It is significant when pilots express their lack of confidence in the safety of an airplane. Yet some pilots have done so. In the wake of the fatal Nov. 12, 2001, crash of an American Airlines A300 into a residential area of Belle Harbor, N.Y., less than two minutes after takeoff from John F. Kennedy International Airport, a number of American’s A300 pilots have suggested in a letter that the remaining fleet of 34 aircraft be grounded until the cause of the crash is determined. The composite tailfin snapped off, and the airplane has a history of uncommanded rudder movements.
All 260 aboard Flight 587 were killed, plus another five persons on the ground. It was the first fatal crash of an Airbus aircraft in North America, and the first involving a composite tailfin. Some sort of dynamically divergent oscillation of the rudder appears to have overloaded the tailfin’s strength-bearing capability.
The crash was the second worst in the history of U.S. commercial aviation–the worst being an American Airlines DC-10 that crashed May 25, 1979, also on takeoff, from Chicago’s O’Hare International Airport. The DC-10 accident, too, involved a structural failure: the left engine and pylon separated, causing the leading edge slats on the wing to retract when the hydraulic fluid bled out. All 273 aboard were killed.
The A300 pilots note that the DC-10 fleet was immediately grounded "until we were able to determine that engine pylon bolts were to blame." In contrast, the cause of the Flight 587 crash seems to be a deepening mystery. "Why are American Airlines’ A300s still flying when they are unsure whether the same structural failure that occurred on Nov. 12 will occur again?" a letter to "Fellow Airbus Pilots" asks.
"What we are asking and advocating is not any type of job action," the letter adds. "We would like each of you to evaluate your feelings on the issue of whether or not the fleet should be grounded until a definitive cause for this accident can be determined, along with ways to prevent a similar occurrence…"
Reaction to the letter could be likened to a match falling on dry tinder. Even though it was signed, "Fraternally," the Allied Pilots Association (APA), the union of American Airlines pilots, distanced itself, asserting that the letter is "not a union-led initiative." The union stated publicly that it did not support grounding. American Airlines rejected the call for grounding, saying, "Nothing in the examination of the Airbus fleet…suggests there is a need to ground this fleet."
Manufacturer Airbus declared, "If Airbus had any indication whatsoever of a safety issue, we would notify the authorities and airlines immediately. The letter from this small group of pilots is based on opinion."
The National Transportation Safety Board (NTSB), which is investigating the Flight 587 crash, believes the evidence thus far reveals a safety concern regarding rudder inputs. "We have calculated that certain rudder movement inputs by the pilots could cause a catastrophic failure of an airliner’s vertical tailfin," NTSB Chair Marion Blakey said at a Feb. 8 press conference, in which she announced an interim safety recommendation on the matter. "This concern is not limited to the A300 or even to Airbus models. Our concern is industry-wide," she added.
More specifically, dangerous combinations of sideslip angle and rudder position can cause aerodynamic forces sufficient to snap off the tail. In the more direct terms of a Safety Board official, "A nearly full rudder deflection in one direction and then a full deflection in another direction can cause loss of the tailfin."
Investigators know from the flight data recorder (FDR) that a series of left/right rudder movements occurred in the moments before rudder and stabilizer departed the airplane. However, the FDR did not record pilot inputs on the rudder pedals. Blakey says, "We do not know [if those rudder movements] were caused by the pilots."
Reminded that some A300 pilots suggest grounding the fleet, Blakey says, "We would not recommend grounding the fleet, based on what we do not know." This argument, it seems, could be turned around to argue for grounding, as unknown circumstances could combine to kill again.
In the interim, the Safety Board recommends that pilots be educated about the potentially lethal consequences of full slam-bang rudder deflections to opposite limits. If excessive rudder deflections are the problem, expanding the authority of the rudder limiter might be a more straightforward and standardized means of addressing the problem, rather than enjoining pilots to make more prudent rudder inputs. An NTSB official reports that the rudder movements captured on the FDR "were at a speed that can occur in either case," by the machine or by the man. "We can change the pilot inputs quicker," he says. It would take years to isolate any problem in the rudder control system, design a fix and retrofit the fleet.
Capt. Glenn Schafer, an A300 pilot who signed the letter suggesting grounding, believes the pilots could not have induced the rudder movements recorded on the accident aircraft. "I’ve been flying big airplanes for more than 20 years, the last 10 of which have been spent on the A300," he says. "As a pilot, I can tell you that…the aircraft’s response to control input is not instantaneous. You make a control input, and it takes a bit of time to move the aircraft in the desired direction."
"I’m also in the fairly unique position of having flown with both Capt. Ed States and First Officer Sten Molin, the pilots of the ill-fated Flight 587," Schafer adds. "Both were excellent, well-seasoned pilots. Nothing I observed while flying with either of them could possibly lead me to conclude they would even attempt to move the rudder around in the fashion the FDR says it was moved."
Schafer argues that, in a wake turbulence encounter, such as occurred in the accident scenario, a pilot would not normally make a large rudder input and then snap-reverse it at 255 knots, the speed at which the accident airplane was climbing when the tail separated. Schafer suggests a simple exercise with a stopwatch to illustrate that the pilots of Flight 587 could not have moved their feet that quickly.
Indeed, an aircraft control systems engineer supports Schafer’s view. He maintains that if the pilots caused the rudder motion, it is doubtful, in a wake turbulence encounter, that they would have achieved virtually the same rudder deflection on each swing. The rudder always stopped at 10 degrees, a pattern that could be "explained" by the yaw damper oscillating at its mechanical limit.
Safety Board investigators do not agree. At this point, they believe the rudder movements on the accident aircraft appear to be "within pilot capability."
Investigators nevertheless are looking closely at the rudder control system. It may be useful to note that the A300-600 has amassed a history of uncommanded rudder movements–eight such events before the Flight 587 accident, as noted in the service difficulty report (SDR) database. The rate of such events for the A300-600 is more than double that of the Boeing 757. A cautionary note: reporting gaps in the SDR database make such comparisons suggestive, at best. However, a series of incidents has been documented in which the rudder moved without pilot inputs.
There may be a clue in the case of a FedEx A300. During a routine maintenance check on Feb. 1 at the company’s main maintenance base at Memphis, Tenn., mechanics found bent and broken rudder control system components, as well as associated disbonding of the composite tailfin. Details are sketchy, but this much can be reported: the mechanic was applying rudder movement with the hydraulics turned on as part of a phase check; he unearthed a synchronization issue, wherein hydraulic pressure pulses from different sources can get out of phase. The problem of "rudder servo control desynchronisation" was the subject of an airworthiness directive (AD) issued Nov. 19, 1997, by French authorities (DGAC AD 96-242-208B R2). In the FedEx case, an oscillation was felt as a sustained vibration, and then a single loud bang was heard. The damaged fasteners connected the rudder itself to the "green" hydraulic system actuator. A yaw damper actuator change appeared to fix the problem, but it has reoccurred since then, according to a source close to the situation.
That damaged FedEx rudder assembly may represent a telltale of "yaw oscillation." NTSB investigators immediately focused on the implications of the damaged/broken rudder control components found on the FedEx airplane and their possible relevance to the Flight 587 crash. "It appears that the system damaged the rudder. That is not supposed to happen; the system should break out first," states an NTSB official.
An obvious question is whether the condition of the linkages and actuator(s) on the FedEx airplane matched those retrieved from the Flight 587 wreckage. Unfortunately, most of the yaw damper and linkages on the Flight 587 aircraft were consumed by fire. However, the NTSB official declares, "the investigation is pursuing many scenarios, including an oscillatory failure of the rudder." That back-and-forth rudder movement could have been the precursor to loss of the tailfin.
Meanwhile, the question of grounding the A300s seems to be receding, even though a published American Airlines bulletin cautions pilots that they may experience uncommanded rudder inputs of up to 12 degrees, and a published NTSB safety recommendation indicates that 9.3 degrees of rudder movement at 255 knots can cause the vertical stabilizer to separate. A300 pilots have been advised to shut off the appropriate servo switch and land. This expedient procedure might be characterized as an event-driven grounding of an individual aircraft–which is to say a particularized response to a generalized problem.