In-flight upset involving Boeing 737-8FE, VH-YQR, 143 km west of Ballina/Byron Gateway Airport, New South Wales, on 6 September 2023

The investigation

Decisions regarding the scope of an investigation are based on many factors, including the level of safety benefit likely to be obtained from an investigation and the associated resources required. For this occurrence, a limited-scope investigation was conducted in order to produce a short investigation report, and allow for greater industry awareness of findings that affect safety and potential learning opportunities.

The occurrence

At 1605 local time on 6 September 2023, a Virgin Australia Boeing 737-8FE (B737) aircraft registered VH‑YQR departed Brisbane, Queensland for Melbourne, Victoria. The flight crew consisted of the aircraft captain, who was performing the pilot monitoring duties (PM) from the left seat, and the first officer (FO), who was performing the pilot flying (PF) duties from the right seat.^[1]

Inadvertent application of rudder trim

Following an uneventful take-off, the aircraft was being controlled through the autopilot for the climb to the intended cruise altitude of flight level (FL) 380.[2] The PF did not have their hands and feet on the flight controls but was in a seating position that enabled full access to those controls.

As the aircraft approached FL 370, with the flight crew engaged in conversation, they received a call from the cabin crew requesting entry into the flight deck. Following completion of security procedures, the PM proceeded to enable entry into the flight deck using the flight deck door switch (FLT DK DOOR). The PM looked to the centre aisle stand, identified the FLT DK DOOR switch, and simultaneously reached across the stand to activate that switch.

However, just prior to grasping the switch, the PM transferred their gaze from the aisle stand to the rear of the flight deck and to the door. In doing so, they inadvertently grasped and, at 1625:22, activated the rudder trim control to the full left position instead of selecting the FLT DK DOOR switch.

On activation of the rudder trim control, both pilots felt the aircraft briefly roll and/or yaw and queried each other on what had occurred. The PM immediately looked forward and outside the aircraft, and then scanned the instruments, while continuing to maintain the input on the rudder trim control. The PF scanned the flight instruments and noted that the position trend vector[3] on the navigation display had begun to indicate a slight left turn. As neither pilot identified anything abnormal, the PM looked back to the cabin door, waiting for it to open, while maintaining the full‑left rudder trim control selection, and the PF continued to monitor the flight instruments.

Autopilot response

The autopilot responded to the increasing left rudder trim and resultant left yaw with an opposing and increasing right wing down aileron input. This was replicated on the control column’s control wheel as an increasing right wing down control wheel displacement. However, a slight left bank began to develop.

After 5 seconds of full left rudder trim input, the autopilot’s application of aileron input to counter the increasing rudder trim and yaw reached the limit of its authority – that is, the autopilot had applied the maximum aileron input available to it. This was also replicated on the control wheel, which by then was displaced to a 22° right wing down position. The aircraft, however, still had a left roll bank angle of about 5°. As the left rudder trim input continued, and in the absence of any further autopilot counter-input, the aircraft responded with an increasing left roll.

Inflight upset and recovery

Identifying the increasing left roll and turn, the PM again looked forward and queried whether the aircraft was supposed to be turning. The PF responded in the negative. At about the same time, about 8 seconds after first applying the unintended input, the PM released the rudder trim control. About 5° of left rudder displacement had been applied and the aircraft was now banked about 10° to the left.

Due to the significant rudder displacement, the aircraft’s left turn bank angle began to rapidly increase. As it passed about 25°, the PF attempted to counter the turn using the heading mode and heading changes on the mode control panel. This had no effect, and with the bank angle increasing past 35°, the PF announced and disconnected the autopilot and autothrottle, taking manual control of the aircraft. Almost simultaneously, the PF briefly applied about two-thirds deflection of the control wheel right wing down input to oppose the left roll.

Almost immediately after, the aircraft’s ground proximity warning system (GPWS) bank angle alert triggered, which the PM responded to by calling ‘upset’. The PF acknowledged the upset call and responded by verbalising and appropriately actioning the upset recovery procedure. A large application of opposite (right) right wing down roll stopped and then reversed the increasing left roll, but not before the aircraft had attained 42° left bank angle. The aircraft was recovered to an approximate wings level attitude of less than 10° bank angle about 18 seconds after the rudder trim input was first applied. Shortly thereafter, the aircraft was banked to the right with the intent to regain tracking.

The flight crew immediately initiated troubleshooting to determine the cause of the uncommanded roll, with the initial focus on an engine‑related issue. The aircraft had not lost any height during the upset, and the required tracking was quickly regained. However, during this period of troubleshooting, the PF needed to hold about 35° of right wing down control wheel displacement to maintain an approximate wings level attitude. The PF stated that, in recovering manual control after disconnecting the autopilot, both hands and feet were returned to the manual flight controls.

While the PM was checking for the cause of the upset, the PF called for the rudder trim to be checked, as there were no alerts or other apparent sources causing the large roll input. The PM checked the trim indicator and identified the inadvertently applied trim. At 1626:34, right rudder trim was then applied to neutralise the rudder position.

Events in the cabin

At the time of the occurrence, the cabin crew had commenced a food service, with service carts moving through the cabin. Due to the movement of the aircraft during the upset, a cabin crew member at the rear of the aircraft sustained a minor injury while stabilising a cart.

Context

Personnel information

The captain held an air transport pilot licence (aeroplane), while the FO held a commercial pilot licence (aeroplane). Both pilot licences included appropriate aircraft ratings, operational ratings and endorsements for operating the B737 aircraft type. Both pilots held a current Class 1 aviation medical certificate. The ATSB found no indicators that increased the risk of the flight crew experiencing a level of fatigue known to affect performance.

The captain had about 19,500 hours of flight experience, of which 13,500 hours were on the B737 type. The FO had about 2,700 hours of flight experience, of which about 350 hours were on the B737. The captain had flown 165 hours, and the FO 178 hours, on the B737 type in the previous 90 days.

Aircraft information

Flight controls

The B737 flight control system uses a conventional control wheel, column and rudder pedals (Figure 1) at each pilot’s station, linked mechanically to hydraulically‑powered control units at each flight control surface. These control units move those flight control surfaces in response to inputs from either pilot or the autopilot. The 2 sets of pilot flight controls are manually linked, such that an input on one control is replicated at the other station.

Figure 1: B737-800 flight deck layout

An image of the flight deck of a generic B737-800 type aircraft.

Source: Copyright © Boeing. Reproduced with permission, annotated by the ATSB

Control of the aircraft along its 3 axes (Figure 2) is achieved through:

• ailerons supplemented by flight spoilers for roll control on the longitudinal axis
• rudder for yaw on the vertical axis
• elevators for pitch on the lateral axis.

Figure 2: B737 flight control surfaces

A 3-dimensional depiction of the B737 aircraft identifying the 3 axes of motion and the relevant control surfaces for those axes.

Source: JTSB investigation AI2014-4, modified by the ATSB

The ailerons/flight spoilers are controlled by the pilots' control wheel. The 4 flight spoilers on the upper surface of each wing supplement roll control when the control wheel is displaced by more than about 10°. The flight spoilers on the up-aileron wing rise with the aileron, while those on the down-aileron wing remain faired. The rudder is controlled through the pilots’ rudder pedals. Rudder displacement is restricted at airspeeds greater than about 135 kt by reducing the amount of hydraulic pressure available to control the rudder.

Rudder trim

The rudder trim control (Figure 3), located on the aft electronic panel (Figure 1), adjusted the rudder’s neutral position by electrically positioning the rudder. The rudder pedals are also displaced proportionately to any rudder trim adjustment. The rudder trim indicator displayed the rudder trim position in non‑dimensional units.

Figure 3: Rudder trim and door lock switch

An image of the normal aisle stand configuration for the operator’s B737 aircraft, with the rudder trim control and position indicator, and the flight deck door switch identified.

Source: Virgin, annotated by the ATSB

The rudder trim control was spring‑loaded to return to the neutral (centre) position and activation was through rotating the control in the direction of required trimming. The trim control was a circular rotary switch with segmented straight knurling.

Autopilot flight control

The aircraft was fitted with 2 autopilots (or flight control computers) that could be engaged using controls on the mode control panel (MCP) (Figure 1). Only one autopilot was able to be engaged at a time (except when the approach mode was selected on the MCP). The engaged autopilot controlled the aircraft’s flight path through commands to pitch and roll control units, which then moved the relevant flight control surfaces.

Boeing advised that the autopilot had limited flight control input in certain modes. In particular, during single autopilot operations, there was limited roll input authority, and therefore there was a limit to the maximum aileron input that could be applied. During the occurrence, the recorded data showed the autopilot input for the roll control surfaces reached the allowable limit, while rudder trim input and the resultant roll continued to increase. Upon disconnecting the autopilot, the aileron displacement rapidly increased with the pilot’s input.

The operator’s B737 flight crew operations manual (FCOM) did not document the limitation to the autopilot’s control surface inputs in single autopilot operation. The FCOM did, however, indirectly indicate an autopilot control input limitation in the section on the Roll/Yaw Asymmetry Alert.

Flight deck door lock

The flight deck door switch was a spring‑loaded, elongated, hexagonally (blade) shaped, rotary switch with 3 positions:

• UNLKD, which unlocked the door while the selector was maintained in this position
• AUTO, which locked the door automatically when closed
• DENY, which overrode the alternate method of opening the door.

The switch was spring‑loaded to the AUTO position and had to be pushed in before rotating from AUTO to UNLKD.

Primary flight display with bank angle and slip/skid indicators

The outboard display unit for both pilots (Figure 1) is normally used as the primary flight display (PFD). It provides the information and parameters necessary to monitor and control the aircraft’s flight path. Central to the display is the attitude indicator, which provides an indication of the aircraft’s pitch and roll attitude referenced to the horizon (Figure 4). The following features of the attitude indicator are relevant to this occurrence:

• the pitch scale is in 2.5° increments
• a bank angle pointer indicates bank angle, and always points to the vertical (a white-outlined triangle in the left panel of Figure 4 and a solid amber triangle in the right panel)
• the bank angle pointer turns solid amber when the bank angle is 35° or more
• a roll scale is marked to indicate bank angle increments of 10°, 20°, 30°, 45° and 60°.

Figure 4: PFD with bank angle pointer and slip/skid indicator highlighted

A split image showing the primary flight display bank angle pointer and the slip/skid indicator in a wings level and balanced flight state on the left, and on the right, a reproduction of the display at the time of the maximum bank angle during the occurrence.

Source: Copyright © Boeing. Reproduced with permission, annotated by the ATSB

Immediately below, and adjacent to, the bank angle pointer is the slip/skid indicator (Figure 4). It is normally represented by a white-outlined rectangle. The slip/skid indicator will displace to the left or right of the bank angle pointer to indicate lateral acceleration (g), with maximum displacement of the indicator occurring at 0.21 g or greater of lateral acceleration.

The outline of the slip/skid indicator will turn amber when the aircraft is banked to 35° or more (see right panel of Figure 4). The indicator turns solid white when at full scale deflection and the bank angle is less than 35°, and solid amber when at full scale deflection and bank angle is 35° or more.

Boeing provided a simulated recreation of the occurrence event’s PFD indications at the maximum bank angle of 42° (right panel of Figure 4). The recreation showed that the bank angle indicator and outline of the slip/skid indicator had turned amber, but the slip/skid indicator was not at its maximum displacement and therefore not solid amber.

GPWS bank angle alert

The aircraft’s ground proximity warning system (GPWS) provided an aural BANK ANGLE, BANK ANGLE alert when roll angle exceeded 35°, 40°, and 45°. Once sounded, the alert was silent for that respective bank angle (35°, 40°, or 45°) until the system was reset by the bank angle decreasing to 30° or less.

Roll/yaw asymmetry alert

Seven of the operator’s B737 aircraft were fitted with a roll/yaw asymmetry (R/YA) alert, although the occurrence aircraft was not. The R/YA alert notified flight crew of an asymmetry issue that had led to yaw-induced roll, through the provision of alerts that identified the level of autopilot roll authority that had been used to counteract the yaw. These alerts were:

• the ROLL/YAW ASYMMETRY alert displayed at 75% of the autopilot’s roll authority limit
• the ROLL AUTHORITY alert displayed when the autopilot’s roll authority limit reached 100%, which was also accompanied by an aural ROLL AUTHORITY alert.

The asymmetry alerts also caused the bank pointer and slip/skid indicator to become outlined in amber. The slip/skid indicator would also become solid amber when it was displaced by more than 25% of its width (Figure 5).

Figure 5: Roll/yaw asymmetry alert

A split image showing an updated primary flight display where conditions exist that trigger the ROLL/YAW ASYMMETRY alert, on the left, and the ROLL AUTHORITY ALERT, on the right.

Source: Copyright © Boeing. Reproduced with permission, annotated by the ATSB

Operating procedures

Use of rudder trim

The captain’s preflight procedure included checking all trim controls for trim’s freedom of movement, and then ensuring that the aileron and rudder trims were set to zero units. The flight crew training manual contained a section on recommended rudder trim technique. This provided guidance and procedures to ensure that the rudder trim was set for minimum drag and zero roll/heading change. Trimming the rudder for minimum drag was a normal and regularly practiced procedure, mostly used early in the cruise phase of flight.

Operation of switches on the flight deck

The operator’s operating policies and procedures (OPP) manual required specific procedures be applied when changes were made to a safety critical system’s switch or control. A critical control or switch was defined as one that controls or alters the configuration, operating mode or function of an aircraft system. A safety critical system was one where mis-selection may lead to an undesired aircraft or system state, incident or accident. The flight deck door lock switch did not fall into these categories and were therefore not subject to the relevant procedures in the OPP. However, the OPP also stated that controls and switches must not be changed or activated prior to positive visual identification.

Flight deck door lock

The OPP manual included a procedure for entering the flight deck, which included a method of communicating and then coordinating entry through the locked flight deck door. The procedure required the use of the flight deck door switch and did not contain any restriction or limitation on the use of that switch.

Bank angle

The OPP manual specified policies for passenger comfort and wellbeing, which limited bank angle to a maximum of 30°.

Inflight upset

The OPP manual defined an ‘upset’ as:

an undesired aircraft state characterised by unintentional divergences from parameters normally experienced during operations.

There was no specific procedure for upset recovery. Instead, the flight crew operating manual (FCOM) quick reference handbook (QRH) provided:

…actions that represent a logical progression for recovering the airplane. The sequence of actions is for guidance only and represents a series of options to be considered and used dependent on the situation.

The upset recovery sequence of actions was included within the non-normal manoeuvres section of the QRH, and contained a preliminary statement that ‘flight crews are expected to do non‑normal maneuvers from memory’. Similar guidance material was also contained in the flight crew training manual (FCTM).

Information on sideslip

The operator published a flight crew information manual, the purpose of which was to provide a consolidated source of training, reference or flight technical information for flight crew. That manual contained the following guidance on pilot-commanded sideslip:

The rudders on modern jet transport aircraft are sized to counter the yawing moment associated with an engine failure at very low take-off speeds and to ensure yaw control throughout the flight envelope, using up to maximum pedal input. This very powerful rudder is also capable of generating large sideslips. An inappropriate rudder input can produce a large sideslip angle, which will generate a large rolling moment that requires significant lateral control input to stop the aircraft from rolling. The rudder should not normally be used to induce roll through sideslip because the transient sideslip can induce very rapid roll rates with significant time delay...

Recorded data

Recorded data from the aircraft’s quick access recorder (QAR), which contained data from the aircraft’s flight data recorder, enabled a detailed examination and recreation of the occurrence event. The ATSB also sought Boeing advice on the aerodynamics of the occurrence event, which stated the following:

Analysis of the QAR data indicates that a roll to the left from wings-level to a peak of -42 °s (left wing down) with the autopilot B channel engaged was the result of a left rudder trim input that persisted for approximately 8 seconds. The rudder trim input remained for approximately 90 seconds during which time an average control wheel deflection of approximately 35 °s (right) was maintained along with a sustained, non-zero lateral acceleration (uncoordinated flight) of around -0.06 g’s (left). As the autopilot reached its maximum control wheel authority to the right with the airplane continuing to increase bank to the left, the flight crew intervened and commanded the control wheel further to the right, causing the autopilot to disconnect and resulting in bank angle returning back towards wings-level. Margin to stall warning activation was generally reduced as a result of elevated normal load factor from the non-zero bank angle and sustained right-wing-down control wheel deflection sufficient to raise the flight spoilers, leading to reduced lift on the wing and elevated angle of attack while the non-zero rudder trim input was maintained. When the rudder trim was returned to near zero °s (neutral), the airplane returned to normal flight; the rudder deflection and control wheel deflection subsequently reduced leading to reduced angle of attack and increased margin to stall warning activation. The airplane systems functioned as expected with no observed anomalies.

Table 1 contains data extracted from the recorded data for specific parameters covering the period from the commencement of the trim application until the aircraft was recovered and stabilised at an approximate wings level attitude.

Table 1: Selected DFDR data for the occurrence event

Boeing advice on the effect of rudder

In May 2002, Boeing published a flight operations technical bulletin[4] (FOTB) on the use of rudder in transport category aircraft. The FOTB provided both generic information applicable to all of its swept wing jet transport aircraft, and specific information relevant to the B737:

Maneuvering an airplane using the rudder will result in a yaw and roll response. The roll response is the result of sideslip. For example, if the pilot applies left rudder the nose will yaw left ... This yawing response to the left will generate a sideslip (right wing forward). The resulting sideslip will cause the airplane to roll to the left (i.e., roll due to sideslip). The actual force on the vertical tail due to the rudder deflection tends to roll the airplane right, but as the sideslip moves the right wing forward, the net airplane roll rate is to the left.

It is difficult to perceive sideslip and few modern transport airplanes have true sideslip indicators. In older transport instrument panels the “ball” was an indicator of side force or acceleration, not sideslip angle. Some newer models have electronic flight displays with a slip/skid indication, which is still an indication of side force or acceleration; not sideslip. As the pilot applies more rudder, more sideslip is generated and a greater roll response will result...

...Because sideslip must build up to generate the roll, there is a time lag between the pilot making a rudder input and the pilot perceiving a roll rate. This lag has caused some pilots to be surprised by the abrupt roll onset and in some cases to interpret the rapid onset of roll as being caused by an outside element not related to their rudder pedal input...

On [the Boeing 737], as the airplane speeds up, the rudder authority is limited, but the gearing between the rudder and the rudder pedal does not change. Since rudder authority is limited, rudder pedal travel is also limited; i.e., full rudder pedal deflection is not required to get full available rudder deflection. Rudder pedal force is a function of rudder pedal deflection, so less force will be required to achieve maximum available rudder deflection as airspeed increases.

Included within the FOTB was a table detailing rudder deflection and force required at various airspeeds (Table 2).[5]

Table 2: Rudder movement parameters for Boeing aircraft

	V1 (135 kts)			250 kts			MMO at FL 390
	Pedal force (lbs)	Pedal travel (in)	Rudder deflection (degrees)	Pedal force (lbs)	Pedal Travel (in)	Rudder deflection (degrees)	Pedal force (lbs)	Pedal travel (in)	Rudder deflection (degrees)
B737	70	2.8	18	50	1.0	4	50	1.0	4
B747	80	4.0	30	80	4.0	12	80	4.0	8
B767	80	3.6	26	80	3.6	8	80	3.6	7

The PF stated that, immediately on disconnecting the autopilot, they placed their feet on the rudder pedals. However, the displacement of those pedals due to the inadvertent trim input was not detected. This was most likely the result of that displacement being less than about 2 inches (5 cm) despite that displacement corresponding to a significant rudder position change from the neutral. This relatively small pedal displacement in proportion to rudder position is a unique feature of the B737. This factor as well as the PF’s limited experience on the aircraft type likely influenced the rudder pedal displacement associated with the inadvertent rudder trim not being detected.

History of inadvertent rudder trim application events on B737 aircraft

JTSB investigation AI2014-4

On 6 September 2011, a B737-700 operating into Tokyo, Japan experienced an inflight upset during which it deviated significantly from track, reached a bank angle of 131°, lost about 6,000 ft in altitude, and exceeded the aircraft’s load factor limitation during the recovery. The subsequent Japanese Transport Safety Board (JTSB) investigation found that, as the aircraft approached Tokyo at FL 410, the captain briefly left the flight deck and, on notifying the first officer (FO) to allow re‑entry, the FO inadvertently operated the rudder trim switch instead of the flight deck door switch, resulting in left rudder trim being applied.

The trim input exceeded the autopilot’s capacity to control the aircraft’s attitude, resulting in an unusual attitude developing. The FO’s recognition of the unusual attitude was delayed, and the subsequent recovery was insufficient, resulting in the aircraft’s entering a nosedive before being recovered to normal flight about 60 seconds after trim application commenced.

The inadvertent selection of the trim control was partially attributed to the FO having previously flown B737 aircraft with a different trim control/door switch arrangement. In particular, the investigation identified that the rudder trim switch on the occurrence aircraft was in approximately the same location as the flight deck door switch on the B737-500, the type from which the FO had recently transitioned. There were many recommendations arising from this investigation, including the following (JA16AN) to the Federal Aviation Administration (FAA) of the United States:

The aircraft designer and manufacturer shall study the need to reduce or eliminate the similarities between the rudder trim control and the switch for the door lock control of the Boeing 737 series aircraft, in terms of the shape, size and operability as mentioned in this report. In particular, it shall consider the effectiveness of changing the shape and size of the rudder trim control to the design adopted for the rudder trim control for Boeing models other than those of the Boeing 737 series, in which the switch has a cylindrical shape about 50mm in diameter without a brim, so that the difference of the size and shape can be recognized only with a touch.

Boeing human factors analysis of the Tokyo occurrence

Following the Tokyo occurrence, Boeing human factors subject matter experts (SME) conducted a comprehensive analysis of the 2 error types that led to that event. The first error type concerned variation in aisle stand layout across the operator’s fleet and related to the pilot’s transfer from an older B737 model with a different aisle stand layout. This variability in layout was found to have contributed to the inadvertent selection of the rudder trim instead of the door lock switch. To mitigate against that, the SMEs recommended consistency in aisle stand configurations across the various B737 fleet types.

The second error type was substitution, where once having operated the incorrect switch, the pilot continued to believe that the rudder trim knob was the door control knob. To address this error, the SMEs fitted different knob shapes to a simulator to determine if they would more clearly differentiate between the 2 switches. The study found that none of the alternative knob styles prevented confusion in all circumstances, and changing styles could introduce a further inconsistency risk through the period of adoption over the full fleet. The SMEs also considered alternative actions for those controls to further distinguish between them but noted that the 2 switches already had a distinct difference in activation methods.

Boeing’s analysis determined that switch location was more important than shape, and that the most important factor to minimise inadvertent activation was consistency in aisle stand configuration across an operator’s fleet type. While both switches had a similar feel and operation, a standard location and sufficient separation between these controls was recommended. The recommended switch locations were those consistent with the generic Boeing-delivered aircraft (Figure 1). Having the controls placed in these recommended locations:

• created a distinctive reach posture for both pilots
• provided sufficient separation in relation to reach direction from both seats
• provided adjacent tactile landmarks[6] to assist in distinguishing between the switches.

Boeing response to Tokyo occurrence

On 16 July 2012, in response to the Tokyo occurrence, Boeing transmitted a multi operator message (MOM-MOM-12-0489-01B) titled Information – Inadvertent Activation of Rudder Trim. The message was addressed to a broad scope of addressees, including all 737 customers, and had an Engineering and Flight Operations categorisation. It summarised the JTSB incident and alerted operators to the potential for confusion between the rudder trim control and the flight deck door switch on certain models of B737 aircraft. This was based on variability in switch locations on the aisle stand across the B737 fleet, and the similarity in the operation of the 2 controls. It recommended several actions to mitigate the potential for inadvertent rudder trim activation, including:

• ensuring flight crew awareness of this specific potential for error and the need for visual identification prior to operating a control
• ensuring that no aircraft in their fleet had the rudder trim control in the same location as the flight deck door switch on another aircraft of the same type.

Boeing 737-SL-27-238

Also in response to the Tokyo occurrence, Boeing released service letter 737-SL-27-238, titled Inadvertent Activation of Rudder Trim, dated 19 September 2012.[7] The purpose of the service letter was to notify operators of the potential for confusion of the rudder trim knob and the secure flight deck door knob located on the aisle stand. It contained a description of the Tokyo occurrence, Boeing’s actions in response to this occurrence, and recommendations to operators to prevent any future occurrences. The recommendations reflected those stated in the July 2012 multi operator message.

FAA SAIB NM-15-03

In November 2012, the FAA issued a Special Airworthiness Information Bulletin (SAIB) to advise all owners of Boeing transport category aircraft of an airworthiness concern regarding inadvertent actuation of flight deck controls. The SAIB summarised the Tokyo occurrence and identified the varying locations of the rudder trim control and flight deck door switch across various B737 models. It stated the potential for confusion when pilots transferred between similar model aircraft, but with variation in the switches’ location, and discussed the differences in the switch shapes and similarities in their operation. It referenced Boeing’s MOM and service letter published in response to the event.

The SAIB identified that the potential for error may not be applicable to many operators due to differences in their flight deck procedures to that of the Tokyo occurrence operator. One of those differences was where operators did not use the flight deck door switch to enable fight deck entry, but instead used alternate methods of entry.

The bulletin also provided a summary of Boeing’s human factors analysis on the switch mis‑selection and possible methods to mitigate it.

The SAIB concluded with recommended procedural changes for operators. Where operators did not adopt those procedural changes, the SAIB recommended they should undertake certain configuration changes in the aisle stand location of those controls and where operators did modify their procedures as recommended, they should still undertake the recommended configuration changes.

FAA response to JTSB recommendation

The FAA formally responded to JTSB recommendation JA16AN in May 2015. That response stated that the FAA determined that the risk associated with the Tokyo occurrence warranted the issue of an SAIB and a Continued Airworthiness Notification to the International Community (CANIC). Prior to their issue, the FAA had requested the JTSB review those documents. As publication of the SAIB and CANIC had been finalised, the FAA considered the JTSB recommendation JA16AN had been effectively addressed.

An update of 737-SL-27-238

With the introduction of the B737MAX, Boeing became aware that the issue addressed by 737‑SL-27-238 could also apply to the new model. In May 2017, Boeing issued service letter 737‑SL-27-238-A, a re-issue of the original service letter but modified to include the B737MAX aircraft. The substance of the original service letter remained unchanged. 

FOTB 737 21-03 Erroneous Use of Rudder Trim Control

In 2021, Boeing received a report concerning a B737-800 pilot who had mis-selected the rudder trim control and applied left rudder trim while attempting to use the flight deck door switch. The autopilot countered the resultant roll, but the authority limit was reached, after which the aircraft continued to roll. The aircraft was recovered, but not before a BANK ANGLE alert was triggered and the aircraft rolled to nearly 50° bank angle. The occurrence was not subject to an official state‑based investigation, however, the similarities with the Tokyo occurrence prompted Boeing to issue an FOTB on erroneous use of rudder trim.

The FOTB identified the similarities between the new 2021 event and the event reported in the July 2012 MOM and the May 2017 service letter. The FOTB identified that risk of these types of events was elevated when there was variability in the switch locations on the aisle stand across the airline fleet, and due to the similarity in the control operation. As a result, Boeing recommended that operators standardise aisle stand configuration across its B737 fleet, and conduct awareness training for flight crews about the prevention of unintended operation of flight deck controls. This included an emphasis on visual identification of controls and switches prior to operation.

Virgin response to Boeing alerts concerning inadvertent rudder trim activation

Virgin advised that the MOM and service letters had been reviewed by its engineering department, and that while there were some B737 aircraft fitted with a variation in aisle stand layout to the generic configuration, the various aircraft ages and types did not enable exact same aisle stand configurations. Further, the advice in those documents specifically focused on configurations where the rudder trim on one type was in the same location as the door lock on another, and this was not the case for the Virgin fleet. As such, Virgin complied with the advice stated in the MOM and service letters. Virgin did not provide any advice on how the MOM, service letters or FOTB was actioned by the flight operations department.

Safety analysis

In response to a request for entry into the flight deck, the pilot monitoring (PM) intended to activate the flight deck door lock switch. The operator’s policy and procedures manual required flight crew to positively identify any control or switch before manipulating them. The PM visually identified the flight deck door switch, but in reaching for it, did not visually confirm selection or manipulation of the correct switch, instead mis-selecting and activating the rudder trim switch.

A human-factors analysis of the mis-selection of the rudder trim control found that the error was consistent with an unintentional slip. The action occurred during a period of possible distraction when the PM was talking to the pilot flying (PF) and monitoring the aircraft as it approached cruise altitude. The PM’s action of looking away from the panel when selecting the switch was also an example of attention diversion. The distraction and attention diversion were both likely factors that could lead to an unintentional slip. Furthermore, the act of twisting the door switch was a substitution error, predicated by a prior intention to act, and was therefore a routine action which did not go as planned.

As it was routine to operate the door switch, the PM probably did not give sufficient attention to this task. This was further compounded by the physical similarities in the switches and their operation, and their co-location on the aisle stand panel. However, a Boeing human factors examination of possible mitigations to these factors in response to a similar previous occurrence found that changing the switch design was unlikely to mitigate the mis-selection risk, and that the current generic aisle stand configuration and an emphasis on confirmation of switch selection prior to manipulation was the most effective control measure. Finally, Boeing identified the risk of unintentional rudder trim application in an FOTB issued to operators 2 years prior to the occurrence. The FOTB specifically acted as an alert to flight crew of the risk of mis-selection of rudder trim in circumstances identical to those in this incident.

On the initial application of the rudder trim, both pilots felt the aircraft’s immediate yaw/roll response, but were unable to identify the likely cause. Over the following 5 seconds, while the captain maintained activation of the switch and waited for the door to open, the rudder trim progressively increased to the left, causing the rudder to correspondingly move to the left. The autopilot was initially able to compensate for the increasing left yaw input and induced left roll through application of increasing right wing down roll input. This right wing down input was replicated on the pilots’ control wheel.

After 5 seconds of trim input and increasing induced left roll, the autopilot reached its authority limit – that is, the autopilot had reached the maximum roll control input it could apply and maintain. Up to this point, the autopilot had managed to limit the induced roll to a bank angle of less than 5° to the left. However, on reaching the roll authority limit, the increasing rudder trim resulted in the aircraft’s bank angle to the left increasing. As the trim input continued for a further 3 seconds, the aircraft responded with a rapidly increasing rate of roll to the left.

The unexpected and increasing bank angle alerted both pilots to the developing aircraft upset. The PF initially responded by attempting to control the increasing left roll through the use of the mode control panel heading selections and the autopilot. As this had no apparent effect, and with the bank angle continuing to increase, the PF applied a large right wing down control input while almost simultaneously disengaged the autopilot and autothrottle. At about the same time the bank angle alert triggered. The PM responded with an ‘upset’ call, and the PF responded by executing the upset recovery procedure. The aircraft was quickly recovered to about straight and level flight.

Having recovered the aircraft to an approximate wings level attitude, the PF was required to hold about 35° of right wing down control wheel displacement to maintain that attitude. While this large roll input required to maintain a wings level attitude strongly indicated a yaw‑related issue, the crew continued to investigate the cause of the inflight upset unsuccessfully for a further minute. About 70 seconds after the initial misapplication of rudder trim, the PF requested the PM check the rudder trim. Shortly after, the rudder trim was returned to a neutral position. While large right wing down aileron input required to maintain a wings level attitude provided a strong indicator that the upset was linked to a yaw related issue, a combination of the very small displacement of the rudder pedals at the point of maximum trim application, and the PF’s limited experience on the aircraft, probably contributed to some of the delay in identifying the unintended rudder trim. 

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the inadvertent rudder trim activation resulting in an in-flight upset involving Boeing 737-8FE, VH-YQR, 143 km west of Ballina/Byron Gateway Airport, New South Wales on 6 September 2023.

Contributing factors

• While actioning a request for entry into the flight deck, the pilot monitoring mis-selected the rudder trim switch instead of the intended flight deck door switch and inadvertently applied rudder trim for about 8 seconds.
• The autopilot responded to the trim input and its consequential yaw and roll with application of opposing roll. The maximum roll that the autopilot could apply and maintain (the roll authority limit) was reached after 5 seconds of left rudder trim input, after which the continuing rudder trim input resulted in a rapidly increasing rate of roll and an inflight upset.
• During the period of the development and recovery from the upset, and despite the need to use a large right wing down aileron input to maintain an approximate wings level attitude, the flight crew were not able to promptly identify the significant left yaw as the primary initiator of the upset, which in turn delayed the restoration of balanced flight.

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Virgin Australia Airlines advised that, following this occurrence, the flight deck door unlock procedure was reviewed and modified. The new procedure is designed to indicate that the crewmember requesting entry is at the door and ready to enter, thereby limiting the time required for the door unlock switch to be held in the unlock position. Other safety action included a briefing on the event for flight crews, and changes to the non-technical skills program.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the flight crew
• Virgin Australia Airlines
• Boeing
• recorded data from the aircraft.

References

Heckhausen, H and Beckmann, J (1990). Intentional Action and Action Slips. Psychological Review, 97(1), 36–48.

Reason, J (1990). Human Error. Cambridge University Press, New York.

Salvendy, G and Karwowski, W (2021). Handbook of Human Factors and Ergonomics. John Wiley & Sons Incorporated, New Jersey.

Wickens, CD, Helton, WS, Hollands, JG and Banbury, S (2022) Engineering psychology and human performance. Routledge, New York.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the flight crew
• United States National Transportation Safety Board
• Boeing
• Civil Aviation Safety Authority 
• Virgin Australia Airlines.

Submissions were received from:

• the flight crew
• Boeing
• Civil Aviation Safety Authority
• Virgin Australia Airlines.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.