NTSB and Rudders [Archive]

RatherBeFlying

9th Feb 2002, 00:08

edited NTSB Text follows -- foot notes interrupt text:

This safety recommendation letter addresses an industry-wide safety issue involving omissions in pilot training on transport-category airplanes. Specifically, the National Transportation Safety Board has learned that many pilot training programs do not include information about the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes. Further, the Safety Board has learned that sequential full opposite rudder inputs (sometimes colloquially referred to as “rudder reversals” <img src="wink.gif" border="0"> —even at speeds below the design maneuvering speed1—may result in structural loads that exceed those addressed by the requirements. In fact, pilots may have the impression that the rudder limiter systems installed on most transport-category airplanes, which limit rudder travel as airspeed increases to prevent a single full rudder input from overloading the structure, also prevent sequential full opposite rudder deflections from damaging the structure. However, the structural. .certification requirements for transport-category airplanes do not take such maneuvers into account; therefore, such sequential opposite rudder inputs, even when a rudder limiter is in. .effect, can produce loads higher than those required for certification and that may exceed the. .structural capabilities of the aircraft.. .This safety issue was identified in connection with the Safety Board’s ongoing investigation of the November 12, 2001, accident involving American Airlines flight 587, an Airbus Industrie A300-600.2 Flight 587 was destroyed when it crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport (JFK), Jamaica, New York. Before impact, the vertical stabilizer and rudder separated from the fuselage.3 The 2 pilots, 7 flight attendants, 251 passengers, and 5 persons on the ground were 1 The design maneuvering airspeed is the maximum speed at which the structural design’s limit load can be imposed (either by gusts or full deflection of the control surfaces) without causing structural damage.. .2 Under the provisions of Annex 13 to the Convention on International Civil Aviation, the Bureau Enquêtes-Accidents and Airbus Industrie are participating in the Safety Board’s investigation of this accident as the Accredited Representative and technical Advisor, respectively, of the State of Design and Manufacture.. .3 The vertical stabilizer and rudder assemblies were found floating in the water about 0.7 mile from the main impact crater. The vertical stabilizer was largely intact with no significant damage, although some localized areas of. .2. .killed. Visual meteorological conditions prevailed and an instrument flight rules flight plan had been filed for the flight destined for Santo Domingo, Dominican Republic. The scheduled. .passenger flight was conducted under 14 Code of Federal Regulations (CFR) Part 121. The investigation is still examining many issues, including the adequacy of the certification standards for transport-category airplanes, the structural requirements and integrity of the vertical stabilizer and rudder, the operational status of the rudder system at the time of the. .accident, the adequacy of pilot training, and the role of pilot actions in the accident. It must be. .emphasized that, at this time, the Board has not yet determined the probable cause of the. .accident. Further, the Board is not aware of any prior events in which rudder movements have. .resulted in separation of a vertical stabilizer or rudder. Nonetheless, the investigation has. .revealed this safety issue, which should be immediately addressed. Before the separation of the vertical stabilizer and rudder, flight 587 twice experienced turbulence consistent with encountering wake vortices from a Boeing 747 that departed JFK ahead of the accident aircraft. The two airplanes were separated by about 5 (statute) miles and 90 seconds at the time of the vortex encounters. During and shortly after the second encounter, the flight data recorder (FDR) on the accident aircraft recorded several large rudder movements(and corresponding pedal movements) to full or nearly full available rudder deflection in one direction followed by full or nearly full available rudder deflection in the opposite direction.4. .The subsequent loss of reliable rudder position data is consistent with the vertical stabilizer. .separating from the airplane. The cause of the rudder movements is still under investigation.. .Among the potential causes being examined are rudder system malfunction, as well as flight. .crew action. Preliminary calculations by Safety Board and Airbus engineers show that large sideloads were likely present on the vertical stabilizer and rudder at the time they separated from the airplane. Calculations and simulations show that, at the time of the separation, the airplane was in an 8° to 10° airplane nose-left sideslip while the rudder was deflected 9.5° to the right. Airbus engineers have determined that this combination of local nose-left sideslip on the vertical stabilizer and right rudder deflection produced air loads on the vertical stabilizer that could exceed the airplane’s design loads. The Board notes that, at the time the vertical stabilizer and rudder separated from the airplane, the airplane was flying at 255 knots indicated airspeed (KIAS), which is significantly below the airplane’s design maneuvering speed of 273 KIAS. Transport-category airplanes certified by the Federal Aviation Administration (FAA)must meet the airworthiness standards in 14 CFR Part 25. Subpart C, pertaining to the airplane structure, includes Section 25.351, titled “Yaw maneuver conditions,” which requires that the damage were evident around the stabilizer-to-fuselage interface. At the lower end of the stabilizer, all of the attachment fittings were either fractured through the attachment hole or the stabilizer structure was fractured around. .the fittings. Portions of the closure rib and skin attach angle and front spar were also fractured from the stabilizer. Most of the rudder was separated from the vertical stabilizer except for portions of the rudder spar, which remained attached to the actuators and the upper hinge (no. 5 and 7).. .4 Preliminary information based on FDR data and an analysis of the manner in which rudder position data is filtered by the airplane’s systems indicates that within about 7 seconds, the rudder traveled 11° right for 0.5 second, 10.5° left for 0.3 second, between 11° and 10.5° right for about 2 seconds, 10° left for about 1 second, and, finally, 9.5° right before the data became unreliable. [FOUR complete reversals inside 7 seconds -- methinks the crew would have to be Tour de France material to work the pedals that fast]. .3. .airplane be designed for loads resulting from the following series of maneuvers in unaccelerated. .flight, beginning at zero yaw: (1) full rudder input resulting in full rudder deflection (or as. .limited by the rudder limiter system); (2) holding this full deflection input throughout the. .resulting over-swing5 and steady-state sideslip angles; and (3) while the airplane is at the steadystate sideslip angle, a release of this rudder input and the return of the rudder to neutral. The A300 was certified as having met this regulatory standard. In other words, the airplane must be designed to withstand the results of a full rudder input in one direction followed by (after the airplane reaches equilibrium) a release of that rudder input.. .It is noteworthy that these certification requirements do not consider a return of the. .rudder to neutral from the over-swing sideslip angle, nor do they consider a full rudder. .movement in one direction followed by a movement in the opposite direction. Although, as. .previously mentioned, most transport-category airplanes are equipped with rudder limiter. .systems that limit rudder deflection at higher airspeeds, which prevents single rudder inputs from causing structural overload, the Safety Board is concerned that pilots have not been made aware that, a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the other direction, even at speeds below the design maneuvering speed, can dramatically increase the risk of structural failure of the vertical stabilizer or the rudder. The Safety Board is also concerned that pilots may not be aware that, on some airplane types, full available rudder deflections can be achieved with small pedal movements and comparatively light pedal forces. In these airplanes, at low speeds (for example, on the runway during the early takeoff run or during flight control checks on the ground or simulator training) the rudder pedal forces required to obtain full available rudder may be two times greater and the rudder pedal movements required may be three times greater than those required to obtain full available rudder at higher airspeeds. On the A300-600, for example, at airspeeds lower than 165 knots (when rudder travel is unrestricted by the airplane’s rudder limiter system) the rudder can travel +/-30°, requiring a pilot force of about 65 pounds to move the rudder pedals about 4.0 inches. However, at 250 knots, when the limiter restricts rudder travel to about +/-9.3°, a pilot force of about. .32 pounds is required to move the rudder pedals about 1.3 inches. The rudder system on the. .A300-600 uses a breakout force6 of about 22 pounds. Thus, at 250 knots, the rudder can reach. .full available travel (9.3°) with a pedal force of only 10 pounds over the breakout force. There. .are several other types of rudder limiter systems that operate differently. For example, on some. .airplanes, full pedal travel (and corresponding pedal force) is required to obtain full available. .rudder, regardless of airspeed, even though the maximum available rudder deflection is reduced. .with airspeed by mechanical means. Lacking an awareness of these differences in necessary. .pedal force and movement, some pilots, when sensing the need for a rudder input at high speeds, may use rudder pedal movements and pressures similar to those used during operations at lower airspeeds, potentially resulting in full available rudder deflection.. .5 Over-swing refers to the maximum sideslip angle resulting from the airplane’s momentum as it yaws in response to the rudder’s movement; the over-swing sideslip angle will always be greater than the subsequent steady-state sideslip angle.. .6 Breakout force is the force required to start moving a flight control such as the rudder pedal or control column.. .4. .The Safety Board notes that there is a potential for pilots to make large and/or sequential. .rudder inputs in response to unusual or emergency situations, such as an unusual attitude or. .upset, turbulence, or a hijacking or terrorist situation. In fact, unusual attitude training already exists7 that encourages pilots to use full flight control authority (including rudder), if necessary, in response to an airplane upset. Further, the Board is aware that, since the terrorist attacks of September 11, 2001, operators and pilots have been discussing ways to disable or incapacitate would-be hijackers in cockpits or in cabins during flight. Although the Board understands the need to formulate effective maneuvers for addressing such unusual or emergency situations, the Board is also concerned that, without specific and appropriate training in such maneuvers, pilots could inadvertently create an even more dangerous situation if those maneuvers result in loads that approach or exceed the structural limits of the airplane.. .Finally, notwithstanding the concerns noted above about the potential danger of large and/or sequential rudder inputs in flight, it should be emphasized that pilots should not become. .reluctant to command full rudder when required and when appropriate, such as during an engine. .failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. The. .instruction of proper rudder use in such conditions should remain intact but should also. .emphasize the differences between aircraft motion resulting from a single, large rudder input and. .that resulting from a series of full or nearly full opposite rudder inputs. As previously noted, the Safety Board’s examination of the adequacy of the certification standards is ongoing and no conclusions have yet been reached in that regard. However, on the basis of the investigative findings to date, the Board believes that the FAA should require the. .manufacturers and operators of transport-category airplanes to establish and implement pilot. .training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training does not compromise the substance or effectiveness of existing training regarding proper rudder use,. .such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. The Safety Board also believes that the FAA should carefully review all existing and proposed guidance and training provided to pilots of transport-category airplanes concerning special maneuvers intended to address unusual or emergency situations and, if necessary, require modifications to ensure that flight crews are not trained to use the rudder in a way that could result in dangerous combinations of sideslip angle and rudder position or other flight parameters.. .7 The widely used Airplane Upset Recovery Training Aid, which was created by Airbus Industrie, the Boeing Company, many major domestic and international airlines, and major pilot organizations, states that, “pilots must be. .prepared to use full control authority, when necessary. The tendency is for pilots not to use full control authority because they rarely are required to do this. This habit must be overcome when recovering from severe upsets.”. .5. .Therefore, the National Transportation Safety Board recommends that the Federal Aviation Administration:Require the manufacturers and operators of transport-category airplanes to. .establish and implement pilot training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transportcategory airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite. .direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with. .comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training. .does not compromise the substance or effectiveness of existing training regarding. .proper rudder use, such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. (A-02-01). .Carefully review all existing and proposed guidance and training provided to pilots of transport-category airplanes concerning special maneuvers intended to address unusual or emergency situations and, if necessary, require modifications to ensure that flight crews are not trained to use the rudder in a way that could. .result in dangerous combinations of sideslip angle and rudder position or other flight parameters. (A-02-02). .Chairman BLAKEY, Vice Chairman CARMODY, and Members HAMMERSCHMIDT,. .GOGLIA, and BLACK concurred in these safety recommendations.. .By: Marion C. Blakey. .Chairman. .Original Signed

Looks to me work is needed in the flight control and feel systems -- breaking an airliner should be hrd work.

LatviaCalling

9th Feb 2002, 01:42

I don't know, but the preliminary NTSB report seems to me like absolute bull. It's like saying that you can't drive with summer tires in snow. Of course you can't, but how gentle can you be to reach the maximal tolerance of the rudder? Apparently, not a hell of a lot.

BOING

9th Feb 2002, 02:01

This has been a long time coming but is not unexpected. It has been quite obvious that far too many procedures are being implemented on the basis of a little knowledge and a lot of SIMULATOR testing by people not competent to formulate such procedures. The last time I commented on this subject the return post questioned whether I had ever heard of a rudder load limiter since the respondant clearly considered that these items would always prevent structural problems. Unfortunately I returned from a trip too late to make an effective reply.. . As a cost cutting measure commercial aviation training nowadays focuses on routine flight profiles using autoflight systems with almost zero training on aviation fundamentals and aircraft handling. The cynical assumption is that pilots bring this knowledge to the job (or that in modern commercial operations they do not need this training). This may be true for certain ex-military pilots but it is resoundingly not true for the present day run-of-the-mill entrant in the US. This is not to denigrate the ABILITY of these entrants it is to point out their LACK OF EXPOSURE. It is easy to see how new pilots would buy into the idea that the aircraft manufacturer has solved all the possible handling problems. This is the viewpoint encouraged by flight training departments who prefer the sausage machine approach to keep costs down. If you need examples of the lack of basic aircraft handling knowledge of many pilots just remember all the comments by the brave souls who were going to carry out high altitude aerobatics in a transport aeroplane to upset hijackers.. . In the case of the use of rudder to recover from upsets the idea started out quite sensibly - if you needed a little help to speed up a roll use an amount of rudder. Unfortunately, over the years the "little help" turned into an automatic application of full rudder regardless of actual flight conditions. I see this every training session. This attitude is encouraged by simulator programming which often provides negative training. In our simulators the box will not allow upset recovery until it has reached predefined upset limits EVEN IF THE AEROPLANE WOULD HAVE RECOVERED UNDER THOSE SAME CONDITIONS. Therefore use of full rudder is encouraged. If the aeroplane (simulator) does not recover with the rudder you have applied - try some more. Since the simulator is programmed not to recover inevitable full rudder is eventually applied. Negative training.

ironbutt57

9th Feb 2002, 04:18

If we are taught to "rudder" our way out of a slow speed upset to avoid stalling the wing with aileron deflection....then this "new finding" flushes that all down the toilet...looks like somebody has paid a lot of money to cover up a basic design flaw...who (whom)?

Captain104

9th Feb 2002, 05:15

Sorry,. .4 weeks ago, in the thread "Whitnesses saw AA 587...",I guessed:"I dare say, during the next weeks the profs will circle around those AA procedures you all heard about: the recovery out of unusual attitudes by applying full rudder".. .Retour:. .1)A honorable member called "The Prisoner" booked me on the train:"me thinks a Captain of C 150"!. .2)In a post, McD Administrator corrected me, "the emphasis is on PROPER and CONTROLLED inputs".

Reading the NTSB-release today carefully, I feel a bit like "Mr.Piggy who knows it all". What makes me thinking is a very long explanation they give there dealing exclusivly with training aspects. In their bag no yawdamper-problems, no wrong wiring somewhere, no computer problem, nothing. <img src="confused.gif" border="0">

Than Boings interesting post, in which he talks about:"therefore use of full rudder is encouraged". Comments are welcome, because I'm really <img src="confused.gif" border="0">

411A

9th Feb 2002, 06:11

It would appear that many here are rather "new" to high speed jet aircraft operations. . .The problems with large rudder inputs were taught many years ago to the pilots of the Boeing 707...now we have a new group, but many lessons of the past have been forgotten, or never learned.. .The results are there for all to see....aerodynamics do not necessarily change with the calendar.

[ 09 February 2002: Message edited by: 411A ]

Wino

9th Feb 2002, 07:24

FOR IMMEDIATE RELEASECONTACT: Gregg Overman. .Director of Communications. .Allied Pilots Association. .817-302-2250

. .ALLIED PILOTS ASSOCIATION RESPONDS TO NATIONAL TRANSPORTATION. .SAFETY BOARD RECOMMENDATION CONCERNING PILOT TRAINING OMISSIONS:. .GUIDANCE NEEDED 'AS SOON AS POSSIBLE'

Fort Worth, Texas (February 8, 2002)-The Allied Pilots. .Association (APA), which serves as collective bargaining agent. .for the 11,000 pilots of American Airlines, responded to the. .NTSB's Safety Recommendation concerning omissions in pilot. .training on transport-category airplanes by calling for specific. .guidance as soon as possible.

. .The NTSB issued its Safety Recommendation today as part of the. .ongoing investigation into the accident involving American. .Airlines Flight #587. With today's Safety Recommendation, the. .NTSB acknowledged that pilots have not been informed that it is. .possible, in certain situations, to overstress key aircraft. .components even when on-board load limiting systems are in place. .and functioning properly.

. ."Pilots worldwide lack meaningful guidance regarding 'how much is. .too much' when it comes to rudder inputs," said Captain John. .Darrah, APA President. "As the NTSB notes in its Safety. .Recommendation, the widely used Airplane Upset Recovery Training. .Aid states that 'pilots must be prepared to use full control. .authority when necessary.'

. ."We look forward to receiving specific guidance for our pilots as. .soon as possible in this critical flight-safety matter."

. .In today's Safety Recommendation, the NTSB notes that it has not. .yet determined the probable cause of the Flight #587 accident.. .The NTSB also noted that the source of the rudder movements. .recorded by the Digital Flight Data Recorder on board the. .aircraft just before the accident have not been pinpointed.. .According to NTSB Chairwoman Marion Blakey during the NTSB's. .press conference this morning, "We do not know if those rudder. .movements were caused by the stabilizer's failure, or if the. .rudder movements perhaps were caused by a mechanical problem that. .was separate from that, or whether these movements were caused by. .the pilot.

. ."This Recommendation is about education and training," said. .Blakey. "It is not about pilot error."

. .Headquartered in Fort Worth, Texas, APA was founded in 1963. The. .union's Web site address is <a href="http://www.alliedpilots.org" target="_blank">www.alliedpilots.org</a>

Shore Guy

9th Feb 2002, 10:38

This NTSB recommendation comes as no surprise in the course of this investigation. However, I believe it to be of little value in the ultimate solving of this accident investigation.

I am not privy to the upset training program at AAL, but it is hard to fathom that any professional pilot would manually enter the abrupt and contradictory inputs mentioned to date. Keep in mind that one of the suspected culprits in this accident is wake turbulence. Wake turbulence at the angles/aircraft types involved normally produces a rolling motion, not normally compensated with by rudder input. At the altitude/speed these events occurred, normally a pilots feet are on the floor, letting the yaw damper system do its job.

One aspect of this accident that I have not seen particularly addressed is that the forces/stresses on the vertical stabilizer/rudder (yaw axis) of large twin-engine transports is (my opinion) greater than other transport aircraft. Vertical stabilizer and rudder area (and therefore the stresses involved) on large twins is disproportionately greater than on other transport aircraft because of the need to keep the aircraft tracking straight with loss of very high thrust engines at a critical time (V1). Not until the advent of large, high powered engines was this situation encountered. In normal operations, this is routinely demonstrated by the relative “sporty” nature one must approach a crosswind takeoff or landing in large twins. These aircraft are weathervanes and take a large amount of control input to counteract this tendency.

Any engineering types out there care to provide more insight into this?

Ignition Override

9th Feb 2002, 11:01

Interesting.

At least one US major airline gives no training on unusual aircraft attitudes. Why? Could it be money, even before Sept 11, but long after the loss of the UA 737 in Colorodo Springs and the 737 near Pittsburgh? Not to pick on the 737s, just to point out the perceived need for a new type of training in all transport planes. Doesn't United teach it in each fleet?

For this "other" airline, unusual attitude training (in our fleet) is to have an engine failure at about 18-20 degrees pitch on takeoff. But we still, in December, wasted some time and money on simulator PRM approaches, which are NOT to be done anymore at the "Peoples' Republik" hub! . . Woops! The Peoples' Thought-Korrektness Polizei might be reading this in Eagan...they said that "the Wall" came down, but most of us know better.

As for training, the FAA might like to sign off any slight change in the trainingsyllabus...more paperwork=more job security.

[ 09 February 2002: Message edited by: Ignition Override ]

MasterGreen

9th Feb 2002, 11:39

Shore Guy : I was under the impression this was a "after take off - low level climb event", so your premise of :

"At the altitude/speed these events occurred, normally a pilots feet are on the floor, letting the yaw damper system do its job."

Is probably an orange herring and is suspect in every way. I don't know your background - although your profile says "Major Airline". I will be generous and assume an RTFQ error before I rant on.

411A has got it just about on the button here I fear. There is a new generation of "handlers", not "pilots", out there who can only fly the way they have been taught. This is not to say they can't fly - but they are severely limited in their experience and backgrounds and this is the new way of it. Unfortunately this is the "new thing". Automation takes the place of systems knowledge and skill / feel is replaced by, yes, another computer system.

On a positive note there is a very good article on Upsets and Recovery here :. . . .<a href="http://www.boeing.com/commercial/aeromagazine/aero_03/textonly/fo01txt.html" target="_blank">Aero Magazine Web Page</a>

Shore Guy

9th Feb 2002, 13:11

Master Green and all,

Perhaps my reference to "feet on the floor" during the wake turbulence encounter was slightly inappropriate, but, according to the NTSB, the event began some 93 seconds after liftoff, with normal climb/acceleration to that point. With normal profiles in a large twin, that does not qualify this (in my opinion) as an "after take off -low level climb event” as you describe. As I recall, the aircraft was at or close to clean maneuver speed, where critical rudder inputs are not normally needed. Your offensiveness in your defense was not necessary. (By the way, what is “RTQF”?).

An A-300 or any other large twin is not a Pitts Special, nor should it be flown as one. There are different skills/disciplines required to fly each one well – and sometimes those skills are mutually exclusive.

I will once again pose my original query – is there someone with an engineering background who would like to address the specific loads/stresses on the vertical stabilizer/rudder on large twin engine aircraft?

Old King Coal

9th Feb 2002, 13:39

Well imho taking your feet away from the rudder pedals in a big twin jet (or indeed any aircraft), in any stage of flight is just asking for trouble !

Also, I was always taught to use the rudder purposefully but also gently - it's a necessarily very powerful control - it needs some respect.

Ps. RTFQ = Read the ******* question, whilst RTFA = Read the ******* answer.

SaturnV

9th Feb 2002, 14:10

ORAC posted the following link in the earlier thread about AA pilots seeking to have the A300 grounded.

<a href="http://pull.xmr3.com/p/25356-E59F/30254611/rudder.html" target="_blank">http://pull.xmr3.com/p/25356-E59F/30254611/rudder.html</a>

This is AviationWeeks technical analysis article (with graphs) on how excessive rudder movement can overstress the fin. This article is cited in the NY Times story of Feb 9, below, and was also cited in a USA Today article earlier this week:

"WASHINGTON, Feb. 8 - The inquiry into the crash of an American Airlines plane in Queens three months ago has shown that a passenger jet can break up in flight if the rudder suddenly flips back and forth, investigators said today.

"Pilots should be trained that such a breakup can occur even at the low speeds that rudder movements had previously been considered safe, the investigators added.

"Government rules on how strong an airplane's tail must be do not take into account sudden back-and-forth rudder movements like those that occurred in the last moments of American Airlines Flight 587, the National Transportation Safety Board said.

"In fact, the board said, in some cases a fairly light tap on the rudder pedals may be enough to cause structural damage. If the pilot reverses the rudder just as the plane reaches its limit in one direction, investigators said, the movement can overload the tail, which they say may have. .happened to Flight 587.

""It is possible, particularly with reverse action, to do catastrophic damage to the tail assembly," said Marion C. Blakey, the board chairwoman.

"In an unusual response, the Federal Aviation Administration immediately said that it agreed with the substance of the recommendation and would make a formal answer shortly. The. .safety board recommendations are advisory; the F.A.A. sets pilot training requirements.

"The recommendation is in contrast to a text jointly developed by Airbus, Boeing and major airlines on recovering from aircraft "upsets." That training tool, as the safety board pointed out today, stresses that "pilots must be prepared to use full control authority when necessary."

"The board said that the problem might extend to all big jets, not just Airbuses, and not just those with tails made of composites, as the tail on the A-300 is. The board, which based its recommendation on calculations of side stresses that would have been produced by the plane that. .crashed and the rudder movements that were recorded, is still trying to determine whether there was a pre- existing weakness in the tail. The board is also continuing to investigate whether the rudder moved because the pilots. .pushed the pedals, or whether it moved because of a mechanical malfunction.

""Even if investigators determine that the rudder moved in response to "pilot inputs," as engineers call it, Ms. Blakey stressed, "this tecommendation is about pilot education and training; it is not about pilot error."

"But it is also about the standards used to certify the airplane as safe to fly. Those standards, used by both the F.A.A. and, in the case of the Airbus, its European counterpart, are taken by pilots to mean that a safety system called a rudder limiter will prevent them from. .overstressing the tail.

"In normal flight, using the rudder will turn the nose of the plane out of line with its direction of travel, like a car skidding on an icy road that points to the side without changing direction. In the air, it is called a yaw. In a. .big airplane, in which the tail is 100 feet or more behind the center of gravity, a yaw can produce large pressures on the vertical tail.

"The rudder limiter on the A-300 and many similar planes blocks the rudder from moving too far and creating a dangerous yaw. The faster the plane flies, the closer the limiter holds the rudder to the neutral position. Aircraft builders calculate the maximum force that the yaw can produce and design the plane to survive 50 percent more.

"If the rudder is pushed to its limit, the plane will swing hard, and because of its momentum, will reach maximum yaw and then settle back slightly toward straight, in a new equilibrium.

"The problem is that the certification test assumes that when the plane reaches maximum yaw, the rudder is held steady or returned to neutral position, and that the rudder is not pushed in the opposite direction until the plane has. .reached equilibrium. In the case of the Queens crash, the rudder appears to have moved in the opposite direction at the moment of maximum yaw, and that may have overstressed the tail.

"That possibility was first raised publicly by Aviation Week & Space Technology magazine on Jan. 21, after it conducted its own analysis.

"This was news to many pilots. "The traditional wisdom is that the rudder limiter will prevent you from exceeding the certification limit," said a senior captain at another airline who has trained scores of pilots on using the rudder.

"But the captain, who did not want to be further identified added, "there are no maneuvers we teach at all that would require you to use full rudder in one direction, then another direction.""

Danish Pilot

9th Feb 2002, 14:18

Regarding the use of rudder, could it be because (as 411A point out) that the older generation was tought to fly on tailwheel aircraft? I remeber the schoolflying, and we were strictly taught to use any amount of rudder required, to recover from stall or other flight manouvers before those would end in a stall. So the "use of rudder" is/was burried deep inside, and that goes for me allso, until I did some time on a tailwheel aircraft (Pilatus PC6). You simply cannot fly that one, if you don´t start useing rudder as a "tool" rather as an "solution". Don´t know if that make sense, but that was what I noticed about my self. <img src="cool.gif" border="0">

E. MORSE

9th Feb 2002, 17:03

No Danish Pilot, has to do with the difference between large jets and lightplanes.

And yes, rudder is the tool for tailwheel aircraft on the ground !

Cheers

John Farley

9th Feb 2002, 21:29

I am concerned that several pilots seem genuinely baffled that rudder use could have the fin off a fully serviceable aircraft that was properly designed and certificated. Unhappily it can, as I will try to explain in a moment.

Before I go on please may I emphasise I am not suggesting this caused the accident this thread is about, but offer these comments to the general debate about rudder use that is going on.

The mechanism I refer to is the same one employed by adults when helping youngsters to enjoy a swing. The adult applies a very small force at just the right moment in the cycle and by so doing builds up the oscillation until in the end the displacement of the swing can become very large indeed (with much yelping from the occupant)

A similar relatively small side force generated by rudder deflection, repeatedly applied, can cause a yaw oscillation to build rather than damp. There are two possible end points in this case, either the fin will stall due to the size of its AoA (in which case the aircraft will depart from controlled flight) or the fin will break before it stalls due to aerodynamic overload.

We all enjoy the powerful damping effects of yaw autostabilisers when they produce a very small force and apply it at the right moment to reduce the yaw oscillations. Now imagine a yaw autostabiliser that is working in reverse. Or a pilot that is out of phase with his feet. Or a pilot that is pushing the rudder pedals correctly but control actuation lags result in those correct inputs being delayed to an incorrect time.

CrashDive

9th Feb 2002, 22:03

Just in case anybody doesn't know who John Farley is: [quote]John Farley OBE AFC CEng is a renowned test pilot.

He became a fighter pilot with the RAF and following training as an instructor, taught flying at RAF College Cranwell. He returned to the Royal Aircraft Establishment (Farnborough) and spent 19 years contributing to the development of the Harrier. He retired as Chief Test Pilot BAe Dunsfold.

Five years as Manager of Dunsfold and a further two as Special Operations Manager at BAe Kingston completed his career with British Aerospace. In 1990 he became the first Western test pilot invited by the Russians to fly the MiG-29 fighter.<hr></blockquote>

RatherBeFlying

9th Feb 2002, 22:06

Footnote 4 in the NTSB letter catches my interest:

"Preliminary information based on FDR data and an analysis of the manner in which rudder position data is filtered by the airplane’s systems indicates that within about 7 seconds, the rudder traveled 11° right for 0.5 second, 10.5° left for 0.3 second, between 11° and 10.5° right for about 2 seconds, 10° left for about 1 second, and, finally, 9.5° right before the data became unreliable."

These are the last 7 seconds the fin and rudder were well enough attached to give reliable FDR readings. The FDR shows FOUR complete rudder reversals inside "7 seconds" but the sum of the intervals given only comes to 3.8 seconds and we are not given the travel time of the last rudder movement to the right. The letter does show that the last reliable FDR reading shows the a/c in a left yaw of 8-10° and that that combination exceeded the structural strength.

We are only given the last yaw angle -- I would really like to see yaw vs. rudder position in these 7 seconds. In my opinion, the crew would have to be Tour de France material to work the pedals that fast against a 32 pound force. This inclines my suspicions to the flight control system.

In traversing the two wake vortices, it is possible that local effects confused the yaw damper sensor system and resulted in counter-corrective rudder movements.

I am tempted to propose an expensive and hazardous experiment with a 747 and A300 flying the accident flight profile in a remote area with an unfiltered FDR -- remote control or ejection seats for the A300 crew highly recommended.

whatshouldiuse

9th Feb 2002, 22:38

Not a pilot, but a frequent Pax...If I interpret the NTSB document correctly, it recommends "not using Rudder reversal at high speeds as this can cause structural damage to the vertical tail fin"

. .How far am I off base from what the report states??

PaperTiger

9th Feb 2002, 22:41

The NTSB, having postulated about inappropriate control inputs, finally comes back to mentioning the yaw damp(en)er.

From the original release (12 Dec):. . [quote]The yaw damper also initially failed the pre-flight check, but it too was reset by a mechanic and the problem was reported resolved, according to the NTSB. . ."Investigators are going to want to get a good handle on how effective the reset was," McKenna said. "They need to make sure the reset is valid and didn't just have the appearance of fixing the problem." <hr></blockquote>

OK maybe I'm paranoid and this was just an eerie coincidence, but would such 'sensor confusion' be limited to just this airplane, or endemic to all A300s ?

[ 09 February 2002: Message edited by: PaperTiger ]

Cosmo

10th Feb 2002, 01:51

RatherBeFlying . .Wishing to not take part in hypothesizing about the accident, due to lack of qualifications, I merely want to point out that a 32 pound resistance doesn't seem like much. I think that even an untrained individual can easily press around 300 pounds (150 kgs) with their legs.

Cosmo

Raas767

10th Feb 2002, 04:01

I went through AA upset training as did every American Airlines pilot. The people who initiated and taught this to the line pilots all had technical backgrounds, many line pilots are former military test pilots and quite a few pilots I have flown with are Aero Engineering graduates. The point is that nowhere in the training do they advocate such agressive use of a flight control unless it is absolutely necessary. That being said, however, no information was ever presented, nor has informnation ever been presented to me during my traing or my career to sugest that rudder use can cause a vertical stab to fail. As pilots we all know that airplanes can be overstressed in certain situations but with load limiters I for one was not aware that I could overstress an airplane by going full left then full right with the rudder.. .In any case. The wake encounter behind the 747 could not possibly have necessitated the use of the rudder that aggresively. The rudder moved but I doubt it was pilot induced.. .I guess you learn something new everyday in this business.

BOING

10th Feb 2002, 08:02

I doubt the A300 crew could have applied so many rapid rudder reversals so quickly. A more likely possibility would be an inappropriate flight system response to wake turbulence followed quickly by the pilots attempt to correct the flight system error. A matter of unfortunate bad timing. This is probably going to be a difficult accident to determine an exact cause despite all of the information that should be available from a modern FDR.

I am sure the wiring systems on "electronic" aeroplanes are designed and maintained to the Nth. degree but anybody who has ever touched a Lucas car electrical system must shudder at the idea of keeping all those (miles?) of electrical wiring and thousands of electrical connectors in good condition as an aeroplane ages. All it would take is one connector to be corroded by a spilt Coke or a blow from a badly loaded freight igloo and Bingo!

By the way, what happened about the insulation failures that were reported a while back on some modern wiring?

Ignition Override

10th Feb 2002, 08:45

Raas 767 put it in a nutshell. On the one hand, I've never seen warnings about sudden full rudder deflection at high speeds anywhere, other than the fact that any pilots knows that even partial rudder would frighten the passengers and might hurt pax or crew (and spill very hot coffee).

Our Aircraft Operating Manual clearly describes rudder restriction mechanisms with increased restriction from 170-300 kts, and a different restrictor to reduce unwanted side slip characteristics, engaged with slats/flaps 0 or 5 (on the dash 30 and 40 series Douglas).

[ 14 February 2002: Message edited by: Ignition Override ]

arcniz

10th Feb 2002, 13:13

There's a little bit of an off-odor to these suddenly promulgated Agency and Airframe Mfr. proclamations of "everyone knows that too much rudder will knock off tails".

Available information critical to safety travels fairly efficiently in aviation. Pilots as a group are serious people who do not mumble or stay silent when safety issues come up for discussion. And they have plenty of time, over the years, to talk endlessly with one another about the short list of aerodynamic gotchas for cruise flight.

The craftsman - apprentice supervisory system for bringing pilots along, combined with endless reams of data and technical tools for rehearsing every aspect of flight convey the impression that all the bad news is on the table for everyone to see. The important things one also prepares for in a simulator. So we thought.

More than a few aviators are astonished that passenger-bus aircraft would be constructed with such a fundamental and accessable succeptibility.

If it were a well-known truth that known a given aircraft model could be near-certainly ripped out of the sky by a simple tap-dance on the rudder, wouldn't it have made sense to program some sensitivity to that phenomenon into the simulator routines - or, better yet, into the actual airplanes? The seriouness of this tail-strength issue - as it is now revealed to us - would seem to merit a red light about 2 feet wide that would come on somewhere up front saying "WHATEVER YOU DO, FOOL, DON'T PUSH THAT RUDDER AGAIN!"

From the historical lack of structural cautions, printed warnings, etc. about this, the lack of sim-training to address it, the lack of feedback mechanisms in the aircraft to detect and alert about it, one wonders how this info has gotten so little attention over the years.

And one also wonders if the existing yaw-damper control program and rudder control programs in the Airbus know about this constraint and implement specific fail-safe interlocks to prevent bang-bang rudder action of a nature that would overstress the tail.

I bet they will in the not-distant future.

sky9

10th Feb 2002, 17:27

I have checked my Boeing Training Manual for the 767/757 and there is nothing about applying too much force however there is a comment about jammed flight controls which states:. ."If any jammed flight control condition exists, both pilots should apply force to try to either clear the jam or activate the override feature or shear out feature(the rudder has a shear out feature)". .I suspect that we are seeing the start of blame transfer. "The pilots are dead lets blame them".

Wino

10th Feb 2002, 19:46

The only thing that this investigation proves is that dead pilots have bad lawyers.

There is no way on gods green earth That Sten Molin or Ed States would have used the rudder pedals like a stairmaster which is exactly what we are talking about here. Both fine Aviatiors had been at AA for 10+ years and had long careers before AA. When AA quoted their experience they were only quoting time at AA, not the 1000s and 1000s of hours they had to get in the door at AA. Both gentleman were consumate professionals.

But because dead pilots have bad lawyers, Airbus is gonna blame the pilots. So this investigations once again proves that dead pilots have bad lawyers.

E X T R E M E L Y P I S S E D O F F <img src="mad.gif" border="0"> <img src="mad.gif" border="0"> <img src="mad.gif" border="0">

RatherBeFlying

10th Feb 2002, 21:19

I have real trouble imagining any situation that would call for four full rudder reversals in four seconds save air combat where somebody is shooting at you and you have no other ideas <img src="eek.gif" border="0">

So let's help out the NTSB with a poll. If anybody has ever performed a series of rapid rudder reversals, can you let us know. Or you can e-mail the details to the NTSB investigation at [email protected]

Belgique

11th Feb 2002, 00:40

Just another Theory

1. Clues:

a. AA587 + <a href="http://www.iasa-intl.com/folders/Safety_Issues/others/AA_587_Survey1.rtf" target="_blank">eight prior</a> uncommanded yaw incidents (U/Y) + a bent FEDEX rudder actuator rod (with associated fin disbonding)

b. An anecdotal reputation (particularly amongst F/A's) for the A300 being a tailwagger.

c. early design, early software

d. Composite fin more prone (than metal) to sudden failures due to its axial strength, load-bearing capabilities and "strength only through integrity" characteristic.

e. five recorded rapid high-throw rudder deflections at 255kts during and immediately after the second wake encounter (before fin failure) on AA587 (assuming this was the filtered DFDR read-out). The A300-600 rudder can move at a rapid 39 deg/sec.

f. neither autopilot nor Control Wheel Steering engaged.

g. There was an audible "rattle" from aft (as recorded on the AA587 CVR) after the second wake encounter (just prior to fin failure).

2. Assumptions: (intuitive, logical, recommended and standard practices)

a. A pilot would not (normally) make a large rudder input at 255kts (about 1.9Vs) [see Boeing/Airbus Guidance at:. .<a href="http://www.boeing.com/commercial/aeromagazine/aero_03/textonly/fo01txt.html." target="_blank">http://www.boeing.com/commercial/aeromagazine/aero_03/textonly/fo01txt.html.</a> Any rudder inputs are commended only at lower (near or at stall) type speeds.

The FAA guidance for pilots is transparently a bit of an irrelevant butt-covering exercise - but it does give us the heads up that an oscillatory rudder (see Farley above) certainly can break a fin. Happy with that - because that oscillatory motion is equivalent to aerodynamic or system induced "flutter". Flutter has always been associated with imminent catastrophic failure - as it often tends to be oscillatory and divergent. The nature of flutter is such that it all happens too quickly to enable recognition and speed (or configuration) changes. It's best avoided altogether (through design).

b. Pilots had no time in which to react - either appropriately or inappropriately (about 7 secs for recognise and respond/react). They would not have recognised the fin loss and the full power response probably did not materially affect the outcome.

c. The uncommanded yaw can happen on approach (i.e. slow and configured) or at FL310 so that common factor gives us a further clue. It doesn't appear to be a factor on/near the ground (i.e. you need a speed range).

d. As not all uncommanded yaw instances resulted in disastrous failure, there must be a trigger and exacerbating factors (i.e. present for AA587). We know of one - wake turbulence. Possibly another - the preflight yaw damper reset by maintenance. We can possibly refine this to "a characteristic (of design) plus an unserviceability" in order to complete the chain. Or maybe it's all predicated by design plus circumstance......no u/s required.

3. Givens:. . a. The "yaw damper reversed" theory (both Miami 99 and Farley above) is a tempting hook upon which to hang one's hat and it may indeed be the reason why the yaw damper needed a reset.

b. The rudder trim switch had been subject of two AD's, the second one of which called for a lengthened switch shaft and a wiring change. That gave three rudder-trim switch maint mischoice possibilities (plus the wiring change). There was also an aileron trim AD for inadvertent actuation (both switches being close adjacent on the 408VU panel - increasing the possibility of a maint "Murphy")

c. Intermittent wiring problems have been known to cause similar flight control erratics....but oscillatory?? Maybe not, that's more likely a systemic interaction.

d. The Loral DFDR had been previously found unsatisfactory by investigators because it recorded only a filtered sampling of data (as per that displayed in the cockpit). The FCS is in fact capable of moving the rudder more than twice in the time that the DFDR records one motion. This may help explain the "rattle" (lateral fin-rocking) recorded on the DFDR and yet indicate that the pilots could not have possibly moved the rudder as fast as the FCS was capable of doing (39 deg/sec) - but without it being recorded.(See <a href="http://www.aviationnow.com/avnow/news/channel_maint.jsp?view=story&id=news/raa21114.xml" target="_blank">this article</a> regarding AA587’s DFDR deficiencies (low sampling rate). And see also [url=http://www.srg.caa.co.uk/publications/CAP455_airworthiness_notices.pdf]Loral_800_"obsolescence"

4. Theory: Considering all of the above and extrapolating into plausible explanations, here's an hypothesis:

a. Static port positions are chosen by designers in order to minimize local pressure disturbances throughout the speed and configuration range - so that inputs to the Air Data Computer (ADC) are as solid and error-free as possible. However they tend NOT to consider what happens under yawed flight. In a steady-state yaw (asymmetric, engine-out, OEI) the port/starboard discrepancy is soaked up by the fact that there are ports on both sides of the fuselage and the two pressures are joined in a Y Junction before being presented to the ADC. If, however, the yaw angles become much greater, there is both an asymmetric blanking and a pressure change (venturi) effect caused by both the rapid reversal of yaw and the extent and periodicity of that yaw. The actual data (incremental pressure changes) presented at the static port has a long way to travel and it can become both erroneous and out-of-phase - simply due to the dynamics of the situation (and perhaps even due to the sampling rate of the ADC / and its subsequent input rate to the FCS). PEC (position error correction for static errors) is normally applied to the ADC only for balanced flight in the envelope - for normal configurations.

b. Consider further the effect of yaw if the static ports are placed in an optimal error-free position for balanced flight - but just happen to be at a point of curvature on the fuselage where the venturi effect on the sensed pressure, under yaw, will be very significant (i.e. perhaps producing large local pressure drops).

c. Airspeed is Dynamic Pressure (but is sensed at the pitot as TOTAL Pressure (static plus dynamic). The static port pressure is deducted to give you the indicated airspeed (i.e. the dynamic only). If you need a yard-stick for the significance of static port pressure errors on the sensed airspeed, take note that trapped water freeze-blocking a static line (in a climb above freezing level) will cause an ASI to wind down from 220kts to zero in just under 2800ft of climb (equivalent to 9mbs Hg). It would also cause the VSI to zero and the altimeter to freeze - but that's irrelevant here. I'm just pointing out that quite a small static port pressure discrepancy can have a large effect on ADC-sensed airspeed. Those sensed airspeeds control yaw-damper action and rudder ratio limiting - at any one point in time.

d. So why (and how) might this be significant? In prior instances of U/Y there may have been a minor out-of-phase disagreement between the FCS and the ADC. As pointed out, this could be caused by the rudder limiter's throw (and/or yaw damper input) being misset by the flawed ADC airspeed info. A yaw requiring an 18% displacement throw of the rudder might end up being much greater because the rudder limiter is permitting (courtesy of the ADC and FCS software) up to 16 degrees full throw (instead of the 10 deg appropriate to the actual airspeed at that instant). That much greater (or simply inappropriate) corrective yaw causes another ADC sensing error and the tail goes into "wag" mode (familiar to A300 backenders). Eventually the damping effect of that large fin normally causes these rudder-induced overshoot oscillations to dissipate. But you need a trigger for this to "kick off" - some initial yaw. atmospheric disturbance, pilot "stretching" with feet on rudder pedals (done it myself), climb/descent through an inversion, wind-shear, turbulent air, wake turbulence etc etc. Help me out here.

e. But why did AA587 self-destruct? I think it may be as simple as the first wake encounter starting the tail wagging the dog and the next wake encounter really confusing the issue and leading to an instantaneous fin overload (the rattle of that semi-detached fin indicating that lugs had sheared and that the fin was on its way). These fins and rudders on the big twins are quite powerful because they have to accommodate OEI any old time. Courtesy of the . .system that tempers that power, the FCS is quite capable of breaking the fin off - both due to it being a composite structure (that won't just partially fail/fatigue crack) and because the range of rudder-throw action is large. At 250 kts it shouldn't exceed 9.3 deg, but if you fool it into thinking it's at 165 kts, you can have the whole 30 degrees of throw. Obviously that's going to be enough to break it at the higher speed. I'm not suggesting that it went full-scale deflection, just that induced static errors caused the ADC to continually re-schedule the FCS to permit inappropriate deflections for the actual airspeeds - leading to an oscillatory flutter as each deflection proved inappropriate - yet gave rise to the need for a prompt further deflection (and thus becoming oscillatory). That's not overswing (per the FAA release), it's system error - where the rudder's power is pitted against the inherent dampening of the fin. At a certain point it will become exponential and destructive. Because of this classic A300 tail-wag, the sensed static port pressure was never on . .the money and the ADC/FCS interaction was in full disagreement (after the first wake-induced yaw) when the second wake turbulence encounter hit at just the wrong angle and broke a fin lug, starting the fin's rudder-driven death-rattle.

f. Why the bent FEDEX rudder actuator rod? Sometimes the fin wins and the periodicity of the feedback to the rudder is sufficient to bend the actuator.

g. Or perhaps it wasn’t the FCS computer’s fault at all, perhaps it was a cross-wiring or a reversed hook-up of the static ports or a hydraulic servo valve. Whatever it was, if it was a hardware flaw, it may have been that way for a while. Sometimes you need a significant divergence (such as that caused by wake turbulence), before you cross a trigger-point for feedback mayhem. Think of the microphone analogy. If you place an open mike in front of a speaker that’s in the same circuit, as long as the volume is way down there’ll be no feedback squeal. Wind it up a little and it will suddenly be deafening.

5. No doubt someone will now tell me that yaw-induced static port pressure errors aren't of sufficient magnitude to start this ball rolling....

or that this is all accommodated in a cunning ADC/FCS program patch of narrow notch (or broadband) filtering.. But as I said, it's just a theory that seems to fit the bill (and, if correct, one flaw which should be easily fixed). I don't think that it's a fin strength composite) problem. Whether or not this static port theory holds water, it's still likely to be an FCS computer-derived (and driven) flutter that arises from a sensing problem. Just keep in mind that the rudder has two movements. Rudder deflection resolves the yaw (or is intended to) and then (in an ideal world) centering sends the rudder to parade rest, calmly zero'd in trail. But in my theory, there was always a bunfight going on back there and a simple recentering was rarely on the cards; sometimes the yawing gave cause for alarm, but normally the static port error wasn't significant because the yaw wasn't massive and so the natural damping of that large fin meant there were only a few wags at most. But the potential was (and is still) there for an A300 to eventually meet its wake encounter match. One is left wondering what the "break-out" yaw angle/rate is (that might "dud" the static port pressures and set this ball rolling).

Belgique

11th Feb 2002, 00:50

And while we're at it, also think about the effect of some trapped water in one side of the static system - and what effect it might have (on the ADC) during yaw gyrations.

arcniz

11th Feb 2002, 05:04

Belgique - Masterful!

Your lucid and clearly communicated static port theory is the first I have seen that explicitly addresses the "second failure mode" of the independent rudder-travel limiting mechanism seemingly failing to keep rudder deflections inside the stipulated limits for the aircraft speed.

The AA587 aircraft might have ridden through the wake events ok if the extreme deflections of rudder had been limited according to the speed vs throw angle rules - even if the First Failure Mechanism for rudder oscillation were present due to design instability, wiring faults, or both.

One suspects the static system value data has considerable mechanical and/or electronic "buffering" in it so that responses to individual port changes are averaged over a time interval of seconds, at least. Because it is the baseline reference for barometric calculations, fast response to static pressure variations would just add noise to the gauges and controls.

If this is the case, a pressure change from the first wake event (and related slip?) might have created enough distortion of the averaged static pressure that the computed airspeed for rudder limiter purposes was scaled back toward the 165K mark where full rudder travel is allowed. The inter-wake interval leaves time for the (probably fairly slow) mechanical travel interlocks to reposition for a substantially wider rudder travel window. Then comes wake bump number 2, which sets off the First Failure Mechanism on a cycle of uncommanded rudder oscillations. Because the rudder travel window is inappropriately wide at that moment, those swings do the tail in short order.

I sure wish someone would start measuring how "normal" A300's wiggle their tails in the course of a working day....per my comment on the "Pilots want A300's grounded " thread.

hobie

11th Feb 2002, 11:47

systemsguy ......

"I sure wish someone would start measuring how "normal" A300's wiggle their tails in the course of a working day....per my comment on the "Pilots want A300's grounded "

Why not select 10% of the fleet spread around the world and do this monitoring Now!!! ......

Few Cloudy

11th Feb 2002, 12:42

Two valid points run through this thread;

- Pilots would not kick rapid full throws of opposite alternating rudder,

- If they did it could cause a structural failure.

Both valid points I think.

They both refer to a healthy aeroplane, however. If the rudder/fin were structurally damaged, causing a full rudder swing and yaw, a pilot might well be brought to put in an opposite input - he doesn't have time to analyse the reason for the initial swing, just corrects the flight path. Depending on the failure, this could aggravate the problem. The rudder might be about to swing to the other side anyway, making the handling just as unpredictable as the Air Alaska MD-80 free floating stabiliser case.

COnclusions for me are;

- I sympathise with the pilots, who were probably in an invidious position,

- I regret that another piece of useful 'how to destroy an airliner' knowledge has been made available to self destuctive terrorist individuals.

IcePack

11th Feb 2002, 17:11

This all seems to me an excuse for not making the aeroplanes strong enough in the first place.. ."It is not the aeroplane it must be ze pilots."

ignoramusextremus

11th Feb 2002, 22:08

What a buch of Chuck Yeagers. I haven't seen so many comments by so many experts in a long time. Way to go aces! How about we grow up a little and realize the investigation is not over. Oh I almost forgot, if it is a "cover up" you probably will be branded a conspiracy theory "type". So much for all this babbling, Ladies.

[ 11 February 2002: Message edited by: ignoramusextremus ]

Few Cloudy

11th Feb 2002, 22:12

Ah!

That's that nice man who calls the pilots mice on the UAl attempted Hijack thread. What a star!. .Who is this fellow guys? Must have a brain bigger than Pooh Bear...

crazytwon

12th Feb 2002, 00:38

alright, being new to the flying feild, i dont really know all the stuff that everyone is talking about. however i did find many of the comments to be well founded.

what my question deals with is how exactly does wake turbulance (when encoutered by a medium to large size aircraft)? Since i have never flown a large aircraft (unless you would like to consider my piper warrior one <img src="wink.gif" border="0"> ) i have not encountered wake turbulance.

Also, when an aircraft encouteres jet "upset" at low to medium altitude, what are the basic manuvers to perform to correct the situation (ie. do you use the rudder to correct the situation at a high angle of attack instead of using the alierons for fear of stall?)

just to clearify, i am a student pilot (only a few hours in as of yet) and am working on my ppl here in the u.s. so if i dont make any sense...please understand i am rather new to this!!! thanks!

ignoramusextremus

12th Feb 2002, 01:30

Actually, yes. I have a brain much bigger than the bear. I am just tired of all the whinning going on, not to mention the lack of professional attitude. By the way Post-Tanker, I graduated Magna Cum Laude from my university. Pilots are their own worst enemies.

[ 11 February 2002: Message edited by: ignoramusextremus ]

Shore Guy

12th Feb 2002, 02:02

What a profoundly bitter individual....

Coming on the forum is a choice, and, oh yes, what does PPRUNE stand for?

Let's move on.

knows

12th Feb 2002, 02:56

I can't beleive no one has thanked Mr Farley for his easy to understand and valuable informed input!

Roadtrip

12th Feb 2002, 09:48

The NTSB recommendations are a bunch of horse s**t. I used to have respect for the NTSB, but after listening to the woman who heads it, I fear that she's cut from the same cloth as Administrator Garvey. If that crap about not agressively using rudder is the best they can come up with, then they're better off keeping their mouth shut until they find some that they can PROVE.

I've had a hardover rudder on a KC-135 so bad it bounced my head off the side window. Damage? NONE.

I've also flown MANY times minimum interval takeoffs (MITO)during the cold war. 12 secs behind multiple aircraft in wake turbulence you only read about, and you know what?? It's not a big deal. Easily handled by both pilot and aircraft.

747FOCAL

12th Feb 2002, 10:13

ignoramusextremus-Quit talking like you got short mans syndrome. Let them speculate about anything they want. Who really cares. I wouldn't want to fly with anybody who thinks they know everything. <img src="rolleyes.gif" border="0">

wes_wall

13th Feb 2002, 00:33

Well, one thing is always for sure, the lawyers can always determine the cause, well before anyone else.

American and Airbus Sued for NY Crash

"The case was filed by Margarita Del Carmen Montan, the widow of Jose Angel Rosa, who said her husband was forced to endure severe mental anguish and fear of impending death before he was killed in the crash.

The suit alleged that structural, electrical and mechanical systems failures caused or contributed to the crash. "

Comforting isn't it.

Belgique

13th Feb 2002, 23:20

My initial post on page two of this thread gave rise to a number of queries, so it may not have been clear enough. Here's another attempt. Apologies for the length.

A Refined Theory

The NTSB is laying the groundwork for a belief that perhaps the pilots could have encountered the initial wake turbulence and then

laid into it with a corrective boot (for whatever reason) but thus creating a rudder reversal situation (beyond the provisions of

FAR25) that overloaded the fin. Their theory infers that, perhaps when they hit the second lot of wake, they were in a significant

sideslip with a large rudder deflection. And supposedly they didn't do this just once, but went for a heavy pedal-throw five

"recorded" times during and just after that second wake encounter, with as little as 0.3 seconds between.

Well I'll tell you now that you won't have any more than 0.5% of the qualified pilot population ever believing that one. Multi-engine

pilots just don't go for big boots of rudder at 240 knots (1.9Vs) when they encounter wake turbulence (and, as you point out, that

happens quite frequently). Pilots might be more prone to utilise rudder in order to stop a further wing drop at low (approach type)

speeds (1.3Vs). That remains a recommended course of action simply because trying to pick up a "dropped" wing with aileron/spoiler

when near the wing's stalling angle of attack only serves to exacerbate the situation and can lead to autorotation (incipient spin).

So there has to be another answer - and that's probably why the US pilots flying the A300 have the wind up. They know that this facile

NTSB explanation just doesn't wash. Neither does it accord with the A300's reputation as a tail-wagger, nor with the recorded

instances of uncommanded yaw. You should not lightly dismiss either of those factors.

There are system failure explanations that might encompass the cause and I've mentioned my latest theory (the effect of yaw on the

static pressure sensed by the Air Data Computer and predicating allowable rudder deflections - see below). Another avenue of

exploration might be this one:

<a href="http://www.casa.gov.au/avreg/aircraft/ad/adfiles/over/ab3/ab3-088.pdf" target="_blank">http://www.casa.gov.au/avreg/aircraft/ad/adfiles/over/ab3/ab3-088.pdf</a>

AD/AB3/88 Amdt 1

. .Rudder Servo Control Desynchronisation 5/98

The desynchronisation check is to be repeated every 1300 flight hours.

Background: This AD is raised to detect and prevent rudder servo-control desynchronisation which

could lead to structural fatigue and adverse aircraft handling qualities. The AD also

mandates structural inspections to detect the onset of fatigue damage resulting from

servo control de-synchronisation. This amendment recognises changes to Service

Bulletin revision status and incorporates a new compliance clause.

The original issue of this airworthiness directive became effective on 2 January 1997.

Unfortunately I don't have the Service Bulletin nor the inside knowledge of the system, so I cannot judge whether it's a valid

connection or not. I'm not sure whether the rudder input actuator rod found on the FEDEX bird had any significance here - but you

cannot discard that either.

. .The NTSB and FAA have disclosed that a previously FAA-accepted NTSB recommendation on the DFDR was not acted upon and so only the

desensitized data was going onto that thoroughly discredited Loral DFDR (in other words, the same as what the pilots were seeing - and

eliminating all the intermediate data-points). When you consider that aspect, and reflect that as little as a quarter of what went on

down back actually went onto the DFDR, I have no trouble seeing those latter tail-end events as "a rattle". And I certainly then

discard any notion that it was the pilots peddling that fast....because they simply couldn't have done so. But the FCS driven system?

Yes, that can move the rudders at a rapid 39 deg/sec.

So, is it a simple 737-type rudder case where the valve is going to full throw and then sticking? No. Something is causing the A300

rudder to fluctuate back and forth - but not rhythmically (an important point). Well we know that there have been prior instances of

the A300 rudder generating uncommanded yaw, some just annoying - but others generating concern, incident reports and flight aborts. So

why didn't they previously cause a fatal fracture of the fin? Easy, it's all about the forces generated on the fin - by both the

rudder's motion and the side-slip angle at the time. For AA587, already in tail-wag mode when they hit the second wake, the overload

was likely caused by the angular velocity of that wake as it hit a deflected rudder's pre-loaded fin. It is most obviously the

combination of those two aerodynamic loads that (for AA587) proved lethal. That is well covered in

<a href="http://www.iasa-intl.com/folders/Safety_Issues/others/aa587/ruddersnapfinoff.html#dornheim" target="_blank">AW&S T's Dornheim article</a>. But

it's not the whole story - it lacks an acceptable cause for the waggle.

OKAY, what could cause the rudder to waggle, (but not rhythmically) and, in the case of AA587, break the fin? Well the answer possibly

lies in the systemic relationship between the ADC and the FCS. The ADC senses pitot and static pressures and provides the speed input

so that the rudder ratio limiter knows how much of the (physically available 30 deg of) full-throw is permitted at any one time. If

you manage to confuse the ADC so that its input to the rudder limiter (owned and operated by the FCS) is a little haphazard, then

every rudder deflection will be inappropriate. Because it is (and proves to be) an inappropriate response, a further corrective rudder

deflection is called for. It too will be incorrect if the speed derived from the ADC isn't near to the actual speed of the aircraft.

The yawing evolution ends up as an over/under-correction followed by yet another over/under-correction and the end result is dependent

upon some other factors. Firstly, if it's not a significantly inappropriate rudder deflection, the massive dampening effect of that

large fin will provide a countervailing restorative moment and the uncommanded yaw will subside. If it is a largish error, then the

inertia of that fuselage swing also becomes a factor, as does the timing of the FCS inputs and any time-lag in the ADC's sensing of

the aircraft's speed.

So why would the ADC tell fibs (to the FCS and rudder limiter) about the aircraft's speed? It might not be the same reason every time

and I covered that in my initial hypothesis

<a href="http://www.pprune.org/ubb/NonCGI/ultimatebb.php?ubb=get_topic&f=1&t=017746&p=2" target="_blank">here</a> ("just another Theory"- "Help me out

here"). But in AA587's case I'd suggest that the initial wake turbulence encounter was enough to set the ball rolling. Normally, in a

yaw, the fact that the port and starboard static ports are Y-connected is enough to iron out (and average) any discrepancies caused

locally at each port (by the venturi effect of yaw angle, air inflow and fuselage curvature). However the design engineers only ever

consider balanced flight and a few different configurations when they decide upon static port positioning and then map the PEC

(position error correction) errors to be fed into the ADC. In yawed flight I'm suggesting that quite large errors can creep in and be

magnified by both the ADC and FCS sampling rate (i.e. how often these gizmos ask for the speed info). As I pointed out in the earlier

article, about a 9mb error (= an 8% error on an ISA day) can cause the airspeed to zero out. I'm not suggesting that that happened,

just pointing out the small magnitude of P.E. error required to cause a largish speed error and an inappropriate rudder deflection.

Remember the 1996 Birgenair 757 that crashed due to static port tape being used to stop water getting into the static system during an

aircraft wash (not being removed)? Well it's a little-known fact that heavy rain and a falling barometer can allow a static port to

suck in water. It's usually not significant because it normally pools in water traps in the system - and gets drained eventually. In a

heated system it's unlikely to freeze and cause the gross errors mentioned in my earlier article. However just consider what effect an

amount of trapped water might have in the static system - particularly upon the timeliness of ADC sensing, and particularly in a yaw?

The water may well flow in an adverse direction, due to the forces of the yaw and inertia, and induce a false static pressure (which

is then picked up by the ADC etc etc). Do you see where I'm going here?

So if you accept my hypothesis, you will see that a clean/dry static pressure system can induce an error into the FCS - and so can a

wet one, but probably a fiercer reaction in the latter case - because of the adverse flow of trapped water during any yawing. Due to

the unpredictable nature of the water-flow and the ADC sensing, rudder ratio changes and resulting erroneous FCS responses, any yaw

meanderings would not be rhythmic, but they could build up and become divergent and gross. Equally likely, the rudder could become

out-of-phase with the aircraft's physical yawing and tend to assist the damping effect of the fin. Luck of the draw I would say - but

in AA587's case I'd suggest that the second wake turbulence encounter came at just the wrong time in the cycle. It can probably

therefore be seen as a once off type accident. But if I am right, then there are things that can be done to resolve any such

discrepancies in the Airbus system's logic and susceptibility to this type of error.

In answer to the question (at the end).

Pitot Pressure (as sensed by a pitot tube facing into the airflow) is a Total Pressure made up of dynamic and static pressure: T =

D + S1. . . .So obviously we need to subtract that S1 (the static pressure – which should be the ambient pressure at that height), because what we

want to see on our Air Speed Indicator is D (dynamic pressure or the pressure due to our forward speed). The formula now becomes D = T

– S1 (a conventional airspeed indicator does this within its internal plumbing but in a glass ship the Air Data Computer obliges).. . . .But where do we source that S1? Well it comes from the static ports (let’s call it S2)…. which live on the port and starboard sides of

the airplane’s aft fuselage (normally two small holes each side / above and below, which are heated against icing but which are open

to the elements inflight and quite often left open and unplugged on the ground). If you park an airplane in the open and there’s heavy

rain and it’s flowing down over those holes then capillary action can cause water to be sucked in, sometimes in fairly large

quantities. I can recall an inflight emergency where I lost all pressure instruments after climbing through freezing level. They

figured out later that, parked in the rain, water had been sucked up the hollow centres of the downward-facing rubber bungs (off which

the water was dripping). When it later froze in the static system, of course I lost the altimeter (it froze at that height), the VSI

went to zero and the Air Speed indicator just wound back to zero (from the 220knot climb speed). It was calculated later that that

will happen (from that IAS) over a climbing height change of 2800feet (about = 9mbs or 8% of the Sea-level ISA pressure). The school

solution is to depressurize and break the glass on the VSI and accept that there will be a fairly gross altitude error (due to using

cockpit static). But that gets your ASI back in the picture (although greatly errored, trends will be good).. . . .Now in an ideal world S2 will always be equal to S1. But we don’t live in an ideal world so there will always be some discrepancies:. . . .a. When we lower flap and/or change AoA, it tends to speed up the airflow over the wing and down past the static ports - so the

venturi effect drops the pressure there and a correction is required (to the speed that we fly). . .D = T – S2 becomes an errored speed indication because it’s now a greater quantity than D = T – S1.. . . .b. If we yaw the aircraft, the fact that the port and starboard static ports are interconnected via Y junctions should stop

the error being of any great magnitude (a higher pressure on one side being in theory cancelled out by a lower pressure on the other).

But if we go into a rapidly yawing mode through a significant angle, then all bets are off and the pitot-static system will be

struggling to provide valid data to those flight control systems with a high sampling rate and requiring accurate pick-offs of static

pressure (and consequently any derived speed will be fluctuating). Note here that I said pitot-static systems – because the pitot is

also yawing away and so it’s also subject to some error). Navigation systems and pressure altimeters aren’t as vulnerable to sensed

errors (resulting in momentary speed discrepancies) as would be the flight-control systems (yaw damper and rudder limiter inputs say). . . . .c. And if we have water trapped in that system and start yawing, then obviously we have to examine the effect of the inertia

of that water on the sensed static pressure (S2). Over a period of (say) five seconds, we might measure (but never see) S2 ± 5mbs

variation. Depending upon the sampling rate of the ADC it may not even record this on the slow-sampling DFDR – but it may provide that

instantaneously erroneous data to the rudder limiter and yaw damper…. With eventual AA587 uncommanded gross yaw type results. . . . .d. Additionally, if we fly into a wake turbulence encounter, we might accept that a wake vortex has within it some wide

variations of pressure. These can vary from “almost a vacuum” to much greater than ambient pressure at that height. In addition the

angular velocities of the encountered (greatly disturbed) rotating wake vortex airflows may mean that there are components of the wake

at an angle to the static port (on one or BOTH sides of the airplane) – and those ports can take in that air pressure much as a pitot

tube does (leading to even greater errors and flux). . . . .So it is starting to look like a real pakapoo ticket is it not? The business of getting a true S2 just became tantamount to impossible

when we entered that first wake and began the tail-wag. When we entered it the second time, it was with a thoroughly confused system

that was doing the wild thing with the rudder and, as luck would have it, the second encounter just happened to be at the worst

possible angle and at the worst possible time. The rudder was already imposing a high load upon the fin and suddenly the additional

load snapped an attachment lug and started the fin “working”. As the fin started its lateral dance of detachment, the rudder was

excitated into a frenzy of fin-swaying corrections, leading to the death-rattle heard on the CVR.. . . .Addressing what you’ve asked below:. .“The static pressure drops to zero” isn’t really the case at all. What happens when water freezes in the static system is that the

ambient pressure at that height is trapped and displayed (and that’s why the altimeter freezes at that height, even though the

aircraft continues to climb). 2800ft later, the altimeter reads the same height - but the subtraction of that greater S2 (trapped

pressure) causes the Air-speed indicator to wind back to zero. Over that 2800ft of climb the ambient pressure drops off about 9mbs

(roughly 3mbs Hg/1000ft). So if there was to be a momentary 9mb drop in the S2 (for any reason including the adverse flow of trapped

static system water) at a speed of 220kts, the sensed speed would be nil, zero, zip. Now obviously that’s never the case because it’s

a very dynamic situation we’re talking about here – but it does give you an idea of the magnitude of the pressure errors as sensed at

the static ports – which could drastically influence the airspeeds being fed into the flight-control system. The speeds sensed could

be at any one point of time either above or below the actual aircraft speed – thus causing the continually inappropriate FCS-dictated

rudder responses (in reply to the gyro-detected yawing moments). And there’s the rub.

Question: I don't quite understand one thing in your "Just another theory". It deals with pitot tubes and static ports,

which is to say dynamic and static pressure. If static pressure drops to zero, why would the speed reading decrease? If the speed is

dynamic pressure minus static pressure, then lower static pressure would suggest a greater speed to me than a lesser one. At greater

perceived speed, the rudder would be more (not less) limited in its arc of travel.

<a href="http://www.iasa-intl.com/folders/Safety_Issues/others/aa587/ruddersnapfinoff.html" target="_blank">a link to the theory in toto</a>

ojay

14th Feb 2002, 00:16

Certainly exploring the pprune envelope on this topic.An absolutely superb analysis from a very distinguished ex-test pilot followed by the usual embittered rantings. My ha'porth on the subject of rudders and jet transports is never touch them except for engine failures and crosswind landings.Over and out.

ojay

14th Feb 2002, 00:24

And by the way as a postscript to my previous post I certainly do not believe that experienced AA pilots would be applying large inputs of rudder in normal flight ops/rgds.

411A

14th Feb 2002, 02:54

....don't be soooo sure, ojay, many of these guys were not around when "dutch roll" was a problem...

RatherBeFlying

14th Feb 2002, 07:16

Further to Belgique's post, if yaw is sensed with a vane (or perhaps differential pressure between the static ports), entering and exiting different flow regions within a wake vortex will likely feed fluctuating and misleading data to the yaw sensing system, resulting in confused yaw damper outputs.

The resulting aircraft response could compound the confusion.

If yaw in the A300 is sensed from ring gyros or other INS, then this theory goes out the window.

Obviously yaw damper and rudder programs need to integrate correctly sensed yaw as well as airspeed to limit rudder movements within the fin strength.

Once Airbus, NTSB and BEA have determined and made the necessary revisions, they should fly an updated A300 through the same flight profile to show that the problem truly has been fixed.

Belgique

14th Feb 2002, 17:15

RatherBeFlying

Think you've misunderstood. Not talking about yaw being sensed by a vane - that's normally a gyro function. The yaw that was sensed was probably quite correct - it was the corrective rudder inputs that may have been continually inappropriate. Why?

What I'm looking at is the airspeed inputs to the yaw dampers and rudder limiters being in error. The reason why they can be in error is fairly clearly explained in that post - but to

summarize:. .Imagine that there's water trapped within that static system and you enter the first wake encounter induced yaw cycle. Water has inertia and will be affected by the yawing.

Flowing adversely (and even out-of-phase) within the static system, the instantaneous pick-offs by the ADC are going to lead to inappropriate rudder input corrections - simply because the sensed airspeed will be wrong (and thus the rudder ratio limiter is mis-set). Because the airspeed derived from a false static pressure can be quite grossly in error (example given) you will have a series of non-rhythmic corrective yaw inputs that will each prove to be "unfinished business". A minor yaw disturbance will result in a diminishing yaw cycle - because of the overpowering damping influence of the vertical fin (which is why the fin is there in the first place). However a larger initial yaw might result in a divergent (or at least self-sustaining) oscillation.

I'm suggesting that this is what has happened with AA587. Unfortunately that cycle was interrupted at just the wrong time (and angle) by the second wake encounter - and that's what broke an attachment lug. After that first lug broke, the fin was soon rocking laterally and that was the death-rattle heard on the CVR (as the rudder was driven into a frenzy trying to compensate for the fin's lateral rocking as it danced its Detachment Dance).

The bent/broken FEDEX rudder input actuator rod. .The event they had in their hangar was related to the hydraulic synchronization issue (hydraulic pressure pulses from different sources getting out of phase-sync). The mechanic who initially heard the "banging" did say it was oscillatory in nature, although there was no one watching the rudder at the time. Remember that only one actuator is moved by the

yaw damper. If it was this one that’s bent? Well then it’s just about case solved. I would then submit that there might have possibly been a battle between a rudder limiter that had run amuck (courtesy of the ADC’s flawed pressure inputs) and a yaw damper that was properly doing its job, as it saw it.

As these threads are very perishable, a page of informed surmise will be maintained <a href="http://www.iasa-intl.com/folders/Safety_Issues/others/aa587/ruddersnapfinoff.html" target="_blank">here</a> (with links of interest at the bottom).. .Feel free to contribute.

RatherBeFlying

14th Feb 2002, 20:56

Belgique,

If yaw on the A300 is sensed by gyro, that would eliminate my last theory/guess, but I would like to get confirmation from somebody with specific A300 knowledge before dropping that line of inquiry.

As to the possibility of incorrect airspeeds to the rudder limiter because of static system disturbances, I am so far disinclined that that was material in this case because the recorded rudder movements were within or close to the limits for the speed. However it may be possible that flight data recorder filtering censored beyond limit rudder movements or that the rudder sensing unit may have refused to signal more than allowed by the limiter.

Somebody's gonna have to fly a properly instrumented A300 through the accident flight profile, preferably under remote control -- and it might take more than one A300 to understand what really happened and verify the fix.

spinproof

14th Feb 2002, 21:44

...sorry to be dragging this out, but are we talking about those two pedal thingeys that when you step on the one on the right the plane turns right, and when you step on the one on the left the plane turns left???. .OK then..we're not suppose to do that anymore? <img src="confused.gif" border="0"> <img src="confused.gif" border="0"> <img src="confused.gif" border="0">

RatherBeFlying

15th Feb 2002, 05:58

On further thought, it looks like I've been garbling my nomenclature; so for the record:

yaw rotation about the normal/vertical axis,

sideslip angle airflow makes with the longitudinal axis.

So the yaw damper and/or rudder program(s) yaw the a/c to zero out sideslip.

And sideslip pretty much has to be sensed by an airflow sensor, be it a vane or a differential pressure between static ports or other opposite side ports in the fuselage or fin (A sensor using a classic ball would surprise me, but I'm not an instrumentation engineer).

As different flow regions are entered and exited within a vortex, the sideslip sensor could be presenting highly variable and possibly misleading sideslip conditions to the rudder program which can result in the yaw damper amplifying the condition rather than dampening it. And possibly it could get caught in FCSIO, the computer equivalent of PIO.

Now if your a/c suddenly yaws heavily, you may likely put in full opposite rudder, but don't forget the NTSB has just published that so doing may break it off <img src="frown.gif" border="0">

You may prefer to turn off the yaw damper and any other automatic rudder control immediately upon entering a wake vortex.

Few Cloudy

15th Feb 2002, 18:26

That could be dangerous advice RBF.

RatherBeFlying

15th Feb 2002, 19:06

Few Cloudy -- My suggestion to turn off the yaw damper and automatic rudder control upon entering a wake vortex [in an A300] is based on my evolving suspicion that the A300 FCS in its confusion overreacted and subsequently overstressed the fin and rudder. I suspect that this accident would not have happened if the rudder only moved in response to pilot inputs.

Certainly, if turning off the A300 yaw damper and automatic rudder control inside a wake vortex would create other hazards, I would very much like to understand how that would happen.

wsherif1

27th Jul 2002, 00:05

@#$%&, Forget the Rudder!!!

The pilots never had a chance to induce any effective recovery control inputs! The clockwise rotating vortices off the left wing tip of the B747 struck the vertical tail surfaces, fin and the rudder, BROADSIDE, at a force of 200 + mph, which induced an instantaneous left yaw. This abrupt yaw motion initiated a left Dutch roll. An eye witness statement, "The right wing was perpendicular to the ground"!

The instantaneous left yaw severed both engines from the structure and accelerated them directionally, the right engine was tossed to the left of the aircraft's track and the left engine to the right of the track.

The instantaneous left yaw presented the right side of the fin and the rudder to the slipstream plus the force of the vortices. These abrupt opposite direction bending forces exceeded the ultimate load factor of the surfaces and the rudder was torn off the structure while the fin was sheared off just above the lug connections.

The rudder movements were a result of the forces of the B747's vortices striking the rudder. These lateral forces began at a value of 0.1G through 0.3 and 0.4G to a final value of 0.8G as the aircraft encountered the fringes of the vortex and then closed on the core.

At one point the Captain exclaimed "wake turbulence". Pilots sure as hell know when we have encountered wake turbulence!
To intimate that he was mistaken is a disservice to the crew and the profession.

There is some question about an early T/O release of AA 587 behind the B747 and also the routing directly in trail of the preceding traffic.

In any case there is no way this accident was in any way connected with pilot error!

Belgique

28th Jul 2002, 08:06

Both wsherif1 and RBF have good points.
wsherif1 however seems to be missing the fact that the A300 received two wake “hits” - and the real damage was likely to have been done by the second - and for sound reasons.

Unfortunately at the time of that second “hit” the FCs was still responding to the yaw upset caused by the first. It’s like that old pugilistic “one-two” punch set. The first fist (the “right”) puts him off balance and the second (“left uppercut”) follows through at just the correct moment, catching the punch-drunk fighter dazed, off-balance and off-guard. We know that the A300 has a factual and anecdotal history of tail-wagging. However unless that involves external forces and reaches extreme amplitudes or gets nastily out-of-phase, the outcome is simply “noteworthy”, although discomfiting. In AA587’s case the characteristics of the FCS corrective rudder displacement) and the natural dampening stability of that large vertical fin meant that the amount, rate (and direction) of side-slip at the instant of that second hit was wholly adverse - and enough to break the fin off. No need to involve any pilot inputs here, in fact because of the tight timings it’s unwise to do so. But that’s not to say that attempted pilot intervention could NOT have happened. If I was sitting in the seat as PF and felt that the FCS had lost the bubble, I’d be attempting to stop the yaw nonsense (for pax comfort). That doesn’t mean that I’d be laying on a bootful. To the contrary, I’d be tromping on both pedals equally and simultaneously and trying to dampen out oscillations related to any excess pedal travel - in the hope that natural damping would stop the yawing. That’s just about instinctive for any pilot.

If the FCS has a built-in software (or CADC induced) flaw that causes any restorative rudder inputs to overtravel inappropriately, then that would explain both its reputation for tail-wagging and the AA587 outcome. Why so for AA587? Well think of it as a wake-induced yaw that went “a Bridge too Far” and entered dangerous, normally untravelled, territory. Let’s say that, after the first wake encounter, at that IAS a 5 degree rudder displacement would have been appropriate to assist the fin’s natural yaw dampening. But for some (programmed) reason the FCS fed in 10 degrees and at a higher rate than might have been ideal. The end result is an overshooting instability and an even greater amount of slip or skid out the other side - at which point the second wake “hit” occurred. For FCS failure modes see “servo control desynchronisation” and “yaw inertia” in my earlier posts on this thread (pg3).

If it had been another type aircraft (with a less rigid metal fin and rudder incorporating some flexing "give") the dynamics of the side-stresses could have been soaked up by the structure - and possibly without any permanent deformations. But it was an A300 and its vertical fin attachment is via a set of six composite attachment lugs dissimilarly mated to metal brackets on the fuselage hull. If it had been a metal-to-metal attachment and the metal upper attachment lug-set had been firmly part of a fin-embedded metal structure, then the shear of an excessive side-force may not have caused the failures in tension seen just above those composite lugs (it's called "load-sharing"). So it’s back to the composite engineers’ admissions that the composite matrix lay-up is necessarily set so as to give maximum strength in certain force directions - unlike metal. The first wake “hit” engaged an essentially yaw-static airplane. But when the second wake-hit occurred, at just the wrong moment, it engaged with some opposing FCS-induced yaw-dynamics. That combination was dynamic enough to exceed the fin’s ability to withstand lateral stresses and an attachment failure occurred. In fact it probably exceeded ultimate design load and any inherent weakness due to manufacture, repair or prior incident damage would have been minimal factors. In other words any A300 might have suffered a similar failure in the circumstances - and that’s the big worry. The one disquieting aspect of structural composites (as against metal) is that they need a continued 100% integrity. In other words, once you have a composite failure affecting load-bearing integrity, it’s likely to become progressive. The other anxieties about whether or not a visual inspection is sufficient to detect significant delamination or disbonding and the effects of resin aging and moisture ingress? They just add to the disquiet.

My spies tell me that all concerned in the investigation are now leaning heavily towards pilot intervention as being a satisfactory explanation for AA587. Even those who don’t believe that explanation remain convinced that it was an unholy stroke of bad luck that caused all those factors to come together and fail AA587’s fin. Be that as it may, I myself will be thinking twice about traveling the structural composite routes. Catastrophic failure is not supposed to occur, no matter how fast a pilot may (or may not) have been pedaling his wares. http://www.iasa.com.au/folders/images/AA587_09s.jpg

apfds

28th Jul 2002, 11:39

Some of the comments made worry me somewhat;

1. On modern swept wing aircraft it is taught to use aileron to pick up a wing,rudder should not be used. Ailerons are effective into the stall.

2.It is not full deflection of rudder that causes the damage ,it is sudden control reversal.

3. I think that 411 has hit the nail on the head, training is probably at fault and a whole generation of pilots are suffering under the misapprehension that rudder travel limiters will stop you overstressing it.

Wino

28th Jul 2002, 14:35

Now wsherif1...
Since you have access to the APA website you should KNOW that the .8 G loading was after the tail departed and the airplane was going through the airsideways shedding large parts. The other G loadings that you list are not enough to even require a write up under the new AD against the tail.

If you had been following along you would also know that there is a problem with the rudder load limiter on the A300.

Just in recurrent 2 weeks ago and doing a rudder demonstration at 250kts I knocked the sim off its jacks even knowing what was going to happen I couldn't prevent it. The only way you can use the rudder at all in the A300 once it gets going fast is to push with the opposit foot at the same time. The breakout force is higher than the force required to reach the stop. It is guaranteed to cause a POI.

Belgique...

The A300-605R uses spoilers for Roll. There is no out board aileron on the A300-605 though there is on the A300b4. And no matter what you think, you cannon RAISE a wing with spoilers. Ask the B52 pilot that flew into the ground during the airshow.

The fact that it is impossible to apply coorinated rudder at high speeds on the A300-605 is the problem. The B4 had a ratio type limiter. the 600 series has a very poorly done blocking type system.

Cheers
Wino

411A

28th Jul 2002, 15:08

Wino

Are you saying that the A300-605 has a deficient rudder control/limit design? I would have thought after all these years that designers could get it right from the get-go.

Wino

28th Jul 2002, 18:02

Yep thats exactly what I am saying.

The rudder load limiter in the A300 600 works by limiting the travel of the rudder pedals. The breakout forces are also increased .

On the ground the rudder pedals have a travel of around 8 inches in either direction. In flight the pedals are physically restricted from going further than the rudder travel required. So full throw of the rudder pedal around 250 knots is about 1 inch. The breakout force is higher than the force to reach the stop. so what happens is that the rudder becomes a toggle switch in flight. You get a choice of All or nothing. If you try and correct your all input from one side you will instantly go full travel the other way. There is no way to put in a coordinated amount of rudder without pushing with BOTH feet simultaneously to try and modulate the rudder. And it feels nothing like what you are used to when you are doing V1 cuts, crosswinds etc. Now who would push down with both feet if they didn't know?

They used to have a ratio type load limiter in the A300 b4 where normal travel at slow speed equaled normal pedal travel at high speed, with a different amount of rudder being applied so the rudder always feels the same. Boeing switched to that style of rudder load limiter from the 747 forward (IE 757 767 777) and depowered the rudder in the 727 and removed 1 completely from use so that though the 727 had a blocker limiter, force was also limited.

Some one mocked me for it, but the facts are Airbus had it right for the A300B4 and went wrong from there (All airbus rudders are blocker types)

Cheers
Wino

ORAC

28th Jul 2002, 18:44

LA Times: July 28, 2002

WASHINGTON -- The crash of a jetliner in New York last year after its tail fin ripped off is prompting investigators to question whether government structural standards are tough enough, according to sources close to the inquiry.

Boeing Co. has informed federal investigators that the tail of its comparable Boeing 767 airliner would not have broken under the forces experienced by the Airbus A300-600, said three sources familiar with the investigation.

Both the Airbus and Boeing planes meet Federal Aviation Administration structural standards. But Boeing imposes two additional requirements for its tail fin design, beyond four that are mandated by the FAA, a company document indicates.......

Airbus said in a written statement that comparing Boeing planes with its own "can easily be misleading." The company did not respond to the specific question of whether its tail fin design goes beyond minimum FAA standards, citing trade secrets and NTSB rules barring disclosure of accident investigation data.

"The bottom line is this," the Airbus statement said. "While our designs are proprietary, the [tail fin] on the A300-600--as on all our aircraft--was designed and demonstrated to meet or exceed all certification criteria established by the FAA and European certification authorities".........................

FAA spokesman Les Dorr defended the agency's standards. "There is no information that has come out of the accident investigation to date that would cause us to think any change needs to be made to the requirements. Obviously, if any such information does come to light, we would review it and determine what the proper course of action should be." Dorr also warned against comparing planes built by different manufacturers.

NTSB experts are analyzing Boeing's findings about the strength of its 767 jetliner to see if the comparison is valid. They are "trying to understand the nuances and differences ... to see if [Boeing is] talking apples to apples," said one source close to the investigation......................

No conclusions have been reached.

"Boeing may have [an airplane] that is designed way above the standard, and Airbus may have one that is designed to the standard," said the source, who asked not to be identified. "There are design standards which people are supposed to meet. If someone breaks a tail, then there is an issue with those standards"............................

The FAA standards are intended to safeguard the tail fin from such forces as extreme gusts of wind or pilots aggressively using the aircraft's rudder............

The FAA's hypothetical maneuver is supposed to represent a worst-case scenario. A manufacturer must certify that its design is at least 50% stronger than the hypothetical worst case. This added safety margin is called "ultimate load." Engineers rely on mathematical calculations and data from various kinds of tests to certify to regulators that their designs will hold up under ultimate load.

Airbus has told NTSB investigators that its calculations indicate that Flight 587 experienced forces beyond the A300 design limits, its "ultimate load," said another source familiar with the investigation. But Boeing told the NTSB its engineers tested several scenarios that involved manipulating the rudder of its 767, and "it would appear to them that their loads were below ultimate," the source added. "If you are below ultimate, you wouldn't break the tail."

According to this source, Boeing obtained data on the forces experienced by the Airbus plane and then calculated the effects of those forces on its plane. The NTSB then asked Boeing to do additional tests.

"They tried to get the worst possible scenario, and they [were] getting loads below ultimate," said the source.

The Boeing standards raise the bar on what the FAA requires.

For example, the company calls for its aircraft to withstand full rudder in one direction followed by full rudder in the opposite direction. (The FAA only requires a full turn in one direction, followed by a quick return to neutral.)

"The net result of this approach is that there has been no catastrophic structural failure of a Boeing airplane due to pilot control input in 40 years of commercial operations involving more than 300 million commercial flights," Boeing said in a recent bulletin to pilots.

The NTSB has scheduled hearings in October on the crash. Agency officials have stressed that they are still considering a number of factors, including the actions of the pilots, the design of the tail fin , the operation of the rudder controls, possible preexisting problems with the plane and the performance of the advanced composite material used to build the tail. The NTSB has rejected a call by some American Airlines pilots to recommend grounding all Airbus A300s.

"There are a lot of unanswered questions at this point," Loeb said. "This is a very complicated investigation. The issue is not solely the structural capacity of the tail. It is a combination of that and the rudder control system."

If the crash leads to tougher design requirements, manufacturers literally would have to go back to the drawing board to plan costly changes to many existing aircraft. Another option would be to impose higher requirements on new aircraft, while advising pilots to exercise caution in flying older models...............

The full article can be found here, you need to register, but it's free:

LA Times (http://www.latimes.com/news/printedition/front/la-na-crash28jul28.story?coll=la%2Dhome%2Dtodays%2Dtimes)

wsherif1

28th Jul 2002, 19:25

You can quote all the technical details about the operation of the A300 rudder but the rudder and its possible operation by the pilots is not relevant!

The 200+ mph force of the rotating vortices striking the FIN, (vertical stabilizer and the rudder), BROADSIDE resulted in an INSTANTANEOUS left YAW! A strong, abrupt left YAW will initiate an INSTANTANEOUS left Dutch roll! GONE MAN GONE!

The pilots were just along for the ride! They did hold full right aileron, but with little or no effect.

Eye witness statement, "The right wing was perpendicular to the ground"!!!!

Wino

28th Jul 2002, 20:55

Comeon Bill you got to be kidding me. We been over this on C&R.

Tell me again how it was windshear that caused the egypt Air 990, and shutting down the engines was the captain trying to save the ship.

I know someone played a dirty trick on you in the sim once but get real. The world has changed alot since your 707 days and the aircraft are very different.

So you opinion is that this is the very first time that anyone hit a 747 wake? If not where are all the other smoking holes.
They werent THAT close

Cheers
Wino

wsherif1

29th Jul 2002, 01:37

Your statement, "The .8 G loading was after the tail departed." is open to question!

At 16:04.5 Rudder data becomes unreliable. The NTSB states, "The FDR shows lateral acceleration increases to 0.8g, yaw rate of 10 deg/sec. left bank through 25 deg. with pilot applying right wheel, pitch down to -30 deg.! The perfect description of a Dutch roll! Eye witness statement, "The right wing was perpendicular to the ground"!!!

You state, "The other G loadings that you list are not enough to even require a write up under the new AD against the tail." These other G loadings serve to illustrate AA 587's path through the vortex beginning at the fringes and then transitioning through to the core of the vortices.

You state, "If you had been following along you would also know that there is a problem with the rudder load limiter on the A300." I must admit that I pay little attention to all these comments about the rudder system as I deem them irrelevant to the cause of this accident.

The main control surface involved is the total surface of the vertical stabilizer and the rudder. This large surface area is now the major flight control surface on the aircraft and when struck by an enormous force broadside to this surface there is no other maneuver possible except an instantaneous yaw motion!

The rudder movements were the result of these broadside hits, first on one side and then on the opposite side. There were no pilot inputs to the rudder relevant to this accident!

Fraternally

RatherBeFlying

29th Jul 2002, 03:25

NASA is developing a wake vortex model at NTSB's behest.

We need that model to quantify effects on the sensors, entire a/c, fin and rudder control system that various transects of the wake vortices and region between would produce.

Until then, it's just speculation.

I notice that nobody seems to be in a hurry to fly an A300 or anything else through a low level 747 wake to research the accident profile -- can't say I blame them.

wsherif1

29th Jul 2002, 19:42

Reply to WINO post 600.

OK, I say again. Wind shear, from turbulence, across the
openings of the Pitot-Static System can cause low pressures which can induce erroneous flight instrument readings. Turbulence can also induce aircraft attitude transitions, (ask Captain Goode about his aircraft's attitude gyrations.) These triggers can induce instinctive pilot flight control inputs that may result in aircraft upset accidents! e.g., NWA 705, EgyptAir 990, SilkAir MI185, etc.,etc. (Reference to EgyptAir 990 accident)

I know the world has changed but the laws of physics have not. The B707 or the 767 still accelerate at the rate of G! Instantaneously! The Captain called for engine shut down after the aircraft was indicating .99 Mach! Incidently, the elevators did not split until after the .99 Mach point! (EgyptAir 990 accident)

This is the first time, in almost 100 years of flight, that we are aware of, that an aircraft has entered the core of a vortex behind a fully loaded B747 at climb power. (AA 587)

A little knowledge can be dangerous, but too much reliance on book learning can lead to obfuscation! Remember the basics!

Fraternally

Wino

29th Jul 2002, 20:28

So bill, if the Aircraft dutch rolled you don't think that would be because the TAIL WAS MISSING!

Come on bill, you don't fly the aircraft, you have been out of it for a while, and the greater increase in INS for flight instruments rather than the old DGs and stuff change their ability to be spoofed...

The first input in the DFDR by Sten was a coordinated input (rudder and aileron went the same way) Later events were different.

Your reliance on witness reports is really funny. I choose to use the one that reported the explosion, and the other 1 that reported a missle.

We have been doing those departures out of Kennedy for years bill. Every damn day. They weren't any closer than 100s of other wake encounters. The seperation wasn't especially tight. And like the 727/737 encounter that lead to PITT the only thing that the wake did was start the event. It didn't tear the tail off. You are the only person talking about 200 kts wind blasts shearing off the tail. The NTSB is not, the APA is not, the FAA is not, how is it that you, not a party at all to the investigation come up with this brilliant insight?

ANd the captain didn't shut down the engines of 990 himself to try and save the aircraft. While that would reduce thrust in the 707 days and not change controllability much because of the cable backups. It would be SUICIDE in a 767, Which incidentally is exactly what 990 was (murder suicide to more precise because of all the people he took with him)....

wsherif1

30th Jul 2002, 01:53

If the tail was missing there could not be a Dutch roll!

It is true that I do not fly the particular aircraft but you still push and pull the same way!

I have survived a B707 pitchup, a 12,500 free fall, a severe aircraft wake turbulence encounter 45 miles behind another B707,(in smooth air) Dr. AA Wray of NASA affirms that in smooth air conditions aircraft wake turbulence can persist for extended periods of time.

Yes there have been many improvements in flight instrument technology but they still rely on the basic pitot-tube static port sensors. Wind shear forces across their openings produce low pressures. See Boeing Publication, "AERO 08" for info. on the possibility of erroneous flight instrument indications. See the TV coverage of the COPA B737 accident over Tucuti, Panama. When they ran the FDR readout through the computer the Boeing engineers declared that the radical maneuvers were impossible for the aircraft to perform!

NASA states that the rotating vortices forces in aircraft wake turbulence can be as high as 300'/sec. When this force strikes the total surface of the vertical stabilizer and the rudder, first on one side and and then immediately on the opposite side, the possibility exists that the bending forces may have exceeded the ultimate load factor of the vertical stabilizer and the rudder. Which obviously it did!

I never said the EgyptAir 990 Captain shut down the engines himself. You obviously have not seen the FDR readout of the 990 accident. The NTSB reported the elevators were split and intimated that the crew were fighting for control of the aircraft. This is absolutely incorrect! The FDR shows that both elevator control inputs were exactly the same until the aircraft reaches .99 Mach! At this time the flight controls are subject to buffeting and the aircraft is now beyond recovery from the dive attitude!

The NTSB also claims that there were no flight anomalies prior to the Co-pilot's first exclamation of a prayer. Again the NTSB is evidently unable to read the FDR. On the FDR readout there is an abrupt right bank input and the Co-pilot says, "control it"! Seconds later the first prayer is voiced!

The NTSB completely ignores the, "Egypt Air 990 Track Plots" which indicates the number of aircraft on crossing flight paths at similiar times.

The NTSB ignores the 'thumps' of the turbulence and the clicks of the stabilizer trim wheels, in the cockpit, as they react to the wind shear of the turbulence!

The Co-pilot of EgyptAir 990 did not commit a deliberate suicide, as Jim Hall claims, but he did commit an INADVERTANT suicide in reaction to turbulence induced aircraft attitude transitions and erroneous flight instrument indications! Excerpt from an NTSB letter dated January 21, 1998. "Pilot reaction to turbulence, MOSTLY INADVERTANT, does cause more problems than the jolt of turbulence itself"!

To indicate further the incompetence of the NTSB, I refer you to the United 826 accident (one fatality, five broken necks and seven broken backs, besides other serious passenger injuries, from supposedly, clear air turbulence.) The NTSB claimed that the aircraft had encountered a force of negative 0.8 G and the passengers had been subjected to a force approaching Zero G. When I received a copy of the FDR, from the NTSB, in response to a letter I had forwarded regarding this accident, it was obvious that the actual reading was 1.8 negative G! How would it be possible to inflict a fatality and the other serious injuries at a force approaching Zero G!

When I asked a senior NTSB investigator , at a hearing, how they had arrived at their reading of 0.8 negative G? He replied , "You start from zero and count down to the maximum point and that is the G reading! When did we start flying around at Zero G!!!

At a later time there was an article in the AW&ST about a French aircraft turbulence encounter. They had a copy of the FDR readout included in the article and believe it or not they were also measuring the G force from the zero G line!

I could remark on other gross errors the NTSB has made in other investigations but will save them for another time. Don't take the theories of the NTSB too seriously. That is the problem with the technology challenged media, they echo whatever the NTSB spouts!

Happy flying

Belgique

30th Jul 2002, 15:49

Below (the preamble) I've attempted to point out the significance of the A300 FDR's limitation (of only being connected downstream of where FC system data was being "filtered").

The following extract's from the 12 Apr 02 7th NTSB Public Release at:

http://www.ntsb.gov/Pressrel/2002/020412b.htm
My theory (on Pprune) about the probable CADC involvement pre-dated this by some months.

1. "Other Airbus Event

The Safety Board is interested in another upset event last year involving an Airbus aircraft. On November 25, 2001, a Singapore Airlines A340-300 departed Singapore for a scheduled flight to Dhaka, with 96 persons aboard. Shortly after takeoff, the pilots noticed a problem with airspeed indicators. Among other things, there were overspeed warnings and large rudder movements without pilot input. The aircraft returned to Singapore and made a safe landing; there were no injuries.

Inspection subsequently found problems with the pitot and static connections to the air data computers, which may have been introduced during recent maintenance. The Civil Aviation Authority of Singapore is investigating the incident. Due to computed loads that might have been experienced by the vertical stabilizer, it and the attached rudder were removed from the aircraft shortly after the incident and were recently examined in Germany.

Although no damage was found in either the stabilizer or the rudder, the Board is interested in the rudder system’s role in this event."

I consider this prior event to be very significant - and indicative of a design glitch within the A300's FCS. In fact...even Blind Freddy could see that.

2. from http://www.ntsb.gov/Pressrel/2002/020115.htm
Flight Data Recorder

The flight data recorder continues to be analyzed. That process is taking a little longer in this case because signals for some parameters on this aircraft are "filtered" before they reach the flight recorder. The filtering operation is used to smooth data that drive cockpit displays so that the needle (or other indicator) does not jump around. This filtering is accomplished by averaging the data over time. When large, rapid movements are made, this averaging will distort the recorded data; rapid, extreme control movements are clipped off. As a result, the readings on the recorder show what the gauges were telling the pilots, not necessarily what was actually occurring on a real-time basis to the aircraft. This will require some aircraft testing and then further computations by Board staff to get the true readings on some parameters of interest like rudder, elevator, and aileron movement. Although this has added to the workload of investigators, it is not expected to affect the quality or the timing of the Board's final product.

In 1994, the Safety Board recommended to the FAA that such filtering systems be removed from information sent to flight data recorders. The FAA told the NTSB that its 1997 final rule amending FDR requirements "precludes the use of a filter and specifies the seconds-per-sampling interval for all parameters." Based on that information, the Safety Board closed its recommendation as "Acceptable Action" on August 9, 2000. The Safety Board has alerted Airbus and the FAA of the problem noted on the recorder recovered from American Airlines flight 587.

Reference Loral F-800 DFDR (and its unsatisfactory performance in prior accident investigations)
Page 88 of 353 at http://www.caa.co.uk/docs/33/CAP455.pdf - previously declared defective and obsolescent by the UK CAA

wsherif1 said:
"Wind shear, via turbulence induced in the Pitot-Static System, can cause fluctuating pressures which can induce erroneous flight instrument readings. Turbulence can also induce aircraft attitude transitions. ... These triggers can induce instinctive pilot flight control inputs that may result in aircraft upset accidents"

Developing that a little:

If in fact the CADC's response to instantaneous pressure changes are so rapid that the pressure fluxes inside a wake vortex double-whammy can generate instantaneously inappropriate FCS responses and wholly out-of-whack rudder limiter constraint settings and yaw-damper interventions, then that would go a long way towards explaining AA587.

In other words, during a wake encounter the airplane's wild gyrations are continually challenging the FCS to correct - but because of the pressure spikes being input into the CADC and the dynamism being fed to the rate gyros, any satisfactory "derived" outcome becomes unlikely. Why is that? One answer might be "inappropriately interacting FCS algorithms". Consider here the 25 Nov 01 Singaporean A340 that had wild airspeed fluctuations and overspeed warnings plus uncommanded rudder deflections - all (allegedly) because of some CADC maintenance glitch in its pitot-statics. Consider also that the reason why the Loral FDR's record is "filtered" was because the data pickoff is downstream of the point where the FC system itself was being filtered. Now why would you do that to an FCS? (heavily filter its I/O)- unless the input data-rate of some circuits were too high and causing undesirable FCS system reflex confusion or incomplete/over-reaction? I'd suggest that Airbus isn't telling the whole truth about some of the design compromises that were made (forced) once they got into the original experimental test-flying. Maybe the signal filtration (damping) was required to quieten down some control surface/sub-system inter-actions (rudder limiter/ PCU / yaw damper) - that might have been producing undesirable results (the hydraulic chatter or system-induced oscillations that I introduced originally)..

To get one's mind around this, and why the airplane sometimes responds normally (and sometimes doesn't), think of it in these terms. The original A300 FCC design probably accommodated trending rate data rather than raw processed flight control surface positions and airplane axis displacements. In other words, if a developing yaw-rate was detected (e.g. heading beginning to change nose-left at a certain rate) the FCS would instantly outguess it by feeding in a minor countering rudder displacement - and restore stability even before any significant yaw had actually happened. The basis for the sensing of such a finely tuned rate-sensitive system would be highly tied and integrated rate sensors (i.e. gyros), control surface position transducers and CADC I/O data (based upon digital integration of raw pitot-static info).... all designed quite early on in the digital age.

In any steady-state near-equilibrant scenario such a system is going to give a very comfortable ride. However if the rate sensing and pressure sensing was subjected to significantly divergent data flux (as in the sizeable rapid pressure reversals and momentary aircraft attitude changes within wake turbulence), the inbuilt lag in the physical FCS (hyd valves, actuators and motors, inclusive of stab and trim) would subside into systemic chaos and the ultimate nightmare of slipping into an out-of-phase response condition.

It's partly a function of the rate of integration of analogue data and partly due to the physical limitations of mechanical interfaces, but even inertia gets to play an increasing role as the flux becomes stronger and the displacements greater. Rudder limiters and yaw dampers would be responding inappropriately (to the point of amplifying rather than damping) and yes, even the pilots could be sucked into trying to resolve any resulting excursions or oscillations by tramping the rudder pedals - and themselves become out-of-phase and part of the complex problem of systemic aperiodicity.

So I remain convinced that an external initiating event (the wake encounter) was necessary to set this "bridge too far" process in train. The gross pressure fluctuations and ever-changing attitude within a strong wake was enough to get the A300 FCS into its high-gear resolution mode - but (contrarily) its built-in ability to rapidly detect and respond to instantaneous trends was then enough to drive the rudder responses into an out-of-phase frenzy. In consequence, at exactly the wrong moment, (and at the wrong angle [in the wrong attitude and flight-path]) the a/c hit the second wake and the fin's port-side attachment failed laterally in overload shear, the fin rocking a few times but then rotating laterally around the three stbd lugs until it tore away.

So perhaps with AA587's rapid breakup we've now seen the very first system-induced oscillation (SIO). Or perhaps that should read SRC (System Reflex Confusion). Underbuild (or underspec?) of the composite fin I see as only contributory - although of course without that factor it may have been just a wake turbulence incident (non-reportable unless someone was injured).

But the FDR's plumbing and deficiencies can perhaps be seen as a clue as to why the A300 FCS was so heavily filtered - and poses questions about why that might have been necessary - and just when might it have been introduced into the design (in consequence of ...?). My guess would be sometime well after that first prototype flew...... and for good reason. It would have been a software implementation I guess. I'd be surprised if "aperiodicity" doesn't make it into the final report. It's a word that belongs with the study of vortex behaviour - but in an entirely different sense than it probably applied to AA587's sudden flight control system's conundrum.

arcniz

30th Jul 2002, 19:40

Belgique - You're hitting close to the mark. I have reached essentially the same view (also aka Systemsguy) as the facts (and gaps) have emerged. It now seems plausible that the failure could have resulted - in part - from System-Induced rudder Oscillations originating in an adversely resonant combination of sensor sampling rates, sample-errors and averaging effects -- with those made possible by design gaps in the conception and testing of the rudder control SYSTEM for a full range of boundary cases.

The uncomfortable aspect of this idea is that it implies an inherent weakness of design characteristics in the system which could be triggered again in another situation under similar or quite different circumstances.

One point on which I differ slightly is that I do not think (after rather many hours driving experimental control systems around in various situations, including aircraft) that signal filtering and pre-processing is inherently a bad thing - so long as one does not destroy too much useful information in the process. Out-of-sync timing of control responses - or some processes using filtered data and some using unfiltered - can get you resonating faster than mere hamfisted filtering.

At a philosophical level, the current cohort of civil FBW and non-FBW transport aircraft designs may be seen as straddling the line between all-direct-coupled (mechanical:analog) and all-robotic (electrical/optical:digital) sensing and control systems. Prior generations were mostly mechanical, and the successor ones will be mostly robotic. We are just at the cusp. The problem accompanying this is that the two philosophies do not always mesh well at either technical or human (design and support) levels, so such hybrid systems can have unique failure modes which simply do not apply in either form of the 'pure' implementation.

And it seems really very unfortunate that the inflexible, mysterious, and not-overly-strong tail design was added to this broth.

Whatever the official conclusions, some timely re-engineering seems prudent and likely.

wsherif1

30th Jul 2002, 23:28

Belgique,

Your reference to my comments on wind shear affecting the pitot-static system causing erroneous flight instrument indications, while valid in 'upset' accidents are not applicable in the AA 587 accident.

The strength of the clockwise rotating vortices striking the left side of the fin, BROADSIDE, initiated such an instantaneous left yaw motion, and resultant Dutch roll, that the flight instrument readings were of no significance.

Ths instantaneous left yaw then presented the right side of the fin to the slipstream and the same vortices forces on the right side of the tail surfaces. This immediate reversal of the bending forces, exceeding the ultimate load point, sheared off the fin just above the attaching lug connections.

The tremendous forces involved in this radical, instantaneous maneuver were beyond any possible pilot induced flight control, (rudder), input to initiate or recover from. The forces striking the combined surface area of the large vertical stabilizer, (two engine aircraft design), and the rudder, together, was the initiating source of this accident.

Eye witness statement, "The right wing was perpendicular to the ground"!

Any time two engines are sheared off the structure there will be fire, smoke, and explosive noises!

Best regards

Wino

31st Jul 2002, 01:54

Bill Go buy a balsa wood glider, take the tail off of it and I will show you an airplane with the wing vertical to the ground.

587 cut across the radius of the 747s turn it wasn't following it strait so it wasn't a 90 degree hit.

When the tail came off the aircraft became onstable in Yaw and went through the air sideways decelerating at .8 g...

I know you old guys are set in your ways but please....

Wino

wsherif1

31st Jul 2002, 23:36

Wino,

Obviously in your relatively limited experience you have never been in a strong yaw maneuver!

They did not have a yaw damper in the early days of the 707 operation!

Never shove the nose down in a 'pitchup'!

SaturnV

1st Aug 2002, 03:17

wsherif1, you repeatedly assert that a witness saw AA587 with the right wing perpindicular to the ground. The NTSB has logged 349 witness accounts, and has summarized these as follows:

"The Witness Group has received 349 accounts from eyewitnesses, either through direct interviews or through written statements. An initial summary of those statements follows:

· 52% specifically reported seeing a fire while the plane was in the air, with the fuselage being the most often cited location (22%). Other areas cited as a fire location were the left engine, the right engine or an unspecified engine, and the left wing, the right wing or an unspecified wing.
· 8% specifically reported seeing an explosion.
· 20% specifically reported seeing no fire at all.
· 22% reported observing smoke; 20% reported no smoke.
· 18% reported observing the airplane in a right turn; another 18% reported observing the airplane in a left turn.
· 13% observed the airplane "wobbling," dipping" or in "side to side" motion.
· 74% observed the airplane descend.
· 57% reported seeing "something" separate from the airplane; 13% reported observing the right wing, left wing or an undefined wing separate; 9% specifically reported observing no parts separate."

It would seem from the great variance in these accounts that one could find support for an assertion that the right wing was perpindicular, the left wing was perpindicular, or the plane was in a horizontally level descent.

I also don't think you advance your argument by insisting that SilkAir and EgyptAir 990 were caused by wake turbulence. Surely you don't believe that wake turbulence induced a sequential disconnection of SilkAir's FDR and CVR while the plane was in cruise. EgyptAir 990 crashed at about 1:50AM EST, a time of light North Atlantic traffic in that sector, as the ATC transcript indicates. Looking at the FDR tabular data sets, it would seem that the EgyptAir flight anomaly you are referring to is a very brief -0.53 roll several seconds before the co-pilot is believed to say 'control it'. Yet this same degree of roll also briefly occurred at 01:43:28 EST, without comment or concern. (The captain leaves closing the cockpit door at 01:48:22; 01:48:24 roll of -0.53; 01:48:27 roll of -0.35; 01:48:30 'control it'; 01:48:30, roll of -0.18; 01:48:40, the first of the "I rely on God" statements by Bahouty; 01:48:40, roll of 0.00. The AoA, pitch, and roll values do become anomalous startring at 01:49:40; at 01:50:04, pitch of -22.50, roll of -10.72; the captain re-enters the cockpit at 01:50:07, asking "what's happening? what's happening?"

Pehr Hallberg

2nd Aug 2002, 08:10

My experience as a pilot is very limited (Gliders). I have been working with software development and testing since the 60's. I am on the PPRuNe out of interest and to learn.

Reading the input from Belgique and arcniz gives me a nasty feeling of recognition.

There is no such thing as a complex software system without bugs in it. Combine this with filtering of the input, maybe errors in the input due to failures in the sensors and you may end up with a very strange response from the system.

From my experience. If I had to choose between two boxes doing the same thing:

1 A proven mechanical device

2 The latest computer controlled gadget in the market

and it was vital to me that the thing performed as advertised I would choose number 1.

PickyPerkins

2nd Aug 2002, 19:17

The F-meter

It seems to me that w.r.t. tail fins coming off a/c, and what is too much (or too little) rudder input in various circumstances, that there is an existing potentially useful technology which is not getting any attention.

Many aircraft have G-meters. As you know, these are based on strain gauges which measure forces on things. An electrical resistance element gets stretched and the resistance goes up. Very simple and cheap.

You fly a plane with a G-meter so that the needle does not go into the red. Doesn’t matter whether you are heading vertically down at speed, you do whatever you have to do to the controls to keep the needle out of the red (particularly at speed).

The tail-fin problem seems to me to have some similarities. You use a G-meter to keep the wings from coming off. We need an F-meter to keep the fin from coming off.

Fins come off (I am assuming) because the stresses and strains are more than the fin can stand. As has been pointed out, this might arise from wake vortex action without any pilot input. So put a strain gauge on the fin and a display in the cockpit. No debate now as to what is too much pilot rudder input or too little, just keep the needle out of the red. In a pronounced yaw the pilot rudder input may have to be to keep the rudder inline with the airflow and hence will seem to the pilot to be in a direction to INCREASE the yaw. However, if you don’t the needle may go into the red.

Of course, in practice it won’t be quite as simple as I am making out. For instance:

(a) where do you put the strain gauge(s)? You may have to use a number of gauges at a number of points, each output scaled to the max. permitted strain at that point, and feed the largest value to the cockpit display.
(b) can you retrofit gauges? Gauges are usually just glued to a surfaces, so this may not be a great problem. Maintenance may be a problem for gauges exposed to the weather and the fingers of the curious. But at least some could be applied to or near the internal protected fin-attachment lugs, and within the fin.

The greatest potential advantage seems to me to be that in normal flying pilots will get a feel of how stresses on the fin are related to rudder inputs and turbulence in various phases of flight (regardless of how yaw-dampers and computers may be modifying your control inputs).

You would get a direct reading of what matters, as with a G-meter.

What do YOU think?

wsherif1

3rd Aug 2002, 00:17

Having a G meter reading available in the cockpit would be of considerable value to the pilot, however in the case of the AA587 accident it would have been of little use.

When the vertical stabilizer and the rudder were struck broadside by the forces of the 747's clockwise rotating vortices the resulting instantaneous yaw maneuver was initiated before the pilot had a chance to react to what would have been erroneous flight instrument indications anyway. The pilots were just along for the ride!

Wino

3rd Aug 2002, 02:52

I love a guy who goes into the investigation with the whole thing solved ahead of schedule.

As to limited myexperience...

10 years of airline line flying 3 years as a FCF (funtional test flight) pilot. engine out ferry, new aircraft receipt and delivery, post maint test flying. I have moved aircraft in and out of the desert (that usually involves lots of interesting things not being installed on the aircraft). So don't assume that I don't know about yaw and manuevering. I have personally stalled 42 B727 aircraft. Full stalls as required by the RAM 738k boeing's post D check flight test checklist.

I have done PLENTY of flying without yaw dampers bill. I have also had a 727 depart at 18k and recovered at 6 after 3 inverted turns when the bullnose on a kruger was misrigged (that's the whole point of the test flights) and the aircraft departed 4 knots before predicted shaker, as the right engine surged from the disrupted airflow just as the wing broke down...

So Bill, we are in an area where I probably have more experience that you as you only flew the line. You should know who you are talking down to.

I say again. There was nothing Unique about 587's departure. Plenty of other aircraft have gotten much closer and more perfectly aligned with the wakes of 747s and they still have their tail.

What that person demonstrated to you in the sim was a crock. Its like what Airbus did in the sim with me when I went to Miami Airbus factory school to get my A320 rating. They have what they call the "dollar ride" to get you used to the sidestick controller on your first day. after you fly around for a little they tell you to close the close the throttles and peg the stick in the back right corner of its movement. That gives you a 2.5 G 66 degree climbing spiral as you bleed speed off Alpha Floor kicks in and the engines go to full power that the sim goes up at 10k per minute. Now that is really cool, but ask yourself if ANY airbus product can sustain a 10k per min climb wing level. Of course the answer is no, so there is no way that adding 2.5 G loading on the aircraft is gonna improve climb performance so its just a game they put in the sim to make you go Gee whiz what a cool plane. Doesn't mean its real.

Samething goes for your sim experience where that instructor crashed you... There was a bug in the program and the sim guy exploited it.

Cheers
Wino

wsherif1

3rd Aug 2002, 04:52

Please cancel all references to experience levels!

I still see all the evidence pointing to a radical yaw induced Dutch roll from strong aircraft wake vortices striking the fin and rudder broadside.

I guess we will have to wait till NASA comes out with their wake analysis to get a true picture.

Fraternally

stator vane

3rd Aug 2002, 07:22

seems a bit extreme.

experience in real airplanes, especially stalling them and rolling around in them would allow the person to FEEL some of what is actually happening and i will respect that more than any simulator experience, and i will listen to someone who has actually experience, especially a test pilot.

i will also listen to someone who seems to be focused on the 747's vortex aiming onto the rudder and not touching any other part of the airplane. but it seems a bit narrow.

may as well cancel all reference to experience when hiring as well.

Wino

3rd Aug 2002, 15:39

Stator,

WSherif1 was referring to me.
He is retired AA and I am relatively new to AA and as such he assumed that my experience was limited to 2+ years at AA plus maybe an F-16 before hand. He didn't know that I can out of several other airlines and did post maint. work there...

Because we have also crossed swords on the APA message board called C&R we both know all about a little section of each of our lives but not the whole picture. We would still be sluggining out on C&R if that software wasn't so darn clunky that it just isn't worth my while.

Bill,
I agree that we will wait. I just want to remind you everyone jumped to exactly the same conclusion with USair 427 in Pitt. When push came to shove and they flew the 2 airacraft in VERY close proximity (much closer than the accident) Lo and behold it was found that wakes while interesting were nothing more than a trigger for a mechanical problem lurking in the aircraft.

Cheers
Wino

wsherif1

3rd Aug 2002, 21:37

Wino,

Your reference to the USAir 427 accident in Pitt.and the 727 wake experiment indicating that the wake was of no consequence but only triggered a mechanical problem ignores the fact that wake turbulence can trigger a pilot's instinctive reaction to aircraft attitude transitions along with erroneous flight instrument readings, due to the wind shear forces in turbulence..

Excerpt from a NTSB letter dated January 21, 1998. "Pilots reaction to turbulence, MOSTLY INADVERTANT, does cause more problems than the jolt of turbulence itself."

What mechanical problem are you referring to?

The aircraft crashed in a left bank attitude. Both pilots left legs were fully extended (medical examiner statement) and both left rudder pedals were sheared off their supporting structures!

Pilot reactions to turbulence is fully documented in TWA 705, United 585, COPA 185, USAir 1016 and EgyptAir 990 accidents.

AA 587 is not included in this catagory as the pilots did not have the time or the conmtol force available to counteract the immense forces on the combined fin and rudder surface area.

Fraternally

.

stator vane

4th Aug 2002, 07:49

do you think it all hangs on the wake turbulence and the pilots' reaction to it? in the AA and the B737 events as well?

was there then nothing wrong with the B737 rudder PCU's after all?

personally i have never had any rudder runaway-YET-but it sounds as if there have been some definite events in the rudder from what i have read.

i am simply reading this thread and asking questions if that is okay. not attacking at all.

all this leads me to state that more unusual attitude recovery in real aircraft or the sim would be more useful than ADF approaches. regardless of how many factors entered into the event-wake turbulence, yaw dampers, rudder PCU reverse flow and jamming, composite failures and sure enough, the pilots' reactions-even if some of the control came back while the aircraft was over on it's back and headed into the ground, more familiarity with unusual attitude recovery would not hurt matters at all.

cheers;

PickyPerkins

4th Aug 2002, 17:23

Pehr Hallberg There is no such thing as a complex software system without bugs in it. Combine this with filtering of the input, maybe errors in the input due to failures in the sensors and you may end up with a very strange response from the system.

From my experience. If I had to choose between two boxes doing the same thing:
1 A proven mechanical device
2 The latest computer controlled gadget in the market
and it was vital to me that the thing performed as advertised I would choose number 1.
I couldn't agree more.

wsherif1

4th Aug 2002, 19:08

Stator Vane,

AA 587 was not a pilot reaction to turbulence, it was strictly the
aircraft's mechanical reaction to the rotating vortices force against the large surface area of the fin & rudder. The pilots had no effective control of the aircraft.

When you ask about the B737 events (United 585 at Colorado Springs and USAir 427 at Pitt.) here we are in a completely different situation. United encountered mountain wave turbulence which affected the flight instrument indications. The pilot reaction to an attitude transition (nose up) and erroneous flight instrument readings triggered pilot flight control inputs and the aircraft pitched over into a dive. Co-pilots exclamation, "Oh God (Flip)"! Note, she did not say Roll!

The NTSB removed the final controllers sworn statements from the official report! The controller said, "The aircraft never rolled it went straight in"!

In the USAir accident the NTSB claimed the wake turbulence from the B727 just minutes ahead had no effect on 427! They do not understand that the flight instruments can be affected! The pilot reacted to erroneous flight instrument indications! Pilots have been injstructed throughout their careers to believe their instruments and have not been told about the possibility of erroneous indications from wind shear forces in turbulence.

There never was any problems with the B737 rudder! As you know, even after they modified the rudder they continued to have problems.

The numerous reports of rudder malfunctions is, in most cases, actually aircraft wake turbulence. Dr. AA Wray of NASA affirms that in smooth air aircraft wake turbulence can persist for extended periods of time. I had a severe wake turbulence encounter 45 miles behind another 707, in smooth air!

The 'Industry' has so sensitized the pilots to this supposed rudder problem that recently a crew returned to land because the aircraft 'shuddered'!

You are correct more instruction in unusual attitude recovery is imperative. The present, Aircraft Upset Recovery Training Aid, is not only misnamed but in one reccomended procedure can almost guarranty an aircraft upset accident. It should be named Aircraft Unusual Attitude Recovery Training Aid. Once an aircraft is upset into a steep dive attitude the acceleration of G is so rapid that the possible recovery velocity is exceeded and the aircraft breaks apart in the air. e.g. NWA705, COPA 185, EgyptAir 990, etc.

The 'Industry' still insists that an aircraft will pitch down in an updraft! In my 'pitchup' in a B707, (in the clear above strong thunderstorm activity), from a weather induced updraft, the aircraft pitched up, instantaneously, to an attitude of 20-25 degrees! There was no zoom in climb just some mechanical lifting with the updraft. The aircraft's momentum carried it along, in this attitude, on its projected flight path.

Due to the vertical component of the relative wind there was no zoom in climb as you would expect in this nose attitude transition. No zoom, no increase in aircraft load factor, 'G'! No increase in G, no loss of aircraft's kinetic energy! No loss of kinetic energy no iminent stall threat! No stall threat no need for a radical pitch control input! Ease the nose down to the actual horizon, as in my case, or artificial horizon if on instruments! NOW THE BIG PROBLEM! Your flight instruments will show a rapid climb and slowing airspeed! The pilot's natural reaction will be to shove the nose down. With this radical control input and the vertical component of the relative wind, the aircraft will pitch over into a vertical dive. In the NWA 705 pitchup accident the pilot trimmed the horizontal stabilizer nose down but the aircraft did not respond as expected so he further trimmed to the nose down stop. Now he exited the updraft and normal relative wind conditions took affect and the full nose down trim pitched the aircraft over into a steep dive attitude. The aircraft came apart in the air during the attempted recovery! In the investigation both gyros exhibited severe impact damage on the nose down stops!

In turbulence the aircraft must be controlled with reference to the artificial horizon only! The erroneous flight instrument indications that trigger pilots' instinctive reactions must be shielded from the pilots' field of view! A 'heads up' presentation of the artificial horizon on the windshield?

Regards,

wsherif1

Wino

5th Aug 2002, 07:07

Bill you are working with outdated info on 427 and colorado springs.

I suggest that you get last month's (maybe 2 months ago now) Air and Space magazine. It has a long detailed description of the investigation and how they thought what you thought was true untill they found the mechanical defect in the 737s rudder that causes it to reverse (You step with right foot and it goes left) and then JAM at the stop. The problem is real and now known and turned out to be common to the redesigned rudder. The aircraft have been speeded up to faster than crossover speed as a near term bandaide till the fleet can be fixed.

Your hypothesis was given a VERY serious look at by the NTSB and the FAA and everyone else untill the real mechanical defect was found. We have found enough defects in the A300 as well.

Cheers
Wino

PS. If you can't get a hold of Air and Space shoot me your address and I will copy it and forward it to you if I still have it

wsherif1

5th Aug 2002, 21:46

Wino,

The NTSB really had to work hard to find some mechanical fault to cause a supposed rudder problem.

As you will recall they then determined that the United 585 accident at Colorado Springs, CO must have experienced the same problem, so they finally solved this previous accident by blaming it on the rudder also.

I don't know if you have read the ATC Chairman's Factual Report on this accident. It is very enlightening! The NTSB never acknowledged or mentioned it in the final report!!!

This 'Factual' report contains the sworn statements of the final controller handling the aircraft at the time of the accident. Qiuote from Mr. Rayfield (final controller), "The aircraft never rolled it went straight in"! etc., etc.

You quote the supposed problem in the 427 accident, "You step with right foot and it goes left and then jams at the stop." Please explain the fact that both pilots' left legs were fully extended at impact (medical examiner) and both left rudder pedals were sheared off their support structures!!

The NTSB will do whatever is needed to cover-up accidents that might alarm the flying public , meanwhile they are obscuring the real causes! They have removed essential data from the official report on the TWA 800 accident, they are reading the FDR readout from the Zero G line!, They have ignored evidence in the EgyptAir 990 accident and implied evidence that is absolutely not true.!! etc. Save us from the NTSB!!

Cheers!!

Belgique

14th Aug 2002, 20:30

Obviously AA587's tail fell off after it was sorely abused. There's but one candidate for said abuse (IMHO). It's just the process that they now need to hunt down.
This 13 Nov 01 incident below may be relevant (happened quite remarkably the day after the AA587 crash).

FACTUAL INFORMATION
A Boeing 747-SP38 aircraft was maintaining Flight Level (FL) 430 with autopilot `A' engaged, when the aircraft yawed abruptly to the right and rolled to a bank angle of approximately 20 degrees. The autopilot was disengaged and the aircraft stabilised in a straight and level attitude. The uncommanded yaw occurred again. The flight crew broadcast a PAN (radio code indicating uncertainty or alert, not yet the level of a Mayday) and received a descent authorisation to FL380.
The upper rudder position indicator showed a rudder displacement of 5-degrees right and the lower rudder indicator showed zero degrees deflection. The flight crew began activating and de-activating the upper and lower yaw damper switches attempting to isolate the problem. During those actions, the aircraft commenced to `Dutch roll' (lateral oscillations with both rolling and yawing components). The crew then successfully isolated the problem to the upper damper and turned the upper damper switch off. With the aircraft at FL380, normal operations ensued. Autopilot `B' was then engaged and the flight proceeded without further incident.
Investigation by company maintenance personnel confirmed an anomaly of the upper yaw damper computer. The unit was replaced and the system tested. Normal operations ensued.
Analysis of Flight Data Recorder information revealed that during the event the upper rudder displaced 4.7 degrees. The data also indicated that the maximum roll encountered was 13 degrees to the right.
System redundancy had operated as required to limit the effect of the upper yaw damper anomaly.

http://www.atsb.gov.au/aviation/occurs/occurs_detail.cfm?ID=381

I believe the A300-600 has two yaw damper actuators and two yaw damper computers. My gut feeling is that if there was to be a software "bug" latently in the software of one system it would be very likely repeated in the other. For there then to be a conflict between the two, a significant trigger threshold (such as the wake turbulence upset) may be required to trigger any vehement algorithmic disagreement. The interesting comparison is that in the 747SP case above, the computer anomaly was able to act upon its own (upper) rudder (only) - whereas in the AA587 accident it may have been the case that a resonance (or electronic echo) was set up between the two computers (each acting through separate actuators - but upon the same rudder). In that scenario, both may have been accepting feedback from the other's reaction to the yaw induced by the wake turbulence encounter. That sort of thing in acoustics (and digital and analogue electronics) soon sets up a very annoying superheterodyne squeal. In a computer-controlled flight-control system the equivalent outcome may be capable of chaotically driving the rudder to its limits. It might explain A300 tail-wagging in toto.

We know that the A300-600's FCS is capable of very rapid sampling and reaction times (such that the cockpit display info is necessarily filtered, as are the DFDR data-feeds also -unfortunately). One notable aspect of a yaw damper system is that it is by design a very reactive system i.e. it pauses (before acting) for a finite period to sense what is happening (from yaw-rate gyros) so as to calculate its appropriate response. It may even reset and resample if it doesn't believe its first answer. Because Dutch Roll is normally an escalating phenomenon, the yaw damper software may be "trained" to reject and resample any sharp disturbance of a large initial amplitude and rate (such as wake). So let us suppose, in a very dynamic scenario, that this "sensing and resetting" of each computer is able to become ever so slightly out of synch - perhaps sufficiently that the two systems are actually reacting to each other's inputs. Therein would lie the seeds of mayhem and destruction. Computers in this type of arrangement are normally "tied" (and constrained to agree), but perhaps not to the same extent as autopilots in an autoland configuration.

It would also be interesting to learn whether each yaw damper computer gets individual feeds (if any) from the CADC. My theory all along has been that, once things get dynamic, you cannot trust pressure sensors within a highly responsive and reactive system.

Once again it's just a theory. But you will recall that a yaw-damper failed its BITE test on start-up for Flt AA587 and had to be reset. Whilst not uncommon, it might at least be indicative. The 747SP anomaly at least proves that two identical systems, even though tied together and fed the same info, can still slug it out like a couple of boxers (once provoked sufficiently).

arcniz

15th Aug 2002, 01:32

Regarding Appropriate technology:

Pehr Hallberg says.....and PickyPerkins seconds:

There is no such thing as a complex software system without bugs in it. Combine this with filtering of the input, maybe errors in the input due to failures in the sensors and you may end up with a very strange response from the system.

Let's put this in perspective:

Sad but true, ALL systems have their inadequacies. Each and every one is cobbled together by fallible people, based on the biases and perceptions of the time, using the materials at hand at that moment, to solve a problem which is inevitably, to some degree, imperfectly understood and improperly specified.

When machines cross beyond a certain threshold of complexity, they are actually safer to build with electronics and 'software' in control than with long cables, vulnerable hydraulics or carefully hewn clockworks of steel or spruce. Manual controls are more appropriate for gliders and sailboats than for turbine passenger transport aircraft and nuclear submarines. Of course, there's likely always something mechanical at the ends of the process.

I, too, have worked in software development and testing since the 1960's as well as in electronics, computer architecture & design, and systems analysis - not a small amount of it for things like chemical refineries, vehicle and machine controls, avionics, weapons systems, very large-scale transactions systems such as used by the banking industry, telecommunications, health care, and other environments that place a high value on near-perfect operation, orderly degradation in the event of failures, and redundancy / maintainability such that they may never fail and never need to be switched off for scheduled maintenance.

By 1970, already, the state of the art of reliability and verifiability for critical process software-driven control systems was well along. The hundred-millionfold improvement since then in raw price/performance of computing and control system pieces has helped move machine reliability along much further.

The proof that these systems exist and operate is all around you - in a rather undramatic form. It is most manifest in the industrial accidents that don't happen, the odd little deviations that don't appear in your bank account, and the unintended mushroom clouds you don't see depicted on the evening news.

There is a BIG difference beteen software (and hardware) carefully developed for critical applications and those provided on a fairly casual basis by companies, such as Microsoft, which depend on inherent product bugs to motivate frequent purchases of hastily developed 'new and improved' products with new and improved bugs.

So: Please do not frighten people unduly with global condemnation of these very useful technologies, but instead try to cite more specific relevant examples (many can be found) that are specifically worthy of criticism and improvement.

-----------

BELGIQUE - your focus on rudder specifics is very illuminating. A good job of reporting!

This information deserves much consideration. We can hope someone who knows the design specifics will share some details. I will react to a couple of points immediately:

:cool: I agree with your inference that the two yaw-damper computers SHOULD have been identical in design. Whether that actually is the case - at the circuit level - would require some heavy duty testing. One hopes the parties involved will take a forensic approach toward a determination.

The yaw-damper computers could have been physically identical but with different STORED states determining behavior - such as calibration, configuration updates, or just recent history that would be weighted in. Like ice, these states might not be preserved for later analysis. Any difference in history - which is inevitable if each is using a different collection of sensors - would cause them to operate somewhat out of phase - most of the time.

Even a single yaw-damper control could oscillate - by itself- if the s1- sensor reported aerodynamic response of the aircraft differed significantly from expected value for the s2-sensor reported angle of rudder deflection, based on the computed command signal applied to the actuator. This would produce the case where yd1 system was oscillating and the yd2 system, mechanically coupled to yd1 via the yd2s2 deflection angle sensor -whose response is delayed by the slew rate of the yd1 actuator and rudder mass - would be counter-oscillating in the effort to correct it.

:cool: Depending how implemented, I doubt that the yaw damper system 'pauses' before acting. More likely it determines a rate of control actuation which will - based on current input - lead to the desired result at some point in time future, and repeats this analysis continuously. By doing so, it never causes the full action based on a single moment in time, but accomplishes this
by the cumulative effect. This plan tends to reduce oscillation. Two controls with similar future-oriented agendas could certainly oscillate against each other if one was slow or misinformed or if both were receiving rapidly varying information which they processed in slightly differing phase.

Surely the original designers thought a lot about the possibilites for oscillation here, so it would be interesting to see what could have slipped through the cracks. My guess would be a 'minor' redesign of some critical component - actuator - angle sensor - rudder - yaw sensor - computers - calibration procedure - data path, etc. after the the original design was completed and released.

Pehr Hallberg

21st Aug 2002, 08:34

Exactly Belgique.

About computer redundancy and the security of having two computers "agree" on something.

A computer doing some useful job is obviously some hardware with some specialized software together performing the job. I have seen in the Telecom industry for instance several examples where the redundancy is on the hardware side but where you run the same software in both sets of hardware. This protects against hardware faliure but if the software fails both computers fail in the same way.

Now then where is your redundancy?

PickyPerkins

30th Aug 2002, 15:05

--------- Start of quotes ----------
Wsherif1, posted 28th July 2002 :... The 200+ mph force of the rotating vortices striking the FIN, (vertical stabilizer and the rudder), BROADSIDE resulted in an INSTANTANEOUS left YAW! …….

Wsherif1, posted 2nd August 2002 NTSB and Rudders: The F Meter When the vertical stabilizer and the rudder were struck broadside by the forces of the 747's clockwise rotating vortices the resulting instantaneous yaw maneuver was initiated before the pilot had a chance to react to what would have been erroneous flight instrument indications anyway. The pilots were just along for the ride!

Wsherif1, posted 4th August 2002 …. Dr. AA Wray of NASA affirms that in smooth air aircraft wake turbulence can persist for extended periods of time. I had a severe wake turbulence encounter 45 miles behind another 707, in smooth air! …
--------- End quotes ----------
I have been thinking on and off over the past month about the above posts and the various responses from Wino, Stator Vane, and Belgique, and finally got around to wondering what would happen with a much LOWER vortex X-wind than 200 mph, like maybe 100 kts.

I should start by saying that I am NOT a commercial pilot, and have NO training or qualifications in aerodynamics or aircraft structures, and that this post is really an attempt to encourage people who really know their stuff into following a train of thought and providing guidance to the rest of us.

The train of thought goes as follows: AW&ST published a diagram (on p. 25, AW&ST for Jan 21, 2002) showing the results of their calculations of how the side forces on the fin/rudder of an A300-600 varies with sideslip angle at 250 kts. One of the three curves in that diagram was for a centered rudder. It showed that the fin/rudder design strength limit is reached at a sideslip angle of 10 degrees, and that the design ultimate limit is reached with a sideslip angle of 15 degrees. I have plotted these results in a different form in Fig. 1 below.

Since the a/c cannot be held in a sideslip on a fixed heading with the rudder centered, AW&ST assumed that the sideslip was established using the rudder and other controls, and then the rudder was suddenly centered. At a maximum of 39 degrees/sec, this might be done on an A300 rudder in less than half a second.

Now suppose instead of sideslipping, you fly along normally on a fixed heading and with the rudder centered, and then you suddenly meet a wake vortex which effectively provides a X-wind. To the a/c this feels like it was initially flying along normally and then suddenly it is flying at a yaw angle due to the vortex X-wind, as shown on the right in Fig. 2. The relative wind comes at an angle to the nose and is the vector sum of the speed of the plane, S, and the speed of the vortex X-wind, X. In both Figs. 1 and 2, S=250 kts. The calculated stresses on the a/c for a given sideslip angle are as shown in Fig.1. While a sideslip is not the same as a yaw, and neither can be held at a constant heading with the rudder centered, I am going to assume for the purposes of this discussion that that the forces on the fin are roughly equivalent for similar sideslip/yaw angles. If this is accepted, then Fig. 1 can be re-drawn in terms of “Angle of Relative Wind Off the Nose” and “X-wind” as shown in Fig. 2.

Fig.2 indicates that the fin/rudder design strength limit is reached at a sudden X-wind speed of about 44 kts, and the design ultimate limit is reached at a sudden X-wind speed of about 66 kts. A lot less than 200 mph.
http://home.infi.net/~blueblue/_uimages/FinForces_08-25-2002.gif
A possibly interesting aspect of all this is that a vortex X-wind speed of 200 mph MIGHT be LESS stressful because relative wind would then be at an angle of 35 degrees, at which angle-of-attack the coefficient of lift might be much lower than at 10-15 degrees, and consequently the force might be LOWER than at a LOWER X-wind speed.

Now what happens if the a/c is flying along normally (fixed heading, rudder centered, and no yaw) and then it suddenly meets a wake vortex X-wind speed of, say, 60 kts (i.e. where the stresses on the a/c are more than design but less than ultimate), and the pilot has NO TIME TO REACT? The a/c is aerodynamically in a yaw, but the autopilot and yaw dampers, being gyro-based, think the a/c is flying straight and level, so they initially do nothing, and the rudder initially remains centered. One of the quotes above says that the X-wind will start a yaw and roll by direct action on the fin/rudder, which I assume the autopilot and yaw-damper will then try to counter. The numbers in the AW&ST diagram referred to above for cases where the rudder is not centered (not shown in Figs. 1 or 2) suggest that if the angle the rudder then turns through is equal to or less than the angle that the plane turns through (as might be expected of a gyro-based correction system), then the net result will be a DECREASE in the stress on the fin/rudder. So the autopilot/yaw damper response should NOT be an additional hazard.

To summarize this (possibly erroneous) train of thought:

(a) It looks from the AW&ST calculations that a wake vortex X-wind of about 66 kts would stress the fin/rudder to its design ultimate stress (at which level the fin/rudder might deform permanently, but it should NOT immediately detach). The AW&ST article says that the FAA requires that the aircraft must be able to withstand the ultimate limit stress for three seconds, permanent distortion being allowed. However, I assume that a X-wind of 100 kts. might result in a different outcome.

(b) The responses of the auto-pilot yaw-damper combination at X-wind speeds of 66 kts. or less are likely to immediately lower the stresses on the fin/rudder.

(c) I cannot even guess what a 200 mph X-wind would do, because that corresponds to a 35 degree yaw, at which angle of attack the fin/rudder coefficient of lift might be lower than at 10-15 degrees, and the forces might therefore be LOWER than at a LOWER X-wind velocity. :confused: And, of course, the vortex wind might not be a direct X-wind, but come at an angle other than 90 degrees.

To repeat my initial note, I am NOT a commercial pilot, and have NO training or qualifications in aerodynamics or aircraft structures. This post is an invitation to people who really know their stuff to follow a train of thought and respond with correction, amplification, confirmation, or whatever they may feel is appropriate.

Meanwhile, I think I will temporarily retire into my underground bunker ……….. :)

Belgique

30th Aug 2002, 23:11

Picky

Sort of "responded to" here (http://www.iasa-intl.com/store/chaos.html) - rather than answered.

Bit lengthy as a Pprune thread (and don't want to upset the moderators) - so it's elsewhere.

Belgique

cwatters

31st Aug 2002, 17:29

What diameter are these rotating vorticies? Is it possible that the top of the fin can be pushed one way and the bottom of the fin the other? Does this double the forces or have I missed something?

Belgique

31st Aug 2002, 17:58

cwatters
Not dissimilar to the way in which a thermal will boost one wing and give you the "net" effect of an unwanted roll. If you've ever watched a dust-devil accelerate away from the ground and broaden out as it gains height and entrains surrounding air, well just imagine the wake vortex to be a horizontal thermal that is similarly expanding as it drops astern. The essential difference is that the thermal is accelerating and the wake vortex decelerating. When you hit a wake there will be a net effect upon your airplane ... BUT it is also true that part of your airplane might take a fairly direct hit from that rotating helix. That didn't seem to matter in an all-metal airplane. When it's a large vertical surface that's not really designed to take large thwartships airloads (because it's made of composite material) - well that's apparently not immaterial.

My theory (at that url above) is that if you take that hit and it causes an FCS overreaction (per the reasons and sample incidents given), then the combined effect of rudder response and an ill-timed second wake encounter (from the other wingtip's trailing vortice) may be a sufficient overload for failure.

arcniz

31st Aug 2002, 18:48

Pehr Hallberg says:A computer doing some useful job is obviously some hardware with some specialized software together performing the job. I have seen in the Telecom industry for instance several examples where the redundancy is on the hardware side but where you run the same software in both sets of hardware. This protects against hardware faliure but if the software fails both computers fail in the same way.

I disagree. A couple of points here:

a) To achieve any tough degree of reliability and fail-soft capability with computer controls, one needs to work them in groups of three. With only two, any discrepancy leads to an argument and possible deadlock; with three, they can take a vote, cut out the oddfellow, and ring some bells to escalate alarm about the new condition of degraded redundancy. If three is good, 'many' sometimes can be better.

b) Much can be done - in design - to prevent the problem you point to - where 'everybody is wrong'. Sometimes the best answer is to 'fail' the system momentarily and recycle it to a new self-aware configuration. Also helpful is judicious allocation of 'gold bars' allocating authority.

c) As we all know, a lot of things can go wrong in hardware and software. Reliability in both is most commonly accomplished by detection of abnormal performance and subsequent reconfiguration to a (usually) more conservative operating strategy. This works just as well with 'software' as 'hardware', yet it tends more often to be omitted or done lightly in software because the threshold cost for s/w changes is putatively lower.

You seem to feel that hardware fault detection is much more reliable than software fault detection, but I disagree. If similar design methods are used for software fault detection and reconfiguration, the results can be comparable to those of the best hardware, i.e., nearly perfect.

We have all seen computers fail to perform correctly, but anecdotal evidence is not the same as truth.

If the intent is to have ultrareliable systems and then they are observed to fail, one must say that they have not been designed / tested with sufficient care. This is the binary equivalent of 'pilot error'.

Your telcom anecdote highlights a common failure in 'duty of care'.
Just as it would be irresponsible for an airline to put an unqualified and untested pilot in charge of a passenger transport, it is a management mistake to deploy inadequately designed and / or inappropriate technology in any critical application.

The only way to achieve true reliability is .....Very Carefully.

PickyPerkins

31st Aug 2002, 21:55

Wake turbulence rotators seem to be big - like a wing-span.
http://home.infi.net/~blueblue/_uimages/WakeTurbulence_smoke1_03-08-2002.jpg http://home.infi.net/~blueblue/_uimages/WakeTurbulence_smoke2_03-08-2002.jpg
http://home.infi.net/~blueblue/_uimages/WakeTurbulence_smoke3_03-08-2002.jpg

FDXmech

1st Sep 2002, 01:56

As I work on the A300-600 on a daily basis, I'm very interested in this topic.

I was always aware of the design philosophy between the Boeing ratio changer method of rudder travel limiting versus Airbus's rudder pedal limiting philosophy. Yet, until Wino brought to my attention the potential (and with AA587, possibly all too real) ramifications of limiting pedal movement, I assumed the difference to be "six on one hand, half dozen the other".

Yet the more I learned of this pedal limiting design, with its inherant progressive decrease in pedal force coupled with a very short pedal travel as IAS rises, I can only ask why was such a system devised and more importantly, approved? What benefit does this design bring?

I wanted to see for myself the overall effect of this system. This being possible by putting a single air data computer in the self test mode, (via the maintenance test panel behind the F/O's seat) thereby increasing various air data driven parameters.

I gently cycled the rudder pedals and to my surprise, the resistance to movement felt almost nonexistant, especially noticeable with the short throw. IMO, any assertion that a pilot would need to be heavy footed to swing the rudder is a bit overstated.

Belgique: Do you have any opinion on this system?

Lu Zuckerman

1st Sep 2002, 02:53

To: arcniz

I am enclosing the following in order to shed some light on how Airbus and their vendors do business. I will state that the information following deals with theA-310 and the A-320 but since the major players are basically the same the A-300 can be tarred with the same brush.

I worked as the senior Reliability and Maintainability engineer on the A-310. I worked on a consulting contract at Liebherr Aerotechnik in Lindenberg, Germany. Liebherr was the senior contractor in the design of the secondary flight control system power drives and actuators. They were also senior contractor in the design of the flap / slat computer which was designed and built by Marconi in the UK. The integrating contractor was MBB-Erno based in Bremen, Germany. The lead in the wing design was BAe in Hatfield in the UK. Our associate contractor in the design of the power drives and the actuators was Lucas Aerospace in Wolverhampton in the UK.

The story is about to unfold and it is broken into several sub stories.

1) During the tear down of a slat actuator that had been used in test and development I discovered a strange erosion pattern. I referred it to our stress engineer and he said it was stress corrosion. I placed the unit under high power magnification and the strange pattern turned out to be spark erosion. I could not get the stress engineer to agree. I talked to a senior design engineer and asked him to verify the continuity of the installed system on the iron bird. The check showed that the slat system was not grounded to the iron bird, which meant that when installed in the aircraft it would not be bonded to the airframe. I contacted my counterpart at Lucas and he found the same to be true for the flaps. I brought this problem to the attention of my department manager and he took it to the Vice President and the senior project engineer. To support my argument I had referenced an Airbus technical directive (TDD 20 A 001) which addressed Electrical Bonding, Lightning Strike Protection and Electrostatic Discharge. Their argument against my criticism of the design was two fold. They stated that the TDD was not fully approved and therefore did not apply to the A-310 design. Although Airbus directed in the design specification that any problems related to Reliability, Maintainability and Safety had to be brought to their attention it was Liebherrs’ position that if they brought it to the attention of Airbus they would have to absorb the cost of the design modification. They suggested that I talk to MBB-Erno, which I did. Much to my surprise they took the Liebherr position of not telling Airbus as a means of avoiding the redesign costs. I then took the problem to Bae and they told me that they were in sympathy with my problem but they could do nothing about it. This is the company that designed the wing and was responsible for flight safety and ultimate certification.

According to the Airbus TDD the two most frequent points of lightning attachment are the nose which has strike diverters and a partially extended slat. Should lightning hit the extended slat it would arc to the outboard slat actuator and into the wing structure. The way the A-310 wing is constructed the slat actuator jack screw is retracted into the wing and it is separated by a thin Titanium wall. On the other side of the Titanium wall is the outboard fuel tank, which will most likely explode when the arc occurs.

The clincher to this problem is that the TDD was eventually approved and the problem of non- electrical bonding would or, should have been detected during final inspection of the aircraft prior to flight-testing. The non-bonding of the flaps is another story. According to Lucas calculations the flaps would build up a static charge of 800-1400 volts and as the flaps retracted the voltage would arc to the wing skin or the rear of the rear spar.

2) Airbus and JAR / FAA requirements dictate that an uncommanded operation of the flaps or slats should occur no more frequently than 1 10 9 or one time in a billion hours for the fleet. In performing the Failure modes Effects Analysis (FMEA) for the Flap and Slat Power Control Units (PCU) it was determined that if an internal leak that bypassed the control solenoids on the PCUs it could cause an uncommanded operation of the flaps or the slats depending on which PCU developed the crack. The problem was that a similar crack could also occur that would cause faulty operation of the PCU or it could result in a loss of a single hydraulic system. The predicted occurrence of this type of crack is .1 10 6 or, one time in 10 million hours of fleet operation. We were forced to show that the crack occurrence was 1 10 9 and not .1 10 6 which is the difference between 10,000,000 hours and 1,000,000,000 hours which was not realistic. We ended up doing it over my objections in order to show we met the safety requirements dictated by the certification authorities.

During the life cycle testing of the slat system Liebherr encountered a runaway slat system and the flap slat computer was not only unable to detect it was unable to stop it. This would be a minor problem on the slat system regarding uncommanded extension, as the air loads at cruise would keep them retracted. However if it occurred on the slat system causing an uncommanded retraction during takeoff it could cause major or catastrophic problems. The same is true if it happened on the flap system. Again Liebherr was required to notify Airbus about the runaway as well as the computer being oblivious to the problem. They didn’t notify Airbus. Instead, they contacted Lufthansa and Swiss Air, which had 17 Airbus A-310s in service. Liebherr made a quick fix and told the operators to notify them when they had an aircraft on ground over night and Liebherr would install a “more reliable” designed PCU at no cost. When Liebherr encountered the problem the accelerated test had about 1800 hours of operation and the operating aircraft were fast approaching that number.

3) The flap slat computer was designed and built by Marconi. I had several encounters with Marconi on other programs and I found them extremely difficult to deal with. The same was true for the A-310 program. Per Airbus program requirements I directed Marconi to analyze the failure of every piece part in the computer and indicate how the failure manifested itself when the part failed. Marconi replied that it would be too expensive to do that so instead they just indicated the failure rate of each part and combined it in order to show the total failure rate for the computer. This proved to be totally insufficient to meet the Airbus requirements, as it did not reflect a true FMEA.

Marconi had a running battle with Lucas Aerospace accusing them of robbing trade secrets and stealing their top designers. Lucas like Liebherr constructed an iron bird to test and develop the flap drive system. Marconi provided Liebherr a complete brass board of the computer that had the total capability to control the slat system and diagnose any system problems. Despite this requirement the computer was unable to respond to the runaway slat system on the Liebherr iron bird. Instead of providing Lucas with a similar brassboard computer they provide one lane of the computer or 1/4th of the computer. This allowed the extension and retraction of the flap system without having any diagnostic capability. Without this diagnostic capability Lucas could not adequately test the system and therefore, they could not certify the system. The system ultimately received certification although it was not properly tested.

On the first revenue flight for Lufthansa they flew from Frankfurt to Cairo. Upon landing the pilots could not retract the flaps. No one including the computer was able to diagnose the problem and the computer did not recognize that a problem had occurred. The aircraft was returned to Frankfurt in non-revenue service with the flaps fully extended. Upon its’ return the same situation existed. Nobody could figure out what was wrong. The flaps were mechanically disconnected and hand cranked in. The system was reconnected and everything worked OK.

Marconi also stated that on the A-320 when Lucas was going to be the lead design contractor Marconi would not work with them and most likely not bid on the contract. I do not know if they followed through with their threat.

4) I concluded that I had done everything possible to bring the problems to the attention of everyone in the chain of command with the exception of Airbus and to do so would place my position in jeopardy. After leaving that consulting position I went to another in Italy on helicopters. While on that assignment I discovered that the A-310 had been certificated in the USA. I sent a letter to the FAA explaining everything. Two months later I received a letter thanking me and telling me that they would bring the problem to the attention of the DGCA. Four months later I received a letter from the FAA stating that the DGCA had indicated that the problems were corrected. I contacted a friend still at Liebherr and he said that nothing had changed. I sent a more forceful letter to the FAA stating that I had absolved myself of any responsibility and if something happened they could be brought into any litigation resulting from a crash. They eventually took action and the Vice President and the senior program manager were fired but nothing was done to correct the design. All of the problems I described above are waiting in the wings (pun intended) and will manifest themselves sometime in the future. It should be noted that an A-320 from Air Canada suffered an uncommanded retraction of the flaps during takeoff and the computer could not stop it.

4) On December 17, 1997 Airbus Industrie issued Airworthiness Directive 90-092-109(B)R3 which dealt with the inspection of the Vespel Bushes in the Flap / Slat Transmission-Universal Joint Assemblies. One of the checks was to determine if there was electrical continuity in the bushes they were to be replaced if continuity was discovered. When the system was designed the bushes which were called Rose Bushes were impregnated with carbon to make them electrically conductive. I do not believe the design was changed to remove the Rose Bushes. What I do believe is that the English translation got it wrong. I contacted the DGCA, the FAA and the Canadian MOT and never got any feedback on the possibility of a mis-translation. I contacted both the FAA and the Canadian MOT telling them that their respective versions of the Airbus AD were not in agreement and that their respective translations from the French original might be wrong. I also contacted the DGCA telling them that there was a possibility that the two translations were not correct. I never heard from any of them regarding this potential conflict.

:cool:

To: arcniz

I had to delete this part of my post above in order to comply with the maximum character requirements for posts.

I have been banned from Rotorheads for speaking the truth, which was interpreted as libel by the moderators. The following is 100% true and I can back everything up as being true. You speak of reliability as if it were some means of assuring that airplanes are safe. The following will show you how reliability really works in the aircraft industry. I was going to disguise the names of the participants but since my statements are already entered into the files of the FAA, the DGCA and the LBA and the RAI I’ll let it stand. I'll wait to see if the moderators agree.

Wino

1st Sep 2002, 05:21

FDXmech

While some other older aircraft use the blocker system (notably the md80 and the 727) they are used in conjuction with reducing the hydraulic pressure from 3000 psi to 800 psi. Thereby limiting your ability to do damage, and making the sensitivity somewhat constant.

The A300-605R A320 A330 and A340 all use a blocker system and maintain 3000 psi at all times. Indeed the A300 tail is not mass balanced and is prevented from fluttering by constant hydraulic pressure of 3000 psi.

If the pilot flying stepped lightly on one rudder to assist in roll he would have gone to the floor at 250 knots and not known how he got there. If he tried to correct he would have almost instantly hit the other stop. I doubt he would have reversed again, but then the other pilot might have tried to put in a rudder input. very quickly you get 4 throws of the rudder right there.

The A300-605R rudder system is DANGEROUS at 250 knots. The tail is incapable of withstanding the stress, and the controlls are trap for a POI. The A300 B4 with its ratio rudder load limiter was a much better design.

The blocker system is much simpler to implement than a complicated ratio changer system. However without the additional safety of depowering the rudder it is a menace. The composite design of the rudder and verticle stab do not allow the rudder to be depowered as the hydraulics are used to balance the rudder. So Airbus cut a corner and 265 people are dead. I expect that out of this accident there will be a short term fix of limiting the throw of the rudder further (probably forcing an engine derate as a result) and a long term fix of requiring rudder load limiters to be of the ratio type or if a blocker is used it is used in conjunction with depowering the rudder.

Cheers
Wino

Belgique

1st Sep 2002, 12:54

PickyPerkins
The actual shape and intensity of the trailing vortices at a dirty configured slow approach speed is very very different to what is shed at low altitude/250kts clean. And high altitude/high TAS is quite different again. The main variables are weight, speed and wing-loading (but assuming one g) - however obviously configuration's a player also. A 747 wake vortex radius at half a mile astern (plus lateral drift) would be around 50 metres across - and at 5 miles that would be around 150m to 200m. To further define that, here we're talking about the radius beyond which the rotational velocity has dropped off greater than 50% of the current maximum. The mounted photos above show the air (as well defined by the smoke) being entrained (dragged into the outer helix by the strongly rotating core, much as a whirlpool sucks in the outer periphery) - but with the very vital core less noticeable as the black bit in the centre. i.e. You have to realise exactly what it is that you're looking at here. Here it's still very fresh and hardly diffused at all. With that large A300 vertical fin, it would not be difficult to imagine how it could take an instant thwartwise hit on the fin and rudder at up to 60 kts (but not the full 100kts if it was on much the same track - due to the fact that it's still a helical rotation). It would have been the next (second) hit, as the A300 went through the 747's port wing wake (with its rudder highly deflected and loading up the fin) that would have broken the right attachment lug(s).

FDXMech
I don't disagree with WINO. He seems to have nailed it. Be very interesting to see how the FAA/DGAC allows Airbus to sneak out of some very expensive mods or add-ons. I've referred the query to a couple of guys who may or may not get back on this thread (or maybe to me). One of them designed the MD-11 FCS and is currently working on the F-35.

fantom

1st Sep 2002, 20:51

ahem....are these opinions suitable material for publication?

Belgique

2nd Sep 2002, 12:03

PickyPerkins

Rainman (MD-11 & F-35 flight control design engineer) has replied at this link (http://www.iasa-intl.com/store/rainman-1.html)

Just a little too lengthy to mount here.

Belgique

2nd Sep 2002, 19:56

Further info from Rainman at this link (http://www.iasa-intl.com/store/rainman-1.html)
EXTRACT ONLY
This 13 Nov 01 incident below may be relevant (happened quite remarkably the day after the AA587 crash).

FACTUAL INFORMATION
A Boeing 747-SP38 aircraft was maintaining Flight Level (FL) 430 with autopilot `A' engaged, when the aircraft yawed abruptly to the right and rolled to a bank angle of approximately 20 degrees. The autopilot was disengaged and the aircraft stabilised in a straight and level attitude. The uncommanded yaw occurred again. The flight crew broadcast a PAN (radio code indicating uncertainty or alert, not yet the level of a Mayday) and received a descent authorisation to FL380.
The upper rudder position indicator showed a rudder displacement of 5-degrees right and the lower rudder indicator showed zero degrees deflection. The flight crew began activating and de-activating the upper and lower yaw damper switches attempting to isolate the problem. During those actions, the aircraft commenced to `Dutch roll' (lateral oscillations with both rolling and yawing components). The crew then successfully isolated the problem to the upper damper and turned the upper damper switch off. With the aircraft at FL380, normal operations ensued. Autopilot `B' was then engaged and the flight proceeded without further incident.
Investigation by company maintenance personnel confirmed an anomaly of the upper yaw damper computer. The unit was replaced and the system tested. Normal operations ensued.
Analysis of Flight Data Recorder information revealed that during the event the upper rudder displaced 4.7 degrees. The data also indicated that the maximum roll encountered was 13 degrees to the right.
System redundancy had operated as required to limit the effect of the upper yaw damper anomaly.
http://www.atsb.gov.au/aviation/occurs/occurs_detail.cfm?ID=381__
The question that arises with the A300-600 is how this might have played out in its two yaw-damper system - but with both yaw damper actuators acting upon the A300's single rudder (and accepting follow-through inputs that wouldn't have been the case with the 747's upper and lower rudder setup).
It seems ridiculously clear (to me, at least) that dual physical rudder surfaces are the best way to go._ There was simply no way the DC-10 nor the MD-11 could meet the stringent 10^-9 first catastrophic failure rate requirement for autoland with only one rudder. We clearly needed two.
When FedEx began bringing in the A300-600s, and as I learned about their autoland with only a single rudder, I ALWAYS wondered how they showed they met the numbers....and why the US gives this a bilateral certification for autoland with that single-point rudder failure mechanism?
Might this actually lead to a feedback mechanism and mutual excitation_within the two Y/D systems?
I believe the answer to that is categorically yes, with the empirical evidence available to back it up._ The FedEx hangar event was a manifestation of the subject of a prior AD for oscillations induced thru out-of-phase pressure pulses from two different hydraulic systems that feed the yaw damp actuator._ This has always been part of the smoking gun from my vantage point of this accident._ Here in the hydraulics is the precise mode you are talking about Belgique: Two systems allowed to operate in an out-of-phase condition, which sets-up and possibly excites a critical oscillation._ Bad news.
cont'd at link above (http://www.iasa-intl.com/store/rainman-1.html)

Lu Zuckerman

2nd Sep 2002, 22:50

To: Belgique

There was simply no way the DC-10 nor the MD-11 could meet the stringent 10^-9 first catastrophic failure rate requirement for autoland with only one rudder. We clearly needed two.

No aircraft flying has ever met the certification requirements for catastrophic failure rate of 10-9. However, every aircraft flying under those failure rate requirements has demonstrated on paper that they are able to not only meet those requirements but they could exceed the requirements showing a catastrophic system failure rate of 10-12 all the way to 10-17. The manipulation of numbers and the magic of Boolean Algebra do it all.

Another point to consider is that the specified number of 10-9 is for system failure that could cause death or loss of the aircraft.
If the certification authorities specified that the airframe manufacturer had to demonstrate the catastrophic loss of an aircraft using the magic of Boolean Algebra it could be proved that the aircraft had a catastrophic failure rate not of 10-9 but somewhere around 10-6 or 10-7 which is totally another story. That is why it is not required.

There must be a dead rat around here because I can smell it.

:cool:

PickyPerkins

20th Sep 2002, 02:08

======= Start of quote =======
cwatters posted 31st August 2002 What diameter are these rotating vorticies?
======= End of quote =======
On another PPRuNe thread, [Flight Deck Forums > Questions > What exactly causes vapour trails?], 152captain has posted a link to a spectacular photo of
vapour trails (www.airliners.net/open.file/239080/M/).
What is interesting is that the vapor trails from each pair of engines on the 747-200 can be seen spiralling around each other giving some indication of the size of the vortices. Also, the intense core of the port vortice can be seen two or three plane lengths back in the trail from the port outer engine. Another feature is the light condensation mist between the two vortices, presumably caused by the lower pressure over the wing. Great photo.

Browsing around the web, I find that the University of California at Berkeley [UCB] claims [and has patented] a way to dissipate wake turbulence faster than normal.

They say that their wind tunnel tests at UCB show that a single vortex is stable. It just slows down with time and finally fades out. A pair of vortices [as in the case of an aircraft] eventually tend to destabilize each other and fade out more quickly than a single vortex. The proposal is to add a vortex-producing flap near each wingtip which would create one additional vortex near each wingtip. The pairs of votices at each wingtip then mutually destabilize each other. The flap adds some drag and could be retracted in cruise. They tried two slightly different designs. One dissipated trails two to three times faster than normal while another design using larger flaps did so four to eight times faster.

There is an excellent video movie on the UCB web page (www.berkeley.edu/news/media/releases/2001/11/20_wings.html) demonstrating this mutual destabilization in a water tank. The web page says you need a broardband connection to view. However, it worked for me with a 56k dial-up connection, but took over an hour to download the 12MB!

I am not in any way connected with UCB.

john_tullamarine

20th Sep 2002, 06:47

I don't have it to hand so I can't cite the reference, but there was an interesting article in the AeroSoc Journal probably 6-12 months ago which addressed the issues of tip vortex and diameter.

FDXmech

23rd Sep 2002, 18:56

Belgique:
>>>The question that arises with the A300-600 is how this might have played out in its two yaw-damper system - but with both yaw damper actuators acting upon the A300's single rudder (and accepting follow-through inputs that wouldn't have been the case with the 747's upper and lower rudder setup)................................................Might this actually lead to a feedback mechanism and mutual excitation_within the two Y/D systems?<<<

I don't necessarily think so.

Here's why. The A300-600 yaw damp actuator, a single unit with two hydraulic actuators, each independantly controlled and monitored via its respective FAC (flight augmentation computer) have what Airbus calls a, "hydraulic transparency device".

This "transparency device" allows up to a 40% split in position between #1 and #2 actuators. Above the 40% threshold, the systems would be opposing one another causing both yaw damp paddles to drop. Of course before this threshhold is reached, a failure would (should) be detected in one of the channels allowing only one channel to drop offline.

The yaw damp assembly has two channels, #1 controlled by FAC 1 and #2 channel controlled by FAC 2.
Both actuators are mechanically bused together so both output levers operate in unison. This would at face value validate the possibility of mutual excitation.
But in actuality, only the #1 actuator has a direct mechanical connection to the yaw damp output lever, #2 actuator is actually a hydraulically driven cylinder with a concentric inner piston. The concentric inner piston has the capability of relative movement inside the hydraulically driven actuator and is the component within #2 channel that is mechanically connected to the output levers (and thus #1 channel), this making a "soft" connection between channel 1 & 2.

Airbus refers to channel 1 as the, "driver side", and #2 as "driven side".

Belgique

24th Sep 2002, 14:51

FDXMech
Your info on the two A300-600 yaw dampers servo valve arrangement is interestingly reminiscent of that 737 rudder's concentric dual pistoned valve….the one that afforded the only notional level of rudder redundancy for that aircraft (until it suddenly didn't on a number of occasions, and as a result is now scheduled to be replaced).

Try and picture an A300’s yaw dampers #1 and #2 at odds with each other and acting via the same concentrically pistoned valve actuator. Sounds mightily suspiciously potential to me.

The relevant part of the Byron Acohido Pulitzer-Prize-winning articles on the 737 rudder PCU is to be found here (http://www.iasa.com.au/folders/Safety_Issues/FAA_Inaction/BoeingLimitsLiability.html) and another here. (http://www.iasa.com.au/folders/Safety_Issues/FAA_Inaction/BoeingLimitsLiability2.html)

You might agree that (in parts) its applicability to AA587 is a bit eerily familiar. The role that dirty hyd fluid played in those various 737 incidents is not well known. Perhaps that’s a reason why a “soft connection” can suddenly become a hard (same-same hardware mechanical) connection...... and provide non-design feedback from one yaw-damper to the other (or whatever other FCS feedback mechanism then becomes available in the rudder or rudder limiter circuit).

Belgique

3rd Oct 2002, 22:07

I was asked by a few people to elucidate whatever theory might have been behind the vague comment above (that was in response to FDXMech’s info). My reply may be of interest.

Think in terms of two computers driving a singular servo-valve actuator (only one of the three A300 rudder actuators is connected to the yaw-dampers and that actuator can drive the rudder at 39deg/sec). One yaw damper drives the actuator mechanically and the other soft-drives it by virtue of something akin to a shock-absorber strut or oleo (that is concentric to that same singular primary actuator valve) (i.e. soft =with a 40% flex), Now develop a theory whereby the "soft-drive" suddenly becomes a hard connection because its travel seizes under the angular displacement of a rudder at near to full throw (or, due to stiction, is acting very slowly). The other system's yaw-damper computer sees a bad result (and takes over - as it's designed to do). The soft-drive connection suddenly frees itself and its computer wants to argue about who has precedence. The rudder actuator returns full-stroke and the soft-drive again seizes. etc etc

Get the idea? In an ideal world the "failed" yaw damp system would trip and hand over. My guess is that it doesn't do that in conditions of partial failure when the actuator goes well outside NORMAL travel (such as in a wake event). i.e. it has probably been allowed some latitude (by design) because yaw-damping can be a rather dynamic event. Now also think about an actuator that spends 99.99% of its existence near motionless over a very limited travel zone. It's going to have a particular wear characteristic, yes? But suddenly there's a wake event and the yaw-damper sends it into the Twilight Zone of Travel for that particular actuator. It's now well outside its "comfort zone" of wear and starts twitching, sticking or seizing (or even suffers an internal hyd leak) - perhaps due to encountering corrosion in the untravelled zone.

This might also explain the anecdotal (and incidental) incidence of mild to severe tail-wagging on the A300.

It was a similar mechanism (with the rudder power control unit) that led to the 737 rudder hard-overs. However, before reading further, you should read the 747 SP yaw-damper event narrative at this URL first.
http://www.atsb.gov.au/aviation/occurs/occurs_detail.cfm?ID=381
The dismissive comment in that incident report is very telling when you think of AA587. It says:
"System redundancy had operated as required to limit the effect of the upper yaw damper anomaly"

(Well, that's very true for the 747’s split rudder system! The A300 however doesn't have a split rudder AND its yaw dampers operate through a singular dual-action valve). It ain't got no real redundancy at all. And just keep remembering that AA587 had a yaw-damper fail its checkout on pre-start at JFK - and required a maint reset. Do you think it might have been trying to tell them something? Commercial pressures notwithstanding, a failure of a system in my opinion requires more than giving it a quick kick in the guts reset and telling it to work (or else). A pessimist might think: "Jeez, that's failed its checkout and that's a warning that everything might not be mechanically right. We've now convinced it to reset but......well what might’ve caused it to fail initially?"

What else might crank up a yaw damper disagreement? Well most (all?) of these URL links below addresses situations where air data computers, fluctuating airspeed and uncommanded yawing all played a part. In AA587 it was flying in amongst the pressure-spike sharp discontinuities of a wake encounter. At West Palm Beach it was the pressure variations and static port asymmetry that you’d encounter in an inadvertent stall - when the copilot then (tellingly) tried to recover using full rudder.

A. http://www.iasa-intl.com/store/chaos.html#westpalmbeach May 97 West Palm Beach.” As the plane's nose pitched up 12 degrees and the bank angle exceeded 50 degrees, the first officer applied full left rudder to correct the roll, NTSB determined.”

B. 25 Nov 2001 - Singapore Airlines A340-300 incident [departing Singapore for Dhaka] (problems with airspeed indicators, overspeed warnings and large rudder movements without pilot input). Post-flight inspection revealed problems with the pitot-static connections to the Air Data Computers (CADC).
http://www.iasa.com.au/folders/Safety_Issues/FAA_Inaction/7thAA587update.html

C. 17 May 99 - American Airlines A300 experienced uncommanded yaw (crew being unable to control the rudder with their pedals). Problem was attributed to the autopilot.

D. 26 Jul 00 - Kansas City (FEDEX A310-203). N409FE returned shortly after take-off due to overspeed warning actuation followed by rudder system 1 and 2 fault lights illuminating. Maint replaced #2 Air Data Computer and a/c checked out serviceable.

E. 05 Nov 99 - Miami (American A300B4-605R) Operator reported erratic rudder movements during a manual approach, caused by a "double fault" with the autopilot yaw actuator. After replacement of the yaw actuator the system functioned normally. NTSB MIA97LA161

F. An American A300-600 crew departing Lima, Peru, reported "fish tailing" soon after the plane took off, an NTSB report said. The aircraft, N7055A returned to Lima and made an uneventful landing.

G. 26 Jul 2000 Fedex A310 (N409FE) – overspeed warning followed by rudder system 1 and 2 fault, returned to Kansas City. Replacement of air data computer #2 fixed fault. CE20001AC071

H. The FEDEX A300 that broke a rudder actuator (the yaw-damp connected one) in the hangar whilst undergoing maint checks.

So IMHO, the tail didn't fall off - it got blown off. That's where the "kid's swing" analogy comes in. A little rudder repetitively at just the wrong time can build the restorative dampening up to quite a yawing gyration. I used to do it to great extremes at the Jet FTS on my graduation parade aero shows. The final pass was inverted yawing of up to 30 degrees nose left and right. You might have seen it done at air displays. That simply requires in-phase rudder-kicks to build the amplitude.

Once the yawing was underway, it only needed the rudder to be significantly deflected whilst the fin was highly loaded and its ultimate load could be exceeded.

I'd be surprised if something similar to this theory doesn't rate a mention by the NTSB at their public docket show later this month.