American Airlines Flight 587 lost its entire vertical stabiliser two minutes after departure from JFK Airport, killing all 265 people on board and five people on the ground. The vertical stabiliser failed because First Officer Sten Molin made a series of rapid, alternating full rudder deflections in response to wake turbulence from a preceding Boeing 747.
This accident sits at the intersection of two systemic failures: a training programme that had taught an inappropriate technique, and a certification standard that had not addressed the specific loading pattern that technique produced. The first officer was doing exactly what American Airlines’ training had taught him to do. The aircraft’s structure was not designed to survive it.
AA 587 is the case where the training killed the aircraft. The crew did exactly what they had been trained to do. The aircraft could not survive what they had been trained to do to it.
Date | 12 November 2001 |
Flight | AA 587 |
Aircraft | Airbus A300-605R |
Operator | American Airlines |
Fatalities | 265 — all on board and 5 on ground |
Category | Composite Structure / Rudder Loading / Training / Certification |
Location | Belle Harbor, New York, USA |
The Event
- AA 587 departs JFK after a Japan Airlines 747 on a standard departure route
- Two minutes after departure, the aircraft encounters moderate wake turbulence
- First Officer Molin applies multiple rapid, alternating full rudder deflections
- The A300’s rudder travel limiter functions correctly throughout — it is not a factor
- The alternating loads on the vertical stabiliser exceed its design limit load
- The vertical stabiliser separates from the fuselage
- Without vertical stabiliser, the aircraft immediately becomes uncontrollable
- Both engines separate from the wing under the aerodynamic loads
- The aircraft strikes Belle Harbor, Queens, New York
- 265 on board and 5 on the ground die
American Airlines’ Advanced Aircraft Maneuvering Programme (AAMP) specifically trained pilots to use full rudder deflection in response to turbulence. This training was developed with good intent — improving upset recovery capability — but produced a behaviour pattern that exceeded the structural design assumptions for the A300’s vertical stabiliser.
Systems Engineering Perspective
From a systems engineering perspective, AA 587 reveals a certification gap: the structural load cases used to certify the A300’s composite vertical stabiliser included single full rudder deflections at certified speeds, but did not include the oscillatory loading produced by rapid alternating full deflections. The structure was certified for the load cases that were standard in civil certification. It was not certified for the load case that the training programme produced.
A structure certified to the standard load cases may still fail under non-standard loading patterns. AA 587 proved that certification must address realistic in-service loading scenarios, not just the standard cases.
Alternating Rudder Loads — The Load Case That Wasn’t Tested
The vertical stabiliser’s composite construction was designed and certified to resist specific load cases: one full rudder deflection at maximum certified speed, limit load factor, and combinations of these. These load cases are the standard reference points in civil certification.
What they did not include was the oscillatory loading produced by rapid alternating full-deflection rudder inputs — applying full left, then full right, then full left, in quick succession at high speed. This loading pattern generates cumulative structural stresses that exceed the peak of either individual deflection. The structure was compliant with the certification basis. The certification basis did not capture the real-world failure mode.
Structural certification covers the load cases identified in the standard. If the standard does not include a realistic in-service loading pattern, the certification is incomplete for that pattern.
The AAMP — Good Intent, Wrong Technique
American Airlines’ Advanced Aircraft Maneuvering Programme was developed to improve pilot upset recovery capability — a genuine safety goal. The specific technique taught — full rudder deflection in turbulence — was based on the reasoning that aggressive rudder use could counter upsets and provide better control authority in rough air.
This reasoning was correct for smaller, more rigid-tailed aircraft. It was incorrect for the A300, whose composite vertical stabiliser was more susceptible to alternating lateral loads than the designers had anticipated, and whose rudder travel limiter had reduced (but not eliminated) the risk compared to earlier designs.
Human Factors Perspective
The human factors analysis centres on the training programme as the proximate cause of the accident. The first officer was not making a poor decision under pressure — he was applying trained technique in the scenario for which it was trained. The training was wrong.
Training as the Proximate Cause
The most important human factors finding in AA 587 is that the crew error was a training-induced behaviour. The first officer applied a specific, taught technique in a scenario consistent with its teaching. The technique exceeded the structural design assumptions.
When training produces a behaviour that is outside the aircraft’s structural envelope, the failure is in the training programme, not in the trainee.
Crew training that induces behaviour incompatible with the aircraft’s structural limits is a safety failure in the training system, not the crew.
Rudder Sensitivity and Type-Specific Training
The A300, like all large transport aircraft, has a rudder that provides significantly more control authority at approach speed than small aircraft pilots typically expect. The instinctive application of full rudder deflection from smaller aircraft training does not scale linearly to large transport aircraft — the consequences are magnified by the larger control surfaces and higher flight loads.
System Interaction Breakdown
1. Certification Basis Missing Real-World Load Case
Oscillatory rudder loading was not in the certification basis. The structure was not tested for this load case.
2. Training Programme Producing Out-of-Envelope Behaviour
The AAMP’s full-rudder technique produced structural loads that exceeded design limits. The training was wrong for the aircraft.
3. Wake Turbulence Encounter — The Trigger
The wake turbulence encounter provided the scenario in which the trained technique was applied. It was the trigger, not the cause.
The cause of AA 587 was a training programme that taught a technique incompatible with the aircraft’s structural limits. Wake turbulence was the opportunity to apply it.
Significance in Aviation Risk
1. Wake Turbulence Response Training Revised
Following AA 587, wake turbulence response training was globally revised to prohibit aggressive alternating rudder inputs. The standard training now teaches wings-level, controlled heading change as the response to wake turbulence — using aileron rather than rudder.
2. Composite Structural Oscillatory Loading
The certification standard for composite vertical stabilisers was revised to include oscillatory loading cases representative of realistic in-service rudder use patterns.
3. Rudder Use Limitations in Type Training
Type ratings for aircraft with rudder travel limiters now include specific guidance on rudder use limitations, including the prohibition on rapid alternating full deflections.
Related Aviation Risk Lab Content
Pillar Pages
Systems Engineering: Systems Engineering
Human Factors: Human Factors
Design and Certification: Design And Certification
Related Case Studies
Case Study 7: Aloha Airlines 243 — The Fuselage That Flew Apart: Aloha 243
Case Study 8: de Havilland Comet — Pressurisation and the Crack: Comet 1954
Case Study 27: Colgan Air 3407 — Fatigue, Startle and the Stall: Colgan 3407
Closing Perspective
American Airlines 587 is the case study that most directly demonstrates that training programmes are safety-critical engineering documents. An incorrect technique, taught systematically to pilots, produces identical hazardous behaviour across an entire fleet. The first officer was not making a mistake. He was doing exactly what the training had taught him to do.
The certification standard that allowed the structure to exist without being tested for this loading case, and the training programme that produced the loading case, were the two systemic failures. Together, they killed 270 people.
Wake turbulence response training today explicitly prohibits what the AAMP taught. That prohibition exists because 270 people died from the consequences of being taught the wrong technique on the right aircraft.
AA 587 is the case that made training programme design a safety engineering activity, not just a pedagogical one. The wrong technique in the training manual is a structural risk, not just a competency one.
Related Posts
