edited NTSB Text follows -- foot notes interrupt text:
This safety recommendation letter addresses an industry-wide safety issue involving omissions in pilot training on transport-category airplanes. Specifically, the National Transportation Safety Board has learned that many pilot training programs do not include information about the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes. Further, the Safety Board has learned that sequential full opposite rudder inputs (sometimes colloquially referred to as “rudder reversals” <img src="wink.gif" border="0"> —even at speeds below the design maneuvering speed1—may result in structural loads that exceed those addressed by the requirements. In fact, pilots may have the impression that the rudder limiter systems installed on most transport-category airplanes, which limit rudder travel as airspeed increases to prevent a single full rudder input from overloading the structure, also prevent sequential full opposite rudder deflections from damaging the structure. However, the structural. .certification requirements for transport-category airplanes do not take such maneuvers into account; therefore, such sequential opposite rudder inputs, even when a rudder limiter is in. .effect, can produce loads higher than those required for certification and that may exceed the. .structural capabilities of the aircraft.. .This safety issue was identified in connection with the Safety Board’s ongoing investigation of the November 12, 2001, accident involving American Airlines flight 587, an Airbus Industrie A300-600.2 Flight 587 was destroyed when it crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport (JFK), Jamaica, New York. Before impact, the vertical stabilizer and rudder separated from the fuselage.3 The 2 pilots, 7 flight attendants, 251 passengers, and 5 persons on the ground were 1 The design maneuvering airspeed is the maximum speed at which the structural design’s limit load can be imposed (either by gusts or full deflection of the control surfaces) without causing structural damage.. .2 Under the provisions of Annex 13 to the Convention on International Civil Aviation, the Bureau Enquêtes-Accidents and Airbus Industrie are participating in the Safety Board’s investigation of this accident as the Accredited Representative and technical Advisor, respectively, of the State of Design and Manufacture.. .3 The vertical stabilizer and rudder assemblies were found floating in the water about 0.7 mile from the main impact crater. The vertical stabilizer was largely intact with no significant damage, although some localized areas of. .2. .killed. Visual meteorological conditions prevailed and an instrument flight rules flight plan had been filed for the flight destined for Santo Domingo, Dominican Republic. The scheduled. .passenger flight was conducted under 14 Code of Federal Regulations (CFR) Part 121. The investigation is still examining many issues, including the adequacy of the certification standards for transport-category airplanes, the structural requirements and integrity of the vertical stabilizer and rudder, the operational status of the rudder system at the time of the. .accident, the adequacy of pilot training, and the role of pilot actions in the accident. It must be. .emphasized that, at this time, the Board has not yet determined the probable cause of the. .accident. Further, the Board is not aware of any prior events in which rudder movements have. .resulted in separation of a vertical stabilizer or rudder. Nonetheless, the investigation has. .revealed this safety issue, which should be immediately addressed. Before the separation of the vertical stabilizer and rudder, flight 587 twice experienced turbulence consistent with encountering wake vortices from a Boeing 747 that departed JFK ahead of the accident aircraft. The two airplanes were separated by about 5 (statute) miles and 90 seconds at the time of the vortex encounters. During and shortly after the second encounter, the flight data recorder (FDR) on the accident aircraft recorded several large rudder movements(and corresponding pedal movements) to full or nearly full available rudder deflection in one direction followed by full or nearly full available rudder deflection in the opposite direction.4. .The subsequent loss of reliable rudder position data is consistent with the vertical stabilizer. .separating from the airplane. The cause of the rudder movements is still under investigation.. .Among the potential causes being examined are rudder system malfunction, as well as flight. .crew action. Preliminary calculations by Safety Board and Airbus engineers show that large sideloads were likely present on the vertical stabilizer and rudder at the time they separated from the airplane. Calculations and simulations show that, at the time of the separation, the airplane was in an 8° to 10° airplane nose-left sideslip while the rudder was deflected 9.5° to the right. Airbus engineers have determined that this combination of local nose-left sideslip on the vertical stabilizer and right rudder deflection produced air loads on the vertical stabilizer that could exceed the airplane’s design loads. The Board notes that, at the time the vertical stabilizer and rudder separated from the airplane, the airplane was flying at 255 knots indicated airspeed (KIAS), which is significantly below the airplane’s design maneuvering speed of 273 KIAS. Transport-category airplanes certified by the Federal Aviation Administration (FAA)must meet the airworthiness standards in 14 CFR Part 25. Subpart C, pertaining to the airplane structure, includes Section 25.351, titled “Yaw maneuver conditions,” which requires that the damage were evident around the stabilizer-to-fuselage interface. At the lower end of the stabilizer, all of the attachment fittings were either fractured through the attachment hole or the stabilizer structure was fractured around. .the fittings. Portions of the closure rib and skin attach angle and front spar were also fractured from the stabilizer. Most of the rudder was separated from the vertical stabilizer except for portions of the rudder spar, which remained attached to the actuators and the upper hinge (no. 5 and 7).. .4 Preliminary information based on FDR data and an analysis of the manner in which rudder position data is filtered by the airplane’s systems indicates that within about 7 seconds, the rudder traveled 11° right for 0.5 second, 10.5° left for 0.3 second, between 11° and 10.5° right for about 2 seconds, 10° left for about 1 second, and, finally, 9.5° right before the data became unreliable. [FOUR complete reversals inside 7 seconds -- methinks the crew would have to be Tour de France material to work the pedals that fast]. .3. .airplane be designed for loads resulting from the following series of maneuvers in unaccelerated. .flight, beginning at zero yaw: (1) full rudder input resulting in full rudder deflection (or as. .limited by the rudder limiter system); (2) holding this full deflection input throughout the. .resulting over-swing5 and steady-state sideslip angles; and (3) while the airplane is at the steadystate sideslip angle, a release of this rudder input and the return of the rudder to neutral. The A300 was certified as having met this regulatory standard. In other words, the airplane must be designed to withstand the results of a full rudder input in one direction followed by (after the airplane reaches equilibrium) a release of that rudder input.. .It is noteworthy that these certification requirements do not consider a return of the. .rudder to neutral from the over-swing sideslip angle, nor do they consider a full rudder. .movement in one direction followed by a movement in the opposite direction. Although, as. .previously mentioned, most transport-category airplanes are equipped with rudder limiter. .systems that limit rudder deflection at higher airspeeds, which prevents single rudder inputs from causing structural overload, the Safety Board is concerned that pilots have not been made aware that, a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the other direction, even at speeds below the design maneuvering speed, can dramatically increase the risk of structural failure of the vertical stabilizer or the rudder. The Safety Board is also concerned that pilots may not be aware that, on some airplane types, full available rudder deflections can be achieved with small pedal movements and comparatively light pedal forces. In these airplanes, at low speeds (for example, on the runway during the early takeoff run or during flight control checks on the ground or simulator training) the rudder pedal forces required to obtain full available rudder may be two times greater and the rudder pedal movements required may be three times greater than those required to obtain full available rudder at higher airspeeds. On the A300-600, for example, at airspeeds lower than 165 knots (when rudder travel is unrestricted by the airplane’s rudder limiter system) the rudder can travel +/-30°, requiring a pilot force of about 65 pounds to move the rudder pedals about 4.0 inches. However, at 250 knots, when the limiter restricts rudder travel to about +/-9.3°, a pilot force of about. .32 pounds is required to move the rudder pedals about 1.3 inches. The rudder system on the. .A300-600 uses a breakout force6 of about 22 pounds. Thus, at 250 knots, the rudder can reach. .full available travel (9.3°) with a pedal force of only 10 pounds over the breakout force. There. .are several other types of rudder limiter systems that operate differently. For example, on some. .airplanes, full pedal travel (and corresponding pedal force) is required to obtain full available. .rudder, regardless of airspeed, even though the maximum available rudder deflection is reduced. .with airspeed by mechanical means. Lacking an awareness of these differences in necessary. .pedal force and movement, some pilots, when sensing the need for a rudder input at high speeds, may use rudder pedal movements and pressures similar to those used during operations at lower airspeeds, potentially resulting in full available rudder deflection.. .5 Over-swing refers to the maximum sideslip angle resulting from the airplane’s momentum as it yaws in response to the rudder’s movement; the over-swing sideslip angle will always be greater than the subsequent steady-state sideslip angle.. .6 Breakout force is the force required to start moving a flight control such as the rudder pedal or control column.. .4. .The Safety Board notes that there is a potential for pilots to make large and/or sequential. .rudder inputs in response to unusual or emergency situations, such as an unusual attitude or. .upset, turbulence, or a hijacking or terrorist situation. In fact, unusual attitude training already exists7 that encourages pilots to use full flight control authority (including rudder), if necessary, in response to an airplane upset. Further, the Board is aware that, since the terrorist attacks of September 11, 2001, operators and pilots have been discussing ways to disable or incapacitate would-be hijackers in cockpits or in cabins during flight. Although the Board understands the need to formulate effective maneuvers for addressing such unusual or emergency situations, the Board is also concerned that, without specific and appropriate training in such maneuvers, pilots could inadvertently create an even more dangerous situation if those maneuvers result in loads that approach or exceed the structural limits of the airplane.. .Finally, notwithstanding the concerns noted above about the potential danger of large and/or sequential rudder inputs in flight, it should be emphasized that pilots should not become. .reluctant to command full rudder when required and when appropriate, such as during an engine. .failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. The. .instruction of proper rudder use in such conditions should remain intact but should also. .emphasize the differences between aircraft motion resulting from a single, large rudder input and. .that resulting from a series of full or nearly full opposite rudder inputs. As previously noted, the Safety Board’s examination of the adequacy of the certification standards is ongoing and no conclusions have yet been reached in that regard. However, on the basis of the investigative findings to date, the Board believes that the FAA should require the. .manufacturers and operators of transport-category airplanes to establish and implement pilot. .training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training does not compromise the substance or effectiveness of existing training regarding proper rudder use,. .such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. The Safety Board also believes that the FAA should carefully review all existing and proposed guidance and training provided to pilots of transport-category airplanes concerning special maneuvers intended to address unusual or emergency situations and, if necessary, require modifications to ensure that flight crews are not trained to use the rudder in a way that could result in dangerous combinations of sideslip angle and rudder position or other flight parameters.. .7 The widely used Airplane Upset Recovery Training Aid, which was created by Airbus Industrie, the Boeing Company, many major domestic and international airlines, and major pilot organizations, states that, “pilots must be. .prepared to use full control authority, when necessary. The tendency is for pilots not to use full control authority because they rarely are required to do this. This habit must be overcome when recovering from severe upsets.”. .5. .Therefore, the National Transportation Safety Board recommends that the Federal Aviation Administration:Require the manufacturers and operators of transport-category airplanes to. .establish and implement pilot training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transportcategory airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite. .direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with. .comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training. .does not compromise the substance or effectiveness of existing training regarding. .proper rudder use, such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. (A-02-01). .Carefully review all existing and proposed guidance and training provided to pilots of transport-category airplanes concerning special maneuvers intended to address unusual or emergency situations and, if necessary, require modifications to ensure that flight crews are not trained to use the rudder in a way that could. .result in dangerous combinations of sideslip angle and rudder position or other flight parameters. (A-02-02). .Chairman BLAKEY, Vice Chairman CARMODY, and Members HAMMERSCHMIDT,. .GOGLIA, and BLACK concurred in these safety recommendations.. .By: Marion C. Blakey. .Chairman. .Original Signed
Looks to me work is needed in the flight control and feel systems -- breaking an airliner should be hrd work.