“The sensitivity of the system is critical and needs to be addressed.” Safety Board Member Debbie Hersman
Modifications are needed to nearly 500 Airbus A300-600 and A310 aircraft in order to provide pilots with greater protection from hazardous rudder pedal inputs at high airspeeds that can lead to aircraft pilot coupling (APC), the National Transportation Safety Board (NTSB) decreed Oct. 26.
These aircraft share the same rudder control system. Capping a three-year $3.7 million invest-igation into the Nov. 12, 2001, crash of American Airlines Flight 587, an A300-600, the safety board held the design partly responsible for the crash, which killed all 260 aboard and five persons on the ground at the Belle Harbor, N.Y., impact site.
At the end of the daylong hearing, NTSB Vice Chairman Mark Rosenker said, “We’ve seen today a tragic coupling of the pilot and aircraft that brought down Flight 587.”
Pending system modifications, the board said that pilots need to be advised in no uncertain terms that back-and-forth pedal inputs to the rudder, or rudder reversals – even within the certified “maneuvering speed” (VA) – pose the risk of imparting aerodynamic loads high enough to break the fin, as was the case in the Flight 587 crash.
While the board’s exhaustive inquiry exonerated the composite materials used in the A300-600 rudder and tailfin, and ruled out terrorism (no evidence of a bomb explosion), investigators criticized American’s upset recovery training program, decried the apparent withholding of safety-critical information in an earlier incident, and blasted the continued use of “filtered” flight data recorder (FDR) information.
Above all, the NTSB homed in on the rudder control system. “It is an inherently unfriendly design,” said the NTSB’s Malcolm Brenner.
In the statement of probable cause, the board cited First Officer Sten Molin’s “unnecessary and excessive rudder pedal inputs.”
This ultimate judgment, that the pilot flying caused the crash, was expected. An animation of the control wheel and pedal inputs show a series of dynamic control inputs well beyond any modest adjustments needed to fly the airplane through the wake turbulence it encountered from a Japan Air Lines B747 that had taken off from New York’s John F. Kennedy International Airport immediately ahead of Flight 587.
However, in its recitation of contributing factors in the crash, the safety board cited rudder pedal inputs that were “characteristic of the A300-600 rudder system design” (i.e., its sensitivity) and, in implied secondary order of importance as a contributing factor, the negative learning inherent in American’s advanced aircraft maneuvering program (AAMP). The acronym is a synonym for upset recovery training. As pointed out in this publication, a wake encounter is a transitory atmospheric condition and not an “upset” importing loss of control (see ASW, Oct. 25).
By its action, the safety board has cast a shadow over the rudder system design, which may require the manufacturer to undertake a potentially costly modification and retrofit.
American officials, who apprehended that the rudder system might be exonerated, leaving AAMP as the primary contributing factor, clearly were heartened, if not elated, by the board’s action.
“We really agree with the recommendations on the rudder sensitivity issue,” declared Bob Reding, senior vice president for technical operations at American Airlines.
Airbus issued a statement immediately following the hearing reflecting the manufacturer’s disappointment and surprise at the board’s determination. “We do not believe the facts of the investigation point to sensitivity of the rudder as contributing to the accident,” Airbus said flatly.
Investigators deemed Molin’s control inputs much too aggressive when the airplane encountered the first of two wake vortices (which were slipping off the wingtips of the JAL jet a few miles ahead).
“The bumps from wake turbulence were typical and the effect on the airplane was minor,” said the NTSB’s John O’Callaghan. Some American officials contend that the forces may have been greater but not captured by the low sampling rate of the flight data recorder (compounded by “filtering” mentioned below). The strength of the wake vortex aside, it is known that Molin made large inputs to the control wheel, shown in an animation as rather like moving the steering wheel of one’s automobile in a sudden quarter-turn. When the airplane encountered the second wake vortex, Molin made full left and right control wheel inputs as well as a series of opposing pedal inputs. American officials contend that Molin’s initial input with a force of about 30-35 lbs. suggests he did not intend to apply full rudder. However, subsequent rudder inputs were on the order of 140 pounds.
“The airplane was outside of its normal flight regime when the fin separated,” O’Callaghan said.
The composite fin broke at nearly twice its limit load. Limit load is defined as the worst case loading expected in normal service. To this value, a 50 percent safety factor is applied called ultimate load (i.e., 1.5 of limit load). The attachment lugs to the fin broke at 1.93 of limit load. Post-accident analysis and testing showed no evidence that the composite layers in the fin had delaminated or degraded in service. Three other attachment lugs were tested after the Flight 587 accident. All three lugs held well above ultimate load before breaking.
The key question is what prompted Molin to alternatively move the rudder pedals like an exercise machine to the point where the structure failed?
NTSB staff member David Ivey said American’s AAMP training, which Molin had completed, may well have predisposed him to use rudder. Specifically, Ivey said, during the simulator portion of AAMP training, pilots were presented with an “unrealistic wake turbulence encounter.” The airplane was rolled beyond 90� angle of bank and the flight controls were inhibited until the aircraft rolled to that point.
Neither pilots nor AAMP instructors at American knew that the simulator flight controls were inhibited (i.e., washed out) until this point. For an airplane about to roll on its back, rudder would be an appropriate response. Thus, Ivey surmised, the inhibited flight controls may have “conditioned use of the rudder.”
Above all, Ivey found that rudder pedal travel and rudder pedal force were thought to be unchanged at higher airspeeds. “AAMP did not fully explain the airplane’s response to rudder inputs,” Ivey said. In particular, “That rudder pedal movement decreases with an increase in airspeed and increases in sensitivity with an increase in airspeed.”
During takeoff, the pedal moves four inches to full deflection and requires a force of 65 pounds to move. At 250 knots airspeed in climb, the point where the accident sequence occurred, the pedal requires only 32 pounds of force (only 10 lbs. above the 22-lb. breakout force) and moves only 1.2 inches to achieve maximum deflection.
Steven Magladry, an NTSB systems engineer, said the rudder system on the A300-600 “has the lightest force and the shortest travel of any other airplane.” Moreover, he added, there are no quantitative standards, or measures of sensitivity, for certification. Given the absence of any such measure, the NTSB created its own. It relates G-force felt in the cockpit to every pound of force applied to the rudder pedal. Investigators compared the A300-600 system to that of the A300 B2/B4, the predecessor model from which the A300- 600 was derived. Magladry explained that B2/B4 operators had called for reduced control wheel force, which Airbus engineers sought to honor in the A300-600 design. In order to maintain “harmony” with wheel and rudder pedals, the engineers also reduced the forces required to move the pedals.
The result was an A300-600 design whose sensitivity increases with an increase in airspeed, unlike that of the B2/B4.
“We don’t like the change in sensitivity from low speed to high speed,” said John Clark, NTSB head of aviation accident investigations. “However, we don’t know how far off the 240 knot point you need to be to have a safe system,” he said, referring to the 0.02 G force imparted by pedal movement at that speed. “We want to buy more margin,” he said, to reduce the potential for aircraft pilot coupling (APC).
APC is a phenomenon in which pilot control inputs can be out of phase with the airplane’s reaction, tending to negatively reinforce an increasing deviation from desired to actual aircraft response. In the case of the Flight 587 accident, APC may well have been involved in the rapid series of rudder reversals leading to fin separation. Prior to the Flight 587 accident, few pilots were aware that APC was possible within the rudder circuit (i.e., around the yawing axis). Classic APCs have tended to be in pitch, with a minor number seen as instability around the fore-aft axis and known as roll-coupling. APC involves an involuntary interaction. The nature of the APC beast is that once the process is set in train, it is unlikely that any pilot will suddenly “get off” the controls. Disengagement is not intuitive.
Brenner, an NTSB human performance specialist, said, “APC events always reflect some underlying design characteristic.”
“Staff concludes that the A300-600 is susceptible to potentially hazardous coupling at high airspeeds,” Brenner said.
Magladry added that the pedal stop “is a moving target” that also depends on the functioning of the yaw damper.
While the board issued recommendations in early 2002 for pilots to be cautioned in training about the dangerous potential for rudder reversals (see ASW, Feb. 18, 2002), Vice Chairman Rosenker said, “At this point, we haven’t done much about the rudder – its sensitivity.”
Board Member Debbie Hersman said, “The sensitivity is more important than the AAMP program.”
“It is important to address both equipment and training, but we must make sure that the equipment and its response to pilot’s input does not create an unexpected environment,” she added. To support her contention, she noted that:
- In one of Molin’s two previous encounters with wake turbulence, he had not used rudder. On the one previous occasion where he had used the rudder, it was after AAMP ground school but prior to the simulator training. AAMP, therefore, may not have conditioned him to apply rudder. By implication, she was pointing to the potential for APC in the accident sequence. After the first rudder input, Molin was involved in an APC event. Moreover, while rudder should not be needed to maintain control in a wake upset, a special 1995 review of 33 wake encounters logged in the aviation safety reporting system (ASRS) database over a six month period showed that pilots used corrective rudder inputs in 11 such cases. Again, if pilots are going to apply rudder, such application should not precipitate APC-induced reversals.
- Hersman noted that the A320 rudder system may be similarly sensitive as the A300-600’s, and therefore the design issue may extend to other models. Magladry remarked that the A320 “has a short pedal throw and less force at higher speed, but we don’t know how the airplane responds at higher speed.” He noted that the A320 is a fly-by-wire (FBW) design, where the system automatically will “input aileron to reduce sideslip” and the attendant aerodynamic forces on the tailfin.
- Hersman pointed out that of seven high loading events, three occurred among A310 operators whose pilots did not go through AAMP training. By implication, AAMP was not a common culprit, pointing again to the rudder system’s sensitivity.
By these arguments, the board was moved to recommend design changes to provide increased protection from hazardous rudder pedal inputs at higher speeds for the A300-600 and A310 fleets. If protection against APC is inadequate in the face of rudder inputs at all airspeeds, the aircraft deemed vulnerable should be modified – a recommendation that could extend beyond the A300-600 and A310 fleets.
The Flight 587 accident also led to the headwaters of the great river of certification standards. Member Hersman noted that aircraft designers are required to show that the fin is strong enough to bear the aerodynamic forces associated with full rudder deflection, followed by return to the neutral position. They are not required to demonstrate the forces associated with a reversal – full deflection to one side followed by continuous movement in the opposite direction to full deflection on the opposite side. Hersman’s exchange with Ivey, a former airline pilot, shows the arbitrariness of the certification standard for a pilot who unexpectedly gets full rudder from 1.2 inches of pedal travel.
NTSB Chairman Ellen Engleman-Connors said the issue of rudder reversals during certification needs to the examined “as a follow up item” with the view to new airplane designs being able to “handle reversals.”
Other issues of import beyond the A300-600 and A310 and the Flight 587 crash were raised that have implications for the industry in general.
For one thing, NTSB officials sharply criticized the use of “filtered” FDR data. Because of filtered recorder data, O’Callaghan said, “We didn’t really have a true rudder position. It had to be reconstructed through a tedious process.”
As previously indicated in this publication, the controversy over filtered data has come up before and the NTSB had to have been aware of the use of filtered FDR data on some aircraft, having tacitly approved exceptions allowing the use of filtered data on some aircraft models (see ASW, Aug. 5, 2002)
Nonetheless, the board wants raw data recorded, and it wants this capability incorporated within two years. One year has already passed since that recommendation was issued, with no evidence of progress. Accordingly, NTSB board members reclassified the status of their recommendation from “Open – Acceptable Response” to “Open – Unacceptable Response.”
Of perhaps greater concern to board members was the perception that Airbus had not shared all it knew about fin loads during the May 1997 stall/upset of Flight 903, another A300-600 (see ASW, Oct. 25). As in the Flight 587 accident, the Flight 903 incident involved rudder reversals, but NTSB officials investigating that event were not made aware of the high loads put on the fin. Sources say as much as 1.9 of load limit may have been achieved, nearly that of the 1.93 of limit load experienced on the Flight 587 accident aircraft.
In the 1997 upset, the rudder deflected some 63 percent beyond the RTL (rudder travel limiter) at 250 knots airspeed (where the Flight 587 accident airplane experienced structural failure of the fin four years later). A June 16, 1997, Airbus internal memorandum expressed considerable concern over the high loads:
“The reason is that the load due to sideslip … and the load due to rudder deflection will work in the same direction and must be added up. Rudder movement from left limit to right limit will produce loads on [the] fin/rear fuselage above ultimate design load.”
“These high amounts and [their] combination are not covered by Loads Design Maneuvers according to JAR/FAR 25 [the European and U.S. certification standards].”
This was one of the memoranda that prompted Airbus to urge American Airlines to inspect the fin and report the findings. However, in its Aug. 12, 1998, submission to the NTSB on the Flight 903 investigation, Airbus did not mention the RTL exceedances or that ultimate load might have been reached on the fin.
Clark said, “We did not know of the specific [loads] calculations and the actions of the RTL, and we’re not very pleased with the subsequent revelations.”
Engleman-Connors declared, “The moral obligation [to share information] will always be higher than the legal obligation [in] my opinion.”
First Officer John David, deputy safety committee chairman of the Allied Pilots Association (APA), the union of American Airlines’ pilots, hypothesized that if the full implication of the fin loadings in the Flight 903 incident had been known, the NTSB recommendations to avoid reversals – issued in February 2002 after the Flight 587 crash two months before – might have been issued in 1998 after the Flight 903 upset, possibly averting the Flight 587 disaster.
Yet during the board hearing last week, NTSB officials discounted a relationship between the Flight 903 event and the Flight 587 accident, while at the same time complaining that Airbus had not disclosed all it knew. Clark said the two cases involve different circumstances. “We don’t think there’s a ‘eureka’ piece in 903 that would have led us to 587,” Clark said. However, the NTSB’s listing of similarities and differences in the two cases did not include rudder reversals. Those movements, and the resulting high tailfin loads, add to the similarity in the two cases.
What lies ahead is the manner in which design changes, if any, are introduced to the A300-600 and A310 rudder control systems to reduce sensitivity and their potential for APC. Certification standards, and whether rudder reversals should be a required element, have been deferred as an issue for the moment, but the NTSB has vowed to look closer. The NTSB clearly seeks added protection against APC in those standards.
In the meantime, Reding said American has already implemented recommended changes to AAMP. Flight control effectiveness is no longer suppressed. Rather, the simulator session starts by putting the airplane into a 90� bank and a -35� pitch and freezing it in this position. The orientation is then unfrozen, and the pilot is challenged to recover the airplane to level flight with full control authority.
The Difference Between Certification Standards & The Real World
NTSB Member Debbie Hersman: If you are a line pilot, how likely would it be that you would get the full amount [of rudder]? Or get 1.2 inches of the pedal at 250 [knots airspeed]?
NTSB professional staff member David Ivey: If I were to put in rudder? And knowing what I had found that … there was a very good chance you could put in full rudder [with 1.2 inches of travel]?
Hersman: And if you put in full rudder to the right, how likely is it that you’re going to have to come back with the left rudder?
Ivey: I think I could speak for most pilots that if I had any input that had sent me to the right, for example, I’m not going to do what certification says and put my rudder to neutral. I am going to counter the effects that I have just experienced in my body or what I have seen and I’m going to put in opposite rudder to try to correct the problem … But to answer your question, if I had a big yaw to the right I would put in left rudder. I certainly wouldn’t put it in neutral.
Hersman: And once that happened, is it your belief that this pilot was in an APC?
Ivey: It is my belief. Source: NTSB
Airbus: ‘We are surprised’
“While the facts of the investigation show that the first officer inappropriately used rudder – as he believed he had been trained by American Airlines to do – we are surprised by the Board’s concern about rudder pedal sensitivity at extremely high speeds in the context of this investigation (as reflected in the probable cause established by a divided 3-2 vote).
“We do not believe the facts of the investigation point to sensitivity of the rudder as contributing to the accident. The first officer applied tremendous pressure on the rudder pedals – about 140 pounds of pressure on several occasions – which would have resulted in full rudder reversals on any commercial aircraft anywhere in the world. Clearly, the pilot was seeking full application of rudder, something he would have achieved regardless of the sensitivity of rudder pedals.” Source: Airbus
| Rudder Design Data for Selected Airbus and Boeing Models All data at an airspeed of 250 knots | |||
|---|---|---|---|
| Aircraft Model | Pedal Force (lbs) | Pedal Travel (in) | Rudder Deflection (deg) |
| Airbus | |||
| A300-B2/B4 |
125
|
4
|
9.3
|
| A310 |
32
|
1.2
|
9.3
|
| A300-600 |
32
|
1.2
|
9.3
|
| A320 |
36
|
1.2
|
8.3
|
| A330-300 |
45
|
1.24
|
9.5
|
| A340-300 |
45
|
1.24
|
9.5
|
| Boeing | |||
| B767 |
80
|
3.6
|
8.0
|
| B737 |
50
|
1.0
|
4.0
|
| Source: NTSB | |||
| Similarities & Differences Factors in the Flight 903 Upset in 1997 Affecting the Flight 587 Accident in 2001 | ||
|---|---|---|
| Issue | AA 903 | AA 587 |
| Pilot training | Yes | Yes |
| Stall/loss of control (LOC) | Yes | No* |
| Rudder input necessary to recover | Yes | No |
| High speed rudder system sensitivity | No | Yes |
| Slow moving rudder travel limiter (RTL) | Yes | No |
| Issues not mentioned by NTSB in this comparison: | ||
| Rudder reversals | Yes | Yes |
| Exceed limit load and ultimate load | Yes | Yes |
| Filtered flight recorder data | Yes | Yes |
|
* Assuming aircraft-pilot coupling (APC) does not constitute LOC Source: NTSB, additions by ASW |
||