NTSB Factual Report

HISTORY OF FLIGHT

On January 12, 2003, about 2115 Hawaiian standard time, Hawaiian Airlines Flight 197, a Boeing 717-200, N482HA, rolled unexpectedly to the left during the climb to cruise after departure from Kahului Airport (OGG), Maui, Hawaii. Hawaiian Airlines, Inc., (HAL) was operating the airplane as a scheduled domestic passenger flight under the provisions of 14 CFR Part 121. The airline transport pilot licensed captain, first officer, 3 flight attendants, and 82 passengers were not injured. The airplane was not damaged. The flight departed Kahalui about 2100 as a nonstop to Honolulu (HNL), Hawaii. Night visual meteorological conditions (VMC) prevailed, and an instrument flight rules (IFR) flight plan had been filed.

HAL submitted a written report. The flight departed runway 02 in visual conditions; winds were light at 5-7 knots. Takeoff, departure, and handoff to Departure Control were normal. The captain was the pilot flying, and he engaged the autopilot at 3,000 feet mean sea level (msl). Passing 8,900 feet msl, he said that the airplane experienced an uncommanded rapid roll of 35 degrees to the left. He countered with approximately 50-60 degrees of right aileron input. The autopilot had been engaged, but disengaged automatically during pilot control input. The first officer (FO) asked the captain if he wanted some aileron trim. The captain responded that he desired only a small amount. His thinking was that he did not want to mask the problem. The captain did not feel any vibration, binding, or unusual "control feel" other than the effort required to hold wings level.

The captain indicated that his fuel load was balanced wing to wing. He did not feel any rudder deflection or imbalance. He insisted that throughout the emergency until final landing he did not observe a Master Caution Light or any alert lights on the Flight Management System (FMS). After directing the FO to call up the Configuration synoptic page on the systems display and get the Quick Reference Handbook opened to the appropriate sections, the captain remembered seeing the right aileron and right elevator deflected upward with "white" (not "green") coloration on the synoptic page. He remembered thinking that the aileron deflection would be consistent with his control input to lower the right wing against a left rolling tendency.

The captain directed the FO to squawk 7700 (emergency) and notify approach control of his emergency and intent to return for landing. The captain related that he made a gradual right turn, keeping the bank angle less than 10 degrees, as he held partial control deflection of 45 degrees or so. He had to make several left turns to line up on final for runway 20. He indicated that he was not comfortable with left turns because he had a feeling of "cross controls" to keep in balanced flight and did not want to aggravate the situation.

On final approach, slat/flap extension and lowering of the landing gear was uneventful to 25 degrees flaps. The captain initially briefed the FO that he would make a "flaps 25" landing. However, in view of a 5-knot tailwind component, he directed the FO to extend the flaps in small increments to 40 degrees. He also directed that if any adverse control input resulted, to immediately return the flaps to the next highest (previous) setting. He encountered no adverse reaction, and flew the airplane to a landing with approximately 45 degrees yoke deflection required to maintain a level wing attitude.

PERSONNEL INFORMATION

Captain

A review of Federal Aviation Administration (FAA) airman records revealed that the captain held an airline transport pilot certificate with a rating for airplane multiengine land. He held a commercial pilot certificate with ratings for single engine land, helicopter, and instrument helicopter. He held type ratings for the DC-9, with a limitation of circling approach in VMC only, and the DHC-7. He held a first-class medical certificate issued on January 21, 2003. It had the limitation that the pilot must wear corrective lenses. The operator reported that the pilot logged 52 hours in the last 90 days, and 13 hours in the last 30 days.

First Officer

The operator reported that the FO logged 85 hours in the last 90 days.

AIRCRAFT INFORMATION

The airplane was a Boeing 717-200, serial number 55127.

Aileron Trim System

The aileron trim system operates the aileron trim tab on the trailing edge of each aileron. The components of the system are the Aileron and Rudder Trim Control Module (ARTCM), the Aileron Trim Control Unit (ATCU), and the two aileron trim tab actuators. The trim control unit insures that the left and right actuators operate in synchronization.

The two control wheels provide mechanical input that move a control tab on each aileron. The ARTCM is on the aft pedestal. The aileron trim control switch is a 2-pronged switch. The top switch "enables" or activates the unit. The lower switch is for the direction that the pilot wants the aileron trim to move. The switches provide electrical input to the ATCU. The pilot releases the switch, and the trim remains at the last position.

For failure detection, the trim control unit has an interface with the Spoiler Electronic Control Unit (SECU). The SECU sends failure data to the Centralized Fault Display Interface Unit (CFDIU) and to the Versatile Integrated Avionics (VIA) units. Failure data also goes directly from the trim control to the VIA unit, and causes an alert on the systems display, status page.

The aileron trim indication is at the top left side of the CONFIGURATION page with input from the ATCU. The AIL (aileron) pointer indicates the position of the aileron trim tab actuators, and is always white. The pointer moves from center to LWD (left wing down) or RWD (right wing down). The same indication is on the secondary engine page. On the STATUS page, the level 1 alert AIL TRIM FAIL shows under the MAINT (maintenance) heading. There are no audio tones or alerts associated with the aileron when it is in an out of trim position prior to takeoff. There is no master caution associated with the aileron trim. The airplane can be dispatched with an aileron trim failure according to the HAL Minimum Equipment List (MEL).

TESTS AND RESEARCH

Initial Hawaiian Airlines Examination

Hawaiian Airlines maintenance personnel conducted an examination under the supervision of the FAA. They completed a thorough visual examination of the airplane and completed flight control checks of the ailerons, flaps, slats, spoilers, elevators, and all trim tabs. They detected no discrepancies. They checked the airplane for electronic fault indications. The read out noted a fault in the no. 1 Flight Control Computer (FCC). The fault indicated an inappropriate aileron servo command response; this was not a hard fault. HAL pointed out that the Fault Isolation Manual (FIM) indicated that this message showed when the Aileron Servo position did not agree with the FCC command. The National Transportation Safety Board investigator-in-charge (IIC) allowed HAL to download the digital flight data recorder (DFDR) to perform initial troubleshooting.

HAL's analysis of the DFDR data indicated that the aileron trim value was 90 percent of full aileron trim authority prior to pushback, engine start, taxi, and takeoff. Their analysis team reviewed data from the previous inbound flight, which had the same flight crew. It appeared that the trim changed from 10 to 90 percent authority about 3 minutes after the previous flight landed at 2003. The trim again shifted following the landing and taxi back of the event flight from 85 percent to 10 percent at 2126.

The captain said that he felt that the airplane was not tracking properly after takeoff. HAL's debrief of the flight crew indicated that they did not see or recognize the excessive aileron deflection on the cockpit screens before or after the event worsened and resulted in autopilot disengagement.

HAL indicated that the Rudder and Aileron check for zero is done during the Cockpit Preparation Checklist, which a crew accomplishes just prior to the Before Starting Engines Checklist.

The Flight Crew Operating Manual (FCOM) procedure for Aileron Controls Jammed or Restricted did not include a requirement to turn off the autopilot. The crew can do this by operating the disconnect switch on either control yoke, or deselecting the Automatic Flight Systems (AFS) OVRD OFF switches to OFF. This would completely disengage a compromised autopilot, and allow the pilot to hand fly the airplane.

Hawaiian reported that according to the FCOM, a level 1 amber alert (FCC 1 or 2 FAIL) should illuminate when an FCC has failed, or a level 1 amber alert (FCC 1 or 2 FAULT) should illuminate when the FCC has a fault. However, the captain indicated that he and the FO did not observe an alert at any time. HAL noted that the captain exerted immediate right aileron with sufficient force to disengage the autopilot. The captain could not remember using the disconnect switch on the yoke. However, he was certain that he saw the AP OFF message flashing in red on the Primary Flight Display (PFD), which confirmed that the autopilot had disconnected. HAL said that the disconnect switch on the captain's control wheel disconnected the autopilot, but not the autopilot servo clutches.

Boeing indicated that the "clear fault" button on the ATCU could reset intermittent faults. Hard faults could only be reset once the identified component had been fixed. Intermittent faults are retained when power is removed. There would have been an indication on the Configuration page showing the actual location of the aileron trim if not in the neutral position. There should have also been fault lights on the control box, which has a total of four lights. The box has a green light that indicates that it is on. This light is always illuminated if the unit is on. Below that is a red light that will illuminate if there is a fault. The last two lights will only illuminate when the test button has been engaged to show maintenance personnel what the problem is by a series of flashes that relate to specific codes. The fault light referred to on the control box (unit) was in fact illuminated when the FAA examined it following the incident, but the control unit is in the Electrical/Electronics (E & E) compartment in the belly of the airplane; therefore, it was not visible to the flight crew.

HAL mechanics examined the Trim Control Module, and found two Fault Isolation Messages (FIM). The codes for these messages were 33, 41, 42, and 43. Boeing noted that message 33 (Electrically Erasable Programmable Read Only Memory (EEPROM) failure and aileron control tab did not operate) is an industry known processor glitch that can occur on power up. Message 41 was the pedestal enable command without left or right command. Message 42 was the pedestal left command without left or right command, and message 43 was the pedestal right command without left or right command.

Boeing pointed out that if the aileron trim signal from the ARTCM is "valid" (C11 through VIA-2), the pointer and scale in white will be visible on the Secondary Engine Display and Configuration Page (upper right of diagram). If the signal is not "valid," the scale will be displayed in white, but the pointer will not be displayed. This only happens if there is a real fault. If the pointer is not visible, a Level 1 Alert AIL TRIM FAIL should illuminate after a 1-second delay. The crew would not receive notice of a failure unless the aileron trim failed. DFDR data indicated that, at a time about 2/3 of the way through the flight, the trim did respond when the copilot manipulated it. The trim pulled back to zero at the end of the flight. Boeing noted that if the crew had observed the aileron trim out at its limit, they could have simply trimmed the condition out.

Boeing Examination

Boeing noted that the DFDR data recorded both the aileron trim position and the aileron trim command signal. The data indicated that the trim responded normally with application of the trim command; first when the trim was reduced to about 75 percent in the middle of the flight, and again when the trim was reduced to about 10 percent at the end of the flight. They determined that the autopilot disconnect occurred when the autopilot was trying to roll out of a turn, and was commanding aileron in a direction opposite to the trim position. They noted that the autopilot disconnected due to an aileron command response monitor. The aileron torque limiter reduced the aileron authority. They felt that with the reduced authority, the aileron position could not keep up with the autopilot command. This resulted in the autopilot disconnect.

Boeing personnel tested numerous components of the aileron trim system under the supervision of a Safety Board investigator. The test plan included placing components into an airplane (ship number 5118) on the production line and supplying the components with electrical power.

On March 6, 2003, the investigation team bench tested the ARTCM. Boeing technicians and engineers performed a continuity check to verify correct functioning of the aileron trim switches. They made multiple combinations of different inputs, and noted no mechanical discrepancies.

On March 7, 2003, the investigation team met at Boeing's production hangar. Boeing technicians and engineers conducted a functional check of the trim system with exemplar units already installed on the airplane. They noted no mechanical abnormalities.

Boeing personnel then installed the ARTCM and ATCU from HAL onto the production airplane. They examined the ATCU to check for existing faults. They observed no hard faults on the ATCU. They observed no preexisting malfunctions or faults on the EFIS system in the Maintenance folder, or on the trim control unit.

The Boeing personnel conducted a functional check of the aileron trim system, and demonstrated basic operation of the trim controls and displays. They commanded full left wing down and full right wing down trim. They operated the switch back and forth several times, and observed trim tab movement and flight deck indications for proper operation. They pulled the trim control circuit breaker and noted that the white aileron pointer disappeared; a white light appeared on the System Control Panel Status Button. Upon pushing the button, the Display Unit (DU) number 4 displayed the STATUS page. The MAIN (maintenance) section displayed the level 1 AIL TRIM FAIL alert. They looked for any evidence of uncommanded operation. The aileron trim control switches and the aileron trim control actuator unit functioned per design specifications with no mechanical discrepancies. Full deflection of the trim from neutral to either the left or right position was 12 seconds. From either position back to neutral it was also 12 seconds.

Boeing personnel made several unsuccessful attempts to induce an intermittent runaway condition. They introduced intermittent aileron trim faults to the system by not manipulating both switches at the same time. They activated the direction switch; however, they did not activate the enable switch. The aileron trim control actuator unit showed faults 42 and 43 that related to the enable switch not being activated and the direction (left or right) that the trim was positioned to move to.

The aileron trim control switches and the aileron trim control actuator unit functioned per design specifications with no mechanical discrepancies noted. The IIC sent the units to their respective manufacturers for further testing.

Aileron Trim Control Unit (ATCU)

The ATCU was part number E1493-1MOD3 and serial number 1069. Goodrich engineers and technicians from the Fuel & Utility Systems unit in Vergennes, Vermont, performed a detailed examination and evaluation of the unit under the supervision of the FAA. They completed a series of tests, starting with a full Pre-ATP (Aileron Trim Power Up and Self Test). Then they made anomalous inputs that should have caused an ATCU fault indication as well as demonstrate the lack of resultant uncommanded motion due to the faul

NTSB Probable Cause

the flight crew's failure to follow the checklist and detect an out of trim condition prior to takeoff.