91av

ON 12 November 2001, the tail fin and rudder of American Airlines flight 587 broke off shortly after the plane had taken off from John F. Kennedy airport in New York. The Airbus A300-600 plunged to earth, killing all 260 people on board plus five on the ground.

Three years after the crash, investigators from the US National Transportation Safety Board (NTSB) said last week that the tail failed because the pilot – the first officer – had used the controls with unnecessary force. But the investigators’ detailed findings, released after their final meeting on 26 October, also suggest how the pilot may have been misled into making such a disastrous mistake. This may have broad implications for the way aircraft and their control systems are designed and how they are simulated in pilot training.

The NTSB concluded that the aerodynamic loads on the tail fin created by the pilot’s “unnecessary and excessive rudder pedal inputs” simply snapped it off the fuselage. The pilot was striving to recover from turbulence caused by a jumbo jet that had taken off ahead of it, and he had twice made full deflections of the rudder to left and right. The forces this imposed on the tail fin far exceeded all design limits (see “Tail material in the clear”).

The NTSB said that while the pilot’s colleagues provided generally positive comments about his flying, two pilots “noted incidents that showed that he had a tendency to overreact to wake turbulence encounters”. His use of the rudder on flight 587, the board said, was not an appropriate response to turbulence which flight recorder data showed was no danger to the stability of the aircraft.

How could this have happened? What the NTSB discovered is that the rudder system on the Airbus A300-600 had an operating limit that Airbus was well aware of but which most pilots and their trainers were not.

The main purpose of the rudder, a large hinged flap at the rear of the tail fin, is to steer the plane while taxiing. In flight it is used only on the rare occasions when one engine loses power or shuts down, when the rudder is needed to compensate for the asymmetric forces on the plane.

In some aircraft, such as smaller ones, rudders are also used in other abnormal or “upset” situations, such as when turbulence pushes it out of straight-and-level flight. Before the flight 587 crash, there was no reason to suspect that such action could lead to disaster with some types of aircraft. The NTSB says American Airlines trained its pilots to use the rudder to help regain control in some upset situations.

All aircraft have a specified “manoeuvring speed” above which vigorous inputs to the plane’s controls can damage the aircraft’s structure. Below that speed, the assumption is that use of the controls will be safe. “In small airplanes, that is true,” says John Hansman, an aeronautics expert at MIT in Boston. But the assumption is not true, it turns out, in the A300. Full application of the rudder at relatively low speed risks overloading the structure and causing damage (91av, 16 February 2002, p 7). Airbus is well aware of this, and says that pilots should never use the rudder to correct anything unless they are trying to cope with an engine failure. “It was not foreseen that it would be used for a purpose it was not intended for,” Airbus Industrie communications director Clay McConnell says.

But Hansman says that most pilots had no idea that was the case. “Before flight 587, if you queried pilots and asked ‘at low speeds, can you hurt the airplane by using the rudder,’ most people would have said no.” Now, he says, pilots are acutely aware of the possibility.

With flight 587, the problem was exacerbated by two other poorly communicated factors. In its A300-600 simulator training for dealing with upset situations, American Airlines would initially make the controls less responsive than normal. This was simply to ensure a dramatic deviation from normal level flight, to give the pilots practice in recovering from, for example, a heavy roll to one side. Because American didn’t explain this to the pilots, an unintended consequence of this way of initiating the event was to make pilots think they had to use the controls aggressively to get a correcting response. Human factors specialist Malcolm Brenner of the NTSB was scathing, calling this a case of “negative training” which could push pilots towards doing the wrong thing in a real plane.

“It became easier and easier to push the rudder to full deflection precisely when doing so became more dangerous”

This was compounded by the unusual characteristics of the A300-600’s rudder control pedals. Although most pilots never had a chance to experience it, as the plane’s speed increased, the pedals’ sensitivity increased too (see Graphic) and the pedal travel required to fully activate the rudder was reduced. In effect, it became easier and easier to push the rudder to full deflection precisely when doing so became more dangerous.

Airbus designed the plane this way to make it easier for the pilots to use the rudder to compensate for an engine failure – which they assumed would be its only use in flight. But that was not made clear to the pilots.

As with the Columbia space shuttle accident last year, it seems that information that could have prevented the loss was known by some people but did not make its way to others who needed to know it. And while the airline and the aircraft maker continue to blame each other, they and the NTSB seem to agree that part of the answer lies in better communications between all parties.

The board also called on the US Federal Aviation Administration (FAA) and the nascent EU body, the European Aviation Safety Agency (EASA), to begin laying down detailed rules about the responsiveness of aircraft controls across all aircraft types, to ensure that pilots always know what to expect in an emergency.