A Theory Refined

The NTSB is laying the groundwork for a belief that perhaps the pilots could have encountered the initial wake turbulence and then laid into it with a corrective boot (for whatever reason) but thus creating a rudder reversal situation (beyond the provisions of FAR25) that overloaded the fin. Their theory infers that, perhaps when they hit the second lot of wake, they were in a significant sideslip with a large rudder deflection. And supposedly they didn't do this just once, but went for a heavy pedal-throw five "recorded" times during and just after that second wake encounter, with as little as 0.3 seconds between.

Well I'll tell you now that you won't have any more than 0.5% of the qualified pilot population ever believing that one. Multi-engine pilots just don't go for big boots of rudder at 240 knots (1.9Vs) when they encounter wake turbulence (and, as you point out, that happens quite frequently). Pilots might be more prone to utilise rudder in order to stop a further wing drop at low (approach type) speeds (1.3Vs). That remains a recommended course of action simply because trying to pick up a "dropped" wing with aileron/spoiler when near the wing's stalling angle of attack only serves to exacerbate the situation and can lead to autorotation (incipient spin). So there has to be another answer - and that's probably why the US pilots flying the A300 have the wind up. They know that this facile NTSB explanation just doesn't wash. Neither does it accord with the A300's reputation as a tail-wagger, nor with the recorded instances of uncommanded yaw. You should not lightly dismiss either of those factors.

There are system failure explanations that might encompass the cause and I've mentioned my latest theory (the effect of yaw on the static pressure sensed by the Air Data Computer and predicating allowable rudder deflections - see below). Another avenue of exploration might be this one:
 

The NTSB and FAA have disclosed that a previously FAA-accepted NTSB recommendation on the DFDR was not acted upon and so only the desensitized data was going onto that thoroughly discredited Loral DFDR (in other words, the same as what the pilots were seeing - and eliminating all the intermediate data-points). When you consider that aspect, and reflect that as little as a quarter of what went on down back actually went onto the DFDR, I have no trouble seeing those latter tail-end events as "a rattle". And I certainly then discard any notion that it was the pilots peddling that fast....because they simply couldn't have done so. But the FCS driven system? Yes, that can move the rudders at a rapid 39 deg/sec (see the article below).

So, is it a simple 737-type rudder case where the valve is going to full throw and then sticking? No. Something is causing the A300 rudder to fluctuate back and forth - but not rhythmically (an important point). Well we know that there have been prior instances of the A300 rudder generating uncommanded yaw, some just annoying - but others generating concern, incident reports and flight aborts. So why didn't they previously cause a fatal fracture of the fin?  Easy, it's all about the forces generated on the fin - by both the rudder's motion and the side-slip angle at the time. For AA587, already in tail-wag mode when they hit the second wake, the overload was likely caused by the angular velocity of that wake as it hit a deflected rudder's pre-loaded fin. It is most obviously the combination of those two aerodynamic loads that (for AA587) proved lethal. That is well covered in AW&ST's Dornheim article below . But it's not the whole story - it lacks an acceptable cause for the waggle.

OKAY, what could cause the rudder to waggle, (but not rhythmically) and, in the case of AA587, break the fin? Well the answer possibly lies in the systemic relationship between the ADC and the FCS. The ADC senses pitot and static pressures and provides the speed input so that the rudder ratio limiter knows how much of the (physically available 30 deg of) full-throw is permitted at any one time. If you manage to confuse the ADC so that its input to the rudder limiter (owned and operated by the FCS) is a little haphazard, then every rudder deflection will be inappropriate. Because it is (and proves to be) an inappropriate response, a further corrective rudder deflection is called for. It too will be incorrect if the speed derived from the ADC isn't near tothe actual speed of of the aircraft.  The yawing evolution ends up as an over/under-correction followed by yet another over/under-correction and the end result is dependent upon some other factors. Firstly, if it's not a significantly inappropriate rudder deflection, the massive dampening effect of that large fin will provide a countervailing restorative moment and the uncommanded yaw will subside. If it is a largish error, then the inertia of that fuselage swing also becomes a factor, as does the timing of the FCS inputs and any time-lag in the ADC's sensing of the aircraft's speed.

So why would the ADC tell fibs (to the FCS and rudder limiter) about the aircraft's speed? It might not be the same reason every time and I covered that in my initial hypothesis below ("just another Theory"- "Help me out here"). But in AA587's case I'd suggest that the initial wake turbulence encounter was enough to set the ball rolling. Normally, in a yaw, the fact that the port and starboard static ports are Y-connected is enough to iron out (and average) any discrepancies caused locally at each port (by the venturi effect of yaw angle, air inflow and fuselage curvature). However the design engineers only ever consider balanced flight and a few different configurations when they decide upon static port positioning and then map the PEC (position error correction) errors to be fed into the ADC. In yawed flight I'm suggesting that quite large errors can creep in and be magnified by both the ADC and FCS sampling rate (i.e. how often these gizmos ask for the speed info). As I pointed out in the earlier article, about a 9mb error (= an 8% error on an ISA day) can cause the airspeed to zero out. I'm not suggesting that that happened, just pointing out the small magnitude of P.E. error required to cause a largish speed error and an inappropriate rudder deflection.

Remember the 1996 Birgenair 757 that crashed due to static port tape being used to stop water getting into the static system during an aircraft wash (not being removed)? Well it's a little-known fact that heavy rain and a falling barometer can allow a static port to suck in water. It's usually not significant because it normally pools in water traps in the system - and gets drained eventually. In a heated system it's unlikely to freeze and cause the gross errors mentioned in my earlier article. However just consider what effect an amount of trapped water might have in the static system - particularly upon the timeliness of ADC sensing, and particularly in a yaw? The water may well flow in an adverse direction, due to the forces of the yaw and inertia, and induce a false static pressure (which is then picked up by the ADC etc etc). Do you see where I'm going here?

So if you accept my hypothesis, you will see that a clean/dry static pressure system can induce an error into the FCS - and so can a wet one, but probably a fiercer reaction in the latter case - because of the adverse flow of trapped water during any yawing. Due to the unpredictable nature of the water-flow and the ADC sensing, rudder ratio changes and resulting erroneous FCS responses, any yaw meanderings would not be rhythmic, but they could build up and become divergent and gross. Equally, the rudder could become out of phase with the aircraft's physical yawing and tend to assist the damping effect of the fin. Luck of the draw I would say - but in AA587's case I'd suggest that the second wake turbulence encounter came at just the wrong time in the cycle. It can probably therefore be seen as a once off type accident. But if I am right, then there are things that can be done to resolve any such discrepancies in the Airbus system's logic and susceptibility to this type of error.


 

In answer to the question (at the end).

Pitot Pressure (as sensed by a pitot tube facing into the airflow) is a Total Pressure made up of dynamic and static pressure:   T = D  + S1

So obviously we need to subtract that S1 (the static pressure – which should be the ambient pressure at that height), because what we want to see on our Air Speed Indicator is D (dynamic pressure or the pressure due to our forward speed). The formula now becomes D = T – S1 (a conventional airspeed indicator does this within its internal plumbing but in a glass ship the Air Data Computer obliges).

But where do we source that S1? Well it comes from the static ports (let’s call it S2)…. which live on the port and starboard sides of the airplane’s aft fuselage (normally two small holes each side / above and below, which are heated against icing but which are open to the elements inflight and quite often left open and unplugged on the ground). If you park an airplane in the open and there’s heavy rain and it’s flowing down over those holes then capillary action can cause water to be sucked in, sometimes in fairly large quantities. I can recall an inflight emergency where I lost all pressure instruments after climbing through freezing level. They figured out later that, parked in the rain, water had been sucked up the hollow centres of the downward-facing rubber bungs (off which the water was dripping). When it later froze in the static system, of course I lost the altimeter (it froze at that height), the VSI went to zero and the Air Speed indicator just wound back to zero (from the 220knot climb speed). It was calculated later that that will happen (from that IAS) over a climbing height change of 2800feet (about = 9mbs or 8% of the Sea-level ISA pressure). The school solution is to depressurize and break the glass on the VSI and accept that there will be a fairly gross altitude error (due to using cockpit static). But that gets your ASI back in the picture (although greatly errored, trends will be good).

Now in an ideal world S2 will always be equal to S1. But we don’t live in an ideal world so there will always be some discrepancies:

1. When we lower flap and/or change AoA, it tends to speed up the airflow over the wing and down past the static ports - so the venturi effect drops the pressure there and a correction is required (to the speed that we fly).

D = T – S2  becomes an errored speed indication because it’s now a greater quantity than D = T – S1.

2. If we yaw the aircraft, the fact that the port and starboard static ports are interconnected via Y junctions should stop the error being of any great magnitude (a higher pressure on one side being in theory cancelled out by a lower pressure on the other). But if we go into a rapidly yawing mode through a significant angle, then all bets are off and the pitot-static system will be struggling to provide valid data to those flight control systems with a high sampling rate and requiring accurate pick-offs of static pressure (and consequently any derived speed will be fluctuating). Note here that I said pitot-static systems – because the pitot is also yawing away and so it’s also subject to some error). Navigation systems and pressure altimeters aren’t as vulnerable to sensed errors (resulting in momentary speed discrepancies) as would be the flight-control systems (yaw damper and rudder limiter inputs say).

3. And if we have water trapped in that system and start yawing, then obviously we have to examine the effect of the inertia of that water on the sensed static pressure (S2). Over a period of (say) five seconds, we might measure (but never see) S2 ± 5mbs variation. Depending upon the sampling rate of the ADC it may not even record this on the slow-sampling DFDR – but it may provide that instantaneously erroneous data to the rudder limiter and yaw damper…. With eventual AA587 uncommanded gross yaw type results.

4. Additionally, if we fly into a wake turbulence encounter, we might accept that a wake vortex has within it some wide variations of pressure. These can vary from “almost a vacuum” to much greater than ambient pressure at that height. In addition the angular velocities of the encountered (greatly disturbed) rotating wake vortex airflows may mean that there are components of the wake at an angle to the static port (on one or BOTH sides of the airplane) – and those ports can take in that air pressure much as a pitot tube does (leading to even greater errors and flux).

So it is starting to look like a real pakapoo ticket is it not? The business of getting a true S2 just became tantamount to impossible when we entered that first wake and began the tail-wag. When we entered it the second time, it was with a thoroughly confused system that was doing the wild thing with the rudder and, as luck would have it, the second encounter just happened to be at the worst possible angle and at the worst possible time. The rudder was already imposing a high load upon the fin and suddenly the additional load snapped an attachment lug and started the fin “working”. As the fin started its lateral dance of detachment, the rudder was excitated into a frenzy of fin-swaying corrections, leading to the death-rattle heard on the CVR.

Addressing what you’ve asked below:

“The static pressure drops to zero” isn’t really the case at all. What happens when water freezes in the static system is that the ambient pressure at that height is trapped and displayed (and that’s why the altimeter freezes at that height, even though the aircraft continues to climb). 2800ft later, the altimeter reads the same height - but the subtraction of that greater S2 (trapped pressure) causes the Air-speed indicator to wind back to zero. Over that 2800ft of climb the ambient pressure drops off about 9mbs (roughly 3mbs Hg/100ft). So if there was to be a momentary 9mb drop in the S2 (for any reason including the adverse flow of trapped static system water) at a speed of 220kts, the sensed speed would be nil, zero, zip. Now obviously that’s never the case because it’s a very dynamic situation we’re talking about here – but it does give you an idea of the magnitude of the pressure errors as sensed at the static ports – which could drastically influence the airspeeds being fed into the flight-control system. The speeds sensed could be at any one point of time either above or below  the actual aircraft speed – thus causing the continually inappropriate FCS-dictated rudder responses (in reply to the gyro-detected yawing moments). And there’s the rub.

Question:     I don't quite understand one thing in your "Just another theory".  It deals with pitot tubes and static ports, which is to say dynamic and static pressure. If static pressure drops to zero, why would the speed reading decrease? If the speed is dynamic pressure minus static pressure, then lower static pressure would suggest a greater speed to me than a lesser one. At greater perceived speed, the rudder would be more (not less) limited in its arc of travel.

Question: Well I am happy to say I got it! I have to confess I needed the explanation contained in the second part to fully understand the effect of the water referred to in the first - but the second part really clarified it for me. Just an idea but how about setting out, using real numbers, the affect of a static "frozen" reading within the Y against a scenario where all the relevant values are known? In other words: if one port was frozen and read X what affect would this have on the overall reading?

The whole theory made sense to me and if I am right it all boils down to this: the incorrect speed reading allowed the aircraft to manoeuvre at an angle incompatible to the actual speed causing fatal pressures on the fin.

Did I get it right???

Answer: Just about right. They hit the first wake and the yaw gyros sensed a particular yaw angle and so the FCS computes a rudder deflection that should eliminate it. Unfortunately, in accordance with my theory, the Air Data Computer is being fed erroneous static pressures and that causes the calculated IAS to be wrong at any one moment (high sampling data-rate here). That miscalculation of airspeed causes the rudder limiter to allow the wrong deflection (i.e. one inappropriate to the aircraft’s actual speed). So correction number one didn’t work out - and we shall now try for rudder throw number two…. and so on.

For the same reasons, rudder deflection number two just causes a tail wag the other way and the yawing continues in this vein. If it was all working properly, then the rudder would centre just as the yaw came off the airplane. Alas, that’s not to happen, and it just happens to be at the apex of one of those amplitude-increasing divergent tail wags when they hit the second wake at just the wrong angle – and likely broke just the one fin attachment lug. Because of the characteristic of composites whereby the strength of a structure is within the whole, the whole fin started “working” –as driven by the rudder. The wobblier the fin became as further lugs fractured, the harder the system worked the rudder – to compensate.

The whole point about water in the static system is not that it would be frozen at that height (because of course it would not be) – but water has inertia and we’re talking about sensing small increments of pressure here. Try sucking water up a straw. You’ll then appreciate the reverse effect that water (flowing under its own inertia due to the yawing moment) can have upon sensed static pressure within the system. Quite considerable.

The whole discussion about frozen water was simply to enable an example of how very small pressure changes can exert a considerable effect upon the indicated airspeed. Here we are talking about the high sampling rates and instantaneous readings peculiar to computer-driven flight control systems.

It’s not really appropriate to start spouting real life figures because then some smarty pants will just grasp at an error of magnitude. It’s not about magnitude - it’s about the timing, sampling rates and the dynamics and development of the situation (best described as a state of flux and incredibly bad luck).

It’s probably not a valid theory – but then again it may be (but either way, it’s certainly filling a giant vacuum at present).

Question

I think it's clear. As the airspeed winds back to zero, the system thinks the plane is going slower, so it allows the rudder limiter more authority. But the movements wind up out-of-phase, leading to the dynamically destructive scenario you portrayed. Very subtle, my man.

Answer:

1. “As the airspeed winds back to zero” Not really talking about the (incorrectly) sensed airspeed getting anywhere near zero. The zero airspeed case was only a maximal illustration designed to point out the magnitude of the effect that a small static system discrepancy could have upon sensed airspeed (particularly where a high sensing and sampling rate computer-driven system is concerned).

2. ..” , the system thinks the plane is going slower, so it allows the rudder limiter more authority.” Or alternately, “thinks the aircraft is going faster” and therefore undershoots in its application of rudder. The end effect will always be “unfinished business”.

3. And so the result must be a frantic scrabble by the FCS to get it right, yet in the process perhaps slipping out-of-phase and going exponential (per JF’s description). In the milder (unreported) cases that have given rise to much anecdotal evidence about the A300’s propensity for tail-wag, I would surmise that the extent of rudder overshoot/undershoot has been small enough that the inherent stabilizing effect of the fin has been able to dampen things down after a number of diminishing excursions. In the case of AA587, courtesy of the initial wake turbulence, it was off on a reasonably major excursion when the second encounter caught it at just the wrong time (and angle) and with considerable force. I am suggesting that the NTSB knows that they were just unlucky and is therefore likely to write it off as a one-in-a-million and allow the pilots to (by inference only) carry the can for this one. Whether it was the yaw damper or rudder limiter, who’s to tell. They both need a good idea of the airspeed for an appropriate reaction.

3. So I hope that after all this verbiage, you can see your way clear around this over-simplification: “Let us remember that airplanes fly through wake turbulence every day. Considering this intriguing scenario, we'd have rudders slamming outside stipulated limits on a fairly routine basis (with lots of resulting reports of rudder malfunctions, uncommanded movements, etc.).” It may be as simple as only airplanes that have trapped water in their static systems suffering the notable uncommanded yaw. Any airplane flying through wake turbulence is going to have some ongoing gyrations in yaw, pitch and roll. Unfortunately for AA587 its rudder was still doing the Last Tango in Paris when it met up with a gust that found it slew-footed (already skidding/slipping and with a large load already applied to the fin by the rudder). The extra load was enough to shear a fin attachment lug (after which they were in break-up mode and the rudder was then being tasked to compensate for a fin in the process of detaching and rocking laterally - as it sheared away from its base attachment structure).

4. And yes, it’s envisaged as being very dynamic…in fact so much so that any airline proscriptions and recommendations for coping are really so much bollocks.

From Rainman (a flight controls engineer)

Hi folks,

Latest update from my end...

I am tending to steer even further away from the Air Data Computer theory, based on the following "data dump" I got today:

I spoke with the guy who took over my lead autoflight engineer job at FedEx when I left. He also happens to be an old flight controls chum from MD-11 development days. He briefed me on their "bent/broken" actuator rod event in their hangar. By the way, the initial media reports of bent rod were incorrect, they actually found *broken* links.

Not really sure what he's describing here because I very much doubt that there are any bike chains in this system.
So links (as such) have me shaking my head a bit. There may well be some chains there (don't really know).
I suppose it makes sense that there would be.

He is of the very firm opinion that the event they had in their hangar was related to
the hydraulic synchronization issue (hydraulic pressure pulses from different sources
getting out of phase-sync). The mechanic who initially heard the "banging"
did say it was oscillatory in nature, although there was no one watching the rudder
at the time. Appears it definitely got bent in the hangar during maint (as per the "banging").
I'd mentioned that rudder servo synchronization issue and passed the AD (amdt ONE) on to you. See here
I would agree that it's a definite starter here. This bent rudder input actuator rod may well prove to be the smoking gun.
Remember that only one actuator is moved by the yaw damper. If it was this one that's bent? Well then it's just about case solved. I would then submit that we might have possibly had a battle between a rudder limiter that had run amuck (courtesy of the ADC's flawed pressure inputs) and a yaw damper that was properly doing its job as it saw it.
I'll run this past Rainman and see if he shoots me down. He'd know (and I'm just punting in the dark).

He also found a repeatable problem with the "Land Test" as performed from the AFS
Maint. Test Panel that involved (what I consider) strange rudder control. Part of the
test induces an "off LOC" input signal condition for the LOC TRK phase. Autopilot BITE Integrity
Test for autoland coupler involves telling the system that it's displaced laterally from the Localizer (LLZ)
and seeing that an appropriate recapture FCS signal is generated through the AFS (auto-flight system aka autopilot)
If the Flight Director was engaged in FPA (Flight Path Angle aka Glideslope) mode the RUDDER deflected! (NOTE: NOT the
aileron to follow LOC as one would expect during LOC TRK!).
You would actually expect both aileron and a small rudder deflection (to balance it). The maint manual should specify. They could make it
happen every time....when they finally got with Airbus they found their procedure called for FD (Flight Director) OFF (I believe) but definitely not in FPA mode. This may be a red herring, but calling for rudder with an off LOC displacement, and no yaw inputs (airplane on ground) is certainly fishy to me!
(no yaw inputs perhaps - but quite a reasonable expectation that a rudder balancing input will be required - and it has obviously been fed in).
Possibly the absence of an aileron movement could be explained by a vagary of the system that calls for NOT an aileron displacement,
but an angle of bank (rudder led, much as a pilot will lead with rudder when rolling at low IAS).
If the system knows it's on the ground, it perhaps locks out any aileron displacement as evidently unachievable - or fails to generate one because
the rudder has generated nil yaw (real punt in the dark there!).
Easily resolved and may well be a red herring I feel.

Finally, something else to consider about a postulate that "the pilots applied heavy,
and oscillatory boots" when the wake turb was encountered: Would a pilot who was
operating at the frequency indicated by the rudder motion get even CLOSE to hitting
the same rudder deflection on each swing??? (i.e. +/-10 DEG given tolerance in
measurement). It's just not likely to me..... It is in fact very highly unlikely and I would hope to hear the NTSB eventually admit it.
I get the feeling that a genuine resolve to let pilots know that doing a Zorba the Greek on the rudders might break the jet has been
subverted into a theory that the pilots DID break that jet. And I say a hearty "bollocks" to that..
Some admin weenie or lawyer within the NTSB has reworked the engineer's original draft, I suspect.

Question along this line: Is the 10 DEG rudder limit applied to the entire rudder
surface, or only to the Yaw Damper? What I am getting at is, if the rudder motion
was caused by a "heavy boot" why did it always stop around 10 DEG? It sounds
too much like the yaw damper oscillating at its mechanical limit! I would agree with this very astute Rainman observation.

Rainman

posted 14 February 2002 03:16                
Further to Belgique's post, if yaw is sensed with a vane (or perhaps differential pressure between the static ports), entering and exiting different flow regions within a wake vortex will likely feed fluctuating and misleading data to the yaw sensing system, resulting in confused yaw damper outputs.
The resulting aircraft response could compound the confusion.
If yaw in the A300 is sensed from ring gyros or other INS, then this theory goes out the window.
Obviously yaw damper and rudder programs need to integrate correctly sensed yaw as well as airspeed to limit rudder movements within the fin strength.
Once Airbus, NTSB and BEA have determined and made the necessary revisions, they should fly an updated A300 through the same flight profile to show that the problem truly has been fixed.
From: Toronto | Registered: Sep 2001  |  IP: Logged

Belgique
Just another number

posted 14 February 2002 13:15                
To RatherBeFlying
Think you've misunderstood. Not talking about yaw being sensed by a vane - that's normally a gyro function. The yaw that was sensed was probably quite correct - it was the corrective rudder inputs that may have been continually inappropriate. Why?
What I'm looking at is the airspeed inputs to the yaw dampers and rudder limiters being in error. The reason why they can be in error is fairly clearly explained in that post - but to summarize:
Imagine that there's water trapped within that static system and you enter the first wake encounter induced yaw cycle. Water has inertia and will be affected by the yawing.
Flowing adversely (and even out-of-phase) within the static system, the instantaneous pick-offs by the ADC are going to lead to inappropriate rudder input corrections - simply because the sensed airspeed will be wrong (and thus the rudder ratio limiter is mis-set). Because the airspeed derived from a false static pressure can be quite grossly in error (example given) you will have a series of non-rhythmic corrective yaw inputs that will each prove to be "unfinished business". A minor yaw disturbance will result in a diminishing yaw cycle - because of the overpowering damping influence of the vertical fin (which is why the fin is there in the first place). However a larger initial yaw might result in a divergent (or at least self-sustaining) oscillation.
I'm suggesting that this is what has happened with AA587. Unfortunately that cycle was interrupted at just the wrong time (and angle) by the second wake encounter - and that's what broke an attachment lug. After that first lug broke, the fin was soon rocking laterally and that was the death-rattle heard on the CVR (as the rudder was driven into a frenzy trying to compensate for the fin's lateral rocking as it danced its Detachment Dance).
The bent/broken FEDEX rudder input actuator rod
The event they had in their hangar was related to the hydraulic synchronization issue (hydraulic pressure pulses from different sources getting out of phase-sync). The mechanic who initially heard the "banging" did say it was oscillatory in nature, although there was no one watching the rudder at the time. Remember that only one actuator is moved by the yaw damper. If it was this one that’s bent? Well then it’s just about case solved. I would then submit that there might have possibly been a battle between a rudder limiter that had run amuck (courtesy of the ADC’s flawed pressure inputs) and a yaw damper that was properly doing its job, as it saw it.
As these threads are very perishable, a page of informed surmise will be maintained here (with links of interest at the bottom).
Feel free to contribute.
From: Obvious | Registered: Mar 2000  |  IP: Logged

Just another Theory (the original submission)

http://www.ntsb.gov/recs/letters/2002/A02_01_02.pdf

Preliminary information based on FDR data and an analysis of the manner in which rudder position data is filtered by the airplane’s systems indicates that within about 7 seconds, the rudder traveled 11° right for 0.5 second, 10.5° left for 0.3 second, between 11° and 10.5° right for about 2 seconds, 10° left for about 1 second, and, finally, 9.5° right before the data became unreliable. [FOUR complete reversals inside 7 seconds].

These are the last 7 seconds the fin and rudder were well enough attached to give reliable FDR readings. The FDR shows FOUR complete rudder reversals inside "7 seconds" but the sum of the intervals given only comes to 3.8 seconds and we are not given the travel time of the last rudder movement to the right. The letter does show that the last reliable FDR reading shows the a/c in a left yaw of 8-10° and that that combination exceeded the structural strength.

We are only given the last yaw angle -- I would really like to see yaw vs. rudder position in these 7 seconds. In my opinion, the crew would have to be Tour de France material to work the pedals that fast against a 32 pound force. This inclines my suspicions to the flight control system.

1. Clues:

a. AA587 + eight prior uncommanded yaw incidents (U/Y) + a bent FEDEX rudder actuator rod (with associated fin disbonding)

b. An anecdotal reputation (particularly amongst F/A's) for the A300 being a tailwagger.

c. early design, early software

d. Composite fin more prone (than metal) to sudden failures due to its axial strength, load-bearing capabilities and "strength only through integrity" characteristic.

e. five recorded rapid high-throw rudder deflections at 255kts during and immediately after the second wake encounter (before fin failure) on AA587 (assuming this was the filtered DFDR read-out). The A300-600 rudder can move at a rapid 39 deg/sec.

f. neither autopilot nor Control Wheel Steering engaged.

g. There was an audible "rattle" from aft (as recorded on the AA587 CVR) after the second wake encounter (just prior to fin failure).

2. Assumptions: (intuitive, logical, recommended and standard practices)

a. A pilot would not (normally) make a large rudder input at 255kts (about 1.9Vs) [see Boeing/Airbus Guidance at:
http://www.boeing.com/commercial/aeromagazine/aero_03/textonly/fo01txt.html. Any rudder inputs are commended only at lower (near or at stall) type speeds.

The FAA guidance for pilots is transparently a bit of an irrelevant butt-covering exercise - but it does give us the heads up that an oscillatory rudder (see Farley above) certainly can break a fin. Happy with that - because that oscillatory motion is equivalent to aerodynamic or system induced "flutter". Flutter has always been associated with imminent catastrophic failure - as it often tends to be oscillatory and divergent. The nature of flutter is such that it all happens too quickly to enable recognition and speed (or configuration) changes. It's best avoided altogether (through design).

b. Pilots had no time in which to react - either appropriately or inappropriately (about 7 secs for recognise and respond/react). They would not have recognised the fin loss and the full power response probably did not materially affect the outcome.

c. The uncommanded yaw can happen on approach (i.e. slow and configured) or at FL310 so that common factor gives us a further clue. It doesn't appear to be a factor on/near the ground (i.e. you need a speed range).

d. As not all uncommanded yaw instances resulted in disastrous failure, there must be a trigger and exacerbating factors (i.e. present for AA587). We know of one - wake turbulence. Possibly another - the preflight yaw damper reset by maintenance. We can possibly refine this to "a characteristic (of design) plus an unserviceability" in order to complete the chain. Or maybe it's all predicated by design plus circumstance......no u/s required.

3. Givens:
a. The "yaw damper reversed" theory (both Miami 99 and Farley above) is a tempting hook upon which to hang one's hat and it may indeed be the reason why the yaw damper needed a reset.

b. The rudder trim switch had been subject of two AD's, the second one of which called for a lengthened switch shaft and a wiring change. That gave three rudder-trim switch maint mischoice possibilities (plus the wiring change). There was also an aileron trim AD for inadvertent actuation (both switches being close adjacent on the 408VU panel - increasing the possibility of a maint "Murphy")

c. Intermittent wiring problems have been known to cause similar flight control erratics....but oscillatory?? Maybe not, that's more likely a systemic interaction.

d. The Loral DFDR had been previously found unsatisfactory by investigators because it recorded only a filtered sampling of data (as per that displayed in the cockpit). The FCS is in fact capable of moving the rudder more than twice in the time that the DFDR records one motion. This may help explain the "rattle" (lateral fin-rocking) recorded on the DFDR and yet indicate that the pilots could not have possibly moved the rudder as fast as the FCS was capable of doing (39 deg/sec) - but without it being recorded.(See this article regarding AA587’s DFDR deficiencies (low sampling rate). And see also [url=http://www.srg.caa.co.uk/publications/CAP455_airworthiness_notices.pdf]Loral_800_"obsolescence"

4. Theory: Considering all of the above and extrapolating into plausible explanations, here's an hypothesis:

a. Static port positions are chosen by designers in order to minimize local pressure disturbances throughout the speed and configuration range - so that inputs to the Air Data Computer (ADC) are as solid and error-free as possible. However they tend NOT to consider what happens under yawed flight. In a steady-state yaw (asymmetric, engine-out, OEI) the port/starboard discrepancy is soaked up by the fact that there are ports on both sides of the fuselage and the two pressures are joined in a Y Junction before being presented to the ADC. If, however, the yaw angles become much greater, there is both an asymmetric blanking and a pressure change (venturi) effect caused by both the rapid reversal of yaw and the extent and periodicity of that yaw. The actual data (incremental pressure changes) presented at the static port has a long way to travel and it can become both erroneous and out-of-phase - simply due to the dynamics of the situation (and perhaps even due to the sampling rate of the ADC / and its subsequent input rate to the FCS). PEC (position error correction for static errors) is normally applied to the ADC only for balanced flight in the envelope - for normal configurations.

b. Consider further the effect of yaw if the static ports are placed in an optimal error-free position for balanced flight - but just happen to be at a point of curvature on the fuselage where the venturi effect on the sensed pressure, under yaw, will be very significant (i.e. perhaps producing large local pressure drops).

c. Airspeed is Dynamic Pressure (but is sensed at the pitot as TOTAL Pressure (static plus dynamic). The static port pressure is deducted to give you the indicated airspeed (i.e. the dynamic only). If you need a yard-stick for the significance of static port pressure errors on the sensed airspeed, take note that trapped water freeze-blocking a static line (in a climb above freezing level) will cause an ASI to wind down from 220kts to zero in just under 2800ft of climb (equivalent to 9mbs Hg). It would also cause the VSI to zero and the altimeter to freeze - but that's irrelevant here. I'm just pointing out that quite a small static port pressure discrepancy can have a large effect on ADC-sensed airspeed. Those sensed airspeeds control yaw-damper action and rudder ratio limiting - at any one point in time.

d. So why (and how) might this be significant? In prior instances of U/Y there may have been a minor out-of-phase disagreement between the FCS and the ADC. As pointed out, this could be caused by the rudder limiter's throw (and/or yaw damper input) being misset by the flawed ADC airspeed info. A yaw requiring an 18% displacement throw of the rudder might end up being much greater because the rudder limiter is permitting (courtesy of the ADC and FCS software) up to 16 degrees full throw (instead of the 10 deg appropriate to the actual airspeed at that instant). That much greater (or simply inappropriate) corrective yaw causes another ADC sensing error and the tail goes into "wag" mode (familiar to A300 backenders). Eventually the damping effect of that large fin normally causes these rudder-induced overshoot oscillations to dissipate. But you need a trigger for this to "kick off" - some initial yaw. atmospheric disturbance, pilot "stretching" with feet on rudder pedals (done it myself), climb/descent through an inversion, wind-shear, turbulent air, wake turbulence etc etc. Help me out here.

e. But why did AA587 self-destruct? I think it may be as simple as the first wake encounter starting the tail wagging the dog and the next wake encounter really confusing the issue and leading to an instantaneous fin overload (the rattle of that semi-detached fin indicating that lugs had sheared and that the fin was on its way). These fins and rudders on the big twins are quite powerful because they have to accommodate OEI any old time. Courtesy of the
system that tempers that power, the FCS is quite capable of breaking the fin off - both due to it being a composite structure (that won't just partially fail/fatigue crack) and because the range of rudder-throw action is large. At 250 kts it shouldn't exceed 9.3 deg, but if you fool it into thinking it's at 165 kts, you can have the whole 30 degrees of throw. Obviously that's going to be enough to break it at the higher speed. I'm not suggesting that it went full-scale deflection, just that induced static errors caused the ADC to continually re-schedule the FCS to permit inappropriate deflections for the actual airspeeds - leading to an oscillatory flutter as each deflection proved inappropriate - yet gave rise to the need for a prompt further deflection (and thus becoming oscillatory). That's not overswing (per the FAA release), it's system error - where the rudder's power is pitted against the inherent dampening of the fin. At a certain point it will become exponential and destructive. Because of this classic A300 tail-wag, the sensed static port pressure was never on
the money and the ADC/FCS interaction was in full disagreement (after the first wake-induced yaw) when the second wake turbulence encounter hit at just the wrong angle and broke a fin lug, starting the fin's rudder-driven death-rattle.

f. Why the bent FEDEX rudder actuator rod? Sometimes the fin wins and the periodicity of the feedback to the rudder is sufficient to bend the actuator.

g. Or perhaps it wasn’t the FCS computer’s fault at all, perhaps it was a cross-wiring or a reversed hook-up of the static ports or a hydraulic servo valve. Whatever it was, if it was a hardware flaw, it may have been that way for a while. Sometimes you need a significant divergence (such as that caused by wake turbulence), before you cross a trigger-point for feedback mayhem. Think of the microphone analogy. If you place an open mike in front of a speaker that’s in the same circuit, as long as the volume is way down there’ll be no feedback squeal. Wind it up a little and it will suddenly be deafening.

5. No doubt someone will now tell me that yaw-induced static port pressure errors aren't of sufficient magnitude to start this ball rolling....

or that this is all accommodated in a cunning ADC/FCS program patch of narrow notch (or broadband) filtering.. But as I said, it's just a theory that seems to fit the bill (and, if correct, one flaw which should be easily fixed). I don't think that it's a fin strength composite) problem. Whether or not this static port theory holds water, it's still likely to be an FCS computer-derived (and driven) flutter that arises from a sensing problem. Just keep in mind that the rudder has two movements. Rudder deflection resolves the yaw (or is intended to) and then (in an ideal world) centering sends the rudder to parade rest, calmly zero'd in trail. But in my theory, there was always a bunfight going on back there and a simple recentering was rarely on the cards; sometimes the yawing gave cause for alarm, but normally the static port error wasn't significant because the yaw wasn't massive and so the natural damping of that large fin meant there were only a few wags at most. But the potential was (and is still) there for an A300 to eventually meet its wake encounter match. One is left wondering what the "break-out" yaw angle/rate is (that might "dud" the static port pressures and set this ball rolling).

And while we're at it, also think about the effect of some trapped water in one side of the static system - and what effect its inertia might have (on the ADC sensed pressure) during yaw gyrations.

Belgique - Masterful!

Your lucid and clearly communicated static port theory is the first I have seen that explicitly addresses the "second failure mode" of the independent rudder-travel limiting mechanism seemingly failing to keep rudder deflections inside the stipulated limits for the aircraft speed.

The AA587 aircraft might have ridden through the wake events OK if the extreme deflections of rudder had been limited according to the speed vs throw-angle rules - even if the First Failure Mechanism for rudder oscillation were present due to design instability, wiring faults, or both.

One suspects the static system value data has considerable mechanical and/or electronic "buffering" in it, so that responses to individual port changes are averaged over a time interval of seconds, at least. Because it is the baseline reference for barometric calculations, fast response to static pressure variations would just add noise to the gauges and controls.

If this is the case, a pressure-change from the first wake event (and related slip?) might have created enough distortion of the averaged static pressure that the computed airspeed for rudder limiter purposes was scaled back toward the 165K mark where up to full rudder travel is allowed. The inter-wake interval leaves time for the (probably fairly slow) mechanical travel interlocks to reposition for a substantially wider rudder travel window. Then comes wake bump number 2, which sets off the First Failure Mechanism on a cycle of uncommanded rudder oscillations. Because the rudder travel window is inappropriately wide at that moment, those swings do the tail in, in short order.

I sure wish someone would start measuring how "normal" A300's wiggle their tails in the course of a working day....per my comment on the "Pilots want A300's grounded " thread.

The critical condition is to put the aircraft into a sideslip, and then apply full rudder against the slip. The Federal Aviation Regulations (FARs) only require that the fin be strong enough to take neutral rudder in a slip, and the load increase from applying opposite rudder can be more than the 50% margin to which aircraft are designed. Applying rudder against a slip may exceed the ultimate load of the fin, depending upon aircraft characteristics.

The Flight 587 flight data recorder (FDR) shows three lateral accelerations of 0.3g and 0.4g right, and 0.4g left, in the approximately 7 sec. before it appears that the fin came off. Aviation Week estimates show that the aircraft may have been in a full slip to produce the high accelerations. During the same period the FDR shows the rudder making about five deflections of 5 to 10-11 deg., culminating in a rudder reversal immediately before the fin apparently came off. The 10-11-deg. deflection is the maximum allowed by the A300's rudder limiter, suggesting it was working correctly.

The large rudder deflections and sideslip angles indicated by the FDR are the combination of conditions that may overload the fin. It is not clear why the rudder made these motions. The National Transportation Safety Board (NTSB) said last week that it was still investigating both mechanical and pilot sources for the motions.

Though the A300 has a rudder limiter to protect the tail structure, it allows fin side loads of about 80,000 lb. at 250 kt., close to the approximately 240-kt. airspeed when the rudder went haywire and the fin came off. That is 60% higher than our estimate of the design load and possibly at a level where the fin could fail. These loads are greater than other conditions that might design the tail, such as the roughly 20,000 lb. needed to balance an engine failure at takeoff and the 40,000-45,000 lb. that we estimated to be the maximum gust load.

Airbus declined to comment on our estimates due to the ongoing NTSB investigation, but said the questions raised "are of relevance."

The chart shows that fin forces increase with sideslip, and that applying rudder against the slip (points X and Y) further increases the load beyond design limits. The basic slope of the lift curve was estimated using NACA TN 775. Rudder effectiveness was estimated as a fraction of fin lift from several sources. Wash out of lift and rudder effectiveness with sideslip came from jet transport simulator data.

THE FARS DON'T COVER the opposite rudder case because regulations have been written with consideration for the intended use of the airplane, said an FAA official with the Transport Airplane Directorate in Seattle. "Transport category airplanes, by virtue of their passenger carrying function, are not intended to be subjected to violent maneuvering conditions. The suitability of the current regulations as being adequate to ensure an acceptable minimum level of safety is based, in part, upon the historical record of vertical tail failure incidents."

That record appears to show that Flight 587 is the first time in civilian jet transport history that a fin has come completely off due to aerodynamic loads. It is on the order of the one-in-a-billion-flight-hours safety rate targeted by the FARs.

Avoiding abrupt rudder usage is considered standard airmanship by the industry, an Airbus official said. Both Boeing and Airbus have highlighted concerns about rudder usage in their upset recovery literature, warning that too much rudder could lead to loss of control or even structural failure.

Fin loads are mostly described in two paragraphs in FAR Part 25, which regulates airworthiness of transport aircraft. Paragraph 25.351 covers yaw maneuver conditions, and 25.341 covers gust and turbulence loads. Our analysis of the A300 found that yaw maneuver is the critical case.

Paragraph 25.351 spells out a simple maneuver and requires that the manufacturer analyze the loads at four conditions (see graphic, p. 24). The maneuver is to:

• Fly straight and level, and step on the rudder pedal with a large force (condition A),
• Maintain rudder and let the aircraft swing to a peak sideslip angle that is beyond equilibrium slip due to fuselage momentum (condition B),
• Maintain rudder and let the aircraft swing back to equilibrium sideslip (condition C), and
• Neutralize the rudder while at equilibrium sideslip (condition D).

An FAA official said each condition tends to load different parts of the fin, such as the front spar, rear spar, hinges, rudder, etc., but condition D can create the highest fin bending loads, as far as the regulations are concerned. But he noted that some aircraft may have different critical conditions.

Conditions A, B, C and D are also marked on the graph of tail loads (below). The units on the left-hand scale are tail lift coefficient, referenced to the estimated fin area of 470 sq. ft. The center line shows how tail lift varies with sideslip, with the rudder fixed in the neutral position. The slope of the line is negative per aeronautical convention. At 15 deg. it starts to wash out due to nearing maximum lift and fuselage interference.

The upper and lower lines show the effect of applying 10 deg. of left and right rudder. The A300 rudder is relatively powerful because it is large--about 34% of the total fin chord. Rudder effectiveness also washes out with increasing sideslip, and this affects the critical anti-slip rudder (the bottom line) more than pro-slip rudder. The 10-deg. rudder deflection is approximately the maximum allowed by the rudder limiter at 250 kt. We assumed that 10-deg. of rudder would give a 10-deg. sideslip, which is typical behavior.

The chart is a presentation of static conditions, and real aircraft behavior is dynamic. The 39 deg. per sec. rudder only takes 0.5 sec. to move from stop to stop at 250 kt., during which we estimated dynamic sideslip angle would reduce by 1-1.5 deg. at condition X, and slightly more at condition Y. With this small reduction the loads are still at or beyond 1.5 times condition D. Also, reversing the rudder while swinging outbound through point C would produce high loads because fuselage rate would act to increase effective sideslip angle.

Given the limited amount of FDR data released by the NTSB it is not clear if forces approaching X and Y were achieved, but the high sideslip and rapid full rudder motions are ripe for this possibility. The exact motions may never be known because the FDR only measured the rudder twice per sec., while it can move at 39 deg. per sec.--it could go from neutral to the stop and back between samples. And as the NTSB noted last week, fast rudder motions were distorted by being filtered.