Despite Fatal Crash, Airbus Sees No Need To Change A300-600 Flight Control System

American Airlines upset recovery program challenged
The combination of a powerful system to move the rudder, sensitive pedals in the cockpit, upset recovery training, and a pilot who once had to be counseled about using excessive rudder, may have set the stage for the fatal Nov. 12, 2001, crash of American Airlines [AMR] Flight 587 in Belle Harbor, New York.

The final outcome of the accident postmortem, and its determination of probable cause, depends on the respective weights investigators give to these factors.

In National Transportation Safety Board (NTSB) hearings last week, an official from Airbus, manufacturer of the accident airplane, an A300-600, explained how the rudder control system was designed for delicate inputs to yield forceful outputs. The design met all certification standards in effect, and U.S. regulatory officials testified that the manufacturer even went beyond the minimum requirements to certify the design of the A300-600, a derivative of the A300-B2B4.

For their part, American Airlines officials proclaimed their advanced maneuvering training program, instituted in response to a plague of loss-of-control accidents in the industry at large, did not predispose their pilots to be ham-footed on the rudder. Rather, they asserted that their training emphasized deliberate, progressive use of the rudder.

The fact-finding hearings were characterized by long periods of technical discussions punctuated by sharp exchanges between witnesses and the parties involved in the investigation. The parties included the manufacturer, the airline, and the Allied Pilots Association (APA), the union of American Airlines pilots. The Federal Aviation Administration (FAA) delegation, representing the fourth party in the crash investigation, had the least to say during the course of the hearings, but the agency's certification standards for structures and flight control systems are also under the microscope.

The accident investigation is significant for the basic elements of the case. It represents the first fatal crash of an Airbus airplane in North America. It represents the first case of a primary composite structure, the tailfin, breaking off in flight. It involves complex, subtle and yet significant technical issues regarding aircraft control system design. Not least, it features a dramatic case of pilot-machine interaction that led in the space of some seven seconds from a quotidian encounter with the wake vortex of a preceding jet to a pall of black smoke marking the impact crater in a New York City neighborhood. The pilots seemed caught by surprise and perplexed about what to do.

Reconstructing the sequence of events is complicated by inadequate sampling rates of critical flight parameters and filtering of the data before it was captured on the digital flight data recorder (DFDR) - limiting characteristics that have dismayed NTSB investigators. And the dynamic maneuvers that were recorded on the DFDR had to be detuned, as it were, for use in a vertical motion simulator. The device was drafted into service as part of the investigators' effort to assess how the airplane's final movements might have felt in the cockpit.

The investigation is challenging; the implications for future aircraft design and for pilot training are significant.

For Airbus, proud of its leading-edge technology, it would be a major blow if investigators were to conclude that the rudder control system and its sensitive pedals set the stage for an unsuspecting pilot to apply loads sufficient to break the tail off the airplane. For American Airlines, it would be embarrassing if its upset training program was found to predispose pilots to use excessive rudder. The FAA may stand above it all, but not beyond accounting. Its role in setting design standards, its involvement in American's upset recovery training program, and its granting Airbus relief from tightened DFDR standards, raise obvious issues of oversight.

About 1,000 pages of background material was released. This material will be mined and portions of particular significance will be presented in future ASW issues. In the meantime, highlights of each day's proceedings are covered below in the form of a daily diary. These notes are not meant to be exhaustive but merely to capture the tone of the proceedings and to touch upon some of the major issues at hand:

Day 1 - The Rudder Control System Under Scrutiny
Metaphorically speaking, shots were fired today. Various participants in the investigation seized the opportunity to air their disappointments and contentions. About five minutes into his presentation, Bob Benzon, the NTSB investigator in charge of the Flight 587 accident inquiry, took a swipe at the inadequate sampling rate and data filtering featured in the doomed airplane's DFDR:

"The analysis of the flight data recorder, a vital tool in accident investigation, was much more difficult than it needed to be, because signals for some FDR parameters on the accident aircraft were electronically 'filtered' before they reached the flight recorder.

"As a result, the readings on the recorder show what the gauges were telling the pilots, not necessarily what was actually occurring on a real-time basis to the aircraft.

"In 1994, the Safety Board recommended to the FAA that such filtering systems be removed from information sent to flight data recorders, and yet in 2001 this investigation was hampered by totally unacceptable filtering of FDR data. In addition, the sample rates of data are not adequate."

Benzon was reiterating concerns expressed by then-NTSB Chair Marion Blakey in a Feb. 6 letter to the FAA, in which she said she was "surprised and disappointed" by the discovery of filtered data on the Flight 587 accident airplane's DFDR (see ASW, Aug. 5).

If the NTSB was taken aback by the sampling rate found early in the Flight 587 accident investigation, there is evidence suggesting this discovery should not have come as a surprise to the NTSB. Effective Aug. 17, 2001, the FAA issued a final rule on flight recorder requirements. The core document is Appendix M, which spells out the accuracy and sampling intervals for each of the 88 required DFDR parameters (see ASW, Aug 19).

One section of that final ruling clearly shows that the NTSB was consulted about Airbus' request for relief:

"Appendix M reflects tightened range, accuracy, sampling interval, and resolution requirements to reflect the performance expected of new technologies.

"After we issued the revised [DFDR] regulations ... the FAA received several communications from Airbus Industrie indicating that in order to comply with the new DFDR recording requirements of Appendix M, several of its airplane models would have to undergo major equipment retrofits, a circumstance that the rule explicitly tried to avoid. Airbus states that although the DFDRs in its airplanes recorded the required parameters, some of the resolution and sampling intervals for certain parameters differed slightly from those required by Appendix M [emphasis added].

"Airbus had noted these differences in its comment to the notice of proposed rulemaking, but the comment was not fully addressed in the preamble to the final rule. After consulting with the NTSB, the FAA determined that changes to Appendix M were an appropriate means to account for the differences in Airbus DFDR equipment. These changes were adopted in 1999 and 2000, before the requirements for those airplanes took effect, by adding footnotes to the affected parameters in Appendix M. The footnotes specify slightly different standards for certain parameters of specified Airbus airplanes."

Indeed, Appendix M contains 17 footnotes outlining exemptions from the more rigorous DFDR standards; those exemptions cover virtually the entire Airbus product line, including the A300-600.

As one source observed, if there was any ducking and weaving concerning the new DFDR standards, the NTSB had been advised and had approved exemptions allowing the Airbus DFDR sampling rate situation to remain unchanged.

In this respect, the documentary record may not support Benzon's charge.

Most of the first day's discussion was taken up by the testimony of senior Airbus engineers responsible for flight control system design. They, too, came under fire. After explaining the design of the rudder control system on the A300-600, they found themselves having to defend it.

Dominique Chatrenet, Airbus vice president of flight controls and hydraulic systems engineering, said the flight controls were designed to produce a "consistent harmony in the pitch and roll axis." That is, the same amount of "input" on the control yoke would produce the same amount of control system "output" in these two axes.

Prior to the hearings, American Airlines officials had fretted about the lack of harmony, saying that very slight "input" movement on the rudder pedals created a great deal of rudder movement, much more so than similar movements of the control yoke for pitch and roll. Chatrenet was taken to task on this matter. Tim Ahearn, American's vice president for safety, security and environment, challenged Chatrenet directly, saying, "There really isn't control harmony."

Chatrenet replied, "That's correct at 165 knots, but not at higher speed." He added that the flight control system had been thoroughly tested at 250 knots, the speed at which control was lost on the accident aircraft. Regarding the slight displacement of the rudder pedals, just 1.3 inches of movement to produce 10 degrees of rudder deflection Chatrenet said, "We never had any complaints" from the test pilots.

Capt. Don Pitts, APA safety committee chairman, asked: Were any changes made to the rudder system after the plane went into service? After all, Pitts pointed out, the A300-600 had a reputation for fishtailing, in which the tail would yaw noticeably.

Chatrenet replied that, yes, modifications had been made to mitigate the fishtailing phenomenon, but these modifications had been stimulated by comments from customer airlines. The changes were not made, Chatrenet insisted, in response to pilots' desires for improvements to the airplane's handling qualities.

Nonetheless, the potential for slight rudder pedal movement or force to generate considerable rudder deflection was a subject of intense discussion. The DFDR traces of the accident aircraft show considerable movement of the rudder pedals, followed by deflection of the rudder. This offset suggests that the pilots moved the pedals as they encountered the second wake vortex from the preceding B747-400.

The 1.3-inch maximum pedal movement at the 250-knot speed at which the upset occurred, "by itself, doesn't matter a lot," Chatrenet said. "We could cut it in half and not affect the pilot's ability to precisely control the aircraft."

And, in terms of the 22-pound breakout force needed to start the pedals moving, that threshold "is pretty appropriate for precise piloting," Chatrenet asserted. "Precision is actually more possible with light control forces," he added. Indeed, some pilots at the hearing agreed with this point, recalling that other aircraft they have flown with light control forces were easier on the pilot and easier to control.

However, the A300-600 was designed so that pilots would not need to use the rudder flying through turbulence, Chatrenet said. Since the DFDR shows rudder pedal movement in the moments before the tail snapped off, Chatrenet's observation suggested that the pilots responded inappropriately to the wake encounter. "In turbulent air, there is no need for the pilot to apply the rudder," Chatrenet said.

"We designed the yaw damper so there is no need for the pilot to fly on the rudder pedals," he added. And without the yaw damper, Chatrenet went on to say, pilots should use the "control wheel only."

"The use of the rudder for roll control is unnecessary," he said, pointing out that pilots have bank authority of some 30 degrees per second at 250 knots - plenty to move the wings level without having to resort to the rudder.

Given the importance of the yaw damper, it may be significant that when forces of 110 pounds or more are applied to the rudder pedals, the countervailing force of the yaw damper can be cancelled out. As an NTSB official explained, on the Boeing [BA] B767, a twinjet roughly comparable to the A300-600, the yaw damper "is always working; it never drops off line." As a consequence, this official said, the aerodynamic loads on the tailfin are less.

American's Tim Ahern pointed to features, some of which are found on other aircraft, that provide varying degrees of protection against excessive rudder movement. These features include yaw dampers that cannot be overridden, hinge moment restriction, also known as "blowdown" to describe the restraining force of the airflow on rudder displacement, and hydraulic restrictors.

"This appears to me to be the only aircraft of this type to experience doublets or triplets exceeding ultimate load," Ahern asserted. Doublets and triplets are rapid back-and- forth movements of the rudder. Ultimate load is the point at which the 50 percent safety factor added to the design limit load and at which the structure, under great stress, will deform to the point where it will not return to its original shape after the force on it is relieved.

In response to Ahern's point, John Lauber, Airbus vice president of safety for North America, asked Chatrenet, "Can any of those systems help prevent the dynamic build-up of side loads?"

"No, I don't think so," he replied. "Even with very small rudder deflection[s] we'd get a large buildup."

Day 2 - Pilot Training Under Scrutiny
American Airlines went on the offensive. The thrust of its effort was to establish that its pilots were trained to modestly apply rudder only when necessary, not to snap it reflexively to full deflection in an upset situation.

Capt. Delvin Young, flight standards manager for the A300 fleet, outlined American's advanced maneuvering program, designated by the acronym AAMP.

"AAMP is not turbulence recovery training," Young emphasized. Rather, the program was designed for upset training, in which pilots might find themselves in a situation where the nose is more than 15� nose-up, or more than 10� nose-down, and the bank angle is more than 45�, he said.

None of these conditions applied when Flight 587 encountered the wake vortex from the Japan Air Lines B747-400 flying ahead of it.

Young explained that ailerons and spoilers are the primary roll controls, but their effectiveness decreases at high angles of attack. In these conditions, the rudder can become an appropriate tool, since the yaw it induces translates into roll recovery. However, Young explained, "Rudder should only be used to make a coordinated roll to recover."

"We do not want to induce side slip," he said, adding, "The rudder is a powerful control surface that must be used prudently."

"Flight 587 was not in an AAMP upset until after the vertical fin separated from the aircraft," Young stressed. In other words, when the airplane penetrated the first and then the second wake vortex from the JAL jet, it was not in the nose up, down, or bank angles considered the starting point for AAMP training.

Moreover, he asserted, "AAMP has always taught pilots to respect the power of the rudder." To buttress his point, Young played film clips of actual AAMP classroom instruction, in which the pilot teaching the daylong course was shown presenting numerous caveats about rudder use. "Don't overcontrol with the rudder ... when the airplane is not responding to aileron and spoiler control, use smooth application of the rudder," the instructor cautioned.

First officer Sten Molin, who was the pilot flying for Flight 587, took the AAMP course in March 1997.

The basic message from American: the training did not predispose American Airlines pilots to mash on rudder pedals. Moreover, Young pointed to guidance issued by Airbus in March 2002, some four months after the crash, enjoining against use of the rudder in upset recovery. Such guidance had not been issued previously. Young pointed to another example where Airbus changed its tune. Prior to the accident, the Airbus guidance for dealing with landing gear not down and locked involved moving the rudder back and forth. After the crash, the guidance was changed to eliminate back-and-forth rudder movement. Rather, pilots were to deflect the rudder to one side, then return it to neutral before moving the rudder to the opposite side:

Before the Flight 587 crash: "If one gear remains unlocked, accelerate to Vmax [maximum maneuvering speed], perform turns to increase the load factor and perform alternating side slips in an attempt to lock the gear."
After the Flight 587 crash: "If one gear remains unlocked ... generate steady state side slip on one side. If the landing gear still does not lock, return the rudder to neutral and let the aircraft stabilize to equilibrium. Then, repeat the same maneuver on the other side."
Young added that the traditionally understood concept of maneuvering speed [Vmax, also VA] has been discussed intensely at American Airlines since the accident.

"What is your definition of maneuvering speed," asked NTSB professional staff member Capt. David Ivey.

Young replied, "Pilots are taught that below maneuvering speed you have full use of the controls with no danger structurally to the aircraft." In addition, he said that prior to the Flight 587 crash pilots believed that "the rudder limiter would protect them during any maneuvers below maneuvering speed."

It should be pointed out that at about 2,000 feet and a speed of 250 knots - the point at which the accident aircraft entered the wake vortices from the JAL jet - the accident A300-600 was a good 20 knots below maximum maneuvering speed, according to the operational parameters spelled out in Airbus' A300-600 flight manual. With respect to the design maneuvering speed, the manual said, "Full application of rudder and aileron controls, as well as maneuvers that involve angles of attack near the stall, should be confined to speeds below VA."

Thus, American officials proclaimed, their upset recovery training not only stressed coordinated use of the rudder, it did not apply to wake vortex encounters, and was based on the traditional concept of maneuvering speed and full control authority within that envelope.

Having seized what they thought was the high ground in the discussion, the American officials came under immediate counter fire.

For one thing, First Officer Molin had been counseled by Capt. John LaVelle after having used excessive rudder during a flight. LaVelle reported that Molin learned from the AAMP training about use of the rudder.

Young said, "I need to put the Capt. LaVelle thing in context. We spoke with several pilots who flew with Molin up to a month before the accident. There is no evidence that he [overcontrolled with the rudder] again."

Airbus' Lauber, a human factors expert before joining Airbus, asked Young if he was aware of the "law of primary."

Not quite, Young replied.

"It's that people tend to remember what they hear first," Lauber explained. Lauber was not-so-subtly intimating that if AAMP student pilots were being instructed to make sharp use of the rudder, they would more likely resort to this stratagem during an upset. Lauber pointed out that in one case the AAMP instruction sanctioned the use of full rudder deflection to snap roll the airplane out of an inverted position.

To the law of primary, Young retorted, "Pilots have a short attention span, so if you want them to remember, you better get it out first."

This quip generated laughter among all present, but Young walked right into Lauber's trap. Young's response was tantamount to admitting that Molin may have resorted unconsciously in the moment of extremis to his AAMP training.

Other aspects of American's AAMP also were challenged. The training wasn't related to wake vortex encounters, Young had asserted, but in every case the training started with a situation in which the airplane was following a B747. The student handouts showed airplanes rocked into sharp banks by wake vortex encounters. One illustration showed an airplane, following an MD-11, tossed by the trijet's wake vortex into a 120� bank (nearly inverted).

Young was asked if wake turbulence had ever hurled an A300 into a 120� angle of bank. No, he conceded.

Since the Flight 587 crash, American no longer uses a wake encounter as the setup for the upset recovery training they claimed had nothing to do with upset recovery. Now, simulator instructors simply fly the airplane into an unusual attitude - the student takes over from there.

To put the pilot in an unusual attitude, roll control was inhibited on the simulator for 5-10 seconds. Without roll control, the airplane would slip into a bank angle of as much as 30� per second.

Young explained, "Regardless of the airplane, we wanted to get [the pilot] to 90� angle of bank to teach them to push [the yoke] once they got beyond 90�."

John Clark, NTSB director of aviation accident investigations, asked, "If it takes 10 seconds [to get to 90�] doesn't that set you up to use a lot of roll and a lot of rudder?"

Young replied, "I don't think this preconditions the pilots to use full aileron and full rudder. Pilots do learn that the rudder can be used for roll control if the ailerons are not effective."

Lauber asked Guy Thiel, an FAA test pilot, what the pilot would do when roll control is inhibited.

"The pilot is going to try to stop the [banking] motion," Thiel replied. "If he goes to the stops on aileron, he might unload a little, then he'd have no choice but to use the rudder, and maybe all the way to the stops."

Lauber's question was tactically brilliant. It was another way of painting American's AAMP training as an exercise in the "law of primary," conditioning pilots to aggressively use the rudder.

American's Ahern attacked the sensitivity of the rudder control system. "In a dynamic event, how can the pilot apply the rudder without getting to full stop with only 10 pounds of force after breakout?" he asked. On the A300-600 rudder system, it takes just 22 pounds of force to overcome the pedals' resistance to movement, and less than half that force to move them.

Airbus experimental test pilot Captain Armand Jacob replied, "The airplane has been flown in turbulent conditions and found satisfactory."

Seizing the opportunity, Lauber asked, "Are the pilot's initial control responses consistent with AAMP?"

Jacob replied, "I believe they are consistent."

Young also asserted Airbus had been specifically invited to review American's AAMP training. Again, Lauber was prepared, pointing to a letter from American Airlines, which said simply that "on your next visit to our training academy" you are welcome to review the parameters employed in the simulators for upset recovery training.

If much of the American position was punctured by this sort of shrapnel, other officials provided modest reinforcements by expressing concerns about the airplane's sensitive rudder control system.

The NTSB's Malcolm Brenner brought up the relationship between pitch, roll and yaw controls, and how considerably less movement was needed on the rudder pedals than for equivalent control inputs on the yoke.

With respect to harmonizing the flight controls, Brenner said, "There isn't a harmony of distance. If the pilot doesn't know the relationship, isn't there a danger of inadvertently moving [the rudder] to full deflection?"

"Dramatic yoke and rudder movements were not necessary" to fly through the wake encounter, Jacob replied.

"No changes are being considered to the flight control system as a result of this accident," he added. "Upset recovery does not require simultaneous inputs in roll and yaw, therefore harmony is not an issue."

Brenner also questioned the relationship between the 22-pound breakout force to begin pedal movement, and the 10-pound force needed to keep them moving all the way to the stop. With respect to that 1.5-1.0 force ratio, Brenner asked what the regulations have to say.

"On the control side, you're limited to 150 pounds of force," explained Don Stimson, acting manager of the FAA's aircraft and flightcrew interface branch.

FAA test pilot Thiel added, "There is no standard ratio."

Regarding the 22 to 10-pound force ratio, Thiel added, "The average person would not stomp on the rudder, he'd add it gradually."

Privately, some pilots observing the hearings said the ratio and pedal movements are too close. One retired captain suggested that the breakout force should be 100 pounds or more, and the pedal movement should be at least six inches.

The Flight 587 crash featured four rudder movements in the opposite direction in seven seconds (e.g., two doublets, making the accident a "quadruplet" in the parlance of system design used during the hearings).

The NTSB's Clark asked Stimson, "If rudder reversals can take the plane past limit load, why are they not part of the certification requirement?"

Stimson replied that the certification standards address the "expected operational environment." Those requirements deal with controllability on one engine, controllability at minimum speeds, and enough control to make takeoffs and landings in a 20-knot crosswind.

Rapid back-and-forth rudder movement is "not a normal piloting maneuver," he said, which is why reversals (i.e., doublets), like spins and acrobatics, are not included in certification standards for transport-category aircraft.

From the tenor of the NTSB questioning, it is clear that investigators are concerned about the "sound of silence" in the certification standards about rapid rudder reversals. Presently the standards only require designers to demonstrate that the tailfin be strong enough to handle full rudder deflection in one direction, and then a return to the neutral position. The regulations do not address the now-demonstrated deadly potential for rapid back-and-forth movement of the rudder to snap the tailfin off the airplane.

"Can you fly the A300-600 without a tailfin?" asked the NTSB's Brenner.

"No," Airbus test pilot Jacob replied.