Aircraft Accidents and Lessons Unlearned XL: American Airlines 587

On November 12, 2001, American Airlines flight 587 (AA587), an Airbus A300-605R, registration number N14053, crashed in Belle Harbor, New York shortly after taking off from John F. Kennedy airport. Recorded as National Transportation Safety Board (NTSB) accident number DCA02MA001, the A300 lost its rudder and vertical stabilizer during climb; the aerodynamic loads caused the loss of both engines before impact. Just two months after the September 11, 2001, terrorist attacks, the accident was thought to be terrorism, a case for the Federal Bureau of Investigation, but when it was determined to be non-terrorism in nature the NTSB shortly took over the investigation. The accident report, AAR-04/04, was adopted on October 26, 2004, almost three years later.

The NTSB determined that, “… the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program (AAMP).”

This accident demonstrated the NTSB was ill-equipped for the technical and industry knowledge challenges of this investigation. This was my first major accident as an NTSB major accident investigator; I was also the only person in the NTSB who had, not only directly worked with composite materials (and I was no expert), but had worked the A300-600 series airliner. The NTSB’s Structures investigators’ inexperience with Composites was concerning; the Structures group should have pushed management for training on composites to better understand the important safety issues they eventually missed. Furthermore, analysis of Air Transat flight 961, A310-308 investigation, made it obvious how NTSB accident report AAR-04/04 did not capture the root failures that led to the AA587 accident.

Question: Could NTSB Board members, with no airline Operational or Technical experience, base a report’s conclusions on the insufficient skills of NTSB investigators long out of the industry? The Board Members faulted American Airlines’ AAMP, then placed full responsibility for AA587 on a qualified pilot with over a decade of Part 121 flight crew experience. According to AAR-04/04, 2.4.3 Summary, “First, the first officer had a predisposition to overreact [underline added] to wake turbulence encounters.” Who at the NTSB could speak to the FO’s ‘predisposition’; that the NTSB assumed the first officer (FO) was careless and unskilled? How did NTSB Board Members and investigators, lacking a career in piloting jet airliners, reach this embellished opinion of a professional they could not understand? Answer: Another captain, whose intentions were never questioned, said so. The FO had flown with this captain … four years earlier … on a B727 …  This captain was interviewed, stated his opinion, of the FO’s “… use of the [B727] rudder pedals was ‘quite aggressive’” (AAR-04/04 page 12).

What did this misdirection of a biased interview do? For one, this biased captain’s opinion placed blame on a professional – the FO – without proof. Second, the misplaced blame distracted attention away from the true cause, which in the case of AA587, was never determined.

What did happen? In 2003, the Allied Pilots Association, parties to the investigation, submitted their report to contradict the NTSB report. It stated, “And the Board found that the composite material used in constructing the vertical stabilizer was not a factor in the accident because the tail failed well beyond its certified design limits.” Did the NTSB physically test an A300 composite vertical stabilizer and rudder? During set-up for the structural tests, a lone A300 vertical stabilizer was found to be available in Asia. However, during shipping, the stabilizer came free of securing, left its pallet and fell overboard into the ocean. The test stabilizer became too structurally damaged and compromised with sea water. Instead, the NTSB was forced to resort to Finite Element Analysis (FEA), a computerized method for predicting how a product reacts to forces; and Progressive Failure Analysis (PFA), which uses C-one shell elements based on classical lamination theory to calculate the in-plane stress. In other words, the tests were accomplished without a static computer model to test on. But were these methods accurate?

No – for three reasons. First, when an aircraft is certified, structural stress exercises are accomplished, such as when the wingtips are bent upwards to see at what deflection the wings will snap, exceeding their physical limits. The manufacturer does not use a computer model for its products’ stress tests because the computer cannot duplicate the flaws unintentionally built into a product.

Second, the increased use of composite structures in aircraft components, such as all flight controls, was relatively new at the time of AA587. Industry mastered composites repairs – after – the composite aircraft were already in service … not before. Detecting composite material defects was an evolving science. Third, the NTSB did not have structural engineers with composite experience. Instead, the NTSB relied too heavily on Airbus to police their own product’s integrity.

What events occurred in the accident aircraft’s history? The accident aircraft, serial number (S/N) 420, was issued its airworthiness certificate on July 13, 1988 and it had flown for thirteen years before the accident. During the initial post-accident maintenance review, records showed that S/N 420 had ‘sat’ on its tail, overstressed the empennage.  This Maintenance Chairman’s Factual Report (MX Factual) should have recorded this. Aircraft ‘sit’ when a tail-heavy weight imbalance occurs, such as fuel in the stabilizer fuel tank. The tail could have struck the ground with great force, enough to damage the vertical stabilizer mounts or rudder hinges. Fact: an aircraft is not designed to ‘sit’; undetected structural flaws could form within the composite layers of components. Did such damage occur to S/N 420, the accident aircraft?

S/N 420 also had nine vertical stabilizer and/or rudder modifications (MX Factual page 12). Could any or could all of the nine modifications have introduced damage within the composite layers? Why did the NTSB fail to give structural integrity proper attention? Did the NTSB give full attention to the composite inspection programs, not only of American Airlines, but of all A300 operators? Where the AAR-04/04 investigation failed, the Transportation Safety Board of Canada (TSBC) accident report A05F0047, Air Transat flight 961 (AT961), found answers.

On March 6, 2005, AT961, an A310-308, was at Cruise approaching 35,000 feet of altitude (by contrast, AA587 was below 2000 feet and at Climb) when AT961’s rudder separated from the vertical stabilizer. The TSBC did not waste resources creating easy solutions, such as wake turbulence or pilot error. Instead the TSBC investigated structural integrity of the vertical stabilizer, the attach points for the rudder and maintenance programs that inspected the composite components’ integrity and the effects of various harmful agents, such as water/ice, deicing practices and chemicals.

The TSBC embarked on an in-depth series of structural examinations, in some cases using sister rudders designed and built to the same specifications as the separated rudder. The TSBC went beyond tests conducted by the manufacturer at rudder certification, such as static load, fatigue, damage tolerance and flutter tests. They thoroughly examined the rudder maintenance inspection program; subjected the test rudders and original vertical stabilizer to chemical and contamination tests, elasticity laminate tests, impact damage testing and bonding tests. The TSBC understood that composites, in relation to the industry, was a young science and that there was much to be learned, much to improve upon.

Where the TSBC exceeded the NTSB in report writing can still be seen in investigations today. For instance, the investigatory methods employed in the 1960s did nothing when investigating the B737-MAX accidents; the use of unqualified/inexperienced investigators and outdated investigatory practices brought the industry no closer to safety with the B737-MAX and only allowed the unsafe practices at Lion Air and Ethiopian Air to continue unimpeded.

Meanwhile it was hoped that Airbus, knowing that AA587 received a less-than-adequate investigation, took it upon itself to build integrity into its composite products, increased the quality of maintenance structural inspections/testing and learned what was ignored during the AA587 investigation. Despite the errors of AAR-04/04, Industry learned; operators of Airbus products (and Boeing products) learned what was missed with AA587: how to design an aircraft to operate for its lifetime with some newfound safety built in. Hopefully, someone took the initiative to get it right.