MIAMI, FL, USA
N7082A
Airbus Industrie 300-600
During final approach to the airport and after the crew turned the autopilot off, American Airlines flight 916 began experiencing uncommanded rudder motion and high rudder pedal forces. The flight crew executed a go-around about 360 feet above ground level. Despite continued difficulties with the rudder, the flight crew was able to land the airplane successfully. Examination of the autopilot yaw actuator revealed two main findings: (1) the wiring to the two main valve solenoids had been cross connected, and (2) a foreign-particle contaminant in the green system engagement valve solenoid had prevented disengagement of the yaw actuator. Investigators found that when these two conditions exist, turn coordination system inputs can cause uncommanded rudder movements. Inspections of A300 and A310 airplanes after the incident resulted in the discovery of another American A300 with cross-connected solenoid wiring. American indicated that it had installed new autopilot actuator solenoids on this airplane and the rest of its A300 fleet. At the time the solenoids were installed, American's procedures did not include a check for proper installation of the solenoid wiring. The manufacturers of the airplane and the actuator have since incorporated new procedures to ensure that the solenoids are wired properly. As part of the investigation, numerous additional solenoids were examined for the presence of contaminants. Although contaminants were discovered on several other solenoids, they were smaller than that found on the incident airplane's engagement solenoid and did not affect solenoid functionality. Audits of the solenoid assembly process revealed the need to update production and inspection documentation and the need to include measures to prevent foreign particles from contaminating adjacent workstations. The manufacturer of the solenoids took corrective actions that included improving production facilities, implementing more stringent sampling and inspection procedures, and clarifying assembly instructions.
HISTORY OF FLIGHT At approximately 1450 eastern daylight time on May 11, 1999, American Airlines (American) flight 916, an Airbus A300-605R (N7082A), experienced high rudder pedal forces and uncommanded rudder motion during final approach to runway 9R at Miami International Airport, Miami, Florida. The motion started soon after the autopilot was turned off in preparation for landing. (The autopilot remained off throughout the remainder of the flight.) Flight data recorder (FDR) data show small rudder oscillations within the range of about 1.0 degree left to about 4.0 degrees right when the airplane was at an altitude of approximately 1,450 feet and an airspeed of 152 knots. The flight crew switched off the yaw dampers, but the uncommanded rudder motion worsened, and the crew switched the yaw dampers back on. During the airplane's descent and approach (at an airspeed of 137 knots), the amplitude of the rudder oscillations reached as high as 5 degrees left and 12 degrees right. The FDR data indicate that the airplane descended to about 360 feet before a go-around was initiated and the airplane began to climb. Large rudder oscillations continued during the climb, and maximum lateral accelerations of +0.342 to -0.240 g were recorded. Although the uncommanded rudder motion continued during the go-around, the crew was able to land on runway 27L successfully. No passengers or crewmembers were injured, and the airplane was not damaged. The flight was a regularly scheduled flight from Bogota, Colombia, to Miami being conducted under 14 Code of Federal Regulations Part 121. During postincident tests conducted at the American maintenance hangar in Miami, investigators reproduced rudder behavior similar to that experienced on flight 916 by pressurizing the green hydraulic servo control system and energizing at least one of the flight control computers (FCC). (The airplane has three independent hydraulic systems, designated as green, yellow, and blue.) The autopilot remained off. Rudder operation returned to normal when either testing condition was not satisfied. After the rudder anomaly had been reproduced several times, the FCC fault data for the incident flight were reviewed by American technical specialists, who reported that the data indicated faults with the autopilot yaw actuator and the No. 1 FCC. (FCC fault data are recorded when an uncommanded autopilot disengagement occurs.) After the rudder testing was complete, the autopilot yaw actuator was removed from the airplane at Safety Board request and replaced with a new yaw actuator to determine whether the rudder anomaly remained and to preserve any failures within the original actuator. The incident actuator, including the hydraulic lines, torque limiter, connector, and wiring, was inspected before and after it was removed. No anomalies were noted. No shorts were found during continuity checks between the FCC connectors and the autopilot yaw actuator (pin-to-pin and pin-to-ground). With the new yaw actuator installed in the airplane, investigators repeated the test series. No rudder stiffness or uncommanded movements were noted during any testing. A300 AUTOPILOT ACTUATOR DESCRIPTION The A300-600 contains three autopilot actuators: one each for the pitch, roll, and yaw axes. The actuators are identical although the output lever is unique to each position. When the autopilot is active, the actuators transform signals from the FCC into commands for movement of the respective flight controls. Each actuator consists of two independent, redundant control channels-the green and yellow systems-each with its own electric and hydraulic operation. Operation of each actuator is controlled by two pairs of solenoids (one pair for each channel). Each solenoid pair consists of a main valve solenoid that controls hydraulic pressure to the actuator and an engagement valve solenoid that controls engagement of the autopilot clutch for autopilot commands. Except for tags on the wiring to the end caps that distinguish the two main valves (both marked "P") from the two engagement valves (both marked "E"), the four solenoids (part number 38215-262) are identical in appearance. The main valve solenoid is always energized in the ON position when the respective FCC is powered, and the FCCs are continuously powered in flight. Once the appropriate autopilot mode is engaged, the engagement valve solenoids for the roll and pitch autopilot actuators are energized and actuator movement is controlled by FCC commands. For the autopilot yaw actuator, the leading edge slats must also be extended to at least 15 degrees before the engagement valve solenoid is energized. For each autopilot actuator channel, the FCC monitors the position of the autopilot clutch to ensure that it agrees with the autopilot selection made by the crew. If the FCC detects a disagreement between the autopilot clutch and the autopilot selection, the FCC will command the respective main valve solenoid to close, thus depressurizing that channel of the autopilot actuator. AUTOPILOT YAW ACTUATOR EXAMINATION The autopilot yaw actuator was produced by Lucas Aerospace, which is now known as TRW Aeronautical Systems. Although the actuator was the original unit installed in the airplane at delivery, American had replaced all four solenoids with upgraded units during a C check on January 19, 1998. Safety Board investigators transported the incident airplane's autopilot yaw actuator, serial number (S/N) 2011, to the Lucas facility in St. Ouen, France, for examination. The examinations revealed two main findings: (1) the wiring to the two main valve solenoids had been cross-connected, and (2) a foreign-particle contaminant was found in the green system engagement valve solenoid. Cross-connected Wiring of the Two Main Valve Solenoids Examination of the actuator at the Lucas facility revealed that its two main valve solenoids were cross-connected so that the electrical connection for the yellow system was connected to the green system solenoid, and vice versa. In this configuration, the FCC for the green system would actually control the main valve for the yellow system, and the FCC for the yellow system would control the main valve for the green system. After the cross-connected wiring on N7082A was discovered, Airbus issued an All Operators Telex (AOT) on May 27, 1999, to all operators of Airbus A300, A310, and A300-600 airplanes. The AOT specified that a one-time inspection be conducted within 10 days to confirm proper connection of the main valve solenoids. Both the French Directeur General de L'Aviation Civile and the Federal Aviation Administration subsequently issued airworthiness directives on June 30 and August 24, 1999, respectively, to require the AOT actions. As a result of the AOT checks, another American A300-600 (N3075A) autopilot yaw actuator (S/N 1630) was discovered with cross-connected autopilot solenoid wiring. American indicated that it had installed new solenoids on the three actuators (pitch, roll, and yaw) on this airplane and the rest of its A300 fleet between July 1997 and July 1999. At the time the new solenoids were installed, procedures did not specifically include a check to ensure that the solenoid wiring was installed properly. Both Airbus and Lucas have since developed new procedures to ensure that the autopilot actuator solenoids are properly wired. Solenoid Contamination Investigators found that a cylindrical particle in the green autopilot engagement valve solenoid, S/N 4287, on the incident airplane's yaw actuator had prevented the solenoid from disengaging. The particle was analyzed at the Lucas facilities under supervision by the French Bureau Enquêtes-Accidents. Analysis revealed that the particle was composed of a copper-zinc alloy covered by a layer of gold and nickel. Spectroscopic examination and analysis of the solenoid components indicated that the particle did not originate from solenoid S/N 4287. The particle measured 0.65 millimeter (diameter) by 0.34 millimeter (length). Further examination of the incident airplane's autopilot yaw actuator revealed contaminants in two of the other three solenoids (S/Ns 4358 and 4315). The contaminants consisted of particles in the small cross-hole of the solenoid pushbutton. Lucas conducted several tests using the biggest particle but was unable to make it jam the solenoid. Investigators checked other A300-600 autopilot actuator solenoids for contamination, including the autopilot yaw actuator (S/N 1630) from N3075A, which was the other A300 that had been discovered to have the cross-connected solenoid. That actuator was sent to the Lucas facility in St. Ouen for examination, where investigators found that one solenoid (S/N 4513) contained three contaminants and another solenoid (S/N 4671) contained one. The first two contaminants in solenoid 4513 were thin curls of aluminum bronze (the same material as the solenoid's push button); one measured 0.8 by 0.4 millimeter, and the other measured 0.4 by 0.4 millimeter. The third contaminant found in solenoid S/N 4513 was a particle of organic material containing traces of titanium and silicon, consistent with paint pigment. This particle measured 0.15 by 0.12 millimeter. Solenoid S/N 4671, the other solenoid found with a contaminant, contained a particle of acrylic resin; its size was not noted. To further explore the issue of solenoid contamination, Lucas examined the eight solenoids from two similar autopilot actuators (S/N 1828 and S/N 2432) and found contaminants in two of the solenoids from autopilot actuator 1828. In one solenoid, the single contaminant was identified as cellulose (consistent with wood fibers). In the other, the single contaminant was identified as lacquer. Lucas indicated that these contaminants were minor and would not have prevented operation of the solenoids. No contamination was found in the solenoids from autopilot actuator 2432. Solenoid Manufacturing History Lucas produced approximately 3,300 solenoids (part number 38215-262) from June 1982 to December 1990. Lucas then contracted with Industria to manufacture the solenoids (using the same drawings), and Industria produced over 5,700 solenoids from December 1990 to July 1999. Lucas indicated that the contaminated solenoids from N7082A and N3075A were manufactured within 4 months of each other in 1997. Lucas Action Following Discovery of Solenoid Contamination After initial discovery of solenoid contamination in the incident airplane's autopilot yaw actuator, Lucas audited Industria's solenoid assembly and inspection processes. The audit revealed the need to update production and inspection documentation and to better segregate assembly areas to prevent particles from reaching other work stations. The audit did not reveal any changes in procedures, or any personnel, equipment, or training issues that may have led to the contamination. Following the audit findings, Industria initiated a corrective action plan that was completed in September 1999, prior to production of the next solenoid batch. The resulting improvements included segregated assembly tables (with plexiglass screens), an increased sampling rate during acceptance tests, reinforced inspection of solenoid push rods, and clarified assembly instructions. Lucas also initiated additional actions to confirm solenoid serviceability despite the presence of some contaminants. These actions included a 1000-cycle endurance test with contaminants present on five different solenoids (which did not affect solenoid functionality), stock checks of parts and solenoids, and corrective actions to prevent the introduction of burrs during production. Lucas also inspected 14 solenoids in addition to those previously examined. The sampling included solenoids from the same batch as those from the incident airplane and other American units, and solenoids from batches produced before and after those produced for the American units. Lucas indicated that the jam experienced on autopilot yaw actuator S/N 2011 from the incident airplane was the only one on record. MAINTENANCE RECORDS REVIEW The incident airplane, Airbus S/N 643, was delivered to American on September 11, 1992. The airplane had a total of 18,651.34 hours and 7,435 cycles at the time of the incident (including the incident flight). Safety Board investigators reviewed the airplane's flight logbook for the 30 days before the incident, looking for flight control discrepancies. They found that a flight control discrepancy had occurred on April 27, 1999, when the blue hydraulic system rudder jam detector was recorded as "inop" and was replaced the same day. The unit was tested in accordance with American's work card 2814, and a subsequent check revealed no anomalies. A similar fault involving the yellow hydraulic system had occurred on April 11, 1999. That discrepancy was cleared after the switch connector was cleaned. According to American, during a January 1997 C check, another American A-300-605R, N70072, experienced a rudder anomaly when the green hydraulic system was powered and the cockpit light test switch or autopitch trim was engaged. (The cockpit light test switch initiates the application of electrical power to the FCCs when the airplane is on the ground.) The anomaly was similar to that experienced by the incident airplane during ground testing by investigators. American was able to repeat the fault several times by duplicating the same conditions. The autopilot yaw actuator (part number 30513-136, S/N 1507) was removed and sent to Lucas for examination and repair. Functional testing by Lucas revealed all parameters to be within specified limits, and Lucas was unable to repeat the anomaly noted during the C check. Although Lucas indicated that the test rig at their Englewood, New Jersey, facility, where the actuator was tested, would have identified such a cross-connection, Lucas records did not indicate that the testing had revealed the cross-connected wiring of any solenoids. Lucas installed new solenoids that incorporated service bulletin modifications. The unit was then recertified for service and returned to American. Because the anomalies affecting N7082A and N70072 were similar, Safety Board investigators requested a search for the autopilot yaw actuator from N70072. American conducted a fleet inspection campaign and found that the actuator (S/N 1507) was installed in the pitch position on N7082A (the incident airplane) at the time of the incident. The unit was removed and shipped to the Lucas facility in Englewood for examination. No functional anomalies were identified during examinations by Lucas or during checks by American. A300 SIMULATOR EVALUATIONS Evaluations were conducted in the Airbus A300 "iron bird" simulator to observe how an autopilot that was jammed in the engaged position would affect the airplane's controllability. This was accomplished by simulating the failure of the engagement solenoids on each of the autopilot actuators in the engaged position. (The monitoring function of the FCC was inhibited to allow the operation to continue.) Each simulator evaluation was flown by A300-rated pilots from the Safety Board, American, and Airbus. In each scenario, the autopilot was engaged for one of the three control axes (pitch, roll, or yaw). The pilots then attempted to maintain proper control as they flew the simulator down to an altitude of approximately 10 feet. For each scenario, light to severe turbulence was also introduced to evaluate its effect on controllability. Failure of the pitch actuator had the least adverse effect on controllability, and failure of the yaw actuator created the greatest control difficulties. Additionally, introduction of turbulence diminished the pilots' control further. Failure of the pitch actuator was least affected by the turbulence, and failure of the yaw actuator was most affected by the turbulence. However, in each failure mode, the pilots were able to control the simulator down to the point of the landing flare. ADDITIONAL INFORMATION To prepare crews for handling the type of uncommanded rudd
Uncommanded rudder movement caused by a contaminant in the engagement valve solenoid that prevented disengagement of the autopilot yaw actuator and cross-connected wiring of the autopilot yaw actuator's main valve solenoids by the operator. Factors contributing to the incident were the lack of proper controls in the solenoid assembly process and the lack of procedures to detect miswired solenoids.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
