Airbus disagrees sharply over cause of Flight 587 crash
The outcome of a bitterly contested investigation into a crash that occurred 10 years ago should guide the probable cause of an investigation that is being resolved this week, according to American Airlines [AMR] officials.
The current case involves the Nov. 12, 2001, crash of American Flight 587, involving the tailfin separation on an Airbus A300-600, which led to the deaths of all 260 persons aboard and five persons on the ground (see ASW, Nov. 25, 2002). The National Transportation Safety Board (NTSB) completes its investigation with an Oct. 26 public hearing.
On the eve of that hearing, American officials point to the NTSB’s findings in the Oct. 31, 1994, fatal crash at Roselawn, Ill., of an American Eagle ATR 72 twin- turboprop, which at the time was flying in icing conditions. In its investigation, the safety board concluded that a lack of information sharing about previous ATR 72 incidents in icing conditions led to “inadequate oversight” of the airplane’s vulnerability to flight in icing conditions. The pilot’s actions, or lack thereof, and continued flight on autopilot while a ridge of ice accreted on the wings, were not mentioned in the NTSB’s probable cause, which instead lambasted French manufacturer Avions de Transport R�gional (ATR) and French and U.S. regulatory authorities. Ultimately, the de-icing boots on the ATR 72 were modified to cover a substantially greater portion of the wing chord.
Similarly, American officials maintain that the A300-600 rudder system is unusually prone to back-and-forth rudder movements (known as “reversals”) that can place excessively high loads on the tailfin because of the sensitivity of the rudder pedals and the susceptibility of the rudder controls to aircraft pilot coupling (APC). In APC, the flying pilot’s rudder pedal inputs can become out-of-phase with the movement of the rudder, causing a rapid buildup of aerodynamic forces on the fin. In the Flight 587 case, a series of such rudder reversals led to nearly twice the force (about 1.93 of limit load) than the fin was designed to withstand. American officials see a similar outcome to the Roselawn crash a decade ago – a mandate for the manufacturer to modify the rudder control system to reduce its sensitivity and to increase its ability to prevent excessive loads on the fin.
Airbus officials flatly disagree. “An improperly trained pilot can break any airplane,” said John Lauber, vice president of safety and technical affairs for Airbus North America. Lauber, like his counterparts at American Airlines, has been steeped in the details of the investigation from day one. He sees no need to modify the rudder control system on the A300-600. “We have 17 million hours of experience on that airplane [model], without one comment on the rudder pedal sensitivity,” he said. To add to his point, Lauber said no comments concerning sensitivity were ever received from American, either, following a 1997 upset involving another one of its A300-600 aircraft (Flight 903).
Airbus officials maintain that the Flight 587 copilot, First Officer Sten Molin, applied a rapid series of full rudder pedal movements that precipitated loss of the tailfin. Had Molin ceased such actions, or had the airplane been flying on autopilot, the rudder reversals would not have occurred and the airplane would have safely flown through the wake vortex it was encountering from a preceding Japan Air Lines B747 as the two airplanes climbed on slightly different paths out of New York’s John F. Kennedy International Airport.
The opposing views can be boiled down to American Airlines blaming inadequacies in the rudder control system, and Airbus pointing to training that predisposed American’s pilots to make excessive and inappropriate use of an inherently safe rudder system. The present controversy recalls an earlier dispute over the safety of the B737 rudder control system, which came to the fore following the fatal 1994 crash of USAir Flight 427 from an uncommanded rudder reversal. Boeing alleged the pilots caused the crash; the pilots union retorted the system was at fault. Following the USAir accident, the B737 rudder power control system design was modified substantially, and many pilots feel the redesign vindicated their concerns about the safety of the rudder system (see ASW, Oct. 14, 2002).
With the ATR 72 and the B737 design changes as precedent, more particularly the latter since it involves a rudder control system, American officials envision – or hope for – a similar outcome regarding the A300-600 in the Flight 587 case. Airbus officials stoutly disagree. The stage is set for controversy, with the NTSB as arbiter in a high visibility case involving a foreign manufacturer of growing dominance with the full force of the European Union in the background, and the largest airline in the United States. In the Roselawn crash case, manufacturer ATR went so far as to directly challenge the NTSB’s probable cause and, by implication, impugn the board’s competence (see ASW, Oct., 25, 1999). A repeat of the charged controversy surrounding the ATR 72 could be in the offing. That saga remains a case study in the opposite of the vaunted term “harmonization,” but rather a sharp disharmony of views, dragging on for years, with the NTSB eventually modifying its findings, albeit only slightly and more symbolically than substantively (see ASW, Sept. 30, 2002).
The NTSB is walking through another minefield of international controversy, with four of its five members fairly new to their positions and only one member on the NTSB at the time of the Flight 587 accident.
American officials make four assertions. To highlight each briefly:
Airbus failed to disclose what it knew in prior incidents of fin overloading on A300-600 and A310 aircraft (the two models share the same rudder control system).
American officials said if they had been advised by the manufacturer of the danger posed by rudder reversals following the 1997 upset of Flight 903 that the 2001 crash might have been prevented. American officials blame Airbus for not sharing information it had following the 1997 upset of the loads imparted on the fin and other incidents involving the A300-600 and the A310. Had they known, their upset recovery procedures would have more strongly emphasized to pilots the imperative to avoid reversals.
However, a review of the available documents surrounding the 1997 upset reflects a clear concern on the part of Airbus about the loads imparted on the tailfin and the urgent need to get more information from American. The documents show American was reluctant to divulge the digital flight data recorder (DFDR) readout. Liability concerns seem to have prevailed and an airplane whose fin was later deemed unairworthy was flown for another five years. It was not removed and replaced until after the Flight 587 crash.
As for American Airlines not being advised of other high-loading events, such as those involving an Interflug A310 in 1991 and an Air France A310 in 1999, Lauber said, “All high loading incidents due to loss of control were from pilot mishandling.” Not only did the Interflug airplane experience high loading on the fin, other parts of the airplane were subjected to extreme loads as well.
Lauber and other Airbus officials said American initially refused to provide the DFDR readouts from the Flight 903 event, and then in June 1997 received “some initial DFDR” information from which “theoretical determinations” suggested ultimate load had been reached. This assessment prompted Airbus to recommend that American “deeply inspect” the fin. When the results of that inspection were negative, Airbus was satisfied that the structure was still airworthy. It was not until more refined calculations were performed in 2002, after the Flight 587 accident, that Airbus determined ultimate load had likely been exceeded and the fin was not airworthy.
The A300-600 rudder design is overly sensitive. American officials assert that Molin did not intend to input the rudder reversals (four in seven seconds) that overloaded the fin. Capt. Delvin Young, fleet captain for A300 flight operations at American, said, “He moved the rudder 1.2 inches with 32 pounds of force and got into an APC.”
Lauber countered that the whole issue of rudder system sensitivity is “a red herring.” “The pilot applied 140 pounds of foot pressure; he would have gotten full rudder on any airplane,” Lauber said.
“He was going for the stops, not an intermediate position,” he added.
American officials say Molin’s actions accord precisely with the Aug. 6 revision of the “Airplane Upset Recovery Training Aid” issued jointly by Boeing and Airbus. In this document, the beginning of Chapter 2 contains this guidance: “A pilot must not wait until the airplane is in a fully developed and definable upset before taking corrective action to return to stabilized flight parameters.”
Young said, “This is what Molin did.”
That may be so, but elsewhere in this same document pilots are cautioned, “Very large yawing moments would result in very large sideslip angles and large structural loads, should the pilot input full rudder when it is not needed.”
Airbus did not fully advise of the dangers involved in rudder reversals. Young said, “It was known from the Flight 903 upset in 1997 that a rudder reversal could exceed ultimate load.”
Had the NTSB’s recommendations issued in early 2002 out of the Flight 587 accident been made following the 1997 Flight 903 upset, the later tragedy might have been avoided, Young argued.
“There is no question that the Flight 587 accident would not have happened had Airbus shared [with the NTSB] what it knew in 1997,” he charged.
Airbus officials bristle at the notion that they had not advised American or the NTSB of the dangers inherent to rudder reversals. Among the numerous documents, they point to an Aug. 20, 1997, letter sent by Airbus, Boeing and Federal Aviation Administration (FAA) officials to Capt. Cecil Ewell, then chief pilot at American. This letter dealt with American’s “Advanced Aircraft Maneuvering Program” (AAMP) or, more colloquially, its upset recovery training program. In the wake of the loss of control accidents involving the American Eagle and USAir accidents (among others), American was one of the first carriers to implement this training.
However, in their 1997 letter, the manufacturers and the FAA representative said they had a “concern” about “excessive emphasis on the superior effectiveness of the rudder.”
“Rudder reversals such as those that might be involved in dynamic maneuvers created by using too much rudder in a recovery attempt can lead to structural loads that exceed the design strength of the fin,” the letter warned.
Perhaps more telling is the May 27, 1997, memorandum sent to Ewell by Capt. Paul Railsback, then the airlines manager of flight operations, technical. The memorandum was sent following the Flight 903 upset earlier that month. Prophetic in hindsight, Railsback attributed the upset to “excessive rudder inputs by the crew” as a result of their AAMP training and that the airline was “at grave risk of a catastrophic upset because AAMP is teaching dangerous aerodynamic theory.”
Railsback expressed his concern more bluntly in a deposition taken in April 2003.
Airbus officials say not only was American Airlines informed of the danger inherent to rudder reversals, some of the carrier’s own officials expressed the same concerns.
Airbus further points out that just a week before the Flight 587 crash, Airbus issued a memorandum warning against aggressive maneuvers to knock hijacking-bent terrorists off their feet: “The rudder reversal maneuvers may be dangerous for the aircraft structure because there is a potential risk to overstress the fin.”
ASW contributing editor John Sampson observes, “There is a growing belief that ‘hands and feet off’ (momentarily) might be the safest way to traverse a wake encounter. Neither method (hand flying or ‘hands and feet off’) will alleviate momentary passenger discomfort but, like a boat ploughing through a wave, eventually built-in stability will prevail and soothe the flight path. After all, loss of control (LOC) is always a function of aircraft speed, angle-of-attack, configuration and pilot inputs. Except in a micro- burst near the ground, loss of LOC has naught to do with the transitory ambient nature of a highly localized air disturbance.”
“AAMP may have been sucking on a myth,” he surmised.
The Roselawn accident is relevant. American officials harken back to the ATR 72 investigation, noting that NTSB recommendations regarding international data sharing were among the most contentious of the board’s many recommendations. Two of the three pertinent recommendations regarding data sharing under bilateral airworthiness agreements (BAAs) were never resolved to the board’s satisfaction. “The BAA mechanism is totally dependent on the regulatory authorities sharing information, which depends on the manufacturers sharing information with the regulator,” an American official said, implying that Airbus has not been suitably forthcoming.
Lauber rejected the assertion, saying Airbus has been “totally open” throughout the Flight 587 investigation.
Nonetheless, American officials adamantly maintain that the Flight 587 crash reflects a systemic safety breakdown similar to that revealed in the Roselawn crash post mortem a decade ago. To American, the Airbus criticism of AAMP is a red herring that distracts from the issues of information-sharing, design deficiencies and the “pilot trap” inherent in the rudder system’s latent potential for airplane pilot coupling.
To the NTSB falls the task of sorting out the real herrings from the red ones. (Look to next week’s issue for coverage of the NTSB hearing on the Flight 587 crash) >> Lauber, e-mail [email protected]; Young, e-mail [email protected] <<
Airbus Concerns About High Loads
Airbus memoranda and messages following the AA Flight 903 upset on May 12, 1997:
- June 18, 1997: “The AAL [American Airlines] structural engineer ‘will not’ – repeat ‘will not’ give me the list of findings from the [tail] inspections … Urgent reply requested.”
- June 19, 1997: “We kindly ask you to send to Airbus Industrie urgently the details of the inspections performed and the associated findings.”
- June 20, 1997: “AAL initially reluctant to release DFDR [digital flight data recorder] as well as any inspection results … AAL were informed about our serious concern in this issue and that we refrained putting the a/c on ground only because of the inspection results received from them today … We should retain carefully the evidence to claim compensation if this a/c will show damage which was not discovered now and inform AAL accordingly.”
- June 24, 1997: “Further to the inspection report and results provided by AAL … please find hereafter additional inspection tasks that we recommend to perform at the next opportunity.”
- June 30, 1997: “AAL has completed the inspection … and there were no findings.”
Source: NTSB, Docket No. SA-522, Exhibit 7-LL
Resolution of Roselawn Recommendations
Emanating from the fatal Oct. 31, 1994, crash of American Eagle Flight 4184, an ATR 72, at Roselawn, Ill. Three of the roughly three-dozen recommendations from the NTSB inquiry dealt with information sharing, issued Aug. 16, 1996 (below)
Recommendation Number and Summary: A-96-62 Develop an organizational structure within the FAA to obtain and record all domestic and foreign incidents and accidents, and manufacturers’ analyses of them, to effectively monitor the continuing airworthiness of aircraft.
FAA Response: FAA disagrees with the need, asserting the function already is in hand.
Current NTSB Status: Closed – Unacceptable Action (NTSB asserts that the FAA’s existing continuing airworthiness monitoring may miss critical technical and trend data).
Recommendation Number and Summary: A-96-63 Revise as necessary FAA monitoring of a foreign airworthiness authority’s compliance with U.S. type certification requirements.
FAA Response: FAA maintains it accomplishes this task effectively.
Current NTSB Status: Closed – Acceptable Action (NTSB concludes that the development of bilateral safety agreements will satisfy the recommendation’s intent; see next item below).
Recommendation Number and Summary: A-96-64 Ensure that all information, including a foreign manufacturer’s analysis of incidents and accidents, is included under bilateral airworthiness agreements (BAA).
FAA Response: ICAO, Annex 8, covers policies and procedures in this recommendation. This document and BAAs completely address this safety recommendation.
Current NTSB Status: Closed – Unacceptable Action (NTSB disagrees, saying some foreign incidents and accidents involving ATR 42 and 72 aircraft were not known to the FAA).
Source: NTSB