Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-00-044
Details
Synopsis: ON 2/9/98, A BOEING 727, REGISTRATION NO. N845AA, OPERATING AS AMERICAN AIRLINES FLIGHT 1340, CRASHED SHORT OF THE RUNWAY WHILE ON A COUPLED INSTRUMENT LANDING SYSTEM (ILS) CATEGORY II APPROACH TO RUNWAY 14R AT CHICAGO O'HARE INTERNATIONAL AIRPORT (ORD). THE APPROACH WAS NORMAL UNTIL THE AIRPLANE PASSED THROUGH 200 FEET ABOVE GROUND LEVEL (AGL), WHERE THE AIRPLANE STARTED A PITCH OSCILLATION THAT GREW IN TIME. THE AIRPLANE DESCENDED BELOW THE ILS GLIDE SLOPE, THEN CLIMBED ABOVE IT, AND FINALLY DESCENDED BELOW IT AGAIN, IMPACTING THE GROUND 300 FEET SHORT OF THE RUNWAY THRESHOLD. UPON IMPACT, THE AIRPLANE SLID OVER THE THRESHOLD AND THEN OFF THE RIGHT SIDE OF THE RUNWAY, WHERE IT CAME TO REST. THE AIRPLANE WAS EXTENSIVELY DAMAGED, AND 22 PASSENGERS AND 1 FLIGHT ATTENDANT SUSTAINED MINOR INJURIES.
Recommendation: THE NTSB RECOMMENDS THAT THE FAA: REVIEW THE CERTIFICATION OF ALL AUTOPILOT SYSTEMS THAT USE TIME-BASED DESENSITIZATION SCHEDULES AND DEVELOP OPERATING LIMITATIONS, AS NECESSARY, FOR THE USE OF THESE AUTOPILOT ON COUPLED INSTRUMENT LANDING SYSTEM APPROACHES. THE LIMITATIONS SHOULD ADDRESS APPROACH FLAP SETTINGS AND AIRSPEEDS SPECIFICALLY, AND SHOULD ALSO CONSIDER TOLERANCES ON WINDS, CAPTURE ALTITUDES, GLIDE SLOPE ANGLES, AND/OR OTHER PARAMETERS THAT COULD ADVERSELY AFFECT AUTOPILOT PERFORMANCE AND SAFETY OF FLIGHT.
Original recommendation transmittal letter: PDF
Overall Status: Closed - Acceptable Action
Mode: Aviation
Location: CHICAGO, IL, United States
Is Reiterated: No
Is Hazmat: No
Is NPRM: No
Accident #: DCA98MA023
Accident Reports: Ground Impact of American Airlines 1340
Report #: AAB-01-01
Accident Date: 2/9/1998
Issue Date: 6/1/2000
Date Closed: 7/31/2003
Addressee(s) and Addressee Status: FAA (Closed - Acceptable Action)
Keyword(s): Autopilot

Safety Recommendation History
From: NTSB
To: FAA
Date: 7/31/2003
Response: On October 24, 2001, the FAA reported that it had reviewed the autopilot systems installed on in-service airplanes that use time-based desensitization schedules. The FAA determined that only early models of the DC-8 and DC-9 have a time-based gain desensitization/scheduling scheme. All other models use a radio altimeter that is not subject to the problems that this recommendation addresses. In its letter dated March 5, 2002, the Safety Board expressed surprise that no similar problems were found with the DC-9. The Board asked the FAA for information on the search for trouble reports and the simulations of the DC-9 autopilot approaches that were performed in support of the FAA's conclusions. The FAA provided extensive details in response to this request in its December 12, 2002, letter, and in a January 21, 2003, teleconference with staff from the FAA's Aircraft Certification Service in Renton, Washington. In this teleconference, FAA staff stated that the operational limits for the DC-9 were the basis for the conditions simulated and described in the FAA's December 12, 2002, letter. On the basis of this teleconference, the Safety Board concurs with the FAA's conclusions regarding the DC-9. During the January 21, 2003, teleconference, the Safety Board's staff requested that the FAA determine whether any changes had been made to the certification basis for the DC-8 when using the autopilot similar to those made to the Boeing 727 that caused the American Airlines flight 1340 accident. On April 25, 2003, staff from the FAA and the Safety Board held another teleconference to discuss this issue. The FAA's review determined that there were no McDonnell Douglas-certified configuration changes that affected autopilot performance. However, there are two non-McDonnell Douglas hushkit modification supplemental type certificates that allow landings at flap settings other than those for which the DC-8 was originally certified for coupled precision approaches. In both cases, approved flight manual limitations were added prohibiting the use of the autopilot and flight director during approaches at flap settings other than those for which the DC-8 was originally certified. The FAA has now reviewed the certification of all autopilot systems that use time-based desensitization schedules and determined that revisions to the operating limitations for the use of these autopilots on coupled instrument landing system approaches are not necessary. Therefore, Safety Recommendation A-00-44 is classified "Closed--Acceptable Action."

From: FAA
To: NTSB
Date: 12/12/2002
Response: Letter Mail Controlled 12/17/2002 6:07:55 PM MC# 2021033 The Federal Aviation Administration (FAA) completed a review of the autopilot systems installed on in-service airplane models that use time-based desensitization schedules. The FAA investigated the Boeing 737-100/200, 747-100/200, Boeing/McDonnell Douglas DC-8, DC-9, DC-10, and Lockheed L-1011 model airplanes. The FAA determined that only early models of the DC-8 and DC-9 have a time-based gain desensitization/scheduling scheme. All other models use the radio altimeter for this purpose. Of the DC-8 and DC-9 models, 28 DC-8 airplanes and over 700 DC-9 airplanes are in service that are equipped with autopilots with this type of design. Boeing surveyed the operators of the in-service airplanes to determine if any airplanes had experienced a pitch oscillation during automatic approach and landing during its 30 years of operation. There were no reports of experiencing this type of problem. Boeing also conducted numerous simulated DC-9 approaches and landings while varying parameters like turbulence, approach speeds, and glideslope angles. Boeing was not able to induce any pitch oscillations during any of these simulated approaches, even during extreme turbulence. The evaluation concluded that no other airplanes in service that are equipped with an autopilot design similar to that of the Boeing 727 could be susceptible to pitch oscillations during an-automatic final approach and landing. addressing the Boeing 727 separately in response Safety Recommendations A-00-41 and -42. The FAA considered its action to be completed in response to Safety Recommendation A-00-44. On March 5, 2002, the Board asked for additional information and classified Safety Recommendation A-00-44 in an "open acceptable" status. The following is the FAA's response to the Board's request: The Board requests details of the types of problem reports Boeing sought from operators regarding pitch oscillations or instabilities during automatic approaches for DC-9 airplanes. In order to determine if there have been any in-service pitch instability problems during automatic approach, Boeing asked selected DC-9 operators the following questions: · For the last 12-month period, how many pilot reports of autopilot pitch oscillations on approach (after glideslope capture) have been noted? · If any reports have been noted, how many occurred below 300 feet? · If any reports have been noted, what action was taken to correct the condition? NOTE: The timer used to reduce the autopilot gain is first initiated at Glideslope Capture, and a second stage reduction occurs when the airplane passes the Middle Marker. For its analysis of the Boeing 727 accident, Boeing used 300 feet as the altitude at which the airplane will normally pass the Middle Marker. After that point in the approach, a gain programming error, if one exists, will contribute significantly to any pitch instabilities that occur. Above that altitude, calculations show that the largest error that could be present in the control law gain are small enough that undamped oscillations will not occur. These questions were crafted by Boeing to look for the same anomalous behavior of DC-9 airplanes during automatic approach that had been reported by numerous Boeing 727 operators. These identical questions, when asked of operators of Boeing 727 aircraft, turned up a significant number of reports that indicated there was a problem associated with the autopilot of that airplane type. In response to Boeing's queries, several DC-9 operators responded that there had been reports of autopilot pitch oscillations. One operator reported a total of 34 pilot reports during the year of 2001, with 7 that occurred below 300 feet. Another operator reported 30 events over the last 12-month period, with only a single event that occurred below 300 feet and one that occurred right at 300 feet. The total number of revenue flights between these operators for the given time period exceeds 350,000 flights. Of these reported pitch instability events (events that occurred below 300 feet and events that occurred above 300 feet), the majority were corrected by replacement of the autopilot Pitch Computer, while most of the remaining items were cleared by replacement of the Instrument Landing System Computer. The final closing action on the few remaining events that were not covered by either of these two maintenance actions was not reported. However, one operator reported that its published maintenance procedures for aircraft with recurring pitch problems includes wiring checks and a check of friction induction. The Boeing study concluded that the causes for these specific events reported by DC-9 operators were individual component hardware failures and were not due to an inherent design problem. The FAA concurs with the conclusions reached by Boeing. Any comments from the FAA on the issue of autopilot-induced problems not recognized as being caused by the autopilot. The operators polled by Boeing represent approximately 90 percent of the DC-9 fleet currently operating in the United States. The system used for pilots to report in-flight events is in place and is trusted by the FAA and the Board to provide information regarding operator, problems for a number of years. As noted above, there were a fairly large number of pilot reports of pitch oscillations during approach by these operators over the course of a l-year period. Because of these facts, it is the opinion of the FAA that there is very little chance that any significant item relevant to this investigation was not reported. Also noted above is the fact that there were numerous instances of Boeing 727 pitch oscillations during automatic approach reported prior to the crash in Chicago. These numerous reports showed a distinctive trend, which turned out to be indicative of a design problem with the Boeing 727 autopilot system. If one or two instances of DC-9 pitch oscillations were not reported, the remaining events that were reported still show no evidence of the same kind of trend present in the Boeing 727 data. A copy of any documentation that includes test plans or conditions to be tested and reports of the result of the automatic approach simulations Boeing conducted for the DC-9 study. The test data provided by Boeing to the FAA have been identified as proprietary material. FAA policies do not allow forwarding material designated in this manner to persons outside the FAA. If the Board wishes to examine the actual Boeing test documentation, the FAA will forward the Board's request to Boeing and ask that Boeing respond directly to the Board. A summary of the test procedures and results is provided below. The FAA believes the following summary provides the necessary information. Multiple simulated approaches were made using a modified Boeing 717 airplane simulation, which included the specific simulation of a Boeing/McDonnel1 Douglas DC-9 autopilot. Honeywell (originally Sperry Rand), the manufacturer of the autopilot computer for Boeing/McDonnell Dotiglas DC-9, assisted Boeing in implementing this autopilot simulation. Each approach scenario used the following parameters: · Starting altitude of 1,100 feet, with a straight-in approach on a 3-degree glideslope. · Landing flap setting of 17/40. · Center of Gravity of 0.25. · Airplane in trim on stable approach. The following parameters were varied during the multiple approach scenarios: · Airplane landing weight (70K/110K). · Headwind (25 kts)/tailwind (15 kts). · Combinations of the previous two parameters resulted in the minimum and maximum approach ground speed (VCAS 115 kts/l44kts) for the DC-9 given that flap setting. · Turbulence. · Glideslope noise. The results show that between the minimum and maximum approach speeds, the high-speed approach is the worst of the two conditions. Several high-speed cases showed a lightly damped short period mode of around two and a half seconds. However, no divergent oscillations were observed. No problems were noted in the low-speed cases. The autopilot response was always stable for the conditions that included noise on the glideslope signal. No unusual or sustained horizontal pitch trim activity was observed at any time during any of the scenarios described above. NOTE: Sustained horizontal pitch trim activity was determined to have played an important role in the previously noted Boeing 727 accident. As a result of this simulation of the Boeing/McDonnell Douglas DC-9 autopilot on approach, Boeing concluded that the DC-9 aircraft is not susceptible to the same problem that was experienced on the Boeing 727. The FAA concurs with this conclusion. The FAA also offers the following additional discussion. One important aspect to consider is that the Boeing 727 accident occurred while the airplane was using an approach flap setting that was different than that originally certified on the Boeing 727 for automatic approaches. This difference resulted in a different approach speed than was originally certified, which resulted in a pitch control gain desensitization scheduling that was not consistent with the original Boeing 727 design. These differences resulted in aspects of the Boeing 727 accident scenario that are not relevant to the Boeing/McDonnell Douglas DC-9 analysis. Another notable difference between the Boeing 727 and DC-9 autopilot systems is that there were two different time constants in service on Boeing 727 autopilot systems at the time of the Chicago accident. One is referred to as a 105-second time constant, and the other as a 150-second time constant. The accident airplane had an autopilot with the 150-second time constant. Analysis and simulations have shown this to be the less stable of the two. As a result of the Boeing 727 investigation, the FAA is in the process of issuing an Airworthiness Directive that will require all Boeing 727 operators to update their autopilot systems to the 105-second time constant for use in automatic approaches. This effort is being addressed separately in response to companion Safety Recommendations A-00-41 and -42. The DC-9 autopilot system has a single time constant. Finally, Boeing (then McDonnell Douglas) previously issued the following two service bulletins for specific items regarding autopilot pitch instabilities, glide slope "porpoising," and loose glideslope tracking. McDonnell Douglas DC-9 Service Bulletin 22-31, "Autopilot - Coupling - Replace Roll, Pitch, and Stability Augmentation Computers," dated April 13, 196.7 McDonnell Douglas DC-9 Service Bulletin 22-54, "Autoflight - Autopilot - Rework Pitch Computer," dated July 2, 1969. Both service bulletins addressed problems that were very similar in nature to those reported by Boeing 727 operators prior to the Chicago accident. It is FAA's opinion that any type of design problems that were present on the Boeing 7.2'1 at the time of the accident were corrected by these service bulletins early in the service history of the Boeing/McDonnell Douglas DC-9. I believe that the FAA has satisfactorily responded to this safety recommendation, and I look forward to your response.

From: NTSB
To: FAA
Date: 3/5/2002
Response: The Safety Board appreciates the extensive evaluation performed by the FAA and Boeing and requests that the FAA supply additional information. The Board notes that during the investigation of the accident that prompted this recommendation, Boeing discovered some reports of 727 pitch oscillations while on approach. However, it was unclear from the trouble reports whether they were attributed to autopilot problems. The Board is concerned that if Boeing's review of DC-8 and DC-9 operators' experience looked for problems related only to the autopilot, it may have missed pitch oscillation problems not recognized as being caused by the autopilot. The Board would appreciate receiving (1) details from the FAA on what types of problem reports Boeing sought from the operators and (2) any comments from the FAA on the issue of autopilot-induced problems not recognized as being caused by the autopilot. Given the similar technology of the autoland systems for both the 727 and the DC-9, the Safety Board would have expected that the numerous simulated DC-9 approaches and landings that Boeing conducted would result in some pitch oscillation problems. The Board requests that the FAA provide a copy of any documentation of the simulated approaches and landings, such as a technical report or other document that includes test plans, conditions to be tested, and result reports. Pending receipt and review of information regarding the details of Boeing's survey of operators, and a technical report or other documentation of the simulated DC-9 approaches and landings, Safety Recommendation A-00-44 remains classified "Open--Acceptable Response."

From: FAA
To: NTSB
Date: 10/24/2001
Response: Letter Mail Controlled 10/29/2001 2:31:22 PM MC# 2010881: The Federal Aviation Administration (FAA) has completed a review of the autopilot systems installed on in-service airplane models that use time-based desensitization schedules. These autopilot systems are the "first generation" analog autopilots capable of performing a coupled approach and landing. Airplanes equipped with newer digital autopilots base their gain desensitization/scheduling on radio altitude rather than time and are not susceptible to the pitch oscillations during automatic approach and landing that were experienced on the Boeing 727 accident airplane. Consequently, the FAA limited further review to large commercial transport airplanes that are equipped with autopilot systems that utilize analog technology. The FAA investigated the Boeing 737-100/200, 747-100/200, Boeing/McDonnell Douglas DC-8, DC-9, DC-10, and Lockheed L-1011 model airplanes. The FAA determined that only early models of the DC-8 and DC-9 have a time-based gain desensitization/scheduling scheme. All other models use the radio altimeter for this purpose. Of the DC-8 and DC-9 models, 28 DC-8 airplanes and over 700 DC-9 airplanes are in service that are equipped with autopilots with this type of design. Boeing surveyed the operators of the in-service airplanes to determine if any airplanes had experienced a pitch oscillation during automatic approach and landing during its 30 years of operation. There were no reports of experiencing this type of problem. Boeing also conducted numerous simulated DC-9 approaches and landings while varying parameters like turbulence, approach speeds, and glideslope angles. Boeing was not able to induce any pitch oscillations during any of these simulated approaches, even during extreme turbulence. The evaluation concluded that no other airplanes in service that are equipped with an autopilot design similar to that of the Boeing 727 could be susceptible to pitch oscillations during an automatic final approach and landing. The Boeing 727 is being addressed separately in response to companion Safety Recommendations A-00-41 and -42. I believe that the FAA has addressed the full intent of this safety recommendation, and I consider the FAA's action to be completed.

From: NTSB
To: FAA
Date: 1/30/2001
Response: The FAA reports that it met with representatives from the Boeing Company to gather information on the Boeing 727 autopilot design used for coupled Category II approaches. In addition to the time-phased gain schedule aspects of the design, the FAA reports that it is also looking at subsequent modifications to the design, changes in normal landing procedures (including flap configuration), and the effect these designs have on system behavior. The FAA reports that the Boeing Company is currently gathering additional technical data and analyses for the Boeing 727 autopilot and certain other Boeing airplanes like the Boeing 737, 747, and Douglas DC-9 that were certified in the late 1960s and early 1970s. The FAA letter states that with a better understanding of the design, the operational limitations, and the certification of this class of autopilot, the FAA will be better prepared to review other autopilots with similar characteristics and to determine a course of action to ensure their safe operation. The action being taken by the FAA is responsive to the recommendation. Pending the results of the FAA's current review and the initiation of a comprehensive review of other autopilots with similar characteristics, Safety Recommendation A-00-44 remains classified "Open-Acceptable Response."

From: FAA
To: NTSB
Date: 11/24/2000
Response: Letter Mail Controlled 11/28/2000 3:45:19 PM MC# 2001744 The FAA met with representatives from The Boeing Company to gather information on the Boeing 727 autopilot design used for coupled Category II approaches. Changes to the design incorporated through service bulletins and the root causes of the accident are being reviewed. In addition to the time-phased gain desensitization element of the guidance control law, the FAA is examining the conditions and configurations in which the system as demonstrated for approval, as well as operational procedures and the limitations in the AFM. In addition to the time-phased gain schedule aspects of the design, the FAA is also looking at subsequent modifications to the design, changes in normal landing procedures (including flap configuration), and the effect these designs have on system behavior. The Boeing Company is currently gathering additional technical data and analyses for the Boeing 727 autopilot and certain other Boeing airplanes like the Boeing 737, 747, and Douglas DC-9 that were certified in the late 1960's and early 1970's. It is anticipated that with a better understanding of the design, operational limitations, and the certification of this class of autopilot, the FAA will be better prepared to review other autopilots with similar characteristics and to determine a course of action to ensure their safe operation. I will keep the Board informed of the FAA's progress on this safety recommendation.

From: NTSB
To: FAA
Date: 11/13/2000
Response: The FAA plans to gather the required data and conduct an analysis of these data to address this safety recommendation. The FAA reports that many of the early autopilots (before 1970) targeted by this safety recommendation were originally approved under 14 CFR Part 25 for cruise operations only, but subsequently, some of these autopilots were approved for coupled instrument landing system approaches. The FAA also notes that more recent autopilots certified using the regulatory compliance guidance outlined in Advisory Circulars 120-29, 120-28, and 20-57 already fulfill the intent of this safety recommendation. For these reasons, the FAA will gather required data to determine the number of autopilots affected by this safety recommendation and will develop an appropriate plan to ensure their safe operation. The actions planned and undertaken by the FAA are responsive to the recommendation. Pending receipt of the results of the FAA's review, Safety Recommendation A-00-44 is classified "Open-Acceptable Response."

From: FAA
To: NTSB
Date: 8/9/2000
Response: Letter Mail Controlled 08/14/2000 3:27:27 PM MC# 2001057 The SP-150 autopilot on the Boeing 727 uses a time-based gain schedule for automatic approach and landing that reduces pitch gain after descent below 1,500 feet measured by the radio altimeter. The original gain schedule was based on an approach and landing flap setting of 40 degrees. When operators use a flap setting of 30 degrees, the approach airspeed is higher, the airplane approaches the glide slope antenna faster, and the gain schedule does not reduce the pitch gain fast enough. As a result, in certain conditions the airplane will oscillate in pitch and may not land safely. The FAA plans to gather the required data and conduct an analysis of these data to address this safety recommendation adequately. Many of the early autopilots targeted by this safety recommendation (before 1970) were originally approved under 14 CFR Part 25 for cruise operations only. Subsequently, some of these autopilots were approved for coupled instrument landing system approaches. The FAA would like to point out that more recent autopilots certified using the regulatory compliance guidance outlined in Advisory Circulars 120-29, 120-28, and 20-57 would already fulfill the intent of this safety recommendation. For these reasons, the FAA will gather these required data to determine the number of autopilots affected by this safety recommendation and develop an appropriate plan to ensure their safe operation. It is anticipated that the review will be completed and an appropriate course of action identified by October 2000. I will keep the Board informed of the FAA's progress on this safety recommendation.