History of Flight

American Airlines Flight 587, an Airbus A300-605R, departed New York's John F. Kennedy International Airport (JFK) at 0914 Eastern Standard Time (EST) on a flight to the Dominican Republic. The flight carried the flight crew of two, seven flight attendants, and 251 passengers. Approximately 1 minute and 40 seconds prior to Flight 587's takeoff, a Japan Airlines (JAL) 747, Flight 47, had taken off and was flying one of the standard departure routes from JFK. Flight 587 used the same runway as JAL Flight 47 and, following takeoff, was cleared to follow the same departure route. During the takeoff and climbout, the two airplanes were always separated by at least 4.3 nautical miles horizontally, and 3,800 feet vertically. The flight paths of the two airplanes are depicted in the following animation: 

At an altitude of approximately 500 feet, having been cleared for the departure route, Flight 587 began a climbing left turn to intercept the assigned route. The captain, who was not flying the departure, contacted the departure controller, indicating that the flight was at 1,300 feet and climbing to 5,000 feet. A few seconds later the captain announced that the flaps and slats were fully retracted.

At approximately 1,700 feet, with the wings approximately level, the airplane encountered what is believed to have been the wake of the preceding 747. The encounter resulted in some pitch and roll oscillations that quickly diminished. Associated rudder movements occurred and were judged to have been within the limits of what the yaw damper could have commanded in response to the wake encounter. Almost immediately a left roll to a bank angle of 17 degrees was initiated, consistent with a left turn required to follow the prescribed departure path. The altitude following the wake encounter was approximately 2,300 feet. Approximately 20 seconds later, while still in the left bank, a second wake encounter was experienced. The bank angle increased from 23 to 25 degrees, and the control wheel moved to 64 degrees right (commanding a decrease in bank angle). At this time the rudder pedals were moved to 100% of their travel, commanding a rudder deflection to the right. The airspeed at this point was 240 knots. The first officer, who was flying the airplane, in a strained voice, called for "max power." The captain asked, "You all right?" to which he replied, "I'm fine." The captain then commented, "Hang onto it. Hang on to it," to which the first officer repeated his request for maximum power. Almost immediately the Cockpit Voice Recorder (CVR) recorded the sound of a loud thump. It was later concluded by the NTSB that this sound was caused by the failure of the vertical stabilizer's right rear attachment fitting. Following the failure of the right rear attachment fitting, the other five fittings failed almost immediately, and the vertical stabilizer separated from the airplane at an airspeed of 251 knots.

During the second wake encounter, the rudder pedals (commanding rudder movement) were moved in an oscillatory fashion from stop to stop (or near the stops) over a time span of approximately six seconds. During this same time interval, the control wheel (commanding roll) was also used in an oscillatory fashion, encountering full deflection on some of the oscillations. These control movements resulted in oscillating sideslip angles of between 10 and 12 degrees, accompanied by a lateral load factor of .2g. Following the separation of the vertical stabilizer, airplane control was lost and sideslip angle continued to increase to a maximum of 31 degrees. Both engines separated from the airplane prior to impact, and the flight data recorder (FDR) stopped recording 13.6 seconds prior to impact. The NTSB produced a video of the flight path and upset which is available below: 

Vertical Stabilizer and Rudder

The A300-600 vertical stabilizer and rudder are constructed of composite materials, primarily carbon or glass fibers in a polymer resin. These carbon reinforced plastics (CFRP) and glass reinforced plastics (GFRP) are pre-manufactured in sheets, and multiple sheets, or plies, are then stacked in a mold and cured under heat and pressure to form a solid structure. The plies may be specifically oriented to one another to enhance strength characteristics. The stiffness and strength are dependent on the number of plies and the orientation of the fibers in the plies.

The vertical stabilizer consists of a torque box and leading and trailing edges. When installed, it also includes an aerodynamic tip fairing at the top of the stabilizer. The leading edge and tip are formed of GFRP and are mechanically attached to the torque box. The trailing edge is also GFRP with a honeycomb core, and is mechanically attached to the trailing edge support structure. The leading edge, trailing edges, and the tip are removable for maintenance or replacement.

The vertical stabilizer is attached to the aft fuselage by three pairs of main attachment fittings and three pairs of transverse load fittings. All of the fittings are CFRP. The main attachment fittings are integrated into the stabilizer skin panels, and are located at the front, center, and rear spars of the stabilizer. The transverse load fittings are integrated into the front, center, and rear spars. Each main attachment fitting has its own assembly (inboard and outboard halves), that are bonded to the skin panels during the assembly/curing process.

The rudder is attached to the aft portion of the vertical stabilizer, and consists of a torque box, leading edge, and tip fairing. These parts are assembled from GFRP and CFRP over a honeycomb core. The main structural component is the torque box, consisting of the left and right skin panels and the spar web. The rudder leading edge and tip are mechanically fastened to the rudder torque box. The physical connection to the vertical stabilizer itself is via seven hinge arm assemblies. Hinge arms 1, 5, 6, and 7 are made from aluminum alloy, while hinge arms 2, 3, and 4 are made from tubular steel. Each hinge arm has three self-aligning bearings that allow the rudder to rotate around its axis. The portions of the hinge attachment fittings that are attached to the vertical stabilizer are made from CFRP, and those on the rudder itself are aluminum. There are three rudder servo controls (hydraulic actuators) that are part of hinge arm assemblies 2, 3, and 4, and are attached via fittings to the vertical stabilizer rear spar and rudder front spar. The rudder is also attached to the rear spar of the vertical stabilizer by a support strut assembly which maintains vertical alignment of the rudder.

Rudder Control System Design

The rudder control system on the A300-600 is conventional for a large transport airplane in that the rudder is actuated hydraulically in response to pilot inputs via foot pedals. The rudder is primarily intended to provide control during engine-out and crosswind situations. In addition to pedal inputs, the rudder can be moved by the rudder trim actuator, the yaw damper actuator, and the yaw autopilot actuator. A command from any of these sources is transmitted through a series of linkages (pushrods, bell cranks, a tension regulator, and cables) through three hydraulically powered servo controls which physically move the rudder. A rudder travel limiter provides a variable stop that limits rudder travel as a function of airspeed. A differential unit operates to sum a pedal or autopilot input and a yaw damper input. The maximum available rudder deflection is 30° in either direction, and the maximum rudder rate, with no loads, is 60° per second. Maximum pedal displacement is four inches. Rudder pedal breakout force, the force required to initiate rudder pedal movement, is 22 pounds.

A rudder travel limiter system reduces rudder travel from a maximum of 30°, at speeds at and below 165 knots, to 3.5° at speeds of 395 knots and higher. Between 165 knots and 395 knots, the rudder travel limiter varies the rudder travel as a function of airspeed. At the airspeed when the 747 wake was encountered, the available rudder travel was approximately 10°. The limiter system is controlled by two feel and limitations computers (a primary and a backup), which operate a variable stop actuator. The variable stop actuator limits rudder pedal travel as airspeed increases beyond 165 knots. As pedal travel is reduced, so is the pedal force required to achieve the maximum deflection. At 165 knots the pedal force required to achieve the full 30° rudder deflection is 65 pounds (43 pounds above the breakout force of 22 pounds). At the speed at the time of the accident (250 knots), the required pedal force to achieve the available rudder deflection of approximately 10° was 32 pounds (10 pounds above the 22-pound breakout force), and required a pedal travel of approximately one inch.

The rudder system for the A300-600 had been changed in two ways relative to the airplane models from which it was derived. Roll control (wheel) forces and rudder pedal forces had been reduced on the A300-600. The reduction in rudder pedal forces was intended to maintain consistency with wheel forces. Second, the rudder travel limiter was changed from a variable ratio design to a variable stop design.

According to the investigators, the net effect of these two rudder system design changes was an increase in overall control system sensitivity.

Bilateral Certification Requirements

The Airbus A300-605R is a derivative of the model A300B2/B4, and was approved for commercial service in 1988. The earlier models, from which the -605R was derived, entered service in 1974 and 1975, respectively. Development of the A300-600 began in late 1980, with the first test flight of the new model occurring in July 1983. A French type certificate was issued in March 1984. The airplane was certified in the United States via a bilateral agreement between the U.S. and French governments. Per this agreement, the FAA determines whether the airplane has any unique features or unusual characteristics, and based on this determination defines FAA participation in the certification. For an airplane such as the A300-600, which is a derivative model and a member of an airplane model family that had established a satisfactory service history, and for which the certification authority is competent to evaluate the airplane relative to U.S. regulations, the FAA may decide to accept the compliance findings of the French airworthiness authority and choose to limit direct participation in the certification of the airplane. As the FAA had participated extensively in past certification of A300 and A310 models, the majority of compliance findings were made on behalf of the FAA by the French government. A limited number of compliance findings, in various disciplines, were retained and made by the FAA.

Controllability Requirements

Relative to the pitch axis of any transport airplane, there are specific requirements for controllability and maneuverability. Explicit force gradient requirements are specified, as well as requirements for maneuvering flight that specify a minimum stick force per G of applied load factor. These requirements result in predictable elevator forces throughout the flight envelope. For the roll and yaw axes, the requirements are largely qualitative. Maximum allowable force values are specified for short- and long-term application, but there are no gradient requirements similar to those specified for the pitch axis. The regulatory requirements primarily provide a means to evaluate control effectiveness and a pilot's ability to precisely control the airplane in engine-out or crosswind conditions. The qualitative requirements prescribe smooth transitions from one flight condition to another without exceptional piloting skill and without danger of exceeding specified structural loads. The result may be that roll and yaw (rudder) forces are low. There are further qualitative requirements for control forces and deflections to be proportional to one another - that may also result in forces in the roll and yaw axes that are relatively light - in order to achieve the desired proportionality. At the time of its certification, the A300-600 was found compliant with all the applicable regulations.

The NTSB expressed concern relative to the regulatory requirements for the yaw axis, and the wide range of system characteristics and handling qualities that could potentially result . The NTSB further stated that the design characteristics of the rudder system on the A300-600 (light pedal forces and reduced pedal travel at high speeds) contributed to the accident. Additionally, the NTSB stated that these same characteristics made the airplane susceptible to "...potentially hazardous rudder pedal inputs at higher airspeeds."

Many designs include a rudder system that has relatively high forces, perhaps as high as 180 pounds to full deflection in some older designs. Further, some systems may require relatively large pedal displacements for a given rudder displacement, even at higher airspeeds. The NTSB expressed concern relative to the A300-600 rudder in that it required a relatively high breakout force, coupled with a relatively short pedal travel, and only 10 additional pounds of pedal force to reach full deflection. The NTSB concluded that this combination of characteristics may have contributed to the copilot's tendency to overcontrol the airplane, and may have made it difficult to recognize that his control inputs had gotten out of phase with the airplane's responses. This phenomenon, known either as Airplane-Pilot Coupling, or Pilot Induced Oscillations is discussed later in this overview.

Design Maneuvering Speed

Design Maneuvering Speed, or V_A is defined as the maximum speed at which the limit load can be imposed (either by gusts or full deflection of the control surfaces) without causing structural damage (AC 61-21A). Although such definitions were widely interpreted among operational pilots as allowing full unrestricted use of flight controls below V_A, the design standards were never intended to protect an airplane from such maneuvers. This excerpt from 14 CFR, part 25 clearly shows that the intent of the regulation was to design for a single full rudder application from a static flight condition. 

An additional requirement that was emphasized by the NTSB in their accident report is the establishment of V_A. V_A is required to be established as a structural limitation, and provides a flight speed limitation at which full elevator can be applied without damaging airplane structure. It became apparent during the course of the accident investigation that V_A was not well understood throughout the industry. This misunderstanding was, in part, a belief that if flight speed was at or below V_A, any manipulation of the controls to full surface deflections, in any axis or in any combination, could not damage the airplane.

The specific regulation introducing V_A addresses only the pitch maneuver. However, most airplane designers typically consider control deflections at V_A in the other control axes as well, for consistency of design. There is no requirement in the FAA's regulatory standards to consider multiple or oscillatory deflections in any control axis, nor is there a requirement to consider control deflections in more than one axis at a time. For example, a full elevator deflection is not required to be considered in combination with a full rudder deflection.

Other regulations specify structural design requirements for control deflections in the roll and yaw axes. For the rudder, the structural design criteria required analysis of a full rudder deflection, and at the maximum yaw value achieved from this control input, the rudder is commanded back to neutral. An oscillatory input is not required to be considered. Further, the certification basis for the A300-600 required a statement in the FAA-approved airplane flight manual (AFM) that full application of rudder and aileron controls, as well as maneuvers that involve angles of attack near stall, should be confined to speeds below V_A.

AA587 had been flying at approximately 250 knots, well below the 270 knot V_A cited in the accident report. The prevailing industry belief at the time of the accident, though not shared by the manufacturers, was that the control manipulations evident in this accident would not have resulted in any airplane damage or loss of control. This widespread misunderstanding was traced by investigators to a fundamental misconception of the relevance of V_A to the structural capability of the airplane.

In the official accident report, the NTSB commented on the apparently widespread lack of pilot understanding of V_A, and the extent of structural protection that exists when below V_A. In designing a commercial transport airplane, manufacturers consider each control axis independently, and additionally only consider a single control input, after which the airplane is returned to stabilized flight. The NTSB learned during the investigation that American Airlines flight crews believed that the airplane would be protected from structural damage even in the event of alternating full control inputs if the inputs were made at a speed below V_A. 

The NTSB concluded that FAA regulations and guidance may have contributed to this misunderstanding. 14 CFR 25.1583, "Operating Limitations," requires that V_A be listed as an airspeed limitation, and cautions against full control displacements or high angle of attack maneuvering at speeds above V_A. The NTSB concluded that although full control displacements should be confined to speeds below V_A, the text of the regulation implied that the airplane could withstand any control input that was made at a speed below V_A. Further, the NTSB cited the wording in Advisory Circular (AC) 61-23C "The Pilot's Handbook of Aeronautical Knowledge," as more misleading than the regulation by stating that any usage of the flight controls, in any combination including full deflection, would not result in structural damage as long as the inputs were made at speeds below V_A.

Advanced Aircraft Maneuvering Program (AAMP)

On August 16, 1995, the FAA issued Handbook Bulletin for Air Transportation (HBAT) 95-10, "Selected Event Training." Selected Event Training was defined as: "voluntary flight training in hazardous flight situations which are not specifically identified in FAA regulations or directives." The HBAT also contained guidance and information on approval and implementation of this training for operators that use simulators as part of their flight training programs. The HBAT had been issued following the USAir 427 accident in 1994 in response to NTSB recommendations regarding training in unusual attitude recovery, but was expanded in scope to include recognition and containment of situations that might lead to unusual attitudes.

Just prior to the issuance of the HBAT, American Airlines had initiated a selected events training program in response to the cited NTSB recommendations. The Advanced Aircraft Maneuvering Program was initiated as the upset training module of their selected events training.

AAMP development began in 1996 following a review of worldwide transport accidents from 1987 to 1996. This review showed that loss of control was the leading accident cause. American Airlines' stated position was that many of these accidents might have been prevented if flight crews had been specifically trained to recognize and respond to airplane upsets. The airline involved airplane manufacturers in early AAMP development, seeking input to "ensure accuracy of the program." Following development of AAMP training, American Airlines held a two-day conference on the subject in May 1997. Attendees included the FAA, Boeing, Airbus, and McDonnell Douglas.

Also in May 1997 an American Airlines internal memorandum from the airline's managing director of flight operations to the chief pilot and vice president of flight expressed concerns regarding "flawed aerodynamic theory and flying techniques that have been presented in the AAMP." According to the NTSB, the memorandum also stated that it was wrong and "exceptionally dangerous" to emphasize the use of rudder as the primary means of roll control in recovery from high angles of attack. The memorandum concluded with the suggestion that the airline take immediate corrective action, and advise flight crews of the adverse consequences of using rudder at high angles of attack.

Following the AAMP conference, the manufacturers and the FAA issued a joint letter to American Airlines in August 1997, detailing their joint concerns regarding certain portions of AAMP training. While characterizing the overall program as excellent, the letter expressed explicit concerns regarding what was characterized as "the excessive emphasis on the superior effectiveness of the rudder for roll control vis-à-vis aileron and spoilers in high angle of attack." In their October 1997 response, American Airlines stated that they did not advocate using "rudder first" or "rudder only," and that four different sections of AAMP specified that rudder use should be confined to "smooth application of coordinated rudder" to obtain a desired roll response only after aileron and spoiler control were ineffective. American Airlines explicitly disagreed with the manufacturer/FAA position stating that American Airlines flight crews "will not hesitate to roll the lift vector off the vertical [axis] to generate the required nose down pitch rate" if unloading the elevator did not produce the desired response, and further stated that American Airlines would not teach its pilots to use nose down stabilizer trim during an upset recovery, nor to reduce thrust before rolling the lift vector off the vertical axis as it may be "counter-productive" for airplanes with wing-mounted engines. (Joint Letter and American Airlines Response)

In March 2002, American Airlines issued an A300 Operating Manual Bulletin titled, "Upset Recovery/Unusual Attitudes." According to the NTSB, this bulletin incorporated Airbus recommended techniques and guidelines for upset/unusual attitude recovery, and replaced the information that had been the Operations Manual at the time of the accident.

Rudder Pedal Inputs

According to the investigation, the cause of the vertical stabilizer separation from the airplane was the "unnecessary and excessive rudder pedal inputs" made by the first officer who was flying the airplane at the time of the separation. The NTSB concluded that there were three factors that influenced the first officer's rudder use: a demonstrated tendency toward aggressive reaction to wake turbulence; his pilot training, including training received at American Airlines; and the characteristics of the rudder control system.

Relative to the first officer's reaction to wake turbulence, pilots who had previously flown with the first officer provided anecdotal evidence of aggressive reaction to wake turbulence encounters. One pilot noted that during a wake encounter, the first officer reacted with a series of rapid, alternating full rudder inputs. When questioned about his rudder inputs, the first officer had insisted that AAMP training directed this type of rudder use, which was concluded by the investigation to have been overly aggressive. A second pilot stated that during a wake encounter on approach, when the airplane rolled moderately, the first officer applied full thrust and initiated a go-around. The NTSB viewed the go-around as having probably been unnecessary, and characterized the first officer as having overreacted.

Relative to training, the investigation determined that pilots have little exposure to, and therefore may not understand the significance of, large rudder inputs or the mechanisms by which rudder inputs induce roll. The NTSB stated that AAMP training may have "reinforced the first officer's tendency to respond aggressively to wake turbulence, encouraged the use of full rudder pedal inputs, and misrepresented the airplane's actual response to large rudder inputs." The NTSB further concluded that A300-600 pilots were not well trained in the function of the rudder travel limiter, and the resulting reduced rudder pedal travel with increasing airspeed.

Finally, the investigation concluded that yaw/roll coupling and the magnitude of rolling moment that can be generated by large rudder inputs are mostly outside an airline pilot's experience. As a result, encountering these responses in flight, following large control inputs, might create confusion or surprise at the airplane response.

The NTSB produced an animation of the pilot's inputs following the wake encounters and leading up to the failure of the vertical stabilizer. The sequence runs twice and is available below: 

Aircraft-Pilot Coupling (APC)

The NTSB concluded that the initial control inputs were not sufficient to generate loads that could cause failure of the vertical stabilizer. The first officer, once the initial control inputs had been made, continued rudder and wheel inputs in an oscillatory fashion until sideslip developed to a sufficient magnitude to result in excessive stabilizer loads. An NTSB study, conducted as part of the accident investigation, concluded that the structural loads that caused the failure of the stabilizer were the result only of rudder pedal inputs, and were not associated with the effects of the wake turbulence encounter. The NTSB stated that if the first officer had ceased his inputs any time prior to the failure of the vertical stabilizer, the accident would have been averted. Accordingly, the NTSB became interested in why the first officer had persisted with his inputs, and pursued the airplane's response to the first rudder input as a potential triggering event for an aircraft-pilot coupling (APC), otherwise and perhaps more commonly known as a pilot-induced oscillation (PIO) event.

According to the National Research Council's (NRC) definition of APC, adverse APC events "are rare, unexpected, and unintended excursions in aircraft attitude and flight path caused by anomalous interactions between the aircraft and the pilot." APC events typically require a trigger that causes a pilot to alter his control strategy. The trigger results in a shift from low gain (small input) control usage to high gain (large input) to create corrections to even small errors or deviations, leading to over control and quickly becoming out of phase with the airplanes response.

The investigation concluded that in this accident the trigger was the second wake encounter, which was initially over-controlled. This initial over control, and a lack of understanding of the airplane's response to rudder inputs at higher airspeeds, may then have been the trigger to attempt large corrective inputs, leading to an APC event.

The NTSB cited certain rudder system characteristics that could have contributed to sustained alternating rudder inputs: yaw/roll coupling that introduces phase lag between control input and airplane response; relatively light control forces; small pedal displacements at higher airspeeds; and changing control performance as airspeed increases. The NTSB acknowledged that while the design characteristics of the A300-600 rudder provided a consistent ratio between rudder pedal and rudder surface deflections, rudder effectiveness also increases, resulting in significant differences in response characteristics at opposite ends of the design envelope.

The NTSB postulated that the small pedal displacements at the wake encounter speed may have contributed to the first officer's large, rapid control inputs. This resulted in a rapid buildup of sideslip angle, and therefore a rapid increase in loads on the vertical fin and its ultimate failure.

Back to top

The NTSB issued 18 findings, variously covering piloting technique, American Airline's training program, control system sensitivity, airplane controllability, and airplane certification standards. The complete text of the findings is available at the following link: (NTSB Findings).

Further, the NTSB issued the following probable cause:

"The National Transportation Safety Board determines that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer's unnecessary and excessive rudder pedal inputs.

Contributing to these rudder pedal inputs were characteristics of the A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program."

The complete accident report issued by the NTSB is available at the following link: (NTSB Report).

Back to top

The NTSB issued 15 recommendations related to this accident: 14 recommendations to the FAA, and one to the French Direction de l'Aviation Civile (DGAC). The recommendations covered a number of issues, most notably including flight crew training, structural design criteria, and recommendations to modify regulatory criteria for design and certification of flight control systems. The NTSB also included recommendations that had previously been made regarding this accident, and previous accidents/incidents that had occurred under similar circumstances. The complete text of the recommendations is available at the following link: (NTSB Recommendations).

Additionally, the NTSB had issued a number of previous recommendations following other accidents/incidents that were also related to circumstances in this accident. Two of those recommendations concerned characteristics of rudder limiting systems and were the result of the American Airlines Flight 903 accident in May 1997. Four additional recommendations were concerned with upset recovery and associated training, and an additional three recommendations addressed flight data recorder data filtering, which had caused some difficulties in data interpretation following a number of accidents, including AA587. These recommendations and associated discussion from the AA587 accident report are available at the following link: (Related NTSB Recommendations).

Back to top

14 CFR §25.143; Controllability and Maneuverability, Control Forces

14 CFR §25.177; Static Directional and Lateral Stability

14 CFR §25.301; Loads

14 CFR §25.303; Factor of Safety

14 CFR §25.305; Strength and Deformation

14 CFR §25.335; Design Maneuvering Speed

14 CFR §25.351; Yaw Maneuver Conditions

14 CFR §25.363; Side-loads on Engines

14 CFR §25.397; Control System Loads

Back to top

Following the American Airlines Flight 903 accident on May 12, 1997, (discussed later in this module under Precursors) Airbus Industrie, as part of their submittal in response to the NTSB investigation of that accident, provided information to the NTSB, FAA, American Airlines, the French BEA, and the airline unions. The Airbus information addressed the hazards of using rudder as a primary recovery control during upsets or unusual attitudes, and in particular discussed the consequences of rudder reversals, such as those that would eventually be employed on AA587, and the possibility of introducing severe structural damage or failure of the vertical stabilizer.

View an excerpt of that submittal, discussing the ramifications of rudder usage during upset recovery.

Also, in 1997 American Airlines convened a conference in which they presented their Advanced Aircraft Maneuvering Program (AAMP) to airworthiness authorities and manufacturers. In a letter dated August 20, 1997, representatives of Airbus Industrie, the Boeing Company (Boeing Commercial Airplane Group, and Douglas Products Division), and the FAA provided a critique of that program.

In regard to use of rudder, the letter included the following comments: "The excessive emphasis on the superior effectiveness of the rudder for roll control vis-à-vis aileron and spoilers, in high angle of attack, is a concern." "The pilots are left with the impression that it (rudder) must be used first in all high angle of attack situations." Sideslip angle is a crucial parameter that should be discussed in your program. It is probably not well understood by many line pilots but has a significant impact on an airplane's stability and control. Large or abrupt rudder usage at high angle of attack can rapidly create large side slip angles and can lead to rapid loss of controlled flight. Rudder reversals such as those that might be involved in dynamic maneuvers created by using too much rudder in a recovery attempt can lead to structural loads that exceed the design strength of the fin and other associated airframe components."

The letter also addressed the use of simulators in upset recovery training. "Artificially manipulating a simulator into an environment that is way beyond valid engineering data creates a potential for negative learning." Current simulator limitations also do not permit the replication of linear or lateral load factors. Pilots need to be aware that the simulator will not necessarily respond as the airplane will when simulator capabilities are exceeded."

Back to top

• A training program which emphasized the use of rudder for roll control during upset recovery and utilized a simulator model extrapolated beyond the validated flight envelope.
• A lack of understanding among the airline pilot community at large of the significance of Design Maneuvering Speed (V_A) and the effect of sideslip on the control and structural integrity of a large swept wing jet transport airplane.

Back to top

• Unrestricted full deflection of flight controls when flying below design maneuvering speed (VA) would not overload the airplane structure.

Back to top

Prior to this accident there were two accidents that are considered precursors to AA587.

Interflug Airline A310, February 11, 1991, Moscow, Russia

During a go-around, the airplane was stalled repeatedly. The pilot's alternating rudder inputs during recovery caused the ultimate design loads of the vertical stabilizer to be exceeded.

American Airlines Flight 903, A300-600, May 12, 1997, Miami, Florida

While entering a holding pattern in instrument meteorological conditions, AA903 experienced an in-flight loss of control following a stall. During recovery, ultimate load was exceeded on the vertical stabilizer. The airplane sustained damage to the vertical stabilizer, wings, and nacelles. One passenger sustained serious injuries and one flight attendant received minor injuries. The flight had originated from Logan International Airport, Boston, Massachusetts, about 2 hours 16 minutes before the accident.

The sequence began after descending to 16,000 ft., where the airplane leveled off with a throttle setting that was insufficient to maintain the commanded airspeed. While entering the holding pattern, the stick shaker activated (stall warning), the autopilot disconnected, and AA903 slowly decelerated into a stall (a condition in which airflow separation over the wing due to excessive angle of attack results in a loss of lift, usually accompanied by un-commanded pitch and sometimes roll excursions). The flight crew did not recognize that the airplane had entered a stall. Three or more times following the initial stall and nose pitch down, the pilot pulled the control column back, pitching the airplane into a succession of secondary stalls and a controlled bank angle with full deflection rudder and aileron reversals which resulted in large lateral and directional oscillations. Loads imposed on the vertical tail reached 153% of limit load, and it was believed that ultimate load was exceeded one or more additional times as the pilot cycled the rudder during the stall recovery. Control of the airplane was subsequently recovered at 13,000 ft. and 280 knots, and the airplane was landed without further incident.

The NTSB determined the probable cause of this accident to be "The flight-crew's failure to maintain adequate airspeed during level-off which led to an inadvertent stall and their subsequent failure to use proper stall recovery techniques. A factor contributing to the accident was the flight-crew's failure to properly use the auto-throttle." In a submission to the NTSB, Airbus concluded, "Rudder reversals such as those that might be involved in dynamic maneuvers created by using too much rudder in a recovery attempt can lead to structural loads that exceed the design strength of the fin and other associated airframe components." The Airbus conclusion is contained in the NTSB accident docket.

Back to top

As a result of the AA587 accident, manufacturers of transport category airplanes, acting at the request of the FAA, revised the Limitations Sections of their Airplane Flight Manuals (A300-600 AFM) to contain a warning that rapid and large alternating control inputs, especially in combination with large changes in pitch, roll, or yaw (e.g., large sideslip angles), may result in structural failures at any speed, even below V_A.

In order to enhance FAA internal coordination regarding design related and operational issues, the FAA has established a program management position specifically tasked with tracking and follow-through on issues which span design and operational activities, with regard to safety management of the airline fleet.

Back to top

Two Airworthiness Directives were issued as a result of this accident.

AD 2001-23-51 was issued in November 2001 to require inspections of the vertical stabilizer-to-fuselage attachment points and rudder-to-vertical stabilizer attachments. The inspections were mandated in order to search for damage to the subject structure that could lead to loss of the fin and/or rudder and loss of control of the airplane.

AD 2002-06-09 was issued in March 2002 and required detailed inspections to detect and correct reduced structural integrity in airplanes after an extreme in-flight lateral loading event.

Back to top

Airplane Life Cycle:

• Operational

Accident Threat Categories:

• Incorrect Piloting Technique
• Structural Failure
• In-flight Upsets

Groupings:

• Loss of Control

Accident Common Themes:

• Organizational Lapses
• Human Error
• Flawed Assumptions

Back to top

Organizational Lapses

In development and implementation of AAMP training, American Airlines emphasized use of the rudder as an upset recovery tool. Further, the investigation discovered that flight simulators used in conjunction with AAMP had been modified to delay responses to control inputs. Pilots in training would be forced to resort to rudder use in order to effect recovery from certain types of upsets. In a joint letter, the FAA and two manufacturers expressed concern regarding the use of rudder and the consequences of rudder use at high angles of attack and urged modifications to AAMP training. Initially, American Airlines disagreed with the contents of the letter and did not modify the AAMP curriculum. However, after the accident, AAMP training was modified to reflect the recommendations of the manufacturers.

Design Maneuvering Speed, V_A, was not well understood by certain segments of the industry. There was a persistent perception that any manipulation of the controls, in any combination, would not result in damage to the airplane as long as airspeed was below V_A. The NTSB stated that the language of 14 CFR 25.1583, making V_A a limitation, and Advisory Circular 61-23C, which explicitly discussed any manipulation of controls in any combination, created confusion and was misleading, contributing the widely held belief that V_A provided a measure of structural protection that did not exist.

Human Error

The NTSB stated that the first officer who was flying the airplane overreacted to a wake encounter and made inappropriate rudder inputs, leading to excessive sideslip angles and loads that exceeded the structural capability of the vertical stabilizer.

Flawed Assumptions

As previously stated, there was a widespread belief that as long as airspeed was below V_A, any manipulation of the controls, in any combination, including oscillatory inputs, would not damage the airplane.

Back to top

American Airlines Flight 903, A300-600, May 12, 1997, Miami, Florida

During approach into Miami, as the airplane leveled off from a descent with autopilot engaged, the airplane slowed following a thrust reduction and subsequently stalled. The autopilot disconnected and the airplane began to roll, reaching a bank angle of 56 degrees. The pilot applied full rudder to correct the roll. The airplane pitched down and began a series of oscillations in all three axes. The maneuvers eventually dampened, and the airplane was recovered. The airplane was landed safely although it suffered structural damage. The NTSB classified it as an accident.

The NTSB determined that the cause of this accident "......was the flight crew's failure to maintain adequate airspeed during level-off, which led to an inadvertent stall, and its subsequent failure to use proper stall recovery techniques. Contributing to the accident was the flight crew's failure to properly use the autothrottle."

It was subsequently analytically concluded that the vertical stabilizer had been subjected to loads in excess of the design ultimate load.

USAir Flight 427, 737-300, September 8, 1994, Aliquippa, Pennsylvania

USAir Flight 427 crashed while on approach to Pittsburgh International Airport following a loss of control and airplane stall precipitated by an encounter with the wake of a preceding Boeing Model 727 airplane. The NTSB deemed that the loss of control was caused by a full rudder deflection in a direction opposite to that commanded by the flight crew (rudder reversal) in response to the wake encounter. During the upset, the elevator was commanded by the flight crew to its full-up position, resulting in an airplane stall, further compounding the loss of control. Control was never regained. The airplane crashed approximately six miles northwest of the airport, killing all 132 passengers and crewmembers. Subsequent to the accident, the Model 737 rudder system was redesigned to preclude an in-flight reversal. In addition, a training document, the Upset Recovery Training Aid, was produced by an industry team to aid in the development of training for recovery from in-flight upsets.

See accident module

Back to top

Technical Related Lessons

Oscillatory and/or simultaneous large magnitude control deflections in single or multiple axes, even at speeds below VA, can result in catastrophic structural failure. (Threat Category: Structural Failure)

• The NTSB focused on the first officer's control inputs as a primary factor in this accident. In response to a wake turbulence encounter, the first officer made a series of large magnitude, oscillatory inputs in both the yaw and roll axes, leading to excessive structural loads and eventual separation of the vertical stabilizer. The NTSB characterized the first officer's response to the wake encounter as "unnecessary and excessive." The NTSB further noted a widespread lack of understanding throughout the industry related to VA, and the inherent lack of structural protection when certain types of control inputs are used, even when speed is below VA. The NTSB believed that this widespread misunderstanding may have contributed to the first officer's belief that his control responses to the wake encounter were warranted and appropriate.

Common Theme Related Lessons

Training programs and associated training simulators must provide realistic responses to control inputs in order to avoid negative training. (Common Theme: Organizational Lapses)

• An aspect of Advanced Airplane Maneuvering Program (AAMP) training relative to upset recovery techniques introduced response time delays to roll inputs in the training simulator. Flight crews in training, when encountering the delayed responses during roll upsets, reverted to use of the rudder in order to provide the necessary roll response to initiate recovery. The NTSB cited this use of unrealistic response as a source of negative training and as a contributing factor in the accident, focusing on the first officer's responses as having been learned during AAMP training.
• The AAMP training was evaluated by the FAA and manufacturers who overall endorsed the program. There were aspects, however, especially regarding what the evaluators viewed as an overemphasis on the use of rudder during upset recovery, where changes were suggested. A joint letter from the FAA, Boeing, McDonnell Douglas, and Airbus suggested that this aspect of the AAMP training be revised, and they provided cautions regarding the use of rudder during upset recovery. Internal American Airlines memos also expressed similar concerns. Subsequent to the accident, the AAMP was changed to reflect these concerns.

Back to top