On
How Airplane Vertical Stabilizers Are Loaded,
What Happens To Airplanes When Vertical Stabilizers Fail,
And Why Airbus Vertical Stabilizers Are Probably Not Acceptably Strong
(Plus Some Notes About
Fly-By-Wire, Envelope Protection,
And Why Composites Are No Less Safe Than Aluminum)
Over my career, as I have learned more details about aircraft structure (including the loads it must sustain and the requirements it must meet for certification by regulatory agencies such as the FAA), I have grown increasingly uncomfortable about the strength (or lack thereof) of the tails (specifically, the vertical stabilizers) of Airbus aircraft. The objective of this white paper is to communicate and explain my concern, especially in light of a few recent fatal accidents. Much has been said about the fly-by-wire computers that can prevent the pilot of an Airbus from being in full command of the aircraft, but just as much needs to be discussed about Airbus’ philosophy when it comes to structural design.
Summary: Airbus's vertical stabilizers are too weak for safe flight. On top of that, the regulatory agencies such as the FAA are too lax when it comes to certifying airplanes whose structure cannot withstand every conceivable aerodynamic scenario (especially scenarios that have been observed many times and that can be easily induced by pilot action, rather than requiring some freak environmental condition or unlikely aircraft failure). The regulatory agencies should require such strength from commercial aircraft. And even through they don't, Airbus should build them that strong. The other manufacturers already do. The result: Vertical stabilizers have broken off of Airbus airplanes, causing them to become just about uncontrollable, and leading to hundreds of deaths. Unless something changes, such accidents will keep happening. Each of these points is explained in detail below.
This paper is written with a lay audience in mind and will explain important concepts and terms from scratch, sacrificing some engineering rigor for the sake of simplicity. Also, it is my hope that the points in this paper will speak for themselves, and that you will be persuaded by the facts discussed here rather than by my authority and expertise that comes from my research and experience in aeronautical engineering. (In any case, I do expect to have more authority than, say, your average Hollywood actor[1]).
I have chosen to share this through a Web 2.0 platform (in this case; Blogger, accessed via TOR) to ensure my anonymity. Again, hopefully the facts and references speak for themselves, and their impact will not be diminished by the fact that I published this via Blogger or by the fact that you have no idea who I am or what my qualifications are.
Two very important things must be said up front:
- I am an engineer, and my work is intimately tied with the details of commercial aircraft structure and the requirements they must meet for certification by the world’s regulatory agencies (e.g the FAA). This paper is my personal opinion. It was not sponsored, authorized, or requested by any corporation or government institution. Only a handful of people, none of them employed by aerospace companies or by any government, knew about the existence of this paper before its public release. While the experiences in my career are a big part of what gives me the perspective necessary to come to my conclusions, this paper is in no way endorsed by my employer or representative of my employer's position on any of the issues discussed here. This paper is the product of one person with experience working in aerospace structures, not a product of any institution.
- This paper contains no proprietary information. I will rely solely on public sources for information, and will link to all of them. Anyone who understands the basics of aircraft structures, the kinds of loads it is exposed to, the requirements it must meet for commercial certification, and the published causes and consequences of certain incidents of structural failure, would be able to write this paper, and will not learn anything new from it. Don’t expect any data or other information, regarding Airbus jets or those of any other manufacturer, that has not been posted online.
This paper is divided into four sections:
Section 1 explains how certain maneuvers and situations cause certain loads on the vertical stabilizer of an airplane. You will learn what the vertical stabilizer is, what its function is, how it does what it does, and under what conditions it sees the greatest aerodynamic loads. This section is the longest, since it explains some engineering principles in details and gives many examples. I take the time to explain them because this background is essential to understanding the concepts, events, and analyzes addressed later.
Section 2 explains what happens when the vertical stabilizer fails. By exploring the detailed account of a crew who lost their airplane’s vertical stabilizer and lived to tell the tale, you will appreciate how the loss of the vertical stabilizer makes an airplane almost uncontrollable, and how their survival was the result of extreme ingenuity and luck.
Section 3 will address what I see as deficiencies with Airbus aircraft. You will understand why their vertical stabilizers are not as strong as they arguably should be, why the mechanical back-up to the fly-by-wire control system is probably insufficient for safe flight, and how these factors are the likely cause of a few recent crashes which resulted in the loss of hundreds of lives.
Section 4 addresses related issues. It has been claimed that Airbus’s fly-by-wire control system does not give the pilot sufficient authority to truly fly the airplane. I agree with this to some extent, so I will discuss it briefly here, and link to further material. And finally, one last issue worth discussing is the following: Some aerospace industry journalists have even stated that because composites go straight from elastic deformation to failure without first deforming plastically, and because the gradual growth of damage such as delamination is not trivial to predict or detect, composites should not be used in aircraft primary structure; This does not make as much logical sense as it first appears to, so I would like to debunk this myth.
Ok. Let’s get to it.
.
.
.
Section 1
How Airplane Vertical Stabilizers Are Loaded
Imagine that you are playing darts, and you throw a dart at a target. The dart leaves your hand with its pointy end forwards. As seen from above, that would look like this, with the airflow indicated by the light blue arrows:
But let’s say that you accidentally gave the dart a little bit of a spin when you threw it, which means that after a second it has rotated to the side a little bit:
This is called sideslip. It is similar to what happens when a car loses some traction during a turn and fishtails, skids, or “drifts”. This means that there is a lateral angle between the direction something is pointing and the direction it’s traveling; This angle is referred to by engineers as Beta.
Now, if this happens to your dart, if given enough time the dart will straighten itself and point back into the wind, so to speak. This is called directional stability: When Beta (the angle of sideslip) grows, some mechanisms are triggered and they force Beta to go back down and the dart again will face in the direction it’s going. Two things in particular cause the dart to be directionally stable, and they are both due to the aerodynamics of the fins at the back of the dart.
One is the drag produced by the fins. This is easy to understand. The heavy part of the dart is near the front. Let’s say that, as it leaves your hand, the dart starts pointing a little to the right, as shown above. This causes the fins to stick out to the left. Again, that looks like this, as seen from above:
The tail fins have some drag. In other words, the air pushes on them. This is even more true as the air starts hitting them at an angle (i.e. as they are no longer aligned with the airflow). Because they are lighter than the front of the dart, and also bigger than the front of the dart, this causes them to be more susceptible to drag than the front of the dart. (If you want to use the proper term relating drag and inertia, you’d say that the dart’s tail has a higher ballistic coefficient than its nose).
So the wind basically blows them back, until they end up as far back as they can get relative to the nose, i.e. at the very back of the dart, causing the dart to align itself into the wind.
This is the same mechanism by which a feathered arrow or a badminton shuttlecock points itself the way it’s going, and was famously used to stabilize SpaceShipOne during the start of reentry [2]. Wind socks also work like this. The wind blows the draggy part of it back, so the non-draggy part points into the wind.
While intuitive, this is actually the less powerful of the two aerodynamic phenomena that stabilize the dart. The phenomenon that actually dominates the dart’s stability, and it is one that is slightly less easy to understand, is not the drag of the tail fins but their lift.
Here is the dart flying through the air and pointing in the direction it’s going. The air blows past both sides of the fin symmetrically, so there is no lift.
But imagine that the dart starts sideslipping again, and the fins stick out to the left, like before. Now the air is coming at the fin at some angle. (Again, the angle of sideslip is called Beta). The fin starts acting like an airfoil, deflecting some of the nearby flowing air a little further to the left.
The air in turn reacts this with an equal and opposite force, pushing the fin to the right.
And so the fin moves to the right, i.e. the dart rotates, i.e. the dart goes back to pointing the way it’s going. This is directional stability.
(Technically, this sideways force on the vertical fin is not called lift, but side force. (Similarly, the downwards lift produced by a racecar spoiler is called down force). However, I thought I should explain it in terms of lift, to make it clear that it is the force produced by an airfoil, perpendicular to the airflow (as opposed to drag which is parallel to the airflow) when air is deflected)
Of course, you want directional stability in any vehicle you’re in. You want to point the way you’re going, primarily because you want to go the way you’re pointing! That’s roughly how people drive cars and how pilots fly airplanes: point the vehicle somewhere, and hope that some physical forces push the vehicle in that direction.
So airplanes need directional stability. Just like a dart, this is accomplished by sticking fins at the back. The horizontal fins keep the nose from wandering up and down without the pilot having requested it, and the vertical fin (by the exact same mechanisms described above for the dart) keep the nose from wandering left or right relative to the way the airplane is flying. For this reason, these fins are called the horizontal stabilizers and the vertical stabilizer.
But with airplanes, it’s a little more complicated. That’s because the tail fins have surfaces that can move relative to the airplane.
As you know, the pilot sometimes does want to maneuver the airplane around. This is done by deflecting those movable surfaces at the back of the fins, and some more surfaces on the wings as well. To bring the nose up (for example, on takeoff), the movable surfaces at the back of the horizontal stabilizers (surfaces called elevators) are deflected upwards. This pushes incoming air upwards, so the air pushes the tail downwards, so the nose comes up like a see-saw. To turn the airplane sideways like steering a car, the movable surface at the back of the vertical fin (a surface called the rudder) is used. If you want to go left, you deflect the rudder to the left. This deflects incoming air to the left, which pushes the tail to the right, which causes the nose to move to the left. Of course, this would cause passengers to be pushed sideways inside the cabin, by what is imprecisely known as “centrifugal force”[3][4]. (To prevent this, the pilots bank the aircraft into the turn (using movable surfaces on the wings called ailerons), so that the resulting net acceleration is perpendicular to the floor (and also so that the wings’ lift pulls the airplane in the new direction). This is known as coordinating a turn).
Now that you understand how the vertical stabilizer and the rudder work, let’s think about when the aerodynamic forces on the vertical stabilizer is strongest. There are a few scenarios, a few combinations of rudder deflection and sideslip angle, which are candidates for generating the strongest aerodynamic load on the vertical stabilizer. Engineers call each of these situations a condition.
(The FAA has an enormous list of conditions [5] that an airplane is supposed to be able to survive if it is to be certified for commercial flight. (Other regulatory agencies around the world copy this list verbatim into their regulations). The conditions include pretty much every event that an airplane can be expected to encounter in its life. Each piece of structure in the airplane is loaded differently during each condition. Some pieces of structure – like the landing gear – are loaded the most strongly during hard-landing conditions, defined as hitting the ground while descending at so many feet per second. The wings are loaded the most strongly during a steep pull-up from a dive, defined by how many “g”s such a pull-up requires. And so on. So each piece of structure must be strong enough to survive whatever condition causes that piece of structure to see the worst load it can be expected to encounter, i.e. its limit load. The load at which the structure breaks – its ultimate load – must be higher than the limit load (i.e. higher than the highest load that the structure ever sees in the worst of the conditions) by a nice wide safety margin. That margin is typically 50% [6][7] for primary flight-critical structure, i.e. structure whose failure would pose significant risk to the safety of the aircraft).
So what condition causes the vertical stabilizer to see the worst load it can be expected to encounter?
Let us consider four conditions:
1) Maximum rudder deflection at zero Beta. That is, the airplane is flying along in a straight line, and the pilot kicks the rudder pedal all the way, and the rudder is deflected to its maximum angle. What is the force pushing on the vertical stabilizer as the airplane starts to turn?
2) Maximum Beta with maximum rudder deflection into the turn. That is, if the pilot continues to hold down the rudder pedal to the max, the airplane eventually reaches some maximum angle of sideslip. The airplane would be “flying sideways” to some extent, like a “drifting” car in a steady controlled skid. What is the force pushing on the vertical stabilizer as the air hits it (but not the rudder surface) at an angle from the side?
3) Maximum Beta with zero rudder deflection. That is, while “drifting” the airplane as described above, the pilot releases the rudder pedal, causing the rudder to align itself with the non-moving surface of the vertical stabilizer, increasing the tail area that is blown by the wind and generating sideways lift. What is the force pushing on the vertical stabilizer as the air hits it (plus the rudder surface) at an angle from the side?
4) Maximum Beta with maximum rudder deflection out of the turn. That is, by holding down the rudder pedal, the pilot “drifts” the airplane as described above, but then pushes the rudder pedal all the way the other way, to aggressively push the airplane out of the skid. What is the force pushing on the vertical stabilizer as the air hits it at an angle (plus the rudder surface that is turned at a greater angle relative to the air)?
Seen from the top, these look something like this. (The [fixed] vertical stabilizer has been colored green, and the [movable] rudder is in purple, and both are extra large for clarity. DC8 graphic courtesy of NASA Dryden).
Say the airplane is flying along…
… and the pilot kicks the ruder pedal to the right, deflecting the rudder all the way to the right. The instant that this happens, just as the airplane begins to turn, things look like this:
This is condition one.
Notice the forces exerted by the air onto the rudder (purple), indicated by the yellow arrow below. (No aerodynamic force is exerted onto the vertical stabilizer (green) because it is parallel to the airflow. But the rudder is attached to the vertical stabilizer by a hinge, so when the rudder is pushed by the air, it pushes on the vertical stabilizer).
If the pilot keeps pushing the pedal down, the airplane will reach some maximum sideslip angle:
This is condition two. Remember that the airplane is flying “up the page”, i.e. at a sideways angle to the air. The air is pushing the rudder to the left (because of how the rudder is at an angle to the airflow, pushing the incoming air to the right), and it is pushing the vertical stabilizer to the right (because of how it is at an angle to the airflow but to the other side, pushing the incoming air to the left), and so they roughly cancel out and the airplane holds this angle. (Well, it’s a little bit more complicated, since the way that the vertical stabilizer deflects the airflow interferes with the way that the rudder deflects the airflow, and vice versa… but the net result is, the airplane comes to a stable steady angle of sideslip where all moments cancel themselves out).
Say the pilot then releases the rudder pedal. Earlier, the horizontal stabilizer was pushing air to the left, but the rudder was pointing the other way and pushing some air to the right. However, now both are aligned and pushing air to the left, so both are pushed to the right by the air and cause the airplane to start re-aligning itself with the airflow:
This is condition three.
Ok. Say the pilot goes back to max right sideslip, but then pushes the rudder all the way to the left. The rudder is now deflecting even more air to the left than it was in any previous condition, since the vertical stabilizer is turned to the left and the rudder on it is turned even further to the left. (This is similar to deploying the flaps for greater lift). This will push the tail back to the right, causing the airplane to straighten itself. Just before the airplane starts turning back and straightening itself, things will look like this:
This is condition four.
Which one is worse? (You can probably guess that it is condition four). By how much?
My employer has some data that gives one set of answers to that question, but I do not intend to reveal any non-public information here. Luckily, the National Test Pilots School in Mojave has performed these tests on a jet, and the data is published in a Flight International article [8][9]. Using sensors, they measured the bending moment on the vertical stabilizer of an Impala (an African-built Aermacchi MB-326) through some of these conditions.
(The bending moment is not just the force, it is the effect that the force at some distance has on deflecting something through some angle. For example, say you push a door open by pushing far from the hinge, e.g. where the handle is. This is the easiest, and most common, way of pushing a door open. Now say you try to push the door open by pushing the middle of the door. You will need to exert a greater force in order to affect the door as much, e.g. to open it as quickly as you did before, with the same moment. So the moment – which in this case is how much your push affects the door – takes into account both how hard you push, and how far away your push is from where the door is attached to the wall hinge. Both an easy push far from the hinge, or a harder push closer to the hinge, have the same moment).
First, the student test pilot flew the Impala in a straight line for a little while, and then kicked the rudder pedal all the way to the right. This caused the rudder to deflect about 17 degrees to the right. At the point when the rudder was at maximum deflection and the Impala was starting to turn, the bending moment on the vertical stabilizer was 26,000 inch-pounds.
That was condition one.
When the Impala stabilized at maximum sideslip, with the rudder still at max deflection into the turn, the bending moment on the vertical stabilizer was only 7,000 inch-pounds. This is understandable, since the stabilizer is oriented one way but the rudder is oriented the other way, so they are fighting each other and the resulting moment is what you get when you subtract one from the other.
This was condition two.
When the rudder was released back to neutral while the jet was at max beta, aligning the rudder surface with the vertical stabilizer surface, the bending moment was 24,000 inch-pounds, almost as high as when the rudder was first kicked to full deflection during condition one.
This was condition three
When the airplane was brought back to max beta and the rudder was kicked only six degrees (about one third of full deflection) the other way, the bending moment was 35,000 inch-pounds.
Notice that 35,000in-lb is about half again as much force as the vertical stabilizer sees when the rudder is deflected all the way at zero-sideslip flight (condition one), or when the plane is brought to max beta and the rudder is released back to neutral (condition three)… and five times as much force as it sees when the airplane is held at max beta by steady max rudder deflection in the same direction (condition two).
But this was not condition four. Why do I say that? Because these 35,000in-lb were caused by the rudder being deflected only six degrees, not seventeen! The pilot only pushed the rudder pedal about one third of the way down, not all the way.
I’ll spare you the calculations, but taking the relevant areas and dynamic pressures and lift coefficients into account, it is likely that bringing the Impala to max sideslip and then deflecting the rudder all the way the other way would probably exert something like 100,000 to 150,000 inch-pounds of bending moment on the jet’s tail. That’s about five times the load seen in condition one (kicking the rudder all the way during straight-line flight) and in condition three (releasing the rudder back into neutral during max-sideslip flight), and about twenty times the load seen while holding the airplane at max Beta with max rudder deflection in the same direction.
Twenty times.
Of course, this is extremely aggressive maneuvering. Would a commercial pilot ever do anything like this to an airplane? The passengers would spill their drinks, some might even be injured, you’d probably end up hearing about it on The Consumerist… Pilots primarily rely on banking to turn the airplane, and use the rudder only to coordinate the turns. A heavy foot on the rudder pedals (and the centrifugal force this would cause) is a no-no during commercial flight. Just holding a big commercial jet at max Beta is almost unthinkable, let alone then kicking the rudder all the way the other way to yank the nose back.
But it is doable.
Should airplanes be built so as to be able to survive such rough rudder action?
Can an Airbus survive it?
Does the FAA (and do other regulatory agencies) require it?
The short answer to those questions, unfortunately, is "No". More details in Section 3. But for now let me tell you a story.
.
.
.
Section 2
What Happens To Airplanes When Vertical Stabilizers Fail
Actually, I won’t tell you the whole story. Several websites (e.g. [10]) recount it more thoroughly and interestingly than I have the time or ability to do here. So I’ll just give you the bare-bones summary.
Some Boeing test pilots were testing the terrain-hugging aggressive-flying abilities of the B-52, to find out whether it could be used in low-altitude penetration. They were doing this basically by flying up and down the sides of mountains in New Mexico. As is typical of mountain flying, they encountered some extremely heavy turbulence, and that was part of the test. But an unlikely confluence of winds caused an abrupt hurricane-level gust to slam onto the airplane from the side. The big jet was rolled by the wind into all kinds of unusual and dangerous orientations, but even worse, the gust caused the vertical stabilizer to break off. The pilots tried to regain control of the B-52, but at one point they gave up and prepared to bail out. Just then they hit air that was smooth enough for them to wrestle the B-52 into barely-controllable flight:
"I had the rudder to the firewall, the control column in my lap, and full wheel input and I wasn't having any luck righting the airplane. In the short period after the turbulence I gave the order to prepare to abandon the airplane because I didn't think we were going to keep it together". Immediately after the severe turbulence, the jet rolled hard... Read More right and almost went out of control. Fisher said: "It required about 80 percent left wheel throw to control the aircraft by the time things had settled down."
An F-100 fighter jet flew to meet the bomber and act as a chase plane. The USAF pilot told the B-52 crew that they had lost their vertical stabilizer. The rear landing gear (the B-52 has two sets of main landing gear under the fuselage) was extended, and this made the airplane stable enough to be flown through controlled turns. The pilots felt that they could land, but of course any cross-wind would blow the B-52 off the runway without a rudder to keep it aligned, so they had to find a base where there was absolutely no cross-wind at the moment. A suitable USAF base was found in Arkansas – three states away! They managed to fly there (including an in-flight refueling) and land, so the story ends happily.
But what if they had not encountered this very calm air? They might not have regained control of the aircraft. The aircraft might have entered an unrecoverable spin, or it might have been blown into a steep dive that could nudge the sound barrier and tear the airplane apart.
And even when they did regain control of the airplane, it was practically impossible to fly. Remember that the vertical stabilizer is what keeps the airplane pointed the way it is going, and going the way it is pointed. Without it, the airplane can slide towards one side with no easy way to bring it back. Banking it into a turn would cause it to slip to the side without necessarily pointing in the desired new direction. It’s something like trying to drive a car on ice. An even better example is trying to throw a dart at a target that is ten or twenty feet away… and trying to throw a pencil at the target from that distance. The dart will keep pointing the way it is going, while the pencil will probably rotate a little bit and not pierce the target with its pointy end. An airplane without a vertical stabilizer will fly in a similar way to that pencil. Luckily there was some vertical stabilizer left on that B-52, and a set of landing gear located near the back (which probably worked more due to shuttlecock-like drag than due to any fin-like lift the wheels and gear doors may have generated). And some extremely still air in which they could fight the airplane back into controllability. And a chase plane to tell them what was going on. And a base with no wind, where they could land. Remove any of these factors and that B-52 would probably have crashed that day. The fact that the crew managed to regain control and land is a small miracle, in part thanks to finding very calm air, but also a testament to quick thinking and great support by the USAF’s resources.
Imagine that, instead of being able to fly into calm air, these pilots had instead been flying in the middle of a massive thunderstorm, with no calm air anywhere for dozens of miles. They surely would never have regained control of the aircraft. The wind would have kept tossing them around, trying to flip the airplane tail-first or upside-down, and the crew would have bailed out. Of course, these B-52 test pilots had parachutes. The passengers of Air France flight 447 did not.
Arthur Doucette, a pilot who has studied aviation accidents (especially problems with Airbur rudders and vertical stabilizers breaking off, described in the next section) has also compared the B-52 incident with Airbus accidents. His take [11] is as follows:
"Note that the B-52's design is quite different and that a good-sized piece of the vertical stabilizer remained (enough to provide significant lateral stability). The B-52 also has the wing mounted much further forward, hece the whole rear fuselage provided a stabilizing force (the feathered-arrow effect). The Airbus is just barely stable without the fin; With the wing mounted further aft, the turning forces ahead of the center of rotation are about the same as those behind the center of rotation. If the fin departed while any moment of rotation was going on, the forces would have quickly spun the aircraft into a flat spin."
Surely commercial airplane manufacturers do everything in their power to ensure that such a scenario would never be encountered by a passenger aircraft, right? And surely the regulatory agencies require strong tails (as well as forbidding any terrain-hugging flights around mountains) that can withstand air blowing at them from the side, right?
Well…
.
.
.
Section 3
Why Airbus Vertical Stabilizers Are Not Acceptably Strong
Why am I writing this paper? Because, like I said, the answers to all those questions is “No”.
Let me tell you another story: American Airlines flight 587. An Airbus 300 takes off from JFK [12] right after a 747. A minute or two into the flight, the A300 encounters the wake turbulence of the larger 747, and the pilots struggle to keep the Airbus straight and level. American Airlines trained their pilots to use the rudder aggressively in these situations, and that’s what these pilots do: The rudder repeatedly goes from one extreme to the other, several times in a few seconds. This causes the vertical stabilizer to break off from the airplane. The airplane crashes into Queens, killing all on board plus five people on the ground.
Above, an image from the New York Times via IASA[13] and below, the vertical stabilizer which broke off an A320 during a flight test just before delivery to Air New Zealand under similar conditions [14].
The details of how the vertical stabilizer broke off are not important. The important part is that they were not designed to be strong enough to take this kind of rudder action. The fact that the stabilizer broke off should not surprise anyone: The stabilizer was exactly as strong as it was designed by Airbus to be, and exactly as strong as it is required by regulations to be. And that is the scary part.
But I'm getting ahead of myself. Let's go over the details. While we may be tempted to just say "The pilots stepped really hard on the rudder and that caused the vertical fin to break off", there’s more to it.
It’s not quite that simple, of course. For example, it is possible that the rudder movements were not caused by the pilots. Due to bugs in the control systems of early model Airbus airplanes, the rudder had been known to deflect without the pilots touching the rudder pedals [15]:
* Nov. 28, 2001. A300 departing Lima, Peru, experienced uncommanded rudder movement, returned to Lima and remained there for about one week (NTSB ID no. DCA02WA011). Aircraft was 055 (American Airlines [AMR] tail number).
* December 2001. Aircraft 054 on approach into Orlando, Fla., experienced 'rudder pulsing.'
* Jan. 17, 2002. Aircraft 051 (Flight 2139) from Miami to Caracas, Venezuela, experienced uncommanded rudder movement climbing through 10,000 feet. Accelerating through 290 knots, the pilots experienced 'smooth, uncommanded yawing' that caused doors 2L/2R to 'buckle and pop.' After slowing, the aircraft returned to Miami for an uneventful landing.
* Jan. 19, 2002. Aircraft 051 (again, Flight 2139) from Miami to Caracas experienced uncommanded rudder movement after both the yaw damper servo actuator and FAC (Flight Augmentation Computer) were replaced the previous night at Miami. Aircraft continued to Caracas. It was ferried back to Miami and subsequently to American Airlines' maintenance base at Tulsa, Okla.
* Jan. 25, 2002. Aircraft 061 took off from San Juan, Puerto Rico, and experienced what the pilot reported was an uncommanded 'rudder jolt.'
* Jan. 27, 2002. Aircraft 061 took off from Newark on a ferry flight to New York's JFK. Crew experienced an uncommanded rudder 'thump' or 'kick' at 50 feet.
* Jan. 28, 2002. Aircraft 061 test flown by an engineering crew from American Airlines' maintenance base at Tulsa. During the test flight, the #1 yaw damper would not reset after tripping.
* Feb. 1, 2002. A300-600 operated by Federal Express (FedEx) was inspected at Memphis, Tenn., and was found to have a bent rudder control rod and delamination in the tail. The hydraulic system was pressurized and the rudder was depressed. Mechanics observed oscillation of the rudder and heard a loud 'bang.' Rudder oscillations occurred in flight subsequent to control rod change and maintenance sign off.
* Feb. 9, 2002. Aircraft 080, from San Juan to JFK. During climbout, pilots reported a large, uncommanded yawing motion upon engaging autopilot no. 2.
* March 15, 2002. Flight 1270 from San Juan to Newark, aircraft 058. Crew reported during flare 'rudder pedal stuck a little and then broke free when about 10 lbs. pressure was applied. Maintenance reported no binding when rudder travel checked. Engaged autopilot #1 & #2. No abnormal inputs. Yaw dampers normal. Aircraft found to be OK for service.'
* March 18, 2002. Aircraft 061, Flight 934 from Guayaquil, Ecuador, to Miami. Aircraft experienced uncommanded rudder movements on climbout and during cruise. On approach, at least one major uncommanded rudder movement occurred.
On top of that, the version of the control system in this batch of A300s made the rudder far more sensitive than on any other aircraft; slight movements of the rudder pedals caused the rudder to swing all the way out [16], so the pilots probably did not intend to deflect the rudder by quite that much.
And, it is quite probable that Airbus did not require appropriate inspections of previous repairs to the composite structure of the vertical stabilizer, so the structure may have deteriorated over time [17].
The conclusions of the AA587 accident investigations are explained in many webpages [12][18], but one thing is clear: the vertical stabilizer broke off, and this caused a tragic crash.
Other incidents have indicated that the Airbus rudder and vertical stabilizer aren’t strong enough to safely survive years of commercial flight. This was still true many years after AA587. Inspections, some including in-flight incidents, have revealed that many Airbus rudders are slowly coming apart over time. See the pictures at the very top of the page, and the following details [19]:
On March 6, 2005, an Airbus A310-300, operated by Air Transat as flight 961, experienced an in-flight separation of its rudder shortly after departure from Juan G. Gomez International Airport in Varadero, Cuba. The flight returned to Varadero, where it landed uneventfully. Upon landing, the crew discovered that most of the airplane's rudder had separated in flight with only the bottom closing rib and the spar between the rib and the hydraulic actuators remaining.
On November 27, 2005, the rudder on an Airbus A300-600 airplane operated by Federal Express was damaged during routine maintenance. To assess the extent of the damage, the rudder was shipped to the manufacturer's facility and examined. In addition to the damage that occurred during maintenance, the examination found a substantial area of disbonding between the inner skin of the composite rudder surface and the honeycomb core, which is located between two composite skins.
More recent examinations have disclosed that hydraulic fluid can exist along the edges of the rudder's inner surface along with an accompanying area of substantial disbonding and that the inspection specified in the Airbus Service Bulletins cannot detect the presence of the hydraulic fluid or the disbonding along the edges.
No other commercial aircraft manufacturer has built airplanes with such flimsy rudders or vertical stabilizers. (The 737 has had problems with its rudder, but these were not structural problems; Rather, the rudder actuator control systems would “freeze” at altitude. This made rudder response erratic once hot hydraulic fluid tried to move the rudder for the first time after hours at altitude [20][21]. Changing one hydraulic valve fixed the problem). In fact, the only other aircraft that has seen such frequent stabilizer structural failures was the Concorde [22][23], which was designed and built by many of the same institutions that currently make up Airbus. In fact, Corcordes were made in the same facility in Toulouse that currently produces Airbus's widebody airliners.
This is not to say that Airbus aircraft are less safe than their competitors. The A300 and A310 are no less safe than their contemporaries such as the DC-10 and MD-80. Newer Airbuses like the A320 and 340 have excellent safety records, as do the “717” (MD-95) and 777 they compete against. And while there have been a non-negligible number of fatal crashes in 737s, this is largely due to the simple fact that several thousand 737s (a greater number than all Airbus airplanes combined) have been flown on high-frequency short flights (sometimes as often as thirteen times a day) for over four decades. So all in all, no one manufacturer makes commercial airplanes that are notably more or less safe than any other, of the types certified for commercial flight by the regulatory agencies of the industrialized world.
However, the Airbus vertical stabilizer does stand out as a worrisome feature. No tails have ever broken off transport aircraft built by McDonnell Douglas, Boeing, Embraer, Bombardier, Lockheed, or any other manufacturer whose airplanes you are likely to fly in. (Empennages have failed during extremely hard landings [24][25] but those accidents caused no injuries since they happened on the ground).
And as we have seen (think of throwing a dart into a target, and then trying to throw a pencil the same way), airplanes without vertical stabilizers have very little directional stability, and will slip and slide sideways, making it hard to fly in a straight line through any kind of wind, let alone make controlled turns.
And what are the regulatory requirements for this? How can these Airbuses be certified for commercial flying?
The answer is relatively simple. Think back to our four conditions that include different combinations of sideslip angle (Beta) and rudder deflection:
1) Max rudder deflection at zero-Beta flight
2) Sustained max-Beta flight by max rudder deflection in same direction,
3) Max-Beta flight with zero rudder deflection
4) Max-Beta flight with max rudder deflection in opposite direction
Recall that condition 2 caused the smallest bending moment on the vertical stabilizer (other than straight-line flight, of course), and that conditions 1 and 3 caused three or four times the bending moment, and that condition four caused fifteen or twenty times the bending moment.
Well, the FAA – and their international equivalents – require an airplane to survive conditions 1 and 2 and 3 in order to be certified for commercial use, as well as an additional condition where the airplane briefly swings beyond the maximum stable Beta that can be held steadily. However, the airplane does not necessarily need to survive condition four; it is ot a certification requirement. Let’s have a look.
Requirements for certification and safe operation of commercial aircraft (i.e. used to transport fare-paying passengers) are laid out in FAR 25. The FARs, or Federal Aviation Regulations, are the FAA-mandated laws that define every aspect of flight, from aircraft instrumentation requirements to pilot training requirements to airport runway markings to how weather is defined, communicated, and dealt with. (Again, most of these regulations are copied verbatim by other countries' regulatory agencies). FAR 25 lays out the structural requirements for commercial aircraft. As you can see [5], FAR 25 Section 351 states
The airplane must be designed for loads resulting from the yaw maneuver conditions specified in paragraphs (a) through (d) of this section …
(a) With the airplane in unaccelerated flight at zero yaw, it is assumed that the cockpit rudder control is suddenly displaced to achieve the resulting rudder deflection, as limited by:
(1) The control system on control surface stops, or;
(2) A limit pilot force of 300 pounds...
(b) With the cockpit rudder control deflected so as always to maintain the maximum rudder deflection available within the limitations specified in paragraph (a) of this section, it is assumed that the airplane yaws to the overswing sideslip angle.
(c) With the airplane yawed to the static equilibrium sideslip angle, it is assumed that the cockpit rudder control is held so as to achieve the maximum rudder deflection available within the limitations specified in paragraph (a) of this section.
(d) With the airplane yawed to the static equilibrium sideslip angle of paragraph (c) of this section, it is assumed that the cockpit rudder control is suddenly returned to neutral.
This basically means a commercial airplane must survive conditions one, two, and three, as well as a condition I had not mentioned (the “overswing sideslip angle”: When the rudder pedal is held to the max, the airplane actually swings out to beyond the maximum beta angle that can be sustained, and then back to that sustainable Beta, here called the “static equilibrium sideslip angle”). There are no mentions of what we have called condition four.
In other words: At max steady Beta, the airplane must be able to survive the rudder deflection that keeps it there, and a sudden return to the neutral rudder setting, but not necessarily an opposite rudder deflection.
So yes, it is possible to take a brand new commercially-certified jet, fly it into max Beta by pushing and holding the rudder pedal for a few seconds, and then snap the vertical stabilizer off the airplane by pushing the rudder pedals all the way the other way.
Or so you would think from the FARs. It turns out that most airplane manufacturers do impose extra design conditions on their design engineers, in addition to the legally required conditions, because they don’t want to make airplanes that crash, and they especially don’t want to make airplanes that can be torn apart by an aggressive pilot. Just the fact that Airbus rudders and vertical stabilizers keep getting damaged, while those of other manufacturers do not, should be enough evidence for you realize that most aircraft manufacturers make their rudders and vertical stabilizers a little stronger than the minimum that is mandated by law. Airbus should follow their example.
(In fact, during presentations, Boeing engineers have revealed (to groups where I was present) that they specifically design their vertical stabilizer structure to be strong enough to withstand all the legally required conditions and the much worse condition of max rudder deflection at max Beta the other way, what I call "Condition 4" on this paper. Now, this information was shown to me after I agreed to not discuss the details publicly. Even mentioning this here is technically a violation of that agreement, but I don't think Boeing would mind if I tell you that Boeing airliners are stronger than the law requires, and that their vertical stabilizers can withstand everything that a pilot can put them through. Which is evidently not the case for Airbus).
This is why I believe that Airbus’s rudders and vertical stabilizers are not as strong as they should be. I do hope that Airbus (or the regulatory agencies) realize the importance of having a tail structure that can survive max rudder deflection during max Beta the other way, and demand this at least in future designs.
A widely-publicized picture [26] shows the vertical stabilizer from Air France flight 447, an Airbus 330, lying in the water in one large piece. So you can guess what my favorite theory is behind what caused this airplane to fall out of the sky. Most of my co-workers agree with me. A hurricane-force gust (or just a pilot who is aggressive on the rudder) broke off the vertical stabilizer, and the pilots never found sufficiently calm air to gain control of the airplane since they were in the middle of a massive storm. Add to that the tendency of that airplane’s pitot tubes to freeze over (which could cause the fly-by-wire computer to over-speed the airplane), the fact that there were electrical failures (the pilots might have been essentially flying blind, with nothing in the cockpit to indicate which way is up or which way is North or how fast or how low they were flying as the wind blew the airplane around), and the fact that the mechanical back-up to the fly-by-wire computer is not enough to safely fly the airplane even in the best of weather conditions (see Section 4 below), and you can see how multiple factors could have conspired to bring AF447 down, each of which (vertical stabilizer coming off during a storm, over-speeding due to frozen-over pitot tubes, flying blind due to electrical failures, having to rely on the mechanical back-up to the fly-by-wire control system) could probably have caused a fatal crash on its own. This white paper focuses on the vertical stabilizer only because that is the factor I am most qualified to talk about. But I’m not the only one who thinks that the loss of the vertical stabilizer during strong winds was the primary cause of the accident [27], especially since this picture [28] was released.
And one last thing. Some readers may reply that Airbus HAS realized that the structure of their vertical stabilizers is not acceptably strong. As evidence for this, they will point to a bulge that can be found at the root of Airbus’s vertical stabilizers. Here is a series of pictures of what I’m talking about. Each picture thumbnail links to the full-size original as posted by the photographer. (This is also the case for the pictures at the very top of this page. So, like Google Image Search results, I trust that I am not violating anyone’s copyright by posting these tiny image thumbnails):
As you can see in these images, Airbuses from the A300 to the A380 feature this bulge on either side of the vertical stabilizer. So yeah, maybe Airbus did reinforce its tails after AA 587, right?
Wrong.
The following pictures were taken before American Airlines flight 587 lost its vertical stabilizer and crashed into Queens:
Yep, the bulge was already there.
In other words, whatever this bulge is, and whether or not it was part of these aircraft’s original design, the fact is that its implementation has not prevented Airbuses from losing their vertical stabilizers. And if the bulge was not a part of the original design, then that would mean that Airbus vertical stabilizers were even weaker at some point than the one that broke off AA587, and weaker than the one that was on AF447. Now there’s a scary thought.
.
.
.
Section 4
Fly-By-Wire
and
Composite Materials
A couple more issues worth bringing up while I’m at it:
- Fly-By-Wire
Airbus’s airplanes use a fly-by-wire control system. What does this mean?
In traditional aircraft – from the Wright Flyer to the 767 and including most small airplanes built today – the pilots control the airplane via a direct mechanical connection to the control systems. Push the control wheel/yoke or joystick to the right, and a system of mechanical controls, involving cables and linkages and hydraulic pistons, will make the right aileron deflect upwards and the left aileron deflect downwards, which (unless the pilot is in some unusual attitude such as a tailslide) will cause the airplane to roll to the right. (Depending on how much the control yoke or joystick is pushed, the spoilers and/or elevators may deflect differentially to help roll as quickly as possible). This is like you steering your car. Turn the wheel to the left, and some mechanical systems will cause the wheels to turn to the left, and so your car will turn to the left (unless something very unusual is going on or unless you're not moving at all). There may be some hydraulic assistance or other clever mechanisms to help push heavy and stiff parts, but it’s all mechanical, rather than electronic. (Well, electronics might help to control when these systems kick in and to what extent – such as by controlling the pump that pressurizes the hydraulic assist – but the functioning of the systems, once they do kick in, is mechanical).
However, in modern aircraft – starting with some NASA experiments, then the F-16, the Space Shuttle, the A320, the 777, and most modern airliners and military jets currently built – the pilots control the airplane via a computer. When they push the joystick to the right, this tells the computer “I want to roll right”. The computer then decides what control surface deflections would best accomplish this, given the speed, angle of attack, attitude, and so on. The computer then sends electrical signals to electric actuators that actually deflect the control surfaces, hopefully causing the airplane to maneuver as desired. This is like when you use the gas pedal in an automatic-transmission car. When you step harder on the pedal, you tell a computer that you would like the car to go faster. The computer takes into account this request, as well as the car’s speed, and the current engine RPM and throttle-valve setting and gear ratio. The computer decides what the best way is to make the car go faster; It might be commanding a servo actuator to open the throttle valve a little more (which in manual-transmission cars is what mechanically happens when you depress the gas pedal), or it might be some combination of gear shifts (which the computer then commands the automatic transmission to carry out) and throttle adjustments. This is done many times per second: the computer is always monitoring engine performance and adjusting it to carry out your inputs (i.e. it’s always looking for, and trying to comply with, changes in how hard you’re pushing the gas pedal).
That’s all fine and dandy. This kind of computerized control allows for systems that are more efficient, that monitor themselves and react to changes more quickly than a human could, and for the management of many parameters (such as the throttle valve setting and the gears in the transmission) to be presented to a human in a much simpler one-dimensional way (just one gas pedal; no tachometer or gear shifter or clutch). Everyone’s happy, right? Anyone who flies an F-16 or a Space Shuttle is glad that their fly-by-wire system works so well, because without it those aircraft would be too unstable to fly. A fly-by-wire system can deflect control surfaces to mimic the forces that a tail would provide as the angles of attack and sideslip change, so you have artificial stability and less drag (since you can reduce the size of the tail surfaces) and more agility (because when you want to turn fast, the tails don’t slow you down).
So what’s the problem?
One problem is that, when you design an airplane to use a fly-by-wire control system, you have the option of making an airplane that would not be stable if the computer fails. Luckily, commercial aircraft must be stable. But only just. In fact, they can be slightly unstable in certain conditions, as long as those conditions are unlikely and/or transient, and the airplane is still stable in the vast majority of conditions, and the fly-by-wire system is so robust that the chance of it failing is negligible. But still, a commercial airplane with a fly by wire system could be quite hard to fly if the system fails.
Another problem, in the case of Airbus, is that the mechanical back-up to the fly-by-wire system is arguably not sufficient to fly the airplane. Iit only uses the rudder (Not if it’s gone!), elevator trim (not the elevators, just the TRIM), and differential engine thrust, to “control” the airplane. United Airlines flight 232 tried to land once using only that level of control and we all know how well that went[29]… And Sean Tucker, the best aerobatic pilot in the US, once was faced with only such a limited set of controls, and decided to bail out of his airplane rather than try to land it [30][31]. On an Airbus, it's even worse. First of all, any pilot is probably hesitant to step on the rudder pedals of an Airbus jet except very lightly, since it seems to be possible that stepping on them heavily could cause the vertical stabilizer to break off. Then, using differential thrust for turning can allow for roughly controlled flight in calm conditions, but landing with such imprecise and weak turning authority is just almost impossible, arguably analogous to trying to parallel-park while only being able to turn the wheel five degrees in either direction. The turning radius is huge and fine quick adjustments are impossible. Same goes for elevator trim: Being able to move the elevator up or down very slowly (and having to move it back to neutral when you want the nose of the airplane to stop moving) is enough for controlled straight-line flight in calm conditions, but not for landing. It’s arguably analogous to, instead of driving by directly turning your steering wheel, having two buttons that cause the steering wheel to rotate very slowly one way or the other but being unable to just grab the wheel and turn it quickly… and the wheel doesn’t go back to the center setting (neutral) unless you use the buttons to rotate it back. As you can imagine, these extremely limited controls are barely enough for controlled straight-line flight (and maybe even slow, wide turns) in a calm day. But throw in wind gusts, or the need to eventually land the airplane, and the people in an Airbus airplane are in trouble.
Now, this particular set of problems (how hard the airplane is to fly when the fly-by-wire fails) is not really worrisome. That's because Airbus’s fly-by-wire system really is extremely robust. Airbus knows that there is little chance one of their jets could be flown without it, so they build multiple redundant systems (such as seven control computers) and other features that make a total failure of the fly-by-wire computer pretty much impossible. In fact, the system has never been known to fail, and it is quite possible that it never will. It is less likely to spontaneously die than a human pilot is.
But the system still worries pilots, a lot. Let me explain why. The most infamous and graphic example of the reason can be seen in videos of Air France flight 296[32]. Unfortunately, the Flight Data Recorder and Cockpit Voice Recorder were tampered with after the crash, so the cause cannot be known for sure. However, it is likely that the pilots used a certain settings mode in the fly-by-wire system, and then requested the airplane to do certain things (pull the nose up higher, and increase engine thrust) that the airplane simply refused to do under that mode.
And it’s not just during the modes used for approach and landing that the airplane computer can refuse to carry out a pilot's commands.
Under NO circumstances will an Airbus allow its pilot to pull the nose higher than 30 degrees above the horizon, dip the nose more than 15 degrees below the horizon, bank the wings more than 67 degrees, exceed certain maximum or minimum speeds, pull up or turn more tightly than a certain g limit, and so on. Imagine if the throttle-by-wire in your car kept you from accelerating faster than a certain rate, or kept you from going above the speed limit, or if a similar system controlled your steering and prevented you from making turns that are too tight or too abrupt… not because of any physical limitation of your car but because it was programmed to keep you safe. First of all, you’d think it was a pain in the butt, since it’s preventing you from really controlling your car. Then, you might admit that it would do a decent job at increasing safety. But then, you might realize that not even that is true, since in order to avoid an accident you may need to call on the extremes of your car’s agility, which is exactly what such a system prevents you from exploiting.
Pilots don’t really fly Airbuses. They ask the computer to do something. If the computer approves, the airplane does it. If the computer doesn’t approve, then the pilot has no way to make the airplane do it. Approach the stall speed, and the airplane will simply refuse to lower engine power or to raise the nose higher. Bank steeply, and the airplane will simply refuse to roll any further in that direction. Pull up at 2.5g, and the airplane will refuse to pull up any tighter (despite the fact that it is aerodynamically and structurally capable of doing so) even if it would make the difference between hitting a mountain or avoiding it.
Boeing’s 777 and 787 also use fly-by-wire systems to reduce pilot workload and increase efficiency, controllability, and stability. But there is a fundamental difference in philosophy regarding how these control systems are designed. It is easily the most significant difference between Boeing and Airbus aircraft [33]. In a Boeing aircraft, as one of these limits is reached, the controls may resist (e.g. yoke becomes harder to pull), and warning bells may buzz, but the pilot can still force the airplane to do what he or she wants it to do. Bring a 777 to the edge of stalling, and many alarms will go off, and the yoke will vibrate and become stiffer in the pull-up direction to discourage the pilot from pulling any further… but the pilot can pull up, and the airplane will stall. Same thing for steep dives, steep banks, maximum speeds, and so on: a Boeing airplane will let you know that you are approaching a safety limit and make it hard for you to press on, but if that’s what you want to do, then in the end you’re in charge. Not in an Airbus.
Another incident worth knowing about: China Airlines flight 006. The rightmost engine on a 747 failed while the autopilot was engaged, causing the autopilot to apply a strong roll-left command to compensate for the asymmetric thrust. No problem so far. But then the pilots disengaged the autopilot without applying the roll-left command themselves, so as soon as the autopilot turned off, the plane rolled violently to the right. It actually rolled all the way around, which caused its nose to drop, putting the airplane in a steep dive. In order to get out of it, the pilot pulled the yoke all the way back, commanding what at that speed momentarily became a 5g pull-up. (Airliners are only certified to 2.5g, typically with a 150% safety factor bringing this up to a little under 4g, which is about the same as the tightest turn you'll experience in any roller coaster). This was enough to force the inboard landing gear down, to rip off two of the landing gear doors, to cause one of the hydraulic systems to rupture and lose all fluid, to plastically bend the wings up by two inches, and to rip off the tips of the horizontal stabilizers. Of course, this 360-degree roll and steep dive were only encountered because the pilots had not followed the proper emergency procedures. (If they had, they could have re-started the engine with without any of this rolling or diving). But given that they found themselves in that situation, it was good that their airplane allowed them to pull up at 5g. If their airplane had refused to pull up at any more than 2.5g, they might have hit the water before getting the airplane back to horizontal flight.
Emergencies are the times when a pilot really needs an airplane to do all that it is physically capable of doing. An Airbus, however, can simply refuse.
Airbuses are terrific airplanes: They are reliable, have long range, are economical to fuel and operate and service, can fit a lot of paying passengers and cargo, and are supposedly easy and fun to fly. (And, as was recently demonstrated in New York City, they're even decent seaplanes). But the pilot isn’t really in charge. I, for one, find that a little unsettling. And I’m not alone [34][35][36].
- "Composite materials should not be used in commercial aircraft structure"
Airbus has been making the vertical stabilizers of their airplanes out of composite materials (basically plastic reinforced with carbon fiber) for decades. More recently, other primary structures (such as the wing box of the A380, the wings of the A400, and pretty much the whole A350) are being built out of composite.
This by itself is not a problem. Most of the 777’s tail, most of the 787, many small aircraft like the MX2 (an aerobatic stunt plane also used in Red Bull air races) and the Columbia 400 (now Cessna 400), and many military aircraft, are built almost entirely out of the same kinds of materials, and their composite structures have caused no accidents.
However, some people think that composite materials should not be used in commercial aircraft fuselages, either because they don’t bend the way aluminum does (metal goes through plastic deformation as a warning before failing, while composites supposedly just snap), or because we don’t understand how they break and how things like delamination work, or because in a crash the sharp edges and toxic fumes could further hurt any survivors [17][37][38][39].
Now that is just ridiculous. Allow me to debunk this.
First of all, some people think that composite materials should not be used because they are toxic and/or flammable. However, the regulatory agencies have strict flammability rules regarding what materials can fly in a commercial airplane, such as what plastics and fabrics are used on the seats, floors, restrooms, overhead bins, and other interior elements (which have been made of plastic for a long time). If it burns too easily, or creates toxic fumes when it burns, chances are the FAA et al won’t allow it on an airplane.
Secondly: Sure, skin exposure to the sharp edges of cracking or torn composite materials – with thin sheets of laminate and tiny carbon fibers sticking out – can be dangerous. But skin exposure to the sharp edges of cracking or torn aluminum sheet is no less painful.
And it’s not exactly correct to say that composites are “brittle”. “Brittle” implies something that bends very little at all before coming apart. In reality, composite materials are quite elastic. The wings of the 787 are expected to flex upwards during takeoff (i.e. when the airplane's weight transitions from being carried by the landing gear to being carried by the wings) quite a bit more than other airplanes [40]. When the tail surfaces are loaded, when the fuselage is pressurized, etc, the 787 deforms in the same way as an aluminum airplane does (and, in many ways, even more so) and then goes back to its original shape when the loads are released during landing.
Ok, there is a difference between metallic bending and composite bending, but this difference is harmless, and is causing confusion and needless concern. (And I say “bending” here to make things easier to imagine for the layperson. These same points go for tension/pulling, compression, torsion/twisting, etc). There are two kinds of bending: elastic and plastic. Elastic bending is temporary; Release the loads, and the structure springs right back to its original shape (like a rubber band or a spring). Plastic bending is permanent; Release the loads, and the structure stays in the same new shape that the loads distorted it into, or at least doesn’t fully return to the original shape (like wax or clay). Now, most metals will go through an elastic phase and then a plastic phase before failing. In other words, a small stress will cause them to bend temporarily (and then spring back to their original shape when the load is released), some greater stress will cause them to bend permanently (i.e. they won’t spring quite all the way back when released, so there was some permanent bending), and some yet greater stress will tear them apart. The thing is, the composite materials used in aircraft structure have a longer elastic phase and a shorter plastic phase. In other words, as stress increases, they spend a longer time in elastic bending (i.e. will spring back to the original shape once released), but then reach a stress that tears them apart, without a wide range of stresses that deform them permanently without breaking them.
In other words: Imagine bending something made out of clay or wax and having the thing hold its new shape. It is possible to do this with aluminum, but it’s pretty much impossible to do it with carbon fiber.
Is this a problem? No. It is not a problem for flexibility, and it is not a problem for strength.
Carbon-fiber structures can be built just as “bendy” as aluminum structure. Many of the concerns about the supposed “brittleness” of carbon-fiber structure imply that aluminum would be better at absorbing the impact of a crash, since carbon fiber supposedly breaks before it bends. But that’s wrong. Carbon fiber bends. A lot. It’s just that, while it’s bending under high stress just before it rips apart, carbon fiber keeps trying to return to its original shape (like rubber or a spring) while aluminum just changes shape and sits there (like wax or clay). I, for one, would prefer to be surrounded by a springy elastic structure during an accident than by something that could bend into me and then not un-bend back out later.
Carbon-fiber structures can be built just as strong as aluminum structure. Say you imagine a piece of aluminum structure (e.g. a wing), and you imagine three loads: A small load that bends it elastically (impermanently), a greater load that bends it plastically (permamently to some extent), and an even greater load that causes it to fail (i.e. some components snap apart). It is possible to build a piece of composite structure that could survive those three loads, i.e. be pushed that hard without anything breaking apart. What’s more, the load that would cause the aluminum structure to bend permanently, and even the load that would cause the aluminum structure to start breaking, would only cause the carbon fiber structure to bend elastically, i.e. it would spring back and return to its original shape once released. And on top of that, it would be more lightweight than the aluminum structure too! (That, of course, is the only reason why airplane manufacturers use carbon fiber on new airplanes as much as they can).
The other supposed danger of composite materials is that we don’t understand how they break.
That one is almost true. For a while, we didn’t. Airbus’s maintenance engineers are infamous for having made comments like “invisible damage cannot produce a significant sub-surface flaw” [41], for repairing composite structure in the vertical stabilizer in such a way that it broke again later, and for denying the need for visual inspections even when American Airlines’ technicians demonstrated that certain kinds of dangerous internal damage could only be detected by ultrasound inspections [17]. The fact is, composites under certain kinds of loads will deteriorate over time; fibers may break, sheets of laminate can come unstuck, etc., and many of these things cannot be seen visually until it is too late. Airbus used to deny this. An engineering professor at MIT has stated that this was “lamentably naive policy. It is analogous to assessing whether a woman has breast cancer by simply looking at her family portrait” [42].
However, this is no longer the case. Extensive research has been conducted by NASA, Boeing, and Airbus, into the failure phenomena of composite materials. Like metal, composites can fail in many different ways under extreme one-time loads and in many other different ways under repetitive moderate loads over time. These ways are different for composites than they are for metals, the warning signs are different, and the detection methods are different… but they are being mapped out, and studied. Mathematical models have been developed [43][44] and tested for the kinds of composite materials, shapes, and configurations currently used in aircraft, and these models have shown to correlate well with structural tests [45]. (Even when it comes to the infamous 787 side-of-body problem, if you read about it carefully you'll notice that the problem was predicted by analysis before the tests [46]). Knowledge from this research is also leading to new inspection technologies to be used by airline mechanics to detect microscopic and “invisible” damage long before it poses a structural risk [47][48][49].
So composite materials aren’t toxic, aren’t brittle, don’t break apart any more easily than aluminum, will do just as good a job protecting passengers from the forces of a crash (which to be honest isn’t that good to begin with… Even crashes that don’t completely destroy an aluminum fuselage can kill everyone on board [50]), and break in ways we understand better and better, giving warnings we now know how to anticipate and detect. So I don’t know what the fuss is all about. Even Airbus has learned to no longer say stupid things like “invisible damage cannot produce a significant sub-surface flaw”. It is true that composite materials fail in ways that are different from aluminum, and we should not be using composites in airplane structures until we understand these failure modes and their warning signs, but this has been pretty much figured out for the kinds of structural designs we see in airplanes. So get over it. Composites are no less safe than aluminum.
Airbus’s minimally-strong vertical stabilizer structure, though, I’m not too confident in.
Hits:
