...In The Wake Of AAL 587

On November 12, 2001, about 0916:15 eastern standard time, American Airlines flight 587, an Airbus Industrie A300-605R,1 N14053, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Flight 587 was a regularly scheduled passenger flight to Las Americas International Airport, Santo Domingo, Dominican Republic, with 2 flight crewmembers, 7 flight attendants, and 251 passengers aboard the airplane. The airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site. The airplane’s engines subsequently separated in flight and were found several blocks north and east of the main wreckage site. All 260 people aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces and a postcrash fire. Flight 587 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident.

The National Transportation Safety Board determined that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program (AAMP).

Prevention of High Loads Resulting From Pilot Rudder Pedal Inputs

Rudder Pedal Inputs at High Airspeeds

Rudder control systems with a variable ratio rudder travel limiter may provide better protection against high loads from sustained rudder pedal inputs at high airspeeds than systems with a variable stop rudder travel limiter because variable ratio rudder travel limiter systems require more physical effort from a pilot (in terms of force and displacement) to produce cyclic full rudder inputs. For airplanes with variable stop rudder travel limiter systems, protection from dangerous structural loads resulting from sustained alternating large rudder pedal inputs can be achieved by reducing the sensitivity of the rudder control system (for example, by increasing the pedal forces), which would make it harder for pilots to quickly perform alternating full rudder inputs.

There is no certification standard regarding rudder pedal sensitivity or any requirement for the sensitivity to remain constant at all airspeeds. The Safety Board concludes that certification standards are needed to ensure that future airplane designs minimize the potential for aircraft-pilot coupling (APC) susceptibility and to better protect against high loads in the event of large rudder inputs. Accordingly, the Safety Board believes that the Federal Aviation Administration (FAA) should modify CFR Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. The Safety Board further believes that, after the yaw axis certification standard has been established, the FAA should review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential APC after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds.

The Safety Board notes that the A300-600 yaw damper system allows a pilot input to override a yaw damper command when the rudder is at the full deflection limit permitted by the rudder travel limiter system for a particular airspeed. Under these conditions, a pilot input can override a yaw damper command in the opposite direction and keep the rudder at the full deflection limit by providing increasing pressure on the rudder pedals. Simulation and flight data recorder data indicated that the first officer’s rudder pedal inputs during the flight 587 accident sequence were consistent with a suppression of yaw damper inputs at the rudder deflection limits. The simulations indicated that, if the yaw damper inputs had not been suppressed, the yaw damper would have moved the rudder partially back toward neutral, thereby lessening (but not preventing) the buildup of the sideslip angle and aerodynamic loads on the vertical stabilizer.

Such a delay could have provided an additional level of safety because the initial response of the airplane to a sustained rudder pedal input would not have been as severe and could have reduced the chance of pilot surprise or confusion.

The Safety Board concludes that, because of its high sensitivity (that is, light pedal forces and small pedal displacements), the Airbus A300-600 rudder control system is susceptible to potentially hazardous rudder pedal inputs at higher airspeeds. Therefore, the Safety Board believes that the FAA should review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds.

Alternating Full Control Inputs

Alternating full inputs on the control wheel and rudder pedals, such as those made by the first officer, should not be necessary to control a transport-category airplane under any circumstance. Industry literature (that is, the NRC report and Advisory Circular [AC] 25-7A) indicates that an effective way to stop an APC event is to cease the inputs. Recognition of an APC event by either the pilot making the inputs or the nonflying pilot before structural damage is crucial. However, according to the NRC report, pilots are not trained to recognize the initial indications or to understand that APC does not necessarily imply poor airmanship.

The Safety Board concludes that, to minimize the potential for APC events, transport category pilots would benefit from training about the role that alternating full control inputs can play in such events and training that emphasizes that alternating full rudder inputs are not necessary to control a transport-category airplane. Therefore, the Safety Board believes that the FAA should develop and disseminate guidance to transport-category pilots that emphasizes that multiple full deflection, alternating flight control inputs should not be necessary to control a transport-category airplane and that such inputs might be indicative of an adverse APC event and thus should be avoided.

Pilot Guidance on Design Maneuvering Speed

During this accident investigation, the Safety Board learned that many pilots might have an incorrect understanding of the meaning of the design maneuvering speed (VA) and the extent of structural protection that exists when the airplane is operated below this speed.

From an engineering and design perspective, maneuvering speed is the maximum speed at which, from an initial 1 G flight condition, 16 the airplane will be capable of sustaining an abrupt, full control input limited only by the stops or by maximum pilot effort. In designing airplanes to withstand these flight conditions, engineers consider each axis (pitch, roll, and yaw) individually and assume that, after a single full control input is made, the airplane is returned to stabilized flight conditions. Full inputs in more than one axis at the same time and multiple inputs in one axis are not considered in designing for these flight conditions.

The American Airlines managing director of flight operations technical told the Safety Board, during a post accident interview, that most American Airlines pilots believed that the airplane would be protected from structural damage if alternating full rudder pedal inputs were made at an airspeed below maneuvering speed. The American Airlines A300 fleet standards manager confirmed this belief during public hearing testimony at the Board’s public hearing for this accident. The Board notes that the American Airlines A300 Operating Manual contained only one reference to design maneuvering speed, which indicated that it was the turbulence penetration speed (270 knots). However, as evidenced by flight 587, cyclic rudder pedal inputs, even when made at airspeeds below maneuvering speed, can result in catastrophic structural damage.

Existing regulations and guidance pertaining to maneuvering speed may have contributed to the misunderstanding regarding the degree of structural protection provided by operating below maneuvering speed. Title 14 CFR 25.1583, "Operating Limitations," lists maneuvering speed among the airspeed limitations that must be furnished to the pilots of transport-category airplanes and states that, along with maneuvering speed, pilots must also be furnished "with a statement that full application of rudder and aileron controls, as well as maneuvers that involve angles of attack near the stall, should be confined to speeds below this value." Although it is true that full control inputs should be confined to airspeeds below maneuvering speed, the statement in Section 25.1583 could also be read to incorrectly imply that an airplane could withstand any such inputs so long as they were made below maneuvering speed. The explanation of design maneuvering speed in AC 61-23C, "Pilot’s Handbook of Aeronautical Knowledge," may be even more misleading, stating that, "any combination of flight control usage, including full deflection of the controls, or gust loads created by turbulence should not create an excessive air load if the airplane is operated below maneuvering speed." This statement strongly -- and incorrectly -— suggests that, if multiple control inputs were made below maneuvering speed, the airplane would be protected against structural damage.

The Safety Board has no reason to believe that the misunderstanding about maneuvering speed is limited to A300-600 pilots. As a result, the Safety Board concludes that there is a widespread misunderstanding among pilots about the degree of structural protection that exists when full or abrupt flight control inputs are made at airspeeds below the maneuvering speed. Therefore, the Safety Board believes that the FAA should amend all relevant regulatory and advisory materials to clarify that operating at or below maneuvering speed does not provide structural protection against multiple full control inputs in one axis or full control inputs in more than one axis at the same time.

Upset Recovery Training

In October 1996, the Safety Board issued Safety Recommendation A-96-120, which recommended that the FAA "require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems, and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements."

More than 8 years have passed since the issuance of Safety Recommendation A-96-120. Although the FAA has expressed agreement with the intent of the recommendation, it has not yet taken the necessary regulatory action to require unusual attitude training for air carrier pilots. In contrast, the air carrier industry has recognized the need for such training by voluntarily developing programs, such as the American Airlines AAMP, and issuing the Airplane Upset Recovery Training Aid. There is widespread agreement among operations and training managers that unusual attitude training helps prepare flight crews for such unusual situations. However, without a regulatory requirement and published guidance from the FAA, the design and adoption of such programs has been voluntary, and approval of the principal operations inspector assigned to the individual operators has been without the benefit of broader guidance from training experts within the FAA.

The Safety Board’s investigation found deficiencies in the American Airlines AAMP, including the following:

• ground school training that encouraged the use of rudder for roll control,
• a simulator exercise in which pilots were encouraged to employ large rudder inputs without being fully trained in the operating properties of the specific rudder control system or fully understanding the structural loads that might be imposed on the airframe by certain inputs,
• a simulator exercise that provided unrealistic portrayals of an airplane response to wake turbulence and significantly suppressed control input effectiveness to induce a large rolling potential that was unlikely to occur with an airplane as large as an A300-600
• a simulator exercise that encouraged the use of rudder in a highly dynamic situation without portraying the large buildup in sideslip angle and sideload that would accompany such rudder inputs in an actual airplane.

FMI: www.ntsb.gov/recs/letters/2004/A04_56_62.pdf