Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-04-063
Details
Synopsis: On November 12, 2001, about 0916:15 eastern standard time, American Airlines flight 587, an Airbus Industrie A300-605R, N14053, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F. Kennedy International Airport, Jamaica, New York. Flight 587 was a regularly scheduled passenger flight to Las Americas International Airport, Santo Domingo, Dominican Republic, with 2 flight crewmembers, 7 flight attendants, and 251 passengers aboard the airplane. The airplane’s vertical stabilizer and rudder separated in flight and were found in Jamaica Bay, about 1 mile north of the main wreckage site. The airplane’s engines subsequently separated in flight and were found several blocks north and east of the main wreckage site. All 260 people aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces and a postcrash fire. Flight 587 was operating under the provisions of 14 Code of Federal Regulations Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident.
Recommendation: TO THE DIRECTION GENERAL DE L'AVIATION CIVILE: Review the options for modifying the Airbus A300-600 and the Airbus A3108 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds and, on the basis of this review, require modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds.
Original recommendation transmittal letter: PDF
Overall Status: Closed - Acceptable Action
Mode: Aviation
Location: Belle Harbor, NY, United States
Is Reiterated: No
Is Hazmat: No
Is NPRM: No
Accident #: DCA02MA001
Accident Reports: In-Flight Separation of Vertical Stabilizer American Airlines Flight 587, Airbus Industrie A300-605R, N14053
Report #: AAR-04-04
Accident Date: 11/12/2001
Issue Date: 11/10/2004
Date Closed: 2/4/2013
Addressee(s) and Addressee Status: European Aviation Safety Agency (Closed - Acceptable Action)
Keyword(s): Rudder

Safety Recommendation History
From: NTSB
To: European Aviation Safety Agency
Date: 2/4/2013
Response: On June 25, 2012, EASA published airworthiness directive (AD) 2012-0088, “Autoflight/Instruments – Stop Rudder Input Warning (SRIW) Device - Installation/Activation.” The AD requires the installation of the SRIW device on Airbus A300-600 and Airbus A310 airplanes. On September 7, 2011, EASA issued Proposed Airworthiness Directive (PAD) 11-098, from which AD 2012-0088 was developed. We have communicated with EASA as it reviewed the options for modifying these airplanes to provide increased protection from hazardous rudder pedal inputs. As EASA has completed the recommended actions, Safety Recommendation A-04-63 is classified CLOSED—ACCEPTABLE ACTION.

From: NTSB
To: European Aviation Safety Agency
Date: 1/11/2013
Response:

From: European Aviation Safety Agency
To: NTSB
Date: 12/19/2012
Response: -From John Vincent, Deputy Director for Strategic Safety, Executive Directorate: Airbus designed a Stop Rudder Input Warning device (SRIW). The SRIW is a rudder reversal detection and alerting system, which early detects - i.e. at first reversal - any potentially dangerous rudder doublet. Airworthiness Directive 2012-0088 published on 25 June 2012 mandates the SRIW.

From: NTSB
To: European Aviation Safety Agency
Date: 12/21/2011
Response: Thank you for the description of the Stop Rudder Input Warning (SRIW) system that Airbus has developed in response to this recommendation. We note that on September 7, 2011, EASA issued Proposed Airworthiness Directive (PAD) 11-098, which proposes to mandate installation of the SRIW system on in-service Airbus A300-600 and A310 airplanes. We also note from your July 27, 2011, letter that the United States Federal Aviation Administration (FAA) is performing an evaluation of the crew training aspects of the SRIW system. The NTSB is concerned that the pilot reactions to a wake turbulence encounter clearly demonstrate that pilot training—even with the addition of an enhanced warning system—may not be sufficient to adequately address the issue of potentially hazardous rudder pedal inputs at high airspeeds. The NTSB’s investigation of the AA587 accident documented that the response of the rudder system at high airspeeds on A300-600/A310 airplanes was different from what pilots would expect and that a pilot would not normally have experience using the rudder at high airspeeds. In our report on the accident, we noted the following: Tests were also conducted in which the subjects [pilots] were instructed to move the control wheel and rudder pedal to 50 percent of their available range. The tests showed that the pedal force applied during the 50-percent condition resulted in full rudder travel, even though that force was one-half of the force applied at the 100-percent condition. The tests also showed that the control wheel force applied during the 50-percent condition resulted in reduced aileron motion. We note that, in PAD 11-098, EASA states this: In addition, an international survey among a worldwide population of airline transport pilots, conducted in 2006 by the U.S. Federal Aviation Administration (FAA) together with the International Air Transport Association (IATA), and published end of 2010, discloses that the rudder is still reported to be used or considered for use by pilots in ways they have not been trained and in situations that sometimes contradict the guidance of the industry’s common Airplane Upset Recovery Training Aid. (emphasis added) A system— such as the proposed SRIW system—that relies on pilot training in combination with a warning system to address the safety issue of protection from potentially hazardous rudder pedal inputs at high airspeeds will need to ensure that pilots will respond appropriately to the warning, particularly when the rudder system is responding in a manner outside of a typical pilot’s flying experience. Our review of PAD 11-098 found that, although it specifies the modifications of the airplane to add the SRIW system, it does not include a requirement for flightcrews to be trained to recognize and respond to an SRIW warning. An appropriate flightcrew response is essential. An airplane upset is a high-workload, high-stress situation for the flight crew with little time available for an appropriate response. In the AA587 accident investigation, we found that it took approximately 7 seconds from the flying pilot’s initiation of alternating rudder pedal inputs to when the vertical fin separated. It is our understanding that EASA does not have the authority to require training that is associated with revisions required through an AD. Instead, EASA makes recommendations to the national aviation authorities, who possess the needed authority. We also understand that EASA is reviewing the training program associated with the SRIW that Airbus is developing, and that, when that review is complete, EASA will issue to these national authorities a notice/recommendation regarding this training program. Accordingly, the proposed requirement for the SRIW may be an acceptable alternate response to this recommendation provided that (1) EASA has evaluated the training aspects of the system and determined that the system will be effective in ensuring an appropriate flightcrew reaction to a warning and (2) EASA issues appropriate guidance to the national authorities regarding required flightcrew training. We ask EASA to describe the information provided by Airbus demonstrating that the SRIW proposed in the PAD will ensure an appropriate flightcrew response. Pending our receipt of that information and a mandate for modifications to the A300-600 and A310 to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds, Safety Recommendation A-04-63 is classified OPEN—ACCEPTABLE ALTERNATE RESPONSE.

From: European Aviation Safety Agency
To: NTSB
Date: 7/27/2011
Response: CC#201100306: Patrick Goudou, Executive Director: Thank you for your letter sent on 23 May 2011 and emphasizing the NTSB’s deep interest in the follow-up given on the accident to the Airbus A300-600 registered N14053 operated by American Airlines on November 12th, 2001. The Agency shares also your concern that pilots' training cannot alone be trusted as a sufficient response to the issue of pilots' commanded sequential opposite-rudder inputs (rudder reversals) on large transport-category aeroplanes. It is the reason why the EASA and Airbus reviewed several options for a design change to address that concern. As a consequence, the purpose of the design change to be implemented on Airbus A300-600 and Airbus A310 is to provide increased protection from potentially hazardous rudder pedal inputs at high airspeeds as requested in recommendation UNST-2004-063 (A-04- 63). Following the initial study of reduced pedal travel limiter unit for the A300-600 and A310, the Agency informed you in our letter dated January 14, 2011, that the development of a Stop Rudder Input Warning (SRIW) system was also alternatively evaluated. The SRIW system monitors rudder inputs and triggers flight deck deterring aural instructions, voiced by the message 'STOP RUDDER INPUTS', combined with Visual warnings (by means of red lights in the glare shield just above the Primary Flight Displays) as soon as one dangerous rudder doublet Is detected, thus preventing: a further increase of the aerodynamic loads on the fin. A thorough evaluation of this SRIW system is currently taking place and, as usual in the frame of a certification process and in line with the EU-US validation process, the FAA responsible authority in that matter, is fully involved; thus ensuring that the proposed change satisfies both parties. In addition to the certification exercise, an FAA evaluation of the crew training aspects has been retained prior introduction of the proposed modification into US-registered aeroplanes. In accordance with the framework on cooperation in the regulation of civil aviation safety, technical data is shared with the FAA who is also part of the tests validating the benefit as well as the non-regression. With regards to recommendations UNST-2010-119 (A-10-119) and UNST-2010-120 (A10-120), EASA is supporting the FAA study in order to determine whether and how existing certification standards could be revised. In parallel, following the A320 ACA190 wake vortex encounter at high speed, Airbus has completed an aircraft level evaluation of the single aisle design in terms of sustainable loads. Airbus is working with EASA on the definition of a design change that would provide increased protection from potentially hazardous rudder pedal inputs. Several design options are currently under feasibility study (warning, reduced rudder travel limitation unit, pedal travel limitation unit).

From: NTSB
To: European Aviation Safety Agency
Date: 5/23/2011
Response: EASA also wrote to the NTSB concerning this recommendation on March 19, 2010. At that time, EASA stated that its “previously held position on the pilot training out as being an efficient and sufficient measure to avoid any new hazardous situations has to be reconsidered following more recent service experience which confirms that crew use of rudder pedal inputs in upset encounters cannot be ‘trained out.’” At that time, EASA also indicated that Airbus had developed the reduced pedal travel limiting unit (PTLU), which provided significantly increased protection from potentially hazardous rudder pedal inputs across the flight envelope. EASA further stated that it planned to require installation of the PTLU on A300-600 and A310 aircraft. On August 4, 2010, largely as a result of the ACA190 event, the NTSB issued Safety Recommendations A-10-119 and -120 and reiterated this recommendation, requesting further details about the PTLU to enable us to fully evaluate whether requiring it would meet the intent of the recommendation. In its January 14, 2011, letter, EASA stated that it had received an overall engineering certification and embodiment program from Airbus that shows that the PTLU will take several years to develop, certify, and implement. Airbus has also proposed a new alternative that is aimed at de-coupling the types of pilot inputs that caused the AA587 accident by monitoring rudder input parameters and triggering flight deck visual and aural warnings, which would require the pilot to release the pedals. Airbus and EASA believe the warning system proposal requires a considerably shorter time for development, certification, and embodiment than is required for the PTLU. EASA indicated that it is evaluating the new concept and has started the certification process of the associated design change. Without being able to review the details of either the PTLU or the newer warning system proposal, the NTSB will have difficulty evaluating whether either will meet the intent of this recommendation, and we are concerned whether the type of warning system described can do so. In the AA587 accident, the captain provided a salient warning system when he asked the first officer, “You all right?” in the middle of his excessive inputs. The first officer replied, “Yeah, I’m fine,” and continued to input the excessive rudder pedal inputs that led to the separation of the vertical stabilizer. Such a situation happens so quickly, and involves such strong emotions, that the NTSB agrees with EASA’s March 2010 statement that crew use of rudder pedal inputs in upset encounters cannot be trained out. The NTSB believes that the pilot reactions to a wake turbulence encounter, discussed in the letter reiterating this recommendation and below, clearly demonstrate that training (even with the addition of an enhanced warning system) may not provide an effective response to the issue of potentially hazardous rudder pedal inputs at high airspeeds. The NTSB asks that EASA provide technical details of the system that it plans to mandate to address this recommendation. Pending EASA’s taking the action recommended, Safety Recommendation A-04-63 remains classified OPEN – ACCEPTABLE RESPONSE.

From: European Aviation Safety Agency
To: NTSB
Date: 1/14/2011
Response: CC# 201100047: - From Patrick Goudou, Executive Director: Thank you for your letter of 3rd August 2010 in response to EASA letters dated 19th March 2010 and 6th April 2010, in which EASA provided its position with respect to NTSB recommendation UNST 2004-063, addressing NTSB concerns about Potential Effects Following Inappropriate Pilot Rudder Pedal Inputs resulting from their investigation of the accident of Airbus A300-605R, registration N14053 on 12/11/2001 at New York. The NTSB reiterates Safety Recommendation A-04-63 and asks for further details about the PTLU. The NTSB has also raised in this letter 2 new Safety Recommendations to EASA (A-10-119 and A-10-120), which repeat recommendations previously made by NTSB to the FAA reference A-04-56 and 57. EASA notes the FAA initial response to A-04-56 and -57 in which the FAA indicated that the current standards in FAR Part 25 may need to be redefined and that it was evaluating these and conducting a study to identify critical rudder control system parameters and human interaction with those controls. EASA acknowledges that such a study is appropriate and we would be willing to work with the FAA to develop the research already conducted in order to determine whether and how existing certification standards could be revised. When the study concludes that Certification Standards need to be revised, a new task will be introduced in the EASA rulemaking programme and it will be developed following the usual rulemaking procedure, which includes a regulatory impact assessment to set the priority and schedule, and the best harmonisation with the FAA. At this stage it is worth noting that our general objective, when amending existing or developing new certification standards, is to identify clearly the safety objective to be met by the applicant and wherever possible to avoid making the standards too prescriptive. With this in mind, our general approach to this particular subject would be to consider the pilot, flight control and aircraft interactions, including the structural capability of the airframe to withstand an abuse case, rather than to focus too closely on specific parameters within an individual control circuit design. Regarding progress on the development of the reduced pedal travel limiter unit for the A300-600 and A310, EASA has received an overall engineering certification and embodiment programme from Airbus, which shows that such a solution will take several years to develop, certify and embody. Airbus has in parallel proposed a new alternative design which is aimed at de-coupling the pilot input. Airbus has included in its proposal a development, certification and embodiment plan which is considerably shorter than for the R-PTLU. The new design monitors rudder input parameters and triggers flight deck visual and aural warnings, which would reqUire the pilot to release the pedals, thus preventing an escalation of the coupling. EASA is carefully evaluating the new concept and has started the certification process of the associated design change, in coordination with the FAA. In respect of the A320 family, which is mentioned in the NTSB letter, EASA has previously acknowledged that there are some similarities between the Air Canada flight 190 event and the American Airlines flight 587 accident; both were triggered by a wake vortex encounter at high airspeed. It is however important to restate that the crew reactions were very different. In the AC 190 event the crew inputs combined side-stick and pedals were not aggressive whereas in the AA587 accident the crew reaction reflected the negative training from the AAMP. This difference indicates to us that if a crew is caught unaware in a wake vortex encounter there is a possibility that they would react by making control inputs, but they would not necessarily make repetitive aggressive inputs. Consistent with our approach to the rulemaking review, we have tasked Airbus with conducting an aircraft level evaluation of the A320 design to ensure that the design as a whole is robust enough to withstand such a low probability event.

From: European Aviation Safety Agency
To: NTSB
Date: 3/19/2010
Response: Letter Mail Controlled 4/20/2010 12:21:57 PM MC# 2100141 - From John Vincent, Head of Safety Analysis and Research, Executive Directorate, EASA: In order to address this Safety Recommendation, Airbus has analysed 5 possible architectures to modify the current rudder control system. The effects of these various architectures/designs of the rudder command have been evaluated and the conclusion of this study has identified a design change, named 'Reduced Pedal Travel Limiting Unit (PTLU)', which provides significantly increased protection from potentially hazardous rudder pedal inputs, across the flight envelope. Moreover, EASA recognises that its previously held position on the pilot training out as being an efficient and sufficient measure to avoid any new hazardous situations has to be reconsidered following more recent service experience which confirms that crew use of rudder pedal inputs in upset encounters cannot be "trained out". Therefore, based on the current Airbus evaluation of solutions, the 'PTLU' design change will be required on A310 and A300-600 aircraft models.

From: European Aviation Safety Agency
To: NTSB
Date: 4/6/2009
Response: Letter Mail Controlled 4/27/2009 9:20:29 AM MC# 2090263 - From John Vincent, Head of Safety Analysis and Research, Executive Directorate, EASA: The NTSB Safety Recommendation A-04-63 had been initially addressed to DGAC-France. EASA has taken over responsibility for this Recommendation and has carried on the work initiated by DGAC-France, following an agreement based on DGAC-France proposal (DGAC letter SFACT/N.AT/2004/4669). EASA confirms that the following actions have been taken, through the mechanism of DGAC-France Airworthiness Directives Nr: F-2000-137-305(B), F-2000-115-304R5, F-2001-467(B), F-2005-111R1. It is the view of the EASA that these measures have increased aircraft protection, as intended by the NTSB Safety Recommendation A-04-063. In addition, Airbus has analysed 5 possible architectures to modify the current rudder control system. The effects of these on the rudder have been evaluated through 9 scenarios, for each aircraft type (A310 and A300-600). These scenarios, defined as ‘speed/altitude’ couple, have been associated with different manoeuvres combining pedal reversals and roll inputs in various configurations (pedals/ control column coordination, anti-coordination, inputs frequency, etc.). The conclusion of this study has identified as a potential design improvement a changed referred to as ‘Reduced Pedal Travel Limiting Unit (PTLU)’, which provides increased protection from potentially hazardous rudder pedal inputs. However, the EASA considers that the main cause for the America Airlines (AAL) flight 587 accident has been established as unnecessary and excessive rudder pedal commands. The crew response has been linked to an airline training regime which has been abandoned in light of the investigation findings as it trained crews to improperly use rudder pedal inputs in response to upset events. In addition, Airbus is continuing to develop the ‘Reduced PTLU’ modification, and its implementation will be recommended. EASA supports this initiative, but in light of the above will not mandate the embodiment of this modification. In conclusion, EASA considers that existing actions as defined by the above listed DGAC-France Ads are sufficient to mitigate the risk of a similar event, and believes that the NTSB Safety Recommendation A-04-63 is adequately addressed.

From: NTSB
To: European Aviation Safety Agency
Date: 9/13/2005
Response: The Safety Board thanks EASA for informing us that since its establishment on September 28, 2003, EASA performs, on behalf of France, the functions and tasks of the State of Design with respect to International Civil Aviation Organization Annex 8 in the field of airworthiness. The Board notes that, at a joint meeting of the U. S. Federal Aviation Administration (FAA), Airbus and EASA, the design of the rudder control system of the A300-600/A310 was reviewed and a number of potential aircraft modifications were identified that are currently being analyzed. EASA indicates that Airbus will determine the most suitable modification(s). It is the Safety Board's understanding that after EASA sent its letter, during a June 9, 2005, meeting attended by the FAA, DGAC, and EASA, Airbus provided an update of the progress on these activities. The Board would appreciate learning of the results of this meeting and further details about the planned Airbus rudder system revisions. Pending the identification of appropriate modifications to the rudder control systems of Airbus A300-600 and A310 aircraft, and a mandate for these modifications, Safety Recommendation A-04-63 is classified OPEN -- ACCEPTABLE RESPONSE.

From: European Aviation Safety Agency
To: NTSB
Date: 3/10/2005
Response: Letter Mail Controlled 3/21/2005 3:01:43 PM MC# 2050115 - From Patrick Goudou, Executive Director: At a meeting with the US Federal Aviation Administration and Airbus the design of the rudder control system has been reviewed. A number of potential aircraft modifications have been identified. One potential modification comprises of moving of the yaw damper, and changes to the displacement / rudder pedal force characteristics of the aircraft control system. Potential modifications are being evaluated with respect to the lateral loads applied to the fin of the aircraft so that the loads remain within certification limits. Further investigations are being conducted by Airbus in order to define the most suitable modification(s). Airbus is to give an update of the progress on these activities that is scheduled for May 2005. We are at your disposal for additional information and will keep you informed of our progresses regarding action taken.