REGARDING THE ACCIDENT OF AMERICAN AIRLINES FLIGHT 587

航空

游客，如果您要查看本帖隐藏内容请回复

航空

i
SUBMISSION OF THE
ALLIED PILOTS ASSOCIATION
TO THE NATIONAL TRANSPORTATION
SAFETY BOARD
REGARDING THE ACCIDENT OF
AMERICAN AIRLINES FLIGHT 587
AT BELLE HARBOR, NEW YORK
NOVEMBER 12, 2001
NTSB DCA02MA001
In accordance with 49 CFR 831.14, the Allied Pilots Association (APA) a designated Party to the National
Transportation Safety Board (NTSB) investigation of the accident, respectfully submits to the Board its
contributing factors, probable cause, findings, and recommendations.
Communication with respect to this Submission may be addressed to:
First Officer John David
Allied Pilots Association
14600 Trinity Boulevard, Suite 500
Fort Worth, TX 76155
Telephone: 817.302.2150
Fax: 817.302.2152
ii
TABLE OF CONTENTS
1. EXECUTIVE SUMMARY ................................................................1
A. PROBABLE CAUSE AND CONTRIBUTING FACTORS................................3
2. INTRODUCTION.............................................................................5
3. FACTS, ANALYSES, AND RECOMMENDATIONS.....................6
A. FLIGHT CONTROL SYSTEM.............................................................................6
Table 3.1 Comparisons of Rudder Flight Control Systems..........................8
Table 3.2 Paradigm Shift of A-300-600R Rudder Flight Control System...8
Safety Recommendation 1 .............................................................................9
Safety Recommendation 2 ...........................................................................10
B. FLIGHT ENVIRONMENT..................................................................................11
Figure 3.1 Depicted Flight Path of AA 587 and JAL 47 ..............................14
Safety Recommendation 3 ...........................................................................14
Safety Recommendation 3 ...........................................................................15
Safety Recommendation 4 ...........................................................................15
C. ADVERSE AIRCRAFT PILOT COUPLING ....................................................16
Safety Recommendation 5 ...........................................................................19
Safety Recommendation 6 ...........................................................................20
Safety Recommendation 7 ...........................................................................20
D. OVERSIGHT .......................................................................................................21
1. Bilateral Agreement .......................................................................................21
2. Intended Rudder Usage ................................................................................23
3. Maneuvering Speed.......................................................................................24
4. Aircraft Separation Standards ......................................................................25
Safety Recommendation 8 ...........................................................................26
Safety Recommendation 9 ...........................................................................27
Safety Recommendation 10 .........................................................................27
Safety Recommendation 11 .........................................................................28
4. SUMMATION................................................................................ 29
WORKS CITED................................................................................... 30
LIST OF SAFETY RECOMMENDATIONS....................................... 31
1
1. EXECUTIVE SUMMARY
American Airlines (AA) Flight 587 departed Runway 31L at John F. Kennedy
International Airport on November 12, 2001. The A300B4-605R departed at
approximately 0916 EDT. Two FAA- licensed airmen with over 3,500 combined flight
hours in the A300B4-605R flew the aircraft observing rules, regulations, and
governances mandated by Federal Aviation Regulation (FAR) Part 121. The pilots also
adhered to rules and procedures stipulated by the Federal Aviation Administration
(FAA), the aircraft manufacturer, Airbus, and the certificated air carrier, American
Airlines. AA Flight 587, Aircraft Registration N14053, followed a heavy Japan Air Lines
(JAL) Boeing 747-400. The departure spacing between the two aircraft complied with the
current aircraft separation requirements established by the FAA. Once airborne, a
sequence of events rapidly occurred. The airplane encountered one or more wake vortices
trailing the B-747-400 aircraft. The Pilot Flying (PF) the airplane reacted judiciously to
stabilize the attitude of the airplane in response to the vortices. Aerodynamic forces
exceeded ultimate load on the tail fin within 6.5 seconds, causing the vertical stabilizer to
separate from the aircraft. Twelve seconds later, the aircraft impacted the ground killing
all onboard. The horrific accident happened in less than 90 seconds on a clear morning
with no significant weather. The aviation community was left to investigate an event that
had never happened to a U.S. transport aircraft: the separation of a major component
from an airplane structure.
To understand the separation of the vertical stabilizer, accident investigators began to
look at a number of variables, chiefly:
· Aircraft design, certification, and modification, concentrating on the flight
control design and the composite structure
· Other in-service events of A-300 aircraft
· Pilot behavior and decision making
· Pilot interaction with the aircraft, including adverse Aircraft Pilot
Coupling (APC)
· Aircraft separation spacing
· Effects of wake vortices on trailing aircraft
The discovery process uncovered ten prior in-service events concerning A-300 aircraft,
beginning with an Interflug Airlines event in 1991. In all ten events, the vertical
stabilizers of each Airbus aircraft were exposed to excessive aerodynamic loads—three
even exceeding ultimate load (United States 2003 (Public Hearing Exhibit 7Q). When the
manufacturer observed these highly unusual in- flight events, Airbus should have
investigated the flaws in the design as the limit load is the maximum load expected when
the aircraft is in service. Ultimate load is defined as the limit load multiplied by a safety
2
factor of 150%.1 The manufacturer failed to correlate the deficiencies obvious in the inflight
events and placed blame on other parties. It is the manufacturer’s responsibility to
assess whether a deficiency exists and, if so, to determine the commensurate need for a
mitigating strategy to prevent a catastrophe. Furthermore, according to the Bilateral
Aviation Safety Agreement (May 1996), Airbus should have disseminated critical
information as a function of their monitoring of in-service aircraft. Yet, throughout the
ten-year span of in-service events, Airbus inexplicably failed to issue any Airworthiness
Directives (ADs), Immediate Action Bulletins, Technical Bulletins, Flight Crew
Operating Manual (FCOM) revisions, or Flight Manual limitation revisions.
Investigators also learned in the discovery process that, in an in-service event in 1997,
another AA Airbus 300-600 vertic al stabilizer had exceeded ultimate load. They
questioned why multiple overloads of the tail fin—a primary aircraft structure—occurred
without warning. To investigators, there appeared to be a certification “loophole” since
aircraft certificating authorities left these in-service events unaddressed. The inaction on
the part of either the manufacturer or the certificating authority violates U.S. transport
certification criterion as neither party acted to ensure the aircraft design met industry
standards. The breakdown in the integrity of the system that governs transport category
aircraft shocked the aviation industry as the investigation progressed, and the flight
community learned that critical operating limitations of the A300 had not been revealed
for over a decade. Investigators uncovered these startling facts months after the 587
accident while the flight crew had less than 6.5 seconds to analyze and react to the
aircraft as it became unrecoverable.
At the public hearing, the manufacturer testified that, unlike aircraft manufactured in the
United States, the A300-600 aircraft had not undergone formal testing for aircraft
handling characteristics. Aircraft manufactured in the U.S. must undergo testing that
evaluates aircraft handling characteristics in both benign and adverse flight conditions.
U.S. aircraft manufacturers employ a standard methodology such as those defined in
Advisory Circular (AC) 25-7A. Airbus used an internal rating system that they felt met
the requirements of FAR 25 but did not apply their internal rating system to gauge the
handling characteristics of the A300-600 in a wake vortices environment.
Facts uncovered during this investigation also highlighted a flaw which is inherently built
into the A300B4-605R rudder design. Airbus’ predecessor aircraft, the A300B2/B4
variant, is equipped with a rudder in which the pilot would exert control forces similar to
those found in other transport category aircraft. However, the modified A300B4-605R
exhibits an oversensitive rudder; it is 7.32 times more sensitive than the similarly- sized
Boeing 767 rudder control system. The FCOM provided by Airbus fails to notate the
extreme rudder control sensitivity difference, fails to outline restrictions placed upon
rudder usage, and fails to reveal how Airbus intended the pilot to use this system.
1 FAR Part 25.301 states, “(a) Strength requirements are specified in terms of limit loads
(the maximum loads to be expected in service) and ultimate loads (limit load multiplied
by prescribed factors of safety).”
3
A corollary effect of the A300B4-605R rudder pedal sensitivity is the propensity for a
pilot to become adversely coupled with the aircraft. This anomaly is known as adverse
Aircraft Pilot Coupling (APC) and is usually the result of a deficient flight control design.
An APC event causes a pilot’s rudder inputs to be out of sync with the motion of the
aircraft. In the case of Flight 587, the Pilot Flying—uninformed and unaware of the
hypersensitive rudder pedals—made appropriate and controlled rudder inputs in response
to the aircraft’s motion as it encountered wake vortices. An unintentional result was that
excessively high aerodynamic loads were placed on the vertical stabilizer which then
broke off the aircraft only 9 seconds after the first rudder pedal input.
A. PROBABLE CAUSE AND CONTRIBUTING FACTORS
The probable cause of this accident was an Aircraft Pilot Coupling (APC) event. This
APC occurrence was the result of a flawed design modification to the A300.
Additionally, the modification was not tested by an accepted Handling Qualities Rating
Method (HQRM). The APC event led to the development of excessive aerodynamic
loads and consequent structural failure of the vertical stabilizer in only 6.5 seconds.
Airbus was forewarned of this catastrophe by preceding in-service events and failed to
caution operators and regulators of this tendency.
The contributing factors of the accident are outlined below:
a. Airbus failed to identify the dramatic changes in a rudder control design that
radically deviated from other aircraft designs.
b. Airbus failed to use an objective standard for rating the aircraft handling
characteristics of the A300B4-600R flight control design, such as the FAA
Handling Quality Rating Method (HQRM), or the Cooper-Harper Pilot
Rating.
c. Airbus failed to publish limitations on the aircraft’s rudder design.
d. Airbus failed to properly educate operators about rudder system limitations.
e. Airbus failed to design an appropriately redundant flight control sys tem that
provides protection by limiting the rudder’s ability to generate excessive
lateral loads on the aircraft structure.
f. Airbus failed to responsibly investigate and report resolutions to prior inservice
events.
g. Aircraft certification authorities failed to require the quantitative evaluation of
flight characteristics and handling qualities for a derivative aircraft design,
thereby ensuring that the derivative model was not susceptible to the hazards
of APC.
4
h. Aircraft certification authorities failed to require quantitative aircraft flight
characteristic and handling quality testing in the presence of wake vortices as
part of the approval process of new and derivative aircraft designs.
i. Regulatory and certification authorities failed to ensure that airmen had proper
knowledge of structural certification requirements for the rudder and vertical
stabilizer.
j. Regulatory authorities failed to ensure mitigation of the risks presented by the
wake vortices of aircraft now approaching 1 million pounds gross weight and
generating significantly stronger and more violent disturbed air masses than
those originally tested in determining criterion for safe aircraft spacing.
k. Regulatory authorities incorrectly defined maneuvering speed (Va) leading to
an industry-wide misconception of the fundamental principle.
5
2. INTRODUCTION
“System safety is a specialty within system engineering that supports program risk
management. It is the application of engineering and management principles, criteria
and techniques to optimize safety. The goal of system safety is to optimize safety by the
identification of safety related risks, eliminating or controlling them by design and/or
procedures, based on acceptable system safety precedence” (3. 3-2).
The FAA System Safety Handbook
In order for the reader to best understand the complex factors of the AA 587 accident, the
Facts, Analyses and Recommendations portion of this report is divided into four main
areas:
· Flight Control System
· Flight Environment
· Adverse Aircraft Pilot Coupling
· Oversight
Each section contains facts and analysis followed by recommendations.
This was a complex accident. The Allied Pilots Association (APA) offers this Submission
to aid the Safety Board in its analysis. Suggestions for specific safety recommendations
that APA believes should be a part of the Final Report are compiled at the end of the
report.
6
3. FACTS, ANALYSES, AND RECOMMENDATIONS
A. FLIGHT CONTROL SYSTEM
“Control forces should not be so high that the pilot cannot safely maneuver the airplane.
Also the forces should not be so light that it would take exceptional skill to maneuver the
airplane without overstressing it or losing control. The airplane response to any control
input should be predictable to t he pilot.” [Emphasis added.]
FAA Advisory Circular 25-7A
In civil aviation, an airplane is judged airworthy by meeting certification standards
established in commercial aviation by FAR Part 25 or the European equivalent. The basis
of this assurance of airworthiness is an understanding that the manufacturer has proven
the proper functioning of the airplane systems, such as the Flight Control System (FCS).
This proof is obtained through extensive analysis, simulation, and flight testing in all
possible flight conditions. The investigation of AA 587 uncovered a lack of design and
regulatory oversight and questionable engineering practices as the airplane evolved from
its original certification basis, the A300B2-1A. The aircraft was adapted over time with a
significantly modified FCS—without updating the original certification basis or
complying with bilateral agreements between the United States and French
manufacturers.
The A300B2-1A airplane2 was the first Airbus design, literally their launch vehicle as an
airplane manufacturer. The FCS was a standard hydro- mechanical, servo-control system,
incorporating an analog computer for flight augmentation functions. This was necessary
to address undesirable handling qualities such as Dutch roll in the lateral axis. By the
1980s, digital technology began to supercede analog technologies, and Airbus moved to
modify the original design with digital autopilot and flight augmentation computers while
maintaining the same basic flight control architecture—except in the primary FCS of the
rudder design and the secondary FCS system of the spoilers. In 1982, the A310/A300B4-
600 aircraft used digital computers and limited Fly-by-Wire (FBW) technologies with
spoiler movement for roll control. This system is also capable of inducing adverse yaw,
an undesirable lateral motion counteracted by the rudder or yaw damper or both.
The main differences of the modified FCS of the A310/A300-600 spoiler control are
summarized below. These differences are significant in both their physical and handling
quality changes to the airframe.
· All mechanical linkage and servomotors previously required on the A300B2/B4
spoiler control system were eliminated and actuators were electrically signaled.
2 1971, U.S. certification 1974
7
· The command/monitoring computer became the basic architecture building block.
It allowed a command channel failure to be detected and neutralized.
· Each command or monitoring unit included all the electronic components needed
to perform its function without sharing resources with another component.
· All functions, including spoiler actuator servo-loops, became software based and
fully under control of digital units.
· Roll control was optimized according to airspeed and flap position. The spoiler
contribution to roll control was significantly increased in comparison to the
previous A300B2 design. One set of ailerons (outboard) was eliminated on the
A310/A300-600 design.
· Modified and enhanced Flight Control Laws (FCLs) and flight envelope
protection were added.
· The rudder control unit was changed from Variable Lever Arm (VLA) to Variable
Stop Actuator (VSA).
· Side-stick pilot controls were incorporated.3
The A300B2/B4 model used a rudder control system employing a Variable Lever Arm
(VLA) to limit rudder travel. A similar rudder-ratio changer design is also fo und in most
other transport category aircraft. The VLA limited the amount of rudder available to the
pilot as the airplane’s speed increased. The rudder pedals consistently moved the same
physical distance, yielding a proportion of rudder relative to speed. In 1988, Airbus
implemented a completely new rudder design, which significantly modified the function
of the previous model and hence, the handling qualities of the new A300-600 airplane
design. This new system used a Variable Stop Actuator (VSA) which is also found in the
MD-80. The VSA also limited the amount of rudder available to the pilot. The difference
in this system is that the distance which the rudder pedals moved also decreased as the
rudder movement decreased in proportion to speed. A significant flaw in the design failed
to offer the same kind of protection as in the McDonnell design. The MD-80 limits
rudder travel and affords protection in the form of rudder “blow down” should an
operator demand more rudder travel (with resultant excessive load) than the structure can
withstand. These kinds of redundant system designs are common in commercial
aviation—a standard that should be addressed during certification. The Airbus Flight
Crew Operations Manual (FCOM) addresses the rudder system much like any other
manufacturer and, in fact, did not change the language of the FCOM even after changing
the A300 design from the VLA to the VSA system.
The significance of this modification is best illustrated by reviewing the input required to
move the rudder. The input is comprised of the pilot’s tactile feel and level of exertion
necessary to incrementally manipulate the flight controls and maneuver the flight path of
the aircraft. Table 3.1 is a comparison of rudder control systems across a variety of
manufacturers.
3 These were not used on American Airlines A300-600s.
8
Table 3.1 Comparisons of Rudder Flight Control Systems
Aircraft
Maximum
Force/Breakout
Force Digital Ratio
Degrees of Rudder Per
Pound of Force Above
Breakout
A-300-600B2 4.68 .090
A-300-600B4 4.68 .090
B-757 5.00 .094
B-737 3.33 .114
B-767 4.71 .127
MD-80 4.00 .178
DC-9 3.75 .182
B-747 4.21 .197
B-727 2.94 .212
B-777 3.33 .214
DC-10 6.50 .255
MD-11 6.50 .273
MD-90 3.25 .288
B-717 3.25 .289
(Official Docket Aircraft Performance Report 12)
Table 3.2 is the same comparison of rudder control systems with the addition of the
A300-600R at the bottom.
Table 3.2 Paradigm Shift of A-300-600R Rudder Flight Control System
Aircraft
Maximum
Force/Breakout
Force Digital Ratio
Degrees of Rudder Per
Pound of Force Above
Breakout
A-300-600B2 4.68 .090
A-300-600B4 4.68 .090
B-757 5.00 .094
B-737 3.33 .114
B-767 4.71 .127
MD-80 4.00 .178
DC-9 3.75 .182
B-747 4.21 .197
B-727 2.94 .212
B-777 3.33 .214
DC-10 6.50 .255
MD-11 6.50 .273
MD-90 3.25 .288
B-717 3.25 .289
A-300-600R 1.45 .93
(Official Docket Aircraft Performance Report 12)
9
The change in maximum force and degrees of rudder per pound between the A300B2/B4
and the A300-600 is highly significant. The A300 family has the distinction of having the
lightest breakout force and the highest number of degrees of rudder travel per pound of
force of any other transport category aircraft. Once a pilot initiates rudder movement, he
or she will be challenged with the most sensitive rudder handling qualities of any
transport category airplane. This sensitivity is a precursor to a characteristic known as
Aircraft Pilot Coupling (APC), a condition typically “…not feasible for a pilot to realize
and react to in real time,” and considered unacceptable in U.S. certified designs
(National Research Council 15). Simply, a very light application of force coupled with a
very small movement of the rudder pedal will yield full deflection of the rudder.
“Artificial trim and feel systems which produce controllers with too small a displacement
and light force gradients may also lead to severe overcontrol.”
FAA Advisory Circular 25-7A
“Good flying qualities are fundamental to the elimination of adverse APC. These are
defined in the form of requirements with relevant metrics to be satisfied (8).”
National Research Council
The reason for such a significant design difference between these two variants of the
A300 has not been determined. Airbus has not produced a quantitative methodology,
such as the FAA’s Handling Qualities Rating Method (HQRM) or Cooper-Harper tests,
to demonstrate how they evaluated the handling qualities of the variant airplane. Mr.
Jacob, Airbus test pilot, could only explain their methodology at the NTSB Public
Hearing as, “We qualify it to—we check it—we—and that means test pilots from
manufacturers and from the certification authorities—qualify the suitability of the
aircraft” (540). That statement bears no similarity to the requirements of 14 CFR Part 25.
Safety Recommendation 1
The NTSB should recommend that the FAA require evaluation of all
aircraft operating under U.S. type certification by FAA Handling
Qualities Rating Method (HQRM) or equivalent.
10
Safety Recommendation 2
The NTSB should recommend that the FAA and French DGAC form
an Engineering Evaluation Team to work with Airbus and the
operators of the A310/A300-600 to determine whether pilot training
alone is an adequate remedy to the undesirable Flight Co ntrol System
(FCS) characteristics of these aircraft, or if an FCS modification is
also required.
11
B. FLIGHT ENVIRONMENT
“Wake turbulence accidents and incidents have been, and continue to be, a significant
contribution to the worldwide safety statistics” (1-1).
Wake Turbulence Training Aid
The encounter of AA 587 with the wake vortices of the preceding aircraft, a Boeing 747-
400, triggered the events leading to catastrophic structural failure of the accident aircraft.
NASA engineers have analyzed the DFDR data from AA Flight 587 and JAL Flight 47,
attempting to recreate the forces of the wake vortices encountered. DFDR data confirms
that the aircraft flew normally until the encounter. Engineers were hampered in their
attempts to analyze the data by three factors (Aircraft Performance Report, 19-20, 11;
Appendix A, 19):
1) Low sampling rates of both DFDRs
2) Lack of specific data to perform force calculations
3) Ambiguous data on flight control and handling characteristics of the
A300
Additionally, they were handicapped in the DFDR analysis by a filter in the System Data
Analog Converter (SDAC) whose properties Airbus was unable to define.
AA 587’s flight path was disturbed by two potentially destructive wake vortices
generated by the Boeing 747-400 aircraft. The vortices carried the legacy of thousands of
documented and undocumented wake turbulence incidents and accidents. Wake
turbulence issues have been clouded by economic influences, particularly airport
capacity. The most direct fix of this problem is to increase separation. This is also the
most opposed solution due to its economic impact. It is time for safety and science to
override economics.
The existence and destructive potential of wake turbulence is more than adequately
substantiated throughout the history of turbojet transport aircraft operations. The
phenomenon has been the subject of study by U.S. and international regulatory agencies,
accident prevention and investigation authorities, and private aviation safety
organizations. Significantly, the character of turbojet transport aircraft has changed
dramatically in terms of operating weights and wing design. These two principal factors
in wake vortex signature are significant in relevance to the 587 accident. Industrial efforts
to determine the wake signatures of new-generation aircraft, such as the 747-400,
however, are absent. Efforts to assess risk in determining the adequacy of wake
turbulence separation criteria applied by Air Traffic Control (ATC) authorities are also
equally absent.
12
Based on a 10- year period of data collection, the Civil Aviation Authority of Great
Britain (CAA) changed from a three- group airplane weight category to a four-group
weight category. In 1991, the CAA presented a paper to participants of an FAAsponsored
conference on aircraft wake vortices held in Washington, D.C. This paper
stated, “The four-group scheme (weight categories) introduced in 1982 was divided as a
result of incident data gathered in earlier years and was designed to provide extra
protection for some types of aircraft found to suffer particularly severe disturbance
behind heavy group aircraft” (Wake Turbulence Training Aid, Appendix 4-A, 12). The
CAA, in analysis of events reported between 1972 and 1990, found that “…the B-747
and B-757 airplanes appear to produce significantly higher incident rates than the other
airplanes considered, indicating prima facie that they produce stronger and more
persistent vortices than other aircraft in their respective weight categories…” (Wake
Turbulence Training Aid Appendix 4-A 13). The maximum take-off weight for the B-
747 at the time of the study was 317,000 kg. or 818,000 lbs (Wake Turbulence Training
Aid, Appendix A, 14). The take-off weight of JAL Flight 47 was 780,000 lbs. Clearly, the
CAA’s four-group weights classification system is relevant to AA 587’s wake encounter.
The FAA divides groups of aircraft in the following manner:
Small aircraft <41,000 lbs.
Large aircraft are between 41,000 lbs. and 255,000 lbs.
Heavy aircraft > 255,000 lbs.
Aircraft are now approaching maximum take-off weights of 1 million pounds. A different
weight group is required for 214,000 pounds of difference in weight (Small to Heavy) but
not for 615,000 pounds of difference (Heavy minimum weight to 747 maximum take-off
weight). NTSB Safety Recommendation A-94-043 clearly states:
“...the Board still believes that the most significant problem related to establishing
adequate separation standards is the great range of aircraft weights involved. Thus the
Board believes it would be prudent to create four weight categories in which the ratios of
the high and low weights within each category are similar.”
Accordingly, separation standards should reflect the revised weight categories.
The FAA Wake Turbulence Training Aid states on page 2.3:
“The strength of wake turbulence is governed by the weight, speed and wingspan of the
generating aircraft. The greatest strength occurs when the generating aircraft is heavy,
at slow speed with a clean wing configuration.”
This is precisely the situation encountered by AA 587.
The FAA has limited knowledge of the strength of wake vortices but has seen multiple
incidents and accidents due to this phenomenon. The wake from one of the heaviest
among heavy aircraft, one that the CAA found to be “stronger and more persistent,”
created forces that absolutely demanded a response from the pilot of AA 587 (Wake
13
Turbulence Training Aid Appendix 4-A 13). This response to stabilize the aircraft’s flight
attitude triggered the ensuing APC.
Computational Fluid Dynamics (CFDs) and wind tunnel modeling have been used to
predict aircraft behavior, but they are unsatisfactory in determining characteristics and
handling qualities which can involve the coupling of an aircraft, pilot, and environments
such as the counter-rotating air mass of wake vortices. In December 1999, the Safety
Board stated in Safety Recommendation A-94-043 that it “…does not believe that
unvalidated [sic] theoretical evaluations should be used to justify decreased safety
margins such as exemptions to the weight classification system.” Additionally, in the
same recommendation, “The Safety Board has no evidence that the FAA/NASA wake
vortex simulation has sufficient validity to define risk in an actual wake vortex
encounter.”
The principal conclusions previously reached by the NTSB, and which are cited in the
Wake Turbulence Training Aid (Appendix 4-A 28) of 1994, remain. Currently, the
conclusions stand as:
1. Current Air Traffic Control (ATC) procedures and pilot reactions can
result in aircraft following too closely behind larger aircraft.
2. Pilots do not have sufficient information to determine relative flight paths
and maintain adequate separation distances relative to wake vortices.
AA 587 took off from Runway 31L with the required two minutes of separation from
JAL 47. Upon departing, the Air Route Traffic Control Center (ARTCC) gave the
accident aircraft a turn to the WAVEY intersection. This vector placed the American
airplane inside the turn of the preceding 747, effectively creating a rendezvous turn. The
flight path of the two airplanes is depicted in Figure 3.1 (Official Docket Aircraft
Performance Report 47). The turn immediately reduced the separation between the two
aircraft, exposing AA 587 to a more powerful wake vortex than the departure separation
should have assured. Additionally, the prevailing winds blew the vortices from the 747
into the flight path of the A300. Both of these hazards occurred without the knowledge of
the 587 flight crew, inadvertently exposing them to dramatically- increased risk.
14
Figure 3.1 Depicted Flight Path of AA 587 and JAL 47
15
Safety Recommendation 3
Safety Recommendation 4
The NTSB should recommend that the FAA reexamine the validity of
current ATC wake turbulence separation standards. Focus of the
review should be on the standards for the wide range of “heavy”
airplanes currently in operation, and for larger aircraft, such as the
Airbus A380 coming in the near future. This examination should
include new technology and should study proposals for improving
controller training and understanding of wake vortices, including
variables such as relative wind, atmospheric stability, and ATC
vectoring.
The NTSB should recommend the FAA comply with open Safety
Recommendation A-94-056 which states, “Require manufacturers of
turbojet, transport category airplanes to determine, by flight test or
other suitable means, the characteristics of the airplanes’ wake
vortices during certification environment.”
16
C. ADVERSE AIRCRAFT PILOT COUPLING
Aircraft Pilot Coupling (APC) is one of the most challenging flight characteristics known
to aerodynamicists and designers of Flight Control Systems (FCSs). It is an unwanted
design flaw affecting the aircraft attitude and motion(s) once disturbed from stable state
conditions. Beginning with an initiating event, these flight characteristics form a
continuous or “closed-loop” interaction between the aircraft and the pilot (National
Research Council 14). The phenomena of APC events have often been associated with
the introduction of new technologies, functionalities, or complexities such as the change
on the A300 rudder control system.
“APC events are collaborations between the pilot and the aircraft in that they occur only
when the pilot attempts to control what the aircraft does. For this reason, pilot error is
often listed as the cause of accidents and incidents that include an APC ev ent. However,
the [NRC] committee believes that the most severe APC events attributed to pilot error
are the result of adverse APC that misleads the pilot into taking actions that contribute to
the severity of the event. In these situations, it is often possible, after the fact, to analyze
the event carefully and identify a sequence of actions the pilot could have taken to
overcome the aircraft design deficiencies and avoid the event. However, it is typically not
feasible for the pilot to identify and execute the required actions in real time” (161).
National Research Council
The National Research Council (NRC) describes an APC event as both oscillatory and
non-oscillatory divergences from the desired flight path. The pilot is involved (due to his
or her responsibility to respond to an uncommanded aircraft motion) by manipulation of
the flight controls to modify or negate input in a “closed- loop” fashion that determines
the flight path of the airplane. The NRC has previously established that the most severe
oscillatory APC events show flight control rate limiting. Rate limiting of the A300 flight
controls has been confirmed by the ground tests conducted by the NTSB Human
Performance and Systems Groups, and Dr. Hess. FAA AC 25-7A also addresses rate
limiting as a root cause for APC. The irony of an APC event is that releasing the controls,
a procedure taught to test pilots but contrary to line pilot training, is one of the most
effective means to counter this adverse condition. Releasing the flight controls is viewed
as so desperate by U.S. aircraft certification authorities that the need to “open the loop” in
this manner to maintain control of an aircraft is considered unsatisfactory. Simply stated,
a design which has demonstrated a propensity for APC and subsequent need for the pilot
to release the controls is a non-airworthy design for transport category aircraft.
The divergent motions of the A300 (with the most sensitive rudder control system of any
transport category aircraft) unexpectedly and unpredictably reacted to the environment
and to the pilot attempts to control it. These subsequent lateral accelerations occurred in
the brief period after the aircraft tangentially traversed the counter-rotating wake field
during the final seconds of the AA 587 flight. The forces imposed on the airplane by the
rudder doublets, commanded in response to the unwanted motion, exceeded the vertical
stabilizer structural limitations. The total system failure began with a faulty flight control
17
design and culminated with a pilot struggling to control an aircraft that only moments
before had been a docile, stabilized platform. The aerodynamic loads built in excess of
ultimate load; separation of the vertical stabilizer occurred only 6.5 seconds after the
aircraft entered the vortices of the 747 (Official Docket Aircraft Performance Report 33).
One of the findings of the NRC study states:
“Adverse APC events are rare, unintentioned, and unexpected oscillations or divergences
of the pilot-aircraft system. APC events are fundamentally interactive and occur during
highly demanding tasks when environmental, pilot, or aircraft dynamic changes create or
trigger mismatches between actual and expected aircraft responses” (33).
National Research Council
In 1997, at the time the NRC published its report, they had identified ten possible pilotinvolved
oscillatory APC events in Airbus aircraft. The manufacturer acknowledged only
three as genuine—but even one is an acknowledgment of an unsatisfactory aircraft design
and a flawed certification system.
In addition to the reluctance of the manufacturer to admit or address latent deficiencies in
the A300 control design, analysis is further complicated because APC events have been
difficult for line pilots to detect and report. Test pilots are trained to recognize and
analyze APC anomalies; commercial line pilots are not. Further exacerbating discovery
of this latent hazard is the low fidelity of Digital Flight Data Recorders (DFDRs). The
low sampling rate of current DFDRs does not facilitate post-event analysis of high
frequency oscillatory APC events. The sampling rates of flight control parameters are
typically one to two hertz. These rates are designed to best record human versus
mechanical discrepancies. A much higher rate and unfiltered data is required to
accurately assess flight control motion. At the NTSB Public Hearing for Flight 587,
Investigator-In-Charge (IIC) Robert Benzon stated:
“In 1994, the Safety Board recommended to the FAA that such filtering be removed from
information sent to the flight recorders. And yet in 2001, this investigation was hampered
by totally unacceptable filtering of the data. In addition, the sampling rates of such data
are simply not adequate” (31).
Airbus clearly subscribes to the use of enhancements offered by the digital age with
modifications to the flight control design of their aircraft, including the A300-600. Flight
augmentation computers, flight envelope protection and even limited Fly-by-Wire (FBW)
technologies were modified into this derivative model in 1986. Verification through flight
testing of these new technologies is appropriate with respect to flight control changes.
Testing should be accomplished through proven evaluation methods, such as the FAA’s
Handling Qualities Rating Method (HQRM).
The Pilot In Command (PIC), assisted by the designated Pilot Flying (PF) were both
type-rated in the A300/310 aircraft. Type-rating training is developed in accordance with
FAR 121.401 using the aircraft information provided by the manufacturer. Pilots must
18
demonstrate competent knowledge of the aircraft as well as complete an extensive
flight/simulator-based training course. Both pilots had completed this process; however,
no line pilot possessed critical knowledge of the limitations in the A300 design. The
critical peculiarities of the flight control design found in this investigation were not
shared with pilots or with American Airlines. Further confounding the understanding of
rudder system limitations was the Flight Manual “L/G [Landing Gear] Unsafe Indication”
procedure which dictated alternating sideslips. The overall sensitivity of the rudder
system was not addressed nor was a prohibition on rudder reversals placed in the FCOM
or flight manual. The manufacturer’s decision to omit information from the FCOM links
a failure to recognize a latent hazard (sensitive rudder) with a supervisory failure to
mitigate future risk. With this higher-risk design, it was only a matter of time before the
necessary preconditions were met for the airplane to experience a non-recoverable
adverse APC event.
A training program could not have been developed because the manufacturer offered no
information about the limitations or peculiarities of the rudder system. Neither pilot was
trained to experience this unexpected and unpredictable flight characteristic nor the
aircraft gyrations experienced in the accident sequence. It was far beyond the pilots’
practical experience, surprising the PF and leaving the PIC unaware of the peril they
faced as the PF struggled to maintain control of the aircraft.
The pilots experienced “Surprise and Startle” factor, a known Human Performance
reaction, when the aircraft entered the wake field, and the resultant unanticipated motion
of the airplane began. The airplane reaction to the counter-rotating wake vortices first
tended to overbank AA 587 from a steady-state left turn. The PF attempted to counter the
undesired airplane motions. At this point in the mishap sequence, the reaction of the
airplane departed from the rational expectatio ns or practical experiences of either pilot.
The PF’s inability to precisely make an input to the rudder system to stop the oscillatory
lateral motions of AA 587 forced the aircraft to yaw excessively which created
aerodynamic side loads on the airplane structure. The oversensitive rudder, needing only
22 pounds of force to initiate, with an extremely short stroke of only 1.2 inches of travel
to command full rudder, was a mere flex of the PF’s foot. The tactile feel and travel
distance of the aircraft’s rudder pedal was out of balance with line pilot expectations of
the rudder control system.
“Artificial trim and feel systems which produce controllers with too small a displacement
and light force gradients may also lead to severe overcontrol.”
FAA Advisory Circular 25-7A
Attempts to counter or dampen this motion, an aerodynamic phenomenon known for
decades and addressed by yaw damper systems, were now being exacerbated again by the
system design. The A300 yaw damper actuator has a maximum deflection authority of ±
10°, with a maximum rate of ± 39° per second. The rudder actuator has a maximum rate
of 60° per second, ± 5°. Because the rudder authority is significantly higher than that of
the yaw damper, it can suppress and/or override the yaw damper which negates one of the
yaw damper’s primary functions.
19
No evidence exists to suggest that the actions by the PF were anything other than a
judicious response to correct an unwanted flight attitude. However, this unexpected
condition degraded as the PF struggled to maintain control of the aircraft. Responding
quickly to the three-dimensional motions caused by the wake of a preceding super-heavy
airplane, the PF used as much authority of the FCS as his years of experience handling
aircraft had taught him to use. He reacted to maintain airplane control, up to and
including, the full command authority of his FCS. Commercial line pilots operate
airplanes in this manner: using performance feedback to control their input rather than
physically looking at a control and cognitively applying a fixed distance stroke. The
pilots were unaware of the latent deficiencies in the modified rudder FCS:
· The extremely light rudder pedal force
· Shorter rudder pedal travel as speed increases
· Excessive degrees of rudder travel per pound of force
· The absence of limiting or protecting systems
The manufacturer failed to warn pilots of these design characteristics and the need to
avoid cyclical motion of the rudder controls. The PF was functioning within the
guidelines written in various procedures, policies, and practices as he struggled to
maintain airplane control. In doing so, he coupled with a hidden flaw in the rudder design
and exceeded an unstated limitation.
Safety Recommendation 5
The NTSB should recommend installation of unfiltered, high sample
rate DFDRs in all transport category aircraft. Further, the NTSB
should recommend that a detailed analysis of operational data from
those aircraft with reports of unexpected performance variances be
made available as part of Service Difficulty Reports (SDRs) required
of aircraft manufacturers.
20
Safety Recommendation 6
Safety Recommendation 7
The NTSB should recommend that the French DGAC require Airbus
to develop formal training for all operators of the A310 and A300-600
similar to that developed by American for its A300-600 pilots. This
airplane -specific training should go beyond NTSB Safety
Recommendation A-02-01 and focus on: (1) the unusually sensitive
rudder; (2) the yaw damper design; (3) the limited capability of the
RTLU to compensate for acceleration; and (4) the unique APC
susceptibility of the A300-600 and the A310. Training should
recognize that the piloting techniques used when flying other
transport category airplanes may not safely transfer when
transitioning from those airplane s to the A310/A300-600.
The NTSB should recommend that the FAA require manufacturers of
transport category airplanes either manufactured in or imported into
the United States to develop FAA-approved advanced maneuver
training programs, including specific documentation and guidance for
classroom and simulator training specific to each airplane.
21
D. OVERSIGHT
1. Bilateral Agreement
Bilateral Aviation Safety Agreements (BASAs) with Implementation Procedures for
Airworthiness (IPA) provide for airworthiness technical cooperation between the FAA
and partner international civil aviation authorities. France and the United States have
agreed to certification and acceptance of aircraft manufactured in either country under the
terms of BASA. The first such agreement, a Bilateral Aviation Agreement (BAA), was
reached in 1973 and was renewed as a BASA in May 1996. BASAs were initiated in part
to enhance cooperation and increase efficiency in matters relating to civil aviation safety.
One other advantage was to reduce the economic burden imposed on the aviation
industry and operators by redundant technical inspections, evaluations, and testing. These
agreements were not intended to diminish the level of safety for the industry. By
requiring equivalent safety measures, the BASA envisioned that aviation products
manufactured in either country would meet the standards of both countries.
Airplanes certificated by the FAA under BASA are required to meet U.S. airworthiness
standards. For transportation category aircraft, the specific standards are defined in 14
Code of Federal Regulations (CFR) Part 25. The BASA process cites several CFR parts
and ACs which define the equivalent requirements for both France’s Direction Générale
de Aviation Civile (DGAC) and the U.S.’s FAA. These CFRs and ACs are the guidance
that a non-U.S. manufacturer must comply with in order to receive a U.S. Type
Certificate for a specific airplane model. The data required by these CFRs and ACs
should be maintained for examination during the lifecycle of a specific airplane. To date,
following numerous requests, neither Airbus nor the DGAC have provided data relevant
to the type certification required for the major component change from the A300B2 to the
A300B4-605R. Specifically, that major component change was the shift from the VLA to
the VSA in the rudder control system.
FAA-AC 21-23A states:
“a. Following the type certification of an aircraft, it frequently becomes necessary to
revise data on the aircraft type design. Major changes to a type design not great enough
to require an application for a new TC, sought by the TC holder, may be issued as
amendments to the type certificate issued under 14 CFR 21.29, or otherwise approved by
the FAA. A certification procedure similar to that described in Chapter 2 is conducted
and adjusted for the magnitude and complexity of the design change. The FAA retains the
right to determine whether the proposed change is substantial enough to require a new
type certificate for the changed design.”
It is unknown whether Airbus did not identify the major change in the rudder system or if
the FAA determined that “one rudder control unit is like another.”
22
Airbus verbally stated the change from VLA to VSA was for weight, reliability, and
simplicity. This design is on all subsequent Airbus designs with one major difference:
limiting systems as a result of Fly-by-Wire (FBW) technology. Airbus also admitted that
their company does not use industry-recognized flight characteristics and handling
quality tests such as the Cooper-Harper Method or the FAA HQRM used in U.S.
certification. 4 Airbus has not produced any other test program data to justify their
selection of overly-sensitive control forces other than what their test pilots thought
appropriate.
Airplane manufacturers hold the proprietary engineering data that allows them to
determine the aerodynamic loads on aircraft experiences based on DFDR data. American
Airlines does not have access to this proprietary data. As such, Airbus had a moral
responsibility to inform the DGAC and the FAA that one of their aircraft experienced a
limit load excursion.
Public Hearing Exhibit 7Q, pages 5 and 6, revealed a total of 11 “high load” events.
These high load events all happened on the A300 or A310. Seven of the events exceeded
load limit and three exceeded ultimate load. Five of the high load events involved rudder
doublets. Yet, Airbus remained silent. This is peculiar since limit load, according to Part
25, is “never to be seen in operational use.” Also, Airbus was required to inform the
DGAC of these unsafe conditions in accordance with the BASA.
BASA and FAA AC 21-23A also specify requirements for continued airworthiness. The
FAA AC 21-23A states:
“When a safety concern arises, the FAA cooperates with its partner to determine the
appropriate corrective action to be taken by operators or owners of affected U.Sregistered
aircraft. The FAA expects exporting CAA’s [sic] to keep it informed of
corrective actions that they believe are required for the safety of U.S.-registered
aircraft.”
The IPA, in paragraph 3.3.0.0(a), states that the exporting authority is responsible “…for
resolving in-service safety issues related to design or production. The exporting authority
shall provide applicable information which it has found to be necessary for mandatory
modifications, required limitations and/or inspections to the importing authority to ensure
continued operational safety of the product, part or appliance.”
Paragraph 3.3.0.2 of the IPA, “Unsafe Conditions and Mandatory Continuing
Airworthiness Actions,” states in paragraph 3.3.0.1(4):
“Notifying the importing authority of the unsafe condition and the necessary corrective
actions by submitting a copy of the mandatory continuing airworthiness action….”
4 The Cooper-Harper Pilot Rating is a numerical Handling Quality Rating (1-10) scale that assigns an
empirical value, indicating the workload task and the performance that could be obtained of a pilot.
23
For U.S. operators, that airworthiness action would be issued in the form of an
Airworthiness Directive (AD).
By its failure to act, Airbus perpetuated an unsafe condition. The manufacturer is
responsible for resolving these unsafe conditions—not the airlines or the civil authorities.
In response to the NTSB recommendations, American Airlines developed policy and
procedural guidance to mitigate the hazard that had been identified. This action was too
late for the crew and passengers of AA 587.
2. Intended Rudder Usage
Airbus failed to accurately inform the aviation community about the intended purpose of
the rudder on their aircraft. Their testimony at the AA 587 Public Hearing conflicts with
their published documents and the A300-600 FCOM. Furthermore, the FAA failed to
ensure that accurate information was disseminated to the operators of the A300.
In June of 1998, Airbus published a FAST Special Technical Digest. The article,
“Aerodynamic Principles of Large-Airplane Upsets,” was authored by several people
including Bill Wainwright, Chief Test Pilot for Airbus and Larry Rockliffe, Chief Pilot
and Flight Training Director for Airbus Service Company Inc. The summary of the article
states:
“Each upset event may result from different causes, but the concepts for recovery are
similar.
· Use whatever authority is required of the flight controls” (Dempster 12).
In December of 1998, Airbus published an Airplane Upset Recovery Training Aid and
included a letter that stated the manual was “part of an industry effort to reduce loss of
control accidents and incidents” (Airplane Upset letter). The letter encouraged the user to
“use this training aid to ensure your pilots participate in an effective airplane upset
recovery training program.” In a section 2.6.2.3, titled “Use of Full Control Inputs,” the
manual reads:
“Flight control forces become less effective when the airplane is at or near its critical
angle of attack or stall. Therefore, pilots must be prepared to use full control authority,
when necessary. The tendency is for pilots not to use full control authority because they
rarely are required to do this. This habit must be overcome when recovering from severe
upsets.”
No limitations to rudder use or any prescribed intended rudder use were mentioned in
either publication, nor were any rudder qualifications published in the FCOM.
In Mr. Rockliffe’s testimony at the public hearing, he states a completely different use of
the rudder:
24
“I think that we need to be clear and -- well, we need to be clear that aileron and normal
roll control is -- is through ailerons and roll spoilers conducted through the yoke or in
the side stick, depending on the type of airplane. And rudder is not a primary flight
control to induce roll under any circumstance unless normal roll control is not
functional. So the consequence of that is that the ailerons, whether you're in cruise or
whether you're elsewhere in the flight envelope, at a much slower or higher angle of
attack, ailerons and roll spoilers would continue to be your normal, usual roll control.
Rudder, on the other hand, is used to control the yaw. It's -- it's used to zero side slip. Mr.
Chatrenet spoke to it, I think, quite well, that for thrust asymmetry or drag asymmetry,
whatever the cause, if you have a yaw condition or a side slip condition, the rudder is
dimensioned and it is there to zero it out, for the pilot to apply rudder so that you end up
with this zero or reduced loading. And that's throughout the entire envelope” (243).
This confusing and obtuse statement from the Airbus Services’ Flight Training Director
is an unmistakable example of the manufacturer’s failure to provide clear guidance on the
use of the rudder in the A300.
Mr. Jacob, an Airbus test pilot, testified more directly at the public hearing. He
definitively states limitations to the rudder that were unknown to the operators:
“Yaw mode—I have to go back to what the rudder is designed for on a transport category
airplane. A rudder is there to steer the airplane during takeoff and landing roll, to decrab
in case of a crosswind landing, and to zero out any thrust or yaw asymmetry that
might occur” (527).
Both Mr. Rockliffe and Mr. Jacob qualify the use of the rudder dramatically when their
company had previously extolled the full use of all flight controls. Yet, while Mr.
Rockliffe testified about rudder limitations, and Mr. Jacob specifically delineated what a
rudder may be used for, Airbus did not publish these limitations until they issued an
FCOM Bulletin in March 2002. For years operators had apparently been operating the
A300 without proper guidance on flight control usage.
The FAA issued Type Certificates for the A300 family of aircraft stating, “This Data
Sheet which is part of Type Certificate No. A35EU prescribes conditions and limitations
under which the product for which the Type Certificate was issued meets the
airworthiness requirements of the Federal Aviation Regulations.” It is unknown whether
Airbus shared their hidden flight control limitations with the FAA when the airplanes
were certified. However, it can be definitively stated that hidden flight control limitations
and intentions do not meet the airworthiness requirements of the Federal Aviation
Regulations (FARs).
3. Maneuvering Speed
For many years, a great disservice has been done to pilots by the definition of
maneuvering speed’ (Va). The FAA is the defining authority for aviation regulation and
training in the United States. Their most basic training aid, FAA AC-61-23C: The-Pilot’s
25
Handbook of Aeronautical Knowledge, defines ‘maneuvering speed’ erroneously. The
AC states that:
“The maximum speed at which an airplane can be safely stalled is the design
maneuvering speed. The design maneuvering speed is a valuable reference point for the
pilot. When operating below this speed, a damaging positive flight load should not be
produced because the airplane should stall before the load becomes excessive. Any
combination of flight control usage, including full deflection of the controls, or gust loads
created by turbulence should not create an excessive air load if the airplane is operated
below maneuvering speed.”
Certainly this leads pilots to believe that they cannot damage the aircraft structure when
maneuvering below Va. Unfortunately, we now know that this is not the case as AA 587
was operating well below the published maneuvering speed.
FAR 25.1583, Operating Limitations and Information, further reinforces this mistaken
concept. This regulation requires that the Va limitation be defined in the Flight Manual in
this manner:
“The maneuvering speed VA and a statement that full application of rudder and aileron
controls, as well as maneuvers that involve angles of attack near the stall, should be
confined to speeds below this value.”
No information contrary to this definition of Va was provided by the manufacturer. There
is, therefore, no way that American Airlines or its pilots could have known that an
unusual limitation existed for maneuvering the rudder of an A300 below Va.
NTSB IIC Robert Benzon acknowledged this deficiency in his public hearing testimony,
stating:
“Many pilot training programs do not include the information about the structural limits
for the rudder and vertical stabilizer on the airplanes pilots fly. Significantly full rudder
inputs, even at speeds below maneuvering speed, may result in structural loads that
exceed certification requirements” (31).
Unfortunately, it took a tragedy for these shortcomings to come to light. Maneuvering
speed is incorrectly defined by the FAA—leading the aviation community to incorrect
assumptions about the protections it affords.
4. Aircraft Separation Standards
The current three-class separation standards between aircraft are inadequate and present a
hazard to all aircraft operating today. These standards were developed using dated
information about aircraft vortices and have not been updated as aircraft weights
approach 1 million pounds. New testing of the “super-heavy” generation of aircraft must
be accomplished to mitigate the risk which grows as aircraft weights grow.
26
Many argue that simulations currently exist to accurately predict the wake vortices of
aircraft as they grow in size and change in their wing design. The Safety Board clearly
states in the response to Safety Recommendation A-94-043 that:
“The Safety Board has no evidence that the FAA/NASA wake vortex simulation has
sufficient validity to define risk in an actual wake environment. The Safety Board does
not believe that unvalidated [sic] theoretical evaluations should be used to justify
decreased safety margins such as exemptions to the weight classification system.”
The Board’s genuine concerns are further delineated in Safety Recommendation A-95-
056. This recommendation would require manufacturers “to determine, by flight test or
other suitable means, the characteristics of the airplane’s wake vortex during
certification.” This recommendation’s status is “Open/Unacceptable Response.” The
FAA justifies its classification of new aircraft within the existing separation standards by
citing the safety record established by those standards. This weak argument was defeated
when AA 587 encountered a wake of unknown intensity.
The Board concludes the open recommendation with the statement:
“By testing all new aircraft, the FAA would know how they compare to existing aircraft
and would be able to scientifically determine what adjustments to separation distances
may be necessary. The Board continues to believe that the FAA needs to determine the
characteristics of all transport-category airplanes’ wake vortices during certification.”
The NTSB has shown valid concerns about the wake vortices emanating from new
“super-heavy” aircraft. It is time for the FAA to acknowledge those concerns and act. AA
587 encountered the wake from a 747-400. The wake vortices from this late model 747
have never been measured and are virtually unknown in strength. New separation
standards must be established to protect all aircraft operating in the National Airspace
System (NAS) from this unknown threat which will continue to propagate as aircraft
continue to grow.
Safety Recommendation 8
The NTSB should recommend that the FAA Office of System Safety
(OSS) review the findings of the AA 587 investigation to determine
why these system safety failure s occurred. This effort should include a
team of qualified individuals from industry and government,
including representatives of the French DGAC and FAA certification
officials. The stated goal of the review should be to identify and
understand the system safety failures so as to prevent, if possible, the
re-occurrence of a tragedy like AA 587.
27
Safety Recommendation 9
Safety Recommendation 10
The NTSB should recommend that the FAA more specifically define
the definition of ‘maneuvering speed,’ as it pertains to all categories of
aircraft and, in so doing, clearly outline the differences of assumptions
as they apply to the three primary flight control surfaces. All
manufacturers’ flight manuals and other associated documents for
airplanes certified in or imported into the United States accordingly
should also be revised to reflect the proper meaning and use of the
term ‘maneuvering speed.’
The NTSB should recommend a much more aggressive compliance of
system safety practices as outlined in the FAA System Safety
Handbook. The Assistant Administrator of System Safety (ASY) and
office staff should be empowered to act as an independent technical
authority to ensure system safety practices are used through the life
cycle of the various systems receiving FAA approval or certification.
The NTSB should revise Safety Recommendation A-96-64 to the FAA,
re-emphasizing the pertinence of the recommendation to aviation
safety. This recommendation resulted from the 1994 Roselawn,
Indiana, accident and now directly applies to this accident. The
recommendation states, “Establish policies and procedures to ensure
that all pertinent information is received, including the
manufacturer’s analysis of incidents, accidents or other airworthiness
issues, from the exporting country’s airworthiness authority so that
the FAA can monitor and ensure the continued airworthiness of
airplanes certified under the Bilateral Airworthiness Agreement.”
28
Safety Recommendation 11
The NTSB should recommend the various governmental agencies
responsible for the bilateral agreements which allow foreign
manufacturers to qualify for U.S. certification form a team to review
the aircraft certification process. Emphasis should be placed on
ensuring that the standards of 14 CFR Part 25 are met fully prior to
certification consideration.
29
4. SUMMATION
Airbus designed and produced the A300B2-1A in 1971. Eleven years later, Airbus
redesigned the rudder control unit in a new model called the A300B4-600. This unique
design dramatically changed the handling characteristics of the airplane. Airbus did not
rely on a verifiable test process to identify any undesirable flight control characteristics
when modifying the rudder system. After ten years of in-service high- load events, Airbus
had knowledge that there may be a flaw in the A300. They then had a chance to fix the
flaw before it resulted in a catastrophic event.
Contrary to the BASA, Airbus chose not to inform the aviation industry of this flaw. In
fact, Airbus published guidance encouraging use of “whatever authority is required of the
flight controls” (Dempster 12). They withheld information from the aviation community
when, after participating in a full NTSB investigatio n, they failed to inform American
Airlines and the NTSB that airplane N90070 had exceeded ultimate load in a 1997 event.
That airplane continued to fly with a damaged tail until it was replaced in late 2002.
Airbus had five years in which to notify the NTSB, FAA, DGAC, or American Airlines
of the flaw but chose not to inform anyone until this accident forced the disclosure.
The pilots operating the accident airplane were highly-skilled, fully-qualified, proficient
aviators who were never informed of the unusual limitations of their airplane. They were
trained in an FAA-approved training program though the FAA misinformed them that
they could use full authority of the flight controls below maneuvering speed (Va). The
pilots took off with the FAA-established minimum wake turbulence separation distances.
Unbeknownst to them, those distances were based upon conjecture and outdated data.
When the pilots encountered a wake vortex of unknown strength, they applied flight
controls which were appropriate for their situation. While they did not exceed any
limitations, violate any procedures, or perform unusually in any manner, their aircraft
suffered catastrophic structural failure.
30
WORKS CITED
Airplane Upset Recovery Training Aid. Monteil, Christian. Letter. France. Airbus
Industrie, 1998.
Dempster, Denis, and Leslie Nichols, eds. Aerodynamic Principles of Large-Airplane
Upsets. Spec. issue of Airbus Technical Digest (June 1998).
National Research Council. Aviation Safety and Pilot Control: Understanding and
Preventing Unfavorable Pilot-Vehicle Interactions. Washington. National
Academy Press, 1997.
United States. National Transportation Safety Board. Official Docket 32764 on American
Airlines Flight 587 Accident NTSB Identification: DCA02MA001. Washington.
GPO, 2002.
---. ---. Public Hearing on American Airlines Flight 587 Accident NTSB Identification:
DCA02MA001.Washington. GPO, 2003.
---. Federal Aviation Administration. System Safety Handbook. Washington. GPO, 2000.
---. National Archives and Records Administration. Code of Federal Regulations.
Washington. GPO, 2004.
Wake Turbulence Training Aid. Washington. GPO, 1995.
31
LIST OF SAFETY RECOMMENDATIONS
1. The NTSB should recommend that the FAA require evaluation of all aircraft
operating under U.S. type certification by FAA Handling Qualities Rating Method
(HQRM) or equivalent.
2. The NTSB should recommend that the FAA and French DGAC form an Engineering
Evaluation Team to work with Airbus and the operators of the A310/A300-600 to
determine whether pilot training alone is an adequate remedy to the undesirable Flight
Control System (FCS) characteristics of these aircraft, or if an FCS modification is
also required.
3. The NTSB should recommend that the FAA reexamine the validity of current ATC
wake turbulence separation standards. Focus of the review should be on the standards
for the wide range of “heavy” airplanes currently in operation, and for larger aircraft,
such as the Airbus A380 coming in the near future. This examination should include
new technology and should study proposals for improving controller training and
understanding of wake vortices, including variables such as relative wind,
atmospheric stability, and ATC vectoring.
4. The NTSB should recommend that the FAA comply with open Safety
Recommendation A-94-056 which states, “Require manufacturers of turbojet,
transport category airplanes to determine, by flight test or other suitable means, the
characteristics of the airplanes’ wake vortices during certification environment.”
5. The NTSB should recommend installation of unfiltered, high sample rate DFDRs in
all transport category aircraft. Further, the NTSB should recommend that a detailed
analysis of operational data from those aircraft with reports of unexpected
performance variances be made available as part of Service Difficulty Reports
(SDRs) required of aircraft manufacturers.
6. The NTSB should recommend that the French DGAC require Airbus to develop
formal training for all operators of the A310 and A300-600 similar to that developed
by American for its A300-600 pilots. This airplane-specific training should go beyond
NTSB Safety Recommendation A-02-01 and focus on: (1) the unusually sensitive
rudder; (2) the yaw damper design; (3) the limited capability of the RTLU to
compensate for acceleration; and (4) the unique APC susceptibility of the A300-600
and the A310. Training should recognize that the piloting techniques used when
flying other transport category airplanes may not safely transfer when transitioning
from those airplanes to the A310/A300-600.
7. The NTSB should recommend that the FAA require manufacturers of transport
category airplanes either manufactured in or imported into the United States develop
FAA-approved advanced maneuver training programs, including specific
32
documentation and guidance for classroom and simulator training specific to each
airplane.
8. The NTSB should recommend that the FAA Office of System Safety (OSS) review
the findings of the AA 587 investigation to determine why these system safety
failures occurred. This effort should include a team of qualified individuals from
industry and government, including representatives of the French DGAC and FAA
certification officials. The stated goal of the review should be to identify and
understand the system safety failures so as to prevent, if possible, the re-occurrence of
a tragedy like AA 587.
9. The NTSB should recommend that the FAA more specifically define the definition of
‘maneuvering speed,’ as it pertains to all categories of aircraft and, in so doing,
clearly outline the differences of assumptions as they apply to the three primary flight
control surfaces. All manufacturers’ flight manuals and other associated documents
for airplanes certified in or imported into the United States accordingly should also be
revised to reflect the proper meaning and use of the term ‘maneuvering speed.’
10. The NTSB should recommend a much more aggressive compliance of system safety
practices as outlined in the FAA System Safety Handbook. The Assistant
Administrator of System Safety (ASY) and office staff should be empowered to act as
an independent technical authority to ensure system safety practices are used through
the life cycle of the various systems receiving FAA approval or certification. The
NTSB should revise Safety Recommendation A-96-64 to the FAA, re-emphasizing
the pertinence of the recommendation to aviation safety. This recommendation
resulted from the 1994 Roselawn, Indiana, accident and now directly applies to this
accident. The recommendation states, “Establish policies and procedures to ensure
that all pertinent information is received, including the manufacturer’s analysis of
incidents, accidents or other airworthiness issues, from the exporting country’s
airworthiness authority so that the FAA can monitor and ensure the continued
airworthiness of airplanes certified under the Bilateral Airworthiness Agreement.”
11. The NTSB should recommend the various governmental agencies responsible for the
bilateral agreements which allow foreign manufacturers to qualify for U.S.
certification form a team to review the aircraft certification process. Emphasis should
be placed on ensuring that the standards of 14 CFR Part 25 are met fully prior to
certification consideration.