Description

On 6 September 2023, the crew of a Boeing 738-800 (VH-YQR) operated by Virgin Australia Airlines on a scheduled domestic passenger flight from Brisbane to Melbourne in daytime visual conditions (VMC) temporarily lost control of their aircraft. This happened as a result of the pilot monitoring (PM) captain operating the rudder trim instead of unlocking the flight deck door after a cabin crew member had requested access. Full recovery was delayed by the pilots not recognising the cause, and by an initial attempt to resolve the unintended flight path deviation without first disengaging the autopilot. One of the unsecured cabin crew sustained a minor injury as a consequence of the upset.

The position of the rudder trim and door lock switches relative to the pilots’ seats. [Reproduced from the Official Report]

Investigation

An investigation into the occurrence was carried out by the Australian Transport Safety Bureau (ATSB) using data from the flight data recorder (FDR). It was noted that the captain had about 19,500 hours flying experience, which included 13,500 hours on type. The first officer had about 2,700 hours flying experience, which included about 350 hours on type.

The captain, who was acting as PM, stated that after visually identifying the flight deck door unlock switch, they had diverted their attention to the door. Instead of grasping the door switch, the captain unknowingly then selected and activated the rudder trim switch instead. Since the cabin door switch has to be held in the unlocked position until opened by the person who has requested access, the captain held what they believed was the door unlock switch position for around eight seconds. During this time, the captain was also in routine conversation with the first officer.

The AP responded to the resultant left yaw and induced left roll by applying increasing right wing down aileron input - which was replicated on the pilots’ control wheel. Whilst the autopilot was initially able to maintain an approximately wings-level attitude, it reached the limit of its authority after five seconds of left rudder trim, and the aircraft began to bank left. The bank angle rapidly increased, and an upset condition resulted. Despite the large right wing down aileron input initially applied by the attempt by the AP to recover to a wings-level attitude, neither pilot identified the left rudder trim as the origin of the upset condition until the left bank angle was increasing through 35°.

At this point, the first officer disconnected both the AP and the autothrust (A/T), verbalised those actions, and briefly applied about two-thirds control wheel deflection right wing down. As this was done, an enhanced ground proximity warning system (EGPWS) Mode 6 Bank Angle Alert was annunciated, and the captain called "upset." The pilot flying (PF) acknowledged the call and responded by verbalising and actioning the upset recovery procedure. A large application of right wing down roll stopped and then reversed the increasing left roll, but not before the aircraft had reached a left bank angle of 42°.

Recovery to an approximately wings level attitude was achieved about 18 seconds after the captain had begun applying left rudder trim. No altitude was lost during the upset, and the correct track was then regained using right bank. Still unaware of why the upset had occurred, the pilots “immediately initiated troubleshooting to determine the cause of the uncommanded roll." At first, they focused on an engine-related issue but during this review, the first officer continued to hold the control wheel at about 35° right wing down to maintain an approximate wings level attitude. The first officer confirmed that when the AP had been disconnected, they had returned both their hands and feet to the manual flight controls. While the captain was seeking the cause of the upset, the first officer “called for the rudder trim to be checked, as there were no alerts or other apparent sources causing the large roll input." The captain did so and thereby identified the inadvertently applied trim which, after approximately 90 seconds, was then returned to neutral.

The two switches involved in the mis-selection were different in shape, but it was evidently significant that the door unlock switch had to be held in position until the unlocked door was opened. Also, since entry requests were not necessarily followed by immediate entry, pilots were used to holding the switch in the unlocked (left turn) position until the door was opened. Although the rudder trim switch had a trim indicator adjacent to the switch, the consequent rudder trim input was not seen on this indicator (see the illustration below) because the captain had not considered the possibility that they had operated the wrong switch after unexpected left bank occurred. 

A closeup of the two switches and the rudder trim position indicator. [Reproduced from the Official Report]

It was observed during the Investigation that the primary flight displays (PFDs) in front of both pilots would have quite quickly taken on a radically different appearance as the maximum possible 42° bank angle was reached (see the illustration below). However, the slip/skid indicator was not showing solid amber because it had not reached its maximum displacement.

A PFD in balanced flight with the wings level (left) and as it would have looked at the maximum 42° left bank angle (right). [Reproduced from the Official Report]

It was noted that the EGPWS Mode 6 ‘BANK ANGLE’ Alert would have occurred once as the bank angle exceeded 30° and again when it exceeded 35° - and would have sounded again had the bank angle exceeded 45°.

Relevant content in the Operators ‘Operating Policies and Procedures’ (OPP) Manual was reviewed and it was found that specific procedures applied when “changes were made to a safety critical systems switch or control." A critical control or switch was defined as “one that controls or alters the configuration, operating mode or function of an aircraft system.” A safety critical system was defined as “one where mis-selection may lead to an undesired aircraft or system state, incident or accident." However, although these descriptions did not apply to the flight deck door lock switch, it was noted that the OPP also stated that (all) “controls and switches must not be changed or activated prior to positive visual identification." Whilst the OPP did include a flight deck access procedure, this did not contain any restriction or duration of use limit in respect of switch selection to the unlocked position.  

The investigation noted a previous Boeing 737 upset event in 2011 also attributable to mistaken operation of the rudder trim switch instead of the door unlock switch. This event had resulted in the issue of a number of alert publications by both Boeing and the U.S. Federal Aviation Administration (FAA). Then, when Boeing received information in 2021 on another such event which was not subject to a State Investigation, they had issued Flight Operations Technical Bulletin (FOTB) 737 21-03 which included a recommendation that “operators conduct awareness training for flight crews about the prevention of unintended operation of flight deck controls (with) an emphasis on visual identification of controls and switches prior to operation." The investigation noted that “Virgin did not provide any advice on how the FOTB was actioned by the flight operations department."

Three Contributing Factors to the unintended rudder trim activation were formally documented as follows:

• While actioning a request for entry into the flight deck, the pilot monitoring mis-selected the rudder trim switch instead of the intended flight deck door switch and inadvertently applied rudder trim for about 8 seconds.
• The autopilot responded to the trim input and its consequential yaw and roll with application of opposing roll. The maximum roll that the autopilot could apply and maintain (the roll authority limit) was reached after 5 seconds of left rudder trim input, after which the continuing rudder trim input resulted in a rapidly increasing rate of roll and an in-flight upset. 
• During the period of the development and recovery from the upset and despite the need to use a large right wing down aileron input to maintain an approximate wings level attitude, the flight crew were not able to promptly identify the significant left yaw as the primary initiator of the upset, which in turn delayed the restoration of balanced flight.  

The overall Safety Message from the Investigation was documented as follows:

When selecting and activating any control or switch, it is critical that flight crew ensure that the intended control or switch is positively identified and actually selected before activating it. Further, it is important that any mis-selection of switches be reported not only to the operator, but also to the manufacturer, as a continuing record of switch mis-selection across a fleet type may indicate a design error that needs correcting.

Safety Action

Virgin Australia Airlines reviewed and modified the flight deck door unlock procedure so that the crew member requesting entry is at the door and ready to enter, thereby limiting the time required for the door unlock switch to be held in the unlock position.

The Final Report was published on 29 November 2024. No Safety Recommendations were made.

Related Articles

• Loss of Control
• Trim Systems
• Recovery from Unusual Aircraft Attitudes
• Bank Angle Awareness
• Standard Operating Procedures (SOPs)