The Conundrum Of American Airlines Flight 587

Air Safety Week, Jan 31, 2005

Better Pilot Training or Aircraft Design?

Editor's note: Equivocation about Pilot-Induced oscillation (PIO) aside, the ability to inadvertently induce destructive yaw loads upon the Airbus A300 tail fin still exists, argues Martin Aubury, former head of Aircraft Structures at the Australian Civil Aviation Authority, and a university lecturer on structures at the Australian Defence Force Academy (ADFA) and the University of New South Wales in Sydney.

PIO is a euphemism for Aircraft-Pilot Coupling (APC), or "rudder excursions." PIO, as well as aircraft design, are at the center of the investigation into the fatal crash of American Airlines [AMR] Flight 587 on Nov. 12, 2001. Airbus and American Airlines disagree on the cause of the crash and have lobbied the National Transportation Safety Board (NTSB) to heed their views. Airbus blames American's pilot training, and American blames the Airbus' design (ASW, Jan. 10). Below, Aubury argues that federal regulators should require Airbus to modify that aircraft's rudder limiter system.

On the morning of Nov. 12, 2001, American Airlines Flight 587 twice hit wake turbulence after takeoff from New York's Kennedy airport. The pilot tried to steady the Airbus A300-600 aircraft with fairly vigorous control inputs; first ailerons, then rudder. Suddenly the aircraft broke apart in mid-air and crashed at Belle Harbor, a few miles from the airport, killing 265. This happened just two months after the World Trade Center and Pentagon attacks; aviation was still reeling. Suspicion immediately turned to terrorism but the National Transportation Safety Board (NTSB) quickly reported that the breakup sequence began with failure of the vertical tail. It landed within a mile of the main wreckage. Because the aircraft's fin was made from carbon-reinforced plastic, pundits questioned the integrity of composite material, especially its susceptibility to prior damage that could have gone undetected. That theory also was discounted when NTSB showed that the fin had failed under loads far greater than envisaged during design.

According to NTSB findings reported on Oct. 26, 2004, the aircraft was properly designed and the pilot of Flight 587 flew it legally and in accordance with his training, yet inadvertently caused loads extreme enough to destroy the aircraft. Some of the issues raised by the accident are specific to the aircraft type and to American Airlines' training regime. However, NTSB warned of industry-wide misunderstanding among pilots of the degree of structural protection that exists when large control inputs are made at speeds below an aircraft's specified maneuvering speed. Put bluntly, some pilots may not know how easy it is to break an aircraft.

Accident Details

Flight data records show that the A300 was nine minutes into its flight when it first encountered wake from a B747 flying about five miles ahead and upwind of the accident aircraft. Wake turbulence spacing between the aircraft was correct and data shows that the encounter was typical, not severe. The pilot responded with the control column and large yoke inputs; these caused small changes in pitch and roll angles. Initially nothing remarkable happened.

A few seconds later, with the aircraft in a climbing left turn and controls almost neutral the aircraft again met wake turbulence. This time the pilot applied a large right yoke input and full right rudder pedal. NTSB surmises that rudder was used to help augment the roll-rate but doubts it was needed. As the aircraft responded to the turbulence and to the pilot's initial inputs, the pilot followed up with a series of full alternating rudder pedal inputs together with increasing oscillations of the control column.

The outcome of these inputs was an oscillation in sideslip angle relative to airflow that built up oscillatory loads on the vertical tail and together with rudder loads broke the tail at its root.

Since the aircraft was flying below its maneuver speed limit, the pilot undoubtedly thought that his control inputs were within the aircraft's capability. Individually they were; but the series of inputs caused a dynamic interaction and dangerously high loads. It's like pushing a swing; several timed impulses give a disproportionate response.

NTSB Warning

Within months of the accident and long before its cause was formally determined, NTSB recognized an industry-wide deficiency in pilot training. In a letter dated Feb. 8, 2002, NTSB alerted the Federal Aviation Administration (FAA) that training on transport-category airplanes often omitted information about the structural certification requirements for the vertical stabilizer and did not warn pilots that sequential opposite rudder inputs (colloquially called "rudder reversals") cause structural loads that can exceed design strength - even at speeds below specified maneuvering speed.

Many pilots wrongly thought that systems installed to limit rudder travel as airspeed increases, and thus prevent excessive tail loads, would also prevent damage from sequential opposite rudder deflections. In fact, structural certification requirements take no account of such maneuvers. So even when there is a rudder limiter, sequential inputs may produce loads higher than those prescribed for certification and exceed the strength of the aircraft.