Aviation Investigation Report A08W0007

On 10 January 2008, the Air Canada Airbus A319-114 (registration C-GBHZ, serial number 0813), operating as flight ACA190, was en route from Victoria International Airport, British Columbia, to Toronto Lester B. Pearson International Airport, Ontario on a regularly scheduled flight with 83 passengers and 5 crew members on board. The aircraft was at flight level (FL) 350 and following a United Airlines Boeing 747-400, flight UAL896, in level cruise at FL 370 over the state of Washington, United States (U.S.). When separation had increased to 8.1 nautical miles (nm), with UAL896 in the lead, U.S. air traffic control cleared ACA190 to climb from FL 350 to its flight planned altitude of FL 370. At 0648 Pacific standard time, as ACA190 was climbing through FL 366, 10.7 nm behind UAL896, sharp jolts were felt in ACA190, followed by a series of rolls. During the roll oscillations, the aircraft continued the climb to FL 369 and then descended to FL 355, where the crew regained straight and level flight. The crew declared an emergency and diverted the flight to Calgary International Airport, Alberta where it landed uneventfully at 0728. Eight passengers and crew received minor injuries and three received serious injuries due to falls and collisions with aircraft furnishings.

Other Factual Information

Digital flight data recorder (DFDR)^{Footnote 1} information was extracted from both aircraft for analysis.

After take-off from Victoria, British Columbia, Vancouver Area Control Centre (ACC) cleared ACA190 to proceed to the IWACK intersection and maintain flight level (FL) 330. At that time, UAL896, which was eastbound at FL 370 en route from Hong Kong to Chicago O'Hare, was also under the control of Vancouver ACC.

At 0633,^{Footnote 2} Vancouver ACC cleared ACA190 to FL 350 and informed the pilots that they were following a Boeing 747.

At 0643, control of and communications with both UAL896 and ACA190 was transferred to Seattle ACC, who advised ACA190 that they would be cleared from FL 350 to their flight planned altitude of FL 370 when there was sufficient spacing with the preceding United flight. UAL896, at 490 knots, was cruising slightly faster than ACA190 at 450 knots. The two aircraft were on slightly diverging tracks, with ACA190 on a track of 078°M and UAL896 on a track of 81°M.

At 0645, when UAL896 was 8.1 nautical miles (nm) ahead, ACA190 was cleared to climb to FL 370. The pilots of ACA190 were not aware of their distance from UAL896 (see Appendix A - Map of Flight Paths), and air traffic control (ATC) did not issue ACA190 with an advisory regarding possible wake turbulence.

Flight Dynamics

At 0648, at a point 9 nm south of the Canada/United States (U.S.) border in northern Washington State, 34 nm east of the IWACK intersection, ACA190 was in a stable wings level climb through FL 366. Three sharp jolts described as similar to hitting automotive speed bumps were felt. This was followed by a roll to the right of 5.6° which was countered by the autopilot with aileron input. The aircraft rolled past wings level to 27.8° left, with the autopilot responding. When this roll was near its maximum, the captain, who was the pilot flying, disengaged the autopilot and autothrottles and attempted to correct the roll. This was followed by four rolls varying in magnitude from a few degrees to a maximum of 55° (see Appendix B - DFDR Summary). The aircraft then returned to level flight with minor oscillations.

During the 18-second duration of the event, heading varied from 065°M to 086°M. The captain reacted to the rolls with a total of nine sidestick roll inputs, accompanied by coordinated rudder pedal deflections. Five sidestick inputs were to full travel of 20°. Seven successive rudder pedal inputs were made, with six cyclic reversals from left to right. Rudder deflection followed pedal inputs with maximum deflection of 6° left and 7° right.

Analysis of DFDR data indicated that, during the event, vertical accelerations reached peak values of +1.57g and −0.77g.^{Footnote 3} Lateral accelerations reached peak values of +0.49g (right) and 0.46g (left) during four oscillations.

From 06:48:07 to 06:48:25, pilot sidestick roll inputs were 90° out of phase with aircraft motion. From 06:48:07 to 06:48:15, lateral accelerations and heading deviations were approximately 90° out of phase with the rudder pedals. This indicated that after the autopilot was disconnected, most of the aircraft motion in the roll axis resulted from pilot inputs and that lateral accelerations were due mostly to pilot rudder control inputs. Rudder control inputs, which were coordinated with the out of phase roll inputs, had a direct relationship with vertical stabilizer loads. Abnormal accelerations in the normal or vertical axis were correlated with changes in angle of attack, and sidestick pitch control inputs opposed these aircraft angle of attack excursions.

After stabilizing at FL 355, the crew informed ATC that they had experienced a flight control problem and were operating with reduced flight control capability. A further descent was coordinated to FL 310. Although a suitable airport at Kelowna, British Columbia, was closer, the crew decided to divert to Calgary, Alberta, due to advantages of terrain, medical and airport facilities. Because they believed that a flight control computer malfunction caused the event, they completed the flight with the autopilot off and manually flew the aircraft.

Weather

An analysis of the upper atmosphere in the vicinity of the occurrence was made by the U.S. National Center for Atmospheric Research. No remarkable weather systems were affecting the area at the time. All individual diagnostics including pressure pattern, wind flow, mountain wave and pilot reports indicated the likelihood of no more than light turbulence in the area of the occurrence. ACA190 and UAL896 were flying in clear air above cloud, and neither aircraft encountered significant turbulence in the area immediately prior to, or after the event. DFDR data indicated that the wind at FL 370 was 270°M at 52 knots.

Aircraft

The aircraft was certified and maintained in accordance with existing regulations and approved procedures. There were no pre-existing faults or conditions that contributed to the occurrence. This event was the first recorded on the occurrence aircraft requiring an inspection due to excessive g loading.

Flight Control Laws

The Airbus A319 features a fly-by-wire control system in which there is no direct mechanical linkage between the side stick controller and control surfaces responsible for pitch and roll. The pilot's rudder pedal inputs are not processed by a flight control computer, but are linked directly to the rudder actuator via cables as on traditional, non-fly-by-wire aeroplanes. Pilot pitch and roll inputs are processed by digital flight control computers that order hydraulically operated control surface deflections consistent with programmed flight control laws. These laws provide hazardous flight envelope protections for speed, bank angle, angle of attack, g-load factor, and pitch attitude. For routine ground and air operations, the aircraft is configured in normal law. Under certain conditions, it can be replaced by three reconfiguration laws: alternate law, abnormal law, or direct law. Flight control law reconfiguration is a function of phase of flight, serviceability of flight control electronic systems, and operational conditions in relation to defined parameters. Although flight control laws are not directly selectable by the pilot, actions such as gear selection may reconfigure them.

• Normal Law

  This is the normal operating configuration, providing improved stability and flight envelope protections for high angle of attack, vertical load factor limitation, pitch and roll attitude protection, and for high speed and low-energy state. There is provision for turn coordination (yaw). The aircraft can not be stalled in normal law.

• Alternate Law

  Alternate law is activated after multiple failures of redundant flight control and electronic systems. There are two levels of alternate law: with or without protections. Alternate law with protections provides low- and high-speed stability, and load factor limitation. Alternate law without protections provides only g-load factor limitation. The autopilot is operational in alternate law.

• Direct Law

  This is the lowest level of computer flight control. All protections are lost, and the aircraft can be stalled. There is a direct relationship between side stick input and control surface movement. Elevator travel is adjusted in relation to aircraft centre of gravity. Direct law is automatically selected from alternate law upon landing gear down selection if autopilot is not engaged. The aircraft can be stalled in alternate and direct laws.

• Abnormal Attitude Law

  This law is configured temporarily during extreme manoeuvring conditions of pitch, bank, angle of attack, and speed. When the aircraft has recovered from its abnormal attitude, the configuration reverts to alternate law in pitch and yaw, and direct law in roll. There is no reversion to direct law when landing gear is extended.

A mechanical back-up permits the pilot to control the aircraft during a temporary complete loss of electrical power with manual trim and rudder.

Apart from providing computed rudder deflection to augment coordinated turns and dampen dutch roll tendency, the flight control laws do not provide envelope protection in yaw, or prevent excessive rudder pedal input.

ECAM Messages and ADIRU Disagree

In the A319, an electronic centralised aircraft monitor (ECAM) displays aircraft condition, caution, and warning messages to the flight crew. During the event, the master caution warning illuminated, accompanied by multiple ECAM messages.

At 0648:14, a warning of "FCTL ADR DISAGREE^{Footnote 4}" was accompanied by a reversion from normal to alternate flight control law. Analysis by Airbus indicated that this warning was attributed to differences between sideslip-induced angle of attack values detected by the air data inertial reference units (ADIRU). The "DISAGREE" warning angle of attack threshold is 3.6° for straight and level flight. Air data reference (ADR) systems functioned in accordance with design during the event. ECAM warnings of engine and hydraulic oil quantities also activated due to tanked fluid displacement during the abnormal aircraft attitudes and g loading.

At 0648:17, both fight directors disengaged for less than two seconds. The remainder of the flight was conducted with the flight control systems under alternate law. The necessary conditions to activate abnormal law were not fulfilled.

Post-Occurrence Aircraft Inspection

Following the occurrence, a full engine run and flight control check was conducted. No flight control computer faults were identified and all functions were normal. A heavy turbulence inspection described in aircraft maintenance manual (AMM) 05-51-200-001 was carried out. A review of DFDR data indicated that lateral accelerations^{Footnote 5} developed in excess of limits set by Airbus. The vertical stabilizer was removed from the aircraft and subjected to joint Air Canada/Airbus visual inspections and non-destructive testing. No structural damage was detected in the stabilizer or attachment fittings. Prior to the occurrence, maintenance instructions provided to operators of the A318/A319/A320/A321 series did not provide data that would trigger an inspection of the vertical stabilizer following an event in which an aircraft was subjected to high lateral g forces.

The rear vertical stabilizer attachment fitting was subjected to loads of 129 per cent of limit load, and the rear fuselage fitting, 121 per cent of limit load. Certification standards (U.S. Federal Aviation Regulation [FAR] 25.303) set the "Factor of Safety" at a minimum of 150 per cent of limit load. During certification testing of the A319 vertical stabilizer and attachment fittings, the factor of safety exceeded 150 per cent of limit load and an upper strength limit could not be determined due to test equipment limitations. The vertical tailplane on C-GBHZ was an original component of the aircraft.

Crew Information

The flight crew was certified and qualified for the flight in accordance with existing regulations.

The captain had been employed by Air Canada since 1999 and had accumulated about 8500 hours of total time, with more than 3000 hours on type, 500 hours of which were as pilot in command. He was a senior instructor on the A320 and was involved in the company's Boeing 777 training program. Prior to reporting for work on 10 January 2008, he was off duty for 16 hours.

The first officer had accumulated about 4800 hours of total time, 591 hours on type, and had been employed by Air Canada since October 2006. His employment with Air Canada was his first experience on transport category jet aircraft. He had deadheaded from Toronto on 08 January 2008 and prior to reporting for work on ACA190 he was off duty for about 29 hours.

On the day of the occurrence, both pilots started their duty day at about 0500.

Pilot Responses to Uncommanded In-flight Upsets

In this occurrence, pilot actions to rectify the upset showed some similarities to those found to have contributed to a 2001 airline accident investigated by the U.S. National Transportation Safety Board (NTSB), number AAL-04/04. In that occurrence, American Airlines flight 587 (AAL587), an Airbus A300-605R, encountered wake turbulence produced by a Boeing 747-400. During the investigation, it was determined that, at high airspeeds, alternating full deflection rudder pedal inputs (colloquially termed "rudder pedal reversal") can produce aerodynamic loads on the vertical tailplane in excess of the structural design limit loads. In AAL587, full rudder pedal reversals had contributed to high lateral accelerations, which resulted in vertical tailplane separation due to loading in excess of ultimate load limits.

As part of its investigation, the NTSB cited a special study of uncommanded, in-flight upsets aboard multi-engine turbojet aircraft in the U.S., most involving wake turbulence. In 11 of the 33 events, pilots reported using rudder during their recovery efforts.

A subsequent NTSB recommendation to the U.S. Federal Aviation Administration (FAA), number A-04-059, identified concerns that, generally, pilot training programs did not sufficiently address the issue of the hazards in transport category aircraft associated with reversed rudder deflections to control roll. It was also determined that some operators also utilized simulators for upset recovery training that imparted negative training by instilling pilot responses that were inappropriate for unusual attitudes in the roll axis.

In response to recommendation A-04-059, Airbus and Boeing co-developed training material, including a revision to the Airplane Upset Recovery Training Aid (AURTA), which was originally issued in 1996. The AURTA consisted of written material and a video. In June 2004, Airbus disseminated Flight Crew Operations Manual (FCOM) Bulletin No. 828/1 worldwide to all operators of Airbus equipment. The bulletin pointed out that in transport category aircraft of all types, rudder use was limited to maintaining aircraft control during landing and take-off, as well as during engine out operations. The bulletin contained warnings against pilot input of full scale rudder deflections and reversals during upset recovery at high speeds. Air Canada had incorporated the bulletin into the company's A319/A320/A321 aircraft operating manuals (AOM). In 2005, the FAA issued Safety Alert for Operators (SAFO 05002), which pointed out the availability of the training material, as well as cautioning against control reversals and pilot-induced oscillations.

Transport Canada Civil Aviation, in response to the initial information published by the NTSB concerning the AAL587 accident, published Commercial and Business Aviation Advisory Circular (CBAAC) 0206, Structural Overload in Transport Category Aeroplanes Caused by Rudder Inputs. This recommended that "... operators disseminate this information to pilots for awareness, and where appropriate, establish suitable pilot training programs to avoid this hazardous condition."

Prior to the ACA190 incident, Air Canada pilots were exposed to the material in the FCOM Bulletin No. 828/1 upon initial type training. The company Flight Crew Training Manual discussed the hazards of rudder reversals, but did not include material on wake turbulence. Rudder reversal was not a dedicated syllabus subject during annual recurrent training. The captain of ACA190 last attended annual recurrent training in December 2007. The first officer undertook his initial type training in January 2007. The AURTA material, installed on the company A330/A340 website, was not readily available to A319/A320 pilots. Air Canada simulator upset training concentrated on recovery from unusual attitudes in the pitch axis, with limited attention to proper rudder pedal usage during recoveries from large roll axis excursions. A survey of Canadian operators of transport category aircraft indicated that, generally, their upset training programs were similar to those at Air Canada in that simulator and ground school training was focused primarily on recovery from pitch excursions.

In 1995, the U.S. National Research Council reported on adverse aircraft-pilot coupling events. In these events, a pilot switches strategy from using small control inputs to large corrective inputs even for small errors. The result is often an out-of-phase condition, which results in pilot-induced attitude changes. It was noted that typically an environmental trigger or a vehicle trigger often precedes the adverse aircraft-pilot coupling event.

Out-of-the-loop performance problems are well documented as a potential negative effect of automation.^{Footnote 6} Under certain circumstances, such as when an automatic system is managing an unusual event but there is no direct indication of this action provided to the pilot, it is possible for the pilot to misdiagnose the emergency as an automation failure. This can result in the pilot responding to a presumed automation failure rather than to the actual emergency. In essence, the understanding that the operator has developed of the aircraft and its environment is incorrect because the pilot has not been directly interacting with the aircraft controls. The more complex the situation, the less capable the human is of entering the loop when an emergency occurs. As a result, being outside the control loop can result in adverse aircraft-pilot coupling as a pilot responds to a sudden emergency.

When startled by a sudden unexpected event, a pilot is susceptible to delayed reactions, which are based on previous training and experience. This may lead to making inappropriate control inputs for the conditions at hand. The pilots of ACA190 had been previously exposed to minor wake vortices. This was their first exposure to an event involving an upset to this degree. Due to current fidelity limitations inherent in full motion flight simulators and the expectancy associated with training scenarios, there is difficulty in replicating conditions associated with an unexpected wake turbulence encounter.

Rudder Control System

Rudder control in the A319 consists of a hydro-mechanical system utilizing cables from the pilot's pedals to a differential unit in the fin, and push-pull rods to three independently powered hydraulic flight control units. A yaw damping system acts through the differential unit to improve yaw stability about the vertical axis.

In jet transport category aircraft, application of large rudder deflections at high airspeed can result in aerodynamic loading of the vertical stabilizer and its attachment fittings beyond structural limitations. Maximum rudder travel is therefore automatically limited as a function of aircraft knots calibrated airspeed (KCAS) to prevent such overloading. In the A319 rudder control system, rudder displacement is directly proportional to the amount of pedal input. The maximum rudder deflection of 30° with pedal deflection of 4 inches is reduced progressively as airspeed increases above 160 KCAS. The maximum left/right deflection at 250 KCAS is 8.3°. Achieving this deflection requires a pedal input of 1.14 inches at 36.5 pounds force. The A319 variable stop rudder control system^{Footnote 7} design is similar in principle to that in the larger A300-600. Pedal travel is limited through the rudder travel limiter unit; relatively light control forces and short pedal displacements are required to accomplish full available deflection at high airspeeds. The A300-600 features a pedal input of 1.2 inches and 36.4 pounds for a rudder travel of 9.3° at 250 knots. Rudder deflection in either model is not automatically reduced in a sideslip.

During the investigation of AAL587, the NTSB determined that in the A300-600 rudder control system design, the sensitivity^{Footnote 8} of the rudder pedals at high airspeed increased the susceptibility of pilot rudder reversals to full rudder panel deflection. This increased the possibility of alternating sideslip angles at high airspeeds with related high structural loading of the vertical stabilizer. As a result of this finding, the NTSB recommended (A-04-056) that the FAA modify certification standards in FAR Part 25 to ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder sensitivity. This was followed by NTSB recommendation A-04-057 that the FAA require modifications to existing aircraft to protect them from the adverse effects of aircraft-pilot coupling after rudder inputs at high airspeeds. After these recommendations were issued, Airbus introduced an optional retrofitted pedal travel limiter in the A300. The dynamics involved in the AAL587 occurrence that prompted the optional modification to the rudder control system were different from those in ACA190. In AAL587 the pilot exerted and held significant pressure on the rudder pedals while the aircraft accelerated, defeating full functioning of the rudder travel limiter unit. The pilot of ACA190 made short duration pedal inputs within the limits of the travel limiter; therefore, a modification in the A319 similar to that offered for the A300-600 would not have affected the outcome of this occurrence. There is no plan to modify the A319/A320 family rudder systems.

Wake Turbulence Research

The International Civil Aviation Organization (ICAO) has defined wake turbulence as "...the effect of rotating air masses generated behind the wing tips of large jet aircraft".^{Footnote 9} These vortices, as a product of lift on any aircraft, tend to expand over time, sink, move outward, and drift with wind before eventually dissipating. Atmospheric stability and a lack of mechanical turbulence results in slow dissipation of vortices. An aircraft flying along the vortices trail can be subjected to roll and pitch excursions in excess of control power capabilities. Entering the vortices perpendicular to their axis can result in rapid pitch changes.

The effects of wake turbulence have been known since the 1950's and the hazards illustrated by studies conducted by organizations including the National Aeronautics and Space Administration (NASA), the FAA, the National Research Council of Canada (NRC) and aircraft manufacturers. This resulted in the introduction of separation standards primarily for arriving and departing aircraft. With some modification, these standards continue to be applied, with spacing based upon distance in radar environments and upon time in non-radar environments.

These standards are summarized in the following table.

In June 2007, as a result of work completed by the Airbus 380 Wake Vortex Steering Group involving the European Joint Aviation Authorities (JAA), Eurocontrol, the FAA, and Airbus, it was considered that an overall review of wake turbulence provisions including the current wake turbulence categorization scheme should be undertaken. In October 2007, ICAO issued a state letter requesting that contracting states initiate the collection of information on wake vortex encounters in order to provide a sound basis for any necessary amendments to the wake turbulence provisions (Ref: AN13/4-07/67). After analysis of the information, amendments to the steering group recommendations will be proposed for consideration by the Air Navigation Commission. At the time of publication of this report, there were no recommendations from the steering group.

NRC research conducted over the period from year 2004 to 2008 involved flying instrumented Falcon 20 and T-33 aircraft around and into wake vortices behind larger aircraft, including Boeing 767-300 and Boeing 747-400 models.^{Footnote 12} Vortices capable of affecting aircraft roll/yaw control and causing g-loading spikes were detected at wake lengths to 25 nm, with severe upsets experienced at 8 to 16 nm wake lengths with wake age from one to two minutes. Control disturbances on one flight resulted in the Falcon 20 rolling past 90°, and in an engine flameout due to vortex core ingestion. Effective Boeing 747-400 vortices had been observed to descend at 500 feet per minute to at least 770 feet below the wake generator. Measurable turbulence was detected up to 20 nm behind and 1000 feet below the vortex generating aircraft.

At the request of the TSB, the NRC analysed meteorological data and DFDR data from ACA190 and UAL896.^{Footnote 13} This analysis indicated that ACA190 was subject to external atmospheric loading consistent with a substantial coherent wake vortex flow field.^{Footnote 14} The age of the vortices generated by UAL896 when they were encountered by ACA190 was 84 seconds.

Transport Canada Type Certificate Data Sheet Number A-166 reports that the basis of certification for the A319 includes Joint Aviation Requirements (JAR) sections 25.341 and 25.349(b) at Change 13 and amended by Orange Paper 91/1. FAA Type Certificate Data Sheet A28NM reports that the Basis of Certification for the A319 includes FAR 25.341 and 25.349(b) at Amendment 86. These standards are harmonized and the Harmonized FAR/JAR 25.349, amendment 25-86, under which the A319-114 was certified, sets aeroplane airworthiness certification design requirements for maximum unsymmetrical vertical gusts in level flight.

The design discrete gust strength velocity as specified in FAR 25.341 is calculated at 33 feet per second at 37 000 feet above sea level (asl). ACA190 was subjected to a peak gust intensity velocity of 74 feet per second, which exceeded the certification standard by 124 per cent. Although the gust shape specified in FAR 25.341 would not necessarily apply to vortex core penetration in all cases, the scenario can be considered as a valid test of aircraft structural design.

Other Wake Turbulence Occurrences

Between 1999 and 2009, at least 74 wake vortices encounters in cruise flight have been recorded either within North America or involving aircraft in transit to or from the continent. Some of these cases were reported to government investigation agencies and the remainder were extracted from company reports and confidential reporting systems. To varying degrees, these encounters have resulted in aircraft upset and, in some cases, injury to occupants. Minimum ATC separation standards had been applied.

ATC Separation Standards

Prior to and during the occurrence, Vancouver and Seattle ATC units applied the separation standards of 1000 feet vertically or 5 nm laterally between the two aircraft as specified in the NAV CANADA (ATC MANOPS) and FAA Order 7110.65R, Air Traffic Control. Upon satisfying the minimum radar lateral spacing standard, ACA190 was cleared to FL 370.

FAA Order 7110.65R, 2-1-19, Wake Turbulence, and NAV CANADA Air Traffic Control Manual of Operations (ATC MANOPS) Sections 128 and 533 directed the application of radar separation procedures for wake turbulence avoidance primarily for take-offs, landings, and terminal procedures. NAV CANADA and FAA manuals directed controllers to increase separation and issue wake turbulence cautionary advisories on a discretionary basis. Separation standards for wake turbulence avoidance between aircraft of different weight categories while en route did not include compensation for high cruise speeds accomplished by jet aircraft.

Traffic Alert and Collision Avoidance System (TCAS)

C-GBHZ was equipped with a Collins traffic alert and collision avoidance system (TCAS), part number 622-8971-322. The installed data management computer (DMC) version 32 limited the system to displaying only aircraft posing a threat of collision when set to its normal operating range setting of 40 nm. Proximate, non-threatening traffic would not be shown unless the range was set to less than 40 nm. Because UAL896 was not considered to be an intruder, its target was not displayed in ACA190. DMC version 40, which was available in other serial number ranges of the A319, featured range selections from 10 to 320 nm, and proximate traffic would be displayed at all ranges.

TCAS is designed primarily for preventing collisions in the event of a breakdown of normal separation methods. Cautions have been published warning against pilots using the systems for providing routine traffic separation. Pilots are encouraged to use TCAS target information for enhancing situational awareness. However, TCAS is not specified for use in wake turbulence avoidance.

Passenger and Crew Injuries

For a short time during the climb to FL 350, ACA190 experienced light turbulence and the seatbelt sign was left on until the aircraft levelled off. After the seatbelt sign was turned off, cabin service commenced and some passengers unfastened their restraints and moved around the cabin. Prior to the commencement of the event, most of the seated passengers had their seatbelts fastened in accordance with Air Canada policy. Two passengers in the aft lavatories were thrown violently against the ceiling and walls, with one sustaining serious injuries. Minor injuries to passengers included cuts, bruises, burns from spills of hot beverages, and aggravation of previous injuries. Two flight attendants providing in-flight service sustained minor injuries after being lifted off the floor and falling against aircraft furnishings and service trolleys. Despite personal injuries, the cabin crew continued with their safety duties, assisted by passengers that included off-duty Air Canada personnel.

Emergency medical services met the aircraft at the terminal gate upon arrival in Calgary and attended to the injured passengers and crew. Nine persons were transported to Calgary hospitals for examination and treatment of injuries.

Cabin Service Trolleys and Aircraft Interior Damage

Two cabin service trolleys were being used by flight attendants once the aircraft had levelled off at FL 350. When the aircraft entered the upset, both trolleys lifted off the floor. One trolley struck the ceiling, damaging a plastic panel and overhead bin door. The other trolley also lifted off the floor, damaging an overhead bin door. Material from both trolleys, including coffee pots and food items were strewn about the cabin. Free-standing wheeled service trolleys are the industry standard in transport category aircraft. It is an industry-wide practice to restrain the units when not in use; however, when in service, there are no effective retention systems to prevent displacement in cabins during abnormal vertical and lateral acceleration events.

During the event, a laptop computer held by a passenger struck an overhead bin door with sufficient force to transfer paint to the door.

Cockpit Manuals Displacement

Aircraft documents and manuals were stowed in built-in compartments behind the pilot seats. These compartments did not have provision for restraint of the manuals and, during the event, most of the contents were lifted and strewn about the cockpit. A bulky manual grazed the captain's head; however, he was not badly injured. Some of these materials came to rest on the floor near the flight deck door and had to be moved before a cabin attendant could fully open the door and gain entry to the flight deck. For aircraft of serial number 1600 and above, Airbus has implemented a modification (No. 31378) that consists of installing retention straps on the rear lateral consoles used for book/document stowage. This modification did not apply to C-GBHZ (serial number 0813). Airbus service bulletin ABA320-25-1268, issued in August 2001 and revised 25 March 2002, offered the modification as a retrofit; however, it had not been incorporated into the Air Canada A319/320 fleet.

DFDR data indicated that external forces applied to ACA190 disturbed its steady-state flight conditions, and that the upset was not initiated by the aircraft flight control systems. Any auto flight control inputs during the early stages of the event were attempts by the aircraft systems to return the aircraft to a wings-level climb.

Comparison of the behaviour of ACA190 and flight test aircraft operated by the NRC, as well as kinematic analysis of DFDR data indicated that ACA190 was affected by turbulence associated with wake vortices from UAL896. With a wind no more than 12° off the tail of both aircraft, the track of ACA190 was aligned with the descending vortices. Air stability, with little mechanical turbulence, promoted longevity of the rotational energy contained in the vortices. This energy was sufficient to initiate significant attitude changes in ACA190, including those in the pitch axis, which resulted in negative g forces and displacement of persons and objects in the cabin.

Various databases indicate that at least 74 wake vortices encounters in cruise flight have been recorded either within North America or involving aircraft in transit to or from the continent. These records and research programs have shown that a potential exists for significant upset reactions to wake vortices while aircraft are in cruise. The circumstances of this occurrence suggest three ways to mitigate the risk surrounding wake vortices encounters as follows:

1. ATC Separation Standards

   Because ACA190 and UAL 896 were both flight-planned for the same altitude, the ATC separation strategy relied on the fact that the Boeing 747-400 was slightly faster than the A319-114. When UAL896 was beyond the 5 nm lateral radar spacing standard, ATC was able to clear ACA190 to FL 370, which was occupied by UAL896. The effective wake vortices generated by UAL896 persisted for more than double this distance. At 450 knots, ACA190 covered that distance in 84 seconds, which has been shown by research to have been an insufficient amount of time for effective dissipation of the energy contained in vortices generated by large aircraft.

   Aircraft operating below a heavier aircraft's altitude along a similar track are most at risk of encountering hazardous wake vortices. Because jet aircraft in cruise can cover the ICAO, NAV CANADA, and FAA 5 nm minimum lateral radar separation distance in less than one minute, this separation standard for en route instrument flight rules (IFR) separation does not provide for the same level of mandated wake vortices protection afforded for runway operations. Basing the separation between ACA190 and UAL896 exclusively on the existing altitude and distance standards of 1000 feet vertically and 5 nm laterally did not take into account the strength and low age of the vortices produced by UAL896 when encountered by ACA190.

   As shown in this and other occurrences, the current provisions for wake turbulence avoidance may not be effective in all cases, especially for aircraft operating below and behind a larger aircraft while en route at cruise speeds. Unanticipated encounters with wake vortices can increase the risk of injury to passengers and cabin crew, and structural damage to aircraft. These risks are associated with aircraft exposure to high wind gust speeds, sideslip angles, and abnormal accelerations. Documented cases of wake turbulence encounters involving significant attitude deviations from steady-state cruise flight have continued to occur following the event involving ACA190. Because minimum separation standards were in effect in these incidents, it is possible that the application of these standards is not sufficient to prevent wake vortices encounters.

   When ATC delayed the climb of ACA190 to FL 370, the crew was aware that they were following a Boeing 747 4 nm ahead at FL 370. When climb clearance was granted four minutes later, they were not aware of the proximity of the other aircraft. They expected that with an IFR clearance to climb, safe separation existed. ACA190 was equipped with a TCAS; however, the system was not capable of displaying UAL896 as traffic. Although some potential exists for pilots to use TCAS to assist in developing situational awareness for the purpose of avoiding wake turbulence, system limitations generally preclude consistent, reliable use for routine separation from traffic or wake vortices. Under IFR, reliance on visual acquisition of traffic cannot be relied upon to avoid wake vortices. In en route radar control environments, ATC systems are in the best position to provide separation based on wake vortices avoidance.

2. Pilot Reactions to an Upset

   Upsets due to wake vortices encounters at high altitude are relatively rare; however, they can occur very suddenly and with little warning. In this occurrence, sharp jolts were felt in the aircraft immediately before the onset of the uncommanded rolls.

   When ACA190 entered the wake turbulence, the autopilot responded by countering the initial rolls to the right and left. Although the pilot was monitoring the overall system state, he did not have a full appreciation of the proximity of the Boeing 747 and had no indication that the autopilot's actions were based on wake turbulence. The sharp jolts followed by the uncommanded rolls led to immediate large corrective inputs as the pilot attempted to control the aircraft.

   Although the captain had previous experience with minor wake vortices, this was his first exposure to an event involving an upset of this degree. He believed that there was a serious aircraft-induced flight control problem and determined that the best course of action was to disengage the autopilot and respond manually. His understanding of the situation did not include wake turbulence as a possible cause and, as a result, he took immediate action to regain control of the aircraft. In response to the worsening upset, he attempted to correct the changing attitude of the aircraft with significant control inputs, some of which exacerbated the situation.

   Although the accelerations in the vertical were a result of external influences on angle of attack associated with wake turbulence, most of the lateral accelerations were shown to result from rudder pedal and sidestick inputs in response to the wake turbulence encounter. These lateral accelerations exhibited characteristics of pilot-aircraft coupling. Both the wake turbulence encounter and pilot-induced control inputs contributed to the displacement of unrestrained passengers and objects in the cabin. Lateral accelerations imposed air loads on the vertical stabilizer structure to beyond certified limits. Some pilot actions to rectify the upset in ACA190 were similar to those that contributed to damage to the vertical stabilizer attachment fittings on AAL587 in 2001.

   The low expectancy of experiencing such an upset event in cruise flight combined with little or no warning of entering wake vortices likely startled the pilots, who then responded with potentially hazardous flight control inputs. Advance warning of possible wake turbulence could sensitize pilots and prepare them for such an encounter.

   Training designed to instil correct responses could also defend against this possibility. However, there were indications that Canadian airline training programs (including Air Canada's) concentrated on upset recovery techniques focused primarily on exercises involving pitch excursions. This training may not have focused on uncommanded rolls and inappropriate rudder inputs sufficiently to suppress a pilot's reactions to use full, alternating rudder pedal inputs.

   The automatic reversion to alternate law due to differences in computed angle of attack values was also a product of pilot control inputs. Because the crew believed that the upset was initiated by a flight control problem within the aircraft systems, completion of the flight with the autopilot disengaged made sense, given the circumstances. Although the aircraft was fully controllable under manual control in alternate law after the incident, its operation with degraded flight envelope protection would have slightly elevated the level of risk associated with loss of protections in the event of pilot distraction or a further encounter with moderate to severe turbulence.

3. Rudder Reversal and Aircraft Design

   Rudder control systems on most transport category jet aircraft provide protection from structural damage by limiting rudder travel at high speed, thereby reducing vertical stabilizer aerodynamic loads. Based on information gathered on the A300R system during the AAL587 investigation, the NTSB recommendations indicated that changes in rudder control systems could reduce the risk of catastrophic structural failure. Although the A300 and A319 aircraft models are of significantly different size and weight, they share commonality in their rudder control system designs. On both aircraft models, full allowable rudder deflections at high speeds can be achieved with relatively small pedal displacement and light control force. This characteristic, in combination with a pilot startled by sudden large changes in roll attitude, could result in excessive rudder control inputs.

   The most risk of vertical stabilizer structural overload would occur on a side slipping aircraft when full rudder displacement is effected on the side of the aircraft toward the relative wind vector. The A319 rudder system does not reduce the available travel on the upwind side of the sideslip compared with the lee side. The existing rudder limiting system does not prevent potentially hazardous loads from being applied to aircraft structure as a result of full, alternating rudder pedal inputs.

Service Trolley Risk

After being lifted off the floor and striking the ceiling above occupied passenger seats, the service and sales trolleys came to rest back in the aisle. While these incidents are rare, the consequences could be serious.

The following TSB Laboratory reports were completed:

• LP 007/2008 – Flight Data Recorder Analysis
• LP 168/2009 – Control Input Analysis

These reports are available from the Transportation Safety Board of Canada upon request.

Findings as to causes and contributing factors

1. Although the aircraft were separated by more than the minimum separation standard, when ACA190 was cleared to climb, the wake vortices from UAL896 had not dissipated.
2. The wingtip vortices of the heavier aircraft contained sufficient energy to significantly destabilize ACA190 in pitch and roll, which contributed to displacement of persons and objects in the cabin.
3. During recovery from the upset, pilot rudder and sidestick control inputs resulted in aircraft sideslip and g loadings. These contributed to the displacement of occupants and objects in the cabin, as well as placing lateral accelerations and aerodynamic loads on the vertical stabilizer structure to beyond certified limits.
4. Annual recurrent A319/A320 pilot training at Air Canada did not consistently include reference to the hazards of pilot rudder pedal reversals during upset recovery at high airspeeds. This increased the likelihood that pilots would make inappropriate rudder pedal inputs during upset recoveries.

1. Wake vortices increase the risk of injury to passengers and cabin crew, and damage to aircraft.
2. There is no industry-wide practice of restraining service trolleys when in use in aircraft aisles. An examination of the risks associated with unsecured trolleys by manufacturers and operators may be warranted to identify mitigation strategies.
3. During the event, unrestrained manuals were moved from their stowage compartments and were strewn about the cockpit. These materials presented a risk of injury to the flight crew and damage to flight deck switches and controls.
4. In the Airbus A318/A319/A320/A321 series, it may be possible for a pilot to apply rudder control inputs that result in aerodynamically generated structural loads in excess of certification design limits and approaching ultimate loads.

Other Finding

1. At the time of the occurrence, Airbus documents supplied to A318/A319/A320/A321 series operators did not include lateral load limits that would trigger maintenance action for vertical tailplane inspection.

Transportation Safety Board

In December 2008, the TSB issued two safety communications.

Aviation Safety Advisory A08W0007-D2-A1, Wake Turbulence Encounters During En Route Climbs and Descents, addressed to Transport Canada, indicated that, as shown in this and other occurrences, the current provisions for wake turbulence avoidance may not be effective in all cases, especially for aircraft operating below and behind a preceding larger aircraft while en route. Unanticipated encounters with wake vortices may continue, increasing the risk of injury to passengers and cabin crew, and damage to aircraft. The Safety Advisory suggested that Transport Canada may wish to enter into discussions with the International Civil Aviation Organization (ICAO), NAV CANADA, and the U.S. Federal Aviation Administration (FAA) to address ways to reduce the possibilities of hazardous encounters with wake turbulence at cruising altitude or during en route climbs and descents.

Aviation Safety Advisory A08W0007-D1-A1, Pilot Training for Upset Recovery in Transport Category Aircraft, addressed to Transport Canada, indicated that, as demonstrated in this occurrence, pilots of transport category aircraft can make inappropriate rudder inputs during upsets that involve high bank angles. This can result in aircraft movements that can cause injury to passengers and cabin crew and, as demonstrated in American Airlines flight 587 (AAL587) in 2001, damage to structure. A review of upset training programs of Canadian operators indicates that some of the programs do not contain scenarios involving recovery from large bank angles. The Safety Advisory suggested that Transport Canada may wish to communicate to transport category aircraft operators in Canada the necessity to include roll scenarios in upset training and the appropriate use of rudder control during recoveries.

Transport Canada

Transport Canada Civil Aviation has agreed to participate in an ICAO Study Group to:

1. Develop proposals for the amendment of existing ICAO provisions relating to wake turbulence separation minima and aircraft categories.
2. Develop guidance material, as necessary, to support applicable Procedures for Air Navigation Services - Air Traffic Management (PANS-ATM) provisions.
3. Develop an assessment only of future work on the following subjects:
   1. requirements for wake turbulence prevention and indication systems;
   2. the effect of wake turbulence in the en-route phase of flight and in relation to helicopters;
   3. wake vortex reporting, data collection, and analysis of wake vortex encounters; and
   4. wake turbulence separation minima for specific runway operations, not currently covered by existing PANS-ATM provisions.

Air Canada

Following the occurrence, Air Canada convened a working group to review company training and operational procedures pertaining to jet upset. The training syllabus outlining the hazards associated with excessive use of rudder under certain conditions will be extended to all company aircraft types. Annual recurrent briefing and simulator training will be revised where appropriate.

In February 2008, Airbus issued a revision to the Airbus Maintenance Manual, chapter 05-51-44 for A318/A319/A320/A321 aircraft defining inspection requirements following high lateral acceleration events. Air Canada incorporated this information into the maintenance program for the aircraft types. Following a high lateral acceleration event, determination of aircraft serviceability will be made based on digital flight data recorder (DFDR)/quick access recorder (QAR) data analysis conducted by Airbus.

Air Canada will modify the traffic alert and collision avoidance systems (TCAS) in the A319 fleet equipped with data management computer (DMC) version 32 to allow display of all traffic, including non-threat targets. These modifications will incorporate Airbus Service Bulletins SB 34-1064 and SB 34-1106 Modification 25184, and allow all A319/A320/A321 TCAS to display all proximate traffic to 320 nautical miles (nm). This will improve pilot awareness of the proximity of other aircraft, including those that may pose a threat of producing hazardous wake turbulence.

Air Canada issued internal Transmittal 35 to flight crew concerning flight deck baggage retention. Aircraft operating manual (AOM) 1.04.02 P15 was revised to ensure that flight crew baggage is stowed using the flight deck tie-down areas if available, or otherwise ensure that bags are secure from movement.

Airbus

After determining that lateral g limits for triggering vertical tailplane inspections were not in place in A318/A319/A320/A321 aircraft maintenance manuals, Airbus published and distributed aircraft maintenance manual (AMM) 05-51-44-200-001 as a guideline for initiating inspection of the vertical tailplane components on those models.

Airbus issued Operator Information Telexes SE 999.0012/08/LB dated 15 February 2008 and SE999.0012/08/LB Rev. 01 dated 03 April 2008 to all operators of Airbus aircraft. The purpose was to communicate details of the event as well as inform operators of pending changes to reporting and maintenance requirements after encountering severe lateral acceleration.

International Civil Aviation Organization (ICAO)

The Airbus 380 Wake Vortex Steering Group provided ICAO with revised information that allowed the ICAO to issue a state letter in July 2008 with updated guidance information related to wake turbulence aspects of Airbus A380-800 aircraft.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 08 April 2010.

Appendix A — Map of Flight Paths - ACA190, UAL896

Image

Image

Appendix B — DFDR Summary of the Event

Image

Appendix C — Comments from the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile

Image

AAL587

American Airlines flight 587

ACA190

Air Canada flight 190

ACC

Area Control Centre

ADIRU

air data inertial reference unit

ADR

air data reference

AMM

aircraft maintenance manual

AOM

aircraft operating manual

ATC

air traffic control

ATC MANOPS

Air Traffic Control Manual of Operations

AURTA

Airplane Upset Recovery Training Aid

DFDR

digital flight data recorder

DMC

data management computer

ECAM

electronic centralised aircraft monitor

FAA

Federal Aviation Administration

FAR

Federal Aviation Regulations

FCOM

Flight Crew Operations Manual

FL

flight level

g

load factor

ICAO

International Civil Aviation Organization

IFR

instrument flight rules

JAR

Joint Aviation Requirements

KCAS

knots calibrated airspeed

nm

nautical mile

NRC

National Research Council of Canada

NTSB

National Transportation Safety Board

PANS-ATM

Procedures for Air Navigation Services - Air Traffic Management

QAR

quick access recorder

TCAS

traffic alert and collision avoidance system

TSB

Transportation Safety Board of Canada

UAL896

United Airlines flight 896

U.S.

United States

°

degree

°M

degree magnetic