal of all the trailing edge screws. The analysis found that the flutter behaviour of this model was nearly unchanged relative to the baseline scenario. The reason for this was that the trailing edge connection was still intact so the torsion cell was still closed.
• Trailing Edge Connection Removed - This scenario simulated the removal, to varying degrees, of the trailing edge connection. The analysis found that the tendency to flutter increased with the increasing size of the damage, and that flutter within the flight envelope was possible with the larger damage areas.
• Fractured Front Spar - This scenario assumed that the rudder front spar was fractured above the hydraulic actuators. The analysis found that there was only a slight deterioration in the rudder-rotation/fin-bending flutter coupling relative to the baseline scenario.
• Loss of Rudder Below Hinge 2 - This scenario assumed that the section of rudder below hinge point 2 was lost. The analysis found that the rudder rotation frequency increased significantly due to the missing rudder mass, but there was no coupling.
• Upper-End Disbond - This scenario assumed a large one-sided disbond at the upper end of the rudder. Twenty percent stiffness was assumed in the disbonded area. The analysis found that there was only a small change in damping relative to the baseline scenario.
• Hinge Failures - Five scenarios were evaluated involving the following failures: failure of hinge 1; failure of hinge 7; failure of hinges 1 and 7; failure of hinges 6 and 7; and failure of hinges 5, 6, and 7. The analysis found that scenarios for failures of hinge 7, and failures of hinges 1 and 7 did lead to flutter, but this occurred beyond 400 KCAS, outside the design envelope. The remainder of the scenarios did not show any flutter-critical couplings.
• Hinge Stiffness - Three scenarios were evaluated involving the following failures: 75 per cent of nominal stiffness, all 7 hinges; 50 per cent of nominal stiffness, all 7 hinges; and 25 per cent of nominal stiffness, all 7 hinges. The analysis results showed that none of these scenarios presented any significant deterioration in coupling of the fin bending and rudder rotation modes compared to the baseline scenario.
• Hydraulic Actuator Stiffness - Three scenarios were evaluated involving the following failures: 75 per cent of nominal stiffness, all 3 hydraulic actuators; 50 per cent of nominal stiffness, all 3 hydraulic actuators; and 25 per cent of nominal stiffness, all 3 hydraulic actuators. The analysis results showed that decreasing the hydraulic actuator stiffness increased the tendency to flutter. At 25 per cent stiffness, a flutter speed of 268 KCAS was calculated.
• Single Hydraulic Actuator Disconnection - Three scenarios were evaluated involving the following failures: disconnection of actuator at hinge position 2; disconnection of actuator at hinge position 3; and disconnection of actuator at hinge position 4. The analysis found no flutter with the disconnection of one actuator. Further analysis found that, when simulating a double hydraulic failure, the reduction of rudder rotation mode frequency was only 0.33 Hz and did not lead to flutter.
• Actuator Stiffness versus Actuator Disconnection - A comparative analysis of the two previous scenarios found that disconnecting one hydraulic actuator has the same effect as all three actuators having 66 per cent of their nominal stiffness.
• VTP Attachment Failure - A flutter analysis was conducted to determine the effect of failed VTP main attachment fittings on flutter. The analysis found that the disconnection of one or both of the VTP rear attachments did not provide a flutter-critical coupling.
• Extra Rudder Mass - This design of rudder is not mass-balanced. Any condition that adds mass to the rudder and moves its CG aft, further away from the hinge line, has an adverse effect on the flutter margin. Excessive paint layers or fluid ingress are examples of conditions that could cause such an effect.
  • Extra Mass at Trailing Edge - The analysis simulated extra rudder mass by increasing the mass of the trailing edge screws. This analysis found that 142 kg distributed at the trailing edge was necessary to produce flutter at the occurrence speed of 270 knots. The analysis also found that, with 71 kg of extra mass, there was adequate damping at the occurrence conditions.
  • Extra Paint - The analysis simulated extra mass distributed evenly over the surface of the rudder. This analysis found that, at the occurrence speed of 270 knots, the addition of mass did not significantly reduce the damping. At high speeds, the addition of the initial 19.3 kg of extra paint significantly reduced the damping.
  • Pooled Fluid in Rudder - A flutter analysis was conducted to determine the effect of pooled fluid in the rudder leading edge as was found in the rudder of aircraft MSN 701. It was found that, since this extra mass is concentrated so close to the hinge line, it had a negligible effect on flutter.

1.12.15.5 Summary of Flutter Analyses

The analyses found that flutter could occur within the certification envelope for three damage scenarios:

• free rudder or free rudder section;
• significant decrease in hydraulic actuator stiffness; and
• significant reduction in rudder torsion stiffness by extensive disbond or failure of trailing edge connection.

In all these scenarios, the necessary damage was significant and exceeded certification requirements.

1.12.16 Time-Domain Flutter Analysis

1.12.16.1 General

The flutter analysis results described above were presented graphically by frequency and damping curves versus speed. In order to correlate this flutter analysis with the results of the flight dynamics analysis and the recorder data, which were presented as curves versus time, the following time-domain flutter analysis was conducted to observe the flutter amplitude versus time.

1.12.16.2 Method of Analysis

A time-domain flutter analysis was conducted for two of the failure scenarios: single-sided 5.6 m² disbond with less than 5 per cent stiffness of the original panel and free upper rudder. The aim was to produce time histories and correlate the resulting loads. The analysis was conducted in time steps of 0.001 second. The structure was excited with a lateral force of 1 kilonewton (kN) at the VTP tip acting as a step pulse starting at time step 100 with a 0.1-second duration.

The following variables were examined:

• rudder deflection (top, middle, bottom);
• loads at all seven hinges;
• forces at all three actuators;
• loads at VTP attachments (front, middle, rear); and
• lateral accelerations (cockpit, CG/DFDR, VTP attachment, VTP tip, rudder top and bottom)

1.12.16.3 Results

Upon excitation, the amplitudes of all the responses started to grow. Figure 8 shows a typical load response at the left rear VTP attachment. At design ultimate load, the maximum force acting at the aft VTP attachment is approximately 700 kN, and based on the attachment fittings damage, it is known that loads during the occurrence did exceed ultimate strength. Therefore, the time step where the load peaked above 700 kN was selected as a reference point for each scenario. All the remaining monitored variables were measured within an envelope around the reference time step, since all the maxima did not occur at the same time. Their peak value within this envelope was recorded. Both investigated scenarios showed no contradictions with respect to restraints like VTP attachment rupture load and maximum rudder rotation. The free upper rudder scenario did not exhibit any significant hinge loads in the fore/aft direction, and the VTP attachments would have failed before the hinges. Since this contradicts the observed damage, this scenario is excluded as a realistic damage scenario.

The single-sided 5.6 m² disbond with less than 5 per cent stiffness of the original panel scenario did exhibit significant hinge loads in the fore/aft direction. The time-domain flutter analysis determined that hinge 5 would be the first to fail and that it would fail before the VTP main attachment fittings were damaged. A second time-domain flutter analysis was conducted to study this scenario with a disconnected hinge 5. That analysis found that, after the failure of hinge 5, the loads of hinge 6 exceed allowable loads while VTP rear attachments reached a level above ultimate but below rupture.

1.12.17 Summary of Flutter and Time-Domain Flutter Analyses

Flutter and time-domain flutter analyses were conducted for a number of failure scenarios. One scenario, the single-sided 5.6 m² disbond with less than 5 per cent stiffness of the original panel, provided a credible response and showed good correlation with the observed damage, the recorder data, and the flight dynamics analysis.

1.12.18 National Transportation Safety Board Radar Data Analysis Study

The NTSB conducted a trajectory analysis of the Florida Keys (KEY), Melbourne (MEL), Tamiami (TMA), and Cudjoe Key (CUD) air route surveillance radar data to identify the numerous tracks in the vicinity of the track of TSC961 at the approximate time the rudder separated from the aircraft. The aim was to distinguish larger pieces of debris from smaller shards and examine relative timing of events. The caveat was that radar has many variables that cannot always be reverse-engineered. No discernable track of an initial separation or a sustained track that would resemble a large piece of aeroplane part was evident. The tracks of the returns resembled numerous small pieces floating with the prevailing winds.

1.12.19 Other Aircraft in Vicinity

ATC records indicated that there were no other aircraft with an instrument flight rules discrete transponder code at a similar altitude within 60 nautical miles (nm) of the occurrence aircraft at the time of the event. The nearest aircraft was at FL 320 feet approximately 70 nm to the east. All other aircraft were considerably lower and further away.

1.12.20 Space Objects

Military authorities reported that, at the time and place of the occurrence, records did not indicate any man-made objects re-entering the atmosphere. Records were unavailable for natural objects re-entering the atmosphere.

1.13 Organizational and Management Information

1.13.1 Company Operations

Air Transat is authorized by TC to provide the types of services specified in its air operating certificate (AOC). Part I of the AOC, in part, authorizes non-scheduled and scheduled international operations between Canada and points abroad and between points abroad using its A310 aircraft.

1.13.2 Maintenance Organization

Since February 2002, the occurrence aircraft was maintained by Air Transat, which operates a fleet of 14 wide-body aircraft (A310 and A330) under a quality safety management system (QSMS). Air Transat's QSMS is a component of a management control system that deals with quality and safety. Air Transat's QSMS includes an accountable executive, a safety management plan, safety oversight, training, quality assurance, documentation, and an emergency response plan.

The Air Transat maintenance program in place at the time of the occurrence was approved by TC on 10 December 2004 under approval number Q-0188. Air Transat holds a TC-approved maintenance organization (AMO) certificate, as per Part 5, Sub-Section 73, of the CARs, under AMO 32-87. The company has approximately 285 employees in the maintenance department. The company is capable of doing line and heavy maintenance, minor and major repairs, and modifications for Lockheed 1011, Airbus 310 series, Airbus 330 series, and Boeing 757 series aircraft.

Air Transat also holds the privileges of specialized maintenance rating on sheet metal structure, composite structure, arc welding, avionic systems, and components, as per Section 573.02 of the CARs. The review of the Air Transat AMO showed that the organization has up-to-date Maintenance Control and Maintenance Policy manuals that outline the requirements for the technical operation.

Air Transat was last audited by TC from 06 to 17 May 2002. Air Transat was not approved to perform C-checks on its Airbus aircraft. The last C-check on C-GPAT was completed by TAP Portugal in May 2004. Air Canada Technics has been used for C-checks on the occurrence aircraft as well as on other Air Transat aircraft.

1.14 Additional Information

1.14.1 All Operators Telex-Fleet Inspection of Rudder

1.14.1.1 AOT-1-Fleet Inspection of Rudder Exteriors

As a result of this investigation, the aircraft manufacturer issued AOTs A310-55A2035, A300-55A6035, A330-55A3035, and A340-55A4030 on 17 March 2005 for the inspection of all aircraft with part number A55471500 series rudders (Figure 9). These AOTs were subsequently made mandatory by an Airworthiness Directive issued by the Direction Générale de l'Aviation Civile (DGAC) of France, the State of manufacture. This inspection included 222 A310s, 146 A300-600s, 6 A330s, and 34 A340s. The aim was to verify the structural integrity of the rudder and its attachment by means of one-time visual and tap-test inspections. This included a GVI of the VTP rear spar aft face, DVI of the hinge arms and actuator support fittings, DVI of the rudder hinge fittings, and a tap test of the rudder side panels. The tap test was conducted around the exterior perimeter of the rudder side panels as per the normal five-year inspection, as well as the inspection of additional bands through the centre as shown in Figure 9. It is noted that an exterior tap test is unable to detect disbonds on the interior face sheets. Airbus obtained results from operators for over 80 per cent of the affected aircraft, with the following results:

• Side panel disbonds and delaminations were found on a small number of aircraft but were all within SRM repair limits.
  
• Damage at hoisting points was found but the damage was below the size requiring immediate repair and was within SRM repair limits.
  
• Some corrosion was reported at hinge fittings but was assessed as having no impact on structural integrity.
  
• Some free play was reported at hinge bearings but was assessed as having no impact on structural integrity.
  
• No trends were observed in the damage data, which would suggest batch tendencies.
  
• None of these findings approached a level that could result in failure in flight.

1.14.1.2 AOT-2-Fleet Inspection of Rudder Interiors

On 02 March 2006, the aircraft manufacturer issued a second series of AOTs (AOT A310-A552043, AOT A300-A556042, AOT A330-A553036, and AOT A340-A554031) for the inspection of all aircraft with rudder part number A55471500 series rudders. These AOTs were subsequently made mandatory by two Airworthiness Directives issued by the European Aviation Safety Agency (EASA), representing the State of manufacture. The aim was to verify the structural integrity of the rudder by means of a one-time tap-test inspection to the interior face sheets of the rudder side panels, as well as checking the drainage holes at the bottom of the rudder and cleaning hydraulic fluid from the external surfaces. Access to the interior of the rudder was through the inspection holes in the front spar of the rudder. It is noted that the access to inboard surfaces from the inspection holes is limited. Figure 10 shows the areas of inspection. Airbus obtained results from operators for over 90 per cent of the affected aircraft and no disbonds were found.

2.1 General Information

TSC961 departed Varadero on a scheduled flight and was being flown by qualified crew members in accordance with applicable regulations and procedures. Documentation indicates that the aircraft was equipped and operated in accordance with applicable regulations and procedures. Weather and navigation aids were not considered as factors in this occurrence.

2.2 Flight Control System

2.2.1 General

The investigation of the aircraft flight control system and related subsystem components revealed that there were no control system anomalies or conditions that could have led to the breakup of the rudder.

2.2.2 Ability to Diagnose the Source of Flight Control Difficulty

Throughout the flight, the nature of the structural damage could not be precisely identified. Only when rudder inputs were made in the final stages of approach and landing did it become apparent that rudder response was abnormal and inadequate.

The problem the crew was facing could be described as "flight control difficulties of unknown origin." There is no established procedure for this problem. The ambiguous nature of the symptoms made it difficult for the crew to assess the situation and to form a clear diagnosis of what had caused the control problems that they had experienced.

2.2.3 Dutch Roll Recovery

During their initial training, the pilots were shown a Dutch roll in the simulator; this was their only encounter with this situation. The integrity of any abnormal procedure checklist relies on the premise that only the correct procedure should be used for a given situation, and that the procedure should be completed in its entirety. On the A310, most procedures are displayed on the ECAM, and as each procedure item is properly completed, the item is removed from the display screen. Completing the associated procedure ensures best safety of the flight. There is no procedure in the QRH or on the ECAM that deals with Dutch roll. Only the Airplane Upset Recovery Training Aid gives general guidelines, and it does not deal specifically with systems such as the autopilot. There was insufficient guidance regarding Dutch roll recovery technique. Additional information may have prevented the crew from worsening the flight characteristics as was the case when the autopilot was re-engaged.

2.2.4 Decision to Return to Varadero

Shortly after the rudder loss, the crew took steps to descend and divert to a nearby airport. As the flight progressed, the Dutch roll decreased and then ceased as they descended. By the time the crew was in a position to complete an approach to either Miami or Fort Lauderdale, there were indications that the aircraft would continue to fly normally. The determination of where to land was influenced by the following: there were no symptoms remaining related to the noise, vibration, or Dutch roll; there were no ECAM messages, warning lights or cockpit indications related to the control problems; the flight could continue at low altitude; and the company was better equipped to deal with the passengers and aircraft at Varadero.

The investigation determined that the aircraft was not in danger of losing the VTP during the flight, either through loss of static strength or loss of stiffness.

2.2.5 Decision not to Declare an Emergency

The timely declaration of an emergency allows the aircrews to be helped to the greatest possible extent when dealing with abnormal or emergency situations.

Declaring an emergency and clearly communicating the nature of the problem allows ATC to more easily coordinate between units and anticipate the needs of the crew in planning traffic management. It also serves to ensure that the flight will get immediate attention from controllers should the situation change. If ATC is aware that an aircraft is having control difficulties, it can incorporate this knowledge into its planning, and provide, among other things, more manoeuvring space and a longer final approach. Without this information, there could be unexpected and undesirable consequence such as the aircraft being unable to comply with ATC requests resulting in the requirement to execute a missed approach or other manoeuvre that would delay landing.

Air Transat's operations manual recognizes that there are a wide variety of possible emergency situations and leaves it to the discretion of the crew as to when an emergency should be declared. In this occurrence, by the time the crew was in a position to communicate to ATC, they had full control of the aircraft and did not feel it necessary to declare an emergency.

2.2.6 Crew Communication and Decision Making

In abnormal and emergency situations, effective crew communication enhances effective pilot decision making in that decisions will be based on all available information. In this occurrence, information that might have been relevant, specifically the magnitude of the forces incurred in the aft galley and the subsequent adverse effects or a description of the noise (volume and type of sound) heard by the FAs, was not communicated to the flight crew.

This information was not communicated because, given the intensity of the noise and vibration, all members of the cabin crew assumed that their experience was representative of the experience throughout the cabin. In addition, the captain assumed that, if potentially valuable information existed within the cabin, the FD would have such information and would provide it without being asked.

The assumptions persisted despite training given to all crew members that emphasized the importance of sharing all information and not assuming other crew members have a complete understanding of events. Air Transat's written procedures provide a structured format for the flight crew to provide a briefing to cabin crew but there is no requirement for the FD to seek information from the rest of the crew.

In this case, the provision of information related to the severity of events experienced in the aft cabin may not have had a significant impact on the decisions taken by the crew or the outcome of the occurrence. However, in other circumstances, the lack of information could have severe consequences. Procedures and practices that do not facilitate information sharing between crew members increase the likelihood that decisions will be based on incomplete or inaccurate information, placing passengers and crew at risk.

2.3 Maintenance

2.3.1 Maintenance Program

No shortcomings were found in the Air Transat maintenance organization, facilities, procedures, the control of maintenance activities, or personnel qualifications. It was concluded that the aircraft was maintained in accordance with the approved maintenance program.

2.3.2 Maintenance Records

The investigation examined the maintenance records of Air Transat as well as those of the aircraft's previous owner. There were no remarkable issues with the rudder, apart from the repair of some minor lightning strike damage at the tip of the rudder approximately eight years prior.

2.3.3 Hinge Bearing Condition

Although the occurrence aircraft had one rudder hinge line bearing at position 2 that exceeded the AMM tolerances and 3 of 10 VTP side hinge arm bearings that were partly seized, there had been no reports of rudder vibration on the occurrence aircraft, no significant free play was measured on the residuals, and partially seized bearings could still be rotated. It is therefore concluded that the general condition of the rudder hinges indicates that they were not a factor in the occurrence.

2.3.4 Adequacy of Rudder Inspection Program

Daily and transit checks of the rudder consist of a GVI conducted from the ground. These inspections can only detect significant external damage because the rudder is as high as 15 m in the air, and the view of the rudder is partially blocked by the horizontal stabilizer. Therefore, the daily and transit checks are limited in their effectiveness to detect rudder damage.

Air Transat conducts the 2-C check of the rudder every 30 months and it consists of a GVI conducted at arm's length. This inspection can only detect externally visible damage. It does not assess the inside condition of the rudder, nor detect such anomalies as inner skin disbonds or fluid ingress. Therefore, the 2-C check is limited in its effectiveness.

A tap test of the rudder side panels is conducted every five years. This tap test is limited to a 40 mm-wide strip along the front edge of the rudder side panels, and a similar narrow strip along the lower part of the trailing edge. This inspection cannot detect damage in the side panels outside these limited areas, and the tap test will only detect large inner-skin disbonds. Therefore, the five-year inspection is limited in its effectiveness.

During the fleet-wide inspection that followed the occurrence, other NDI techniques were used such as ELCH, X-ray, ultrasonic, and thermography, and they demonstrated their effectiveness in finding damage not detected by tap test or visual inspection. For example, these techniques were responsible for finding cases of water ingress and inner-skin disbond. Although these alternate NDI techniques are available, and even used on other parts of the aircraft (that is, thermography is used to inspect the elevators), they are not part of the scheduled maintenance program for the rudder. Therefore, there are more effective NDI techniques available than those used by the current maintenance program.

An effective inspection program must offer an acceptable probability of detecting damage before it can grow to critical size. The occurrence rudder did receive its five-year tap-test inspection in May 2001, and during the intervening period, it was visually inspected in accordance with the maintenance program with no finding. Nevertheless, the limitation of the inspection techniques does not guarantee that there was no damage present that could grow to critical size without detection. Therefore, the current inspection program is not adequate to detect damage to the rudder assembly in a timely and consistent manner.

2.4 Recorders

2.4.1 Cockpit Voice Recorder Duration

The lack of information from the 30-minute CVR regarding the rudder-loss event, including the noises heard by the cockpit and cabin crew and the associated vibrations, hindered the investigation. A two-hour CVR would have captured the sounds of the vibrations on the cockpit area microphone, providing important information on the vibration frequencies. The lack of adequate data increased the workload of investigators and hampered their ability to obtain a timely, complete, and accurate understanding of the event.

2.4.2 Digital Flight Data Recorder Data Sampling

A two-second highly dynamic event was identified when the DFDR and the DAR data were merged and lateral accelerations were compared. The determination of the frequencies involved was not possible due to the low sampling rates of the recorded accelerations. Although the sampling rates meet current performance standards required by regulation, they were not adequate for capturing the highly dynamic conditions that may exist during an accident.

2.4.3 Digital Flight Data Recorder Filtered Data

To investigate the rudder failure and resulting aircraft response, a performance analysis was undertaken that required accurate control surface position data. The DFDR - recorded control surface position data are not the raw sensor data. The raw sensor data are filtered by the system data analog converter before being recorded. The probable rudder position history was calculated using filtered information. The analysis suggested that the filtering produced 0.4-second data latency and reduced the amplitude by up to 1° during the initial high-frequency oscillations. The rudder position filtering and the necessity for additional analysis adversely affected the accuracy and effectiveness of the investigation efforts.

2.4.4 Preservation of Recorder Information

In this occurrence, disabling the CVR at engine shutdown would not have prevented the loss of information recorded at the time of the rudder failure, because the CVR was a 30-minute device, and the event occurred more than one hour before landing in Varadero. Nevertheless, there are situations for which securing the recorders after landing will preserve valuable evidence, as past investigations have shown (TSB reports A00A0185, A01W0117). No procedure for disabling recorders after landing was available to the crew.

2.5 Analysis of Rudder Failure Mechanism

2.5.1 General

The investigation studied the possibility of the rudder failing either as a result of a static loading phenomenon or of a dynamic loading phenomenon.

2.5.2 Static Loading Phenomenon

2.5.2.1 Large Rudder Deflection

The rudder control system was operating correctly and no indications were found that the rudder made a deflection beyond authorized deflection limits. It is concluded that the failure was not caused by a large rudder deflection.

2.5.2.2 High Static Load

The investigation reviewed the static load tests, sub-component tests, and damage tolerance tests that had been conducted during initial certification, and concluded that the rudder was designed with adequate strength to react to static loads encountered within the structural design envelope. A review of recorder information revealed that the aircraft was operating within its design envelope and that it did not experience a high load event either on the occurrence flight or on an earlier flight. It is concluded that the failure was not caused by a high static load.

2.5.3 Dynamic Loading Phenomenon

The analysis of the lateral load signal from the DFDR and DAR found an indication that the occurrence was associated with a dynamic event. The following were examined as possible causes of this dynamic event.

2.5.3.1 High-Frequency Control Input

The investigation of the aircraft systems did not reveal any conditions that would have resulted in a control-induced dynamic event. DFDR and DAR recordings did not show any indications of high-frequency control movement in the period leading up to the occurrence. It is concluded that the dynamic event was not caused by a high-frequency input from the control system.

2.5.3.2 Flutter

The lateral load signals recorded, the damage to the VTP main attachment fittings, the damage to the rudder hinge arms at positions 5 and 6, as well as the noise and vibrations felt during the event are consistent with flutter.

2.5.4 Possible Causes of Flutter

2.5.4.1 Flutter without Prior Structural Deviation

Flutter analysis confirmed that a rudder with no structural deviations will not flutter within the design envelope. The investigation showed that the rudder was operated within the design envelope; therefore, the rudder did not experience flutter without a prior structural deviation.

2.5.4.2 Flutter Following Structural Deviation

The investigation revealed that rudder imbalance and hinge free play would not have led to flutter. It was determined that the most probable cause of flutter was a large disbond-type damage. The presence of additional minor factors such as possible water trapped in the honeycomb and excess paint would marginally reduce the size of the disbond necessary to cause the flutter.

2.5.5 Growth of Rudder Damage

Vacuum cycling tests conducted resulted in damage growth. Therefore, the pressure differential between the air inside the honeycomb and the reduced external air pressure at cruise altitude might have acted as the driving force for the growth of core/face sheet separations or in-plane core fractures.

This particular rudder design does not include any damage growth arrest features in the side panels such as a mechanical barrier. Once damage starts to grow, it can continue to grow until it reaches critical size. Such a feature was not specifically demanded for certification.

2.5.6 Possible Causes of Rudder Damage

2.5.6.1 Manufacturing Process

Examination of the rudder residuals determined that correct resin systems had been used and that the degree of cure was adequate. Although this analysis was based on the examination of only the small amount of the rudder that remained - since each side panel, spar, or rib is cured as a unit - the state of the small residuals is representative of the overall components. Therefore, the entire rudder was most probably constructed using the correct resin system and was adequately cured.

Some non-conformities in the occurrence rudder were found by quality assurance at manufacture, and corrected. Since most of the rudder was missing, it was not possible to examine each of these locations on the residuals and formally exclude them as a cause of the occurrence. However, a review of the repair schemes, repair procedures, and quality assurance used to correct these non-conformities was conducted, and did not reveal any inadequacies. It is considered improbable that these particular repairs led to the occurrence.

The residuals showed indications of possible insufficient bonding pressure during cure at the bond between the honeycomb and the inner skin along the edges of the z-section of the left side panel within a width of 20 mm. Subsequent investigation revealed that low bonding just aft of the z-section could be caused by insufficient caul plate pressure during cure as a result of mispositioning of the z-section, or of adverse accumulation of tolerances. This deviation would not necessarily be open to the outside air and could grow by vacuum cycling loads into a disbond. Further computer analysis determined that it was possible for such a disbond to grow under the influence of vacuum cycling. This deviation would have been present since manufacture and is a possible cause of the initial damage to the rudder.

2.5.6.2 Material Degradation

It is improbable that the occurrence rudder was damaged due to degradation by fatigue, aging, chemical contamination, or exposure to high temperature.

2.5.6.3 Mechanical Damage

It is improbable that the initial damage to the rudder was caused as a result of grinding damage, water ingress in the honeycombs, a seized hinge point, or the LPP repair.

Impact damage tests conducted during the course of this investigation demonstrated that, although blunt impact could cause core crush, it could not cause disbonds. Subsequent vacuum cycling tests demonstrated that core crush damage did not grow. Therefore, it is improbable that the initial damage was caused by a blunt impact. Since the misuse of high-pressure spray jets would likely result in damage similar to blunt impacts, it is also improbable that the initial damage to the rudder was caused by the misuse of high-pressure spray jets.

There was no evidence of impact damage on the residuals, but only a small amount of rudder survived for examination. The investigation was not able to discount the possibility that the rudder may have experienced a discrete event^{Footnote 12} that resulted in significant damages either on the ground or in flight.

The lightning strike to the tip of the rudder approximately eight years prior was a discrete event that could not be discounted as a possible cause of the initial damage since the entire upper end of the rudder was missing and could not be examined.

2.5.7 Failure Scenarios

2.5.7.1 Summary of Important Points

• The dynamic event was most probably caused by rudder flutter. Flutter analysis showed that the rudder would only flutter under the occurrence conditions if it were damaged. Therefore, the rudder was most probably damaged. Flutter analysis determined that the amount of damage necessary to cause flutter was significant. The occurrence conditions had been experienced by the aircraft many times previous, but the rudder had not experienced vibration, flutter, or failure. Therefore, the original damage was most likely small and grew over time.
  
• Although the mechanical cycling tests that were conducted during the original certification showed no damage growth, vacuum cycling tests conducted during this investigation demonstrated that it is possible for an initial damage to grow due to pressure differential associated with altitude.
  
• Results of investigative activity did not support the likelihood of a blunt impact scenario. A discrete event could not be discounted as a possibility since most of the rudder was not recovered for examination. Positive indications were found suggesting the possibility of a weak z-section bond at the interior lower front of the left side panel, and analyses showed that such damage could grow under vacuum loads.
  
• The interior skin is not easily accessible for inspection, and at the time of the occurrence, there was no inspection program for the inner skin. If the damage had been growing on the interior, it would not have been found by the existing inspections. A weak z-section bond would manifest itself in the bond of the inner skin.
  
• In the time leading up to, and at the time of the occurrence, the aircraft was neither manoeuvring nor experiencing turbulence. Therefore, the most significant load on the rudder would have been pressure differential between the core interior and the ambient air at altitude. This suggests that differential pressure may have driven the event.
  
• The investigation revealed that the first event in the occurrence sequence was a loud bang. Vacuum cycling damage growth tests found that, when the damage reached critical size, it grew explosively with a sudden violent release of energy, which caused a loud noise.
  
• The vacuum cycling tests found that explosive damage growth was so violent that it damaged the interior of the test chamber. In flight, such a violent event could possibly damage the opposite side panel. The flight dynamics analysis found that there was a large lateral force at the rudder, possibly the explosive damage growth in one side panel striking the other side panel.
  
• The sudden explosive growth of damage in one side panel and possible collateral damage to the adjacent panel would have resulted in a sudden reduction of rudder stiffness. The flutter analysis indicated that such a loss in stiffness could lead to flutter under the occurrence conditions.
  
• The time-domain flutter analysis for the large disbond case found that, shortly after the initiation of flutter, a large aft force at hinge 5 would exceed the failure load. This is consistent with the flight dynamics analysis that found that, shortly after the initial event, there was a large aft and downward tug on the tail. This is also consistent with the damage observed at hinge 5.
  
• The time-domain flutter analysis for the large disbond case also found that the next hinge to fail would be hinge 6, and that the loads on the rear VTP main attachment fittings would exceed ultimate strength. This is consistent with the damage observed at hinge 6 and at the VTP attachments.

2.5.7.2 Most Likely Failure Scenario

Some time before the occurrence flight, a disbond or in-plane core fracture occurred. The cause of this initial damage may have been a discrete event or a weak bond at the z-section. An indication of weak bonding was found at the z-section along the interior lower front of the left side panel. This damage then grew, possibly due to reduced pressure cycling loads associated with normal flight, without detection until it reached a critical size.

During the occurrence flight, having reached the critical size, the damage rapidly propagated, resulting in a loud and sudden explosion of the skin. This separation could have damaged the opposite side panel and created a large sideways force on the empennage. The resulting sudden reduction in torsional stiffness led to the onset of rudder flutter. About one second later, there was a large aft and downward force associated with failure of the upper hinge points, as the rudder separated. The rudder-separation event lasted about seven seconds, after which only 16 per cent of rudder effectiveness remained. During the remainder of the flight, more rudder pieces separated, and the aircraft landed with no aerodynamically effective rudder remaining.

3.1 Findings as to Causes and Contributing Factors

1. The aircraft took off from Varadero with a pre-existing disbond or an in-plane core fracture damage to the rudder, caused by either a discrete event, but not a blunt impact, or a weak bond at the z-section of the left side panel. This damage deteriorated in flight, ultimately resulting in the loss of the rudder.
   
2. The manufacturer's recommended inspection program for the aircraft was not adequate to detect all rudder defects; the damage may have been present for many flights before the occurrence flight.
   
3. This model of rudder does not include any design features in the sandwich panels to mechanically arrest the growth of disbond damage or in-plane core failure before the damaged area reaches critical size (such a feature was not specifically demanded for certification).

3.2 Findings as to Risk

1. A cockpit voice recorder with a 30-minute recording capacity was installed on the aircraft, and its length was insufficient to capture the rudder-loss event, resulting in critical information concerning the rudder failure not being available to investigators.
   
2. There was no published procedure for disabling the recorders once the aircraft was on the ground; valuable investigation information can be lost if the data are not preserved.
   
3. The sampling intervals for lateral and longitudinal acceleration captured by the digital flight data recorder were insufficient to record the highly dynamic conditions present at the time of the occurrence. This resulted in incomplete information being recorded.
   
4. The rudder position filtering and the necessity for additional analysis adversely affected the accuracy and effectiveness of the investigation efforts.
   
5. There are insufficient published procedures available to flight crew members to assist in recovering from a Dutch roll.
   
6. Declaring an emergency and clearly communicating the nature of the problem allows air traffic control to more easily coordinate between units and anticipate the needs of the crew in planning traffic management.
   
7. Procedures and practices that do not facilitate information sharing between crew members increase the likelihood that decisions will be based on incomplete or inaccurate information, potentially placing passengers and crew at risk.

3.3 Other Findings

1. Throughout the event, the crew received no electronic centralized aircraft monitor message relating to the control problem that the aircraft had experienced, and there were no other warning lights or cockpit indications of an aircraft malfunction.
   
2. After the rudder-separation event, the aircraft was not in danger of losing the vertical tail plane during the flight, either through loss of static strength or loss of stiffness.

4.1 Action Taken

4.1.1 Transportation Safety Board of Canada

4.1.1.1 TSB Recommendations-Airbus Composite Rudder Inspection Program

The separation of the rudder from Air Transat Flight 961 and the damage found during the post-occurrence fleet inspections suggest that the current inspection program for Airbus composite rudders may not be adequate to provide for the timely detection of defects. In addition, preliminary tests demonstrating that disbonds can grow due to altitude-related pressure differential suggest that increased attention is warranted to mitigate the risk of additional rudder structural failures. The consequences of a rudder separation include reduced directional control and possible separation of the vertical tail plane (VTP).

Therefore, on 27 March 2006, the Board recommended that:

On 14 June 2006, Transport Canada (TC) responded to Board Recommendation A06-05. TC concurs with the TSB suggestion that the current A310-300 inspection program may not be adequate to provide timely detection of defects to the rudder assembly.

Specifically, TC has indicated that the following corrective actions will be taken:

• A letter will be sent to Airbus and the Direction Générale de l'Aviation Civile (DGAC) of France detailing the results of additional inspection on a Canadian-registered A310-300 series aircraft.
  
• TC will recommend that a detailed inspection of the drainage path of the rudder for blockage be added to the current inspection program to ensure that there is adequate drainage.
  
• TC will request that Airbus review the current inspection program for the vertical stabilizer and rudder assembly for the A300/A310 aircraft series.
  
• A tap test is potentially not effective in determining small areas of delamination or disbond of composite materials; therefore, TC is working with the National Research Council of Canada to identify more suitable inspection techniques to detect failures in composite materials.
  
• To better identify failures in composite material, TC will coordinate with the International Maintenance Review Board to review the logic used in developing maintenance programs.

The TSB has reviewed TC's response and assessed it as Satisfactory Intent.

Further, on 27 March 2006, the Board recommended that:

On 22 November 2006, the European Aviation Safety Agency (EASA) stated that it agreed with Board Recommendation A06-06 and that Airworthiness Directive 2006-0066 issued on 24 March 2006 requiring a mandatory one-time inspection satisfactorily addressed the Board recommendation.

Although the EASA agreed with the Board recommendation, Airworthiness Directive 2006-0066 referenced in its 22 November 2006 response does not provide for a repetitive inspection cycle that will allow early and consistent detection of damage, as is implied in the core of Recommendation A06-06. Nevertheless, the TSB assessed that the EASA is well positioned to take a leadership role within the industry in advocating for the development and integration of an inspection program dealing with composite materials. On that basis, a conference call was initiated on 20 December 2006.

Following the conference call, the EASA released a further response dated 17 January 2007. This response stated that all elements that may have potentially caused the damage growth were still being investigated. Furthermore, the EASA stated that, within the Continued Airworthiness process and in cooperation with Airbus, it continues its efforts to determine the most appropriate corrective actions. Subsequently, the EASA will consider mandating those actions, including amending the maintenance program to require repetitive inspections.

The 17 January 2007 response reflects EASA's commitment to continue to develop corrective actions that may include amending the maintenance program to require repetitive checks. Because EASA's most recent response contains a proposed action that, if implemented, will reduce or eliminate the risks associated with this deficiency, the response to Recommendation A06-06 is assessed as Satisfactory Intent.

4.1.1.2 TSB Safety Advisory-Cockpit Voice Recorder Duration

The cockpit voice recorder (CVR) installed on Air Transat Flight 961 employed a continuous-loop magnetic tape of 30-minute duration. The event of the rudder separation on the Air Transat Flight 961 CVR was recorded approximately 60 minutes before landing. Crew conversations and cockpit sounds before the event of the CVR recording may have provided substantial insight into any initiating or precursor events that led to the accident. Given the need for longer periods of recorded sound to capture the initiating events of aviation accidents and the availability of two-hour CVRs, the Board believes that such recorders should be mandated by regulatory authorities worldwide.

Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC re-addressing its concern that, in 2005, there are still commercial aircraft not equipped with a CVR with at least two-hour recording capacity.

4.1.1.3 TSB Safety Advisory-Digital Flight Data Recorder Recording of Filtered Data

With filtering, the ability to differentiate between a rudder excursion and a data filtering artefact is limited. The filtering of raw sensor data necessitated additional analysis to estimate the probable rudder position history, ultimately affecting the accuracy and timeliness of the investigation efforts. The Canadian Aviation Regulations (CARs) do not address the requirement to test parameter accuracy under both static and dynamic conditions as does 14 CFR (Code of Federal Regulations) of the United States. The CARs continue to refer to the previous minimum operational performance specifications (MOPS) for flight recorders (ED55), rather than the current ED112, which offers guidelines on data filtering. The current Federal Aviation Administration (FAA) Notice of Proposed Rule Making (issued 28 February 2005) regarding revision of digital flight data recorder (DFDR) regulations does not address the recurring problem of filtered data.

Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC addressing its concern that data filtering may prevent investigators from determining accurate control surface positions from recorded data, particularly under dynamic conditions.

4.1.1.4 TSB Safety Advisory-Digital Flight Data Recorder Low Recording Rates

The Air Transat occurrence demonstrated that further improvements to DFDRs are needed to more effectively determine the sequence of events in an accurate and timely manner. Specifically, due to the low recording rates for acceleration data, the existence of aeroelastic effects as a possible failure mode could not be positively identified. The limited lateral acceleration data also prevented the characterization of the initiating event.

Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC addressing the possible conduct of a review of recording rates of DFDR data to ensure that adequate information is made available to analyze dynamic flight events.

4.1.1.5 TSB Safety Advisory-Dutch Roll Recovery Procedure

For this loss of rudder occurrence, the absence of sufficient guidance in Dutch roll recovery resulted in a situation wherein the crew engaged the autopilot, which led to a worsening of the flight characteristics. Although the engagement of the autopilot did not increase the severity of consequences for this occurrence, under other circumstances, such action might have led to an aircraft upset.

Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC suggesting that TC, in concert with industry, FAA, DGAC, and EASA, may wish to conduct a review of the adequacy of published procedures to ensure that pilots have the required knowledge to safely recover from a Dutch roll situation.

4.1.2 National Transportation Safety Board

As a result of its investigation into an Airbus A300-600 aircraft operated by FedEx Express that was damaged during routine maintenance on 27 November 2005, the National Transportation Safety Board (NTSB) recommended on 24 March 2006 that the FAA

Require that all operators of Airbus A-300 series airplanes immediately [possibly before further flight] comply with four Airbus All Operators Telexes (AOT) A300-55A6042, A310-55A2043, A330-55A3036, and A340-55A403 dated March 2, 2006. Any disbonding to the rudder skins that occurs in the presence of hydraulic fluid contamination should be repaired or the rudder should be replaced as soon as possible, well before the 2,500 flights specified in the AOTs. (A-06-27, issued March 2006)

The NTSB further recommended that the FAA

Establish a repetitive inspection interval for Airbus premodification 8827 rudders until a terminating action is developed. The interval should be well below 2,500 flights. (A-06-28, issued March 2006)

4.1.3 Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile

On 10 March 2006, the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile recommended that [translation] the EASA impose as soon as possible an appropriate inspection program for the concerned rudders (part number A55471500). (000153/BEA/D, issued March 2006)

4.1.4 Airbus

4.1.4.1 All Operators Telex (AOT-1)

Based on the initial information uncovered during this TSB investigation, Airbus, on 17 March 2005, issued an AOT for the inspection of all aircraft equipped with part number A55471500 series rudders. This one-time visual and tap-test inspection involved 222 Airbus A310s, 146 Airbus A300-600s, 6 Airbus A330s, and 34 Airbus A340s, for a total of 408 aircraft. In addition, a more detailed inspection of rudder side panels on over 20 aircraft was conducted using the elasticity laminate checker (ELCH) test method. Finally, the attention drawn to rudders by the occurrence resulted in operators examining their rudders more closely during maintenance. These various inspections found examples of disbonds, damage around hoisting points and trailing edge fasteners of the rudder, corrosion and abrasion at hinges, seized hinges, hinges with excessive free play, and water ingress.

4.1.4.2 All Operators Telex (AOT-2)

On 02 March 2006, the aircraft manufacturer issued a second series of AOTs for the inspection of all aircraft with rudder part number A55471500 series rudders. These AOTs were subsequently made mandatory by an Airworthiness Directive issued by the EASA, representing the State of manufacture. The aim was to verify the structural integrity of the rudder by means of one-time tap-test inspection to the interior face sheets of the rudder side panels, as well as checking the drainage holes at the bottom of the rudder and cleaning hydraulic fluid from the external surfaces. Access to the interior of the rudder was through the inspection holes in the front spar of the rudder. It is noted that the access to inboard surfaces from the inspection holes is limited. No disbonds have been found.

4.1.5 Air Transat

4.1.5.1 Abnormal Situation

Based on the initial information uncovered during this investigation, Air Transat issued, on 10 November 2006, new procedures for situations that are not typical. The following text was added to the Cabin Attendant Operation Manual:

[...]
When experiencing an abnormal situation, you must report to the Flight Director as soon as possible and describe the event such as, but not limited to:

• Unusual odour
• Unusual noise
• Presence of an unusual object
• Instability of objects, passenger or crew
• Inappropriate passenger behaviour
• Medical situation

Never assume that others experienced the same effects that you have or are fully aware of the events taking place. Communication is the key for a proper evaluation of the situation and appropriate corrective measures. If the Flight Director can not be reached and time is critical, Cabin Attendants must contact the Flight Deck Crew without delay.

4.1.5.2 Preservation of Recorder Information

Air Transat issued, on 16 May 2006, a new Accident/Incident Response Checklist as part of the Flight Crew Operating Manual for the A-310. A procedure to disable the appropriate circuit breakers to preserve the recorded data for both the CVR and the DFDR is described. This new standard operating procedure also highlights that preserving the recorded information is critical to the investigative process after an occurrence.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 21 June 2007.

Appendix A - Direct Access Recorder/Digital Flight Data Recorder Data Comparison

AFD

assistant flight director

AFRP

aramid fibre-reinforced plastic

agl

above ground level

AIM

Aeronautical Information Manual

AMM

aircraft maintenance manual

AMO

approved maintenance organization

AOC

air operating certificate

AOT

all operators telex

APYA

autopilot yaw actuator

ARINC

aeronautical radio incorporated

asl

above sea level

ASTM

American Society for Testing and Materials

ATC

air traffic control

ATPL

airline transport pilot licence

CARs

Canadian Aviation Regulations

CFRP

carbon fibre-reinforced plastic

CG

centre of gravity

cm

centimetre(s)

cm²

square centimetre(s)

CVR

cockpit voice recorder

daN

decanewton(s)

DAR

direct access recorder

DCB

double cantilever beam

DFDR

digital flight data recorder

DGAC

Direction Générale de l'Aviation Civile (France)

DVI

detailed visual inspection

EASA

European Aviation Safety Agency

ECAM

electronic centralized aircraft monitor

EDX

energy dispersion X-ray spectroscopy

ELCH

elasticity laminate checker

EUROCAE

European Organisation for Civil Aviation Equipment

FA

flight attendant

FAA

Federal Aviation Administration

FCC

flight control computer

FD

flight director

FL

flight level

FOD

foreign object damage

g

load factor

GFRP

glass fibre-reinforced plastic

GVI

general visual inspection

GVI (G)

general visual inspection from the ground of empennage

GVI (A)

general visual inspection at arm's length of empennage

GVT

ground vibration test

HIRF

high-intensity radiated fields

Hz

hertz

IR

infrared

KCAS

knot(s) calibrated airspeed

KFLL

Fort Lauderdale/Hollywood International Airport

kg

kilogram(s)

KIAS

knot(s) indicated airspeed

KMIA

Miami International Airport

kN

kilonewton(s)

LPP

lightning protection plate

m

metre(s)

m²

square metre(s)

m³

cubic metre(s)

mm

millimetre(s)

mm²

square millimetre(s)

MOPS

minimum operational performance specifications

MRTT

multi-role tanker transport

MSN

manufacturer's serial number

MUVR

Varadero/Juan Gualberto Gómez International Airport

N

newton(s)

NDI

non-destructive inspection

nm

nautical mile(s)

NTSB

National Transportation Safety Board

PPC

pilot proficiency check

QRH

quick reference handbook

QSMS

quality safety management system

RTL

rudder travel limiter

SB

Service Bulletin

SRM

structural repair manual

TC

Transport Canada

Tg

glass transition temperature

TSB

Transportation Safety Board of Canada

TSC921

Air Transat Flight 921

UFDR

universal flight data recorder

UTC

Coordinated Universal Time

VTP

vertical tail plane

XPS

X-ray photoelectron spectroscopy

YD

yaw damper

°

degree(s)

°C

degree(s) Celsius