Days of Our Discontent: The crash of American Airlines flight 587
Note: this accident was previously featured in episode 17 of the plane crash series on December 30th, 2017, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 12th of November 2001, an American Airlines Airbus A300 bound for the Dominican Republic plunged from the sky shortly after takeoff from JFK International Airport, tearing a fiery swathe through a residential neighborhood and claiming the lives of 265 people. With New York still darkened by the looming shadow of 9/11, the crash sparked fears that the terrorists had struck again. But when the evidence began to point toward a different explanation, America seemingly lost interest — leaving one of the country’s worst air disasters to disappear from the nation’s collective consciousness.
Within the aviation industry, however, the cause of the crash shocked experts and pilots alike. What seemed at first to have been a catastrophic mechanical failure that ripped the wide body jet apart in midair turned out to be something much more bizarre. As the plane encountered wake turbulence from a Boeing 747, the first officer overcorrected, then overcorrected in the opposite direction, over and over until the plane slewed so hard to the side that the vertical stabilizer ripped off in flight. How could this happen? Could a pilot really rip the tail off his own plane using nothing more than the flight controls? Who had taught him this deadly technique, and why? The findings left a bitter taste in the mouth of Airbus pilots, but much of the controversy in the wake of the crash would not have occurred had the media more accurately represented the investigation’s conclusions — and had Airbus taken responsibility for its own central role in the accident.
◊◊◊
In 1988, seeking high-capacity, efficient aircraft to fly lucrative Caribbean routes, American Airlines decided for the first time in its history to look to Europe’s Airbus, eying its newly updated A300–600 wide body twin jet. The A300 was not new technology: it was designed in the late 1960s and entered service in 1971. However, the new -600 variant had two things going for it: an unusually large amount of luggage space, perfect for accommodating the greater-than-average amounts of baggage carried by passengers on their way to the Caribbean; and newly modernized avionics and flight controls, incorporating in limited form some of the advances Airbus had recently made in fly-by-wire technology and flight envelope protections. American Airlines ultimately ordered 35 of the aircraft, each one capable of carrying 250 passengers.
By 2001, the A300s had been established in the American Airlines fleet for 13 years, carrying millions of passengers safely to and from destinations all across the Americas. One of the most popular was flight 587, a regular shuttle between New York City and Santo Domingo, capital of the Dominican Republic. Among New York’s large Dominican community, flight 587 was not merely a lifeline, but a cultural phenomenon all of its own. The act of flying home to Santo Domingo with American Airlines had its own rules of etiquette and style of dress. Characters in Dominican movies would frequently fly aboard flight 587, and “Flight 587” was the title of a song by famed Dominican singer Johnny Ventura:
‘’The airplane arrived
This is Flight 587, destination Santo Domingo
The airplane arrives full with bursting suitcases
It arrives full of hope
Also full of joy
To spend the Christmas season with my people
And look and see if more can fit
To take it to my mother
I’m taking seven suitcases
And this is not enough!”
But on the morning of the 12th of November 2001, the flight full of joy would be forever shattered.
◊◊◊
That morning, flight 587 was, as always, fully booked, with 251 passengers and nine crew aboard. In command were two experienced American Airlines pilots: 42-year-old Captain Ed States, and his 34-year-old First Officer Sten Molin, a second generation aviator whose father also made a career flying jets.
Shortly after 09:00, the A300 pushed back from the gate at John F. Kennedy International Airport, fueled up and ready to fly. The pilots carried out routine control checks; everything was in order. Flight 587 taxied toward runway 31L, just behind Japan Airlines flight 47, a fully loaded Boeing 747 bound for Tokyo.
At 09:11, flight 47 took off, turning left across Jamaica Bay as it climbed away from the airport. Watching it go, the tower controller said to flight 587, “American five eighty seven heavy, Kennedy tower, caution: wake turbulence. Runway three one left, taxi into position and hold.”
All large aircraft, especially those given the qualifier “heavy,” generate wake vortices which can disrupt aircraft behind them, potentially causing smaller planes to roll uncontrollably. This wake turbulence is rarely a serious problem for aircraft as large as the A300, but it is standard procedure for controllers to warn pilots if it may be present, and they are required to space aircraft apart during takeoff and landing to give time for the turbulence to dissipate.
Two and a half minutes after the departure of the 747, Kennedy tower cleared flight 587 for takeoff.
In the cockpit, First Officer Molin, who was flying the plane, asked Captain States, “You happy with that distance?”
“Aah he’s… we’ll be alright once we get rolling,” said States. “He’s supposed to be five miles by the time we get airborne, that’s the idea.”
“So you’re happy, right?” Molin asked.
“Yeah,” States replied.
Seconds later, the pilots pushed the thrust levers forward, and flight 587 was away.
About one minute after takeoff, as the crew turned left toward their first waypoint, the plane hit the wake of the 747 in front of it. The cockpit voice recorder captured some mild squeaking and rattling as the plane plowed through the rough air.
“Little wake turbulence, huh?” States commented.
“…Yeah,” said Molin.
Six seconds later, the plane hit another patch of wake turbulence. The plane rolled ten degrees to the left, on top of the 23-degree left bank it was already in. Startled by the jolt, First Officer Molin steered to the right with both the yoke and the rudder. In response, the plane yawed sharply to the right, entering a sudden sideslip. Molin instinctively countered, pushing the rudder hard to the left, and the plane followed, swinging around violently in the opposite direction. Less than a second later, he pushed the right rudder pedal again, and the plane swung back a third time, skidding through the air like a drift car going around a corner.
“Max power!” Molin breathlessly exclaimed, reaching for the thrust levers.
“You alright?” States asked, confused by the plane’s rapid movements.
“Yeah, I’m fine,” Molin choked.
“Hang onto it, hang onto it!” States said.
“Let’s go for power please!” Molin repeated. The plane yawed again, careening back and forth in a deadly, escalating dance.
At that moment, as the plane swung into yet another terrifying sideslip, the vertical stabilizer gave way under the immense strain. In a fraction of a second the entire tail snapped off at its base, ripped away as though it were made of paper. The pilots heard a loud snapping sound, and then the plane started to spin out of control, a deafening roar rising behind their terrified voices.
“Holy shit!” Molin shouted. “What the hell are we into!? We’re stuck in it!”
Trapped in a dramatic right sideslip with no directional control, the plane quickly spiraled in and began to fall from the sky. Massive G-forces ripped off both engines almost simultaneously, and the flight data recorder ceased recording.
“Get out of it, get out of it!” States screamed. But there was nothing they could do — their plane was tearing itself apart in midair.
Without the flight data, what exactly the plane did in its final seconds will never be known with certainty. Some witnesses said the plane rolled steeply and dived into the ground; others said it fell like a leaf, spinning around and around in a horrific death spiral. What is known is that at 09:16 and 14 seconds, less than two minutes after it took off from JFK, flight 587 slammed into a residential neighborhood with a sound like thunder.
At the corner of Newport Avenue and Beach 131st Street in the Belle Harbor neighborhood of Queens, the Monday morning quiet was abruptly shattered by a tremendous explosion and a hail of flying debris. A wall of fire erupted into the clear blue sky above the rows of wood-frame houses, and pieces of flaming wreckage hurtled past ticky-tacky porches and white clapboard fences. In a matter of seconds, a quaint slice of urban Americana had turned into the seventh circle of hell.
Moments after the crash, people poured onto the streets, staring agape at the inferno, while others fled in shock from houses already aflame. Some saw the plane come down, others did not, but all had only one thing on their minds: the specter of September 11th. Just two months earlier, terrorists had traumatized New York and the world by flying airplanes into the World Trade Center, killing nearly 3,000 people. The residents of Belle Harbor had lost neighbors, family members, and friends. The last funerals for fallen firefighters, many of whom lived in Belle Harbor, had concluded only three days ago. And now, it seemed, the evil that had taken their fellow New Yorkers had come for them as well.
As news of the crash spread, city officials reacted as though it were the beginning of another campaign of airborne terror. Authorities closed all of New York’s bridges, airports, and tunnels, evacuated the Empire State Building, and locked down the United Nations. As firefighters battled the towering flames, the rest of the city ground to a halt in a matter of minutes.
In Belle Harbor, it soon became clear that not all of the plane made it to the main crash site. One of the engines came down in the parking lot of a petrol station at 442 Beach 129th Street, 250 meters away from the rest of the plane, and the other engine badly damaged a house and a boat one block over, at 414 Beach 128th Street. Even more bits of airframe, parts of engines, and other debris fell like metallic rain over an area several blocks long, including the left wingtip, which landed at the intersection of Beach 125th Street and Cronston Avenue. And the biggest piece of all — the vertical stabilizer, remarkably intact except for where it had been sheared off at its base — was found floating in Jamaica Bay more than a kilometer from the crash site. Whatever brought down the plane, it must have been catastrophic.
In all, the crash totally destroyed four houses and damaged six more, three of them beyond repair. For the people on board, it was obvious that there was no hope: all 260 passengers and crew were killed instantly on impact. Another five residents of Belle Harbor also perished as the plane slammed into their homes. But the shock of the tragedy was perhaps felt most keenly thousands of miles away, in the Dominican Republic, where desperate relatives waited in Santo Domingo for a plane that would never arrive. Some 90 percent of the passengers were of Dominican origin, making the crash one of the worst losses of life in that country’s history. As they desperately scoured the passenger manifest, Dominican-Americans asked themselves: why us? Why, out of all the flights that stream in and out of JFK, did it have to be flight 587?
◊◊◊
By the end of that day, experts were confident that terrorism was not the most likely explanation for the crash, noting an absence of suspicious passengers or communications, unidentified bags, or claims of responsibility. Newspapers were careful to point out that a mechanical failure was the leading theory, and that the National Transportation Safety Board had been placed in charge of the investigation instead of the FBI. Nevertheless, terrorism would not be officially ruled out until days later, and it took quite some time to convince a jittery populace that Al Qaeda had not come back for round two.
As the NTSB descended on the scene, investigators were able to recover the black boxes and listen to the cockpit voice recording within a short time after the crash. The cockpit conversations, in combination with the flight data, revealed something that the NTSB had never seen before. During its initial climb through about 2,500 feet, the plane encountered seemingly mild wake turbulence from the 747 in front of it. Immediately thereafter, the FDR recorded a bizarre series of inputs: full right rudder, then full left rudder, then full right rudder again, repeated five times in the space of just seven seconds. The plane skidded into an extreme sideslip, then there was a bang, and the vertical stabilizer departed the airplane. Investigators were left with two central questions. Could the stabilizer really have broken off solely from the aerodynamic loads induced by the pilot’s rudder inputs, or was there something else wrong with it? And why did First Officer Sten Molin make those inputs in the first place? The answers to both questions would shock the entire industry.
Initially, there were some points of concern with the design and fabrication of the A300’s vertical stabilizer. The A300–600 represented one of the first planes to incorporate structural elements made from carbon-fiber reinforced plastics (CFRPs), commonly referred to as composites, which can be stronger, lighter, and more flexible than the metals they replace. When the investigation started, NTSB investigators didn’t even know what long-term fatigue damage in a composite material would look like — everything had to be learned from scratch.
One of the most common failure modes of a composite material is delamination. CFRPs are made up of hundreds of thin layers fused together into a continuous surface, but if they are not properly bonded, two layers could delaminate from one another, creating a weak area in the material. As it turned out, the aircraft involved in the accident had problems with delamination while it was still at the factory. Before the plane was ever delivered to American Airlines, Airbus had to repair delamination caused by a manufacturing error in one of the six main attachment lugs connecting the vertical stabilizer to the tail. The fix required the application of several additional layers of CFRP secured by titanium rivets, a repair which was performed by the book but which may have had unexpected long-term consequences. The NTSB therefore had to seriously consider the possibility that the tail failed under the first officer’s rudder inputs because it was already compromised by this 13-year-old repair.
However, as teams of experts carried out structural analyses on the recovered wreckage of the vertical stabilizer, it became clear that the lug which was repaired was not the one which failed first. The lugs are arranged in two rows of three; the repaired lug was the middle one on the left side, while a detailed investigation of the breakup sequence showed conclusively that the separation began from the rearmost lug on the right side. Furthermore, this lug showed no signs of pre-existing damage; rather, it had failed in overload. The question then was whether the lugs were strong enough in the first place.
In 1986, during testing of the new composite tail for the A300–600, Airbus conducted a load test to determine how much lateral loading the tail could withstand before breaking. During the test, the tail easily handled the design limit load — the largest load the tail is expected to experience during the lifetime of the aircraft. It also held up against the ultimate limit load, defined as 1.5 times the design limit load, the amount of force it is legally required to withstand without fracturing. The test continued until the tail finally snapped off its mountings at more than twice the design limit load. And just like flight 587, the failure started with the rearmost lug on the right side — compelling evidence that the accident airplane’s tail had failed because it was subjected to a sideways load in excess of its structural limit. To prove this beyond all doubt, the NTSB repeated the tests themselves and achieved identical results — everything, down to the specific type of damage on each lug, matched what was found on the wreckage of flight 587.
The problem with all of this was that every aircraft has a design maneuvering speed, or VA — a speed below which it should not be possible to overstress the airframe using the controls. For the Airbus A300, this was 270 knots or 0.78 Mach, whichever was lower. But flight 587 was traveling at about 250 knots when the stabilizer broke off, well within this limit. According to the definition of VA provided by the Federal Aviation Administration, it should not have been possible to move the rudder in such a way as to subject the tail to twice its design limit load, as must have happened to flight 587, while traveling at only 250 knots. The fact that this apparently happened anyway raised serious doubts about whether the design of the A300–600’s stabilizer and rudder system complied with federal regulations.
But when the NTSB dug into the rules governing aircraft design, they found that the requirements were not as clear-cut as anyone had assumed. At high speeds in cruise, suddenly wrenching the controls of a traditional airplane all the way in one direction could cause the aircraft to break apart in flight, and all pilots know this; but pilots, airlines, and investigators had always taken VA to be a hard speed limit below which it was not possible for the pilot to break the airplane using the controls in this way. In reality, however, manufacturers were only obligated to show that single inputs would not break the airplane below this speed. Combinations of inputs, such as repeatedly moving the rudder back and forth from full left to full right deflection, were never tested, nor were they required to be, because there was no justifiable reason for a pilot to do this.
To understand the behavior of the airplane in this untested scenario, experts calculated the loads that would be exerted on the stabilizer when the rudder was moved back and forth across its full range five times in seven seconds, as occurred on the accident airplane. What they found was that each successive reversal progressively increased the aerodynamic loads on the vertical stabilizer. Normally, loads peak when the sideslip angle is greatest, but as the repeated rudder inputs caused the sideslip angle to rapidly oscillate from left to right, the magnitude of each successive sideslip increased, as did the lateral distance the tail must travel, and the speed at which it did so. And each time this occurred, the massive surface area of the stabilizer acted like a sail, pushing against the air with enormous force. The result was that such a sequence of inputs would prevent sideways aerodynamic loads on the stabilizer from dissipating and could ultimately stress it to the point of failure. Investigators were stunned: this was a failure sequence which had never been seen before in the history of commercial aviation.
This finding placed even greater importance on the NTSB’s parallel quest to understand why First Officer Sten Molin made this catastrophic series of rudder inputs. A300 pilots and investigators alike were mystified by his actions — but, interestingly enough, some pilots who had flown with Molin on the Boeing 727 before he switched to the A300 were less surprised.
According to these pilots, Molin was a capable aviator with above average skills, except for one bizarre quirk: he was so unnerved by wake turbulence that he tended to overcontrol the airplane upon encountering it. One captain related the story of a wake turbulence encounter on the 727 during which Molin rapidly moved the rudder back and forth upon encountering a relatively benign wake vortex. The inputs were so unusual that the captain initially assumed Molin must have been reacting to an engine failure, but he soon realized nothing was wrong with the plane. When he later asked Molin why he had done this, the young First Officer dropped a bombshell: as far as he understood, this was what he had been taught to do during the American Airlines Advanced Aircraft Maneuvering Program.
The Advanced Aircraft Maneuvering Program, or AAMP, was a series of lectures and training scenarios developed by American Airlines in the mid to late 1990s intended to give pilots the skills needed to recover from unusual situations that they would not encounter during normal operations, such as nose high and nose low upsets, steep bank angles, developed stalls, and inverted positions.
Investigators became particularly interested in a simulator scenario designed to teach techniques for recovering from bank angles in excess of 90 degrees. During the scenario, pilots were told that they would be taking off behind a Boeing 747 and received a standard “caution: wake turbulence” warning. Then, during climb, the plane would encounter “wake turbulence,” and the instructor would press a button causing the plane to roll ten degrees, then roll rapidly toward 90 degrees in the opposite direction. For the first few seconds of the roll, the aileron and rudder controls were inhibited in order to ensure that the bank angle reached 90 degrees before the pilot could initiate a recovery. Most pilots found that they needed to make large inputs with both the ailerons and rudder in order to regain control, and many developed a technique of pre-emptively moving the rudder and ailerons to full opposite deflection while the control inhibition was still in place in order to decrease the required recovery time after it was removed. This occurred unconsciously, because pilots were not told that the controls had been inhibited.
The problem with this scenario was that while it was supposed to be about recovery from extreme bank angles, pilots sometimes came away believing that it was actually about recovery from a wake turbulence encounter. In small aircraft, encountering the wake of a Boeing 747 could occasionally look and feel like the simulation. However, no aircraft the size of the A300 has ever suffered such an extreme upset as a result of wake turbulence; in fact, most wake turbulence encounters are fairly benign, with the most extreme such events on the A300 rarely resulting in bank angles more than 30 degrees, let alone 90. Furthermore, in a real wake turbulence encounter, there is no inhibition on the flight controls, and recovery can be accomplished using the ailerons only. The scenario therefore could have taught A300 pilots three dangerously incorrect ideas about wake turbulence: that it could roll their plane inverted in a matter of seconds; that the plane would not immediately respond even to maximum opposing control inputs; and that it would be necessary to use the rudder to recover. These misleading takeaways could have convinced First Officer Molin that if he did not react aggressively to wake turbulence using the rudder, he could lose control of the airplane.
It was not lost on the NTSB that the real scenario encountered by flight 587 was a near-perfect match for the simulated wake turbulence encounter both pilots had undergone during the AAMP training. They were taking off behind a 747, they were warned of wake turbulence, and upon encountering the turbulence the airplane rolled an additional ten degrees to the left. The situation was primed for First Officer Molin, already known to be skittish around wake turbulence, to overreact. But there was one more factor in play, a deadly design flaw which may have turned this overreaction into an unprecedented catastrophe.
The problem lay in the design of the A300–600’s rudder control system. Every rudder control system on a large airplane has to compensate for the fact that the reaction of the aircraft to any given amount of rudder deflection becomes exponentially more extreme as the plane’s airspeed increases. Therefore, the A300 progressively reduces the maximum allowable travel of the rudder from 30 degrees while below 165 knots to 3.5 degrees while above 395 knots, with several intermediate stages as well. On most aircraft, including the original A300 variants, this was accomplished using a variable ratio arm (VRA) rudder travel limiter, which causes full deflection of the rudder pedal to produce different rudder responses depending on airspeed. This ensures a consistent airplane response to any given input pressure on the pedals regardless of how fast the airplane is flying.
But the rudder travel limiter on the Airbus A300–600 and the related A310 worked differently. These aircraft had a variable stop actuator (VSA) rudder travel limiter, which simply reduced how far the pilot could push the pedals at higher airspeeds instead of changing the reaction of the rudder to a given amount of input pressure. More specifically, at 135 knots it was possible to depress the rudder pedal by 10 centimeters, but this was reduced to 3.2 centimeters at 250 knots, in proportion with a reduction in maximum rudder travel from 30 degrees to 9.3 degrees. The effect of this design was that the rudder control system became increasingly twitchy as the plane accelerated. In fact, to achieve maximum allowable rudder deflection at 135 knots, pilots needed to apply 65 pounds of force to the pedals, but only 32 pounds of force were required to achieve the same effect at 250 knots. Furthermore, 20 pounds of force were already necessary just to move the pedals from the resting position, so there was only a 12-pound force difference between no rudder deflection and maximum rudder deflection at this airspeed. And even at low speeds, the A300–600’s rudder pedals were noticeably more sensitive than on other large airplanes; this problem simply became even worse as speed increased. One can already see how — at any speed, high or low — a pilot might depress the rudder pedal a certain distance, intending to make a reasonable input, only to effect maximum rudder deflection instead.
Even if pilots were aware of how this system worked, the risk of accidentally making larger-than-intended rudder inputs at high speeds was rather alarming. And as it turned out, pilots at American Airlines were definitely not aware that they could achieve maximum rudder travel at 250 knots by depressing the rudder pedals a mere 3.2 centimeters — because Airbus never bothered to tell them. In fact, throughout the course of the investigation, Airbus never clearly explained why there was no information about this system in the Flight Crew Operations Manual or in any training materials.
In Airbus’s opinion, the rudder was only to be used for three purposes: to keep the plane straight during takeoff, to crab the airplane during a crosswind landing, or to compensate for asymmetric yaw due to an engine failure. None of these procedures required full deflection of the rudder, nor would they commonly be used while traveling at high speed. But Airbus had not provided airlines with any such limitations on when A300–600 pilots could use the rudder, and American Airlines was training crews to use it in a variety of additional scenarios, such as to recover from extreme bank angles, or to induce roll while in a stall. In practice, this meant that pilots could be using the rudder in inappropriate situations without understanding its exceptional sensitivity. And, in fact, they were — with sometimes terrifying results.
Over the course of the investigation, the NTSB discovered no less than ten events involving the A300–600 and the similar A310 during which the vertical stabilizer experienced loads in excess of the design limit. And in five of these incidents, the excess load appeared to have occurred because the pilot made repeated large inputs with the rudder pedals. Three of the incidents may even have exceeded the ultimate load limit required by regulations. The most noteworthy of these cases involved an A300–600 operating American Airlines flight 903 in May 1997. During this flight, the plane experienced a sudden bank to fifty degrees while in an otherwise normal turn, because the aircraft was flying too slowly and the inside wing started to stall. In reaction to this steep bank, the pilot made large rudder inputs which quickly escalated into a series of alternating sideslips similar to those experienced by flight 587. A flight attendant and a passenger were injured, but the pilots ultimately regained control and landed the airplane safely in Miami, Florida. After reviewing the flight data, Airbus discovered that the vertical stabilizer had experienced a lateral force 1.53 times the design limit load. The difference between flight 903 and flight 587 might simply have been their differing speeds at the time of the upsets: flight 587 was flying much faster than flight 903, resulting in higher aerodynamic loads that were sufficient to cause the failure of the stabilizer.
Considering all of this evidence, it was plausible, perhaps even likely, that First Officer Molin never intended to apply full rudder in response to the wake turbulence. He might well have believed that depressing the pedal 1/3 of the way to the floor would use 1/3 of the maximum rudder authority, when in fact at 250 knots this would result in full rudder deflection. Therefore, having been indoctrinated with an incorrect belief that the use of the rudder was necessary during a wake turbulence encounter, he reacted to the initial ten degree left roll by steering right with both the rudder and ailerons. However, having accidentally applied maximum right rudder, the plane’s response would have been far larger than he was expecting. This in turn could have led him to believe that the plane’s violent right roll and sideslip were caused by the wake turbulence, not his rudder input. Believing that the turbulence was trying to roll his plane sideways as it did during the simulations, he applied full left rudder to counter it.
At this point, First Officer Molin experienced a rare and deadly condition known as adverse Aircraft-Pilot Coupling (APC). Defined as a series of “unexpected, and unintended excursions in aircraft attitude and flight path caused by anomalous interactions between the aircraft and the pilot,” adverse APC somewhat resembles the experience of an automobile driver caught in a fishtailing maneuver. An initiating event causes a large reaction, which in turn sends the car or airplane into an undesired maneuver, which the pilot or driver then instinctively counters, making the situation even worse. In a car, this usually ends in a spinout and a collision with a highway barrier, but in an airplane it can lead to a complete loss of control or even the breakup of the aircraft.
In the grip of an adverse APC event, First Officer Molin did not have time to realize that the plane was swaying and rolling violently from side to side because of his own inputs. Each time the plane entered an extreme sideslip, he pressed on the over-sensitive rudder pedals hard enough to put the plane into an extreme sideslip in the opposite direction. Without being aware of it, he had stopped fighting the wake turbulence and started fighting himself.
Unfortunately, there was no time for either pilot to realize what was really going on. Just seven seconds into the sequence of escalating sideslips, the tail ripped off, and recovery became impossible. Both Ed States and Sten Molin likely went to their graves believing that wake turbulence had brought down their plane.
The NTSB had now revealed a perfect storm of misleading training and bad control system design which combined to bring down American Airlines flight 587. But one question remained: could the accident have been prevented?
Many of those involved in the investigation came to believe that the answer was yes. They found it alarming that A300–600 and A310 aircraft had experienced ten separate incidents in which the design limit loads on the vertical stabilizer were exceeded, and yet Airbus seemingly made no effort to search for an underlying problem. Other manufacturers reported no such incidents, and indeed no such incidents should occur, since the design load limit is already defined as the maximum load the plane is expected to experience during its lifetime. Repeated exceedances of this limit should tell a manufacturer that some of its fundamental design assumptions are wrong, something which should have raised alarm bells at every level of the company. And yet Airbus seems to have displayed a remarkable lack of curiosity, which could also be characterized as secretiveness, or even a cover-up, depending on your preferred level of cynicism. In fact, not only did Airbus never attempt to find a common cause for the events, they didn’t even tell the NTSB that the stabilizer on American Airlines flight 903 had exceeded its ultimate load limit until after the crash of flight 587! Had they instead properly investigated this incident and others like it, they might have discovered that pilots were having trouble with the over-sensitive rudder controls, but they did not.
Furthermore, Airbus had told American Airlines to inspect the tail of the airplane involved in flight 903, but American found no defects, and the plane was returned to service. But while examining the stabilizer attachment lugs from this aircraft during the investigation into the crash of flight 587, the NTSB found that the incident had in fact damaged the composite structure in places which were only visible if the stabilizer was removed from the airplane. Unable to see the damage, American Airlines had let the plane fly for five years in an unairworthy condition because Airbus never informed them that removal of the stabilizer was required in order to conduct a complete inspection.
Investigators also noted that the design of the Airbus A300–600’s rudder control system clearly fell short of FAA certification requirements. According to federal regulations, an aircraft control system should not feature displacements which are so small and/or control forces which are so light as to lead to the possibility of severe overcontrol. But it seemed Airbus never made any attempt to determine whether its redesigned rudder control system on the A300–600 met this requirement. When asked how the company evaluated the handling qualities of the updated model, Airbus test pilots said they simply flew the airplane and assessed whether it felt right or not. Having done this, Airbus put the system into service on the updated A300s without even informing European regulatory authorities that its design had fundamentally changed. This represented an unacceptable breakdown in the aircraft certification process that directly contributed to numerous subsequent incidents, including flight 587.
The shocking lack of transparency by Airbus about these issues was most apparent to people who attended the NTSB’s public hearings, because criticism of witnesses’ conduct during the investigation process rarely makes it into official reports. But when the final report on the crash of flight 587 was published in October 2004, it nevertheless portrayed a complex and nuanced set of factors which led to the crash, and outlined in careful detail the dozens of studies comprising thousands of man hours which led to their conclusions. And yet, despite this fascinating piece of investigative work, huge numbers of people took away completely the wrong message from the NTSB’s conclusions. Even before the report was officially released, news media distilled the findings down to the simplest possible sound bite: the crash was caused by pilot error. It was Sten Molin’s “excessive” rudder inputs which led to the disaster, they said. The probable cause statement did use the words “excessive” and “unnecessary,” but too many reporters clearly never read any farther than that. The crash of flight 587 was not caused by pilot error, but by the interaction of multiple deficient systems, from pilot training to aircraft design and certification.
As a result of this lazy media coverage, many people believe to this day that the NTSB determined pilot error to be the cause of the crash, even though the report itself tells a different story. And because of that misconception, there persists a widespread but erroneous belief, especially within the aviation industry, that the NTSB somehow whitewashed the real causes of the disaster. The investigation was derided as a classic case of “blaming the pilot,” when in fact it was media reporting which blamed the pilot, not the NTSB.
In large part due to this incorrect perception of the findings, “alternative” theories about the cause of the crash remain unusually popular. Many pilots still refuse to believe that it is possible to rip the tail off a jet simply by manipulating the controls, even though the NTSB’s most urgent goal was to dispel this flawed assumption. Furthermore, early speculation that there was something wrong with composite materials continues to feed conspiracy theories alleging that the tail broke off because of poor quality manufacturing, and that the NTSB colluded with Airbus to cover it up. Even if we ignore the question of why the NTSB would falsify an investigation on behalf of a foreign company, the concerns about composites have not aged particularly well. The crash of flight 587 lies closer in time to the original introduction of composite aircraft structures than it does to the present day, and in the 20 years since, more and more airplanes made largely of composites have continued to fly with flawless safety records. There may have been unanswered questions about the materials’ behavior in 2001, but the picture is much clearer today, and the persistence of these theories is difficult to explain.
These spurious theories are popular within the aviation industry, especially among pilots. But among the general public, rumors of mechanical problems compete with a lingering suspicion that the crash really was a terrorist attack all along, and that this was suppressed to prevent panic so soon after 9/11. However, the only real reason to believe terror could have been involved was the crash’s temporal and physical proximity to the September 11th attacks. Had it occurred at any other time and place, the possibility probably wouldn’t have been raised at all. Nevertheless, this belief remains particularly popular in New York’s Dominican community, alongside conspiracies about Airbus, perhaps in large part due to the lack of clear messaging about the true causes of the crash. Advocacy groups periodically call for the investigation to be reopened, but there has never been any reason to believe that this is necessary. Although the company never suffered the consequences it probably deserved, Airbus’s malfeasance was not covered up — it was plainly laid out in officially published materials, if only people bothered to read them.
In the end, a number of changes were made as a result of the accident. Airbus eventually altered the design of the rudder control system on the A300–600 and A310; American Airlines overhauled its Advanced Aircraft Maneuvering Program to more closely reflect real scenarios; language encouraging the use of the rudder in inappropriate contexts was removed from flight manuals; and airlines began warning pilots not to make rapid oscillatory control inputs.
It is somewhat less clear whether the NTSB’s other goals, such as improved awareness of the limitations of design maneuvering speeds, were ever achieved. In a retrospective interview, former NTSB chairman Jim Hall stated that many of the NTSB’s efforts to increase awareness about issues related to flight 587 fell on deaf ears, in large part because the crash happened so soon after 9/11. Once it became clear that the crash was not another terrorist attack, people stopped paying attention, creating a sort of collective amnesia surrounding the accident. Even though flight 587 was the second deadliest plane crash on American soil, and came scarily close to reaching number one, it ranks low on the list of the most widely remembered US air disasters. Its obscurity is part of the legacy of a unique period in American history, when a traumatized nation could look upon the fiery deaths of 265 people and feel nothing, save for relief that it was “only an accident.” In the end, only time will tell whether there is a price to be paid for forgetting.
_____________________________________________________________
Update: After this article was published, credible accounts emerged implicating First Officer Sten Molin in multiple rapes and sexual assaults against both adults and minors. While this is a separate topic to the technical details discussed in this article, I’ve had a lot of inquiries about the matter and I would direct anyone who wants to know more to Sara Hammel’s blog, which you can find here. The long and short of it is that he was apparently a really horrible person behind his seemingly normal exterior, and while this article distributes most of the blame for the crash onto systemic factors, readers should beware the temptation to refer to Sten Molin as “innocent.” The victims of his crimes are not helped by such a description.
_____________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 200 similar articles.
You can also support me on Patreon.
