March 26, 2004 – by Victor Trombettas
What we are reporting in this article will be of interest to
both schools of thought regarding American Airlines Flight 587
(FL587): the majority school – those who believe tail separation
was the cause of the crash, and the minority school – those
who believe that some other initiating event may have doomed FL587
and led to the subsequent loss of the tail and engines.
As mentioned in our February 23rd article, we continue to work on an article that will outline our findings, concerns, and conclusions at this point in the official FL587 investigation. We have found that many questions have gone unanswered and many areas of investigation remain unexplored; but what is known paints a much different picture than the one portrayed by the official investigation.
In this article we focus on another NTSB investigation of an Airbus accident from several years ago – the lessons learned from that investigation – and how those lessons shed light on FL587.
Four years before FL587 plummeted into Belle Harbor in Queens, NY, another American Airlines A300-605 was involved in a near-crash near West Palm Beach, FL, on May 12, 1997. This summary of Flight 903 (FL903) comes from the NTSB's accident database:
Aircraft: Airbus Industrie A300B4-605R, registration: N90070
Injuries: 1 Serious, 1 Minor, 163 Uninjured.The flight was assigned an airspeed of 230 knots (kts) and cleared to descend from 24,000 to 16,000 feet in preparation for landing at Miami. The FDR (Flight Data Recorder) indicated that while the autopilot was engaged in the descent, the power levers moved from the mechanical auto-throttle limit of 44 degrees to the manual limit of 37 degrees. As the aircraft leveled at 16,000 feet the airspeed decreased. The F/O (First Officer) began a right turn to enter a holding pattern and added some power, which stabilized the airspeed at 178 knots. However, the right bank and the resultant angle of attack (AOA) continued to increase, despite left aileron input by the autopilot. As the autopilot reached the maximum input of 20 degrees, bank angle increased past 50 degrees, and the AOA increased rapidly from 7 degrees to 12 degrees. At this point the stick shaker activated, the autopilot independently disconnected, the power was increased, and full left rudder was used to arrest the roll. The bank angle reached 56 degrees, and the AOA reached 13.7 degrees at 177 knots. The aircraft then pitched down, and entered a series of pitch, yaw, and roll maneuvers as the flight controls went through a period of oscillations for about 34 seconds. The maneuvers finally dampened and the crew recovered at approximately 13,000 feet. One passenger was seriously injured and one flight attendant received minor injuries during the upset. According to wind tunnel and flight test data the A300 engineering simulator should adequately represent the aircraft up to 9 degrees AOA. Unlike the accident aircraft; however, the simulator recovered to wings level promptly when the lateral control inputs recorded by the FDR were used. The roll disagreement between the simulator and accident aircraft began at 7 degrees AOA, and it appears that some effect not modeled in the simulator produced the roll discrepancy. Just prior to the upset the accident aircraft entered a cloud deck. The winds were approximately 240 degrees, 35 knots, and the ambient air temperature was approximately minus 4 degrees C. An atmospheric disturbance or asymmetric ice contamination were two possible explanations considered, but unproven.
The National Transportation Safety Board determines the probable cause(s) of this accident as follows:
The flight crew's failure to maintain adequate airspeed during level-off which led to an inadvertent stall, and their subsequent failure to use proper stall recovery techniques. A factor contributing to the accident was the flight crew's failure to properly use the auto-throttle.
USA Today also provided some FL903 coverage, as it related to the FL587 investigation, at:
http://www.usatoday.com/news/nation/2003-05-26-a-cover_x.htm
The USA Today article slightly exaggerated the damage found on FL903's tail; the tail was not "cracked" – there was some subsurface delamination – disbonding – in the right rear attach point (lug); there are six such lugs. This lug was still secured to the pin and to the fuselage clevis. Visual inspections did not reveal this damage – but ultrasound scans did. Airbus tests concluded that this damaged composite lug was still capable of supporting 1.75 times the design limit. See Exhibit 1:
Exhibit 1 - The damage to FL903's right rear tail lug
USA Today provided an animation of the FL903 event at: http://www.usatoday.com/news/graphics/g903/flash.htm
To better grasp the significance of FL903 as it relates to FL587, it is important to also view the NTSB's excellent animation of FL587 at:
http://www.ntsb.gov/events/2001/AA587/anim_587.htm
(at this NTSB page above – scroll down and click on the link for "Accident Reconstruction"; the relevant time frame on the FL587 animation is at 9:15:51 A.M, when the Pilot of FL587, First Officer Sten Molin, began his maneuvers; the tail allegedly separates 7.5 seconds later). What is obvious in viewing these two animations, is how much more severe the FL903 event was.
As revealed at the FL587 Hearings in October 2002, Airbus was aware (in 1997) that the rudder reversals by the FL903 Pilot (the rudder swings from side to side) had placed loads on the tail of that aircraft that approached or exceeded the "ultimate load". Airbus failed to bring this to the attention of the NTSB or the FAA in 1997. Had they done so, former and current NTSB investigators believe the crash of FL587 may have been prevented since the NTSB would have had the chance (in 1997) to warn of the dangers of rudder reversals. Airbus maintains that they made a good faith effort to raise these concerns but there is no evidence at all that this was done.
In light of these revelations at the Hearings, this question should have been asked – "why didn't Airbus share the information that rudder reversals could produce catastrophic loads on a tail?" There had to have been a motive for Airbus not to do so. We'll get to that question later in this article. First, some more background:
(In their FL903 submission to the NTSB in 1998 Airbus stated: "Rudder reversals such as those that might be involved in dynamic maneuvers created by using too much rudder in a recovery attempt can lead to structural loads that exceed the design strength of the fin and other associated airframe components." However, their submission never specifically stated that the rudder reversals on FL903 did create near-catastrophic loads on the tail.)FL587 Investigators, preferring anonymity, had commented to U.S.Read that if not for the fact that FL903 was flying at a slower speed than FL587 was, FL903 would have also lost its tail and crashed.
However, after examining the FL903 performance data, it was obvious that not only had FL903 attained the same speed as FL587, but had in fact surpassed it, while continuing to experience high deflection rudder reversals. You can download the Airbus pdf file "Summary of Airbus Loads Analysis for AA903" from U.S.Read at:
http://usread.com/flight587/coverups_n_foulups/242339.PDF
Other items of interest began to emerge (from this Airbus document):
1. The 46 second mark (19 minutes and 46 seconds after the hour) of the FL903 event provided an excellent comparison with the moment on board FL587 that the NTSB believes the tail broke off (at 9:15:58.5 A.M. – the time of the "loud bang" on the CVR). FL903 data in our table below (Exhibit 2) also matches data from the FL903 Digital Flight Data Recorder (DFDR) Factual Report ("RTLU" below represents Rudder Travel Limitation Unit, a.k.a., "Rudder Limiter"):
Exhibit 2 - FL587 at assumed time of tail separation compared with FL903
Altitude Speed Bank Angle Sideslip Filtered Rudder deflection (right) Lateral g's FL587 2,534 250 kts 8 deg. (right) 9 deg. (nose left) 6.3 deg. (RTLU @ 9.3 deg.) -0.38 FL903 13,195 264 kts 50.27 deg. (left) ~11 deg. (nose left) 14.8 deg. (RTLU @ 7.5 deg. exceeded by 97%, or more) -0.55 In addition to traveling at a faster speed FL903 also appears to have experienced a much higher filtered rudder deflection to the right than FL587 – well beyond the rudder limiter or RTLU (the system designed to restrict rudder movements at higher speeds to prevent overload on the tail).
Why the loads on FL587 were significantly higher (according to Airbus and the NTSB) is unclear, and perhaps these and all loads calculations related to both flights need to be independently reviewed. One factor that could account for the difference is the less dense air FL903 was flying through at 13,000 feet compared with FL587 (at 2,500 feet).
What were the loads experienced by FL903's tail at this moment? Strangely, that information was redacted by Airbus in the "Loads Analysis for AA903" file (see pages 10 & 11 of this file), with the captions, "No DFDR Recording", and "doubtful" (see Exhibit 3 below). At the FL587 Hearings, Airbus witnesses stated that the FL903 loads at these times were "unreliable".
Exhibit 3 - The loads calculations redacted in 2002 (the redacted areas are covered by the pink bars)
2. Given that the Airbus charts in this file clearly showed that there was DFDR data for the 46 second mark (see Exhibit 4 below), then there should be some reliable loads calculations behind Airbus' redaction.
Exhibit 4 - Rudder position data during FL903 upset event; there is rudder data at the 46 second mark
Through the use of unique software, U.S.Read was able to look through the redaction to see the load calculations (see Exhibit 5):
Exhibit 5 - The Loads Calculations for the entire FL903 event
In Exhibit 5, the thin red lines indicate the bending loads experienced by FL903's tail. The horizontal dashed green lines indicate the limit load or design limit. The horizontal blue lines represent the ultimate load – which is 1.5 times the limit load or 1.5 LL.
Airbus estimated that the loads at the 46 second mark were at ultimate load – which seems low when compared with FL587 (in Exhibit 2 above).
But these loads calculations for FL903's tail did show that:
3. Design limits (limit load) were exceeded 7 times during the event.
4. Ultimate loads were reached or exceeded 4 times.
5. Most surprisingly, the rupture point was reached or exceeded at the 38 second mark with a bending load of at least 2.1 LL based on the exhibit above. That is 13% percent higher than the load on FL587's tail when it allegedly broke off.
The Airbus charts in the "Loads Analysis" file also showed:
6. Lateral g loads recorded by FL903's DFDR (side-to-side forces) reached as high as -0.75g, twice as high as FL587's lateral load when the NTSB assumes the tail separated (-0.38g).
In addition, the lateral loads on FL903 exceeded FL587's highest pre-tail-separation lateral loads (-0.38g) a total of 7 times.
7. The vertical g loads on FL903 reached as high as 2.84g, exceeding FL587's highest pre-tail-separation vertical load (1.1g) a total of 8 times.
According to the NTSB, FL587's engines appear to have separated when the lateral accelerations reached 0.8g, the vertical accelerations were 2.1g, and the aircraft's speed was at 268 knots.
Consider FL903 – at the 39 second mark it's lateral g's were -0.75, the vertical g's 2.22, and the aircraft's speed was at 260 kts, about the same as FL587 and the engines and pylons were not compromised on FL903.
The combination of those g's forces on FL587:
a. is one factor for the NTSB assuming that the tail had already departed. Yet FL903 experienced the same g forces and we know the tail was present and the rudder fully functional.
b. is why the engines allegedly ripped off of FL587 yet FL903 did not lose even one engine. (U.S.Read not only disagrees with the NTSB as to when the tail departed on FL587, but we believe the evidence is equally convincing that the engines departed later in the crash sequence as well).
8. The Pilot of FL587 reversed the rudder 4 times, whereas the Pilot of FL903 reversed the rudder 9 times.
9. The FL903 rudder limiter was exceeded at least 3 times based on the non-redacted portions of the Chart (to determine the limiter range we referred to this Airbus/NTSB document: http://www.ntsb.gov/events/2001/AA587/exhibits/241835.pdf and the FL587 Aircraft Performance Report at: http://www.ntsb.gov/events/2001/AA587/exhibits/242470.pdf).
Notably, Airbus made no mention of the FL903 Rudder Travel Limitation Unit (RTLU) failure on this chart, or any other document.
10. On FL903, at the 24 second mark, the aircraft was at a speed of only 189 knots, yet the ultimate loads were reached during the second rudder reversal.
11. There were two redacted portions of the Airbus charts that stated "no dfdr recording". This implied that the parameters displayed on the Airbus' charts (such as rudder position, etc.) were unavailable because the DFDR had not recorded them during those two periods of time, totaling approximately 13 seconds. It was widely known that the FL903 crew experienced a 4 second blackout of the cockpit displays (due to a known, now corrected, issue with SGU resets under high roll rates – SGU stands for Symbol Generator Unit) but could the FL903 DFDR Factual Report shed any light on Airbus' claim of "no dfdr recording"? We'll get to that shortly.
The evidence shows that FL903 suffered more severe lateral loads and more severe bending forces on the tail than FL587 did. Thankfully, FL903's tail did not break off. But the following questions arise:
• Why didn't the tail break off? Why wasn't there more damage to the right rear lug? Why wasn't there any damage to any of the other five main lugs? If the FL903 loads calculations are accurate – the tail should have shown more damage, if not broken off.
• Why didn't the engines break off? Not only did FL903 suffer tremendous lateral accelerations but the roll rates were exceptionally severe as well as the vertical g forces. Flight 587 wasn't even in an upset when the tail allegedly departed, and, according to the NTSB, FL587 lost both engines when it had yet to experience the severe loads and roll rates that FL903 experienced. Why did FL587 literally fall apart when FL903 held together so well?
Many experts will react to this and say that FL903 was simply fortunate. But because FL903 survived – lessons that could have been learned from that event were not.
An independent group of Airbus Pilots has pointed out that FL587, registration N14053, suffered a severe upset in 1994 that injured 47 passengers. It is possible that upset created damage on FL587's tail that proved deadly on November 12, 2001. The NTSB counters this by stating that FL587's tail did not break off until it had exceeded the ultimate load by a large margin (1.9 LL). Even if there was some delamination in the tail – the tail performed as good as new. If that's true, how did FL903's tail endure higher loads? Was its tail better than new after several years of wear and tear?
Many of U.S.Read's contributing aviation experts respond to this FL903 / FL587 performance comparison and say that this proves that either there was something wrong with the tail on FL587 that doomed it prematurely or there was something else that had occurred on board FL587 which caused the crew to lose control. The tail separation may have been a consequence, not the cause of the crash.
U.S.Read will outline in our upcoming update some evidence we believe suggests the tail on FL587 survived beyond the point where the NTSB assumed it separated. That it survived beyond the point where the DFDR stopped recording, and didn't separate until several seconds later when the "flash" and large vapor/smoke trail appear in the tollbooth video.
What is important is that Airbus and the NTSB believe the tail departing FL587 was the cause of the crash. And this makes the FL903 event very relevant to FL587. But it's not only the performance of the airplanes that is noteworthy – the performance of Airbus and the NTSB can also provide us with troubling insight.
Let's move onto our earlier question: "could the FL903 DFDR Factual Report shed any light on Airbus' claim of "no dfdr recording?"
The narrative portion of the FL903 DFDR Factual Report (a 102 page report prepared September 1997, less than 4 months after the accident) mentioned the SGU reset and the 4 second blackout of the cockpit displays. It made mention of a few DFDR data dropouts after the SGU reset but each one of those data dropouts was approximately 3/16ths of a second in length. Not 5 and 8 seconds as Airbus implied. The DFDR Report also includes the plots of many DFDR parameters and dozens of pages of DFDR tables.
A review of the full DFDR tables revealed this fact: there was no blackout of DFDR data. There were no periods where there was "no DFDR recording". A FL587 Investigator, speaking with U.S.Read on condition of anonymity, stated "there is data".
Below is a picture from the DFDR table covering the time frames that Airbus said did not contain any DFDR recording (Exhibit 6).
Exhibit 6 - from the FL903 DFDR Factual Report
Is it possible something so erroneous would have been submitted by Airbus into the official record of a federal investigation (the FL587 investigation)? Is it possible the NTSB would let Airbus submit something materially incorrect into the record – especially since these documents were submitted to the NTSB weeks, if not months, before the Hearings with ample time to confirm accuracy?
Upon further review of the DFDR tables, including the time portions redacted in the Airbus FL903 Loads Analysis charts, we noted some rather shocking information:
1. At the 18 and 24 seconds marks, with the aircraft flying at a speed of 183 to 189 kts, the rudder deflections (both to the left) were higher than the Airbus chart (Exhibit 4 above) indicated. These two rudder movements were as high as 27.6 degrees – with the rudder deflection at the 24 second mark apparently exceeding the RTLU by at least 15%, perhaps more. The tail's ultimate loads were reached at this point 24, with the aircraft at only 189 kts, at least 80 knots below the maneuvering speed – the speed at which full application of flight controls is supposed to be safe. This highlights the danger of rudder reversals, but also the critical importance of the RTLU. The ultimate load would not have been reached had the RTLU not been exceeded.
2. At the 35 second mark, with the aircraft having accelerated to somewhere between 223 - 236 kts, the rudder was at 25.48 deg. left, approximately 66 percent beyond the RTLU's expected limit (of approximately 15 degrees).
If even remotely accurate, this DFDR data means the Pilot of FL903 was getting much more rudder control than he expected during his effort to recover from the stall. And yet all the blame was placed on him for his poor recovery techniques.
3. At the 36 second mark, the Pilot begins reversing rudder again. We are no longer in the redacted portion of the Airbus charts but there is an inaccuracy in the Airbus chart (Exhibit 4) – it shows the rudder (at the 38 second mark) at 18 or 19 degrees right – the DFDR tables show a deflection of 22.87 degrees (at 239 kts). This exceeds the RTLU's expected limit (approximately 13 degrees) by 75%, and this is when the loads on the tail reach 2.1 LL.
Flight 587 Investigators confirmed to U.S.Read that there was FL903 DFDR data for those periods of time that Airbus' had stated there was no data. The DFDR data was sufficiently reliable that it was used by the NTSB in 1997 in computer simulated recreations of the flight, and was evidence enough to Airbus and the NTSB that the Pilot had employed inappropriate recovery techniques (didn't get the nose down, used too much rudder).
Also confirmed to U.S.Read was that the FL903 RTLU did fail with the rudder substantially exceeding the expected limits. In fact, the expected rudder limiter points had been exceeded at least 6 times during the event. A U.S.Read review of the highest deflection points during the upset event, compared with the publicly available RTLU specs, shows that the RTLU was probably exceeded 9 times. American Airlines discusses the FL903 RTLU performance in their recent FL587 Submission to the NTSB.
This all led to the FL903 tail being exposed to tremendous loads several times during the event. This also meant the Pilot received far too much rudder authority which exacerbated the "upset" event and his attempts at recovery.
Finally, also confirmed to U.S.Read (and mentioned in the American Airlines' report) is the fact that Airbus withheld all this information (the RTLU failure, the tremendous loads on the tail) from the parties to the investigation including the NTSB and the FAA.
The fact the FL903 RTLU limits were exceeded several times answers the question, "why didn't Airbus share the information that rudder reversals could produce catastrophic loads on a tail?"
Had Airbus, in 1997, chosen to surrender what they knew about the loads experienced by FL903, it would have led to the discovery that the RTLU had failed.
Airbus chose not to open the door to this level of inquiry and discovery, so they kept quiet. And the NTSB failed to ask the right questions.
If you viewed the USA Today FL903 animation you may have noted that the narrator said (based on information they received from the NTSB) that the Pilot applied "too much rudder". As late as 2003 (when that animation was developed), we were still getting an inaccurate picture of what had happened to FL903.
The other half of the truth is that the Pilot's trust in the RTLU was in vain – it gave him too much rudder (higher roll rates) – and almost cost him and 164 other souls their lives.
Besides the cover-up of a serious safety issue, it is appalling
how well Airbus played out the FL903 investigation. They stressed
to the NTSB that had the Pilot of FL903 not used so much rudder,
as he had been (allegedly) trained to do by American Airlines'
overemphasis on rudder use, but instead focused on getting the
plane's nose down, the event would have been shortened, less severe,
and recovery achieved sooner. This influence on the NTSB made
it into the NTSB's probable cause statement: "their (the
crew's) . . . failure to use proper stall recovery techniques."
Aviation experts approached with these findings firmly believe Airbus knew, in 1997, how the RTLU performed on FL903 but preferred to dump all the blame on the Pilot and maintain secrecy about a serious malfunction.
Airbus then chose a strategy of emphasizing and stressing to the airlines that rudder use should be de-emphasized in pilot training, but they never came out in full force saying that rudder reversals could expose the tail to dangerously high loads; they didn't even use FL903 as a case study. They didn't update their manuals which for one maneuver suggested that a Pilot place an aircraft into "alternating sideslips" to unstick the landing gear. Had Airbus drawn too much attention to FL903 they would have risked exposing the RTLU failure.
Airbus and the NTSB may still claim the FL903 DFDR data, though present and readable, is "unreliable."
The NTSB's FL903 DFDR Factual Report, however, did not state that the data was unreliable. The NTSB plotted graphs from that data, they printed all the DFDR tables, and the Aircraft Performance Group ran simulations from that data in search of a weather anomaly or an icing condition. They also used the data to analyze – and criticize – the recovery techniques of the Pilot.
The FL903 Aircraft Performance Report does raise some general questions regarding DFDR reliability, including the effects of the serious upset event on the DFDR. However, some of those same concerns have been raised by the NTSB in the FL587 investigation. Airbus can't have it both ways – if they raise reliability issues about FL903's DFDR, then those same concerns apply to FL587.
What cannot be denied by Airbus is that they knew in 1997 how dangerously high the loads on FL903 had been and they withheld this information from a federal investigation, neither did they disclose the dangers of rudder reversals or the failure of the RTLU. A retired NTSB Investigator and a FL587 Investigator both called this behavior "a crime". The very fact Airbus decided not to come forth with all this info is proof alone that the DFDR data was sufficiently reliable as to create problems for them.
Going forward, it should be an NTSB requirement that any charts or graphs generated always show the limits of the RTLU. The RTLU was not charted by Airbus in their FL903 Loads Analysis document in 2002. The NTSB should have asked for it.
USA Today had reported that at least one American Airlines official, Paul Railsback, flight operations managing director, was very concerned about the loads that the rudder movements on FL903 may have placed on the tail, and urged immediate changes in American's pilot training. But American Airlines did not have access to Airbus' loads assessments and/or calculations and therefore did not know just how severe the event had been.
U.S.Read asked Airbus if indeed there was "no DFDR recording" and their answer was that there was "no data recorded during the times the charts are redacted". U.S.Read informed Airbus that the DFDR tables generated in 1997 were complete, with no time gaps, and we asked Airbus for clarification. Airbus did not respond to that question or any of our follow-up questions.
When asked by U.S.Read if the Airbus' statement "no dfdr recording" was accurate, the NTSB's Public Affairs Office stated, "you have the data, so why are you asking us if it's there or not?" The NTSB has yet to respond to any of our FL903 questions including questions about the reliability of Airbus' submissions to the FL587 docket and if those submissions have been reviewed, corrected, and independently confirmed.
Further evidence of Airbus submitting inaccurate or intentionally misleading information about FL903 into the FL587 docket is the document "Airbus Vertical Tail High Loads in Service Events" (Exhibit 7-Q in the FL587 docket). You can download this pdf document by clicking the exhibit 7 image below.
In this document, page 5, FL903 is listed as one of the top three high load events (shown as the "May 1997" event) experienced by Airbus airplanes (see U.S.Read Exhibit 7 below):
U.S.Read Exhibit 7 - Airbus High Loads in Service Events
In addition to repeating their "no dfdr recording" statement, Airbus makes three other inaccurate statements – all significant:
(1) The document grossly understates the speeds at which the May 1997 (FL903) event occurred. This document shows speeds of 190 - 230 kts when it is known from other docket submissions and from the 1997 FL903 DFDR report that the speeds were 178 - 268 kts. This is significant given that FL587's tail is believed to have separated at a speed of 250 kts.
(2) Airbus stated that there were "several rudder doublets (reversals) to TLU during the recovery". This is also misleading as it implies the rudder traveled to the TLU (The Rudder Travel Limitation Unit or RTLU, as we have referred to it) but not beyond. As we've shown, this is patently false. The statement should have read "several rudder doublets beyond the TLU."
(3) The maximum load experienced by the tail was listed as 1.5 LL. That is also misleading. The loads at one point had reached or exceeded rupture point (2.1 LL – higher than loads FL587 experienced).
American Airlines has revealed in their official submission
to the NTSB that Airbus informed the NTSB of the FL903 RTLU failure in
July 2002 – no less than 3 months before
the FL587 Hearings. Why didn't the NTSB make any references anywhere
about this? How did they permit Airbus to slip false information
into the docket?
One FL587 Investigator admitted to U.S.Read that the NTSB "did a bad job on the FL903 investigation".
Where the NTSB continues to lose credibility, is how they have kept quiet since 2002 when they learned that FL903 experienced loads beyond ultimate load and that the RTLU failure was a large contributor to those loads. The NTSB stood by while Airbus spun the "reliability" of the FL903 loads calculations and the DFDR readouts in the official docket and at the FL587 Hearings. In fact, it appears they have eased the way for Airbus, these last two years, to continue to conceal the RTLU failure. No more – American Airlines has publicly mentioned this fact in their recent submission to the NTSB.
In February 2002, less than 90 days after the crash of FL587, the NTSB, in the form of new safety recommendations, rushed to inform the flying community that rudder reversals can place potentially deadly loads on a tail. But something was missing then, and is still missing today. The NTSB has not shared the full lessons that might be learned from FL903. They too have treated this all as a pilot training issue: pilots not reversing rudder, and pilots being careful to not use too much rudder (which is almost impossible to do especially in an upset, given that available pedal travel becomes very small as airspeed increases – this makes it nearly impossible for a pilot to modulate a rudder deflection).
A lesson the flying community might learn from FL903 is that if they get into an upset – just when they might need the rudder most to help them "recover" – the RTLU may fail for as yet unexplained reasons (by "fail" we mean a failure to keep the rudder travel to its theoretical limit) and they may get too much rudder travel. This would of course place even more loads on the tail at a time when loads are already higher than normal due to the fact that they are in an upset.
Shouldn't the NTSB have raised this all-important issue as a new safety recommendation after they learned of it? Even if not to issue a safety recommendation – at least to inform the pilot community that this issue of RTLU failure had been recently discovered, and was being investigated by them and that in light of these concerns Pilots should not only be careful about avoiding rudder reversals but understand that even a single rudder deflection might place excessive stress on the tail if the RTLU is not functioning properly?
Had the NTSB done this in 2002, it would have exposed their
failure to spot the RTLU failure in 1997. Perhaps this explains
their silence? If they didn't learn about FL903's RTLU problem
until the summer of 2002 – then why no disclosure at that
time? Given that FL903 was not a major investigation it could
be argued that the NTSB wasn't motivated to perform at their best
or didn't use their best people given that their attention was focused
on TWA Flight 800 and other fatal incidents. But none of this justifies
the NTSB's silence in 2002 when they most assuredly came
to grips with what they missed in 1997 and what Airbus withheld
from them.
In their recent submission to the NTSB (March 2004), Airbus offered
a couple of scenarios whereby an RTLU might "stall" or become incapable
of reducing the rudder travel – if the pilot applies too much pedal
force (above 140 lbs) or if rudder reversals are occurring. Even
though Airbus referenced the FL903 event frequently in their submission
they made no mention that the RTLU limits on FL903 were exceeded
several times.
DFDR Filtering – Making Matters Worse
Anyone familiar with the FL587 Investigation knows that some of the FL587 DFDR data was "filtered" (averaged) before being sent to the DFDR. Filtering data is useful for the cockpit displays but a disadvantage when Investigators need to dissect an aircraft's performance, as the highest values attained by any filtered parameter (like the rudder position) will very likely not be recorded accurately.
Three weeks after the crash of FL587, the NTSB was made aware
by Airbus that FL587 had a filtered DFDR. The NTSB didn't disclose
this in a Press Release until two months after the crash – in their 4th
FL587 Update. Why did Airbus wait three weeks to tell the NTSB?
A few weeks later, in Feb. 2002, the NTSB sent a letter to the FAA bemoaning the continued use of filtered data and stated that until they could develop an inverse filter (since Airbus did not have it) critical FL587 aircraft performance investigations would be delayed.
The FL903 DFDR Factual Report, on the other hand, was completed very quickly in 1997 – within 4 months of that accident – yet it was likely that this DFDR also had the same filtering issue as FL587. If the data was filtered on FL903, how was the filtering issue dealt with so quickly – in 1997?
Upon inquiry, Airbus confirmed to U.S.Read recently that the FL903 DFDR was filtered and "that is SOP (Standard Operating Procedure) with the (high) number of parameters". Airbus also added that the FL903 DFDR "defiltering" was not done until after the crash of FL587, sometime in 2002.
The fact the FL903 DFDR was not defiltered in 1997 is mystifying as the question must be asked "why wouldn't Airbus, already concerned internally about the loads experienced by the FL903 tail, not want to have a better understanding of the event and the actual loads placed on the aircraft by having the DFDR data defiltered?"
Airbus internal memos from 1997 (when the DFDR data was still filtered and the highest values for important flight control parameters, like the rudder position, were unknown) expressed concern internally that "ultimate loads could have been reached" on FL903.
Did Airbus know in 1997 the data was filtered? As the manufacturer, they must have known. Is this yet another piece of relevant FL903 information they withheld from the NTSB? If they willingly withheld this info as well from the NTSB – why did they? There is only one answer to that question – because the defiltered data would show even higher rudder deflections (as we've seen with FL587) indicating even larger failures by the RTLU and even higher loads on the tail. Therefore, the loads assessments done by Airbus in 1997 were understated due to the presence of a filter.
How significant is the presence of a filter? Had the presence
of the filter on FL587 not been discovered, the loads calculations
would have led to the conclusion the tail failed well below ultimate
load. For example, on the fifth and final rudder movement on FL587
(when the tail allegedly broke off), the DFDR showed a peak filtered
reading of 4 degrees (at the time of the loud bang) but the defiltered
reading was 12 degrees
(illustrated in Exhibit 8 below).
Exhibit 8 – Filtered rudder position graphed with
defiltered rudder position (source: NTSB)
In the exhibit above the red dashed line represents the filtered DFDR rudder position (the filtered reading is also what the cockpit displays would be showing). The darker red line line is the NTSB's defiltered rudder data. The black dashed line is the rudder pedal data. At 9:15:58.5, when the tail is assumed to have broken off, the red line (defiltered data) is near 12 degrees but the dashed red line (the filtered data) is only at 4 degrees.
Filtering can, therefore, significantly affect "loads calculations" – the filtered data will generally produce lower loads and the defiltered data will produce higher loads – when examining the peak deflections of the rudder.
In 1997, the NTSB was well aware of the presence of filters on commercial jets as they had issued recommendations to the FAA in 1994 to ensure that filtered data was not being recorded by DFDR's. Filtering was a topic they were familiar with and had acted to remedy. Yet, there was no mention in the NTSB's FL903 DFDR Factual Report as to the presence of filtered data.
The FL903 investigation, in hindsight thus far, has highlighted at least four NTSB failures: they did not detect or acknowledge the DFDR filtering, they did not detect the RTLU limit failures, or the tremendous loads placed on the tail, and five years after the FL903 event they permitted Airbus to submit erroneous information about FL903 into the FL587 docket. We will also identify a 5th failure below.
The NTSB has not officially responded to any U.S.Read questions in regards to the FL903 event. But Airbus and anonymous sources within the investigation confirmed to U.S.Read that filtering was present on the FL903 DFDR.
Where's the FL903 De-filtered Data?
The original FL903 docket CD (completed in 1998), which we received in February 2004, made no mention of the DFDR filtering issue and included the filtered DFDR data as it was compiled in 1997.
Recently, U.S.Read had learned from within the FL587 investigation that Airbus had submitted "new" FL903 data to the NTSB within the last few months. Naturally, we wished to see this data thinking that this would offer the defiltered (higher) values for the rudder movements on FL903.
On February 26th, the NTSB informed U.S.Read that they had checked for "new" FL903 data and there wasn't "anything new that has been put into the AA903 public docket in some time." We responded to the NTSB that we had specific information from sources that new data had indeed been submitted to the NTSB recently. In their reply, the NTSB informed us that they would burn a CD for U.S.Read with the new FL903 docket info – but the NTSB would not tell us what that new info was.
The new docket CD (dated Feb. 27, 2004 and created in response to the U.S.Read request) contained a correction notice regarding the original 1997 DFDR data:
"The original engineering unit conversion algorithms used . . . were found to be in error. New engineering unit conversion algorithms were applied to the original raw FDR data and the FDR data were updated."
This contrasts with the NTSB's statement in 1997 that "the
correct engineering unit conversion was verified by the
NTSB, BEA, and Airbus Industrie." (emphasis added)
Four DFDR parameters were corrected in 2004 including the all-important rudder position. Without any acknowledgement by the NTSB that the original 1997 data was filtered, or that the new data was now "defiltered", the spreadsheet provided by the NTSB showed lower rudder deflections for the entire FL903 event compared with the original 1997 filtered readings. The reductions in rudder deflections were approximately 15% to 22%.
Shouldn't the NTSB include some more information about these "new" conversion algorithms, which, submitted by Airbus, had the effect of being beneficial to Airbus? One insider said, Airbus is "trying to work the system to their advantage."
U.S.Read is troubled by these developments with FL903's DFDR. What confidence is there about the accuracy of any Airbus DFDR downloads during the last 15 years? How many other crash investigations were affected by the application of these so-called erroneous "engineering unit conversion algorithms?" It is unlikely these errors only affected FL903.
The use of (allegedly) erroneous DFDR algorithms is the 5th failure of the NTSB in the FL903 investigation.
Even with the remarkable changes to docket data seven years after the fact, the "new" rudder data still showed the FL903 RTLU being exceeded five times during the FL903 event, and this safety issue has not yet been acknowledged by the NTSB.
It appears that when Airbus had calculated (in 2002) that the tail of FL903 had approached rupture point loads at around the 37 second mark – those calculations were most probably based on the lower rudder deflections they submitted to the NTSB in 2004. If this new data is unreliable and since the issue of filtered data has yet to be addressed, FL903 more than likely attained loads well beyond rupture point; well beyond even what FL587's tail endured. All the FL903 loads calculations would skew higher given that the actual peak deflections have yet to be revealed.
Credibility Lost & The Flight 587 Connection
Airbus' behavior and the NTSB's failures in regards to FL903 should seriously undermine the public's confidence in Airbus' trustworthiness, and in the NTSB's ability to see the real issues. U.S.Read has spoken to many aviation experts about the FL903 event. Unanimously, they thought that Airbus behavior could be classified as a cover-up, with the NTSB enabling Airbus through their own shortcomings and failures.
As with most aviation investigations, the NTSB has had to rely heavily on the manufacturer in order to evaluate the performance of FL587. Perhaps the most important contributions by Airbus have been the loads calculations on the tail. It was very much in their interest to prove (as they allegedly have) that FL587's tail didn't break off until it was exposed to loads 1.9 times the design limit – loads near the rupture. The NTSB has bought into this; Robert Benzon, the NTSB's Investigator-In-Charge (IIC) for FL587 has said, "aerodynamic and internal loads that the vertical stabilizer experienced were significantly above the ultimate loads required by the French and American certification standards. In fact, the sustained loads were near the structural test loads demonstrated during the certification process."
The NTSB's aircraft performance report stated: "Using
data and methods provided by Airbus that describe the effects
of these parameters on the vertical tail loads, the NTSB and Airbus
calculated the shear, bending, and torsion loads on the vertical
tail during the final seconds of DFDR data." (emphasis added)
"Data and methods by Airbus". Let that settle in.
Given what we know about the FL903 affair, how can Airbus' data and methods be trusted? Even if Airbus's was completely objective, and had never committed the kind of transgressions they did with the FL903 accident, the conflict of interest could not be more obvious. Obviously, some data can only come from the manufacturer. But the methods too?
Are there any indications that Airbus may have had an undue influence in the FL587 Investigation?
Airbus and Flight 587 – "Working the System" – with the NTSB enabling Airbus yet again
The most critical piece of evidence that FL587's tail performed as good as new – the best defense for Airbus – are the loads calculations which show the tail did not break off until it was exposed to loads 1.9 times the limit load. A critical factor, or variable, in those calculations is the rudder position data. How reliable is the rudder position data from FL587 and how reliable is the interpretation of that data?
Here are our findings:
1. Flight 587's rudder readings changed at least twice during the investigation – each time increasing the value of the all-important fifth rudder movement – the one that allegedly broke the tail off. This gives the appearance that the values were increased to just the right point where the loads calculations would produce the magic escape hatch for Airbus – the "rupture point" – 1.9 LL. Anything less than that could have called into question the integrity of the tail.
For example: The DFDR showed the filtered rudder at approximately 4 degrees to the right when the tail allegedly broke off. The NTSB, after some defiltering refinements, stated in February 2002 that the fifth rudder movement went to 9.5 degrees right. At the Hearings in October 2002, they stated the fifth rudder movement was now 12 degrees or higher. The NTSB refers to these changes as "refinements". Airbus could not have scripted better refinements.
2. The RTLU was exceeded by 23 to 40%. The RTLU at the time of the 5th rudder movement was supposed to hold the rudder to 9.3 degrees (see Exhibit 9):
Exhibit 9 - Airbus' Rudder Data with RTLU limiter shown (source: NTSB)
3. Airbus' Vice President and Head of the Flight Control and Hydraulics Department, Mr. Dominique Chatrenet, responded to questions by the NTSB at the FL587 Hearings about the 11.5 degree deflection on the fifth rudder movement, and why the RTLU was exceeded, by stating: "we are exactly in the time of the estimated separation of the fin from the fuselage. So . . . we can imagine that even if the TLU (RTLU) was actually holding firm . . . at the time of the separation when the fin bended and went away, the control rod was likely to be under tension. And this tension . . . is sufficient to allow or to consider four millimeter of deformation of tension to explain the difference – the difference we see between the – TLU and the . . . estimated rudder position."
What Mr. Chatrenet was saying was that as the tail broke away it stretched the control rod and produced the faulty 11.5 degree reading when in fact, they claim, the RTLU was not exceeded. In effect, he was saying that the tail started to break off when the rudder was 9.3 degrees right (when the "TLU was holding firm").
4. This Airbus explanation means the tail started to break off at a deflection of 9.3 degrees right (the RTLU limit at the time the NTSB assumes the tail departed) at 9:15:58.2, three tenths of a second before the NTSB states the tail broke off at 9:15:58.5. In attempting to downplay and explain the seeming RTLU problem – Airbus created another problem. At 9:15:58.2 A.M., when the RTLU was at 9.3 degrees and allegedly "holding firm", Airbus' own loads calculations clearly show the loads on the tail are not at 1.9 LL but at 1.5 LL (ultimate load – see Exhibit 10 below). The ultimate load had not been exceeded but the tail had begun to break off. The FAA certification requires that ultimate load be sustained for 3 seconds – it wasn't. According to Airbus' own testimony, the tail failed having not met the certification requirement. Of course, Mr. Chatrenet either didn't realize what he was saying, or he did, and was hoping no one would interpret the consequences of his statement. The latter is the more likely scenario.
Exhibit 10 - Airbus and NTSB Tail Load Calculations (source: NTSB)
5. If Mr. Chatrenet was wrong – and the tail did not start to break off at 9.3 degrees but at 11.5 or higher – then the RTLU failure is to blame for the tail breaking off. Either way – Airbus is cornered; the tail failed either because it didn't sustain ultimate loads or the RTLU failed to hold the rudder to the limit and permitted destructive loads. There was no middle ground.
Fortunately for Airbus – the same NTSB that failed to pick up on the critical issues in 1997 on FL903 – had failed to follow-up on critical issues yet again.
6. The NTSB's lead FL587 investigator, Robert Benzon, was able to say in his opening statement at the Hearings, "Investigators have found no indications of any rudder system anomalies." Yet the following two statements were found in the NTSB's Aircraft Performance Report:
a. "the rudder exceeded the expected RTLU limits"
b. "rudder exceeds the expected rudder travel limits near the end of the DFDR data"
The NTSB has not answered our questions as to how the RTLU can apparently not function as expected and yet the NTSB can say there are no indications of any anomalies.
7. Whereas the rudder's position data was filtered (therefore, the highest deflection values were not recorded by the DFDR), the rudder pedal data was not filtered. The rudder pedal readings are real readings sampled twice a second. Therefore, the pedal data should be very useful in understanding the rudder position data as there is a direct relationship between the two.
The pedal data – from the DFDR – clearly shows that the rudder itself never deflected as far as 11.5 degrees right (or higher – as the NTSB had calculated) during the fifth and final movement. The pedal data does indicate one of two things. Either Sten Molin had decided to halt his 5th rudder movement prematurely (before he reached the RTLU) and return to neutral or he had started to lose control of the rudder system altogether by 9:15:58.3 – before the NTSB assumes the tail broke off – and before loads beyond ultimate load were placed on the tail.
Exhibit 9 from above (Airbus rudder data with RTLU limits shown) has one very interesting omission – the rudder pedal data. Why would Airbus choose to exclude data that would be the one and only real data source of all the data in that chart? All the data in exhibit 9 is either filtered or defiltered data, of which the NTSB declares in their Aircraft Performance Report, there could be many values which can be derived from the filtered data.
U.S.Read took Exhibit 9 (from above) and inserted the rudder pedal data in Exhibit 11 below.
Exhibit 11 - Airbus Rudder Data with Pedal Data also Plotted (click image for higher resolution image in a new window)
In the exhibit above, the green line and yellow dots represent our insertion of the DFDR rudder pedal data which matches the NTSB's pedal data in exhibit 8 above and matches the DFDR spreadsheets. The red dashed line and dots are the DFDR (filtered) rudder data. The blue dashed line is the NTSB's defiltered rudder data. The black line is Airbus' calculation of the actual position of FL587's rudder (defiltered) based on simulator tests. The black dashed line across the top and bottom the rudder movement lines is the RTLU limit. As FL587 was accelerating during this time the RTLU limit was restricting available rudder movement.
The actual position of the rudder represented by the Airbus black line closely follows the pedals represented by the green line; the rudder will quickly do what has been commanded by the pedals. There are some oddities in Airbus' black line – points where the rudder leads the pedals – these seem to be in errors but we will not focus on them here. You'll notice the NTSB's rudder position (the blue dashed line) better matches the rudder pedal movement.
The NTSB and all the parties to the investigation assume the tail departed at 09:15:58.5; the NTSB's blue dashed line representing the actual rudder position terminates at about that point.
In Exhibit 12 below we highlight the critical portion of the fifth rudder movement from exhibits 9 and 11. What becomes very obvious is that the pedal data simply does not support the "derived" or "defiltered" rudder data which alleges that the rudder deflected to 11.5 degrees right (the Airbus black line) or 12.5 degrees right (the NTSB blue dashed line).
Exhibit 12 - Critical Portion of the Fifth Rudder Movement (isolated view taken from exhibit 11 above)
Two facts are very apparent from the pedal data:
a. there is no DFDR pedal data to support the conclusion that it (and the rudder) traveled 11.5 to 12.5 degrees right. The pedal data's highest value during this final movement is 6.75 degrees right. This is a significant point: the one piece of real data – the pedal data – provides no support for the current NTSB theory in regards to the fifth rudder movement. In other words, their current theory that the tail suffered 1.9 times the limit load because of a rudder deflection of 12 degrees is based on manufactured data. That is what the data above clearly shows. Also, the filtered rudder data (before the NTSB and Airbus defiltered it) shows a rudder deflection of only 6.33 degrees right at 09:15:58.6. We can expand our statement to say that,
"there is no DFDR information to support the current NTSB conclusions about the fifth rudder movement. And if their conclusions about the fifth rudder movement are suspect, then all their conclusions about when and why the tail separated are suspect."
b. compared with the previous three rudder reversals, this 4th rudder reversal was unusual in that the pedal movement slowed down during the reversal – before the pedal reached the pedal limiter – and this slowdown was the most severe of all the rudder reversals. The average pedal speed (measured in degrees per second) of the previous three rudder reversals were 25 degrees per second. The slowest movement was the first rudder movement, where the pedal moved at a 15 degree per second rate. Aside from this first movement, all the other pedal movements that occurred during rudder reversals were in the range of 22 to 31 deg./sec. The pedal speed (in Exhibit 12 above) from 09:15:57.9 to 09:15:58.3 was the slowest – only 9.75 degrees a second.
This is unusual and unlike any of the other rudder reversals. This slowdown is obvious just by looking at the charts above without doing the math. This slowdown occurs right in the middle of the Pilot's final swing of the rudder from the left to the right. The NTSB and Airbus calculations and derived rudder readings all assume the pedal went all the way to the limiter (and perhaps beyond). But that evidence does not exist.
This slowdown of the pedal movement is most likely due to:
1. the tail departing the aircraft at this point in time (09:15:57.9 to 09:15:58.3) – earlier than the NTSB assumed – but in line with what Mr. Chatrenet hinted at, or . . .
2. The pilot losing control of the rudder control system but not because the tail had fallen off. The real cause of the crash, the real initiating event, was beginning to affect aircraft systems and the first effect experienced by the crew was the loss of rudder control. As we will show in our upcoming report – Spoilers 2, 3, 5 (flaps on the wings) also failed within the next second.
It has been proven in ground tests with an Airbus A300-605 that a Pilot cannot modulate (cannot "tune", if you will) his/her rudder movements at these speeds. It's an all-or-nothing system given the limited available pedal travel. In other words, if a Pilot decides to use the rudder – they will in all likelihood go all the way to the stop (to the limiter). This is the case because available pedal travel (the distance the pedals can move) becomes severely limited (as little as 1.2 inches) at the speeds FL587 was flying at. The NTSB had highlighted this pedal design peculiarity in their February 2002 safety recommendations.
Therefore, given that the pedal movement and reading that occurred at 09:15:58.3 was modulated (it didn't go to the stop), the most likely explanation is that some factor other than the Pilot was responsible for that modulation. The bottom line is – the Pilot was losing control of the rudder system before he ever deflected the rudder to 12 degrees.
Without the pedal data there to confirm the NTSB's and Airbus' defiltered rudder readings, there is no evidence the rudder ever deflected to 11.5 degrees. There is no evidence the loads on the tail ever approached 1.9 LL. There is no evidence that even ultimate loads were reached on the 5th rudder movement as there is no evidence the rudder even went to 9.3 degrees. The pedal data indicates the opposite of what has been offered as defiltered data.
Seeing through the FL587 mess
If tail separation was the cause of the crash of FL587, if the pedal data supported the belief that tail truly separated when the NTSB says it did, then the FL587 investigation has failed to conclude what should be obvious – the tail failed because the RTLU allowed the rudder to move beyond the limiter. But the pedal data does not support this theory. Alternatively, Airbus' public comments and the rudder pedal readings lead to the determination that the tail failed prior to enduring loads beyond ultimate load. Either way, if tail separation was the cause of the crash, for the NTSB to continue to place the burden of this crash literally at the feet of the First Officer and Pilot, Sten Molin, is to totally ignore or evade all of the evidence presented here.
U.S.Read is convinced by all the scientific evidence and the testimony of eyewitnesses that tail separation was a consequence of a crash sequence that had already begun before the tail separated. All this talk of the tail, and loads, and rudder movements, and pilot training, and FL903, and even RTLU and loads cover-ups, shed no light at all about what actually happened to FL587. Our upcoming articles will highlight this position in more detail.
We do conclude that Airbus has produced much misleading information – apparently intentionally – and they have withheld safety information from the airlines, the FAA, and the NTSB for many years. The NTSB has shown the ability to let the truth slip through the cracks and appears to be allowing history to repeat itself.
The FL903 affair has also shown that we cannot have blind faith in DFDR downloads or loads calculations, since numbers can be "updated" seven years after the fact and Airbus (or someone else) can withhold vital information. In other words, currently available data, though hailed as trustworthy, might be changed 7 years from now and there might still be data we don't yet know about. These are just some of the lessons of FL903.
FL903 likely experienced loads well above
2.1 LL and only had subsurface delamination in one composite lug
4 years after the accident and after a total of 13 years of wear
and tear. Why did it's tail survive the more severe upset and
more severe loads? Why wasn't there more damage to it's tail?
Did the upset that FL587 suffered in 1994 (the nature of the upset
is unknown) weaken the tail and set it up for it's demise on November
12, 2001? Or is this yet another lesson from FL903 – that
tails, even those manufactured by Airbus, do not easily break
off of airplanes. For FL587's tail to have departed, something far more
deadly than 4 rudder reversals had to have occurred on board.
U.S.Read believes the evidence can show the tail of FL587 survived
the initial loss of control and did not depart the aircraft until
after the flash and smoke on the tollbooth video. As many credible
eyewitnesses stated, they first noticed a fire or explosion on the
aircraft before the tail departed. The NTSB has at times called
the eyewitnesses "unreliable". But the FL903
and FL587 investigations have shown that the NTSB needs to
first look inward before they declare others as unreliable.
