NTSB Safety Recommendation

Mr. Patrick Goudou
Executive Director
European Aviation Safety Agency
Postfach 10 12 53
D-50452 Cologne, Germany

The National Transportation Safety Board (NTSB) is an independent U.S. Federal Government agency charged by the U.S. Congress with investigating transportation accidents, determining their probable cause, and making recommendations to prevent similar accidents from occurring. We are providing the following information in support of the safety recommendations in this letter. The NTSB is making these recommendations because they are designed to prevent accidents and save lives.

On November 12, 2001, about 0916 eastern standard time, an Airbus A300-605R,1 N14053, operated as American Airlines flight 587, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York.2 Following an encounter with wake turbulence from a preceding Boeing 747 (747), the first officer made a series of full alternating rudder pedal inputs before the airplane’s vertical stabilizer and rudder separated in flight; both were found in Jamaica Bay about 1 mile north of the main wreckage site.

The NTSB determined that the probable cause of the American Airlines flight 587 accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design3
that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600
rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program (AAMP).4
1 The Airbus A300-605R is one of several variants of the A300-600 series airplane. The “5” refers to the type of engine installed on the airplane, and the “R” refers to the airplane’s ability to carry fuel in the horizontal stabilizer.
2 For more information, see In-Flight Separation of Vertical Stabilizer, American Airlines Flight 587, Airbus Industrie A300-605R, N14053, Belle Harbor, New York, November 12, 2001, Aircraft Accident Report NTSB/AAR-04/04 (Washington, DC: National Transportation Safety Board, 2004).
3 The ultimate design load is the maximum load to be expected in service multiplied by a safety factor of 1.5.
4 According to American Airlines, AAMP was “advanced training for experienced aviators involving upsets in aircraft attitude” that consisted of ground school and simulator flight training.
5 The leading 747, United Airlines flight 896, was en route from Hong Kong to Chicago O’Hare International Airport. The 747 was eastbound at FL370. At the time of the upset, both flights were under Seattle Air Route Traffic Control Center control, and when Air Canada flight 190 was cleared from FL350 to FL370, the 747 was ahead of and above Air Canada flight 190. The Transportation Safety Board of Canada calculated that, at the time of the upset, United Airlines flight 896 was 10.7 nautical miles ahead of Air Canada flight 190. According to postaccident interviews and cockpit voice recorder data, although the flight crewmembers of Air Canada flight 190 knew they were following a 747, they were unaware of their trailing distance to United Airlines flight 896.
6 Encounter with Wake Turbulence, Air Canada Airbus A319-114 C-Gbhz, Washington State, United States, 10 January 2008, Aviation Investigation Report A08W0007 (Gatineau, Quebec, Canada: Transportation Safety Board of Canada, 2010). .
7 In the Airbus A319, a side-stick controller is used to control pitch and roll.
8 The vertical stabilizer is attached to the airplane’s aft fuselage. The vertical stabilizer provides supporting structure for the rudder, which is an aerodynamic control surface that is used to make the airplane yaw, or rotate, about its vertical axis. An airplane cannot be flown without its vertical stabilizer.
9 According to 14 Code of Federal Regulations (CFR) 25.301(a), the limit load is the highest load that the airplane structure is expected to experience while in service. According to 14 CFR 25.305(a), the airplane must be designed to withstand this load without detrimental permanent deformation, and the deformation may not interfere with safe operation.
10 For more information, see table 4 of NTSB/AAR-04/04.
11 APC excursions occur when the dynamics of the airplane and the dynamics of the pilot combine to produce an unstable system. For more information, see National Research Council, Aviation Safety and Pilot Control—Understanding and Preventing Unfavorable Pilot-Vehicle Interactions (Washington, DC: National Academy Press, 1997).
12 This change in pedal sensitivity is not characteristic of a variable ratio control system, such as employed on other airplanes, which retains a relatively uniform aircraft response throughout the airspeed envelope.
13 On September 13, 2005, the NTSB acknowledged that, on behalf of France, the European Aviation Safety Agency (EASA) would perform the functions and tasks of the State of Design with respect to International Civil Aviation Organization Annex 8 in the field of airworthiness; therefore, EASA would be responsible for responding to Safety Recommendation A-04-63.

The circumstances of the American Airlines flight 587 accident are similar to a more recent accident involving an Airbus model A319. On January 10, 2008, about 0848 central standard time, an Airbus Industrie A319, Canadian registration C-GBHZ, operated as Air Canada flight 190, experienced an in-flight upset after encountering wake turbulence from a 747 while climbing from flight level (FL) 360 to FL370.5 The flight crew declared an emergency and diverted the flight to Calgary, where it landed uneventfully. Of the 5 crewmembers and 83 passengers on board, 2 crewmembers and 8 passengers sustained minor injuries, and 3 passengers sustained serious injuries. Visual meteorological conditions prevailed, and an instrument flight rules flight plan was filed for the scheduled domestic passenger flight from Victoria International Airport, British Columbia, Canada, to Toronto Pearson International Airport, Ontario, Canada. The Transportation Safety Board of Canada investigated this accident;6 the NTSB and Bureau d’Enquêtes et d’Analyses provided accredited representatives and technical advisors to the investigati

Data from the flight data recorder (FDR) indicate that, during the upset, the airplane experienced several roll and vertical load factor oscillations and lost about 1,000 feet of altitude. Although the autopilot was engaged during the start of the wake vortex encounter, after about 3 seconds, the autopilot was disengaged, and there was a series of large oscillatory inputs on the left side-stick controller.7 In addition, the FDR recorded a series of three to four alternating rudder pedal inputs (right pedal, then left pedal) over the next 15 seconds. During these inputs, the airplane continued to oscillate in roll, reaching a maximum roll of 55º. At the same time, the recorded acceleration was also oscillating, with peaks of -0.46 G to +0.49 G of lateral load factor and peaks of -0.76 G to +1.57 G of vertical load factor.

Because of the severity of the upset, following the emergency landing at Calgary, the airplane was grounded pending an inspection by Airbus engineers. During an extensive inspection, the vertical stabilizer8 was removed from the airplane and scanned ultrasonically to inspect for damage to the stabilizer’s composite components. No damage was found, and the stabilizer was reattached and the airplane returned to service.
Although no damage to the stabilizer was found, an analysis of the accident performed by Airbus indicated that the rear vertical stabilizer attachment fitting sustained loads 29 percent above its design limit load.9 Simulation work performed by Airbus revealed that these high loads were primarily the result of the flight crew’s series of alternating rudder pedal inputs and were not the result of the wake turbulence. Information and animations provided by Airbus showed that if the pilots had not made any control inputs after the wake encounter, the airplane would have righted itself with minimum altitude loss and g-loading.

Prevention of High Loads Resulting From Pilot Rudder Pedal Inputs

The rudder system design for the Airbus A320 airplane family, which includes the A319, is functionally similar to the design for the Airbus A300/A310 airplane family. Both families use a variable-stop rudder travel limiter, which mechanically limits available rudder pedal deflection as airspeed increases. Consequently, at high airspeeds, these systems require lighter pedal forces and smaller pedal displacements to obtain maximum available rudder than at low airspeeds.10 Investigation of the American Airlines flight 587 accident revealed that variable-stop systems produce dramatically larger aircraft responses to the same rudder input at higher airspeeds than at lower airspeeds, which can surprise a pilot and serve as a trigger for an aircraft-pilot coupling (APC)11 event.12

As a result of findings from the American Airlines flight 587 investigation, the NTSB issued Safety Recommendation A-04-63, which asked the French Direction Générale de l’Aviation Civile13 to do the following:

Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds.

In the same report, the NTSB issued a companion recommendation, A-04-58, to the Federal Aviation Administration (FAA). On September 13, 2005, the NTSB classified Safety
Recommendation A-04-63 “Open—Acceptable Response.” On April 6, 2009, the European Aviation Safety Agency (EASA) responded that Airbus had analyzed several modifications, and a reduced pedal travel limiting unit (PTLU) was identified as the most promising solution to address this recommendation. On March 19, 2010, EASA further indicated that “its previously held position on the pilot training out as being an efficient and sufficient measure to avoid any new hazardous situations has to be reconsidered following more recent service experience which confirms that crew use of rudder pedal inputs in upset encounters cannot be ‘trained out.’” EASA therefore indicated that it plans to require the PTLU on Airbus A310 and A300-600 aircraft models. The NTSB will consider how the proposed changes are responsive to Safety Recommendation A-04-63 when EASA provides further details about the PTLU. In the meantime, the NTSB still believes that the changes called for in this recommendation are necessary. Therefore, the NTSB reiterates Safety Recommendation A-04-63.

Yaw Axis Certification and Rudder Pedal Sensitivity

The similarities between the Air Canada flight 190 and American Airlines flight 587 crewmembers’ responses to wake encounters indicate that the Airbus A320 family is also susceptible to potentially hazardous rudder pedal inputs at higher airspeeds. In both events, the vertical stabilizer limit loads were exceeded by a large margin as a result of the alternating rudder inputs. In the American Airlines flight 587 accident, the pilot applied four full alternating rudder inputs; after the fourth input, the aerodynamic loads on the vertical stabilizer exceeded the vertical stabilizer’s ultimate design load (at about twice the maximum load), and it separated from the airplane. In the Air Canada flight 190 accident, the pilot applied three alternating rudder inputs and exceeded the limit load by 29 percent.

Rudder control systems with a variable ratio rudder travel limiter may provide better protection against high loads from sustained rudder pedal inputs at high airspeeds than systems with a variable-stop rudder travel limiter because variable ratio rudder travel limiter systems retain a relatively uniform aircraft response throughout the airspeed envelope and require more physical effort from a pilot (in terms of force and displacement) to produce cyclic full rudder inputs at high speeds. There is no certification standard regarding rudder pedal sensitivity or any requirement for the sensitivity to remain constant at all airspeeds. As discussed above, the Airbus A320 rudder control system design characteristics are comparatively similar to those of the Airbus A300-600 and A310 and may serve as a trigger for an APC event at high airspeeds. The NTSB concludes that, as demonstrated by the American Airlines flight 587 and Air Canada flight 190 accidents, certification standards for transport-category aircraft regarding yaw sensitivity to rudder pedal inputs must ensure that airplane designs minimize the potential for APC susceptibility and better protect against high loads in the event of large rudder inputs.

As a result of the American Airlines flight 587 accident investigation, the NTSB issued Safety Recommendations A-04-56 and -57, which asked the FAA to do the following:

Modify 14 Code of Federal Regulations Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A-04-56)

After the yaw axis certification standard recommended in Safety Recommendation A-04-56 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential [APC] after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-04-57)

On March 1, 2005, the FAA indicated that the current standards governing the performance and design of yaw control systems may need to be redefined. The FAA added that it was evaluating the existing standards and conducting a study to identify critical rudder control system parameters and human interaction with those controls. The FAA further indicated that, based on the results of the study, it would determine whether the current standards need to be updated and would work with industry to develop rudder control standards. On August 3, 2005, the NTSB classified Safety Recommendations A-04-56 and -57 “Open—Acceptable Response.” As a result of the investigation of the Air Canada flight 190 accident, the NTSB reiterated Safety Recommendations A-04-56 and -57. The NTSB concludes that the yaw axis handling qualities standards envisioned in Safety Recommendations A-04-56 and -57 would increase the safety of all aircraft, not just those whose initial airworthiness certificate is issued by the FAA. Therefore, the NTSB recommends that EASA modify EASA Certification Specifications for Large Aeroplanes CS-25 to ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. Further, the NTSB recommends that, after the yaw axis certification standard recommended in Safety Recommendation A-10-119 has been established, EASA review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, EASA should determine if the airplanes would be adequately protected from the adverse effects of a potential APC after rudder inputs at all airspeeds. If adequate protection does not exist, EASA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds.

Therefore, the National Transportation Safety Board recommends that the European Aviation Safety Agency:
Modify European Aviation Safety Agency Certification Specifications for Large Aeroplanes CS-25 to ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A-10-119)
After the yaw axis certification standard recommended in Safety Recommendation A-10-119 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the European Aviation Safety Agency (EASA) should determine if the airplanes would be adequately protected from the adverse effects of a potential aircraft-pilot coupling (APC) after rudder inputs at all airspeeds. If adequate protection does not exist, EASA should require modifications, as
necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-10-120)
In addition, the National Transportation Safety Board reiterates the following recommendation to the European Aviation Safety Agency:
Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. (A-04-63)

The National Transportation Safety Board reiterated three safety recommendations (A-04-56 through -58) and reiterated and reclassified one safety recommendation (A-02-01) to the Federal Aviation Administration.

In response to the recommendations in this letter, please refer to Safety Recommendations A-10-119 and -120 and A-04-63. If you would like to submit your response electronically rather than in hard copy, you may send it to the following e-mail address: correspondence@ntsb.gov. If your response includes attachments that exceed 5 megabytes, please e-mail us asking for instructions on how to use our secure mailbox. To avoid confusion, please use only one method of submission (that is, do not submit both an electronic copy and a hard copy of the same response letter).

Chairman HERSMAN, Vice Chairman HART, and Members SUMWALT, ROSEKIND, and WEENER concurred with these recommendations.

By: Deborah A.P. Hersman
Chairman