17 November 2002
17 November 2002
One of the most complex accident investigations in recent memory has shifted from public testimony to assessment of a mountain of data, only about a fourth of which reportedly has been processed more than a year after the accident.
The investigation involves the fatal Nov. 12, 2001, crash of American Airlines [AMR] Flight 587. Recently, the National Transportation Safety Board (NTSB) conducted four days of open hearings into the various issues involved. The first two days of hearings focused on the design of the rudder control system on the accident airplane, an A300-600, and on the training pilots received at American Airlines on upset recovery.
The elemental issue in the first two days might be described as the susceptibility of a powerful yet overly sensitive rudder control system to inputs from pilots whose upset recovery training may have subtly preconditioned them to make excessive use of the rudder. To both issues the main protagonists, manufacturer Airbus and the airline, would say that this was not the case. To Airbus, there are no unexamined issues in the rudder control system. To American, the training stressed coordinated, modest use of the rudder.
On the third and fourth days of the hearings, the design of the composite tailfin was reviewed in detail. The discussion led all the way to the headwaters of that great river known as the certification process.
At this point, the Flight 587 accident investigation is unusually significant for the broad range of issues involved. To highlight just a few, the issues concern basic factors in aircraft structural and control system design, wake separation standards, air traffic control procedures, pilot training, flight system reliability, the sharing of safety-related information, as well as small yet significant details, such as whether it should take one or two clicks to disconnect an autothrottle, and what kind of aural signals or visual queues should be provided to alert pilots to a change in functional status.
In the meantime, highlights of the discussion over the composite tailfin point to what may well evolve into an eventual change in certification standards. Days 3 & 4 - Composites under scrutiny
The good news, if it can be so characterized in the grim context of a fatal accident investigation, is that the tailfin held until nearly twice its design limit load. The bad news is the number of times tailfins on the A300 and its cousin, the A310, have experienced forces greater than the design limit load.
The disclosures are likely to lead to changes in certification standards for aircraft structural components, whether they are manufactured of metal or composites.
Previous incidents of high tailfin loadings were brought out in the concluding sessions of the NTSB hearings. The composite tailfin on the A300-600 snapped off under the excessive aerodynamic loading in the final seconds of the doomed airplane's brief 103-second flight.
The composite lugs holding the tailfin to the fuselage gave way at nearly twice the worst-case condition envisioned by the airplane's designers, or 1.96 times limit load. Limit load is defined as the greatest combination of shear, bending and torsion loads the airplane would ever experience in service. Consider this limit load has having a value of 1.0. The tail, in this case, must be able to carry the limit load and, if it deforms under the stress, return to its original shape when the load is released. Designers add to the limit load a 50 percent factor to account for unforeseen circumstances. This value, 1.5, defines ultimate load, or the point at which the structure may be able to carry the load, but not without permanent deformation of its shape.
During the original certification trials, the tailfin had gone to 1.83 of limit load before breaking in the test rig. Hence, Airbus engineers regard the fact that the tailfin on the accident airplane went to a load about 7 percent greater as further evidence of the soundness of their design philosophy.
However, in seven known cases where A300 tailfins experienced unusually high loading in service, four of them were above limit load. In the operational history of the A310, a variant of the A300, in four cases of high loading ultimate load was exceeded once, and limit load twice. In a total of 11 high- loading events for the A300 and A310 combined, two-thirds of the cases exceeded limit load. Three cases exceeded ultimate load: the Flight 587 accident aircraft (event ""A"" in the table), another American Airlines A300, Flight 903, in 1997 (event ""B""), and an Interflug A310 incident in 1991 (event ""H"").
The number of such incidents gave rise during the hearing to a spirited discussion about whether the calculation of limit load is really taking the worst-case condition into consideration. After all, limit load is supposed to represent the very worst-case of gusts, crosswind takeoffs and landings, loss of engine thrust, and flight control system failures. From some 30 different cases, limit load is based on the most demanding.
One of the most important calculations concerns the loads generated on the tailfin when the rudder moves to full deflection in a stabilized sideslip. The certification requirement involves full deflection, followed by the rudder's return to the neutral position, followed by movement in the opposite direct and return to the neutral position. Doublets not required
The certification requirements do not include rudder doublets, or the rapid movement of the rudder to one side and back to the other, without pausing at the neutral position. In five of the seven cases where limit load was exceeded, rudder doublets occurred.
John Clark, NTSB head of aviation accident investigations, raised the obvious question: ""If rudder reversals can take the plane past limit load, why are they not part of the certification requirement?""
Airbus officials kept pointing to the certification requirements. ""There is no need for more strength,"" insisted Erhard Winkler, a senior composites specialist at Airbus. ""We cover our requirements,"" he said, adding, ""The requirement is 1.5 and we achieved 1.9."" He was referring to the 1.96 multiple of limit load estimated to have been the amount of force that broke off the tail on the Flight 587 airplane.
Capt. Don Pitts, safety committee chairman for the Allied Pilots Association (APA), the union of American Airlines pilots, picked up on the same theme. ""Did Airbus consider the pilot moving the rudder in the wrong direction in an engine out [situation] and then correcting?""
Ewe Kerlin, an Airbus structural loads expert, replied, ""No ... just the requirements.""
Pitts directed his next question to a Federal Aviation Administration (FAA) witness. ""With seven examples of this design exceeding limit load, where are we with respect to regulatory requirements?"" he asked Dr. Larry Ilcewicz.
Ilcewicz, chief FAA scientific and technical advisor for composites, replied, ""The reason we design structure to limit load and then to 1.5 is that we recognize there will be exceptional cases.""
""For limit load, you want to be good for extremely rare events,"" he said. For ultimate load, he said, ""I want to be sure of a full factor for safety.""
Pitts pressed his point. ""If we see cases exceeding limit load, don't we need to assess if that load factor is accurate?""
The response was intriguing. ""I don't care to comment,"" Ilcewicz said. Then, after a brief pause, he said, ""I have confidence that most of the composite structure out there is safe."" However, given the cases where the A310 and A300 were outside of their design envelope, ""being a stress analyst, that makes me uncomfortable.""
Dr. Bill Ribbens, who teaches airplane design at the University of Michigan, expressed his discomfort with certification standards that do not include the aerodynamic loads involved with doublets. ""You should make airplanes so you can't break them, especially in the yaw axis,"" he asserted.
""How do we assure airworthiness for composites,"" he asked. The wrinkled skin of an aluminum structure is a sure sign that limit load has been exceeded, Goglia pointed out. But for composites, no such telltale wrinkling will occur and, indeed, damage could be hidden from view.
As an example, hidden damage in the tailfin of the American A300 that experienced an upset in 1997 was missed twice - once during a visual inspection shortly after the event, and again when the tailfin was reinspected visually after the Flight 587 accident. It was not until the fin was subjected to ultrasound inspection that interior damage was found. The tailfin, having been subjected to a force greater than ultimate load, remained in service for another five years before finally being removed from the Flight 903 airplane.
""What today would prevent the Flight 903 airplane from being returned to service?"" Goglia asked. Ilcewicz referred to the airworthiness directive (AD) requiring tailfin inspections whenever an A300 experiences a lateral loading in excess of 0.3 G.
NTSB member George Black inquired, ""So, if a B777 was involved, we wouldn't look at it?"" The B777 also has a composite tailfin.
Even though the AD does not apply to the B777, Ilcewicz said the problem is understood within the industry. ""This kind of loading event is something maintenance personnel would bring forward for further action,"" he assured.
But Goglia stressed the conundrum. If damage is not visible on a composite structure, unlike the wrinkling of overstressed aluminum, maintenance personnel will be reluctant ""to turn themselves in,"" he said. By implication, other airplanes with composite structures could experience loadings outside their design envelope and, absent visible damage, could remain in service for years.
The UK's Engineering Industries Association (EIA) and the Manufacturing Technologies Association (MTA) have received confirmation of government funding for UK engineering companies to exhibit at overseas trade shows.
Thai Flight Training (TFT), a subsidiary of Thai Airways, recently ordered an Airbus A320 door trainer from Spatial Composite Solutions.
Solvay reports that Advanced Sensor Technologies Inc (ASTi) has selected Ryton polyphenylene sulphide (PPS) to mould protective housings for two industrial-grade sensors.