• Figures
• Attachment A: Cockpit Voice Recorder Transcript
• Attachment B: Response of the Egyptian Civil Aviation Authority to the Draft Report of the National Transportation Safety Board

FACTUAL

HISTORY OF FLIGHT

Because of the 10-hour scheduled en route flight time from JFK to Cairo, ECAR Part 121, Subpart Q, required that the accident flight have two designated flight crews (each crew consisting of a captain and first officer). According to the EgyptAir flight dispatcher who accompanied the two accident flight crews from their hotel in New York City to the airport, they departed the hotel about 2330 EDT on October 30 and arrived at JFK about 40 minutes later, about the same time as the airplane, inbound from LAX, arrived at the terminal gate.

According to air traffic control (ATC) records, by 0101, the pilots of EgyptAir flight 990 had requested, received, and correctly read back an IFR clearance from ATC. ATC transcripts further indicated that between about 0112 and 0116, air traffic controllers issued a series of taxi instructions to EgyptAir flight 990. At 0117:56, the pilots advised the local controller that they were holding short of the departure runway (runway 22 right [22R]) and that they were ready for takeoff. The local controller instructed EgyptAir flight 990 to taxi into position and hold on runway 22R and, at 0119:22, cleared the accident flight for takeoff. The first officer acknowledged the takeoff clearance, and, about 0120, the airplane lifted off runway 22R.

Shortly after liftoff, the pilots of EgyptAir flight 990 contacted New York Terminal Radar Approach (and departure) Control (TRACON). New York TRACON issued a series of climb instructions and, at 0126:04, instructed the flight to climb to flight level (FL) 230³ and contact New York Air Route Traffic Control Center (ARTCC). According to ATC and cockpit voice recorder (CVR) records, at 0135:52, New York ARTCC instructed EgyptAir flight 990 to climb to FL 330 and proceed directly to DOVEY intersection.⁴

According to the CVR transcript,⁵ about 0140 (20 minutes after takeoff), as the airplane was climbing to its assigned altitude, the relief first officer suggested that he relieve the command first officer at the controls,⁶ stating, "I'm not going to sleep at all. I might come and sit for two hours, and then...," indicating that he wanted to fly his portion of the trip at that time. The command first officer stated, "But I...I slept. I slept," and the relief first officer stated, "You mean you're not going to get up? You will get up, go and get some rest and come back." The command first officer then stated, "You should have told me, you should have told me this, Captain [relief first officer's surname].⁷ You should have said, '[command first officer's first name]...I will work first.' Just leave me a message. Now I am going to sit beside you. I mean, now, I'll sit by you on the seat. I am not sleepy. Take your time sleeping and when you wake up, whenever you wake up, come back, Captain."

The relief first officer then stated, "I'll come either way...come work the last few hours, and that's all." The command first officer responded, "No...that's not the point, it's not like that, if you want to sit here, there's no problem." The relief first officer stated, "I'll come back to you, I mean, I will eat and come back, all right?" The command first officer responded, "Fine, look here, sir. Why don't you come so that...you want them to bring your dinner here, and I'll go to sleep [in the cabin]?" The relief first officer stated, "That's good." The command first officer then stated to the command captain, "With your permission, Captain?"

At 0140:56, the CVR recorded the sound of the cockpit door operating. About 1 second later, the command first officer stated in a soft voice, "Do you see how he does whatever he pleases?" At 0141:09, the command first officer stated, "No, he does whatever he pleases. Some days he doesn't work at all." At 0141:51, the CVR again recorded the sound of the cockpit door operating. Sounds recorded during the next minute by the CVR (including a whirring sound similar to an electric seat motor operating, a clicking sound similar to a seat belt operating, and some conversation) indicated that the command first officer vacated and the relief first officer moved into the first officer's seat.

Flight data recorder (FDR) and radar data indicated that the airplane leveled at its assigned altitude of FL 330 at 0144:27. At 0147:19, New York ARTCC instructed EgyptAir flight 990 to change radio frequencies for better communication coverage. The command captain of EgyptAir flight 990 acknowledged and reported on the new frequency at 0147:39.⁸

At 0147:55, the relief first officer stated, "Look, here's the new first officer's pen. Give it to him please. God spare you,"⁹ and, at 0147:58, someone responded, "yeah." At 0148:03, the command captain stated, "Excuse me, [nickname for relief first officer], while I take a quick trip to the toilet...before it gets crowded. While they are eating, and I'll be back to you." While the command captain was speaking, the relief first officer responded, "Go ahead please," and the CVR recorded the sound of an electric seat motor as the captain maneuvered to leave his seat and the cockpit. At 0148:18.55, the CVR recorded a sound similar to the cockpit door operating.

At 0148:30, about 11 seconds after the captain left the cockpit, the CVR recorded an unintelligible comment.¹⁰ Ten seconds later (about 0148:40), the relief first officer stated quietly, "I rely on God."¹¹ There were no sounds or events recorded by the flight recorders that would indicate that an airplane anomaly or other unusual circumstance preceded the relief first officer's statement, "I rely on God."

At 0149:18, the CVR recorded the sound of an electric seat motor. FDR data indicated that, at 0149:45 (27 seconds later), the autopilot was disconnected.¹² Aside from the very slight movement of both elevators (the left elevator moved from about a 0.7° to about a 0.5° nose-up deflection, and the right elevator moved from about a 0.35° nose-up to about a 0.3° nose-down deflection)¹³ and the airplane's corresponding slight nose-down pitch change, which were recorded within the first second after autopilot disconnect, and a very slow (0.5° per second) left roll rate, the airplane remained essentially in level flight about FL 330 for about 8 seconds after the autopilot was disconnected. At 0149:48, the relief first officer again stated quietly, "I rely on God." At 0149:53, the throttle levers were moved from their cruise power setting to idle, and, at 0149:54, the FDR recorded an abrupt nose-down elevator movement and a very slight movement of the inboard ailerons. Subsequently, the airplane began to rapidly pitch nose down and descend.

Between 0149:57 and 0150:05, the relief first officer quietly repeated, "I rely on God," seven additional times.¹⁴ During this time, as a result of the nose-down elevator movement, the airplane's load factor¹⁵ decreased from about 1 to about 0.2 G.¹⁶ Between 0150:04 and 0150:05 (about 10 to 11 seconds after the initial nose-down movement of the elevators), the FDR recorded additional, slightly larger inboard aileron movements, and the elevators started moving further in the nose-down direction. Immediately after the FDR recorded the increased nose-down elevator movement, the CVR recorded the sounds of the captain asking loudly (beginning at 0150:06), "What's happening? What's happening?," as he returned to the cockpit.

The airplane's load factor decreased further as a result of the increased nose-down elevator deflection, reaching negative G loads (about -0.2 G) between 0150:06 and 0150:07. During this time (and while the captain was still speaking [at 0150:07]), the relief first officer stated for the tenth time, "I rely on God." Additionally, the CVR transcript indicated that beginning at 0150:07, the CVR recorded the "sound of numerous thumps and clinks," which continued for about 15 seconds.

According to the CVR and FDR data, at 0150:08, as the airplane exceeded its maximum operating airspeed (0.86 Mach), a master warning alarm began to sound. (The warning continued until the FDR and CVR stopped recording at 0150:36.64 and 0150:38.47, respectively.)¹⁷ Also at 0150:08, the relief first officer stated quietly for the eleventh and final time, "I rely on God," and the captain repeated his question, "What's happening?" At 0150:15, the captain again asked, "What's happening, [relief first officer's first name]? What's happening?" At this time, as the airplane was descending through about 27,300 feet msl, the FDR recorded both elevator surfaces beginning to move in the nose-up direction. Shortly thereafter, the airplane's rate of descent began to decrease.¹⁸ At 0150:21, about 6 seconds after the airplane's rate of descent began to decrease, the left and right elevator surfaces began to move in opposite directions; the left surface continued to move in the nose-up direction, and the right surface reversed its motion and moved in the nose-down direction.

The FDR data indicated that the engine start lever switches for both engines moved from the run to the cutoff position between 0150:21 and 0150:23.¹⁹ Between 0150:24 and 0150:27, the throttle levers moved from their idle position to full throttle, the speedbrake handle moved to its fully deployed position, and the left elevator surface moved from a 3º nose-up to a 1º nose-up position, then back to a 3º nose-up position.²⁰ During this time, the CVR recorded the captain asking, "What is this? What is this? Did you shut the engine(s)?" Also, at 0150:26.55, the captain stated, "Get away in the engines,"²¹ and, at 0150:28.85, the captain stated, "shut the engines." At 0150:29.66, the relief first officer stated, "It's shut."

Between 0150:31 and 0150:37, the captain repeatedly stated, "Pull with me." However, the FDR data indicated that the elevator surfaces remained in a split condition (with the left surface commanding nose up and the right surface commanding nose down) until the FDR and CVR stopped recording at 0150:36.64 and 0150:38.47, respectively. (The last transponder [secondary radar] return from the accident airplane was received at the radar site at Nantucket, Massachusetts, at 0150:34.)²²

Information about the remainder of the flight came from the airplane's two debris fields and recorded primary radar data from long-range radar sites at Riverhead, New York, and North Truro, Massachusetts, and the short-range radar site at Nantucket. The height estimates based on primary radar data from the joint use FAA/U.S. Air Force (USAF) radar sites indicated that the airplane's descent stopped about 0150:38 and that the airplane subsequently climbed to about 25,000 feet msl and changed heading from 80º to 140º before it started a second descent, which continued until the airplane impacted the ocean.

Airplane wreckage was located in two debris fields, about 1,200 feet apart, centered at 40° 21' north latitude and 69° 46' west longitude. The accident occurred at night in dark lighting conditions.

PERSONNEL INFORMATION

Command Captain Information

The command captain's most recent proficiency check was satisfactorily completed on March 9, 1999, and his most recent recurrent training was satisfactorily completed on August 14, 1999. According to EgyptAir records, at the time of the accident, the command captain had flown approximately 14,384 total flight hours, including 6,356 hours in the 767. The Safety Board's review of EgyptAir training records for the command captain indicated that he had accomplished all required checkrides and satisfactorily performed all required maneuvers.

The command captain arrived in New York the afternoon of October 28, 1999, after serving as a captain on EgyptAir flight 989 from Cairo to JFK. (Additional information about the command captain is contained in the public docket on this accident.)

Relief First Officer Information

The relief first officer's most recent proficiency check was satisfactorily completed on June 19, 1999, and his most recent recurrent training was satisfactorily completed on December 19, 1998. According to EgyptAir records, at the time of the accident, the relief first officer had flown approximately 12,538 total flight hours, including 5,191 hours in the 767. The Safety Board's review of EgyptAir training records for the relief first officer indicated that he had accomplished all required checkrides and performed all required maneuvers.

Before EgyptAir hired him, the relief first officer was a flight instructor, first for the Egyptian Air Force and later for a Government-operated civilian flight training institute in Egypt. The relief first officer became a Major in the Air Force before he transitioned to the flight training institute, where he eventually became the chief flight instructor.

The relief first officer arrived in New York City the afternoon of October 28, 1999, after serving as a first officer on EgyptAir flight 990 from LAX to JFK. (Additional information about the relief first officer is contained in the public docket on this accident.)

AIRPLANE INFORMATION

The accident airplane was equipped with two P&W 4060 turbofan engines. Company maintenance records indicated that the No. 1 (left) engine, S/N 724126, was installed on the accident airplane on April 19, 1998, and had operated about 25,708 hours since new and that the No. 2 (right) engine, S/N 724127, was installed on the accident airplane on June 3, 1998, and had operated about 19,316 hours since new.

767 Longitudinal Control System Information

Two parallel sets (one operated from the captain's side, the other from the first officer's side) of flight control components move the elevator surfaces. Control column inputs made at the captain's position are linked directly to the actuators for the left elevator surface, whereas control column inputs made at the first officer's position are linked directly to the actuators for the right elevator surfaces. The two parallel sets of flight control components are linked together at the forward and aft override mechanisms/linkages and slave cable interconnects. Flight control commands from the captain's and first officer's control columns are transmitted through linkages and cables²⁹ from the front of the airplane to the left and right aft quadrant assemblies, respectively. The aft quadrant assemblies then translate the inputs to the respective bellcrank assemblies and the input control rods for each of the three elevator PCAs for each outboard elevator surface.

After control cable movement is translated to input control rod movement, the control rods move control valves inside the PCAs, allowing high-pressure hydraulic fluid to flow to one side or the other of the actuators' pistons (depending on the direction of the input), resulting in elevator movements that correspond to the direction of the input. When the elevators reach the commanded position, feedback linkages move the control valves to a position in which the hydraulic fluid is blocked off, resulting in no further movement of the actuator piston or elevator.

Testing, evaluation, and analysis of the 767 elevator system showed that any movement of the control columns (whether pilot-induced or not) would have resulted in concurrent, identifiable movements of the elevators, which would have been recorded on the FDR.

An elevator feel-and-centering unit transmits hydraulic and mechanical feel forces to hold the elevator at the neutral (trimmed) position when no control column force is applied. It also provides feedback (or feel) force to the control column that increases as the control column is moved forward or aft. The feel forces provided are essentially equal at both pilot positions because of the connections between the left and right elevator systems.

The captain's and first officer's control columns have authority to command full travel of the elevators under most flight conditions and normally work together as one system. However, the two sides of the system can be commanded independently because of override mechanisms at the control columns and aft quadrant. Therefore, if one side of the system becomes immobilized, control column inputs on the operational side can cause full travel of the nonfailed elevator. In addition, in many cases, control column inputs on the operational side can also result in nearly full travel of the elevator on the failed side through the override mechanisms. The elevator PCAs are installed with compressible links located between each bellcrank assembly and PCA input control rod to provide a means of isolating a jammed PCA, thus allowing the pilots to retain control of that elevator surface through its two remaining (unjammed) PCAs.

767 Elevator Blowdown Information

The maximum output force produced by the elevator PCAs is generated by the hydraulic system pressure acting on the PCAs' piston area; if all three elevator PCAs are working properly, the total output force for each elevator surface is the sum of the forces produced by all three of that elevator's PCAs. When a dual elevator PCA failure occurs,³⁰ the forces produced by the two failed PCAs would overpower the opposing force produced by the one nonfailed PCA. The resultant initial force on the elevator surface in the failed direction would be equivalent to a single functioning PCA operating at 100 percent of its maximum force. The failed PCAs would resist the backdriving force³¹ with a force equivalent to about 130 percent of a single functioning PCA. The high internal pressures required for activation of the PCAs' pressure relief valves allow the PCAs' pistons to resist the aerodynamic backdriving movement with more force than normal operating pressures would allow. Therefore, if a dual PCA failure occurred in flight, the elevator would initially move to a position consistent with a single functioning PCA operating at 100 percent of its maximum force, balanced against the aerodynamic forces affecting the elevator surface. As the airspeed increases, the failed elevator surface would remain at this initial position until the backdriving forces exceeded those of a single PCA operating at 130 percent of its normal capability, at which point the deflection of the failed elevator surface would decrease.³² (Figure 2 is a comparison of the elevator positions recorded by the accident airplane's FDR with failed and nonfailed elevator positions following a dual PCA failure.)

767 Autoflight Systems Information

767 Autopilot Information

The 767 autopilot system controls the airplane's movement about the pitch axis by using the elevators for dynamic control of the airplane's pitch and the horizontal stabilizer to trim out steady-state elevator deflections. When the autopilot is engaged and the airplane is in a steady-state flight condition, the autopilot is designed to keep the elevators near their neutral (or faired) position, using the elevators primarily for short-term dynamic adjustments (such as those necessitated by atmospheric disturbances). The elevators are also used for small trim adjustments, such as those necessitated by fuel consumption during flight. As these small elevator adjustments accumulate over time, the elevator deflections move further from their neutral (or faired) position. When the elevators' deflections reach a threshold value, the autopilot "retrims" the horizontal stabilizer and the elevator returns to a neutral (or faired) position. According to Boeing, when the autopilot system is disconnected, the force applied by the autopilot actuator to the elevator control system is removed, and, if the horizontal stabilizer has not been adjusted recently, small elevator movements result. Boeing representatives indicated that the following circumstances could result in elevator movements at the time of autopilot disconnect:

• Differences between the neutral position recognized by the autopilot and the actual neutral position of the elevator feel-and-centering unit would result in the autopilot actuator holding a force that would be released when the system is disconnected.
• The autopilot may have moved the elevators since it last trimmed the stabilizer, placing the elevators at a position other than their neutral position at the time of disconnect. When the autopilot is disconnected, the elevators would return to the neutral position commanded by the feel-and-centering unit. (During steady-state flight conditions, this situation occurs because of the effect of fuel consumption on the airplane's center of gravity.) According to Boeing, "this type of elevator motion upon autopilot disconnect is inherent in the operation of the autopilot system."
• Pilot forces on the control column at the time of manual autopilot disconnect can affect the movement of the elevator. (The autopilot can be disconnected manually by double-clicking the control yoke-mounted autopilot disconnect switch.)
• Mechanical aspects of the elevator control system (including friction, the effects of compliance in the system,³³ variations among individual autopilot actuator units, and variations in the centering detent force) can cause elevator movement at the time of autopilot disconnect.

• the red autopilot disconnect warning light illuminates,
• the red master warning light illuminates,
• the engine indication and crew alerting system computer displays an autopilot disconnect message, and
• a siren alert sounds.

767 Autothrottle Information

When the autothrottle function is engaged, it controls throttle lever movement. The maximum autothrottle commanded throttle lever movement rate for a normally functioning autothrottle system is 10.5° per second. Manual throttle lever inputs can exceed this rate; for example, the accident airplane's FDR recorded throttle lever movement at a rate of 25° per second at the beginning of the accident sequence. The minimum throttle lever position that the autothrottle can command varies as a function of the airplane's speed and the autothrottle mode selected. For the accident airplane's flight conditions and the selected autothrottle mode at the beginning of the accident sequence, this position would have been 40° to 50°. The FDR recorded a throttle lever position of about 33° at the beginning of the accident sequence.

Reported Autopilot Anomalies in the Accident Airplane

Examination of the FDR data for the October 30th flight to LAX revealed that at the time the captain reported he disconnected the autopilot because it was "hunting" for the glideslope during the approach to LAX, the autopilot was operating in its LOC (localizer approach) mode, which does not have glideslope intercept capability. The FDR data indicated that, later in the approach to LAX, when the captain tried to reengage the autopilot using the APP (approach) mode, which has both localizer and glideslope intercept capability, the airplane had descended far enough below the glideslope that the autopilot system could not capture the glideslope signal.³⁷

The Safety Board's review of the FDR data revealed that nine autopilot disconnects were recorded on the accident airplane's 25-hour-long FDR tape: one just before landing at Cairo the day before the accident; one just before its next landing at EWR; four during the approach to LAX (during which the reported autopilot difficulties occurred); one on the ground at LAX; one just before landing at JFK the night of the accident flight; and one immediately preceding the accident sequence. No elevator movement was recorded after the autopilot disconnect that occurred on the ground at LAX. The elevator movements recorded following the other eight autopilot disconnects were primarily in the trailing-edge-down (TED) direction and were less than 0.88° in magnitude. According to Boeing, the elevator movements recorded by the accident airplane's FDR were consistent with the movements that would be expected as a result of the normal operation of the autopilot on a properly rigged 767.

Accident Airplane Maintenance Information

FAA Service Difficulty Reports (SDR)³⁸ and accident and incident data from all operators flying 767s between 1990 and 2000 were also reviewed by investigators. Although some elevator-related SDRs were noted,³⁹ there were no documented maintenance trends or anomalies that were relevant to the circumstances of this accident.

767 Bellcrank Anomalies

Boeing and the FAA conducted additional tests and research to further investigate why the rivets failed and what the possible repercussions of such a failure would be, including metallurgical examination of high-time bellcranks, material properties testing on old and new bellcranks, review of bellcrank failure rate data obtained from 767 operators, and examination of maintenance procedures to determine whether changes in procedures and/or intervals were warranted. The Safety Board monitored the FAA's and Boeing's tests and research into the bellcrank shear rivet failures.

The research conducted by Boeing and the FAA revealed that single bellcrank shear rivet failures had occurred on other 767s, some of which might not have been detected during the single hydraulic system maintenance check that is to be conducted by 767 operators every 400 flight hours.⁴² On August 17, 2000, Boeing issued Service Bulletin 767-27A0166, which described methods by which failed bellcrank shear rivets that might not be detected during the single hydraulic system maintenance check could be identified. Subsequently, the FAA issued AD 00-17-05, effective September 11, 2000, which required all 767 operators to perform a one-time functional check of one shear rivet in all six elevator PCA bellcrank assemblies within 30 days, reworking or replacing the bellcrank assembly if needed. AD 00-17-05 indicates the following:

[F]ailure of two [of the three] bellcrank assemblies on one side can result in that single elevator surface [but not both surfaces] moving to a hardover position independent of pilot command resulting in a significant pitch upset recoverable by the crew. Failure of [all] three bellcrank assemblies on one side can cause an elevator hardover that may result in loss of controllability of the airplane...the FAA has received no factual information that indicates that this incident is related to [the EgyptAir flight 990] accident....The cause of that accident is still under investigation.

One of the mechanical failure conditions evaluated by the Safety Board during the EgyptAir flight 990 investigation involved disconnection of the input linkages to two of the three PCAs on one elevator surface. This failure condition could be caused by the failure of any of the components that comprise the elevator PCAs' input linkage systems, including the bellcranks. As further discussed in the section titled, "Potential Causes for Elevator Movements During the Accident Sequence," the Board's tests and simulations indicated that the nonfailed elevator and the airplane are controllable from either control column with a dual PCA disconnect on one elevator surface. Those tests showed that neither a dual disconnection nor a triple disconnection (such as would result from a triple bellcrank failure) on one elevator surface would produce elevator deflections that matched the FDR data from the accident sequence.

METEOROLOGICAL INFORMATION

FLIGHT RECORDERS

Cockpit Voice Recorder

The CVR recording started at 0119:13, as the flight was cleared for takeoff from runway 22R at JFK. As previously discussed, the cessation of the CVR recording at 0150:38.47 (shortly after the FDR recorded the airplane's loss of engine power) was consistent with the loss of electrical power to the recorder that occurred after the engines were shut off.

Two transcripts were prepared of the entire 31-minute 30-second recording, one in Arabic/English words and phrases exactly as spoken on the accident flight and the other with Arabic words translated to English. As stated previously, throughout the CVR transcript, the Cockpit Voice Recorder Group provided as direct a translation as possible, without attempting to interpret the words or the intent of the speaker. According to participants in the Cockpit Voice Recorder Group (which included several Arabic/English speakers), occasionally the direct translation of Arabic words into English resulted in awkward or seemingly inappropriate phrases.

Cockpit Voice Recorder Sound Spectrum and Speech Studies

Audio Information Recorded by First Officer's Hot Microphone

The study concluded that the recording quality of the first officer's hot microphone was excellent while the command first officer wore the headset/microphone and poor when the headset/microphone was believed to be stowed.⁴⁸ After 0150:24, the first officer's hot microphone stopped recording cockpit conversation and started recording a sudden increase in background noise. The speech evaluation study indicated that this most likely occurred because a pilot inadvertently activated the air-to-ground/interphone button on the back of the control wheel and thereby altered the amplitude of the recording to the amplitude level set at the individual pilot position.

Speech Sample Information

All utterances made after the captain departed the cockpit (at 0148:18) were analyzed to the extent possible; however, in part because of occasional loud background noise in the cockpit after that time, only 15 of the 23 utterances recorded by the CAM after such time were strong enough (relative to background noise) to be analyzed by computer for fundamental frequency (pitch) and formant dispersion⁴⁹ information.

Fundamental Frequency and Speech Duration Information

• An increase in fundamental frequency of about 30 percent (compared with that individual's speech in a relaxed condition) would be characteristic of a stage 1 level of stress, which could result in the speaker's focused attention and improved performance.
• An increase in fundamental frequency of between 50 to 150 percent would be characteristic of a stage 2 level of stress, which could result in the speaker's performance becoming hasty and abbreviated; however, the speaker's performance would not display gross mistakes.
• An increase in fundamental frequency of between 100 to 200 percent would be characteristic of a stage 3 level of stress, or panic, which could result in the speaker's inability to think or function logically or productively.

Previous research has also shown that speech duration often becomes shorter (that is, speaking rate becomes faster) when psychological stress increases. Speech duration measurements were performed on the phrase "I rely on God" (repeated by the relief first officer 11 times between 0148:39 and 0150:08). The CVR transcript indicated that the first utterance of the phrase "I rely on God" was spoken faintly, about 1 minute 6 seconds before the autopilot was disconnected, and had a duration of 1.02 seconds. The second utterance of this phrase, which occurred about 5 seconds before the throttle levers were moved to idle and while the airplane was still in level flight, had a duration of 0.81 second. The remaining nine utterances of this phrase, which began about 8 seconds later (as the airplane began its abrupt nose-down pitch and steep descent), varied in duration from 0.73 to 0.87 seconds, with pauses of 0.51 and 0.70 seconds between successive utterances. According to the speech study, the relief first officer's rate of speech did not increase significantly when saying, "I rely on God," during the pitchdown and descent.

The Safety Board also examined the length of time between the relief first officer's "I rely on God" statements for evidence of psychological stress. About 67 seconds passed between the first and second utterances of the phrase, 8.1 seconds passed between the second and third, and 0.51 to 0.70 seconds passed between subsequent utterances of the phrase. According to the speech study, after the second utterance, the data suggested a "rhythmic repetition of the phrase rather than an accelerating trend, as might be expected with increased psychological stress."

The speech study concluded that, although the relief first officer's speech displayed some evidence of increased psychological stress between the first and second utterance of "I rely on God" (when the airplane was still in level flight at cruise altitude), there was no evidence of increased psychological stress in the relief first officer's speech after he uttered the phrase the second time. As previously discussed, after the second utterance of the phrase, the airplane departed level flight to a steep nose-down pitch attitude and experienced an increased nose-down pitch attitude and rate of descent and a decrease in its load factor (to negative Gs) while the relief first officer repeated, "I rely on God," the last nine times.

Unintelligible Comment

As previously discussed, and as noted as follows in the CVR transcript:

The five Arabic speaking members of the [CVR] group concur that they do not recognize this as an Arabic word, words, or phrase. The entire group agrees that three syllables are heard and the accent is on the second syllable. Four Arabic speaking group members believe that they heard words similar to 'control it.' One English speaking member believes that he heard a word similar to 'hydraulic.' The five other members believe that the word(s) were unintelligible.

Flight Data Recorder

Flight performance parameters recorded by the FDR included the following: pressure altitude; airspeed (computed); engine rpm; pitch; roll; heading; angle of attack; normal (vertical), longitudinal, and lateral acceleration (load factors); left and right elevator positions; left and right inboard and outboard aileron positions; left and right trailing edge flap positions; rudder position; and horizontal stabilizer position. In addition, the FDR recorded speedbrake handle position, throttle resolver angle, autopilot engagement/disengagement, engine low oil pressure, and engine fuel cut signals. The FDR was not required to and did not record control wheel, control column, or spoiler positions nor did it record control wheel and column forces.⁵³ Excerpts from the FDR data plots and CVR transcript are shown in figures 3a through 3h.

WRECKAGE INFORMATION

Sonar mapping of the wreckage site depicted two distinct underwater debris fields, which were identified by recovery personnel and investigators as the western and eastern debris fields. These debris fields were about 366 meters (1,200 feet) apart from center point to center point. The western debris field, which was estimated to be 62 meters by 66 meters and was centered about 40° 20' 57" north latitude, 69° 45' 40" west longitude, contained mainly parts associated with the left engine and various other small pieces of wreckage (including portions of two wing panels, fuselage skin, horizontal stabilizer skin, and the majority of the nose landing gear assembly). The eastern debris field, which was estimated to be 83 meters by 73 meters and was centered about 40° 20' 51" north latitude, 69° 45' 24" west longitude, contained the bulk of the airplane's fuselage, wings, empennage (including the outboard tips of the right and left elevators and all recovered elevator PCAs), right engine, main landing gear, and flight recorders. Many pieces of floating wreckage (including pieces of the right and left elevator surfaces)⁵⁴ were recovered from the water's surface in or near the eastern debris field shortly after the accident; specific recovery locations for some of these pieces were not noted. The small size of most of the recovered pieces of wreckage was consistent with the airplane impacting the water at a high speed. The locations of the two main wreckage debris fields were consistent with the accident airplane's flightpath, as indicated by the primary radar data.⁵⁵

The Safety Board leased a commercial vessel to recover the wreckage that had settled on the ocean floor. Pieces of wreckage were recovered from a depth of about 230 feet using a clamshell scoop and a crane, loaded (using a front loader) into containers on the recovery vessel, and moved to shore. Upon reaching shore, the containers of wreckage were lifted off the recovery vessel and rinsed thoroughly twice. The containers were then moved into the hangar at Quonset Point, Rhode Island, where they were tipped onto their sides. The wreckage was then moved out of the containers onto the floor using rakes and shovels. Once on the hangar floor, the wreckage was spread evenly by a front loader to assist the drying process. During this process, FBI and Safety Board investigators examined the recovered wreckage for evidence of fire or explosion damage. The FBI placed identification tags on some of the debris; accident investigators then documented all of the debris.

Four of the elevators' six PCAs (the center and outboard right elevator PCAs and two elevator PCAs whose positions could not be determined)⁵⁶ were recovered. Postaccident examination revealed that all four of the recovered PCAs exhibited impact-related damage. One of the four also exhibited the following two unusual characteristics on its internal mechanisms: (1) the pin that attaches the spring guide to the valve slide was sheared, and (2) a portion of the bias spring (about one full coil) was improperly positioned over the head portion of the spring guide. It could not be determined whether these conditions existed before impact or whether they were impact related. The Safety Board's measurements of these components indicated that the inside diameter of the servo valve cap into which the bias spring and spring guide fit was 0.872 inch and that the outside diameter of the spring guide at its widest point was 0.749 inch, leaving a clearance of 0.123 inch between the spring guide and the servo valve cap. Measurements indicated that the bias spring wire had a diameter of 0.031 inch. Impact marks and damage were observed on other components in this PCA; however, there was no evidence of scraping, abrasion, or other marks on the improperly positioned bias spring or adjacent surfaces that would indicate that these metal parts had jammed in the PCA.⁵⁷

Five of the elevators' six bellcranks (all three right elevator and two of the left elevator bellcrank assemblies) were recovered. Postaccident examination of the recovered bellcrank assemblies revealed that all of the shear rivets in the recovered bellcrank assemblies were sheared,⁵⁸ with the sheared surfaces appearing consistent with shear overstress. However, the rivets in some of the bellcrank assemblies sheared in a direction opposite to others; shear rivets in the two recovered bellcrank assemblies from the left elevator surface and in the inboard bellcrank assembly from the right elevator surface were sheared as if the bellcrank arms were moving to a higher relative angle, whereas the shear rivets in the middle and outboard bellcrank assemblies from the right elevator surface were sheared as if the bellcrank arms were moving to a lower relative angle. Most of the recovered elevator control linkages were found broken or otherwise damaged.

Examination of the fracture surfaces on the recovered pieces of wreckage revealed that the fractures were consistent with failures generated by a high-speed impact. None of the fracture surfaces examined exhibited any sign of preexisting fatigue or corrosion. No evidence of foreign object impact damage or pre- or postimpact explosion or fire damage was observed.⁵⁹

Examination of the left engine (which was recovered relatively intact) revealed evidence of little, if any, rotation at the time of impact. The right engine was severely broken up, and only about 80 percent of it was recovered. Examination of the recovered portions of the right engine showed evidence of little, if any, rotation at the time of impact. The observed deformations on the right engine were consistent with a steep impact angle, whereas observed deformations on the left engine were consistent with an inverted, slightly aft-end-down impact angle. Although the recovery location of and damage to the left engine were consistent with it separating from the airplane before impact, no evidence of any preimpact catastrophic damage or fire was observed on either engine.⁶⁰

TESTS AND RESEARCH

Review of Radar Data

No secondary radar returns were received from EgyptAir flight 990 after 0150:36 (about the time the CVR and FDR stopped recording); however, after this time, several radar sites recorded primary radar returns that continued along the accident airplane's extended flightpath from its last recorded radar position. As previously discussed, these primary radar data (with extrapolated FDR data and simulation results) indicated that after the airplane's FDR and CVR stopped recording, the airplane descended to an altitude of about 16,000 feet msl, then climbed to about 25,000 feet msl and changed heading from 80º to 140º before it began its second descent, which continued until it impacted the ocean.⁶¹

Accident Sequence Study

• Aside from the very slight movement of both elevators (the left elevator moved from a 0.7° to about a 0.5° nose-up deflection, and the right elevator moved from a 0.35° nose-up deflection to about a 0.3° nose-down deflection)⁶² and the airplane's corresponding slight nose-down pitch change, which were recorded within the first second after autopilot disconnect at 0149:45, and a very slow (0.5º per second) left roll rate, the airplane remained essentially in level flight about FL 330 for about 8 seconds after the autopilot was disconnected.
• At 0149:53, the left and right throttles were retarded to the aft idle stop (equivalent to a throttle lever angle of about 33º) at a rate of about 25º per second.⁶³ About 1 second after the start of the throttle movement, the FDR recorded slight motion in the inboard ailerons, the left elevator surface moved to about a 3.4º TED position, and the right elevator surface moved to about a 3.8º TED position.⁶⁴
• At 0149:54, the airplane began to pitch nose down, reaching a pitch attitude of about 40º nose down at 0150:15. During the dive, the wings remained within about 10º of level and the heading remained about 80º, increasing to about 85º between 0150:20 and 0150:33.
• Between 0150:05 and 0150:06, the FDR recorded additional movements in the inboard ailerons, and the left and right elevators moved an additional 1.5º TED to about 5.5º TED. Before this time, the load factor had been about 0.2 G; after this time, the load factor decreased to about -0.1 G. Between 0150:06 and 0150:10, the FDR began to record "Low Engine Oil Pressure" signals for both engines; the FDR recorded these signals until after the load factor increased to above 0 G between 0150:17 and 0150:21.⁶⁵
• At 0150:08, as the airplane passed through about 30,800 feet msl, the airplane exceeded its maximum operating airspeed (0.86 Mach), and the Master Warning alarm sounded. The maximum rate of descent recorded during the dive was about 39,000 fpm at 0150:19, as the airplane descended through about 24,600 feet msl. At 0150:23, the airspeed reached its peak calculated value of 0.99 Mach, as the airplane descended through about 22,200 feet msl.
• At 0150:15 and about 27,300 feet msl, the left and right elevator surfaces started to move slowly (about 0.6º per second) in the trailing-edge-up (TEU) direction, back toward their neutral position. The pitch angle, angle of attack, and load factor also started to increase at this point, so that when the FDR recorded the last data for the accident flight at 0150:36.64, the pitch angle had increased to about 8º nose down, and the airplane was experiencing about 2.4 Gs.
• Between 0150:18 and 0150:27, the FDR recorded TEU movements of the left and right outboard ailerons and the left inboard aileron.⁶⁶
• At 0150:21, the left and right elevator surfaces started to split (that is, to move asymmetrically). The right elevator surface started to move TED, whereas the left elevator surface moved TEU. This split between the left and right elevator surface positions continued to the end of the FDR data, varying in magnitude but averaging about 4º difference between the surfaces (see figure 2).
• Between 0150:21 and 0150:23, the engine start lever switches for both engines moved from the run to the cutoff position.
• Between 0150:24 and 0150:25, both throttle handles moved full forward.
• Between 0150:25 and 0150:26, the speedbrake handle moved to its fully deployed position. Coincident with this activity, between 0150:24 and 0150:27, the left elevator surface moved briefly in the TED direction (from 3º TEU to 1º TEU) before it returned to 3º TEU.
• Almost immediately after the speedbrakes were deployed at 0150:26, the left elevator surface deflection increased further, reaching its maximum deflection of more than 3.8º nose up about 0150:30.⁶⁷ After 0150:30, the left elevator's nose-up deflection gradually reduced, until the data for that parameter ended at 0150:36 with a left elevator deflection of about 2.3º nose up.
• Between 0150:21 and 0150:24, the right elevator surface's nose-down deflection increased gradually, then increased rapidly until just after 0150:25, when the nose-down deflection briefly reduced from about 2.35º to about 1.9º nose down. Between 0150:21 and 0150:23, the engine start levers moved to the cutoff position. At 0150:26, the right elevator's nose-down deflection began to increase again, reaching its maximum nose-down deflection of about 3.2º at 0150:29. Subsequently, the right elevator's deflection moved generally toward a nose-up position, with occasional movements in a nose-down direction; when the FDR data ended, the right elevator deflection was 0.2º nose down.
• Between 0150:27 and 0150:32, the FDR recorded a split condition in the outboard ailerons (the left outboard aileron maintained its approximate presplit deflection, while the right outboard aileron began to move in a TED direction).⁶⁸ The outboard ailerons had been moving in a TEU direction since 0150:18.
• During the elevator split, the larger movements of the left and right elevators individually corresponded with changes in the load factor (see figure 4). For example, between 0150:30 and 0150:36, the recorded movements of the right elevator (lower graph) are reflected in the load factor profile (upper graph).
• No secondary radar returns were received from the accident airplane after the last data were recorded by the FDR at 0150:36.64.
• Performance calculations based on primary radar returns indicated that the airplane's rapid descent stopped at an altitude of about 16,000 feet msl. The primary radar returns indicated that the airplane then began to climb, reaching about 25,000 feet msl about 0151:15. During this climb, the airplane's heading changed from about 80º to about 140º.
• After 0151:15, the data indicated that the airplane began a second rapid descent that continued until it impacted the ocean.

Potential Causes for Elevator Movements During the Accident Sequence

The Systems Group reviewed numerous potential failure scenarios to evaluate whether any of them might have been capable of causing the elevator surface movements recorded on the FDR during the accident sequence, including failures associated with the elevator system's flight control cables,⁷¹ failures associated with elevator surface PCAs,⁷² and other system-related failures.⁷³ On the basis of the results of failure modes and effects analyses, the Safety Board ruled out all but four of these potential failure scenarios because they failed to reflect the accident flight's elevator movements in obvious and significant ways.⁷⁴ For example, it was determined that neither an autopilot malfunction nor EMI⁷⁵ would have caused any elevator movements during the accident sequence.⁷⁶ Although some of the other scenarios could have caused some elevator movements, the nature and degree of those movements differed so greatly from the elevator movements recorded during the accident flight that they did not warrant further consideration.

However, the failure modes and effects analyses showed that the following four elevator failure scenarios (each of which involves two failures) warranted further study because they could potentially cause nose-down elevator movements or a split elevator condition that might resemble some portions of the data recorded on the accident flight's FDR:

1. Disconnection of the input linkages to two of the three PCAs on the right elevator surface. This failure scenario could be caused by the failure of any of the components that comprise the actuator input linkage system, including the bellcranks.
2. A jam of the input linkages or servo valves in two of the three PCAs on the right elevator surface. In order for this failure scenario to occur, the internal slides of the affected servo valve would first have to be moved (by manual or autopilot input) to an offset position and then jam. Although such jams could theoretically occur in either direction, all tests and simulations involving jammed elevator PCAs were intentionally configured to produce nose-down (rather than nose-up) elevator input.
3. A jam of the input linkage or servo valve in one PCA and the disconnection of the input linkage to another PCA on the right elevator surface.
4. A jam in the elevator flight control cable connecting the right-side control column to the right aft quadrant assembly combined with a break in the same cable. (Four variants of this scenario were studied. For additional information, see the Systems Group Chairman's Factual Report and its addendum regarding the cable break/jam and PCA jam with high breakout force [compressible link] ground testing.)

1. Disconnection of the input linkages to two of the three PCAs on the right elevator surface.

   During the ground tests, the failed elevator surface was driven to its full nose-down position and would not respond to nose-up flight control inputs from either control column. A study of the elevator control system indicated that if this scenario occurred in flight, it would result in an initial deflection of the failed surface to a position consistent with a single functioning elevator PCA operating at 100 percent of its maximum force (as limited by aerodynamic blowdown forces); the failed elevator surface would resist being backdriven with a force equivalent to about 130 percent of a single functioning PCA.⁷⁷ Calculations showed that at 280 knots (the accident airplane's airspeed when the initial descent began), this position would initially have been about 6º nose-down elevator deflection, and the degree of deflection would be reduced as the airplane's speed increased above 290 knots. See figure 2 for additional elevator blowdown position information.⁷⁸

   During the ground tests, the nonfailed elevator surface remained in its prefailure position unless it received inputs from either control column. A study of the elevator control system's force balance and calculations of the effect of this failure under the conditions of the accident flight indicated that the nonfailed surface would remain in its prefailure position.

   During the ground tests, either control column could be used to control the nonfailed elevator surface and to command the full travel of that surface available at the existing flight condition. The Safety Board's study of the elevator control system indicated that under the accident flight conditions, inputs from either control column would have resulted in corresponding movement of the nonfailed elevator surface.
    
   

2. A jam of the input linkages or servo valves in two of the three PCAs on the right elevator surface.

During the ground tests, the failed elevator surface was driven to its full nose-down position and would not respond to nose-up flight control inputs from either control column. A study of the elevator control system indicated that if this scenario occurred in flight, it would result in an initial deflection of the failed surface to a position consistent with a single functioning elevator operating at 100 percent of its maximum force (as limited by aerodynamic blowdown forces); the failed elevator surface would resist being backdriven with a force equivalent to about 130 percent of a single functioning PCA. As discussed in connection with the previous failure scenario, calculations showed that, under the conditions of the accident flight, this position would initially have been about 6º nose-down elevator deflection, and the degree of deflection would be reduced as the airplane's speed increased above 290 knots.

During the ground tests, the nonfailed elevator surface moved to about 4º nose-down deflection in the same direction as the failed surface. A study of the elevator control system's force balance and calculations of the effect of this failure under the conditions of the accident flight indicated that the nonfailed surface would move to a position corresponding to 30 lbs of feel force.⁷⁹ Calculations showed that under the conditions of the accident flight when the initial descent began, the degree of deflection for the nonfailed surface would be the same as during the ground tests (about 4º).

During the ground tests, either control column could be used to control the nonfailed elevator surface and to command that surface in either the nose-up or the nose-down direction.⁸⁰ The Safety Board's study of the elevator control system indicated that under the accident flight conditions, inputs from either control column would have resulted in corresponding movement of the nonfailed elevator surface.
 


3. A jam of the input linkage or servo valve in one PCA and the disconnection of the input linkage to another PCA on the right elevator surface.

During the ground tests, the failed elevator surface was driven to its full nose-down position and would not respond to nose-up flight control inputs from either control column. A study of the elevator control system indicated that if this scenario occurred in flight, it would result in an initial deflection of the failed surface to a position consistent with a single functioning elevator operating at 100 percent of its maximum force (as limited by aerodynamic blowdown forces); the failed elevator surface would resist being backdriven with a force equivalent to about 130 percent of a single functioning PCA. As discussed in connection with the previous failure scenarios, calculations showed that, under the conditions of the accident flight, this position would initially have been about 6º nose-down elevator deflection, and the degree of deflection would be reduced as the airplane's speed increased above 290 knots.

During the ground tests, the nonfailed elevator surface moved to about 2.1º nose-down deflection in the same direction as the failed surface. A study of the elevator control system's force balance and calculations of the effect of this failure under the conditions of the accident flight indicated that the nonfailed surface would move to a position corresponding to 15 lbs of feel force. Calculations showed that under the conditions of the accident flight when the initial descent began, the degree of deflection for the nonfailed surface would be the same as during the ground tests (about 2.1º).

During the ground tests, either control column could be used to control the nonfailed elevator surface and to command that surface in either the nose-up or the nose-down direction. The Safety Board's study of the elevator control system indicated that under the accident flight conditions, inputs from either control column would have resulted in corresponding movement of the nonfailed elevator surface.
 


4. A jam in the elevator control cable connecting the right-side control column to the right aft quadrant assembly combined with a break in the same cable.

   During the ground tests, the left elevator surface moved to nose-down deflections of 1.2º to 3.9º and the right elevator surface moved to nose-down deflections of 1.4º to 5.0º, depending on the scenario tested. Analysis of the elevator system indicated that if such failures occurred in flight, the resultant elevator surface positions would not have varied as a result of changes in the aerodynamic forces acting on the elevator in the same manner as the previous three failures because all three PCAs would still be functioning properly.

   During the ground tests for all break/jam combinations, either control column could be used to control both elevator surfaces. Testing showed that a pull from either control column of 25 lbs would result in sufficient movement of both elevators in a nose-up direction to be evident on the FDR. A pull from either control column of 50 to 100 lbs would result in sufficient movement of both elevators in a nose-up direction to either reverse or significantly slow the airplane's nose-down dive.

Simulations of the three failure scenarios showed that it was possible to regain control of the airplane using either control column and return it to straight and level flight using normal piloting techniques and that the airplane could be trimmed to hands-off level flight after each of the three failure scenarios occurred.⁸² Further, for all three failure scenarios, full recovery was possible even when no efforts were made to recover the airplane until 20 seconds after the failure occurred. Although additional force beyond that required for recovery from a dive of this magnitude without a failure was necessary in all tested scenarios, the nonfailed surface responded immediately to nose-up inputs and recovery could be accomplished by a single pilot using either the left or right control column. Although the recovery was easier and the required control column force was reduced when stabilizer trim was used, it was not necessary to use stabilizer trim to recover from any of the three failure scenarios. Further, the simulations also demonstrated that the engines could have been restarted throughout most (if not all) of the recovery from the dive and/or the subsequent climb and that the airplane could have been returned to straight and level flight after the recorders stopped recording. The elevator deflections resulting from the fourth scenario were less extreme, and would therefore be easier to recover from, than those resulting from the first three failure scenarios.
 

Additional Information

Submissions

EgyptAir's April 28, 2000, Presentation

• The suicide scenario is not consistent with data and facts of [the EgyptAir flight 990] accident.
• [Left and right] elevator deflection as a result of right elevator dual PCA jam is consistent with the FDR data where Boeing data is valid.
• In the area beyond the airplane normal design envelope where the data is not valid, all the flight control behavior is uncertain, control surfaces are subject to flutter.
• The right elevator middle and outboard bellcrank rivets shear direction is consistent with a jammed PCA reacting against pilot input to move the elevator up.
• Analysis revealed that there are a lot of [radar] returns forming continuous paths crossing the flightpath of [EgyptAir flight 990], which may reflect deliberate [evasive] action by one of the pilots.

EgyptAir's August 11, 2000, Submission

EgyptAir also argued in its submission that the relief first officer did not deliberately cause the accident. According to the submission, "the deliberate act theory was based, in large part, on the initial inaccurate translation of an expression repeated several times by the [relief] first officer...[which] has been eliminated not only by credible evidence and analysis but also by accurate translation of the CVR." EgyptAir further stated that (1) the relief first officer had no motive to kill himself or others aboard EgyptAir flight 990; (2) the relief first officer did not use his seniority to insist that he be allowed to fly the airplane; (3) the relief first officer may not have been alone in the cockpit at the onset of the dive; and (4) the captain returned to the cockpit almost immediately after the dive started, and there was no indication of a struggle or disagreement between the two flight crewmembers. EgyptAir further stated that "the cockpit conversations showed an effort at teamwork rather than a crew working at cross purposes." Further, EgyptAir indicated that several of the relief first officer's actions were not consistent with a deliberate attempt to crash the airplane. For example, it stated that the cockpit door was not closed and locked; the throttle levers were moved to idle, whereas engine power would have accelerated the descent; and more radical flight control inputs were available (more nose-down elevator deflection or aileron and rudder with elevator deflections) but not used.

EgyptAir also contended in its submission that at least three flight crewmembers were in the cockpit during the descent, as evidenced "by the fact that if either the captain or [relief] first officer had let go of their control columns to shut the engines or to deploy the speedbrake...the aircraft would have pitched down at the same time." The EgyptAir submission further stated that the split elevators "do not support the conclusion that there was a struggle in the cockpit" because (1) the CVR provides no indication of a struggle, argument, or refusal to follow a command; (2) the FDR recorded control surface positions but did not record the control column position or forces--"accordingly, one cannot conclude from examining only the FDR data that pilot input to his control column caused the elevators to be in a given position"; and (3) "at the same moment the elevators split, both outboard ailerons moved upward...when this unusual aileron movement occurred during the dive, the aircraft's speed was approaching Mach 1.0, and no published performance data is available to predict what will occur to ailerons at these high speeds. It is likely, however, that aerodynamic shocks or flutter were occurring at the control surfaces."

In its submission, EgyptAir summarized its position as follows:

• Accordingly, from an impartial review of the factual evidence gathered during the investigation, it is clear that the [relief] first officer did not intentionally dive the aircraft into the ocean.
• At this point in the investigation considering the factual evidence gathered, it is clear that the first officer did not commit suicide. Further investigation of the elevator control system's design in conjunction with the other factual information available is necessary before a conclusion can be reached regarding the true cause of this accident. Specifically, further engineering analysis, including wind tunnel tests, is necessary to examine the dual actuator malfunction in the speed ranges for which current data is not available. In addition, further investigation of radar data is also necessary to completely rule out the possibility of conflicting traffic. Until this work is accomplished, the cause of this accident cannot be truly established.
• An analysis of the facts and of the elevator control system's design indicates that malfunctions in two PCAs on the right elevator may have precipitated the airplane's dive. This dual PCA malfunction may have consisted of a latent or nearly latent failure in one PCA that may have existed for a period of time followed by a jam of a second PCA shortly before the dive.
• The facts do not support the initial, and widely reported, theory that the [relief] first officer deliberately dove the plane toward the ocean.
• Without further information concerning the data from military and FAA radar, one cannot rule out the possibility that the [relief] first officer may have been attempting to avoid or maneuver the aircraft out of a perceived dangerous situation at the time the dive occurred.

Boeing's Submission

Boeing also considered several operational scenarios, including collision avoidance, rapid descents, response to engine oil pressure lights, and loss of thrust on both engines. Boeing's submission stated that, "EgyptAir 990 crew actions were determined to be inconsistent with the performance of standard Boeing recommended operating procedures and training for the 767 airplane."

In its submission, Boeing summarized its position as follows:

• Flight control surface movements recorded on the [FDR] are capable of generating the airplane flight path recorded by the [FDR] and radar.
• Based on the examination of the recovered wreckage, Boeing did not find any evidence of a failure condition within the airplane flight control system that could have caused or contributed to the initial pitchover, or prevented recovery from the dive.
• Boeing participated in examining all potential failure conditions developed during the investigation and could not find a failure condition that: (1) matched the data recorded by the [FDR] or (2) resulted in a condition that was not recoverable by the pilot.
• Therefore, Boeing does not believe that the loss of EgyptAir 990 was the result of a mechanical failure of the aircraft or aircraft systems.

EgyptAir's January 12, 2001, Response to Boeing's Submission

Additionally, EgyptAir's response to Boeing's submission indicated that there was evidence of a mechanical malfunction of the elevator system; specifically, EgyptAir cited the reported autopilot difficulties during an approach to LAX the day before the accident and the downward elevator deflections recorded by the FDR at autopilot disconnect. EgyptAir stated the following:

[This evidence] shows that an anomaly existed in the flight 990 elevator system even before the aircraft left New York for Cairo on October 31, 1999--a latent defect that could not be detected by the crew. In light of these facts, it is plausible to believe that--just as [the captain of the flight into LAX] had done a day earlier--the [relief] first officer on flight 990 disconnected the autopilot after observing some unusual movement of the column.

Further, in its response to Boeing's submission, EgyptAir reiterated its position that its analysis of the elevator's motions⁸⁵ indicated that the elevator split observed in the FDR data was not the result of a struggle between the captain and the relief first officer. The response stated that the split "may [have been] the result of the loss of the right elevator." To support this statement, EgyptAir asserted that (1) there was no indication on the CVR transcript that a struggle occurred in the cockpit; (2) the uncommanded elevator positions might have resulted from unique aerodynamic phenomena as the airplane's speed increased; (3) when an FDR records elevator position, it is actually recording the sensor position, which does not, by itself, indicate the position of the elevator or the control column; and (4) the pitch and roll motions recorded during the last 15 seconds of FDR operation were "much closer to the expected aircraft performance if the right elevator is missing."

EgyptAir's response to Boeing's submission also stated the following:

EgyptAir has determined that the FDR flight profile after the split is consistent with the expected aircraft performance only if the right elevator has departed the airplane....this conclusion is based upon the absence of expected rolling moment that would have been induced by a differential deflection of the elevators...shown on the FDR.

• Boeing's engineering simulator did not provide an accurate model of real aircraft performance.
• Boeing often ignored the more reliable ground test results.
• Boeing's selective use of test data resulted in inconsistent conclusions.
• Boeing's conclusions regarding crew actions are erroneous.

• Boeing's submission to the NTSB [National Transportation Safety Board] dated October 31, 2000, contains many inaccuracies, omissions, and the selective use of evidence.
• Boeing's own ground test and simulator data does not support its conclusion that FDR data is inconsistent with a dual jam scenario.
• A dual PCA control valve failure on the right elevator is consistent with the EgyptAir flight 990 FDR data.
• There is physical evidence consistent with a malfunction in the elevator control system which might be a plausible cause for the accident.

P&W's Submission

ANALYSIS

General

The accident airplane was properly certificated and was equipped, maintained, and dispatched in accordance with applicable regulations and industry practices.

The Safety Board's review of air traffic control (ATC) information revealed no evidence of any ATC problems or issues related to the accident. Further, examination of the recovered airplane wreckage and cockpit voice recorder (CVR), flight data recorder (FDR), ATC, weather, and radar data revealed no evidence that an encounter with other air traffic or any other airborne object was involved in the accident or that weather was a factor in the accident.

Examination of the wreckage revealed no evidence of preexisting fatigue, corrosion, or mechanical damage that could have contributed to the airplane's initial pitchover.⁸⁶ (The condition of the recovered elevator power control actuators (PCA) and bellcrank shear rivets is discussed in the next section titled, "Mechanical Failure/Anomaly Scenarios.") No evidence of explosion or fire damage or foreign object impact damage was found.

Additionally, the Safety Board's examination of the accident airplane's maintenance records revealed no evidence of any mechanical problems that could have played a role in the accident sequence. Although during interviews conducted at the request of the Egyptian Government more than 1 year after the accident an EgyptAir 767 captain reported that he had experienced autopilot difficulties in the accident airplane during the approach to Los Angeles International Airport (LAX), Los Angeles, California, the day before the accident, these difficulties were likely the result of improper autopilot approach mode selection. Additionally, as previously noted, neither the captain nor the first officer of the flight to LAX reported any autopilot anomalies in the airplane's maintenance logbooks, and the first officer of that flight did not mention any autopilot difficulties during interviews conducted 3 days after the accident. Although the captain reported several minor anomalies during these interviews (including an autopilot anomaly), he told investigators that the airplane was "almost perfect." No autopilot difficulties were reported by the flight crew that flew the airplane from LAX to John F. Kennedy International Airport (JFK), New York, New York, immediately before the accident flight nor did they report any autopilot anomalies in the airplane's maintenance logbooks. Further, the Board's examination of the FDR data before and after all recorded autopilot disconnects in the 25 hours of data recorded by the FDR (including the accident flight) revealed no evidence of abnormal autopilot or elevator surface behavior.

The Safety Board's review of ATC, FDR, CVR, and radar information indicated that the airplane's movements during the accident flight were routine until about 0149:54 (9 seconds after the autopilot disconnect occurred), when an abrupt sustained nose-down elevator motion occurred. A review of the FDR data indicated that the accident airplane's pitch motion before and during the accident sequence was consistent with the elevators' recorded movements. Boeing's full-flight engineering simulator was used to evaluate the consistency of the elevator positions with the pitch motions recorded on the FDR. During these evaluations, the elevator movements required to make the simulator duplicate the pitch motions recorded by the accident airplane's FDR and the flightpath developed from the available data closely matched the elevator movements recorded by the FDR. Further, the recorded load factors were consistent with the recorded movements of both elevator surfaces throughout the recorded data, even during the time that the data indicated a split between the left and right elevator surfaces (see figure 4).⁸⁷

The results of the Safety Board's examination of CVR, FDR, radar, airplane maintenance history, wreckage, trajectory study, and debris field information were not consistent with any portion of the airplane (including any part of the longitudinal flight controls) separating throughout the initial dive and subsequent climb to about 25,000 feet mean sea level (msl). It is apparent that the left engine and some small pieces of wreckage separated from the airplane at some point before water impact because they were located in the western debris field about 1,200 feet from the eastern debris field. Although no radar or FDR data indicated exactly when (at what altitude) the separation occurred, on the basis of aerodynamic evidence and the proximity of the two debris fields, it is apparent that the airplane remained intact until sometime during its final descent. Further, it is apparent that while the recorders were operating, both elevator surfaces were intact, attached to the airplane, and placed in the positions recorded by the FDR data and that the elevator movements were driving the airplane pitch motion, and all associated recorded parameters changed accordingly.

Mechanical Failure/Anomaly Scenarios

As previously mentioned, one of the recovered PCAs was found with a pin (that attached the spring guide to the servo valve slide) sheared and one coil of the bias spring improperly positioned over the head portion of the spring guide. However, there were no marks on any of the surfaces or any deformation of the spring coil to suggest that the spring coil had become jammed between the servo cap and the spring guide, as would be expected if such a jam had occurred.⁹³ Moreover, investigators measured the clearances between these components and determined that those clearances were large enough that even if a coil of the bias spring had become misplaced between the spring guide and the servo valve cap, no jam would have resulted.⁹⁴ Further, the FDR data preceding the accident sequence do not show any evidence of a single jammed PCA.⁹⁵

Most of the recovered elevator control linkages were broken; however, this type of damage is typical following a high-speed water impact and underwater wreckage recovery operations. The shear rivets in the recovered elevator bellcrank assemblies were sheared in different directions; however, the Safety Board considers it likely that the rivets sheared as a result of impact or recovery-related forces. Nonetheless, on the basis of the examination of the structure alone, the absence or presence of a jammed or disconnected input linkage or a jam in the servo valve in one of the accident airplane's elevator PCAs could not be established.

However, ground tests, studies, and calculations showed that each of the first three failure scenarios would have resulted in airplane and flight control movements that were inconsistent with the accident airplane's elevator movements. Specifically, each of those three failure scenarios would have caused the failed elevator surface to move to, and remain at, a position consistent with a single functioning PCA operating at 100 percent of its maximum force. The failed elevator surface would resist being backdriven with a force equivalent to about 130 percent of a single functioning PCA and would not have responded to nose-up flight control inputs. If one of these scenarios occurred at the accident airplane's indicated airspeed at the time of the initial dive (280 knots), the failed elevator surface would have initially moved from its prefailure position (close to neutral) to about a 6º nose-down position.⁹⁶ However, the initial elevator movement (for both elevator surfaces) on the accident airplane recorded during the accident sequence was to a nose-down position of only about 3.6°.⁹⁷

The Safety Board also compared the recorded elevator movements following the initial upset to elevator movements resulting from the first three failure scenarios. As the airplane's speed increased after the initial upset, the maximum deflection value associated with the three failure scenarios would have decreased in response to the increased aerodynamic forces on that surface. However, subsequent movements of both elevator surfaces on the accident airplane deviated repeatedly, for sustained periods of time in both the nose-up and nose-down directions,⁹⁸ from the maximum deflection values that the failure scenarios would have produced, at times exceeding the maximum deflection values by several degrees. As shown in figure 2, the elevator movement profile from the accident flight differs significantly throughout the accident sequence from the elevator movement profile that would have resulted from any of these three failure scenarios,⁹⁹ indicating that neither elevator surface on the accident airplane was limited by a mechanical failure but, rather, that both surfaces were responding normally to flight control inputs. Therefore, the first three failure scenarios are inconsistent with the elevator movements recorded after the initial upset.

Similarly, the elevator movements that would have followed any variant of the fourth failure scenario are also inconsistent with the accident airplane's recorded elevator movements after the initial upset. The Safety Board notes that, in one of the four variations of this scenario (a jam in the aft portion of the elevator control cable combined with a cable break forward of the jam), the initial elevator positions match those on the accident airplane. However, this similarity between the failure scenario and the accident airplane's elevator movements lasts only a few seconds. For the remainder of that variation of the scenario (and for the entire duration of the other three variations of this failure scenario), the elevator positions are inconsistent with those of the accident airplane.

In addition, if one of the first three failure scenarios had occurred, the nonfailed surface would have responded immediately to any nose-up flight control inputs from either control column and would have resulted in an increase in the magnitude of the difference between the two elevator surface positions (because the failed surface would remain at its failure-induced position). If the fourth failure scenario had occurred, both elevator surfaces would have responded immediately to nose-up inputs from either control column. However, the FDR data from the accident flight showed that there was no significant nose-up elevator movement or difference between the two elevator surface positions for the first 28 seconds of the accident sequence--until the captain returned to the cockpit.¹⁰⁰ If a failure had actually occurred, this would indicate that no attempts were made to recover the airplane for the first 28 seconds after the initial pitchdown. Further, after the captain returned to the cockpit, both elevator surfaces began moving together in the nose-up direction, indicating that neither surface was limited by a mechanical failure but, rather, that both surfaces were responding normally to flight control inputs. Similarly, later in the accident sequence, when the elevator split occurred, the right elevator deflected well beyond the maximum position possible for a failed elevator surface in any of the first three failure scenarios. However, the elevator movements during the split are well within the limits of a pilot-commanded movement.

After reviewing all of the inconsistencies between the effects of the four potential failure scenarios evaluated in depth, the actual behavior of the airplane, and the controllability of the airplane in the event of such failures, the Safety Board determined that none of these failure scenarios occurred during the accident sequence.¹⁰¹ Therefore, these four failure scenarios can be ruled out along with all of the other potential failure scenarios considered during this investigation.

The Safety Board also conducted simulations in which pilots from Boeing, EgyptAir, the Federal Aviation Administration (FAA), and the Board evaluated the controllability of the airplane following an initial upset that might have been caused by any of these failure scenarios. During these simulations, the pilots were consistently able to regain control of the airplane and return it to straight and level flight using normal piloting techniques, and the airplane could be trimmed to hands-off level flight. In fact, the 767's redundant actuation system is designed to allow pilots to overcome dual failures such as these.

Even though increased control forces were necessary, recovery could be accomplished by a single pilot using either the left or right control column.¹⁰² Further, the simulations also demonstrated that the airplane could climb to about 25,000 feet msl with the engines shut down, even with the speedbrakes extended. The simulation also documented that the engines could have been promptly restarted and (assuming there were no opposing pilot inputs) that the airplane could have been recovered during the climb after the recorders stopped recording. Although the Safety Board recognizes that the simulator did not duplicate the accident airplane's actual flight conditions in every way,¹⁰³ such limitations are not uncommon in simulations, and the Board takes those limitations into account when evaluating simulator results. In this case, the Board determined that the differences were not significant and did not affect the validity of the results of the simulations.

Immediately after the airplane's initial nose-down dive, the relief first officer would have felt an immediate uncomfortable sensation as the airplane's load factor decreased to near 0 Gs. He should also have noted sudden changes in the airplane's pitch attitude, pitch rate, airspeed, and altitude. In response to these obvious cues, the relief first officer did not attempt to counter the dive by commanding nose-up elevator, a largely intuitive pilot response to initiate a recovery.

Nor did the relief first officer exhibit any audible expression of anxiety or surprise or call for help during the airplane's initial dive or at any time during the remainder of the recorded por