Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-04-058
Details
Synopsis: On November 12, 2001, about 0916:15 eastern standard time, American Airlines flight 587, an Airbus Industrie A300-605R, N14053, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Flight 587 was a regularly scheduled passenger flight to Las Americas International Airport, Santo Domingo, Dominican Republic, with 2 flight crewmembers, 7 flight attendants, and 251 passengers aboard the airplane. The airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site. The airplane’s engines subsequently separated in flight and were found several blocks north and east of the main wreckage site. All 260 people aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces and a postcrash fire. Flight 587 was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident.
Recommendation: THE FEDERAL AVIATION ADMINISTRATION: Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds.
Original recommendation transmittal letter: PDF
Overall Status: Closed - Acceptable Action
Mode: Aviation
Location: Belle Harbor, NY, United States
Is Reiterated: Yes
Is Hazmat: No
Is NPRM: No
Accident #: DCA02MA001
Accident Reports: In-Flight Separation of Vertical Stabilizer American Airlines Flight 587, Airbus Industrie A300-605R, N14053
Report #: AAR-04-04
Accident Date: 11/12/2001
Issue Date: 11/10/2004
Date Closed: 2/4/2013
Addressee(s) and Addressee Status: FAA (Closed - Acceptable Action)
Keyword(s): Rudder,

Safety Recommendation History
From: NTSB
To: FAA
Date: 4/17/2015
Response: From CC# 201500244: The National Transportation Safety Board (NTSB) has reviewed the Federal Aviation Administration’s (FAA) notice of proposed rulemaking (NPRM), titled “Airworthiness Directives; Airbus Airplanes,” which was published at 80 Federal Register 11960 on March 5, 2015. The NPRM proposes to adopt a new airworthiness directive (AD) for all Airbus Model A318, A319, A320, and A321 series airplanes. This proposed AD would require modification of the pin programming of the flight warning computer (FWC) to activate the stop rudder input warning (SRIW) logic, an inspection to determine the part numbers of the FWC and the flight augmentation computer (FAC), and replacement of the FWC and FAC if necessary. The FAA is proposing this AD to prevent detachment of the vertical tail plane and consequent loss of control of the airplane. This proposed AD was prompted by a determination that, in specific flight conditions, the allowable load limits on the vertical tail plane could be reached and possibly exceeded, which could result in detachment of the vertical tail plane. The proposed AD results, in part, from in service incidents involving Airbus A319 and A320 models. On January 10, 2008, about 0848 central standard time, Air Canada flight 190, an Airbus A319, Canadian registration C-GBHZ, experienced a sudden in-flight upset after encountering wake turbulence from a 747 while climbing from flight level (FL) 360 to FL370. With the autopilot on, the airplane initially rolled 28° to the left and then rolled back to 10° to the right. A series of large oscillatory inputs on the lateral and longitudinal side-stick controller and on the rudder pedals followed. During these inputs, the airplane continued to oscillate in roll, achieving roll angle peaks of up to 56° left and 37° right before returning to level flight. At the same time, the lateral load factor also underwent large oscillations, with peaks from -0.46G to +0.49G. The vertical load factor achieved peaks from -0.77G to 1.57G. The airplane lost about 1,000 ft of altitude during the upset. The flight crew declared an emergency and diverted the flight to Calgary, where it landed uneventfully. Of the 5 crew members and 83 passengers on board, 2 crew members and 8 passengers sustained minor injuries. In addition, the proposed AD results from Safety Recommendations A 04 56 through 58, which the NTSB issued after its investigation of a November 12, 2001, accident involving American Airlines flight 587, an Airbus Industrie A300-605R, N14053, which crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Following an encounter with wake turbulence from a preceding 747 and a series of alternating rudder pedal inputs by the first officer, the airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site. All 260 people aboard the airplane and 5 people on the ground died, and the airplane was destroyed by impact forces and a postcrash fire. As a result of this accident, the NTSB issued several recommendations, including the following recommendations to the FAA: Modify 14 Code of Federal Regulations Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A-04-56) After the yaw axis certification standard recommended in Safety Recommendation A-04-56 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplanes designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential aircraft-pilot coupling (APC) after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-04-57) Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300 600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. (A-04-58) In response to Safety Recommendation A-04-58, on November 9, 2012, the FAA published AD 2012-21-15 for all Airbus A300-600 and Airbus A310 series airplanes. The AD requires either incorporating a design change to the rudder control system and/or other systems or installing an SRIW modification to prevent loads on the vertical stabilizer that exceed ultimate design loads. The NTSB has noted its concerns about a warning light alone to address issues with the yaw control and rudder system. When the FAA proposed the SRIW in a May 19, 2011, NPRM, we submitted comments on July 5, 2011, stating our concern that a warning light alone will not rectify the unsafe condition identified in the NPRM. We reiterated this concern in a February 4, 2013, letter to the FAA regarding Safety Recommendation A-04-58. However, we noted that the SRIW and other design modifications would likely increase protection from potentially hazardous rudder pedal inputs at high airspeeds and classified Safety Recommendation A-04-58 “Closed—Acceptable Action.” Although the A320 SRIW is named similarly to the A300/A310 SRIW and each has an aural component, we note that the NPRM and European Aviation Safety Agency (EASA) AD 2014-0217, on which the NPRM is based, do indicate differences. For example, the A300/A310 SRIW has a glare shield red warning lamp that lights when the SRIW is activated; the NPRM and EASA AD do not mention a warning light as part of the A320 SRIW. More importantly, however, we also note that the A320 SRIW incorporates some measure of vertical tail “protection” or unloading based on FAC modification. As stated in EASA AD 2014 0217, “Airbus has developed modifications within the flight augmentation computer (FAC) to reduce the vertical tail plane stress and to activate a conditional aural warning within the flight warning computer (FWC) to further protect against pilot induced rudder doublets” (emphasis added). However, neither the NPRM nor the EASA AD mentions specific details of this aspect of the SRIW. Without these details, we cannot fully assess the A320 SRIW’s responsiveness to Safety Recommendations A-04-56 and -57. We anticipate that the FAA has fully analyzed the SRIW with respect to these safety recommendations as well as the future criteria for Part 25 yaw control changes. However, we cannot determine whether the A320 SRIW includes a warning light like the A300 SRIW or whether it has more comprehensive protection, and we encourage the FAA to address these details in the final rulemaking. The NTSB appreciates the opportunity to comment on the information that is contained in this NPRM and looks forward to receiving additional information and clarification on the issues presented.

From: NTSB
To: FAA
Date: 2/4/2013
Response: On November 9, 2012, the FAA published AD 2012-21-15 for all Airbus A300 600 and Airbus A310 series airplanes. This AD requires either incorporating a design change to the rudder control system and/or other systems, or installing a stop rudder inputs warning (SRIW) modification to prevent loads on the vertical stabilizer that exceed ultimate design loads. The AD was based on a May 19, 2011, notice of proposed rulemaking (NPRM). In comments about this NPRM that we submitted on July 5, 2011, we stated our concern that a warning light alone (that is, the SRIW) would not rectify the unsafe condition identified in the NPRM. However, in issuing the final AD, the FAA indicated its belief that the SRIW and other design modifications discussed in the AD fully address the unsafe conditions discussed in both safety recommendations. The NTSB has reconsidered our previous position in light of the FAA’s analysis, and we now believe that the design modifications specified in the AD will increase protection from potentially hazardous rudder pedal inputs at high airspeeds. Consequently, Safety Recommendations A-04-44 and A-04-58 are classified CLOSED—ACCEPTABLE ACTION.

From: NTSB
To: FAA
Date: 11/8/2012
Response: Since these recommendations were issued, the FAA has been responding to both with a single solution. We have stated in the past that, although both recommendations concern issues with the rudder system on the Airbus A300-600 airplane, the issues with the rudder system addressed by each recommendation are different. In our October 3, 2011, letter, we repeated our concern that the FAA continued to focus on systems developed by Airbus to reduce fin loads in cases of excessive pilot rudder pedal inputs, a different safety concern from the sensitivity to rapid airspeed changes of the RTL system on the A300-600 and excessive rudder pedal forces overpowering the RTL system, the issues addressed in Safety Recommendation A-04-44. A teleconference involving FAA and NTSB staff was held on September 21, 2012, to discuss the differences between Safety Recommendations A-04-44 and A-04-58. During this teleconference, FAA staff explained that the systems under consideration in response to Safety Recommendation A-04-58 would also limit the rate at which rudder pedal inputs could be made, and that these changes would, in their opinion, address the sensitivity to rapid airspeed changes of the RTL system on the A300-600 and excessive rudder pedal forces overpowering the RTL system. On May 19, 2011, the FAA issued a notice of proposed rulemaking (NPRM) proposing an airworthiness directive (AD) for Airbus A300-600 and A310 airplanes requiring incorporation of a design change to the rudder control system and/or other systems to prevent excessive rudder pedal inputs and resulting loads on the vertical stabilizer. The NPRM does not propose a specific design change, but instead allows alternate system changes that could prevent the unsafe condition. The FAA will need to evaluate these alternate systems to ensure that they effectively address the issues that prompted each of these recommendations. Although we are not aware of the specific details of the systems that will be proposed, or how the FAA will determine that the proposed systems address the safety concerns, we now believe that the FAA will consider both sets of safety concerns in its approval of systems proposed in response to the NPRM’s AD. Accordingly, pending issuance of the AD, and the FAA’s determination that systems proposed in response to the AD effectively address the concerns that prompted each of these recommendations, Safety Recommendations A-04-44 and A-04-58 remain classified OPEN—ACCEPTABLE RESPONSE.

From: FAA
To: NTSB
Date: 8/3/2012
Response: -From Michael P. Huerta, Acting Administrator: As previously stated, the Federal Aviation Administration (FAA) issued the Airworthiness Directives; Airbus Model A300 B4-600, B4-600R, and F4-600R Series Airplanes, and Model C4-605R Variant F Airplanes (Collectively Called A300-600 Series Airplanes); and Model A3l 0 Series Airplanes Notice of Proposed Rulemaking (NPRM), identified under docket number FAA-2011-0518, on May 19, 2011. The NPRM proposed a requirement for incorporation of a design change to the rudder control system and/or other systems to prevent excessive rudder pedal inputs and consequent loads on the vertical stabilizer, which could exceed ultimate design loads. The proposed rulemaking does not require a specific design change such as the addition of a rudder pedal travel limiter system. Instead, it allows for flexibility of alternate system changes that could also effectively prevent the unsafe condition. We are reviewing the comments received from the NPRM and expect to issue the final rule airworthiness directive by December 31, 2012.

From: NTSB
To: FAA
Date: 10/3/2011
Response: The FAA’s May 19, 2011, NPRM (discussed above in response to Safety Recommendation A-04-44) proposes an AD that would require actions to address the issue of excessive rudder pedal inputs and the consequent high loads on the vertical stabilizer on Airbus A300-600 and A310 airplanes. This NPRM and the proposed AD would address this recommendation, as well as the higher rudder pedal sensitivity in these airplanes than that in other transport-category airplane designs, which could result in rudder overcontrol and contribute to hazardous rudder inputs, such as rudder reversals. Although the FAA provided the same response to this recommendation as it did to Safety Recommendation A-04-44, above, the NTSB has indicated to the FAA on several occasions that Safety Recommendation A-04-44 addresses a separate problem with the A300 600/A310 rudder system from that addressed by Safety Recommendation A-04-58. On July 5, 2011, the NTSB submitted comments to the docket for the NPRM, (1) indicating that we were encouraged that industry and the FAA were exploring options for addressing excessive rudder inputs and (2) supporting the intent of the NPRM. We remained concerned, however, about the lack of specificity and the length of time it is taking to make a design change available to operators. We also believe that the actions being taken in response to Safety Recommendations A-04-56 and -57, discussed above, will directly impact the actions being taken in response to this recommendation. It is our belief that revisions made in response to Safety Recommendation A-04-58 will need to result in a rudder pedal sensitivity consistent with the findings of the FAA’s five-part study and with the revisions to the certification standards developed by the ARAC. We encourage the FAA to consider these comments when addressing Safety Recommendation A-04-58. Pending completion of the recommended action as discussed above, Safety Recommendation A-04-58 remains classified OPEN—ACCEPTABLE RESPONSE.

From: NTSB
To: FAA
Date: 7/5/2011
Response: Notation 8322: The National Transportation Safety Board (NTSB) has reviewed the Federal Aviation Administration’s (FAA) notice of proposed rulemaking (NPRM) titled “Airworthiness Directives; Airbus Model A300 B4-600, B4-600R, and F4-600R Series Airplanes, and Model C4-605R, Variant F Airplanes (Collectively Called A300-600 Series Airplanes); and Model A310 Series Airplanes,” which was published in 76 Federal Register 28914 on May 19, 2011. The NPRM proposes a new airworthiness directive (AD) for Airbus A300-600 series and A310 series airplanes. The proposed AD would require actions to address excessive rudder pedal inputs and the consequent high loads on the vertical stabilizer. It would also address the higher rudder pedal sensitivity in these airplanes than other transport-category airplane designs, which could result in rudder overcontrol and contribute to hazardous rudder inputs, such as rudder reversals. The proposed AD results from safety recommendations issued by the NTSB following the investigation of the November 12, 2001, accident involving American Airlines flight 587, an Airbus Industrie A300-605R, N14053, which crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Following an encounter with wake turbulence from a preceding Boeing 747 and a series of alternating rudder pedal inputs by the first officer, the airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site. All 260 people aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces and a postcrash fire. Further, the NTSB is aware of other events of a similar nature. One event, during stall recovery in an A300-600 airplane, resulted in alternating rudder pedal inputs, high vertical stabilizer loads and serious injury to one passenger among the 165 persons on board. Another incident, during stall recovery after an aborted landing attempt in an A310 airplane operated by a German airline, resulted in alternating rudder inputs and high vertical stabilizer loads that exceeded the ultimate design loads. Among the recommendations the NTSB issued to the FAA as a result of the American Airlines flight 587 accident investigation were the following: Modify 14 Code of Federal Regulations Part 25 standards to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A 04-56) After the yaw axis certification standard recommended in Safety Recommendation A-04-56 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential aircraft-pilot coupling (APC) after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-04-57) Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300 600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. (A-04-58) The NTSB is encouraged that various actions, as indicated in the proposed rulemaking, are under consideration but is concerned that the rulemaking does not appear to propose a definitive fix of the rudder system; the rulemaking mentions the pedal traveler limiter unit (PTLU) but notes that it is just one option that is currently under review to address excessive rudder pedal inputs. The exact details of the proposed PTLU fix have not yet been documented, and, without a careful review of the proposed modification, the NTSB is unable to determine to what extent it might provide protection from the adverse effects of APC issues in rudder system use, as recommended. In addition, the NTSB notes that the FAA anticipates approving a design change that meets the proposed requirements within the next 3 years and that operators would be required to take action within 4 years of the rulemaking. It is unfortunate that almost 10 years after the Belle Harbor accident, no design change has yet been made available to operators. Finally, the NTSB understands that a warning light for the flight deck that does not incorporate any mechanical changes to the rudder system is under development by Airbus. The NTSB is concerned that a warning light alone will not rectify the unsafe condition identified in the NPRM. The NTSB would appreciate any information regarding cooperation between the FAA and the European Aviation Safety Agency on this matter. It is encouraging that industry and the FAA are exploring options for addressing excessive rudder inputs, and the NTSB supports the intent of this NPRM, as well as the underlying industry work to provide increased protection against APC issues in the rudder input of A300-600 series and A310 series airplanes. We remain concerned, however, about the lack of specificity and the length of time it is taking to make a design change available to operators. The NTSB appreciates the opportunity to comment on this NPRM.

From: FAA
To: NTSB
Date: 6/17/2011
Response: CC#201100255: - From J. Randolph Babbitt, Administrator: The Federal Aviation Administration's (FAA) December 13,2010, letter to the Board described our efforts to evaluate Airbus' intention to reduce fin loads in case of excessive p lot rudder pedal inputs through visual and aural warnings, in lieu of their original intention of developing a pedal travel limiter unit. The European Aviation Safety Agency, the certification authority of the A300-600 and the A310, and the FAA are still evaluating the Airbus proposal. The FAA is assessing its expected efficacy and determining whether or not it adequately a dresses the safety concerns. However, because of the complex review process of the Airbus proposal, the FAA issued Notice of Proposed Rulemaking, Airworthiness Directives; Airbus Model A300 B4-600, B4-600R, and F4-600R Series Airplanes, and Model C4-605R Variant F Airplanes (Collectively Called A300-600 Series Airplanes); and Model A310 Series Airplanes (enclosure 1), mandating design changes to address the safety concern using a method we prove.

From: NTSB
To: FAA
Date: 3/31/2011
Response: The FAA provided the same response to this recommendation as it did to Safety Recommendation A-04-44, discussed above. The NTSB has indicated to the FAA on several occasions that Safety Recommendation A-04-44 addresses a separate problem with the A300 600/A310 rudder system from the problem addressed by Safety Recommendation A-04-58. FAA and EASA staffs have provided a general briefing to NTSB staff on the PTLU that appeared to indicate that the PTLU would satisfy the recommendation; however, without seeing the details of the PTLU design, we have been unable to determine whether a requirement for the PTLU would fully meet the intent of this recommendation. In the same way, without our seeing the details of Airbus’ revised proposal that relies on warning the pilot of unsafe rudder pedal inputs, it is not possible for the NTSB to determine whether such revision would satisfy the recommendation, but we are concerned that a warning system alone cannot adequately address Safety Recommendation A-04-58. The NTSB’s August 3, 2010, letter, discussed above, also reiterated Safety Recommendation A-04-58. That letter indicated that, on March 19, 2010, EASA had written to the NTSB that its “previously held position on the pilot training out as being an efficient and sufficient measure to avoid any new hazardous situations has to be reconsidered following more recent service experience which confirms that crew use of rudder pedal inputs in upset encounters cannot be ‘trained out.’” EASA therefore indicated that it planned to require the PTLU on Airbus A310 and A300-600 aircraft models. In our August 3, 2010, letter, we stated Because of the FAA’s delay in responding to Safety Recommendation A-04-56, which asked the FAA to modify 14 CFR Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity, the NTSB is uncertain that the PTLU that Airbus is developing in response to A-04-58 will ensure that the A300/A310 airplanes will pass any yaw characteristic standards that the FAA develops. Because of the amount of time that has passed since the issuance of A-04-58 and the limited work that has been accomplished to date, the NTSB reiterates Safety Recommendation A-04-58. As with Safety Recommendation A-04-44, we commend the FAA for its planned action to issue an AD while evaluating Airbus’s revised proposal and to require a design proposal that will address the safety problem should the FAA determine Airbus’s proposal to be inadequate. Pending completion of the recommended action, Safety Recommendation A-04-58 remains classified OPEN – ACCEPTABLE RESPONSE.

From: FAA
To: NTSB
Date: 12/13/2010
Response: CC# 201100010: - From J. Randolph Babbitt, Administrator: In the Federal Aviation Administration's letters dated August 12, 2004 and March 1, 2005, we discussed our efforts to work with Airbus, the French Director General of Civil Aviation, and the European Aviation Safety Agency (EASA) to determine appropriate design changes to the A300-600 and A3l O. From these efforts, Airbus planned to develop a pedal travel limiter unit (PTLU) that addressed these recommendations. The PTLU modification was intended to reduce fin loads in case of excessive pilot rudder pedal inputs. On July 27, 2010, Airbus provided the FAA with a revised proposal, recommending visual and aural warnings in lieu of a PTLU. These warnings will activate in certain cases where the pilot reverses the rudder pedals and direct the pilot to release the rudder pedals. EASA, the certification authority of the A300-600 and A31 0, indicated support for the Airbus proposal. The FAA is currently reviewing this new design proposal to assess its expected efficacy and to determine whether or not it adequately addresses the safety concerns. In order to avoid additional delays while we evaluate the new Airbus proposal, the FAA intends to release an airworthiness directive mandating design changes to address the safety concern, using a method we approve. We will provide our final determination of the acceptability of the new Airbus proposal as part of that approval process. If the new alerting proposal is deemed inadequate, we will require that Airbus propose a different design change. I will keep the Board informed of the FAA's progress on these safety recommendations, and I will provide an update by April 2011.

From: NTSB
To: FAA
Date: 8/3/2010
Response: Notation 8216: On November 12, 2001, about 0916 eastern standard time, an Airbus A300-605R, N14053, operated as American Airlines flight 587, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Following an encounter with wake turbulence from a preceding Boeing 747 (747), the first officer made a series of full alternating rudder pedal inputs before the airplane’s vertical stabilizer and rudder separated in flight; both were found in Jamaica Bay about 1 mile north of the main wreckage site. The National Transportation Safety Board (NTSB) determined that the probable cause of the American Airlines flight 587 accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program (AAMP). The circumstances of the American Airlines flight 587 accident are similar to a more recent accident involving an Airbus model A319. On January 10, 2008, about 0848 central standard time, an Airbus Industrie A319, Canadian registration C-GBHZ, operated as Air Canada flight 190, experienced an in-flight upset after encountering wake turbulence from a 747 while climbing from flight level (FL) 360 to FL370. The flight crew declared an emergency and diverted the flight to Calgary, where it landed uneventfully. Of the 5 crewmembers and 83 passengers on board, 2 crewmembers and 8 passengers sustained minor injuries, and 3 passengers sustained serious injuries. Visual meteorological conditions prevailed, and an instrument flight rules flight plan was filed for the scheduled domestic passenger flight from Victoria International Airport, British Columbia, Canada, to Toronto Pearson International Airport, Ontario, Canada. The Transportation Safety Board of Canada (TSB) investigated this accident; the NTSB and Bureau d’Enquêtes et d’Analyses provided accredited representatives and technical advisors to the investigation. Data from the flight data recorder (FDR) indicate that, during the upset, the airplane experienced several roll and vertical load factor oscillations and lost about 1,000 feet of altitude. Although the autopilot was engaged during the start of the wake vortex encounter, after about 3 seconds, the autopilot was disengaged, and there was a series of large oscillatory inputs on the left side stick controller. In addition, the FDR recorded a series of three to four alternating rudder pedal inputs (right pedal, then left pedal) over the next 15 seconds. During these inputs, the airplane continued to oscillate in roll, reaching a maximum roll of 55º. At the same time, the recorded acceleration was also oscillating, with peaks of -0.46 G to +0.49 G of lateral load factor and peaks of -0.76 G to +1.57 G of vertical load factor. Because of the severity of the upset, following the emergency landing at Calgary, the airplane was grounded pending an inspection by Airbus engineers. During an extensive inspection, the vertical stabilizer was removed from the airplane and scanned ultrasonically to inspect for damage to the stabilizer’s composite components. No damage was found, and the stabilizer was reattached and the airplane returned to service. Although no damage to the stabilizer was found, an analysis of the accident performed by Airbus indicated that the rear vertical stabilizer attachment fitting sustained loads 29 percent above its design limit load. Simulation work performed by Airbus revealed that these high loads were primarily the result of the flight crew’s series of alternating rudder pedal inputs and were not the result of the wake turbulence. Information and animations provided by Airbus showed that if the pilots had not made any control inputs after the wake encounter, the airplane would have righted itself with minimum altitude loss and g-loading. Pilot Rudder Pedal Inputs, Yaw Axis Certification, and Rudder Pedal Sensitivity In both the American Airlines flight 587 and Air Canada flight 190 accidents, the vertical stabilizer limit loads were exceeded by a large margin as a result of the alternating full scale rudder inputs. The NTSB’s investigation of the American Airlines flight 587 accident revealed that the Airbus A320 airplane family, which includes the A319, and the Airbus A300/A310 airplane family both use a variable-stop rudder travel limiter, which mechanically limits available rudder pedal deflection as airspeed increases. Consequently, at high airspeeds, these systems require lighter pedal forces and smaller pedal displacements to obtain maximum available rudder than at low airspeeds. Investigation of the American Airlines flight 587 accident revealed that variable-stop systems produce dramatically larger aircraft responses to the same rudder input at higher airspeeds than at lower airspeeds, which can surprise a pilot and serve as a trigger for an aircraft pilot coupling (APC) event. As a result of findings from the American Airlines flight 587 investigation, the NTSB issued Safety Recommendation A-04-58, which asked the Federal Aviation Administration (FAA) to do the following: Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300 600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. In the same report, the NTSB issued a companion recommendation, A-04-63, to the French Direction Générale de l’Aviation Civile. On April 6, 2009, the European Aviation Safety Agency (EASA) indicated that Airbus is developing a reduced pedal travel limiting unit (PTLU). On March 19, 2010, EASA further indicated that “its previously held position on the pilot training out as being an efficient and sufficient measure to avoid any new hazardous situations has to be reconsidered following more recent service experience which confirms that crew use of rudder pedal inputs in upset encounters cannot be ‘trained out.’” EASA therefore indicated that it plans to require the PTLU on Airbus A310 and A300-600 aircraft models. The NTSB will consider how the proposed changes are responsive to Safety Recommendation A 04 58 when the FAA provides further details about the PTLU. In the report on the American Airlines flight 587 accident, the NTSB also issued Safety Recommendations A-04-56 and -57, which asked the FAA to do the following: Modify 14 Code of Federal Regulations [CFR] Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A-04-56) After the yaw axis certification standard recommended in Safety Recommendation A-04-56 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential [APC] after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-04-57) On March 1, 2005, the FAA indicated that the current standards governing the performance and design of yaw control systems may need to be redefined. The FAA added that it was evaluating the existing standards and conducting a study to identify critical rudder control system parameters and human interaction with those controls. The FAA further indicated that, based on the results of the study, it would determine whether the current standards need to be updated and would work with industry to develop rudder control standards. On August 3, 2005, the NTSB classified Safety Recommendations A-04-56 and -57 “Open—Acceptable Response.” The similarities between the Air Canada flight 190 and American Airlines flight 587 crewmembers’ responses to wake encounters indicate that the Airbus A320 family is also susceptible to potentially hazardous rudder pedal inputs at higher airspeeds. In both events, the vertical stabilizer limit loads were exceeded by a large margin as a result of the alternating rudder inputs. In the Air Canada flight 190 accident, the pilot applied three alternating rudder inputs and exceeded the limit load by 29 percent. In the American Airlines flight 587 accident, the pilot applied four full alternating rudder inputs; after the fourth input, the aerodynamic loads on the vertical stabilizer exceeded the vertical stabilizer’s ultimate design load (at about twice the maximum load), and it separated from the airplane. In a January 14, 2010, meeting, the FAA informed NTSB staff that the study of rudder control systems was complete and should be published in the first half of 2010. Furthermore, the FAA indicated that, as a result of the study, it may initiate rulemaking to revise certification standards for large airplane yaw control systems. The NTSB looks forward to the opportunity to review the results of the study and to further FAA action to develop yaw axis handling qualities standards as envisioned in Safety Recommendation A-04-56. The Air Canada flight 190 accident demonstrates that the need remains to revise the certification standards for transport-category aircraft regarding yaw sensitivity to rudder pedal inputs and that these revised standards need to be applied to current in-service aircraft. As discussed above, the Airbus A320 rudder control system design characteristics are comparatively similar to those of the Airbus A300-600 and A310 and may serve as a trigger for an APC event at high airspeeds. The NTSB believes that the yaw axis handling qualities standard envisioned by Safety Recommendation A-04-56 will preclude such characteristics. Further, the NTSB notes that, if the FAA had performed the review of existing airplane designs as asked for in Safety Recommendation A-04-57 to see if they meet new yaw characteristic standards developed for A 04-56, the FAA may have noted that the A320 airplane also needed increased protection from potentially hazardous rudder inputs at high airspeeds. Therefore, the NTSB reiterates Safety Recommendations A-04-56 and -57. Because of the FAA’s delay in responding to Safety Recommendation A-04-56, which asked the FAA to modify 14 CFR Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity, the NTSB is uncertain that the PTLU that Airbus is developing in response to A-04-58 will ensure that the A300/A310 airplanes will pass any yaw characteristic standards that the FAA develops. Because of the amount of time that has passed since the issuance of A-04-58 and the limited work that has been accomplished to date, the NTSB reiterates Safety Recommendation A-04-58. Pilot Training for Upset Recovery As a result of the Air Canada flight 190 accident investigation, on November 18, 2008, the TSB issued Aviation Safety Advisory A08W0007 D1 A1, “Pilot Training for Upset Recovery in Transport Category Aircraft,” to Transport Canada. In the advisory letter, the TSB noted that the accident “pilots were exposed to the material contained in the Airbus Flight Crew Operations (FCOM) No. 828/1” during Air Canada’s initial type training and recurrent ground school instruction every 24 months. However, although the pilots received upset training in the simulator, according to the letter, the training “concentrated on recovery from unusual attitudes in the pitch axis, with limited attention to proper rudder pedal usage during recoveries from large roll axis excursions.” The letter concluded by indicating that “Transport Canada may wish to communicate to transport category operators in Canada, the necessity to include roll scenarios in upset training and the appropriate use of rudder control during recoveries.” The NTSB has advocated upset recovery training since it issued Safety Recommendation A-96-120 on October 18, 1996, asking the FAA to do the following: Require 14 CFR Part 121 and 135 operators to provide training to flight crews in the recognition of and recovery from unusual attitudes and upset maneuvers, including upsets that occur while the aircraft is being controlled by automatic flight control systems, and unusual attitudes that result from flight control malfunctions and uncommanded flight control surface movements. On August 11, 1999, the FAA indicated that it was developing a notice of proposed rulemaking (NPRM) to revise 14 CFR Part 121, subparts N and O, to include training in recognition and recovery from unusual attitudes and upset maneuvers. However, by October 26, 2004, the FAA had not yet issued the NPRM and was unable to indicate when it would be published. Because of the lack of progress towards requiring air carrier pilots to participate in unusual attitude training, the NTSB reclassified Safety Recommendation A 96 120 “Open—Unacceptable Response.” On January 12, 2009, the FAA issued an NPRM titled “Qualification, Service, and Use of Crewmembers and Aircraft Dispatchers” to revise 14 CFR Parts 65, 119, 121, 135, and 142. The NTSB reviewed this NPRM and, on May 7, 2009, provided comments to the FAA. The NTSB noted that, in response to Safety Recommendation A 96 120, the NPRM includes training on recognizing and recovering from “special hazards,” which are sudden or unexpected aircraft upsets. The NTSB noted that this proposal would also include a requirement giving FAA principal operations inspectors (POIs) the authority to review and require changes to training programs that do not adequately address a special hazard. Lack of such authority was a concern identified during the American Airlines flight 587 accident investigation, in which the NTSB learned that the POI knew that aspects of the American Airlines training program had undesirable effects but lacked the authority to require American Airlines to change its program. In addition, the NPRM addresses recovery from loss of control due to airplane design, airplane malfunction, human performance, and atmospheric conditions. The “Upset Recognition and Recovery” section of the NPRM lists a number of items that should be covered, including noting that catastrophic damage may result from rapidly alternating full flight control inputs and that, on some airplanes, progressively lighter pedal forces and smaller pedal movements will command the maximum rudder deflection as speed increases. The NTSB notes that although this NPRM is responsive to Safety Recommendation A-96-120, it proposes requirements for Part 121 operators only; similar action for Part 135 operators will be needed before the recommendation can be closed. The FAA plans to issue the final rule in 2010. Early in its investigation of the American Airlines flight 587 accident, the NTSB determined that the first officer’s series of full alternating rudder pedal inputs resulted in excessive loads on the airplane’s vertical stabilizer and rudder, leading to their in-flight separation. As a result, on February 8, 2002, the NTSB issued Safety Recommendation A-02-01, which asked the FAA to do the following: Require the manufacturers and operators of transport-category airplanes to establish and implement pilot training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transport category airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training does not compromise the substance or effectiveness of existing training regarding proper rudder use, such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. On April 15, 2002, the FAA stated that it reviewed several Airbus operators’ training programs and found that none of the operators conduct training on the rudder in a way that could result in dangerous combinations of sideslip angles and rudder position. The FAA also indicated that it issued a notice directing POIs to notify their air carriers that sequential full opposite rudder inputs may result in structural loads that exceed those addressed by the 14 CFR Part 25 requirements; that the rudder limiter systems installed on most transport-category airplanes will not prevent sequential full opposite rudder deflections from damaging the structure; and that on some airplane types, full available rudder deflections can be achieved with small pedal movements and comparatively light pedal forces. The FAA stated that manufacturers would prepare and distribute to their operators flight technical operations bulletins that address the concerns of this recommendation. Finally, the FAA indicated that it was considering implementing the changes in the approved sections of the airplane flight manuals (AFM) of affected aircraft by the airplane manufacturers. On July 22, 2002, the NTSB responded that the FAA’s plan to use nonregulatory means to meet the intent of Safety Recommendation A-02-01 might represent an acceptable alternative; however, the NTSB would assume, until the FAA indicated otherwise, that the FAA would develop some regulatory changes in pilot training programs in response to Safety Recommendation A 02 01. Pending completion of changes to pilot training programs and the determination of whether these revisions will be implemented through AFM and technical operations bulletin changes or through regulatory changes, Safety Recommendation A-02-01 was classified “Open—Acceptable Response.” However, in the 8 years since the FAA’s April 15, 2002, letter, the FAA has not provided any additional information about its activities in response to Safety Recommendation A-02-01. The NTSB notes that the January 12, 2009, NPRM is partially responsive to the requirement to explain that catastrophic damage may result from rapidly alternating full flight control inputs and that on some airplanes, progressively lighter pedal forces and smaller pedal movements will command the maximum rudder deflection as speed increases. However, the FAA has yet to issue the final rule and respond to the first part of Safety Recommendation A-02-01, which seeks pilot training programs that explain the structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes. In its final report on the American Airlines flight 587 accident, the NTSB also issued Safety Recommendation A-04-59, which asked the FAA to do the following: Develop and disseminate guidance to transport-category pilots that multiple full deflection, alternating flight control inputs should not be necessary to control a transport-category airplane and, thus, should be avoided. In response to this recommendation, on October 25, 2005, the FAA issued Safety Alert for Operators (SAFO) 05002, “Multiple full deflection, alternating flight control inputs.” This SAFO urges directors of safety, directors of operations, fractional ownership program managers, and pilots of transport-category airplanes to (1) familiarize themselves with the location, availability, and content of the “Airplane Upset Recovery Training Aid” and (2) pay particular attention to the cautions against control reversals and pilot-induced oscillations that are repeated throughout the training aid. Following issuance of SAFO 05002, the NTSB classified Safety Recommendation A-04-59 “Closed—Acceptable Action” on June 9, 2006. The NTSB is concerned that, despite Safety Recommendations A-96-120, A-02-01, and A-04-59; FAA SAFO 05002; Airbus FCOM No. 828/1; and the wide distribution of the “Airplane Upset Recovery Training Aid,” pilots may still resort to unnecessary alternating control inputs—including rudder pedal inputs—in an attempt to control their airplanes during a perceived or actual upset, as evidenced by the Air Canada flight 190 accident. The actions taken by the FAA to date, including reviews by POIs, issuance by manufacturers of technical operations bulletins, and distribution of other guidance material, do not appear to have been effective in informing pilots of proper rudder use during upset recovery. Guidance in training aids cautioning against such control inputs and pilot-induced oscillations was not effective in preventing the Air Canada pilots from using alternating rudder inputs in an attempt to control their airplane. The NTSB notes that pilot training regarding rudder system sensitivity and structural certification requirements for the rudder and vertical stabilizer on transport-category airplanes would have provided the accident pilots with additional information about the specific hazard of alternating rudder inputs on these airplanes and the sensitivity of the A320 rudder system at high airspeeds. The actions of the Air Canada flight 190 pilots demonstrate that the need remains for the actions in Safety Recommendation A-02-01. In the 8 years since this recommendation was issued, the FAA has not taken the actions recommended. Therefore, the NTSB reiterates Safety Recommendation A-02-01 and reclassifies it “Open—Unacceptable Response.” Therefore, the National Transportation Safety Board reiterates the following recommendations to the Federal Aviation Administration: Modify 14 Code of Federal Regulations Part 25 to include a certification standard that will ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. (A-04-56) After the yaw axis certification standard recommended in Safety Recommendation A-04-56 has been established, review the designs of existing airplanes to determine if they meet the standard. For existing airplane designs that do not meet the standard, the FAA should determine if the airplanes would be adequately protected from the adverse effects of a potential aircraft-pilot coupling (APC) after rudder inputs at all airspeeds. If adequate protection does not exist, the FAA should require modifications, as necessary, to provide the airplanes with increased protection from the adverse effects of a potential APC after rudder inputs at high airspeeds. (A-04-57) Review the options for modifying the Airbus A300-600 and the Airbus A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300 600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds. (A-04-58) In addition, the National Transportation Safety Board reiterates and reclassifies as “Open—Unacceptable Response” the following recommendation to the Federal Aviation Administration: Require the manufacturers and operators of transport-category airplanes to establish and implement pilot training programs that: (1) explain the structural certification requirements for the rudder and vertical stabilizer on transport category airplanes; (2) explain that a full or nearly full rudder deflection in one direction followed by a full or nearly full rudder deflection in the opposite direction, or certain combinations of sideslip angle and opposite rudder deflection can result in potentially dangerous loads on the vertical stabilizer, even at speeds below the design maneuvering speed; and (3) explain that, on some aircraft, as speed increases, the maximum available rudder deflection can be obtained with comparatively light pedal forces and small pedal deflections. The FAA should also require revisions to airplane and pilot operating manuals that reflect and reinforce this information. In addition, the FAA should ensure that this training does not compromise the substance or effectiveness of existing training regarding proper rudder use, such as during engine failure shortly after takeoff or during strong or gusty crosswind takeoffs or landings. (A-02-01) The National Transportation Safety Board issued two safety recommendations and reiterated one safety recommendation (A 04 63) to the European Aviation Safety Agency.

From: NTSB
To: FAA
Date: 8/3/2005
Response: The Safety Board notes that a similar companion recommendation (A-04-63) was issued to the French Direction générale de l'Aviation civile (DGAC) and that the European Aviation Safety Agency (EASA) now administers, on behalf of France, the functions and tasks of the State of Design with respect to International Civil Aviation Organization Annex 8 in the field of airworthiness. The Safety Board further notes that the FAA, the DGAC, EASA, and Airbus met in February 2005 to discuss this recommendation. At this meeting, the design of the rudder control system was reviewed and a number of potential aircraft modifications were identified. Currently, Airbus is conducting further investigation to define the most suitable modification(s). After an authorities-only meeting, the FAA will define a detailed plan of needed modifications. Pending the recommended action, Safety Recommendation A-04-58 is classified "Open--Acceptable Response." The FAA previously indicated that it plans to respond to Safety Recommendation A-04-58 at the same time it responds to Safety Recommendation A-04-44 (issued as a result of the Board's investigation of an incident involving American Airlines flight 903), which addresses changing the rudder travel limiter system of the A300-600 and A310 model aircraft. On December 15, 2004, the Safety Board noted in its response to the FAA about Safety Recommendation A-04-44: the Safety Board does not believe it necessary to wait to assess other related recommendations before the FAA makes final decisions about any design modifications. The Board notes that this recommendation was issued because a safety issue in need of timely correction was identified; had it been appropriate to wait for the issuance of other related recommendations, we would have done so. The Board emphasizes that, in the letter transmitting Safety Recommendation A-04-44, we stated "The safety issues discussed in this letter were not a factor in the flight 587 accident, which involved an A300-600." The Board's position on the timing of action on these recommendations remains the same. Pending the FAA's taking the recommended action, Safety Recommendation A-04-58 is classified OPEN -- ACCEPTABLE RESPONSE.

From: FAA
To: NTSB
Date: 3/1/2005
Response: Letter Mail Controlled 3/17/2005 12:28:54 PM MC# 2050112 - From Marion C. Blakey, Administrator: The safety recommendation is identical to the one the Board issued to the Director General of Civil Aviation (DGCA). The FAA will work with the DGCA to provide a coordinated and consistent response to this safety recommendation. Additionally, the Board issued Safety Recommendation A-04-44 on May 28, 2004, that also relates to this safety issue. This safety recommendation recommends changing the rudder travel limiter system of the A300-600 and A310 Model aircraft. Consequently, the FAA will include this recommendation in its evaluation of Safety Recommendation A-04-58. In February 2005, the FAA will meet with Airbus, DGCA/EASA to review the existing A300-600/A310 rudder system and discuss possible improvements that address these safety recommendations. Subsequently, an authorities-only meeting will also be held to enable a coordinated and consistent FAA/DGCA position. The FAA will define a detailed plan of the modifications and actions required to address these safety recommendations once the meetings are completed. I will keep the Board informed of the progress on these safety recommendations.