Better Pilot Training or Aircraft Design?
Editor’s note: Equivocation about Pilot-Induced oscillation (PIO) aside, the ability to inadvertently induce destructive yaw loads upon the Airbus A300 tail fin still exists, argues Martin Aubury, former head of Aircraft Structures at the Australian Civil Aviation Authority, and a university lecturer on structures at the Australian Defence Force Academy (ADFA) and the University of New South Wales in Sydney.
PIO is a euphemism for Aircraft-Pilot Coupling (APC), or “rudder excursions.” PIO, as well as aircraft design, are at the center of the investigation into the fatal crash of American Airlines [AMR] Flight 587 on Nov. 12, 2001. Airbus and American Airlines disagree on the cause of the crash and have lobbied the National Transportation Safety Board (NTSB) to heed their views. Airbus blames American’s pilot training, and American blames the Airbus’ design (ASW, Jan. 10). Below, Aubury argues that federal regulators should require Airbus to modify that aircraft’s rudder limiter system.
On the morning of Nov. 12, 2001, American Airlines Flight 587 twice hit wake turbulence after takeoff from New York’s Kennedy airport. The pilot tried to steady the Airbus A300-600 aircraft with fairly vigorous control inputs; first ailerons, then rudder. Suddenly the aircraft broke apart in mid-air and crashed at Belle Harbor, a few miles from the airport, killing 265. This happened just two months after the World Trade Center and Pentagon attacks; aviation was still reeling. Suspicion immediately turned to terrorism but the National Transportation Safety Board (NTSB) quickly reported that the breakup sequence began with failure of the vertical tail. It landed within a mile of the main wreckage. Because the aircraft’s fin was made from carbon-reinforced plastic, pundits questioned the integrity of composite material, especially its susceptibility to prior damage that could have gone undetected. That theory also was discounted when NTSB showed that the fin had failed under loads far greater than envisaged during design.
According to NTSB findings reported on Oct. 26, 2004, the aircraft was properly designed and the pilot of Flight 587 flew it legally and in accordance with his training, yet inadvertently caused loads extreme enough to destroy the aircraft. Some of the issues raised by the accident are specific to the aircraft type and to American Airlines’ training regime. However, NTSB warned of industry-wide misunderstanding among pilots of the degree of structural protection that exists when large control inputs are made at speeds below an aircraft’s specified maneuvering speed. Put bluntly, some pilots may not know how easy it is to break an aircraft.
Accident Details
Flight data records show that the A300 was nine minutes into its flight when it first encountered wake from a B747 flying about five miles ahead and upwind of the accident aircraft. Wake turbulence spacing between the aircraft was correct and data shows that the encounter was typical, not severe. The pilot responded with the control column and large yoke inputs; these caused small changes in pitch and roll angles. Initially nothing remarkable happened.
A few seconds later, with the aircraft in a climbing left turn and controls almost neutral the aircraft again met wake turbulence. This time the pilot applied a large right yoke input and full right rudder pedal. NTSB surmises that rudder was used to help augment the roll-rate but doubts it was needed. As the aircraft responded to the turbulence and to the pilot’s initial inputs, the pilot followed up with a series of full alternating rudder pedal inputs together with increasing oscillations of the control column.
The outcome of these inputs was an oscillation in sideslip angle relative to airflow that built up oscillatory loads on the vertical tail and together with rudder loads broke the tail at its root.
Since the aircraft was flying below its maneuver speed limit, the pilot undoubtedly thought that his control inputs were within the aircraft’s capability. Individually they were; but the series of inputs caused a dynamic interaction and dangerously high loads. It’s like pushing a swing; several timed impulses give a disproportionate response.
NTSB Warning
Within months of the accident and long before its cause was formally determined, NTSB recognized an industry-wide deficiency in pilot training. In a letter dated Feb. 8, 2002, NTSB alerted the Federal Aviation Administration (FAA) that training on transport-category airplanes often omitted information about the structural certification requirements for the vertical stabilizer and did not warn pilots that sequential opposite rudder inputs (colloquially called “rudder reversals”) cause structural loads that can exceed design strength – even at speeds below specified maneuvering speed.
Many pilots wrongly thought that systems installed to limit rudder travel as airspeed increases, and thus prevent excessive tail loads, would also prevent damage from sequential opposite rudder deflections. In fact, structural certification requirements take no account of such maneuvers. So even when there is a rudder limiter, sequential inputs may produce loads higher than those prescribed for certification and exceed the strength of the aircraft.
NTSB wanted FAA, manufacturers and operators to do three things:
- Properly explain to pilots the design requirements for the vertical tail;
- Explain that a large rudder deflection in one direction followed by large deflections in the opposite direction can overload the tail; and
- Emphasize that on some aircraft types, relatively light pedal forces and small movements can easily output the maximum available rudder deflection.
Conversely, pilots must not be reluctant to use full rudder when appropriate, such as during an engine failure or gusty crosswind landings. Apparently NTSB’s message has still not been well disseminated.
Tail Loads
Having now completed its investigation, NTSB confirms that the A300 was in fact flown in a manner that exceeded its design capabilities. Why were such loads never anticipated? Why were they not guarded against?
It is not practical to consider all eventualities during aircraft design. Instead, international design rules prescribe a few extreme conditions that are meant to encompass the worst loads that any aircraft will encounter during its operating life. These are called limit load conditions. For safety, limit loads are increased by a factor of 1.5 to give ultimate loads. Via analysis and testing, aircraft structures must be substantiated as strong enough to withstand those ultimate loads.
On the vertical tail, the case most akin to what happened on Flight 587 is known as the “Yaw Maneuver Condition.” This involves assuming that rudder pedals are suddenly displaced to the maximum extent possible, limited by control stops or by a pilot effort of 300 lbs. Then, after the aircraft achieves an equilibrium sideslip angle with rudder fully deflected, the rudder control is suddenly returned to neutral.
Importantly, the condition is treated in isolation. That means the aircraft is not expected to sustain any other loads while the rudder is full over; neither from other controls nor from gusts. Nor, as happened on Flight 587 are repeated rudder inputs considered. It’s an arbitrary condition dating back more than 50 years and until now it seemed to give conservative design loads for the vertical tail and rudder.
The Yaw Maneuver Condition dates back to an era when full rudder required great pilot effort; before the advent of power controls that now make that pilot effort limitation wholly irrelevant. Usually, power systems automatically restrict rudder deflection as speed increases and on some aircraft, including A300s, they also cut pedal movement.
For instance, NTSB observes that below 165 knots the A300-600 rudder has unrestricted deflection +/-30 degrees requiring a pilot force of about 65 lbs. to move the rudder pedals about 4 inches (100mm). However, at the accident airspeed of 250 knots, a limiter restricts rudder travel to about +/-9.3 degrees and a force of only 32 lbs. pushes rudder pedals through their reduced range of about 1.2 inches. This sensitivity makes it very easy for a pilot to command full and/or sequential rudder movement, especially as leg muscles are physiologically insensitive to force and position.
The A300-600 rudder system is more sensitive than on comparable aircraft and it may be more susceptible to aggressive use than the alternative arrangement existing on some other aircraft (which restrict rudder deflection without significantly cutting pedal travel).
NTSB also suggested that American Airlines’ pilot training may have led the pilot of Flight 587 to use the rudder over-aggressively. For instance, pilots were taught to use rudder during upset recovery but were not warned against multiple rudder inputs. Likewise, simulator training did not present realistic wake turbulence scenarios and the simulator was inhibited from giving a realistic response.
In general, flight crews lack experience in rudder use at high airspeeds and, for whatever reason, Flight 587 was flown in a way that subjected the vertical tail to nearly double the design limit loads. Inevitably that structure failed.
Conclusions on Flight 587
There have been no failures in the past similar to Flight 587 and only a handful of cases where vertical tails were overloaded. So the accident presents a conundrum. Can aviation hope to prevent a repeat simply by better pilot training and better understanding? Or must we impose more stringent design rules and face the extra weight and extra cost of stronger tails?
NTSB wants both. Its safety recommendations include:
- Modifying certification standards to ensure safe handling qualities in the yaw axis, including limits for rudder pedal sensitivity;
- Checking whether existing aircraft meet the new standard and if not, require that they be modified;
- Reviewing options for modifying A300-600 and A310 to provide increased protection from hazardous rudder inputs; and
- Disseminating guidance to emphasize avoidance of multiple, repetitive, full deflection, alternating control inputs and amend all materials to clarify that operating below maneuvering speed does not protect structure against multiple full inputs.
Responsibility lies with the airworthiness authorities, particularly in the United States and Europe, whether to heed the NTSB. But any action is likely to take quite some time. Meanwhile, pilots should understand fully how their rudder system works and use enough rudder when needed but neither aggressively nor repetitively.
Information in this article is based on NTSB hearings and reports at: http://www.ntsb.gov/events/2001/AA587/default.htm.
A Pilot’s Take on PIO
“Classically, a Pilot-Induced oscillation (PIO) requires a “trigger” (in this case it was a wake event) and thereafter it can take on a life of its own. If a pilot doesn’t recognize it for what it is and momentarily release the controls, the natural progression is for the oscillation to increase in amplitude. In many circumstances this can be destructive. Experience teaches us that many pilots don’t just let go–which is why it is vital that any characteristic of a flight control system that might lead to a PIO must be designed out.”
Source: John Farley, British Harrier test pilot.
New Designs for Rudders Needed
“It’s worth re-emphasizing just how vulnerable the accident aircraft was to rudder inputs. The rudder deflected to its stops under a pedal force of only 32 Lb; about a fifth of what we feel in our feet and legs when walking. Four successive applications of such a small force broke the tail off an airliner! Can we rely on extra training to mitigate the risk? I think not. CASA should join with NTSB in urging FAA to introduce new design rules on rudder sensitivity.”
Source: Martin Aubury, from a paper presented at an aeronautical design seminar.
Points to Ponder
1) Most airplanes with fire, smoke in the cockpit (or cabin or hold) land ASAP at “the nearest available,” which may not necessarily be “the nearest suitable.” Might it become a case of “suitable versus acceptable”?
2) Will A380 crews feel constrained by the law of diminishing proportions (in regard to the number of enroute airfields that can cope with the aircraft’s Leviathan dimensions)?