Aviation Investigation Report A98Q0114

At about 0850 eastern daylight time, a flight instructor and a student took off on a local training flight from runway 25 at Montréal/Les Cèdres Aerodrome, Quebec. The student pilot was practicing spins and recoveries. The student initiated a spin to the left, his sixth of the day, at an altitude of 3 600 feet above sea level. The first five spins were to the right. The aircraft entered the spin normally. After one and a half turns, the flight instructor asked the student to recover. The student applied pressure on the right rudder pedal, as taught by the flight instructor, and the rotation did not stop. The flight instructor took over the controls and applied pressure on the right rudder pedal to stop the rotation, but the rotation did not stop. The aircraft, by then, was established in a stabilized spin, rotating to the left, and continuing its descent. The flight instructor applied full power for a moment, then full flaps, to no avail. Throughout the recovery attempt, the flight instructor continued in his efforts to avoid the crash. The aircraft struck the surface of Lac Saint-François. The student pilot sustained serious injuries but managed to evacuate the sinking aircraft through the right, rear window. He then tried to pull out the unconscious flight instructor, but without success. A fisherman close to the scene rescued the student and transported him ashore where emergency vehicles were standing by. The flight instructor did not evacuate the aircraft and died in the accident.

Ce rapport est également disponible en français.

The 1300 Coordinated Universal Time (UTC) weather observation taken at Montreal International Airport (Dorval), about 20 miles east of the accident site, was 5 000 feet scattered, 25 000 feet scattered, visibility 25 miles, temperature 20.3 ° C, dew point 13.3 ° C, wind direction 280 ° at eight knots, and altimeter setting 29.85 inches of mercury.

The flight instructor occupied the right-hand seat. He was certified and qualified to conduct the flight in accordance with existing regulations. He had a total flying time of 1 140 hours, with 1 000 hours on the aircraft type, and about 645 hours of instructional time. He had recently passed the airline transport pilot licence written exams. He was recognized by the chief instructor and his peers as a very serious flight instructor and as being truly professional in his work. There was no evidence that incapacitation or physiological factors affected the flight instructor's performance.

The student pilot occupied the left-hand seat. He had a student pilot permit, and was under training to obtain a private pilot licence.

The Cessna 152 Pilot's Operating Handbook recommends the following with regard to spins:

Where feasible, entries be accomplished at high enough altitude that recoveries are completed 4 000 feet or more above ground level.

It was a normal procedure at the flying school to enter spins at about 3 500 feet above sea level (asl) (3 400 feet above ground level (agl)).

Transport Canada's Flight Instructor Manual states that:

All practice spin recoveries should be completed no less than 2 000 feet above ground, or at a height recommended by the manufacturer, whichever is the greater.

The student entered a left spin with the following procedure: as the stall approached, he pulled the elevator control to the full aft position and applied left rudder pedal so that full left rudder deflection was reached almost simultaneously with full up elevator. The student was uncertain whether he had both feet solidly on the rudder pedals when he applied full left rudder. It could not be determined during the investigation to what extent the right rudder pedal was depressed during the spin recovery attempt.

Cessna recommends the following recovery technique in the Cessna 152 Pilot's Operating Handbook:

1. Verify that ailerons are neutral and throttle is in idle position.
2. Apply and hold full rudder opposite to the direction of rotation.
3. Just after the rudder reaches the stop, move the control wheel briskly forward far enough to break the stall. Full down elevator may be required at aft center of gravity loadings to assure optimum recoveries.
4. Hold this control input until rotation stops. Premature relaxation of the control inputs may extend the recovery.
5. As rotation stops, neutralize rudder, and make a smooth recovery from the resulting dive.

The aircraft was retrieved from the water of Lac Saint-François, and an assessment of the damage was made. The damage pattern and the hydro-forming of the bottom skin of the fuselage revealed that the aircraft spun into Lac Saint-François entering the water at a relatively low forward velocity. The rear of the fuselage buckled downward, and the empennage hinged downward relative to the fuselage, breaking open the fuselage-to-empennage splice at the top. The engine, with the nose, instrument panel, and controls, hinged downward relative to the cabin. The aircraft ended upright, on its nose, submerged in 20 feet of water. The examination of the aircraft, after it was recovered, revealed that the flaps were extended approximately 30 °--the specified maximum travel for the Cessna 152. The damage to the propeller was consistent with an engine at idle power at the time of impact. There was continuity with all the controls. The rudder was found locked in a full left deflection.

The rudder components and the front end of the aircraft were sent to the TSB Engineering Laboratory in Ottawa, Ontario.

It was observed that the rudder stop plate on the right-hand half of the rudder horn was firmly jammed behind its stop bolt on the fuselage. The rudder was deflected 34 ° measured perpendicular to the hinge line, whereas the maximum allowable deflection for setting the stops is 23 °. When the rudder was released from its jam, the deflection was 23 °. It required 36 pounds of steady pull on the trailing edge of the rudder to break the rudder out of its jammed position. This steady pull of 36 pounds equated to 180 pounds if the force was applied to the rudder pedal. However, given that the direction of cable pull tended to increase the jamming by closing the horn, it would not have been possible to break the rudder jam with the application of right rudder.

Image

Figure 1 - Rudder jammed in 34-degree deflection.

The examination revealed that the empennage of the aircraft had been damaged before the accident. The right elevator tip trailing edge had been broken and repaired with aluminium foil tape, and the rudder bottom tip had two cracks of about 1.5 inches extending from a rivet hole which had been stop-drilled and painted. No record was found of these repairs. The examination also indicated interference between the up elevator and the 34-degree left rudder such that the elevator had left a circular mark on the rudder. The trailing edge of the elevator could not be moved downward past neutral because of this interference.

A 50-hour engine inspection^{Footnote 1} was carried out by an apprentice mechanic the day before the accident. During the check, the right pedal rudder bar return spring, P/N 0310196-13, and a spring attachment bracket for this spring, which was welded to P/N 0411526-2 rudder bar assembly, were found to be broken. The return spring supplied a tension force of about 10 pounds per inch of stretch and balanced the force exerted by the matching left rudder bar return spring. The two return springs maintain tension in the rudder cables that connect to the right and left halves of the rudder horn. Without the right rudder pedal return spring, the right rudder cable slackens. The left rudder pedal return spring will then tend to pull the right pedal toward the pilots, which facilitates deflection of the rudder to the left.

The broken pieces of the rudder control system were removed by the apprentice mechanic during the check, but were not replaced. The apprentice mechanic then requested the opinion of an aircraft maintenance engineer (AME), the person responsible for company maintenance. The AME decided that the aircraft could be returned to service without being repaired. The defects in the rudder control system were not entered in the aircraft's journey logbook or technical logbook as required by the Transport Canada-approved company Maintenance Control Manual (MCM). On completion of the check, the aircraft was signed out, in the journey logbook and in the technical logbook, as being airworthy and released to service on 17 July 1998. The person responsible for company maintenance judged that the absence of the spring and bracket would not affect the flight characteristics of the aircraft and decided to release it for service until replacement parts could be installed.

Canadian Aviation Regulations (CARs) standard 571.10 (4), item (d) of the Types of Work table specifies that:

• Work that disturbs engine or flight controls -- That the system has been inspected for correct assembly, locking and sense of operation, by at least two persons, and the technical record contains the signatures of both persons.
• Information Note: One of the signatures required by this section may be that of the person who has signed the maintenance release.

The Laurentide Aviation Maintenance Policy Manual (MPM) contains procedures that are in agreement with this standard. This required Standard of Airworthiness was not accomplished on the accident aircraft.

Laurentide Aviation was using a snag book (not the journey logbook) for the flight instructors and pilots to report defects found on aircraft. The journey logbooks were not available to students and instructor pilots for viewing or for recording times or defects. Transport Canada did not approve the use of a snag book in the Laurentide Aviation MCM, and Transport Canada inspectors were not aware of the use of a snag book. The person responsible for the maintenance reviewed the snag book each morning and took note of all defects in order to take corrective action. A column for corrective action taken was then completed by the person responsible for the maintenance once the defect had been repaired. No corresponding entries were made in the journey logbook. In this occurrence, the flight instructor and the student were not aware of the missing rudder return spring since no entry was made in the snag book with regard to that defect. The occurrence flight was the first flight after the inspection.

According to the Laurentide Aviation MCM, the president of the company is responsible for appointing a manager to be responsible for the maintenance control system. The person responsible for the maintenance control system must record aircraft defects and ensure that defects are rectified in accordance with the company's MCM before the aircraft is released to service. That person is also responsible for removing an aircraft from operation for non-compliance with CARs or for any safety reasons. A maintenance control system dispatch procedure is also in place to ensure that aircraft are not operated unless they are airworthy and maintained in accordance with the operator's maintenance policy.

Laurentide Aviation is a Transport Canada-approved flight training and air taxi operator. It holds an approved maintenance organization (AMO) certificate. As an operator, it must present two separate manuals for approval by Transport Canada:

• A Maintenance Control Manual (MCM), which stipulates that a flight training unit that operates an aircraft or a helicopter shall establish and comply with a maintenance control system that a) consists of policies and procedures regarding the maintenance of aircraft operated by the flight training unit; b) meets the requirements of this subpart; and c) is described in the flight training unit's MCM.
• A Maintenance Policy Manual (MPM), which stipulates that an approved maintenance organization (AMO) certificate holder shall establish, maintain and authorize the use of an MPM, that contains information to ensure the efficiency of the AMO's maintenance policies dealing with the subjects set out in Chapter 573 of the Airworthiness Manual.

The MCM, revision 3, was approved by Transport Canada on 25 November 1997 and the MPM was approved by Transport Canada on 26 November 1997.

The Cessna 152 does not operate under a minimum equipment list (MEL) system. It is then important to note in written records any item related to the airworthiness of the aircraft and items required by the CARs.

CARs section 406.40 stipulates that:

• A flight training unit that operates an aeroplane or a helicopter shall establish and comply with policies and procedures to ensure that an aircraft is not operated unless it is
  1. airworthy;
  2. appropriately equipped, configured and maintained for its intended use; and
  3. maintained in accordance with the flight training unit's maintenance control manual.

CARs section 406.41 stipulates that:

• A flight training unit that operates an aeroplane or a helicopter shall establish and comply with policies and procedures that meet the personnel licensing standards for
  1. recording aircraft defects, including defects that are detected during aircraft operation or during the performance of elementary work or servicing;
  2. identifying defects that recur and reporting those defects as recurring defects to maintenance personnel;
  3. ensuring that defects are rectified in accordance with the requirements of these Regulations; and
  4. subject to Sections 605.09 and 605.10, scheduling the rectification of defects whose repair has been deferred.

Part 1, section 1.2, entitled "Authority" of Laurentide Aviation's MCM, requires that the procedures of the MCM be followed at all times to ensure compliance with CARs and to ensure efficiency of the MCM and that, in case of conflict between the MCM and the CARs, the CARs will prevail. Also, in part 1, section 1.2, entitled "Authority" of Laurentide Aviation's MPM, it is required that the procedures of the MPM be followed at all times to ensure compliance with CARs and that, in case of conflict between the MPM and the CARs, the CARs will prevail.

A review of the journey logbook and the technical logbook revealed that the company had not met all of the requirements of its MPM, as approved by Transport Canada on 26 November 1997. The rudder control defect was not logged, and corrective action was not carried out.

The last Transport Canada maintenance audit of the company before the accident had been conducted in 1991.

Transport Canada also conducted flight tests and base inspections in December 1993, October 1995, and June 1998. During these inspections, Transport Canada did not report any anomalies regarding the maintenance operations of the company. In the period 20 September to 07 October 1999, Transport Canada conducted a regulatory audit of the company. Amongst the discrepancies noted, and pertaining to discrepancies discovered during the investigation into this accident, were the following: 1) many publications which were supposed to be on hand were missing and many technical and regulatory publications were not kept up to date; 2) the procedures established in the MPM were not followed regarding the "Recording of Maintenance," and many deficiencies were found in the technical records of many aircraft (14).

From 17 January to 04 February 2000, Transport Canada conducted a maintenance audit of another flight school operator at Saint-Hubert Airport, Québec. During the audit, Transport Canada inspectors found discrepancies that led to the grounding of 22 aircraft for various reasons. Following this maintenance audit, the operator, on 15 February 2000, submitted a Service Difficulty Report (SDR) after inspecting its fleet of 10 Cessna 152 aircraft. On five of these aircraft, there was evidence that the rudder stop plates on the rudder horns had ridden over the stop bolts. Transport Canada also submitted an SDR on the same subject. TSB investigators visited the operator the next day for preliminary examinations of the five aircraft with the rudder problems.

On 22 February 2000, four TSB investigators met at the flight school at Saint-Hubert, with representatives of Laurentide Aviation, Transport Canada, and Cessna, to examine the aircraft with suspected rudder anomalies to determine if rudder anomalies were related to the circumstances that led to the accident involving C-GZLZ. It was determined that a very hard left rudder pedal input could cause the right side of the rudder horn to deflect slightly and over-travel and hang up momentarily on the stop plate (bumper) on the top of the stop bolt. Witness marks were evident showing that this had occurred on previous occasions. However, a slight application of right rudder pedal would release the rudder. During those tests, it was not possible to make the rudder horn stop plate override the stop bolt and hook behind and below it, as was found in the accident aircraft. It was noted during these tests that the rudder was being stopped from further over-travel in its movement by contact with the left elevator. Witness marks found on the accident aircraft correspond with previous contact between the rudder and elevator.

To better understand whether and how the rudder could have over-traveled and jammed on the accident aircraft, additional tests were conducted on a similar aircraft. The test conditions included removing the right rudder bar return spring and disconnecting the right rudder cable. As with a loose rudder cable, this facilitated over-deflection of the rudder to the left. It was also determined that moving the elevator to a position more than two-thirds up--increasing the clearance between the rudder and the elevator--permitted further travel of the rudder. In that condition, a very hard left rudder pedal input permitted the rudder to over-travel and the stop plate locked below and behind the stop bolt, exactly as had been found in the accident aircraft. The rudder was locked irreversibly and had to be released by levering the rudder horn with a screwdriver. A second test, with the rudder cable reconnected, but slightly loose, and with other conditions the same, again led to a locked rudder. These tests showed that the design and condition of the stop bolt and rudder horn stop plate allowed the stop plate to over-travel the stop bolt and jam.

On 14 March 2000, Cessna notified TSB investigators that it is developing a new design for the rudder horn stop bolt to preclude the possibility of over-travel of the rudder. Cessna has notified the Federal Aviation Administration (FAA) Aircraft Certification Office that it is developing a Service Bulletin to offer the new configuration for all Cessna 150s and 152s produced after 1966. Transport Canada and the FAA are considering airworthiness actions.

The following Engineering Branch report was completed:

• LP 89/98 - Investigation of a Locked Rudder.

This report is available upon request from the Transportation Safety Board of Canada.

The weather conditions were appropriate for the flight. The flight instructor was qualified and had experience appropriate to the flight being conducted. Although the minimum altitude recovery of 4 000 feet agl recommended by the manufacturer was not followed by all the flight instructors at Laurentide Aviation, it is likely that a higher altitude would not have enhanced the flight instructor's chances of recovery from the spin in this occurrence.

However, the failure to follow specified altitude restrictions for spin exercises increases the risk of such operations and deserves attention by Transport Canada by means of reminding operators of such safety precautions.

It was presumed that the lack of a rudder bar return spring would not affect the flight operations of the aircraft, and the aircraft was released for flight. In reality, because the spring was missing, the aircraft was not airworthy. Further, the required entries were not made in either the snag book or the journey logbook. Had the logbooks reflected the defect and been available to the pilots, the flight instructor likely would have been aware that the rudder bar return spring was missing and would have had the option of refusing to operate the aircraft in that condition. There was no communication from the maintenance personnel to the flight crew member about the maintenance actions taken on the aircraft in relation to the rudder system.

The requirement to conduct independent inspections is intended to provide a further check of an engine or flight control system which has been disturbed during maintenance. The objective is to increase the likelihood that the system is going to operate properly. Work was done on the flight control system in the form of inspection, removal of broken parts, discussion, and decision making. The absence of the rudder bar return spring and its attachment bracket arguably resulted in a disturbance to the flight control system which ought to have required an independent inspection. No independent check was completed and Transport Canada maintains that this is not required in these circumstances because no work was done on the rudder control system. In any event, the removal of the rudder return spring meant that the flight authority was no longer valid because the aircraft no longer conformed to its type certification.

During the maintenance audit of the flight school operator at Saint-Hubert Airport, discrepancies were noted that led to the grounding of several aircraft, including five Cessna 152 aircraft with reported rudder over-traveling. The audit revealed that there were scratches or score marks on the five airplanes that indicated that the rudder horns had over-traveled above and beyond the stop bolt at some time. The preliminary findings regarding rudder over-traveling led to additional examinations and tests by the TSB, Transport Canada, Cessna, and Laurentide Aviation personnel on 22 February 2000.

The tests conducted on 22 February 2000 revealed that, under certain conditions, the rudder can over-travel and jam in an irreversible condition, exactly like the condition of the rudder found on the accident aircraft. A full up, or nearly full up, elevator and a full rudder input are the control inputs used for spin entry.

The implications of removing the broken rudder bar return spring from the accident aircraft were not apparent to the Laurentide Aviation maintenance personnel. However, the recent examinations and tests confirmed that the absence of the return spring, in combination with other factors such as incorrect rudder rigging, condition of the rudder, and rudder horn or stop plate condition and alignment, set the stage for irreversible jamming of the rudder during application of controls for spin entry.

It can therefore be concluded that the aircraft entered a left spin with the rudder locked at a 34-degree deflection. With the rudder jammed the way it was, no amount of right rudder pedal force would have released the jammed rudder, as the direction of cable pull tends to increase the jamming by closing the horn.

The actions proposed by Cessna to design a new rudder horn stop bolt assembly should provide protection against future jamming of the rudder--if the new design is installed on the aircraft. However, the Service Bulletin planned to offer the new configuration will not be mandatory without regulatory airworthiness actions.

Findings as to causes and contributing factors

1. During a practice spin exercise, the rudder locked in a full left deflection, which could not be overcome by the crew.
2. The aircraft was released for flight with a rudder bar return spring missing, which, in combination with other factors, probably allowed the rudder to lock in a full left deflection.
3. Tests conducted on an aircraft similar to the accident aircraft showed that the design and condition of the stop bolt and rudder horn stop plate allowed the stop plate to over-travel the stop bolt and jam.
4. Because the direction of cable pull tends to close the mouth of the horn, increasing the jamming effect, applying right rudder force would only have tightened the jam rather than broken it.

Other findings related to risks to persons, property and the environment

1. The aircraft was released for flight with a rudder bar return spring missing, and without the required documentation being entered in the journey logbook and technical logbook regarding the missing spring and the work performed on the rudder system. Thus, the aircraft did not meet the airworthiness requirements for flight.
2. Laurentide Aviation maintenance personnel released an aircraft for flight in an unsafe condition.
3. No entry was made in the aircraft journey logbook or technical logbook indicating that a rudder bar return spring was missing from the aircraft, and the flight instructor was unaware that the spring was missing.
4. Routinely, the company was using a snag book to keep records of discrepancies and repairs instead of making the required entries in the journey logbook and in the technical logbook. This method of recording was not approved by Transport Canada, nor was it in accordance with the company's Maintenance Control Manual (MCM) and Maintenance Policy Manual (MPM).
5. Tests conducted on 22 February 2000 confirmed that, under certain conditions, the rudder will jam at full deflection.

Action taken

On 14 March 2000, Cessna notified the TSB that it had designed a rudder horn stop bolt with a larger head diameter to prevent over-travel of the rudder following a hard rudder input. Cessna has notified the Federal Aviation Administration (FAA) Aircraft Certification Office about this matter and expects to issue a Service Bulletin offering the new configuration rudder stop bolt for all Cessna 150s and 152s built after 1966. A time frame for these actions was not specified.

On 09 May 2000, Transport Canada issued Service Difficulty Alert (SDA) No. AL-2000-04 following information gathered during the tests carried out at Saint-Hubert on 22 February 2000. The SDA discusses the accident circumstances and outlines details regarding the inspection of the rudder control system.

Action required

While stated action by Cessna to develop a Service Bulletin designed to prevent over-travel of the rudder is appropriate, the Board is concerned that, since the proposed Service Bulletin will be voluntary, not all Canadian-registered Cessna 150s and 152s will be modified. Therefore, the Board recommends that:

Any mandatory airworthiness actions to retrofit Cessna 150 and 152 aircraft with newly designed rudder horn stop bolt systems will likely take considerable time to complete. In the meantime, these aircraft will be flying with a known safety deficiency. The circumstances of this accident suggest that the serious implications of the broken or missing rudder cable return spring were not fully understood. Moreover, the possibility of an irreversibly jammed rudder during intentional spin entry by full rudder deflection was not understood until this accident investigation was completed. Therefore, the Board recommends that:

The required logbook entries regarding the maintenance performed on the rudder system were not made, and it was evident that the operator, in general, did not maintain the aircraft journey logbooks in accordance with the Canadian Aviation Regulations (CARs). Therefore, the Board recommends that:

The FAA, as the regulatory body in the state of design and manufacture, has primary responsibilities with regard to continuing airworthiness of both the Cessna 150 and 152 aircraft. Therefore, the Board recommends that:

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 06 July 2000.