American Airlines Flight 587

Date

12 November 2001

Phase of flight

Climb

Location

Belle Harbor, New York, United States

Aircraft

Airbus A300-605R (A300B4-605R)

Registration

N14053

Operator

American Airlines

Flight

American Airlines 587

Occupants

260

Fatalities

265260 on board and 5 on the ground

Investigating body

National Transportation Safety Board (United States)

Final report

NTSB/AAR-04/04

Report date

26 October 2004

Report title

In-Flight Separation of Vertical Stabilizer, American Airlines Flight 587, Airbus Industrie A300-605R, N14053, Belle Harbor, New York, November 12, 2001

On 12 November 2001, about 09:16 eastern standard time (local time), American Airlines Flight 587, an Airbus A300-605R registered N14053, crashed into a residential area of Belle Harbor, New York, shortly after take-off from John F. Kennedy International Airport (JFK). Its vertical stabiliser and rudder had separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage. Both engines also separated before impact. All 260 people on board and 5 people on the ground were killed.

The aircraft had flown twice through the wake of a Boeing 747 that departed ahead of it, but neither encounter placed it in an upset. The National Transportation Safety Board (NTSB) found that the first officer, the pilot flying, answered the second encounter with a series of full, alternating rudder pedal inputs, and that the sideslip they built up loaded the fin to about twice its certified limit load.

The accident changed what pilots are taught about the rudder at high speed, about what the design manoeuvring speed protects, and about upset training that misrepresents the aircraft.

The flight

Flight 587 was a scheduled passenger flight under 14 CFR Part 121 from JFK to Santo Domingo, Dominican Republic, on an instrument flight rules flight plan in visual meteorological conditions. On board were 2 flight crew members, 7 flight attendants and 251 passengers.

The captain, aged 42, had about 8,050 hours, including 1,723 hours as an A300 pilot-in-command. The first officer, aged 34, had about 4,403 hours, including 1,835 hours as an A300 second-in-command, and was the pilot flying. The NTSB found both properly certificated and qualified, and fatigue was not a factor. The aircraft, delivered new to American Airlines in July 1988, had flown 37,550 hours and took off at 349,370 lb, within its limits. A fault in the No. 2 flight augmentation computer before departure cleared after a circuit breaker reset, and the NTSB found the aircraft properly maintained and dispatched.

During the taxi the first officer checked the rudder, pushing the pedals to about 3.7 in right and 3.6 in left. That figure matters later: the A300-600's pedals travel 4 in at low speed, but much less at high speed.

The accident

Flight 587 followed Japan Air Lines Flight 47, a Boeing 747-400, to runway 31L, and the tower cautioned the crew about wake turbulence. Before take-off the first officer asked the captain whether he was happy with the spacing, and the captain said he was. Flight 587 lifted off about 1 minute 40 seconds after the 747. The two aircraft were always at least 4.3 NM apart horizontally and 3,800 ft vertically, and the NTSB found that the controller complied with the FAA's wake turbulence spacing requirements.

At 0915:36, climbing through about 1,700 ft with the wings about level after the initial left turn, the aircraft met the first wake: a brief 0.3 g drop in normal load factor, typical of a minor encounter. The first officer moved the control wheel rapidly right and left several times, up to 37° right and 34° left.

The second encounter came at 0915:51, in a 23° left bank at about 2,300 ft, with the normal load factor dipping from 1.0 to 0.6 g. The first officer moved the wheel to 64° right and, unlike the first time, pressed the right rudder pedal. Over the next 6.5 seconds he made five more alternating rudder pedal inputs while the wheel swung between full left and 64° right. The captain asked, "you all right?" and told him to "hang onto it". The airspeed was about 240 kt, and sideslip grew with each reversal.

When the fitting fractured, the rudder was about 10° to 11° right and the sideslip about 11° to 12° right. Without its fin the aircraft could not be controlled, and the engines separated during the descent. The captain did not take control; the NTSB judged this understandable, because the sequence was short, he appeared to believe the wake was causing the motion, and he could not easily have seen the pedal inputs.

The investigation

The fin failed in overstress

The fin is a carbon fibre reinforced plastic torque box attached by three pairs of main attachment fittings and three pairs of transverse load fittings. Investigators found no fatigue and no pre-existing damage. The main lugs failed in overstress, the right rear lug first. The NTSB's performance study showed that the fin carried about twice its limit load when it broke. Limit load is the largest load expected in service; ultimate load is limit load multiplied by a safety factor of 1.5. The fin had therefore gone beyond its ultimate design envelope, and the NTSB concluded that it had performed as designed and certified.

Who moved the rudder

The FDR's rudder position data had been filtered, so investigators reconstructed the rudder angles. Ground tests on another A300-600 showed that yaw damper or autopilot commands could not reproduce the recorded traces; only pilot pedal inputs could. The NTSB also found that if the first officer had stopped the inputs at any time before the fin broke, the aircraft's natural stability would have returned the sideslip to near zero.

How the rudder rolls a swept-wing jet

A rudder input first yaws the aircraft and creates sideslip; through the dihedral effect of the swept wing, the sideslip then produces a rolling moment, so roll lags the pedal. An abrupt input also causes overswing, a sideslip briefly larger than the steady value. Because the rolling moment follows the sideslip, the aircraft can keep rolling one way after the rudder has been reversed, and reversing the rudder while the sideslip is still large adds the two loads on the fin. The NTSB found these effects outside most line pilots' experience, because they use large rudder deflections mainly at low speed, after an engine failure or in a crosswind. See primary flight controls.

A sensitive rudder at high speed

The rudder travel limiter reduces the maximum rudder deflection from 30° at 165 kt and below to 3.5° at 395 kt and above, and to 9.3° at 250 kt. The earlier A300B2 and B4 used a variable ratio limiter: full pedal travel was always available but commanded less rudder as speed rose. The A300-600 uses a variable stop, which limits the pedal travel itself, so less travel and less force are needed to reach full available rudder as speed increases. Airbus had also lightened the pedal forces.

The NTSB found the A300-600 twice as responsive to a pedal displacement at 250 KCAS as at 165 KCAS, with the lightest pedal forces of all the transport aircraft it evaluated. At 240 kt the pedal reached its stop with about 30% of the travel needed in the ground check, so the first officer may have believed he was using a fraction of the rudder authority when he was using all of it. Airbus estimated his highest pedal force at about 140 lb, against about 30 lb needed to reach the limit. The NTSB found his inputs consistent with overriding the yaw damper at the rudder limit; without that, the yaw damper would have lessened, though not prevented, the build-up of sideslip.

Training and the first officer's history

The NTSB found that the first officer tended to overreact to wake turbulence. The captain of a Boeing 727 flight in 1997 recalled that the first officer had answered a momentary wake encounter with rapid, alternating full rudder inputs, and had then told him that American's Advanced Aircraft Maneuvering Program (AAMP) directed him to use the rudder that way.

The AAMP ground school encouraged rudder use to help control roll during upsets, including wake encounters. Its excessive bank angle simulator exercise placed pilots behind a heavy 747, rolled the aircraft about 10° one way and then beyond 90° the other, and inhibited the ailerons and rudder until 10 seconds had passed or 50° of bank was reached, without the pilots knowing. The NTSB found that the exercise could exaggerate the effects of wake turbulence and teach control strategies that would produce a very different and confusing response in a real aircraft.

The Board also found a widespread misunderstanding among pilots about how much structural protection flying below the design manoeuvring speed (VA) gives against full or abrupt control inputs; an American Airlines manager said that most of its pilots believed alternating full rudder inputs below VA could not damage the aircraft. It analysed the sequence as an adverse aircraft-pilot coupling: an environmental trigger, the wake, followed by high-gain pilot inputs that a light, short-travel pedal made easy to sustain.

Probable cause and contributing factors

The NTSB determined that the probable cause of the accident was "the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer's unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program."

The staff draft had listed the training programme as the first contributing factor; the Vice Chairman's revision reversed the order, and Members Carmody and Healing voted against it. Member Carmody wrote that the investigation had found no unusual rudder use by the first officer before his AAMP training.

Safety recommendations and what changed

On 16 November 2001 the FAA and the French Direction Générale de l'Aviation Civile (DGAC) issued emergency Airworthiness Directive 2001-23-51, requiring a one-time inspection of the fin and rudder attachments of A300-600 and A310 aircraft within 15 days. A later directive, AD 2002-06-09, required inspections after any lateral load factor of 0.3 g or more.

On 8 February 2002 the NTSB recommended (A-02-01 and -02) that pilots be taught that a full rudder deflection followed by a full deflection the other way, or certain combinations of sideslip and opposite rudder, can produce dangerous loads even below VA, and that on some aircraft full rudder is available at high speed with light forces and small pedal travel. Later recommendations covered load thresholds after extreme manoeuvres (A-03-41 to -44) and flight data recorders that capture each parameter's full dynamic motion (A-03-50).

The final report recommended that the FAA:

• create a certification standard for handling qualities in the yaw axis, including limits on rudder pedal sensitivity, and review existing designs against it (A-04-56, -57);
• review ways to modify the A300-600 and A310 for more protection against hazardous rudder inputs at high speed (A-04-58, and A-04-63 to the DGAC);
• tell pilots that multiple full, alternating control inputs should not be necessary to control a transport aeroplane (A-04-59);
• clarify that flying at or below VA gives no protection against multiple full inputs in one axis or full inputs in several axes at once (A-04-60);
• publish guidance for upset recovery training that avoids negative training (A-04-61, -62).

In early 2003 American Airlines gave every A300 pilot classroom training on the rudder system, including the rule that a control input producing unexpected motion should be neutralised until the aircraft stabilises. The industry Airplane Upset Recovery Training Aid was revised after the accident to state: "There is no situation that will require rapid full-scale control deflections from one side to the other."

Lessons for pilots

A wake encounter is usually brief. The NTSB knew of no accident in which a heavy transport aeroplane had departed controlled flight because of wake turbulence. Counter the roll with prompt, proportionate aileron; do not race to full deflection. See wake turbulence.

The rudder is not a roll control in a transport aeroplane. Airbus told the public hearing that the rudder is not a primary control for inducing roll unless normal roll control is not functional. It rolls the aircraft only through sideslip, with a lag, and large inputs at high speed produce side loads and rolling moments that a pilot can mistake for an external disturbance.

Know your rudder limiter. With a variable ratio limiter the pedal travel stays the same and the rudder authority shrinks; with a variable stop the pedal travel itself shrinks, so full available rudder may need only a small, light push at high speed.

Monitor and intervene. Repeated full wheel movements and strong side loads are cues that the pilot flying is overcontrolling. A clear call to stop the inputs, or a transfer of control, can break the cycle.

Training must be realistic. An exercise that suppresses control effectiveness teaches that big inputs are needed and that the aircraft does not answer them. The NTSB asked for upset training built on best practice and free of negative training; see upset prevention and recovery. Other losses of control in this section include Air France 447.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.