Crash During Landing Federal Express, Inc., McDonnell Douglas MD-11, N611FE

iii Aviation Accident Report

Contents

Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix 1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.1 History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.1.1 Airplane Performance During the Approach and Landing . . . . . . . . . . . . . . . . . . . 6 1.1.2 Flight Crew and Witness Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2 Injuries to Persons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.3 Damage to Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.4 Other Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5 Personnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.5.2 The First Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.6.1 Airplane Maintenance and Incident History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 1.6.2 Weight and Balance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 1.8 Aids to Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.9 Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.10 Airport Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.11.1 Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.11.2 Cockpit Voice Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.12 Wreckage and Impact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.13 Medical and Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.15.1 Flight Crew and Passenger Egress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.15.2 Emergency Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.16.1 Landing Gear Energy and Load Limit Certification . . . . . . . . . . . . . . . . . . . . . . 24 1.16.2 Dynamic Failure Simulation of MD-11 Right Wing Structure and Right Main Landing Gear Assembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1.16.3 Tests of Airplane Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.18.1 Dissemination of Hazardous Materials Information . . . . . . . . . . . . . . . . . . . . . . 32 1.18.2 Cargo Operator Review and FedEx Postaccident Actions . . . . . . . . . . . . . . . . . 36 1.18.3 FedEx MD-11 Tailstrike Awareness and Training Initiatives . . . . . . . . . . . . . . 37 1.18.4 MD-11 Hard Landing Accident at Hong Kong International Airport . . . . . . . . 41 1.18.5 DC-10 Hard Landing Accident in Faro, Portugal . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.18.6 Lockheed L-1011 Hard Landing Accident in New York . . . . . . . . . . . . . . . . . . 43 Contents iv Aviation Accident Report 1.18.7 Other Landing Accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 1.18.8 Safety Board Recommendations Relating to DC-10 and MD-11 Spoiler Pitch-up Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 1.18.9 MD-11 Flight Control Computer Software Changes . . . . . . . . . . . . . . . . . . . . . . 49 2. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 2.2 Accident Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 2.2.1 Airplane Performance During the Approach and Landing . . . . . . . . . . . . . . . . . . 52 2.2.2 Flight Crew Factors During the Approach and Landing . . . . . . . . . . . . . . . . . . . . 55 2.3 MD-11 Handling Characteristics and Flight Control System Design . . . . . . . . . . . . . . 62 2.3.1 MD-11 Nose-Up Pitching Moment Because of Ground Spoiler Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 2.3.2 MD-11 Pitch Handling Characteristics and the FCC-908 Software Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 2.3.3 Digital Flight Data Recorder Update Required by FCC-908 . . . . . . . . . . . . . . . . 63 2.3.4 MD-11 Ground Spoiler Knockdown Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 2.4 Transport-Category Airplane Stability and Control During the Landing Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 2.5 Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 2.5.1 Right-Wing Structural Design and Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 2.5.2 Landing Gear Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 2.6 Hazardous Materials Information Dissemination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 4. Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4.1 New Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 4.2 Previously Issued Recommendations Classified in This Report . . . . . . . . . . . . . . . . . . . 74 5. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 A: Investigation and Hearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 B: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 C: Excerpts from the Flight Data Recorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 D: Prior Incident Flight Data Recorder Data for the Accident Airplane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 E: FedEx Tail Strike Awareness Information Bulletin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 F: FedEx Tail Strike Awareness Training Instructor’s Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 v Aircraft Accident Report

Figures

1. Aerial view of the accident site.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2. N611FE at the height of the firefighting effort. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. N611FE during the final portion of the firefighting effort. . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. N611FE after the fire was extinguished. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 5. Comparison of selected FDR parameters for accident landing and previous two landings (correlated by radio altitude – 50 feet). . . . . . . . . . . . . . . . . . . . . . 7 6. Comparison of selected FDR parameters for accident landing and previous two landings (correlated by first touchdown). . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 7. Wreckage distribution diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 8. Right MLG components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 9. Boeing calculations of right MLG energy in the Newark accident.

. . . . . . . . . . . . . . . . 28 10. Boeing calculations of right MLG energy in the Faro accident. . . . . . . . . . . . . . . . . . . . 43 11. Boeing calculations of right MLG energy in the TWA L-1011 accident. . . . . . . . . . . . . 45 vii Aircraft Accident Report

Abbreviations

ABS automatic brake system AC advisory circular agl above ground level AGS automatic ground spoiler ANC Anchorage International Airport AND airplane nose-down ANPRM advance notice of public rulemaking ANU airplane nose-up APLC airport performance laptop computer ARFF aircraft rescue and firefighting ATP airline transport pilot AWAB automated weight and balance CAWS central aural warning system CFR Code of Federal Regulations c.g. center of gravity CHEMTREC Chemical Transportation Emergency Center CVR cockpit voice recorder DEP Department of Environmental Protection DFDR digital flight data recorder DG dangerous goods DGAC Director-General of Civil Aviation EWR Newark International Airport FAA Federal Aviation Administration FCC flight control computer FCOM flight crew operating manual FCP flight control panel FDR flight data recorder FedEx Federal Express, Inc.

FL flight level FMC flight management computer FMS flight management system fpm feet per minute fps feet per second FSAT flight standards information bulletin for air transportation Abbreviations viii Aircraft Accident Report g acceleration of gravity GOCC Global Operations Command Center HMRU Hazardous Materials Response Unit ICAO International Civil Aviation Organization ILS instrument landing system IRU inertial reference unit KIAS knots indicted airspeed LASE low altitude stability enhancement LSAS longitudinal stability augmentation system MAX maximum MDI Mechanical Dynamics, Inc.

MED medium MEL minimum equipment list MLG main landing gear msl mean sea level NASA National Aeronautics and Space Administration NFD Newark Fire Department NOTOC notification to captain NOTAM notice to airmen NPRM notice of proposed rulemaking PAP pitch attitude protection PIO pilot-induced oscillation PNL pitch nose lowering POI principal operations inspector PRD pitch rate damper RSPA Research and Special Programs Administration sm statute miles SN serial number STA station TRA throttle resolver angle TWA Trans World Airlines UN United Nations V takeoff decision speed V takeoff safety speed VASI visual approach slope indicator V reference speed ref WS wing station ix Aircraft Accident Report

Executive Summary

On July 31, 1997, about 0132 eastern daylight time, a McDonnell Douglas MD-11, N611FE, operated by Federal Express, Inc., (FedEx) as flight 14, crashed while landing on runway 22R at Newark International Airport, Newark, New Jersey (EWR). The regularly scheduled cargo flight originated in Singapore on July 30 with intermediate stops in Penang, Malaysia; Taipei, Taiwan; and Anchorage, Alaska. The flight from Anchorage International Airport to EWR was conducted on an instrument flight rules flight plan and operated under the provisions of 14 Code of Federal Regulations Part 121. On board were the captain and first officer, who had taken over the flight in Anchorage for the final leg to EWR, one jumpseat passenger, and two cabin passengers. All five occupants received minor injuries in the crash and during subsequent egress through a cockpit window. The airplane was destroyed by impact and a postcrash fire.

The National Transportation Safety Board determines that the probable cause of this accident was the captain’s overcontrol of the airplane during the landing and his failure to execute a go-around from a destabilized flare. Contributing to the accident was the captain’s concern with touching down early to ensure adequate stopping distance.

Safety issues discussed in this report focus on landing techniques, bounced landing recovery, and training tools and policies that promote proactive decision-making to go around if an approach is unstabilized. Safety issues also include the use of on board computers to determine the required runway length for landing, MD-11 handling characteristics and structural integrity requirements, and hard landing inspection requirements. Tracking hazardous materials continues to be a safety issue and is also discussed in the report.

Safety recommendations concerning these issues are addressed to the Federal Aviation Administration.

1 Aircraft Accident Report

1. Factual Information

1.1 History of Flight

On July 31, 1997, about 0132 eastern daylight time, a McDonnell Douglas MD-11, N611FE, operated by Federal Express, Inc., (FedEx) as flight 14, crashed while landing on runway 22R at Newark International Airport (EWR), Newark, New Jersey. The regularly scheduled cargo flight originated in Singapore on July 30 with intermediate stops in Penang, Malaysia; Taipei, Taiwan; and Anchorage, Alaska. The flight from Anchorage International Airport (ANC), Anchorage, Alaska, to EWR was conducted on an instrument flight rules flight plan and operated under provisions of 14 Code of Federal Regulations (CFR) Part 121. On board were the captain and first officer, who had taken over the flight in Anchorage for the final leg to EWR, one jumpseat passenger, and two cabin passengers. All five occupants received minor injuries in the crash and during subsequent egress through a cockpit window. The airplane was destroyed by impact and a postcrash fire (see figures 1 through 4).

According to flight plan and release documents, the airplane was dispatched to ANC with the No. 1 (left engine) thrust reverser inoperative. The flight plan time from ANC to EWR was 5 hours and 51 minutes—47 minutes shorter than the scheduled time of 6 hours and 38 minutes because of 45-knot tail winds en route. The flight crew stated that at flight level (FL) 330 (about 33,000 feet mean sea level [msl]), the flight from ANC to EWR was routine and uneventful.

At 0102:11, a Federal Aviation Administration (FAA) Boston Air Route Traffic Control Center air traffic controller instructed flight 14 to descend and maintain FL 180, according to the airplane’s cockpit voice recorder (CVR). About 0103, the captain and first officer discussed the approach and landing to runway 22R and the airplane’s landing 6 7 performance. Using the airport performance laptop computer (APLC), the first officer Unless otherwise indicated, all times are eastern daylight time based on a 24-hour clock.

Boeing Commercial Airplane Group acquired the holdings of Douglas Aircraft Company and McDonnell Douglas in 1997. The MD-11 was developed by McDonnell Douglas as a follow-on to the DC-10, which first flew in 1970. According to Jane’s All the World’s Aircraft , the MD-11, which was granted a type certificate on November 8, 1990, has, among many design changes, a longer fuselage, a redesigned tailplane, winglets above and below the wingtips, and advanced cockpit instrumentation.

The jumpseat passenger was a pilot for another airline, and the two cabin passengers were FedEx employees.

A jet engine thrust reverser deflects airflow in the forward direction to help reduce the airplane’s speed after touchdown. Maintenance personnel at ANC deactivated the No. 1 thrust reverser after finding a delaminated door on it. Flight 14’s departure with an inoperative thrust reverser was approved under provisions of the airplane’s minimum equipment list (MEL). The MEL is developed by each operator of an aircraft and must be equivalent to or more conservative than the master MEL, which is developed by the manufacturer and approved by the FAA.

See appendix B for a transcript of the recording.

Factual Information 2 Aircraft Accident Report Figure 1. Aerial view of the accident site.

determined that the airplane’s runway stopping distance would be approximately 6,080 feet using medium (MED) autobrakes. According to the CVR, at 0103:33, the flight crew then compared the APLC approximate landing distance for MED braking (6,080 feet) to the after-glideslope touchdown distance (6,860 feet) provided on the instrument approach plate. Based on the flight crew's calculation (6,860 – 6,080), MED braking provided a 780-foot margin after stopping. The flight crew then compared the APLC approximate landing distance for maximum (MAX) braking (5,030 feet) to the same 6,860-foot after-glideslope touchdown distance provided on the instrument approach plate. Based on the flight crew's calculation (6,860 – 5,030), MAX braking provided a 1,830-foot margin after stopping. On the basis of these calculations, the first officer suggested using MAX autobrakes. The captain agreed, stating “we got a lot of stuff going Runway 22R is 1,100 feet shorter than runway 22L, which was closed (see section 1.10 for a discussion of airport information).

As an airplane approaches the landing airport, pilots enter several parameters (for example, weather information and airplane weight) into the APLC, which generates landing data, including the approximate landing distances for usable runways at a selected airport.

The APLC approximate landing distance is intended to be compared with the APLC runway distance, which, in this case, is 7,760 feet.

Based on APLC data (7,760 – 6,080), MED braking would have provided a 1,680-foot margin after stopping.

Based on APLC data (7,760 – 5,030), MAX braking would have provided a 2,730-foot margin after stopping. Following the accident, FedEx expanded the APLC training presentation that was originally included in initial and upgrade training. This expanded presentation has also been added to recurrent training programs.

Factual Information 3 Aircraft Accident Report Figure 2. N611FE at the height of the firefighting effort.

Figure 3. N611FE during the final portion of the firefighting effort.

Factual Information 4 Aircraft Accident Report Figure 4. N611FE after the fire was extinguished.

against us here so we’ll…start with max.” The first officer added, “I mean…I mean if we don’t have the reverser.” At 0114:22, the captain asked the first officer to advise the passengers that “we’re gonna have a pretty abrupt stop because of those brakes and the thrust reversers and all that stuff.” Twice during the approach, the captain asked the first officer to remind him to only use the No. 2 and No. 3 thrust reversers. At 0116:16, the captain noted that the left landing light was inoperative, adding “… just the right’s working.” The EWR tower controller cleared flight 14 to land at 0129:45 and advised the flight crew “winds two five zero at five.” At 0130:02, the first officer stated “max brakes” during the before-landing checklist. The captain replied “max brakes will be fine,” and the first officer responded “if they work.” At 0130:34, the captain stated “[landing gear] down in four green” and called for “flaps fifty.” At 0102:22, during the approach briefing, the captain stated “ah…remind me to, we just want two and three for reverse.” At 0130:59, the captain stated “two and three on reverse…just in case I forget.” The No. 3 thrust reverser can be deployed on main gear spinup. The No. 2 thrust reverser cannot be deployed until after nose gear touchdown.

Landing lights are located on the fuselage aft of the L1 and R1 cabin doors. According to the MEL, flights can be conducted at night with inoperative landing lights if the nose gear lights are functioning. The captain told National Transportation Safety Board investigators that the inoperative left landing light did not affect his ability to judge sink rate and land the airplane.

Factual Information 5 Aircraft Accident Report At 0130:45, the captain disengaged the autopilot at an altitude of 1,200 feet during the approach and “hand flew” the airplane to touchdown. The autothrottles were engaged, as recommended by McDonnell Douglas and FedEx procedures. According to information from the airplane’s flight data recorder (FDR), the approach was flown on the glideslope and localizer until touchdown, and the airplane’s approach airspeed was about 158 knots until the flare. According to the CVR, the pilots had selected an approach reference speed of 157 knots, or V plus 5 knots. Altitude callouts were made by the on ref board central aural warning system (CAWS) at 1,000 feet and 500 feet, and the first officer called out minimums (211 feet) at 0132:03. At 0132:09, the first officer stated “brakes on max,” and CAWS callouts followed for 100, 50, 40, 30, 20, and 10 feet until the sound of initial touchdown at 0132:18.75. One-half second later, the CVR recorded an expletive by the captain. At 0132:20.26, the CVR recorded increasing high-frequency tones consistent with engine spool-up (accelerating engine rpms), and at 0132:21.06, the CVR recorded a decrease in high-frequency tones consistent with engine spool-down. The sound of a “loud thump” consistent with another touchdown was recorded at 0132:21.62. A series of expletives by the captain and first officer followed until sounds of “metallic breakup” were recorded at 0132:27.

FDR data indicated that after the airplane’s initial touchdown, it became airborne and rolled to the right as it touched down again (see section 1.1.1 for a detailed description of the airplane’s performance during the landing sequence). The airplane continued to roll as it slid down the runway, coming to rest inverted about 5,126 feet beyond the runway threshold and about 580 feet to the right of the runway centerline. The accident occurred during the hours of darkness. Visual meteorological conditions prevailed at the time of the accident.

The MD-11’s autobrakes, or automatic brake system (ABS), automatically apply brakes during landing and rejected takeoff. The takeoff mode is armed by selecting “T.O. [takeoff] with the AUTO BRAKE selector,” according to the MD-11 flight crew operating manual (FCOM). The ABS landing mode is armed after the gear is down. The accident airplane’s maintenance logs contained three write-ups about instances in which the autobrakes failed to arm at takeoff or failed to function properly on landing.

Maintenance personnel checked the system after each reported failure but found no anomalies. The captain told Safety Board investigators that he discussed the reliability of the autobrakes with the first officer in ANC and elected to execute a MAX power takeoff because of the possibility of autobrake failure in the takeoff mode. However, he added that the autobrakes performed normally on takeoff in ANC. He stated that he kept the possibility of autobrake failure in mind when planning for landing at EWR.

During the approach, the captain selected APPROACH LAND and FMS SPEED rather than selecting SPEED SELECT on the flight control panel (FCP) of the flight management system (FMS). In the FMS SPEED mode, the flight management computer (FMC) adjusts the airplane’s speed in relation to configuration changes (for example, leading edge slat, flap, and landing gear extension). In the SPEED SELECT mode, the captain would have had to adjust the airplane’s speed after each configuration by changing the speed on the FCP.

The first officer told Safety Board investigators that runway 22R’s three-bar visual approach slope indicator (VASI) was in operation and visible from the cockpit. He stated that during the approach, the airplane was on the lower path of the VASI system, or red-red-white. Three-bar VASI installations provide two visual glidepaths. The lower glidepath, provided by the near and middle bars, is normally set at 3°. The upper glidepath, provided by the middle and far bars, is normally set 1/4 degree higher.

V , in this case, was a target or reference approach speed. Reference approach speeds are typically ref about 1.35 V (stalling speed with flaps in the landing configuration).

so Factual Information 6 Aircraft Accident Report 1.1.1 Airplane Performance During the Approach and Landing The National Transportation Safety Board used FDR and CVR information, radar data, and integrated vertical speed and position data to develop a time history of the accident airplane’s performance and flight crew control inputs during final approach and landing (see appendix C). Excerpts from the FDR are presented in figures 5 and 6 for comparison to the accident airplane’s two previous landings.

According to FDR and radar data, the airplane was stabilized on the approach, with flaps set at 50° and the landing gear down. The airspeed was between 157 knots and 159 knots indicated airspeed (KIAS), and the vertical speed was about 800 feet per minute (fpm). Pitch attitude was about 2° to 3° airplane nose-up (ANU) and throttle resolver (lever) angles (TRA) were between 55° and 58° until flare was initiated at 38 feet radio altitude. After the flare was initiated, pitch attitude increased to 4.9°, TRA and airspeed decreased, and vertical acceleration increased to about 1.18 g.

As the airplane descended through 17 feet radio altitude, an airplane nose-down (AND) elevator deflection was initiated and pitch attitude and vertical acceleration began to decrease. Pitch attitude decreased to 4.2°, and vertical acceleration decreased from about 1.18 g to about 0.93 g as the airplane descended through 7 feet radio altitude. At 0132:17.6, FDR data indicated an ANU elevator deflection of up to 26° out of a maximum possible deflection of 37.5°, a nose-left-rudder deflection of up to 5.5°, a right-wing-down aileron deflection of 5°, and a TRA increase to 74°. Airspeed was decreasing through 152 knots at this time.

Radar data were obtained from the FAA airport surveillance radar at EWR.

Ground scar and wreckage locations were also used to reconstruct landing events (see section 1.12 for details of wreckage and ground scar locations).

The MD-11 is equipped with an electronic automated engine power control system. The throttle resolver levers on the cockpit’s power control pedestal are linked to a throttle switch and cam assembly that sends electronic signals, based on power setting, to a full authority digital engine control unit located on the engine. Throttle resolver (lever) degree angles represent the total travel of the throttle lever from the “forward limit stop” (of about 85°), to the idle aft limit (of about 41°), to just below the “reverse stop” (of 7.7°). Forward travel of the throttles is limited by an overboost stop (about 81°). This stop has a detent that allows continued forward movement of the throttles when they are pushed with a strong force. Among other things, this extra forward travel causes autothrottle disengagement.

Radio altitude is measured by the on board radio altimeter, which provides a readout of height above ground level (agl). McDonnell Douglas data indicate that the MD-11 radio altitude system is calibrated to read 0 feet when the main landing gear (MLG) tires touch the runway with the struts fully extended at 4° pitch attitude. The radio altitude sensor is 22.8 feet ahead of the MLG; therefore, when pitch is greater than 4°, the radio altitude will read too high, and when pitch is below 4°, it will read too low. The equation to convert from FDR radio altitude to pitch-corrected radio altitude is RADALTcorrected = RADALT – 22 x sin(pitch – 4°).

A g is a measure of force on a body undergoing acceleration as a multiple of the force imposed by the acceleration of Earth’s gravity.

Aileron deflection values represent the average value of all four aileron positions recorded by the FDR after accounting for any offsets resulting from instrumentation error or misrigging.

Factual Information 7 Aircraft Accident Report Comparison of selected FDR parameters for accident landing and previous two Figure 5. landings (correlated by radio altitude – 50 feet).

Factual Information 8 Aircraft Accident Report Comparison of selected FDR parameters for accident landing and previous two Figure 6. landings (correlated by first touchdown).

Factual Information 9 Aircraft Accident Report As the airplane touched down at 0132:18.6, pitch attitude and vertical acceleration were increasing (along with engine speeds). It touched down 1,126 feet beyond the runway displaced threshold with a 7° nose-up pitch attitude. Vertical speed at the time of the first touchdown was about 7.6 feet per second (fps). Vertical acceleration peaked at 1.67 g. About 1/2 second after the first touchdown, the FDR recorded an 18° AND elevator deflection (maximum possible MD-11 AND elevator deflection is 27°) and a TRA decrease. At 0132:19, rudder deflection decreased to near zero, and the magnetic heading stabilized at 217.4° (the published magnetic heading for the runway was 219°).

Pitch attitude peaked at 8.44° and began decreasing. Thrust continued to increase with N values of about 65 percent. Airspeed began to increase and the airplane became airborne.

As the airplane’s altitude increased, it pitched nose-down and rolled right-wing- down, consistent with the AND elevator deflection and right-wing-down aileron deflection. Engine speeds peaked at 80 percent N and began to decrease. The airplane reached an altitude of about 5 feet above ground level (agl) and began to descend. At 0132:20.8, as the airplane descended back to the runway, the FDR recorded about 23° ANU elevator, about 12° nose-left rudder, and additional right-wing-down aileron deflections. The airplane touched down the second time about 1,889 feet from the displaced threshold at 0132:21.6 with a 9.5° right-wing-down roll angle, a -0.70° pitch attitude and on a 216.7° magnetic heading. Roll rate was about 7° per second right-wing-down and peak vertical speed at the right main landing gear (MLG) was about 13.5 fps. Vertical acceleration at the beginning of the second touchdown was about 0.5 g and peaked at about 1.70 g just after touchdown (see sections 1.16.1 and 2.5.2 for a discussion of vertical acceleration values in relation to landing gear energy absorption limits). Maximum elevator deflection at the second touchdown was about 24° ANU, and TRAs were about 51°.

ANU elevator deflection continued for about 1 second after the second touchdown, TRAs increased to about 81°, and a left-wing-down aileron deflection was initiated. The airplane pitched up 5° and began rolling right wing down. An aural “tire failure” warning sounded in the cockpit at 0132:26 as the airplane rolled through 45° right wing down. The right-wing-down roll angle increased to 90° and the pitch attitude decreased to 5° AND This value was the computed vertical speed at the right MLG and includes 6.6 fps vertical speed at the center of gravity (c.g.) and 1.0 fps vertical speed caused by nose-up pitch rate and right-wing-down roll rate.

The MD-11 MLG are aft and outboard of the c.g.; therefore, pitch and roll rates affect the vertical speed of the MLG.

Ground spoilers on the accident airplane did not deploy after touchdown because the TRA was greater than 49°. The No. 2 engine throttle lever mechanically prevents ground spoiler deployment if its position is greater than 44° to 49° (about 1.05 inches) forward of idle and knocks down extended spoilers if the No. 2 engine throttle lever exceeds this range. Ground spoilers, or speed brakes, are hinged or otherwise moveable surfaces on the upper rear surface of a wing that reduce lift and increase drag when extended.

According to the FDR, the airplane touched down at 149 KIAS. The ground speed was 152 knots.

The bounce altitude was determined by correcting radio altitude for pitch attitude, as well as by integrating accelerations.

This value includes 11.5 fps vertical speed at the c.g. and 2 fps vertical speed caused by the right- wing-down roll rate.

Factual Information 10 Aircraft Accident Report when the FDR stopped recording at 0132:27.6. The CVR stopped 1.3 seconds later, after recording sounds of “metallic breakup.” 1.1.2 Flight Crew and Witness Statements The captain told Safety Board investigators in a postaccident interview that he “wasn’t going to grease it [the landing]…but put it [the airplane] on the end of the runway and to try to make sure…not [to] get any float out of it.” He stated that the glideslope, airspeed, and localizer were “completely nailed” during the approach. He also stated that he noticed an increased sink rate at 20 feet, “felt the airplane sink,” and made a “slight pitch and power change.” The captain stated that the airplane touched down “very firmly” and that he was not certain if the ground spoilers deployed but believed that they had. He also stated that he moved the control column forward and added power to compensate for a pitch-up tendency that occurs when the spoilers are deployed. He stated that his pitch and power response “was instinctive” and in accordance with the response called for in his FedEx tailstrike awareness training (see section 1.18.3 for details about FedEx’s tailstrike awareness training program). The captain further stated that when the airplane touched down the second time, “it started rolling to the right” and that he applied left rudder as the airplane began to roll. He added that he could not understand why the airplane kept rolling to the right and that the rolling was “gradual” and not as violent as he thought it would be.

The first officer stated in a postaccident interview that he felt the airplane begin to settle at an altitude of about 20 feet and “could tell it was going to be a firm landing.” He added that he had experienced firmer landings in the MD-11. The first officer stated that the airplane bounced about 5 to 10 feet into the air and was on the centerline. He stated that his FedEx training advocated avoiding a nose-high attitude and not controlling sink rate with pitch during a bounce. He added that the training also advocated adding power until the sink rate has been arrested or a landing accomplished. He stated that he observed the captain doing this, adding that he believed the nose attitude was about 7°. The first officer stated that no attempt was made to execute a go-around.

A FedEx DC-10 captain, whose airplane was taxiing to the departure end of runway 22R, stated that he watched the accident airplane land. He stated that he saw the airplane pitch nose down and bank to the right. He stated it was not a “normal bank” and that he saw the right wing strike the ground, break off, and catch fire.

The EWR tower controller stated that he saw the airplane touch down hard and bounce. He stated that the airplane was in a bank when it touched down again and that he saw sparks and debris coming from the airplane “before something appeared to break off from under the aircraft.” The first officer noted that this was a “seat of the pants” feeling and was not based on indications of cockpit instruments.

Factual Information 11 Aircraft Accident Report

1.2 Injuries to Persons

Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 0 0 0 0 0 Serious 0 0 0 0 0 Minor 2 0 3 0 5 None 0 0 0 0 0 Total 2 0 3 0 5

1.3 Damage to Airplane

The airplane and its cargo were destroyed by impact and a postcrash fire. The airplane was valued at $112 million.

1.4 Other Damage

A 1,574-foot area along the right side of runway 22R was sooted and scarred. Soil samples taken from the accident site were analyzed and were not found to contain hazardous levels of fuel or other chemical contamination. Five runway/taxi signs along the right side of the runway were damaged or destroyed. Cost of cleanup and repairs was estimated at $500,000.

1.5 Personnel Information

1.5.1 The Captain The captain, age 46, was hired by Flying Tigers, Inc., in 1979 and became a FedEx pilot when Flying Tigers merged with FedEx in 1989. The captain held an airline transport pilot (ATP) certificate and was type-rated in the MD-11. In addition to his ATP, the captain held a commercial certificate and a turbojet flight engineer certificate. His most recent FAA first-class medical certificate was issued on April 15, 1997, with limitations requiring him to wear corrective lenses. The captain’s most recent proficiency check was April 15, 1997, and his most recent line check was July 11, 1997. According to company records, the captain had logged a total of 11,000 flying hours, 2,621 hours of which were with FedEx. He had logged a total of 1,253 hours in the MD-11, of which 318 hours were as pilot-in-command. He had flown 155 hours, 96 hours, 41 hours, 6 hours, and 6 hours in the last 90 days, 60 days, 30 days, 7 days, and 24 hours, respectively. A review of training FedEx hired a New York-based, independent laboratory, Environmental Testing Laboratories, Inc., to test soil samples taken from the accident site. The laboratory report concluded that the accident “did not have an adverse” impact on the environment and that “no further soil investigation” was warranted.

Factual Information 12 Aircraft Accident Report records indicated that the captain had received an unsatisfactory evaluation on an upgrade proficiency check ride on October 29, 1996. The captain received additional training in V cuts and multiple engine failures and accomplished a successful recheck. FedEx records indicated that the captain had successfully completed the company’s tailstrike awareness training program twice, on July 10, 1996, during annual recurrent training as a first officer and again on November 15, 1996, during captain upgrade training. A search of FAA and company records showed no enforcement actions, accidents or incidents, or company disciplinary actions, and a search of records at the National Driver Register found no history of driver’s license revocation or suspension.

The captain had not flown in the 7 days before the accident. He arrived at ANC from his home in Nevada the evening before the accident flight departed. He reported routine activities and normal sleep in Anchorage and feeling rested upon waking about 0830 local time the day of the accident. The accident occurred approximately 14 hours later. The captain reported eating meals en route and that, typical of flights of similar duration, he felt tired at the end of the accident flight but that his performance was not affected. The captain was in good health, reported a stable personal life, and did not take medications or consume alcohol in the 24 hours before the accident.

1.5.2 The First Officer The first officer, age 39, was hired by FedEx on September 6, 1994, as a ground service employee after serving as a pilot in the U.S. Navy and as a flight engineer for another airline. He had logged a total of 1,911 hours of flying time as a pilot and 1,200 hours as a flight engineer at the time of his transfer to FedEx’s air operations division in October 1995. He held an ATP and a turbojet flight engineer’s certificate and was type-rated in the MD-11. His most recent FAA first-class medical certificate was issued on March 25, 1997, with no limitations. His most recent proficiency check was on May 18, 1997, and his most recent line check was on June 28, 1997. According to company records, he had logged a total of 3,703 flying hours, 592 hours of which were with FedEx. He had logged a total of 95 hours in the MD-11. He had flown 95 hours, 95 hours, 56 hours, 21 hours, and 6 hours in the last 90 days, 60 days, 30 days, 7 days, and 24 hours, respectively. FedEx records indicated that the first officer had successfully completed the company’s tailstrike awareness training program on May 6 and 10, 1997. A search of FAA and company records showed no enforcement actions, accidents or incidents, or company disciplinary actions, and a search of records at the National Driver Register found no history of driver’s license revocation or suspension.

The first officer lived in Minnesota and was based at ANC. He was off duty in Anchorage for 2 days before the accident and reported routine activities. He reported sleeping more than 8 hours before the flight and waking about 1200 local time after being awake briefly from 0630 to 0830. The first officer reported eating meals en route. He told investigators that he did not feel fatigued during the accident flight and that he did not V is takeoff decision speed or the decision point at which the takeoff is continued or rejected after an engine failure or other system failure. Simulator training includes V cut scenarios in which engines or other systems are intentionally failed during this critical takeoff phase.

Factual Information 13 Aircraft Accident Report believe fatigue was an issue in the accident. The first officer was in good health, reported a stable personal life, and did not take medications or consume alcohol in the 24 hours before the accident.

1.6 Airplane Information

The accident airplane, serial number (SN) 48604, was initially registered on September 29, 1993. It had a certificated maximum gross weight of 625,500 pounds and was equipped with three General Electric CF6-80C2 engines. At the time of the accident, the airplane had accumulated about 13,034 hours total time in service and 2,950 cycles.

Engine No. 1, installed on June 12, 1992, had a total of 14,652 hours (3,384 cycles), with 1,666 hours (379 cycles) since its last shop visit/inspection. Engine No. 2, installed on August 23, 1992, had a total of 14,930 hours (2,681 cycles), with 4,779 hours (918 cycles) since its last shop visit/inspection. Engine No. 3, installed on September 7, 1990, had a total of 16,950 hours (3,888 cycles), with 1,259 hours (284 cycles) since its last shop visit/inspection.

1.6.1 Airplane Maintenance and Incident History The accident airplane, as part of a fleet of MD-11 airplanes operated by FedEx, was maintained under an FAA-approved maintenance program. According to FedEx maintenance records, the airplane had received a C check at 11,025 flight hours on January 14, 1997; its next C check was due at 15,825 flight hours. FedEx records indicated that an A check was conducted on the airplane on July 18, 1997, at 13,014 flight hours.

The Safety Board reviewed the accident airplane’s maintenance logs for the 30 days before the accident. Excluding the disabled thrust reverser, nothing remarkable was noted.

FedEx maintenance documents indicated that on January 4, 1994, the airplane sustained damage during a bounced landing at Memphis, Tennessee, when a 2.85 positive g load and a minus .45 lateral g load were applied to the airframe during the second touchdown. FedEx personnel conducted the manufacturer-recommended and FAA- approved hard landing inspection and found “mild to moderate buckling of the external skin…from longeron 36 to longeron 48 [near the nose gear wheel well].” Inspection notes added that “deformations [were] smooth with no creases. Suspect areas were verified to be crack-free via eddy current surface probe.” Because no serious damage to A cycle on an airplane is one complete sequence of engine startup, taxi, takeoff, climb, cruise, descent, landing, thrust-reverse, taxi, and shutdown. A cycle on an engine is one startup and subsequent shutdown.

Under an FAA-approved maintenance program, maintenance tasks are divided into categories based on the level of maintenance required, beginning with A checks through E checks.

The MD-11 hard landing inspection examines all landing gear, tires, fuselage, wings, empennage, engine nacelles and pylons, wheel wells, and control surfaces for signs of damage.

Longerons are the principal longitudinal structural members in the fuselage.

Eddy current inspections use alternating current to locate surface and near-surface cracks.

Factual Information 14 Aircraft Accident Report any structure was found, the airplane was released to be operated “with buckles ‘as is’” and with the requirement that the area be inspected periodically before permanent repairs were made at the airplane’s next scheduled C check.

FDR data for the Memphis, Tennessee, incident indicated that nose-up elevator inputs consistent with flare began at about 35 feet radio altitude and were maintained until 1 second after the first touchdown. The first touchdown occurred with pitch attitude increasing through 7°, roll increasing through 2° left wing down, and throttles in the flight idle position. The ground spoilers did not deploy, the airplane bounced, and nose-down elevator was initiated. Pitch attitude and vertical acceleration began decreasing, and the airplane touched down the second time with pitch attitude decreasing through 1° nose-up, roll angle decreasing through 4° right wing down, and elevator position at about 17° nose down. The ground spoilers deployed fully during the second touchdown; the airplane remained on the ground, and the landing rollout was completed (see FDR plots in appendix D).

The airplane also sustained damage from a tailstrike during a bounced landing at Anchorage, Alaska, on November 4, 1994, when a 2.59 positive g load was applied to the airframe during the second touchdown. FedEx maintenance documents indicated that the tailstrike had damaged the airplane’s aft fuselage skin, a rear bulkhead, and several floor supports. According to the FedEx records, temporary repairs were made in Anchorage.

A FedEx engineering authorization form, dated November 6, 1994, stated that “all other remaining damage [was] acceptable for a one-time non-revenue unpressurized ferry flight from Anchorage to LAX [Los Angeles International Airport] for permanent repair” and that the airplane was ferried to Los Angeles. According to FedEx maintenance records, the damage to the aft fuselage skin and bulkhead was repaired during November 1994.

FDR data for the Anchorage, Alaska, incident indicated that nose-up elevator inputs consistent with flare began at about 18 feet radio altitude and were maintained until 1 second after the first touchdown. The first touchdown occurred with pitch attitude increasing through 8°, with roll about 0°, and with throttles having just reached the flight idle position. The ground spoilers did not deploy, the airplane bounced, and nose-down elevator was initiated. Pitch attitude and vertical acceleration began decreasing, and the airplane began descending back toward the runway. Approximately 6° of nose-down elevator was maintained until about 0.5 seconds before the second touchdown when a 15° to 20° nose-up elevator input was made. The airplane touched down the second time with pitch attitude increasing through 3° and roll angle decreasing through 1°. Ground spoilers deployed to 30° after the second touchdown, and pitch attitude increased rapidly as nose- up elevator peaked at about 23°. Nose-down elevator input was initiated as pitch attitude increased through 10°, and the tail struck the ground as pitch attitude increased through 12°. Nose-down elevator input increased to about 20° as pitch attitude started to decrease, then nose-up elevator was used to slow the nose-down pitch rate. The nose gear contacted the runway, ground spoilers fully deployed, and the landing rollout was completed (see FDR plots in appendix D).

Because this damage was substantial, the Safety Board classified the November 4, 1994, event as an aviation accident. For more information, see accident investigation file number ANC95FA008.

Factual Information 15 Aircraft Accident Report According to FedEx maintenance documents, permanent forward fuselage skin repairs resulting from the Memphis incident were completed in August 1995. FedEx maintenance records also indicated that the accident airplane’s landing gear struts were examined during a B check on June 27, 1997, and that no anomalies were found.

1.6.2 Weight and Balance Weight and balance information for FedEx airplanes is calculated by an automated weight and balance (AWAB) report computer program. According to FedEx procedures, station agents prepare the AWAB, which is included in the flight plan and release documentation provided to flight crews before departure; final AWAB figures are provided to flight crews just before departure. Weight and balance information for the accident airplane included the following: Basic Operating Weight: 252,762 pounds Three passengers: 600 pounds Cargo: 167,384 pounds Zero Fuel Weight: 420,762 pounds Fuel: 138,000 pounds Ramp Weight: 558,762 pounds Taxi Burn: minus 2,000 pounds Estimated Gross Takeoff Weight: 556,762 pounds According to McDonnell Douglas airplane documentation, the maximum gross takeoff weight for the accident airplane was 625,500 pounds, and the maximum zero fuel weight was 451,300 pounds. The airplane’s maximum gross landing weight was 471,500 pounds. The airplane’s actual gross landing weight was 452,300 pounds.

1.7 Meteorological Information

The METAR valid for EWR at the time of the accident reported winds of 240° at 10 knots, visibility 10 statute miles (sm), scattered clouds at 8,000 feet, temperature 20° C, dew point 12, and altimeter 30.23 inches of mercury. The automated weather advisory system and automated weather observation system at 0130, about 2 minutes before the accident, reported winds of 270° at 10 knots, visibility 10 sm and clear. According to the CVR, the EWR tower controller informed the flight crew at 0129:45 that winds were 250° at 5 knots.

The MD-11 was equipped with dual chamber, MLG shock struts. According to McDonnell Douglas personnel, improperly serviced struts can cause additional rebound during landing.

METAR is the International Civil Aviation Organization (ICAO) code for routine weather reports.

Factual Information 16 Aircraft Accident Report

1.8 Aids to Navigation

No problems with navigation aids were reported.

1.9 Communications

No external communication difficulties were reported.

1.10 Airport Information

EWR, located 3 miles south of Newark at 40°41.57’ N latitude and 74°10.10’ W longitude, is a publicly owned airport operated by the Port Authority of New York and New Jersey and handles about 421,000 commercial, military, and general aviation operations per year. It has an FAA-approved emergency plan and is certified as an Aircraft Rescue and Firefighting (ARFF) Index E airport under 14 CFR Part 139. EWR has an elevation of 18 feet above msl.

The airport has three asphalt runways with precision instrument markings: 4L/22R, 4R/22L, and 11/29. Runway 22R is 8,200 feet long and 150 feet wide. Its grooved, asphalt surface was reported by EWR tower controllers to be in good condition at the time of the accident. The runway was equipped with high-intensity runway edge lights, centerline lights, and runway end identifier lights. Runway 22R was not equipped, nor was it required to be equipped, with runway approach lights or touchdown zone lights.

The three-bar visual approach slope indicator (VASI) was located on the left side of the runway. The runway was also equipped with a Category I instrument landing system (ILS), which included an outer marker beacon but no middle or inner markers. The glideslope was set at a standard 3° angle. There were no FAA Notices to Airmen (NOTAM) on file indicating that any landing aid components were inoperative.

1.11 Flight Recorders

1.11.1 Flight Data Recorder The airplane was equipped with a Sundstrand Data Control (model UFDR) FDR, SN 2222, which was equipped to record more than 250 parameters. The nonprotected portion of the FDR was destroyed in the postimpact fire. No evidence of thermal or impact Index E refers to ARFF requirements for airports used by air carrier aircraft of at least 200 feet in length. Title 14 CFR Part 139 requires that Index E airports have a minimum of three ARFF vehicles carrying water and fire-suppressing chemical foam and that the total quantity of water for foam production be at least 6,000 gallons.

NOTAMs are disseminated to give information about conditions or changes in any aeronautical facility, service, procedure, or hazard.

Factual Information 17 Aircraft Accident Report damage was found on the inside of the crash-protected portion of the FDR, and all data were recovered successfully.

1.11.2 Cockpit Voice Recorder The airplane was equipped with a Fairchild model A-100A CVR, SN 25685. The recording, which contained good quality audio information, consisted of four channels including the captain’s microphone, the first officer’s microphone, and the cockpit area microphone. The fourth channel included the interphone and public address systems. The external surface of the recovered CVR was found scorched and coated with soot but with little impact damage. The interior of the crash case was also found scorched and discolored but with no impact damage. Fluctuations in the tape’s audio amplitude, consistent with heat damage, were present in the first 5 minutes of the recording playback.

A transcript was prepared of the entire 30-minute, 25-second recording (see appendix B).

1.12 Wreckage and Impact Information

The airplane’s wreckage was distributed along a 2,900-foot-long debris path that gradually arced to the right across runway 22R (see figure 7). Pieces of the right inboard trailing edge flap were found at the beginning of the wreckage path, about 2,226 feet from the runway’s displaced threshold. The main wreckage, located about 5,126 feet from the runway threshold and 580 feet to the right of the runway centerline, comprised the fuselage, left wing, nose gear, left MLG, center MLG, and horizontal stabilizer. The fuselage came to rest inverted with the nose on a 95° heading. Other airplane components and structure separated from the airplane during the crash sequence and were located along the debris path.

Rubber marks consistent with the touchdown of the airplane’s right MLG tires were found about 1,126 feet from the runway displaced threshold. Rubber marks consistent with the touchdown of the left MLG tires and center MLG tires were found at 1,151 feet and 1,160 feet from the runway displaced threshold, respectively. The location of the tire marks was consistent with a touchdown near the center of the runway. Rubber marks consistent with a second touchdown of the right MLG tires were found about 1,924 feet from the runway displaced threshold (798 feet after the tire marks consistent with the first touchdown). Rubber marks consistent with the center MLG tires were found again about 1,983 feet from the runway displaced threshold. The locations of the second touchdown tire marks were consistent with a touchdown near the center of the runway.

The right MLG tire rubber marks veer to the right about 1,995 feet from the runway displaced threshold.

The Safety Board ranks the quality of CVR records by five categories: excellent, good, fair, poor, and unusable. In a recording of “good quality,” most of the crew conversations can be accurately and easily understood, and the transcript developed from it may indicate several words or phrases that are not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to several simultaneous cockpit/radio transmissions that obscure each other.

Factual Information 18 Aircraft Accident Report Wreckage distribution diagram.

Figure 7.

Factual Information 19 Aircraft Accident Report Ground scarring consistent with the No. 3 (right) engine nacelle contacting the runway were found about 2,164 feet from the runway displaced threshold and continued to about 3,476 feet from the runway threshold. Runway scarring consistent with impact of the right inboard trailing edge flap was found about 2,299 feet from the runway threshold, ending about 2,376 feet from the threshold (where the right inboard trailing edge flap was found). Soot marks consistent with burning fuel were found about 2,506 feet from the threshold and continued to the end of the wreckage path. Runway scrape marks and purple paint consistent with the airplane’s tail striking the runway were found about 2,644 feet from the runway threshold and ended about 3,060 feet from the threshold. About 2,826 feet from the threshold, runway scrapes, soot marks, and runway surface gouging began turning toward the right of the runway.

The right wing, the vertical stabilizer, and all three engines separated from the airplane and were found in a grassy area to the right of the runway, about 4,577 feet from the runway threshold, and had sustained fire damage consistent with a postaccident fuel fire. The right MLG strut assembly and two MLG wheels and tires were found on the right edge of the runway, about 4,805 feet from the runway threshold. The other two right MLG wheels and tires were found about 235 feet to the right of the runway centerline and about 4,957 feet from the threshold.

The right wing separated from the fuselage just inboard of the wing MLG and fuel closure bulkhead at wing station (WS) 264. The outboard upper surface was intact and sooted. Buckling was noted in the upper surface skin approximately 12 feet inboard from the tip. The lower wingtip winglet had separated from the wingtip at its attach surface. The upper winglet remained attached to the wingtip. The No. 3 engine and pylon had separated from the wing completely, and the engine remained attached at the aft and forward pylon mounts. Stringers at the inboard end of the right wing upper surface, as well as the upper surface chordwise fracture surface, were bent in an upward direction. The rear spar fracture near WS 264 was bent aft.

All leading edge control surfaces outboard of WS 264 remained attached to the wing. The inboard flap structure had separated from the wing (the full 20-foot section of right inboard flap was found on taxiway H), portions of the separated flap hinge bracket structure were found close to the wing trailing edge, and the spoiler actuator and attach points were found intact.

The right MLG was separated from its attach points on the right wing (see figure 8). The attach points were broken from the wing, except for the forward lug, which remained attached to the wing with no evidence of failure. The right MLG truck assembly was found separated into four parts: one part was attached to the aft axle, where the wheels and tires were found intact; a second part was found on the runway; a The accident airplane’s tail cone, No. 2 engine, and vertical stabilizer were painted purple.

On the MD-11, the right and left MLG comprise four wheels, tires, and brakes and are mounted to the wing structure outboard of the fuselage. The center MLG assembly comprises two wheels, tires, and brakes and is mounted to the center fuselage. Landing gear extension and retraction are hydraulically actuated.

The landing gear wheel axles attach to the truck beam.

Factual Information 20 Aircraft Accident Report Figure 8. Right MLG components.

third part was found attached to the forward axle, where the No. 3 and No. 4 wheels were found intact; and a fourth part was found attached to the strut assembly. The pivot pin was found intact between the truck beam and the oleo piston assembly. The oleo piston and cylinder were found intact, and the piston was fully extended. The torque links were intact and had no structural damage. Parts of a wing-to-gear fitting were found on the aft 45 46 trunnion bolt. The forward trunnion bolt, or fuse pin, failed and had broken into two pieces along the shear plane. The aft portion of the forward trunnion bolt was found on the runway, and the forward portion was found in the right wing-to-gear-fitting forward trunnion lug.

Scraping damage was found on the forward trunnion lug’s forward face. The fixed side brace (to) folding side brace fitting joint was found intact with the side brace, the fixed brace, the side brace fitting (commonly referred to as the “pillow block”), and the pillow block hinge joint pin assembly (see figure 8). The inboard attach bolt was found intact with the pillow block and a part of the trapezoidal panel assembly. The remaining bolt was found detached and in two pieces. One piece was found in the remaining part of A trunnion is a pin or pivot on which an attachment can be rotated or tilted.

A fuse pin is an attachment fitting designed to fail at predetermined loads to prevent more severe damage to surrounding structures. MD-11 landing gear fuse pins were designed and positioned to allow the landing gear to fail under loads in the aft direction.

A fuse pin shear plane is the point at which the pin is designed to fail.

Factual Information 21 Aircraft Accident Report the trapezoidal panel that had broken off from the fuselage and the pillow block assembly.

The other bolt piece was found on the runway. The fixed side brace was found fractured about 6 inches from the wing fitting lug and was bent in the aft direction where it failed.

A metallurgical examination of the recovered right MLG components determined that all fracture surface evidence was consistent with overload failure. No evidence of fatigue cracking or corrosion was found. In addition, the examination found no indications of preimpact failures or anomalies. An examination of the right MLG tires found no evidence of pretouchdown failures or malfunctions.

The airplane’s nose landing gear was found intact on the inverted fuselage. There was evidence of heat damage to the assembly and tires but no indication of structural damage to the assembly’s support or wheel well structure. The strut was fully extended.

The center MLG assembly was found attached to the airplane in an upright position (on the inverted fuselage) but pushed into the fuselage. The strut was fully extended. The oleo piston was separated above the axle, and the remaining part of the oleo piston was pushed inside the cylinder.

The left MLG was found intact. There was evidence of fire damage but no indications of structural damage, except for a broken lower valve assembly (used to inflate the strut assembly lower chamber). The tires were intact and pressurized. Examination determined that the torque of the two bolts that connected the side braces to the left trapezoidal panel pillow block fitting were normal.

The left wing came to rest inverted but remained attached to the fuselage, and all of the control surfaces were attached to the wing. The wing sustained severe damage in the postcrash fire, and sections were melted and sooted by the heat and flames. The left inboard flap was partially extended (10° to 15°) and connected to its attachment points.

The left outboard flap was retracted and connected to its attachment points.

All three engines were separated from their wing or vertical stabilizer attachments.

The No. 1 (left) engine fan cowl was separated from the engine, broken into pieces, and damaged by impact and postcrash fire. Fan blade damage (gradual bending) was consistent with damage occurring during low-speed rotation. The thrust reverser actuators were found in their stowed positions. No evidence of an in-flight engine fire was found.

The No. 2 (tail-mounted) engine was separated from the vertical stabilizer at the pylon attachment points. The engine nacelle was found intact with minor impact damage and with postcrash fire damage. All fan blades were intact, and the thrust reverser actuators were found in their stowed positions. No evidence of an in-flight engine fire was found.

The No. 3 (right) engine separated from the wing at the pylon-to-wing attachment, and witness marks on the wreckage indicated that the engine’s turbine rear frame contacted the ground at the 6 o’clock position. The fan cowl separated from the engine, broke into pieces, and was damaged by impact and postcrash fire. Fan blade damage was consistent The valve was damaged during postaccident recovery efforts.

Factual Information 22 Aircraft Accident Report with damage occurring during low-speed rotation. The thrust reverser actuators were found in their stowed positions. No evidence of an in-flight engine fire was found.

1.13 Medical and Pathological Information

The flight crew provided postaccident toxicological samples, which were tested and found to be negative for drugs of abuse.

1.14 Fire

A fuel-fed fire erupted on impact.

1.15 Survival Aspects

1.15.1 Flight Crew and Passenger Egress The captain told Safety Board investigators that the airplane began a “gradual roll” on the runway at the beginning of the accident sequence and that it remained on its side for a time as it slid down the runway. He stated that he remembered an explosion and saw orange flames. The captain stated that after the airplane pivoted and came to rest inverted, he released his seat belt and shoulder harness and fell on his head and hand. He stated that he crawled to his cockpit window and saw that there was no fire on that side. He stated that when he pushed the window release handle down, it jammed but opened when he applied more force. The captain stated that the window jammed again as he tried to crank it open and that he had to kick an obstruction out of the way to continue. He stated that he exited through the window and shouted “this window is open.” The first officer described the roll as a slow, “controlled soft turnover” and stated that he was not slammed into his seat belt or shoulder harness by impact or rolling forces.

He stated that he saw orange flames and sparks and the runway pavement coming up toward him as the airplane rolled over. The first officer stated that he unbuckled his seat belt and shoulder harness and rolled to the other side of his seat because he thought the fuselage and window structure were going to fail. He stated that as the airplane rolled about 135°, he “bear hugged” his seat back and stood on the (inverted) overhead instrument panel between his seat and the center console.

The first officer stated that as the airplane’s slide began to slow, he heard the captain say “we’ve got to get out of here” and that he saw the captain and jumpseat passenger hanging upside down, restrained by their seat belts and harnesses. The first officer stated that after the airplane came to a stop, he went to the forward cabin area to The five drugs of abuse tested in postaccident analysis are marijuana, cocaine, opiates, phencyclidine, and amphetamines.

Factual Information 23 Aircraft Accident Report check on the two cabin passengers. He stated that he found one passenger strapped upside down in a seat. The second passenger had unbuckled the seat belt and was standing on the ceiling. The first officer stated that the passengers were talking and appeared to be uninjured and that he attempted to open the right forward cabin door but was unsuccessful.

He stated that he saw smoke coming from the cargo cabin and pushed the two passengers in the direction of the cockpit. He stated that he then attempted to open the left forward cabin door, but the handle was blocked by debris. The first officer stated that he yelled into the cockpit that the doors could not be opened and to open the cockpit windows. He stated that the captain exited through the cockpit window, followed by the jumpseat passenger and the two cabin passengers. The first officer stated that he exited through the window behind the cabin passengers. He stated that firefighting vehicles were approaching the airplane when they exited and that they moved to a runway marker located about 100 feet away from the airplane’s nose as firefighters arrived.

The jumpseat passenger stated that he released his seat belt and harness after the airplane came to a stop and “did a half twist and roll” to get down on the ceiling. He stated that he remembered hearing the first officer yell that the doors would not open and that the captain opened a cockpit window and told him to come forward. He stated that it was difficult to maneuver in the cockpit because of the inverted seats and debris.

1.15.2 Emergency Response Air traffic controllers in the EWR control tower witnessed the accident and immediately notified Port Authority fire (ARFF) and police units, transmitting a Condition One alarm. While en route to the crash site, the ARFF fire crew chief reported that flames were visible along runway 22R and that flames were venting from the aft section of the fuselage. The ARFF fire crew chief stated that it took about 35 seconds to drive from the fire station to the accident site and that five ARFF vehicles were engaged in fire suppression within 3 minutes of the alarm. The Port Authority incident commander told Safety Board investigators that he contacted the Port Authority police dispatcher while en route to the crash site and requested activation of the mutual aid contingency (emergency response) plan with the Newark Fire Department (NFD). He stated that he assumed that the accident airplane carried hazardous cargo because it was a late-night cargo flight and that firefighters and equipment were deployed accordingly (that is, upwind and wearing protective breathing gear). Newark authorities were contacted about 0138 and dispatched firefighting vehicles and personnel, who arrived on scene about 0146.

About 0200, the NFD dispatcher notified the Newark Hazardous Materials Response Unit (HMRU) and the New Jersey Department of Environmental Protection (DEP). Newark HMRU personnel arrived at the accident scene shortly after 0200. DEP personnel arrived about 0300 and began downwind wind direction and air quality EWR’s airport certification manual defines a Condition One alarm as “an actual or impending crash.

Major aircraft accident or fire. Aircraft dire emergency. Full response as indicated in the aircraft emergency plan will go into effect.” Factual Information 24 Aircraft Accident Report monitoring operations. About 0315, DEP personnel advised the incident commander that the monitoring had not detected elevated levels of toxic chemicals in the air.

About 0320, the NFD deputy chief reported hearing “popping” sounds as the fire in the fuselage advanced toward the forward cabin bulkhead. According to ARFF and NFD logs, the entire wreckage site was covered with fire-suppressing foam about 0430.

The fire was extinguished (except for sporadic hot spots) about 0700, according to ARFF and NFD logs. About this time, the NFD deputy chief discovered a package marked “Biomedical Research” and immediately halted all firefighting operations until a complete cargo manifest was obtained (see section 1.18.1 for details about dissemination of hazardous materials information and efforts to obtain information about the airplane’s cargo). Port Authority ARFF vehicles were withdrawn about 0700, and NFD assumed control of the accident site.

1.16 Tests and Research

1.16.1 Landing Gear Energy and Load Limit Certification Landing gear certification requirements for transport category airplanes that were applicable to the certification of the MD-11 are primarily contained in 14 CFR 25.721 through 25.737.

Subsection 25.721(a) states: The [MLG] system must be designed so that if it fails due to overloads during takeoff and landing (assuming the overloads to act in the upward and aft directions), the failure mode is not likely to cause— (1) For airplanes that have passenger seating configuration, excluding pilots seats, of nine seats or less, the spillage of enough fuel from any fuel system in the fuselage to constitute a fire hazard; and (2) For airplanes that have a passenger seating configuration, excluding pilots seats, of 10 seats or more, the spillage of enough fuel from any part of the fuel system to constitute a fire hazard.

Subsection 25.721(b) states further that “each airplane that has a passenger seating configuration…of 10 seats or more must be designed so that with the airplane under According to FedEx shipping documents, declared items of hazardous materials were loaded in the forward 1L and 2L cargo container positions. Thirteen packages of hazardous materials were in container 1L, including 10 packages of (flammable gas) aerosols and 3 packages of a flammable solid. The 2L container carried 1 package of perfumery, classified as a flammable liquid, a package of gallium (a corrosive), and methyl methacrylate, another flammable liquid.

Subsequent examination of the package determined that it contained sterilized blood and that it was not a dangerous goods shipment.

Factual Information 25 Aircraft Accident Report control it can be landed on a paved runway with any one or more landing gear not extended without sustaining a structural component failure that is likely to cause the spillage of enough fuel to constitute a fire hazard.” Section 25.473, “Ground Load Conditions and Assumptions,” describes the descent velocities that must be assumed for certain landing conditions (for example, level landing, tail-down landing, one-wheel landing, and side load conditions).

Section 25.723, “Shock Absorption Tests”; Section 25.725, “Limit Drop Tests”; and Section 25.727, “Reserve Energy Absorption Drop Tests,” describe landing gear energy and load limits. Subsection 25.723(a) states that “it must be shown that the limit load factors selected for design in accordance with [Section 25.473] for takeoff and landing weights, respectively, will not be exceeded.” Sections 25.725 and 25.727 describe the values and parameters to be used in conducting the landing gear limit and reserve energy absorption drop tests described in Subsections 25.723(a) and (b). Subsection 25.723(b) also states that the “landing gear may not fail in a test, demonstrating its reserve energy absorption capacity, simulating a descent velocity of 12 fps at design landing weight, assuming airplane lift not greater than the airplane weight acting during the landing impact.” Subsection 25.473 (1) states: The selected limit vertical inertia load factors at the center of gravity [c.g.] of the airplane may not be less than the values that would be obtained— (i) In the attitude and subject to the drag loads associated with the particular landing condition; (ii) With a limit descent velocity of 10 fps at the design landing weight (the maximum weight for landing conditions at the maximum descent velocity); and (iii) With a limit descent velocity of 6 fps at the design takeoff weight (the maximum weight for landing conditions at a reduced descent velocity).

This requirement was added as a result of a notice of proposed rulemaking (NPRM) issued by the FAA on August 12, 1969. In this NPRM, the FAA stated that the existing Section 25.721 “was designed to [e]nsure that if the landing gear fails, no part of the fuel system in the fuselage of the airplane will be punctured. It is proposed to extend this protection to the entire fuel system of the airplane. However, since not all punctures of the fuel system would result in a fire hazard, the proposal would protect against those punctures only that would result in the spillage of enough fuel to cause a fire.” The NPRM proposed amending 25.721 to require that “[t]he [MLG] system…be designed so that if it fails due to overloads during takeoff and landing (assuming the overloads are in the vertical plane parallel to the longitudinal axis of the airplane), the failure mode is not likely to cause the spillage of enough fuel from any part of the fuel system to constitute a fire hazard.” In its final rule, which adopted the language that currently appears in Subsection 25.721(a), the FAA stated on February 24, 1972, that this paragraph had been “substantially amended” since the NPRM and that “in response to a comment, the parenthetical expression in the proposed amendment has been changed to make it clear that the regulation is based on the assumption that the overloads act in the upward and aft directions.” The cargo version of the MD-11 was designed to passenger aircraft certification standards.

Factual Information 26 Aircraft Accident Report Subsection 25.473 (2) states that “airplane lift, not exceeding the airplane weight, may be assumed to exist throughout the landing impact and to act through the [c.g.] of the airplane.” According to Boeing, the MD-11 was designed to allow “sacrificial shedding” (by use of fuse pins) of the MLG assemblies under aft (drag) overload conditions to prevent catastrophic loads being transmitted to the wing box. Boeing indicated that the MD-11 landing gear certification was based on drop tests conducted on DC-10 landing gear, which are nearly identical to MD-11 landing gear.

Boeing, in a submission to the Safety Board, stated that a review of “historical data indicated that [MLG] failure due to overload was most likely to occur as a result of striking an obstruction.” The Boeing submission, which described Douglas’ landing gear design philosophy for the DC-10 and MD-11, added the following: The [Boeing Long Beach Division] believed that the most probable condition would be a 1.0 g vertical load at maximum ramp weight (i.e., the weight of the aircraft would be distributed between the two [right and left] [MLG], the center [MLG] and the nose landing gear with no aerodynamic lift), static gear extension, with a drag load applied to the axles until the failure of the gear. For this condition it was shown by analysis that the [MLG] would separate from the wing without any failures to the fuel tanks. This was validated by tests done on full scale DC-10 landing gear and wing test structure. By analysis this was shown to be true for vertical loads up to 2.0 g’s (i.e., twice the weight of the aircraft is distributed between the two [right and left] [MLG], the center [MLG] and the nose landing gear with no aerodynamic lift) at the aircraft ramp weight.

Because a fuse [pin] in the vertical plane may not prevent substantial loads from entering the wing structure once the fuse has released, and because the review of historical data indicated that failure due to overload was most likely to occur as a result of high drag loads, a different approach was taken to assure fuel tank integrity for the high vertical load (above 2.0 g’s) condition. For vertical loads above 2.0 g’s, the [MLG] is not designed to separate from the wing. Instead, the landing gear and its back-up structure are designed to be very robust, i.e., they are designed to withstand significantly greater descent rates than the 12 fps (ultimate) required per Part 25.723 (b). Analysis has indicated that for a maximum landing weight, typical-landing-configuration landing, the MD-11 [MLG] can withstand up to a 16.9 fps descent rate without bottoming the shock struts or failing its backup structure including the wing rear spar. Similarly, for a rolled landing (8 degrees one-wing-low attitude, with lift equal to aircraft weight), the landing gear can withstand up to 15 fps descent rate without bottoming the shock strut or failing its back-up structure including the wing rear spar.

The wing box, often the heaviest single piece of an airplane’s airframe, is the strong, primary structure of a modern, stressed-skin wing. Loads are taken by cantilever beams comprising upper and lower skins joined to front and rear spars.

Boeing’s Long Beach Douglas Products Division. Undated. Submission of Proposed Findings for FedEx Flight 14, MD-11-F, N611FE, Newark, New Jersey, 31 July 1997.

Factual Information 27 Aircraft Accident Report The Boeing submission added that “creating a reliable vertical fuse can only be accomplished by adding weight and complexity” to the airplane, and increasing landing gear energy absorption capability “could have a cascading effect in that the total aircraft structure would have to be strengthened to absorb the additional energy.” For “extreme roll angles,” the Boeing submission noted that “the landing gear design criteria and philosophy do not come into play. Striking the wingtip may fail the wing directly or may cause the aircraft to ‘cartwheel.’” The Boeing submission stated that “for lesser roll angles the single gear on the ‘wing low’ side may fail (or fuse if so designed) if the combination of sink rate and roll rate (and amount of wing lift) impart loads that exceed the design thresholds.” Boeing’s submission added the following: For ‘fused’ aircraft the (remaining) energy of vertical descent would then be absorbed by flexing the low-side wing, or by some combination of exercising the high-side landing gear, and flexing the low-side wing. For some combinations of sink and roll rates the low-side gear may fuse (followed by the wing engine/nacelle) and the aircraft may ‘settle in’ on the remaining gear and the low- side wing without compromising fuel tank integrity. For higher sink and roll rates (or lower amounts of wing lift) the low-side wing may fail nonetheless, as a result of exceeding its flexure (bending) limits.

The Boeing submission further noted that because “kinetic energy is a form of energy associated with the motion of an object, the kinetic energy dissipated into the landing gear during landing touchdown is derived from both the rate of descent and the aircraft’s rolling rate at touchdown…During a normal landing, the kinetic energy from descent and roll rates is absorbed by shock strut stroking at touchdown, which can be called ‘Phase 1’ energy absorption.” Boeing’s submission added that during “Phase 2” energy absorption, which also occurs via shock strut stroking, “potential energy related to aircraft weight eventually gets absorbed by the main and nose landing gears as wing lift is reduced due to the reduction of both angle of attack and forward velocity and deployment of ground spoilers. This energy is normally absorbed some time after the total kinetic energy related to the descent rate is completely absorbed at initial touchdown.” The Boeing submission added the following: In a stabilized approach, assuming calm atmospheric conditions and ignoring ground effect, once the aircraft’s rate of descent is stabilized, vertical acceleration is equal to 1.0 g and lift is equal to the aircraft weight. … If the aircraft’s vertical acceleration at touchdown is a value less than 1.0 g, then the energy that results from the positive acceleration towards the ground due to the reduced lift becomes additive to the kinetic energy from the rate of descent. The effect is that the landing gear has to absorb not only the Phase 1 energy at touchdown, but a portion of the Phase 2 energy at the same time. The end result is a higher load into the landing gear and attaching structure during touchdown.

Boeing further stated in its submission that it had “begun an evaluation into the net safety benefit of installing a fuse for vertical overload in the DC-10 and the MD-11 [MLG]…that could take a year or more to complete.” Boeing also stated that it would include the Newark accident scenario in its study of the potential safety benefits of vertical fusing.

Potential energy is a function of gravitational acceleration and vertical distance above a reference level, or the relative position of an object.

Factual Information 28 Aircraft Accident Report The accident aircraft’s recorded vertical acceleration at the start of the second touchdown impact was approximately 0.5 g, that is, wing lift was equal to approximately half the aircraft weight, which imparted huge additional potential energy into the landing gear and attaching structure above and beyond those associated with the 11 fps [c.g.] descent rate and the 7 [degree per second] roll rate [which combined resulted in the 13.5 fps sink rate]. In addition, these energies were imparted primarily into the [right] MLG only, due to the right wing down roll angle…at touchdown. At the accident aircraft’s landing weight of 452,000 [pounds]…potential energy of 678,000 ft-lbs was added to the approximately 896,000 ft-lbs. [Right] MLG kinetic energy from the combined aircraft descent and roll rates, for a total energy into the [right] MLG of nearly 1,574,000 ft-lbs.

Comparing the loads into the [right] MLG from the accident landing at Newark to the [right] MLG energy absorption requirements for certification shows that the energy developed during the accident landing was over 3 times the reserve energy (ultimate) certification requirements for a single [MLG].

Figure 9 shows Boeing’s calculations of the energy imparted to the right MLG in the Newark accident.

Figure 9. Boeing calculations of right MLG energy in the Newark accident.

The Boeing submission concluded that a “sink rate of approximately 13.5 fps (11 fps at the [c.g.] plus the [right-wing-down] roll rate) at touchdown impact is, by itself, outside the design envelope; a 13.5 fps sink rate landing on a single [MLG] is even further outside the design envelope; [and] a 13.5 fps sink rate landing on a single [MLG] with a net 0.5 g downward acceleration is yet further outside the design envelope.” In addition, the Boeing submission noted that it was revising the MD-11 maintenance manual to expand hard landing definition and inspection criteria. Boeing Factual Information 29 Aircraft Accident Report stated that the criteria should include “information on the effects of reduced lift and adverse aircraft attitude on loads into the landing gear.” The Boeing submission added the following: Data developed during this investigation show that the absolute recorded vertical acceleration value during landing should not be the only criteria for determining if a hard landing has taken place. The recorded vertical acceleration at the beginning of the touchdown can also be very important. Specifically, if the recorded vertical acceleration at the beginning of the landing is less than 1.0 g, then aircraft weight that is normally accommodated by the 1.0 g wing lift is instead transmitted into the landing gear on top of the loads required to decelerate the airplane vertically from the aircraft’s sink rate. The effects of non-routine aircraft pitch and roll attitudes on energy introduced into singular landing gear should also be part of the hard landing evaluation.

1.16.2 Dynamic Failure Simulation of MD-11 Right Wing Structure and Right Main Landing Gear Assembly Initial simulation conducted by Boeing did not show loads great enough to cause the failure of the right-wing rear spar, MLG, or associated structure. Subsequently, Boeing contracted with Mechanical Dynamics, Inc., (MDI), a Michigan-based company specializing in dynamic simulation, for assistance. Boeing and MDI developed a computer model of the airplane structure to simulate its flightpath based on the FDR data and determine the resulting dynamic loading imparted to the aircraft structure during the accident.

MDI and Boeing personnel developed a computer model of an MD-11’s structural elements and validated its static and dynamic characteristics via comparison with certification test data. Two structural failure sequence theories were then explored. The first scenario (beginning at the second touchdown impact) proposed the following failure sequence: • the right MLG strut and tires bottomed but did not fail immediately, the right inboard flap separated, and the outboard bolt of the side brace fitting failed because of inboard load on the lower right MLG; • the subsequent gear failure transferred the load to the No. 3 engine and pylon and outboard wing and flap; and Certification for landing on one wheel is governed by 14 CFR 25.483, “One-wheel Landing Operations.” Based on conditions and assumptions contained in Section 25.473, Section 25.483 requires that an airplane be certified to withstand a 10 fps vertical landing at its maximum landing weight (471,500 pounds) with zero roll angle.

Boeing incorporated these findings into a revised maintenance manual that was released in November 1999.

The simulation is based on a mechanical system simulation software package, known as ADAMS software, developed by MDI. According to MDI, ADAMS software is also widely used in the automotive, marine, and construction vehicle industries. The Board’s Airplane Performance Group reviewed this simulation effort and verified the methodology.

Factual Information 30 Aircraft Accident Report • the wing failed inboard of the landing gear fitting.

According to the Boeing submission, simulations of Scenario 1 did not generate loads great enough to fail the side brace fitting. Scenario 1 also failed to match runway evidence.

The simulations for Scenario 2 indicated the following failure sequence: • right MLG strut and outboard tires bottomed and vertical strut “spiked”; • right rear spar web and spar caps fractured inboard of the gear fitting; • inboard upper wing (skin and stringer) panel began to collapse from back to front; • outboard right wing twisted leading-edge down, right MLG wing fitting moved up, and right MLG tires moved aft and outboard; • right inboard flap track came off rollers at the side of the fuselage; • right inboard flap twisted off its outboard hinge support fitting and separated from the aircraft; • excessive movement of the right MLG and its wing attach fitting imparted large prying loads on the side-brace-fitting-to-trapezoidal-panel joint, inboard half of the inboard trap panel fractured, and outboard bolt fractured; • right [engine] nacelle contacted runway; • fuel spilled from the right wing and ignited; • aircraft began to roll clockwise, “dragging” the right wing underneath; and • other failures were consequent.

The Boeing submission concluded that its dynamic simulation model of the Scenario 2 accident sequence correlated “substantially with evidence from the crash site” and FDR data. Elaborating on this point, Boeing concluded that it is most probable that, as a result of loads applied to the right [MLG] that were substantially beyond design limits, the right wing structure failed. The failure most probably initiated at the rear spar/bulkhead (trunnion) rib interface and progressed through the primary wing box structure. As a result of this failure, the right main gear trunnion moved substantially upward and aft with respect to the trap [trapezoidal] panel fitting. This motion was sufficient to cause the fixed side brace to bind against the pillow block footing, tearing the pillow block loose from the trap panel.

The Boeing submission stated that the “failure of the rear spar web and the wing torque box [was] modeled as perfectly elastic/perfectly brittle. In the real structure, the failure would be elastic/plastic.

Consequently, the results from the point of failure of the rear spar on become less quantitative than prior to this point in the event. Nevertheless, the model behavior subsequent to the structural failure appears to be in reasonably good qualitative agreement with the evidence from the crash site.” Factual Information 31 Aircraft Accident Report 1.16.3 Tests of Airplane Systems Electronic airplane systems that contained nonvolatile memory were removed for examination and testing. Testing determined that the airplane’s three air data computers, the hydraulic systems control module, two flight control computers (FCC), the miscellaneous system controller, and two advanced flight management computers were operating normally before the accident and that their failures were consistent with loss of electrical power after the second touchdown and structural failure of the airplane.

The Safety Board reviewed the longitudinal stability augmentation system (LSAS) and found that its inputs to and outputs from the FCC were continuously monitored, even when the LSAS was not actively commanding the elevators (for example, below 100 feet agl). When these monitors detect a failure, a fault is stored in FCC maintenance memory.

A review of FCC maintenance memory for the accident flight revealed that the FCCs did not record any LSAS fault messages immediately before or during the first touchdown.

Additionally, the system design provides that failures detected with respect to LSAS inputs/outputs will also result in the affected LSAS channel(s) being shut down, which is recorded on the airplane’s FDR. The FDR data for the accident flight did not indicate any LSAS failures during the accident landing. The FCCs did record LSAS failure fault messages at speeds below the first and second recorded touchdown speeds (149 knots and 152.5 knots, respectively).

The airplane’s left and right fuselage-mounted landing light filaments were examined for impact-related failures. The right landing light filament was found intact with its support structure intact. The left landing light filament was broken into pieces and had slight melting on several ends consistent with having broken while operating. No stretching was found on either filament.

1.17 Organizational and Management Information

FedEx began U.S. domestic operations with a fleet of 14 Falcon jets on April 17, 1973, and expanded its domestic operations between 1973 and 1980. Following a series of The Boeing submission also noted that, according to simulations, “subsequent to the failure [of the spar web structure], the right wing twists substantially nose-down under the imposed loads. This twisting causes the right wing to ‘dump’ most of its lift and results in a sudden and substantial outboard motion of the right main gear bogie, caused by the fixed and folding landing gear side braces pivoting about their (common) attachment at the trap panel fitting attachment point.” The shutdown is accomplished by deenergizing the elevator’s electrical shutoff valves that, when energized, permit LSAS commands to move the elevator. The shutdown would be annunciated to the flight crew via the LSAS FAIL lights on the overhead panel as well as electronic instrument system alerts (providing there are no display system inhibits in effect); an LSAS “FAIL” would also be logged in the FDR if the fault was sufficiently sustained to be recorded by the FDR (each LSAS channel is sampled twice per second).

The airspeeds logged with these faults are generated by the digital air data computer and are routed to the centralized fault display system via the FMCs, resulting in a latency of less than 0.5 seconds from generation to storage.

Factual Information 32 Aircraft Accident Report international mergers in the 1980s, FedEx began operations in Europe and Asia. FedEx operates the largest all-cargo fleet, with a combined transport capacity of about 26.5 million pounds daily. The airline serves 365 airports worldwide in 210 countries with a fleet of 650 airplanes, including 29 MD-11s and 90 DC-10s. More than 150,000 employees handle 3.3 million packages daily (of which 20,000 daily are dangerous goods). The company employs about 3,700 flight crewmembers.

1.18 Additional Information

1.18.1 Dissemination of Hazardous Materials Information FedEx uses several forms to document the shipment of hazardous materials on board its cargo airplanes. The form “Notification of Dangerous Goods Loading (Part A)” is completed for all flights, including those without hazardous materials on board. Part A is an envelope with another multicopy form on the front that identifies cargo containers by their positions on the airplane and the classes of hazardous materials, such as flammable liquids and corrosives, in each container. The Part A envelope contains copies of all shipping documentation about hazardous materials on an airplane and is signed by a hazardous materials specialist and the captain.

A “Dangerous Goods Separation Pouch” for each cargo container loaded with a declared hazardous materials package is inserted into the Part A envelope. The separation pouch is also an envelope with a multicopy form on the front that identifies the various classes of hazardous materials in a specific cargo container. A copy of the form on the separation pouch is also affixed to both ends of each hazardous materials cargo container.

The Part A form and the separation pouch do not indicate the specific hazardous materials and the quantities on board the airplane.

Specific information about hazardous materials in a given package, such as the proper shipping name, United Nations (UN) identification number, hazard class, packing group, quantity, and 24-hour emergency telephone number, is listed on a “Notification of Loading of Dangerous Goods (Part B)” form. The Part B form is affixed to a package containing hazardous materials along with a FedEx tracking number and remains on the package throughout shipment. A copy of the Part B form is placed in the separation pouch for the appropriate cargo container.

The assembled Part A form, separation pouches, and copies of Part B forms are carried on board the airplane so that they can be available to the flight crew. Copies of the Part A form, separation pouches, and Part B forms are also retained at the originating station where the shipment was accepted and at the departing hub of the flight.

FedEx fact sheet, June 2000.

Factual Information 33 Aircraft Accident Report The flight crew also carries a “Load and Weight Plan” form, which lists the position and weight of each cargo container on board the airplane. Remarks on the form identify classifications for hazardous materials carried in cargo containers but do not identify the specific shipping name or quantity of the hazardous material in each package.

The Port Authority incident commander stated that he requested the accident airplane’s shipping documents about 5 minutes after arriving at the accident site to determine whether hazardous goods were on board. Airport police relayed this request to the FedEx office at EWR. After waiting about 20 minutes, the incident commander stated that he dispatched a police officer to the FedEx office to locate the documents. After witnessing the accident, the FedEx manager for international flights at EWR contacted the FedEx Global Operations Command Center (GOCC) in Memphis, Tennessee, to coordinate collection of the accident flight’s cargo documents. The FedEx duty manager also contacted the FedEx office at ANC, the departure station for flight 14, to obtain the hazardous materials shipping documents. Because the hazardous goods shipment originated in Narita, Japan, the Anchorage office did not have copies of the shipping documents. On the basis of preliminary information provided by the FedEx office in Narita and relayed through the Anchorage office, FedEx personnel in Newark forwarded a brief note to firefighters listing several of the hazardous materials on board flight 14, including the amount and the UN classification numbers. The incident commander received the list between 0300 and 0320. The incident commander then requested that the Port Authority police contact the Chemical Transportation Emergency Center (CHEMTREC) for a description of the materials based on their UN numbers.

CHEMTREC responded that some of the material posed a contamination threat to the air and that one of the products might react violently with water. Firefighters were advised to remain upwind of the fire and to wear protective breathing gear.

Between 0500 and 0600, the Anchorage FedEx office began faxing hazardous goods information (Parts A and B) obtained from Narita to the FedEx office in Newark.

According to the FedEx manager, the faxes were given to the incident commander about 0600.

In addition to requiring that the proper shipping name, UN identification number, hazard class, packaging group, total quantity of the material, and 24-hour emergency telephone number appear on shipping papers for hazardous materials, 49 CFR 175.33 also requires operators to provide this information in writing to the pilot-in-command and copies of the shipping papers to accompany the shipment on the airplane. In addition, Section 175.33 requires that emergency response information required under Subsection 172.600(g) “must be maintained in the same manner as the written notification to pilot-of- command during transport of the hazardous material aboard the aircraft.” The Part A and Part B hazardous materials notification forms carried on board the accident airplane were not retrieved by the flight crew before they evacuated the airplane.

The partial, handwritten list contained the UN/North American hazard identification numbers for five of seven hazardous materials on board, including a notation about “36 pounds of unknown hazardous materials.” CHEMTREC is operated by the Chemical Manufacturers Association and was established to provide immediate emergency response information for handling hazardous materials and other chemicals.

Factual Information 34 Aircraft Accident Report 1.18.1.1 Other FedEx Accidents Involving Dissemination of Hazardous Materials Information On September 5, 1996, a FedEx DC-10-10CF was destroyed by fire after making an emergency landing at Stewart International Airport, Newburgh, New York. The emergency landing was executed after the flight crew determined that smoke was in the cabin cargo compartment. The Safety Board’s investigation determined that emergency response agencies repeatedly requested specific information about the hazardous materials on board the airplane and that faxes of shipping documents sent by FedEx personnel in Memphis did not reach the incident commander. The Board also determined that many of the faxes were illegible.

The Safety Board’s investigation of the Newburgh accident revealed that FedEx “did not have the capability to generate, in a timely manner, a single list indicating the shipping name, identification number, hazard class, quantity, number of packages, and the location of each declared shipment of hazardous materials on the airplane.” In addition, the Board determined that FedEx was “unable to provide complete information to emergency responders in a timely manner [Part B shipping documents were not available to emergency responders].” (See sections 1.18.1.2, 1.18.2, and 2.6 for details of Board recommendations from this accident.) Two subsequent FedEx accidents also involved hazardous materials dissemination issues.

1.18.1.2 Previous Safety Board Recommendations on Hazardous Materials Information Dissemination As a result of its investigation of the September 5, 1996, FedEx Douglas DC-10 accident at Newburgh, New York, the Safety Board issued Safety Recommendations A-98-75 and -80 on August 12, 1998. The Board noted in its analysis of the Newburgh accident that “compared to other modes of transportation, it is less likely that shipping papers on board an accident aircraft will survive or be accessible because of the greater likelihood of fire and destruction of the airplane. Because of the danger of fire, a flight crew is also less likely to have time to retrieve the shipping papers after a crash.” The Safety Board concluded that “DOT hazardous materials regulations do not adequately address the need for hazardous materials information on file at a carrier to be quickly retrievable in a format useful to emergency responders.” According to 49 CFR 172.600(g), “Emergency Response Information,” emergency response information, including an emergency response telephone number, is required to be “immediately available to any person who, as a representative of a Federal, State or local government agency, responds to an incident involving a hazardous material, or is conducting an investigation which involves hazardous material.” National Transportation Safety Board. 1998. In-flight Fire/Emergency Landing, Federal Express Flight 1406, Douglas DC-10-10, N68055, Newburgh, New York, September 5, 1996 . Aircraft Accident Report NTSB/AAR-98/03. Washington, D.C.

On April 7, 1998, a Cessna 208 operated by FedEx crashed near Bismarck, North Dakota. On March 5, 1998, a Cessna 208 owned by FedEx and operated by Baron Aviation Services, Inc., crashed near Clarksville, Tennessee.

Factual Information 35 Aircraft Accident Report Safety Recommendations A-98-75 and -80 were issued to the FAA and the Research and Special Programs Administration (RSPA), respectively, and asked them to: Require, within 2 years, that air carriers transporting hazardous materials have the means, 24 hours per day, to quickly retrieve and provide consolidated, specific information about the identity (including proper shipping name), hazard class, quantity, number of packages, and location of all hazardous materials on an airplane in a timely manner to emergency responders.

In an October 27, 1998, response to the Safety Board, the FAA noted that RSPA was “the lead agency on this issue” and was drafting an advance notice of proposed rulemaking (ANPRM) to “require air carriers to develop and implement a system capable of providing this information during instances of emergencies.” Because Safety Recommendation A-98-80 was identical to Safety Recommendation A-98-75 issued to the FAA, the FAA response asked the Board to close Safety Recommendation A-98-75. In a November 9, 1998, response to RSPA, the Board acknowledged that RSPA and the FAA “were jointly developing” an ANPRM “to seek public comment on these recommendations.” Pending completion and review of the final rule, the Board classified Safety Recommendation A-98-80, to RSPA, “Open—Acceptable Response,” which is its current status. Noting RSPA’s assumption of lead agency responsibility in an April 22, 1999, letter to the FAA, the Board classified Safety Recommendation A-98-75 “Closed—No Longer Applicable.” In a June 28, 2000, letter, the Safety Board requested an update from the RSPA regarding its progress on Safety Recommendation A-98-80. In a July 20, 2000, letter, RSPA stated that it is in the final stages of developing the ANPRM with the FAA and anticipates publishing it in the Federal Register by September 1, 2000. (See section 2.6 for further discussion of RSPA’s response.)

1.18.2 Cargo Operator Review and FedEx Postaccident Actions As part of its investigation of the accident involving the FedEx DC-10 in Newburgh, Safety Board investigators reviewed seven other operators that carry cargo to determine if they had the ability to quickly retrieve and produce complete information about hazardous materials carried on board a particular flight. Board investigators found that only one carrier (Swissair) had a computerized capability to provide information about the declared hazardous materials on board its airplanes. Swissair reported that all of its notification to captain (NOTOC) forms were accessible by computer and that it had developed a “simplified” NOTOC that contained the UN number, classification, name, quantity, drill code (emergency response guide), and destination of hazardous goods on board. According to the Board survey, the remaining carriers, like FedEx, tracked this The September 1997 survey was administered to Airborne Express, United Parcel Service, Northwest Airlines, Swissair, United Airlines, British Airways, and Delta Air Lines.

Factual Information 36 Aircraft Accident Report information only by retaining, at the departing station, paper copies of the hazardous materials shipping documentation carried on board the airplane.

In a May 5, 1998, letter to the Safety Board, FedEx’s president and CEO stated that FedEx was developing “systems and procedures which will reduce substantially the length of time required to provide firefighters and other emergency responders with detailed information concerning [hazardous materials] shipments aboard FedEx aircraft.” The letter stated that FedEx planned to first create an “intermediate solution” consisting of an “electronic notification system upon which basic [hazardous materials] information of interest to firefighters will be entered by a DG [dangerous goods] specialist at airport ramps at departure of FedEx aircraft,” including information on hazard class, quantity, and location of all hazardous materials on the airplane.

FedEx’s May 5 letter outlined a “permanent solution” that would allow “the tracking, by container and aircraft, of [hazardous materials] shipments throughout the shipping cycle. Complete [hazardous materials] information, including inbound and outbound…manifests, will be available on an immediate basis at the FedEx GOCC, which is manned 24 hours-a-day, 7 days a week, and all FedEx facilities.” The letter indicated that this system would require “extensive system development efforts, along with scanning technologies which are currently under development” and that such development would take about 18 months before testing.

In a May 20, 1998, letter, the Safety Board replied that FedEx’s plan appeared “reasonable and responsive” and asked the company to keep the Board informed of its progress and the effectiveness of the new systems.

FedEx informed the Safety Board of its progress in implementing the changes in a March 4, 1999, letter. FedEx stated that the interim system, the “manual entry of hazard class, total quantity and location of each Dangerous Good on each departing aircraft’s Flight Dispatch Report,” had been implemented in July 1998. The letter added that this eliminated “the necessity of faxing the basic and most needed” hazardous materials information after an accident and that the proposed fully automated tracking and tracing The simplified form, designed for use in emergencies, contains less information than required by 49 CFR 175.33 and ICAO’s “Technical Instructions” for hazardous cargo transport. U.S. carriers must use the more detailed form required under Section 175.33.

FedEx refers to the automated dangerous goods tracking system by the acronym BADGES (Beneficial Automation of Dangerous Goods Entry System).

Factual Information 37 Aircraft Accident Report system remained under development but would be ready for testing in late 1999. The letter added the following: This system will be able to generate, on an immediate basis, a [DG] manifest which contains all of the required regulatory information for all DG shipments on every FedEx aircraft and truck…This is possible because of advanced scanning technology, sophisticated computer program development, and a dedicated and exclusive DG server. In addition to simply maintaining and displaying information, we believe the system will also alert aircraft loaders of potential problems with incompatible DG shipments, and alert truck drivers of the need for specific placards. These capabilities will reduce manifest entry mistakes and cargo loading errors, thus rendering our carriage of DG safer. It will certainly assist our efforts to get specific DG information to emergency providers.

In an April 5, 1999, letter, the Safety Board acknowledged FedEx for “the actions the company ha[d] initiated” and requested updates on the test and implementation of the system. In his April 19, 1999, letter to the Board, FedEx’s president and CEO stated that FedEx planned to trial test the software in October 1999 with a “full rollout to occur soon thereafter.” In its March 9, 2000, letter and subsequent briefings, FedEx announced that following completion of the October 1999 software test in New Orleans, Louisiana, software changes would be finalized and more testing would be conducted in September 2000 at its St. Louis, Missouri, facility. In a March 24, 2000, letter, the Safety Board replied that it “was gratified that FedEx remained fully committed to the development and implementation of this important safety system.” The Safety Board notes that recent software developments now offer cargo carriers several options for online retrieval of dangerous goods information, such as identifying specific information about hazardous materials on board an airplane and providing information to emergency response personnel. Several air carriers are reported to be incorporating this software into their tracking systems.

1.18.3 FedEx MD-11 Tailstrike Awareness and Training Initiatives FedEx developed and implemented an MD-11 tailstrike awareness training program in June 1996. The program was designed to increase flight crew awareness of pilot-controlled factors that contribute to MD-11 tailstrikes, including control inputs that affect pitching tendency after touchdown. The program also focused on maintaining proper sink rates, bounce recovery, and low-level go-around techniques. FedEx incorporated the tailstrike awareness training into its MD-11 initial, transition, and recurrent training syllabi. The company also compiled and distributed a four-page “Tail Strike Awareness Information” bulletin (see appendix E) for flight crews to study before simulator training. A 25-minute awareness video was added to FedEx’s recurrent ground school syllabus in August 1997.

Factual Information 38 Aircraft Accident Report The 1996 information bulletin stated that landing tailstrikes had occurred under the following conditions: “Flaps 35 and flaps 50, forward and aft [c.g.], light and heavy gross weight, and over-serviced and correctly serviced struts.” The bulletin also stated that “one consistent factor in every landing tail strike to date [has] been an excessive descent rate with an increasing pitch attitude prior to initial touchdown.” It added that high sink rates can be caused by an unstable approach, late or abrupt align (de-crab) maneuver, or early flare.

The instructor’s guide (see appendix F) for the 1996 Tail Strike Awareness Training program noted that “25 percent of MD-11 tail strikes to date have occurred on takeoff and 75 percent on landing.” The instructor’s guide recommended a 7.5° pitch attitude and thrust to recover from high sink rate and bounce. It added the following: If a bounce occurs, a go-around should be initiated. Low level go-arounds, i.e., less than 20 feet [radio altitude], are dramatically different than higher altitude go- arounds. High altitude go-arounds are initiated with pitch, while low level go- arounds must be initiated with thrust. During low level go-arounds main wheel touchdown may be unavoidable. The PF [pilot flying] must not exceed 10 degrees of pitch or retract the landing gear until passing 20 feet [radio altitude] with a positive rate of climb.

Some tail strikes have occurred as a result of the pilot attempting to arrest a high sink rate or bounce by quickly adding up elevator. This technique immediately increases both the effective weight of the aircraft and the aircraft’s vertical velocity. The resulting increased attitude rate will aggravate the pitching tendency after touchdown and drive the main wheels into the ground, thus compressing the main wheel struts. The aft fuselage will contact the runway at approximately 10 degrees pitch attitude with the struts compressed.

The 1996 instructor’s guide included simulator scenarios designed to demonstrate tailstrike avoidance techniques. The approach and landing simulations included an early flare scenario and a high sink rate and bounce recovery demonstration.

FedEx’s 1996 MD-11 flight manual (section 7-46) noted that autothrottles should be used for landings “and will begin to retard after passing 50 feet agl.” The manual The material in this June 1996 bulletin has since been updated and incorporated in FedEx flight and training manuals. In addition, following this accident, FedEx developed a tailstrike briefing guide for the tailstrike awareness program that incorporated MD-11 landing gear certification data, vertical acceleration information (the effects of acceleration on the weight bearing capability of the MLG), and described the effects of roll and pitch rates on total sink rate. For example, the FedEx bulletin describes the following landing situation: “If the pilot pushes the nose over and unloads the aircraft to .5 g prior to touchdown, the weight bearing capability of the landing gear will be reduced to 6 fps (from the original 10 fps certification).” It added: “One could easily imagine a case where a pilot inadvertently unloads the aircraft to .5 g reducing the weight bearing capability of the [MLG] to 6 fps, and also lowers the upwind wing just prior to touchdown at 6° per second generating another 2 fps of total sink rate at the [MLG], leaving only 4 fps (240 fpm) of capability.” FedEx’s current version of the MD-11 tailstrike awareness training program adds that tailstrikes have also occurred “with full, mid and no spoiler deployment.” The de-crab maneuver is the act of aligning the airplane’s longitudinal axis with the runway before touchdown during a crosswind landing.

Factual Information 39 Aircraft Accident Report stated that pilots should avoid holding the “aircraft off in an attempt to achieve a smooth landing. Holding [the] aircraft off to achieve a smooth landing may result in a long touchdown, unusually heavy braking, a higher pitch attitude and reduced tail clearance.” The manual also noted: Below 10 feet with the aircraft fully flared (sink rate approximately 2-4 [fps]), the basic technique is to maintain attitude by applying the required control wheel pressures. A more advanced technique is to relax the back pressure to lower the nose (approximately 1°) prior to main gear touchdown.

The 1996 MD-11 flight manual also noted that “another contributor to tail strikes during landing is the nose-up pitching force generated by automatic ground spoiler deployment at main gear spin up.” The manual (section 7-118) added: This is quickly noted and pilots are taught to compensate for it during initial and transition training. It then becomes part of the MD-11 pilot’s reflexes. Spoiler pitch-up is still present during every landing, and must be counteracted. If touchdown does occur with higher than normal pitch attitude, the nose should be lowered promptly to prevent spoiler deployment from further increasing the pitch attitude.

FedEx’s revised MD-11 flight manual (section 7-1-6-1, dated June 30, 1998) noted that if the airplane “flares early and the autothrottles are allowed to retard, the airspeed will decay, elevator effectiveness will be reduced, and a higher pitch attitude will be required making pitch-up tendency after touchdown more pronounced and more difficult to counteract.” The manual stated that after countering any pitch-up tendency after main wheel touchdown, the pilot should “fly the nose wheel smoothly to the runway [and] avoid full elevator down input.” The revised manual also called for a 7.5° pitch attitude in bounce recovery and increased thrust “until the sink rate has been arrested and/or a normal landing is accomplished.” In “Know Your MD-11,” a 1993 operator letter, McDonnell Douglas recommended the following procedure for flaring the airplane under normal conditions: Autothrottles will begin to retard after passing 50 feet, and a slight flare should be initiated between 30 and 40 feet (approximately 2 degrees). The aircraft should touch down in the touchdown zone…Do not hold the aircraft off.

As of Revision 28, June 30, 1998, the use of autothrottles is no longer mandatory for FedEx flight crews.

This paragraph was deleted in later revisions of FedEx’s MD-11 flight manual as a result of the accident analysis provided by Boeing.

The June 1995 version of the MD-11 FCOM also stated that pilots should be prepared to counter “any pitch-up tendency as spoilers extend.” The section, “Landing Characteristics and Techniques,” added that after spoiler extension, pilots should “fly [the] nosewheel to [the] runway.” Factual Information 40 Aircraft Accident Report In addition, section 7-1-6-1 of the revised (1998) FedEx MD-11 flight manual described the following procedures for a normal landing: Aim to touch down 1,500 [feet] from the runway threshold. The runway threshold should disappear under the nose at about the same time CAWS announces ‘100 [feet].’ Maintain a stabilized flight path through the 50 and 40 foot CAWS callouts (unless sink rate is high). At 30 [feet] a smooth 2.5-degree flare should be initiated so as to arrive below 10 [feet] in the landing attitude. Do not trim in the flare.

Elevator back pressure should be relaxed, and a constant pitch attitude should be maintained from 10 [feet] radio altitude to touchdown.

Section 7-1-6-2 of the FedEx flight manual stated that crosswind landings are accomplished by flying the final approach in a wings level attitude with a crab into the wind. At approximately 200 [feet] agl, align the fuselage with the runway by smoothly applying rudder and maintain runway centerline by lowering the upwind wing. In high crosswinds, consideration should be given to commencing the align maneuver (de-crab) prior to 200 [feet] agl. The align maneuver shall be established by 100 [feet] agl.” The manual cautions that “excessive sink rates and subsequent tailstrikes have occurred as the result of a late or abrupt align (de-crab) maneuver.

The 1993 “Know Your MD-11” operator letter also recommended the following guidelines on go-around decisions while on approach to landing: Experience has shown that approaches which result in large pitch deviations, and which never achieve true speed and glide path stability are much more likely to produce unpredictable landings; hold-offs, floats, hard touchdowns, strong rebounds and tailstrikes. Such approaches make it nearly impossible to establish a proper crosswind correction, and are especially risky on contaminated or slippery surfaces. A destabilized approach is a compelling reason to initiate an early go- around.

The MD-11 flight crew operating manual (FCOM), “Procedures and Techniques” (30-01, Volume Two, June 1995), states that if an airplane “is not stabilized by 500 feet agl, a missed approach should be executed.” FedEx’s tailstrike awareness program stated that the align maneuver was “commonly referred to as a forward slip.” The term “forward slip” has since been replaced by “slip,” which more accurately describes this maneuver.

Boeing, in its submission to the Safety Board, stated that “operators should stress to their flight crews the importance of executing a go-around any time below approximately 500 agl that a stable approach becomes destabilized. As a general ‘rule of thumb,’ if large power and/or control deflections are required to maintain desired flight path and/or alignment with the runway, then a go-around is warranted.” Factual Information 41 Aircraft Accident Report 1.18.4 MD-11 Hard Landing Accident at Hong Kong International Airport On August 22, 1999, a China Airlines MD-11 crashed during a landing approach to Hong Kong International Airport. Of the 315 passengers and crew aboard, two were fatally injured, one passenger died later at a hospital, and 199 received various injuries.

The aircraft was destroyed by impact and subsequent fire. The weather at the time of the accident included high winds and rain.

According to the Hong Kong Civil Aviation Department, after obtaining visual contact with the runway, the captain disconnected the autopilot but left the autothrottle system engaged. The airplane then continued to track the extended centerline but descended and stabilized slightly low on the glideslope. At around 50 feet above the runway, coincident with the reduction of power to flight idle by the autothrottle system and an increase in pitch attitude, the indicated airspeed reduced from 170 knots to 152 knots immediately before touchdown. Although an attempt was made to flare the airplane in a slightly right-wing-down attitude (less than 4°), the sink rate was maintained and a hard landing occurred. The right main wheels contacted the runway first, followed by the right engine cowling; the right landing gear and wing separated as the aircraft rolled inverted.

The right wing front spar fractured at station (STA) 268 (4 inches outboard from the STA 264 bulkhead that separates the #2 and #3 fuel tanks). This was a vertical fracture that intersected the lower and upper cap. The rear spar fractured at STA 222 at the lower cap. The rear spar fracture progressed diagonally upwards and inward to the upper cap at STA 185.

Preliminary calculations conducted by the Safety Board indicate that the airplane’s rate of descent at impact was 18 to 20 fps. This accident is still under investigation by the Hong Kong Civil Aviation Department.

1.18.5 DC-10 Hard Landing Accident in Faro, Portugal On December 21, 1992, a DC-10-30CF operated as Martinair flight 495 crashed while landing on runway 11 at Faro (Portugal) Airport. There were 340 passengers and crewmembers on board at the time of the crash. Two cabin crewmembers and 54 passengers were killed, and 104 passengers were seriously injured. The Portuguese accident investigation report, prepared by the Director-General of Civil Aviation (DGAC), stated that the right MLG hit the runway in a right-wing down attitude on the left side of the runway. The right MLG collapsed inboard and the “right engine and right wing tip contacted the runway,” the report stated. “The right wing suffered total rupture Director-General of Civil Aviation. 1992. McDonnell Douglas Corporation DC-10-30F, Martinair Holland NV, Final Report on the Accident Occurring at Faro Airport—Portugal, on 21 December 1992, Report no. 22/Accid/GD1/92 . The report was translated from Portuguese into English by the Netherlands Aviation Safety Board.

Factual Information 42 Aircraft Accident Report between the fuselage and the right engine. The aircraft slid along the runway for about 30 meters [98 feet] and gradually moved to the right, supported by the center landing gear.” The DGAC report added the following: After the rupture of the right wing, fire developed and enveloped the fuselage from the right to the left. The right wing followed a trajectory next to the aircraft up to the area [where] it came to rest. The aircraft [departed] the runway at the right-hand side, with a track of about 120 degrees, in an inverted position. When leaving the runway and entering the runway edge…the aircraft rolled left and the left wing bottom side dug into the ground and disintegrated partially, and the fuselage broke into…sections. It came to rest with the rear section in a normal position and the front section on the left side with the windows and doors [contacting] the ground. The fuel flowing from the tanks caused explosions followed by fire, causing the destruction of the rear fuselage up to the rear pressure bulkhead.

The airplane came to rest about 3,609 feet from the runway threshold and about 328 feet to the right of the runway centerline. The DGAC report stated that numerous thunderstorms were reported in the vicinity of the airport and concluded that the airplane had encountered turbulence “associated with microburst and downburst phenomena” on final approach at an altitude of about 750 feet radio altitude. The report stated that the approach then became unstable with a descent rate that varied from 100 fpm to 1,300 fpm.

The report stated that as the airplane crossed the runway threshold, it “encountered a crosswind component of 40 knots, and a tailwind component of 10 knots.” The airplane landed with a 7° crab angle to the right, a 8.79° nose-up pitch angle, a 5.62° left-wing-up roll and 1.95 g vertical acceleration, the report stated.

A postaccident metallurgical examination of the right MLG determined that “the gear parts and the associated mechanisms were, at the time of the accident, without fatigue defects or defects of any other type and had no previous fatigue damage.” The report concluded that the “rupture happened exclusively due to the impact on landing which produced the overload which induced in the components and critical zones instantaneous levels of tension which exceeded the material static limit resistance.” The DGAC determined that the probable causes of the accident were “the high rate of descent in the final phase of the approach and the landing made on the right landing gear, which exceeded the structural limitations of the aircraft, [and] the crosswind, which exceeded the aircraft limits and which occurred in the final phase of the approach and during landing.” In connection with its work on the Newark accident, Boeing calculated that the airplane involved in the Faro accident landed on its right MLG at a vertical speed of A downburst is a strong, concentrated downdraft that creates an outward burst of damaging winds at the surface and is usually associated with convective showers and thunderstorms. A microburst is a downburst that has a maximum horizontal extent of 2.5 miles.

Winds at the time were reported from 220°, gusting to 35 knots.

Factual Information 43 Aircraft Accident Report 17 fps, or 263 percent greater than its energy certification limit. The Boeing submission stated that “because of the difference in potential energies into the respective [right] MLG, the Newark landing, at 13.5 fps, was a more severe test of the landing gear than the Faro accident at 17 fps.” The Boeing submission also stated the following regarding the accident at Faro: [A]t a landing weight of 353,000 [pounds], lift at start of touchdown of approximately 1.1 times the aircraft weight, and descent rate at the aircraft [c.g.]

of approximately 15 fps and roll rate of 6 [degrees per second], the kinetic energy, 1,259,300 ft-lbs, was decreased by potential energy (from increased lift) by approximately 106,000 ft-lbs, for a total energy of approximately 1,153,000 ft-lbs on the [right] MLG. Comparing the Faro accident energy with the DC-10-30’s [right] MLG energy required for certification shows that the energy developed during the Faro accident landing was over 2 and a half times the reserve energy (ultimate) certification requirements for a single [MLG].

Figure 10 shows Boeing’s calculations of the energy imparted to the right MLG in the Faro accident.

Figure 10. Boeing calculations of right MLG energy in the Faro accident.

1.18.6 Lockheed L-1011 Hard Landing Accident in New York On July 30, 1992, a Trans World Airlines (TWA) L-1011 experienced an aborted takeoff shortly after liftoff from John F. Kennedy International Airport, Jamaica, New York, and a subsequent hard landing. The airplane came to rest, upright and on fire, Factual Information 44 Aircraft Accident Report about 290 feet left of the departure end of runway 13R. There were no fatalities, but 10 of the 280 passengers on board were injured during the emergency evacuation that followed.

The Safety Board’s investigation determined that immediately after the airplane lifted off the ground, the stall warning stick shaker activated and the airplane began to descend back to the runway. The captain retarded the throttles and executed a landing on the remaining runway. Although the Board determined that the airplane was “performing properly, had accelerated well above V and could have climbed out successfully, the airplane reached about 16 feet of altitude before descending to the runway.” The Safety Board added the following: The airplane landed hard, and the right wing sustained a fracture of the rear inboard spar because the airplane touched down with a sink rate of about 14 [fps].

The airplane’s gross weight was about 71,000 pounds over the approved maximum landing weight, and the sink rate was well over the certified design limit of 6 [fps] for the structure. The Safety Board concludes that the failure of the right wing inboard rear spar was caused by the severe overload stresses imposed at touchdown.

The FDR data revealed that the airplane was banked right wing low about 1.1° at touchdown, which occurred with the centerline of the airplane just to the left of the center crown of the runway. Therefore, the right [MLG] probably touched down before the left [MLG], and the right wing took the initial violent forces, overloading the structure. The fractures noted in the right wing were consistent with such forces. Further, the forces imposed on the right wing rear spar during rotation for takeoff were calculated to be significantly less than those occurring at touchdown. Therefore, the Safety Board concludes that the fracture of the right wing rear spar occurred upon landing.

In connection with its work on the Newark accident, Boeing calculated that the L-1011’s sink rate of about 14 fps and pretouchdown vertical acceleration of 0.75 g resulted in vertical loads 216 percent greater than certification limits. Boeing’s submission also noted that “the 0.25 g nose-down ‘push-over’ (1.0 g minus 0.75 g at start of accident touchdown) during [this] accident was only half of the 0.50 g nose-down ‘push- over’…during the Newark accident.” Figure 11 shows Boeing’s calculations of the energy imparted to the right MLG in the L-1011 accident.

National Transportation Safety Board. 1993. Aborted Takeoff Shortly After Liftoff, Trans World Airlines Flight 843, Lockheed L-1011, N11002, John F. Kennedy International Airport, Jamaica, New York, July 30, 1992 . Aircraft Accident Report NTSB/AAR-93/04. Washington, D.C.

The stick shaker, or control column shaker, is part of the airplane’s stall warning system. An aerodynamic stall occurs when airflow over the airplane’s wings and tail is sufficiently disrupted to result in loss of lift and control.

V is takeoff safety speed.

Factual Information 45 Aircraft Accident Report Figure 11. Boeing calculations of right MLG energy in the TWA L-1011 accident.

1.18.7 Other Landing Accidents The Safety Board has investigated or participated in the investigation of several accidents in which pilots mishandled the airplanes during the landing phase. For example, in 1993, an American Airlines McDonnell Douglas DC-10 was destroyed during landing at Dallas-Fort Worth International Airport, Dallas, Texas. The Board’s investigation found that although the touchdown was uneventful, the airplane veered off the side of the runway shortly thereafter because the captain held insufficient downward pressure on the control yoke after touchdown and attempted to steer the airplane with the tiller rather than through rudder application.

The Safety Board also assisted with the international investigations of three similar landing accidents involving Boeing 767s: an Asiana Airlines 767-300 in Cheju Island, South Korea, on January 16, 1992; American Airlines flight 957 in São Paulo, Brazil, on October 27, 1992; and LOT flight 002 in Warsaw, Poland, on December 31, 1993. Each accident occurred when the pilots applied large nose-down control column deflections after MLG touchdown, which resulted in large nose-down pitch rates and high vertical velocities at the nose gear. The combination of vertical velocity and pitch rate at nose-gear contact resulted in compression loads that exceeded the design loads of the forward fuselage crown structure.

Although Boeing had published landing techniques in its flight training manual, which were furnished to Boeing 767 operators before these accidents occurred, the National Transportation Safety Board. 1994. Runway Departure Following Landing American Airlines Flight 102 McDonnell Douglas DC-10, N139AA Dallas/Fort Worth International Airport, Texas April 14, 1993 . Aircraft Accident Report NTSB/AAR-94-01. Washington, D.C.

Factual Information 46 Aircraft Accident Report techniques had not been implemented consistently or completely by all operators. The Safety Board also learned from discussions with Boeing representatives that the DC-10 and MD-11 had experienced similar instances of damage after being mishandled during the post-touchdown derotation maneuver. Consequently, on June 16, 1994, the Board issued Safety Recommendations A-94-118 and -119. Safety Recommendation A-94-118 asked the FAA to: Require that all FAA-approved Boeing 757/767 Operating Manuals, and other airplane model Operating Manuals as deemed appropriate, clearly communicate derotation techniques and the potential for excessive pitch rates after touchdown if pilots use large nose-down control column deflections. Such information should be inserted in the sections of the manual that refer to normal and crosswind approach and landing, as a cautionary note. Instructions calling for positive forward control pressure after nose wheel touchdown should be replaced with a warning to smoothly fly the nose wheel to the runway by relaxing aft control column pressure and not to use full down elevator.

In an August 29, 1994, letter, the FAA stated that it had reviewed the FAA- approved Boeing 757/767 Airplane Flight Crew Training Manual and Boeing’s “guidance concerning the potential for excessive pitch rates after touchdown if pilots use large nose- down control column deflections.” The FAA noted that the derotation procedures specified in the Boeing 757/767 Airplane Flight Crew Training Manual were consistent with those outlined in Safety Recommendation A-94-118 and were “similar to the guidance contained in McDonnell Douglas pilot operating manuals.” The FAA also stated that it reviewed other actions by Boeing to “inform Boeing 757/767 pilots of proper derotation procedures,” which included specification of proper landing techniques in the 767 Flight Crew Training Manual, issuance of a technical bulletin on proper flare and landing techniques, onsite reviews of proper derotation techniques with all Boeing customers, and review of the issues at a 1993 flight operations symposium. The FAA stated that it had determined that these actions were “effective and…[were] more extensive in addressing this issue than a cautionary note in the FAA-approved Boeing 757/767 Airplane Flight Manual.” The Safety Board agreed and classified Safety Recommendation A-94-118 “Closed—Acceptable Alternate Action” on August 1, 1995.

Safety Recommendation A-94-119 asked the FAA to: Modify initial and recurrent Boeing 757/767 pilot training programs, and other airplane model pilot training programs as deemed appropriate, to include discussion of derotation accidents.

In response to Safety Recommendation A-94-119, the FAA issued Flight Standards Information Bulletin for Air Transport (FSAT) 95-06, “Derotation Accidents During Landings of B-757/767, DC-10, and MD-11 Aircraft,” to all FAA Flight Standards personnel. The FSAT, which was effective February 12, 1995, and expired February 29, Step five in the published Boeing guidance states that after MLG touchdown, speedbrake deployment, and reverse thrust initiation, the pilot should “smoothly fly the nose wheel onto the runway by relaxing aft control column pressure [and should] not use full down elevator.” Factual Information 47 Aircraft Accident Report 1996, reiterated the main points of the safety recommendation, including the Boeing- recommended derotation technique. Consequently, the Board classified Safety Recommendation A-94-119 “Closed—Acceptable Action.” 1.18.8 Safety Board Recommendations Relating to DC-10 and MD-11 Spoiler Pitch-up Incidents On August 2, 1992, a McDonnell Douglas MD-11, operated by Delta Air Lines, pitched nose-up after landing at Los Angeles International Airport and contacted the runway, damaging the airplane’s aft fuselage. The airplane was later ferried to Atlanta for repairs, where it again pitched nose up after landing. In that incident, the pitching moment was corrected before the tail contacted the runway. As a result of its investigation of this incident, the Safety Board issued Safety Recommendation A-93-57, on June 3, 1993, which asked the FAA to: Require McDonnell Douglas and U.S. operators of the DC-10 and MD-11 airplanes to revise their DC-10 and MD-11 [FCOM]s (or equivalent documents) to include an accurate and complete description of the ground spoiler-induced nose pitch-up tendencies of the airplanes and the specific pilot control techniques that may be required to counter those tendencies during landing.

The FAA agreed with the recommendation, and the manufacturer issued temporary revisions to its MD-11 and DC-10 FCOMs on June 25, 1993, and July 1, 1993, respectively, that described the airplanes’ ground spoiler-induced nose pitch-up tendencies and specific pilot control techniques required to counter those tendencies. The revisions were transmitted to all MD-11 and DC-10 domestic operators and foreign airworthiness authorities. The FAA also issued Flight Standards Information Bulletin 93-36, which directed FAA principal operation inspectors (POI) to ensure that the revised material was incorporated into their assigned operators’ FCOMs. In November 1994, as a result of the FAA’s and manufacturer’s actions, the Safety Board classified Safety Recommendation A-93-57 “Closed—Acceptable Action.” As a result of the same Delta Airlines incident, the Safety Board also issued Safety Recommendation A-93-59, which asked the FAA to: Require McDonnell Douglas to study possible revisions to the DC-10 and MD-11 ground spoiler deployment logic to reduce the possibility of landing tailstrikes.

The revisions should include, but not be limited to, the following general concepts: if the aircraft touches down at a pitch angle close to the tailstrike pitch angle, initial partial ground spoiler deployment should not occur until the pitch angle falls below a specified angle; and nose gear strut compression status should be maintained long enough to ensure that the nose wheel is firmly on the ground, and has not just momentarily touched the ground, before full deployment of the ground spoilers occurs.

The temporary revisions were incorporated into the standard revision cycle for the FCOMs of both aircraft. The applicable standard revisions for the MD-11 and DC-10 FCOMs were dated December 1, 1993, and October 15, 1993, respectively.

Factual Information 48 Aircraft Accident Report In a May 15, 1995, letter, the FAA responded that the “majority of DC-10 tailstrikes occurred early in the service life [of the DC-10 model] when ground spoilers were commanded to the full-up position by main gear spin-up” and that “some of the strikes were the result of poor pilot techniques and may have occurred regardless of the ground spoiler-induced pitch-up tendency.” The FAA added that “McDonnell Douglas in 1975 began offering a kit change notice that changed the logic to have the spoilers deploy only partially to the in-flight spoiler position on main gear wheel spin-up; and then to the full ground spoiler position following nose strut compression. This two-stage logic was incorporated into the basic design of the MD-11 as standard equipment.” The FAA concluded that “as a result of these changes and increased flight crew awareness, the potential for tailstrikes ha[d] been considerably reduced” and that no further action was warranted.

On July 17, 1995, the Safety Board disagreed with the FAA's May 15 response, classifying the recommendation “Open—Unacceptable Response.” In its reply to the FAA, the Board noted that tailstrikes had continued to occur after the 1975 modification to the DC-10 and its implementation on the MD-11. The Board also noted that its review of the manufacturer's incident records showed that there had been five landing tailstrike incidents involving DC-10 and MD-11 airplanes since the August 2, 1992, incident that may have been the result of ground spoiler deployment logic. The Board asked the FAA to explain how its review concluded that ground spoiler deployment logic was not a contributing factor in those incidents. The Board reiterated its belief that “initial spoiler deployment should be inhibited until the nose of the airplane is lowered sufficiently that a tailstrike is unlikely.” In an October 10, 1995, response to the Safety Board, the FAA stated that its review indicated that the referenced tailstrike incidents “were not related solely to early spoiler deployments.” The FAA stated that it received reports from manufacturers daily and that it meets with manufacturers to investigate problems if a significant event or trend is identified, such as those referenced by the Board. The FAA stated that it had concluded that “the incidents were not caused solely by ground spoiler deployment.” The FAA reiterated its conclusion that a revision to the ground spoiler deployment logic was not warranted, adding that such a revision “would adversely affect safety by increasing the airplane's landing roll distance.” In a December 20, 1995, response to the FAA, the Safety Board noted that in three of the five incidents reviewed by the FAA, the spoiler-induced pitching moment likely contributed to the tail drag occurrences. The Board stated that the “spoiler deployment logic change could be implemented without increasing landing distances” because “high pitch attitudes after touchdown are associated with low landing speeds, which may result in shorter landing distances.” The Board added that “timely lowering of the pitch attitude, which is retarded by spoiler deployment, is probably more important for safe stopping than spoiler deployment at high pitch attitudes.” The Board further added that it had been informed by Boeing that “landing distance penalties did not occur when it changed the spoiler logic on the Boeing 757” after the company had several early Boeing 757 ground spoiler logic-related tail drag incidents. The Board noted that Boeing determined that Factual Information 49 Aircraft Accident Report “delaying deployment of outboard spoilers” reduced the nose-up pitching moment. Based on the FAA’s decision not to take further action, Safety Recommendation A-93-59 was classified “Closed—Unacceptable Action.” 1.18.9 MD-11 Flight Control Computer Software Changes In December 1995, the MD-11 FCC-907 software certification introduced a pitch rate damper (PRD) control law to the previously certified LSAS. The -907 PRD utilized inertial reference unit (IRU) pitch rate feedback in the LSAS elevator control laws to counter pitch rate tendencies, thereby increasing the apparent static stability of the aircraft.

According to Boeing, this change was implemented as a product improvement to help minimize MD-11 high-altitude upsets. Because it was decided during FCC-907 development not to affect the MD-11’s low-altitude, low-speed handling qualities, the PRD was designed to phase-in and phase-out on a pressure altitude schedule (15,000 to 20,000 feet).

Boeing has developed an MD-11 FCC software upgrade—FCC-908—that was FAA-certified on May 23, 2000. The upgrade primarily comprises modifications to three subfunctions—PRD, pitch attitude protection (PAP), and positive nose lowering (PNL)— of the LSAS. Boeing refers to these LSAS subfunctions as a low altitude stability enhancement (LASE) package.

Boeing indicates that the LASE package implementation has two design goals.

The first is to employ the existing LSAS to provide deterrence against tailstrikes; Boeing indicates this goal was established in response to the Safety Board’s Safety Recommendation A-93-59. The second goal is to augment the natural aircraft longitudinal handling qualities, via LSAS, in a manner approximating the handling qualities of the existing DC-10. Both objectives are intended to facilitate a common type rating between the MD-11 and the MD-10.

The MD-11 FCC-908 software upgrade will activate the PRD control loop below 15,000-feet pressure altitudes at a reduced gain. Whereas the -907 PRD feature was inactive at low altitudes, the -908 PRD will remain active at 30 percent strength from approximately 17,500 feet down to takeoff/landing field elevation. Because the PRD increases the apparent static stability, longitudinal handling qualities of the MD-11 will be more like those of the DC-10.

The Safety Board investigated some of these upsets, including the April 6, 1993, China Eastern MD-11 accident at Shemya, Alaska, and the December 7, 1992, China Air accident at Anchorage, Alaska.

According to information provided by Boeing, the MD-10 is a modification of the DC-10 model that was customized for FedEx. Like the MD-11, the MD-10 design incorporates a two-person flight crew complement with associated changes to flight deck displays and system controls. The basic fuselage, wing, control surface, flight control, and engine designs were not changed from those of the DC-10. On May 9, 2000, the FAA granted Boeing an amended type certificate for the MD-10 freighter. The FAA also approved a common pilot type rating and landing proficiency credit for the MD-10 and -11, provided that the MD-11 incorporates FCC-908 to render its handling similar to that of the DC-10/MD-10.

Factual Information 50 Aircraft Accident Report The PAP subfunction is being added to LSAS to mimic the tailstrike protection that the MD-11 autopilot already provides for coupled landing and go-around operations.

The PAP subfunction is armed whenever an aircraft’s radio altimeter registers below 100 feet agl. The PAP uses radio altitude in conjunction with IRU pitch angle and pitch attitude rate to provide nose-down elevator commands as a pilot begins to approach or exceed the prescribed PAP pitch limit (30° pitch at 41 feet agl and 9.5° pitch at 0 feet agl).

This enhancement will slightly increase the control column force required to pitch the aircraft beyond the prescribed limits, but the pilot otherwise retains full pitch-control authority. As with all LSAS functions, the elevator command authority is mechanically limited to 5° of deflection within the elevator electro-hydraulic actuator.

Boeing indicates that the PNL subfunction is intended to address both design goals for the LASE package. The PNL subfunction provides a two-stage, nose-down elevator command as the main wheels spinup for landing, which counters the nose-up tendency typically experienced when landing ground spoilers are deployed. The PNL subfunction is armed when aircraft radio altitude registers below 100 feet agl. The FCC signals, which are used to command the auto ground spoilers to deploy, will cause the PNL subfunction to command the first stage of the nose-down elevator of 3°. When the ground spoilers are detected to be in excess of 10° of displacement, the second stage of the PNL increases the nose-down command to 4°. Because the closed-loop PRD acts in conjunction with the PNL, the nose derotation characteristics are essentially independent of the aircraft c.g. The PNL commands are removed from the LSAS outputs at the same time that the flight mode annunciator returns to the TAKEOFF mode (that is, after the nose wheel has been on the ground for at least 20 seconds).

Analysis 51 Aircraft Accident Report

2. Analysis

2.1 General

The two flight crewmembers were properly certificated and qualified in accordance with applicable Federal regulations and company requirements. Crew duty time, flight time, rest time, and off-duty activity patterns did not indicate that medical, behavioral, or physiological factors affected the flight crew’s performance on the day of the accident.

The airplane was properly certificated, equipped, and maintained in accordance with Federal regulations and approved procedures, and the airplane’s departure from ANC with the No. 1 engine thrust reverser inoperative was in accordance with approved minimum equipment list procedures (the failure of the left landing light is discussed in section 2.2.2.8). Cargo was loaded in accordance with FedEx’s FAA-approved weight and balance requirements.

Although the airplane had experienced damage to its forward and rear fuselage sections during two prior hard landings in 1994, the damage was assessed and repaired in accordance with approved regulations and procedures. Detailed inspections performed after each of the two prior hard landings and during subsequent periodic maintenance did not reveal any evidence of damage to the MLG, gear attach points, or wing structure.

Safety Board metallurgical staff also examined the fracture surfaces of the right MLG and right wing structure at the scene of the accident before its removal and found no evidence of preexisting structural damage or fatigue cracking. Further, the energy transmitted into the right MLG during the Newark accident landing was more than Boeing estimated to have been required to break the wing of a new, undamaged MD-11 (see section 2.5.1).

Thus, the Safety Board concludes that there was no preexisting damage or degradation to the airplane structure, systems, or components that contributed to this accident.

The response and actions by ARFF and area firefighting personnel were timely and adequate, despite a lack of timely information about the nature and quantity of hazardous materials on board.

Clear night visual meteorological conditions with light winds prevailed at the time of the accident; weather was not a factor in the accident.

This analysis examines airplane and flight crew performance and design and certification requirements for the performance of transport-category airplanes during the landing phase. The analysis concludes with an examination of problems encountered during the emergency response relating to the timely dissemination of hazardous materials cargo information.

52 Aircraft Accident Report

2.2 Accident Scenario

2.2.1 Airplane Performance During the Approach and Landing During the approach, the airplane was configured for landing, with flaps set at 50°.

The captain disconnected the autopilot as the airplane descended through 1,200 feet, and the autothrottles remained engaged. According to flight crew statements and FDR data, the airplane maintained the approach speed of about 158 knots (consistent with the target approach speed specified by FedEx, V +5 knots or 157 knots), at a stable 800 fpm ref descent rate, and on the ILS localizer and glideslope for runway 22R until the landing flare. The average pitch attitude of 3° ANU was consistent with MD-11 flight manual data for descending on the ILS glideslope’s 3° flightpath angle, given the airplane’s weight, c.g., and flaps-50 configuration. The captain and the first officer also stated that the approach was routine until just before touchdown. Thus, on the basis of flight crew statements and airplane performance data, the Safety Board concludes that the airplane’s approach before the landing flare was stabilized.

FDR data indicated that control inputs consistent with the start of flare occurred at about 37 feet radio altitude. Engine thrust was also decreasing about this time. About 1.5 seconds after the start of the flare and 2 seconds before the first of two touchdowns, pitch attitude peaked at 5° nose up. The radio altitude was 17 feet. This portion of the flare maneuver was consistent with FedEx MD-11 flight manual guidance, which called for a “smooth 2.5 degree flare” to be initiated between 30 and 40 feet radio altitude. Thus, the Safety Board concludes that the captain’s execution of the beginning of the flare maneuver was normal and not a factor in the accident.

As pitch attitude peaked about 2 seconds before the first touchdown, the elevator started deflecting from about 12° nose up to near 0°, and the airplane’s pitch attitude began decreasing slightly in response to the nose-down elevator input. Further, about 1 second before ground contact, elevator deflection reversed to a nose-up elevator deflection of 26° (from about neutral elevator to about 70 percent of maximum nose-up elevator), and TRAs increased from about 40° to 70° (from near flight idle to near takeoff thrust). A small right-wing-down aileron input (4° to 5°) followed. The nose-up, throttle- up, and right-wing-down control inputs were initiated as the airplane was descending through 7 feet radio altitude. Pitch attitude and vertical acceleration had just begun to respond when the airplane contacted the ground in the first of two touchdowns. Vertical speed at the first touchdown was about 7.6 fps, and vertical acceleration peaked at 1.67 g. The nose-up elevator and throttle inputs also peaked about the time of the first touchdown.

With the MD-11 autothrottle system engaged and flaps extended to greater than 31.5°, the throttles are automatically driven to the idle stop when the radio altitude decreases through 50 feet.

This value is the vertical speed at the right MLG and includes 6.6 fps vertical speed at the c.g. plus 1.0 fps vertical speed at the right MLG because of nose-up pitch rate and right-wing-down roll rate.

Analysis 53 Aircraft Accident Report Within 1/2 second after the first touchdown, the captain initiated a rapid nose- down elevator input. The total elevator travel was about 40° (changing from about 70 percent of maximum nose-up elevator to about 67 percent of maximum nose-down elevator in less than 1 second). Despite the initiation of the large and rapid nose-down elevator input, the airplane began to lift off the runway as a result of landing gear strut and tire compression loads and the still-increasing pitch attitude, thrust, and airspeed. In addition, wing lift was not degraded upon touchdown because the spoilers did not deploy.

After the initial touchdown, the airplane was airborne for about 2 seconds.

During the first second, while airborne, the elevator remained about 67 percent nose down. In the next second, a large and rapid nose-up elevator input occurred (from 67 percent nose-down to 60 percent nose up), accompanied by nose left rudder and right-wing-down aileron inputs.

About 3/4 second before the second touchdown, as the airplane was peaking at a height of 5 feet agl, lift had decreased to about 0.6 g. The pitch attitude was about 2° nose- up and decreasing rapidly. The elevator was about 15° nose-down, although it was moving rapidly toward a nose-up position. Given the nose-down elevator position at that point in the bounce, there were probably no additional crew actions that could have been taken to prevent a hard impact with the runway.

The airplane touched down for the second time as vertical acceleration was decreasing through 0.5 g. The second touchdown occurred at a roll angle of 9.5° right wing down, a roll rate of approximately 7° per second right wing down, and a pitch attitude of minus 0.7°. Peak vertical speed at the right MLG was approximately 13.5 fps.

The right wing failed at impact (see section 2.5.1 for a discussion of this failure).

The captain’s actions during the 5 seconds preceding the second touchdown established the conditions that led to the right wing failure. When the captain rapidly moved the elevators to near neutral instead of maintaining nose-up elevator and continuing the flare (2 seconds before first touchdown), he destabilized the flare and established a greater sink rate. The large nose-up elevator and thrust inputs that the captain made with only 1 second remaining before touchdown were his reaction to the sink rate and an attempt to prevent a hard landing. From that moment on, evidence indicates that all of the captain’s control inputs were too late and too large to achieve the desired effect. He made a large nose-down elevator input, consistent with an effort to keep the airplane on the runway and ensure an early touchdown of the nose gear with maximum available stopping distance. Although he began these nose-down inputs at about the time of the first touchdown, the airplane had bounced back into the air by the time he had pushed almost all the way forward on the control column. This large nose-down input, in turn, established a very high sink rate and low g load at the time of the second touchdown. The The time interval between the first touchdown and the second was about 3 seconds. During those 3 seconds, the airplane was on the ground with the struts stroking and tires compressing for about 1 second and was airborne for about 2 seconds.

The Safety Board could not determine why the captain commanded right-wing-down aileron and left rudder deflection before the second touchdown.

Analysis 54 Aircraft Accident Report captain’s final, large nose-up inputs were made too late to soften the impact. The airplane touched down with enough energy and at a sufficiently high roll angle to bottom the right MLG strut and break the right wing.

All available data indicate that the airplane’s aerodynamic performance and flight control functionality were normal until after the second touchdown. Thus, the Safety Board concludes that the accident airplane performed normally in response to the captain's flight control inputs until after the second touchdown.

The captain’s large and rapid elevator control reversals, which resulted in an increasing divergence above and below the target pitch attitude, were consistent with a “classic” pilot-induced oscillation (PIO). Essentially, the captain made each increasingly larger elevator input in an attempt to compensate for the input he had made in the opposite direction about 1 second earlier. PIO in the pitch axis can occur when pilots make large, rapid control inputs in an attempt to quickly achieve desired pitch attitude changes. The airplane reacts to each large pitch control input, but by the time the pilot recognizes this and removes the input, it is too late to avoid an overshoot of the pilot’s pitch target. This, in turn, signals the pilot to reverse and enlarge the control input, and a PIO with increasing divergence may result.

Additional key elements in the onset of PIO are derived from the interaction between the pilot and the flight environment. Researchers have described the following: “...many of the reported [PIO] events have taken place during air-to-air refueling operations or approaches and landings, especially if the pilot is concerned about low fuel, adverse weather, emergencies, or other circumstances. Under these conditions, the pilot’s involvement in closed-loop control is intense, and rapid response and precise performance…are necessary. Even so, these operations usually occur routinely without [PIO] problems. [PIO] events do not occur unless there is a transient triggering event that interrupts the already highly demanding…operations or requires an even higher level of precision. Typical triggers include shifts in the dynamics of the effective aircraft (the combination of the aircraft and the [flight control system]) caused by increases in the amplitude of pilot commands, [flight control system] changes, minor mechanical malfunctions, or severe atmospheric disturbances. Other triggers can stem from mismatches between pilot’s expectations and reality.

The environmental cues and concerns that may have served as triggering events in this accident, motivating or influencing the captain’s control inputs and decisions, are further analyzed in the following section.

National Research Council. 1997. Aviation Safety and Pilot Control: Understanding and Preventing Unfavorable Pilot-Vehicle Interactions , p. 3.

Analysis 55 Aircraft Accident Report 2.2.2 Flight Crew Factors During the Approach and Landing During the approach briefing, the first officer and the captain discussed the stopping distance available on runway 22R for the airplane’s weight and landing configuration. During that discussion, they expressed concerns about the approximate landing distance and the length of the runway, which they had derived from the APLC (see section 2.2.2.7 for a discussion of the flight crew’s misinterpretation of the data presented in the APLC). Additionally, during the approach, the flight crew indicated that they were aware of the inoperative No. 1 engine thrust reverser, which would have resulted in a slight reduction in deceleration capability after landing. The flight crew was also aware of three recent events recorded in the airplane’s maintenance log in which the airplane’s autobrakes had failed to arm at takeoff or failed to work at landing. Although maintenance personnel had checked the system after each reported failure and determined it was functioning properly, the captain told Safety Board investigators that he discussed the reliability of the autobrake system with the first officer before takeoff from ANC. The captain told investigators that the autobrakes remained armed during the departure from ANC. However, he kept the autobrake problem in mind when planning for the landing at EWR, adding that he planned to land the airplane at the start of the runway and wanted to ensure that the airplane would not float during the landing flare.

Thus, on the basis of the flight crew’s comments during the approach about the relatively short runway length, the inoperative thrust reverser, the questionable reliability of the autobrake system, and the perceived need to land at the beginning of the runway, the Safety Board concludes that the captain was concerned about the airplane’s touchdown location on runway 22R and intended to take measures during the landing to achieve an early touchdown and minimize the length of the rollout on the runway after touchdown.

2.2.2.1 Nose-Down Elevator Input at 0132:16 (2 seconds before first touchdown) The Safety Board examined the captain’s 12° nose-down elevator input at 17 feet radio altitude to determine if it was consistent with FedEx guidance for landing the MD-11. The Board’s review of FedEx’s MD-11 landing guidance found only one technique that promotes the use of nose-down elevator between the initiation of flare and touchdown. Specifically, the FedEx MD-11 “advanced technique” for landing recommends that “elevator back pressure…be relaxed” about 10 feet before touchdown (to achieve a 1° decrease in pitch attitude). However, the captain’s nose-down elevator input, which moved the elevator from 12° nose-up to about the neutral position, was very rapid and much greater than is required for the maneuver. Further, the captain began his nose-down input about 1 second before the airplane reached 10 feet radio altitude, the aural annunciation of which should have served as the cue for such a pitch reduction if it Although the flight crew may have been concerned about the reduction in deceleration capability, the inoperative thrust reverser did not increase the runway length requirement for the accident landing above that shown in the APLC because the deceleration effects of the thrust reversers are not used in calculating the distances required for landing.

Analysis 56 Aircraft Accident Report had been related to the FedEx “advanced” landing technique. Thus, the Safety Board concludes that the captain’s nose-down elevator input beginning at 17 feet radio altitude was not consistent with FedEx guidance for landing the MD-11. Further, the Safety Board concludes that the captain’s nose-down elevator input at 17 feet radio altitude (2 seconds before the first touchdown) was consistent with an attempt to control the point of touchdown given his concerns about the runway length.

2.2.2.2 Nose-up Elevator Input at 0132:17 (1 second before first touchdown) The captain and the first officer told Safety Board investigators that they felt the airplane’s sink rate increase shortly before the airplane touched down. They stated that these were “seat of the pants” feelings and were not based on observed indications on cockpit instruments. FDR data indicated that after the captain made the nose-down elevator input at 17 feet radio altitude, a small increase in sink rate and decrease in vertical acceleration occurred. The decreased vertical acceleration and increased nose-down pitch rate could have led to sensations of sink consistent with the pilots’ descriptions.

With just more than 1 second remaining before touchdown, the captain had the following options: accept the sink rate and subsequent hard landing, attempt to salvage the landing with last-second thrust and pitch adjustments, or execute a go-around. FDR data and postaccident interviews show that the captain chose to try to salvage the landing with last-second thrust and pitch adjustments. Thus, the Safety Board concludes that the captain made a nearly full nose-up elevator input and a large throttle increase to compensate for the increased sink rate caused by his previous nose-down input.

The FedEx MD-11 flight manual recommends that a “constant pitch attitude be maintained from 10 feet radio altitude until touchdown.” However, this guidance presupposes a stabilized approach and flare leading up to 10 feet radio altitude. In contrast, because the captain had destabilized the flare 1 second earlier, he perceived a need to arrest the resulting sink rate with additional thrust and nose-up pitch.

FedEx’s high sink rate and bounce recovery training recommends establishing a 7.5° pitch attitude and “arresting the sink rate with thrust” as a prelude to either landing with a high sink rate, re-landing the airplane after a bounce, or executing a low-level go- around. However, FedEx’s MD-11 tailstrike awareness training also cautioned that “quickly adding up elevator” near the ground should be avoided because it can result in increased nose-up pitch rate at touchdown, increased downward vertical speed at the MLG, a hard landing, and tailstrike. To gain a better understanding of this training and its relevance to the captain’s actions, Safety Board investigators participated in FedEx classroom and simulator training for high sink rate and bounce recovery, as well as for tailstrike avoidance. This experience demonstrated to investigators that the timing and large magnitude of the captain’s nose-up elevator input just before the first touchdown were inconsistent with FedEx’s MD-11 high sink rate recovery and tailstrike awareness training.

Analysis 57 Aircraft Accident Report 2.2.2.3 Nose-Down Elevator Input Shortly After the First Touchdown The captain’s large, nose-down elevator input began within 1/2 second of the first touchdown. Based on the sequence and timing of the events, this nose-down elevator input was the captain’s response to the airplane’s rapid nose-up pitching motion, which began in the second before touchdown as a result of the captain’s immediately preceding large nose- up elevator input, and/or his attempt to rapidly land the nosewheel and begin braking immediately after touchdown. After the airplane touched down hard and bounced, the captain continued his nose-down input while the airplane continued to pitch up.

A large nose-up pitch rate and high pitch attitude at touchdown would have introduced several factors that may have contributed to the captain’s subsequent large nose-down elevator input. First, MD-11 pilots are taught in training that nose-up pitch rate and high pitch attitude at touchdown are factors that lead to tailstrike. This consideration may have caused the captain to believe he should apply additional nose-down elevator to the amount that he normally applies after touchdown to counter the MD-11’s characteristic nose-up pitching moment following ground spoiler deployment. Second, as demonstrated by his statements on the CVR and during postaccident interviews, the captain would have continued to be concerned about the available runway length; the rapidly increasing pitch attitude just before and during the first touchdown would have increased the probability of a floating flare, which, in turn, would have decreased the amount of runway available to bring the airplane to a stop. Therefore, the Safety Board concludes that the captain’s full nose-down elevator control input at the time of the first touchdown was consistent with his continued concerns to avoid a long landing and his desire to avoid a tailstrike.

2.2.2.4 Summary of the Captain’s Elevator Control Inputs Considering the captain’s three significant elevator control inputs in sequence, it is apparent that after the first destabilization of the landing flare (from the captain’s nose- down input at 17 feet agl), each of the succeeding nose-up/nose-down elevator inputs resulted from the captain’s attempt to correct for the immediately preceding control input.

His perception of a short runway and the need to constrain the pitch attitude within a very limited range (to avoid a tailstrike) would have motivated the captain to rapidly return the airplane to a stable attitude. He attempted to accomplish this goal with the quick application of large elevator inputs; however, this succession of elevator inputs and pitch oscillations rendered the landing attempt increasingly unstable.

Throughout the sequence of increasingly extreme nose-down and nose-up elevator inputs, which were consistent with a “classic” PIO (as described in section 2.2.1), the captain continued to attempt to salvage the landing; however, a go-around executed by the captain at any time through the touchdown and bounce would have prevented the accident.

MD-11 pilots are taught and the MD-11 FCOM advises that ground spoiler deployment at touchdown creates a nose-up pitching moment that must be counteracted with pilot-induced nose-down elevator inputs.

This technique is referred to in the MD-11 FCOM and operator training as “flying the nose to the runway.” Analysis 58 Aircraft Accident Report Therefore, the Safety Board concludes that the captain’s overcontrol of the elevator during the landing and his failure to execute a go-around from a destabilized flare were causal to the accident.

Further, the Safety Board’s examination of the training that FedEx provided its pilots in landing the MD-11 showed that its training was consistent with and, in some respects, exceeded that provided by many other major airlines. On the basis of comparing the captain’s control inputs with FedEx’s procedures and training for landing the MD-11, the Safety Board concludes that the captain’s control inputs during the flare and bounce were not consistent with landing procedures and techniques outlined in the FedEx MD-11 pilot training procedures, McDonnell Douglas FCOM, or with FedEx’s MD-11 tailstrike awareness and high sink rate and bounce recovery training.

2.2.2.5 The Captain’s Training History The Safety Board attempted to determine if a factor in the captain’s training history could explain his actions in attempting to control the airplane during the landing and thereafter. The Board notes that the captain received an unsatisfactory evaluation on an upgrade proficiency checkride on October 29, 1996. However, the Board obtained no other evidence that could reflect negatively on the captain’s skills. Other than the October 1996 checkride, there was no history of unsatisfactory performance or of disciplinary action in his career at FedEx. There was also no record of accident, incident, or enforcement action in his FAA records. In addition, in the 10 months after the failed checkride, the captain satisfactorily completed a proficiency check and two line checks (the last line check was 20 days before the accident). Thus, the Safety Board concludes that the captain had no previously documented skill deficiencies that contributed to this accident.

2.2.2.6 Enhanced Pilot Training The captain’s failure to properly respond to a destabilized flare and his excessive overcontrol of the airplane, as well as the accumulated evidence from previous air transport landing accidents (see sections 1.18.4 through 1.18.7), indicate that action may be warranted to improve the quality of air carrier training and guidance to pilots in performing safe landings. The circumstances of this and other accidents suggest that, although accidents before or shortly after touchdown are rare, the risk of a future catastrophic accident could be reduced if air carrier pilot training programs devote additional attention to safety issues related to landings. It is particularly important to instill in pilots the orientation to perform a go-around in the event of an unstabilized approach or destabilized landing flare.

Shortly after the Safety Board conducted a special investigation of rejected takeoff accidents in 1990, a joint government-industry task force was formed to study the issue and develop a flight crew training aid. This training aid has led to a reduction in the National Transportation Safety Board. 1990. Runway Overruns Following High Speed Rejected Takeoffs. Special Investigation Report NTSB/SIR-90-02. Washington, D.C.

Analysis 59 Aircraft Accident Report incidence of rejected takeoff accidents and incidents. The Board notes that other government-industry efforts have produced valuable training tools to avoid and recover from inadvertent encounters with wake vortices, windshear, controlled flight into terrain events, and aircraft upsets.

The Safety Board’s review of accidents involving pilots’ control handling in the landing phase of flight, including this accident, indicates that a similar training tool development effort should be made for landings. This tool should devote specific attention to proper high sink rate recovery techniques during the landing flare, risks associated with PIOs during the landing, and the hazards associated with overcontrol and premature derotation during a bounced landing.

In 1995, responding to a safety recommendation issued by the Safety Board as a result of its investigation of three Boeing 767 landing accidents as well as incidents involving DC-10s and MD-11s, the FAA issued FSAT 95-06. This document required FAA POIs to ensure that pilot training programs for the Boeing 757/767, DC-10, and MD-11 include a discussion about derotation accidents. Unfortunately, FSAT 95-06 expired in 1996.

Further, in its submission to the Safety Board on the Newark accident, Boeing advocated expanding traditional approach go-around guidance to instruct that missed approaches be made if the airplane is not stabilized by 500 feet or if approaches involve “large pitch deviations.” The Board concurs with this suggestion and notes that air carrier pilots’ adoption and use of a proactive go-around philosophy would be a desirable goal for a training tool development effort on this issue.

Following this accident, FedEx added instructional material and guidance on landing gear and wing structural certification to its tailstrike awareness training program.

This guidance detailed the effects of vertical acceleration on the MLG and wings and explained the effects of roll and pitch rate on total sink rate. The FedEx training information describes in detail the aerodynamic effects of large nose-down elevator inputs that result in reduced-g touchdowns, which increase the loads that must be absorbed by the MLG.

The Safety Board notes that one of the new FedEx training modules closely describes the acceleration, pitch, and roll factors found in the Newark accident scenario.

However, based on discussions with pilots who have flown with several air carriers, the Board is concerned that this information may be lacking in other operators’ training programs and that this lack of landing guidance could contribute to similar landing accidents. Thus, based on its review of air carrier landing accidents, the Safety Board concludes that air carrier pilots’ performance would be improved by additional guidance and training in landing techniques.

A review of the Safety Board’s database of U.S. accidents revealed no fatal overrun events since 1990.

Analysis 60 Aircraft Accident Report Therefore, the Safety Board believes that the FAA should convene a joint government-industry task force composed, at a minimum, of representatives of manufacturers, operators, pilot labor organizations, and the FAA to develop, within 1 year, a pilot training tool to do the following: a. Include information about factors that can contribute to structural failures involving the landing gear, wings, and fuselage, such as design sink rate limits; roll angle limits; control inputs’ roll rate; pitch rate; single-gear landings; the effect of decreased lift; and structural loading consequences of bottoming landing gear struts and tires; b. Provide a syllabus for simulator training on the execution of stabilized approaches to the landing flare, the identification of unstabilized landing flares, and recovery from these situations, including proper high sink rate recovery techniques during flare to landing, techniques for avoiding and recovering from overcontrol in pitch before touchdown, and techniques for avoiding overcontrol and premature derotation during a bounced landing; and c. Promote an orientation toward a proactive go-around.

2.2.2.7 Landing Distance Calculation Errors During its investigation, the Safety Board determined that the flight crew misinterpreted the APLC stopping distance data for MED autobrakes by incorrectly comparing APLC runway data with the landing distance provided on the approach plate for runway 22R. Although there was sufficient stopping distance for a MED autobrake setting, the misinterpretation of the APLC data, among other factors, led the captain to believe that stopping distance would be an issue in the landing. Thus, the Safety Board concludes that the flight crew’s calculation error in determining the runway length required for landing influenced the captain’s subsequent actions during final approach and landing by creating a sense of urgency to touch down early and initiate MAX braking immediately.

The Safety Board is concerned that two pilots with significant APLC experience at FedEx failed to properly interpret the calculated landing distances and that other experienced flight crews may also be deficient in their operational knowledge of how APLC systems function. The Board notes that following the accident, FedEx expanded the APLC pilot training presentation for all initial and upgrade training and also added it to recurrent flight crew training programs. The Board has learned that several operators have either adopted systems similar to FedEx’s APLC system or are considering doing so and that other electronic performance calculators are in use at other operators. Thus, the Safety Board concludes that some flight crewmembers may lack proficiency in the operation of APLCs, or similar airplane performance computing devices, and that confusion about calculated landing distances may result in potentially hazardous miscalculations of available runway distances after touchdown. Therefore, the Safety Board believes that the Instead of the miscalculated 780-foot margin result that influenced his decision to set MAX autobrakes, there was actually a 1,680-foot margin.

Analysis 61 Aircraft Accident Report FAA should require POIs assigned to Part 121 carriers that use auxiliary performance computers to review and ensure the adequacy of training and procedures regarding the use of this equipment and the interpretation of the data generated, including landing distance data.

2.2.2.8 Left Landing Light The Safety Board considered whether the absence of the left landing light affected the captain’s ability to land the airplane. The ability to land an airplane from the initiation of flare to touchdown requires that the pilot rapidly detect and assess the airplane’s attitude, altitude, sink rate, velocity, and alignment with the runway. Cues used to accomplish this task include the relative size of objects, relative movement between objects, and variations in angles of convergence around the runway environment. Texture cues in the environment help pilots estimate altitude and velocity. Because of the absence of texture cues at night, estimating height may be difficult. Landing lights can increase the texture or detail available in the runway environment by illuminating the runway surface and tire marks on the runway and casting shadows in the periphery.

Runway 22R’s edge lighting would have provided cues for altitude and sink rate from which the captain could extract the angular information needed to support the landing. In addition, the edge lighting system would have provided a fixed ground reference from which the captain could have gauged his drift and alignment with the runway. Runway 22R’s three-bar VASI system would have helped the captain maintain a stabilized approach as he transitioned from the electronic glideslope to the visual glidepath. The weather during the landing was clear, and there were no obstructions to visibility that would have degraded the appearance of these lighting systems.

Although the left landing light was inoperative, the airplane had other external lights available during the landing, including the right landing light, turnoff lights, and taxi and landing lights on the nose gear. Therefore, the area normally covered by the left landing light would have been darker than normal but not without illumination because of the overlapping areas of illumination from the other lights. Moreover, the captain was aware well before landing that the landing light was inoperative and told Safety Board investigators that the inoperative left landing light did not significantly affect his ability to detect sink rate and land the airplane. The captain also told investigators that the view out the windscreen was normal and that he had landed before with a landing light inoperative.

Thus, the Safety Board concludes that the inoperative left landing light did not impede the captain’s ability to land the airplane.

Turnoff lights are located at the wing root and are turned on below 18,000 feet according to FedEx procedures.

Analysis 62 Aircraft Accident Report

2.3 MD-11 Handling Characteristics and

Flight Control System Design

2.3.1 MD-11 Nose-Up Pitching Moment Because of Ground Spoiler Deployment The MD-11’s known tendency to pitch up after ground spoiler deployment and the captain’s reference to it during interviews prompted the Safety Board to evaluate the role of the pitch-up tendency in the accident sequence. The captain told Board investigators that he was expecting the nose-up pitching moment associated with initial spoiler deployment at MLG spin-up. He stated that he remembered compensating with forward control column input and that he thought the spoilers had deployed at touchdown.

Although a portion of the captain’s nose-down elevator input at the time of the first touchdown may have been in response to the pitch-up tendency, the input greatly exceeded that required to control this tendency. Therefore, the Safety Board concludes that the MD-11's tendency to pitch up at ground spoiler deployment did not contribute to the accident. Nevertheless, a reduction or elimination of the pitch-up tendency would simplify MD-11 landing techniques and may help prevent future MD-11 landing incidents and accidents.

2.3.2 MD-11 Pitch Handling Characteristics and the FCC-908 Software Upgrade The FCC-908 software package developed by Boeing will alter the handling of the airplane during landings by decreasing the pitch sensitivity through action of the PRD.

The decrease in pitch sensitivity combined with additional handling improvements included in the FCC-908 upgrade should render the airplane less susceptible to overcontrol in pitch similar to that involved in this accident. Boeing’s stated goal in implementing FCC-908 is to match the handling characteristics of the MD-11 to those of the existing DC-10 and the DC-10’s newly developed two-pilot adaptation, the MD-10, thereby facilitating FAA approval of a common type rating for the MD-10 and MD-11.

The DC-10 and MD-10 do not have the pitch sensitivity that, until implementation of the FCC-908 software upgrade, has been characteristic of the MD-11.

Further, the MD-11 FCC-908 software upgrade may help prevent tailstrikes by providing PAP and eliminating the MD-11’s nose-up pitching tendency at touchdown through the positive nose-lowering feature of FCC-908. The Safety Board notes that changing the FCC software to eliminate the nose-up pitching tendency may be an acceptable alternate approach to changing MD-11 spoiler logic as recommended in Safety Recommendation A-93-59.

The Safety Board concludes that the handling changes incorporated in the MD-11 FCC-908 software upgrade will provide valuable improvements in safety during MD-11 landings. Therefore, the Safety Board believes that the FAA should require the Analysis 63 Aircraft Accident Report installation, within 1 year, of the MD-11 FCC-908 software upgrade on all MD-11 airplanes.

2.3.3 Digital Flight Data Recorder Update Required by FCC-908 The Safety Board notes that for an MD-11 equipped with the FCC-908 software package, the LSAS will apply elevator control inputs simultaneous with those of the pilots. The Safety Board concludes that with the information that is currently available from the FDR, it may be impossible to distinguish the control inputs of the MD-11 FCC-908 LSAS from the pilots’ control inputs. As a result of discussions with Board staff on this subject, Boeing advised the Board that it plans to issue a service bulletin and digital flight data acquisition unit upgrade kit to add some LSAS-associated parameters to the digital flight data recorder (DFDR) data stream.

The Safety Board notes that a requirement for additional FDR parameters is supported by 14 CFR 25.1459(e), which states, “Any novel or unique design or operational characteristic of the aircraft shall be evaluated to determine if any dedicated parameters must be recorded on flight recorders in addition to or in place of existing requirements.” Therefore, the Safety Board believes that the FAA should require, on all MD-11s equipped with the FCC-908 software, the retrofit of DFDR systems with all additional parameters required to precisely identify and differentiate between pilot and LSAS elevator control activity, including control column force, IRU pitch rate, LSAS command signals, elevator positions, and automatic ground spoiler (AGS) command signals.

2.3.4 MD-11 Ground Spoiler Knockdown Feature The Safety Board also evaluated the role of the MD-11 ground spoiler knockdown feature in the accident sequence. MD-11 and DC-10 ground spoilers will not deploy if the No. 2 TRA is greater than 44° to 49°, or just above flight idle. This logic is intended to prevent spoiler deployment or retract spoilers during go-arounds. Go-arounds are characterized by large thrust increases near or above takeoff thrust. The Board is concerned that the MD-11’s TRA threshold may be too low to allow for power applications to accommodate moderate sink rate and airspeed control techniques near the ground without disarming the AGS system.

Examination of the accident data shows that TRAs rapidly increased from near idle to about 75° (near takeoff thrust) just before touchdown, which prevented ground spoiler deployment at touchdown and contributed to the bounce. The Safety Board does not consider this large and rapid TRA increase to be consistent with a moderate attempt to control sink rate or airspeed and believes that even a modified DC-10 or MD-11 knockdown feature would likely have prevented spoiler deployment given such a large TRA increase. Further, DC-10 and MD-11 training and procedures require pilots to manually deploy ground spoilers if they do not automatically deploy. Therefore, the Safety Analysis 64 Aircraft Accident Report Board concludes that the MD-11’s TRA-driven spoiler knockdown feature did not contribute to this accident.

Nevertheless, the Safety Board notes that it is possible to modify the existing DC-10 and MD-11 spoiler deployment system to allow greater throttle movement before the spoiler knockdown feature is activated. Delaying the knockdown feature would allow pilots to make larger thrust increases just before landing without preventing ground spoiler deployment at touchdown, which may help prevent or minimize some bounces. In the event of a go-around, the higher knockdown angle would slightly delay the retraction of ground spoilers; therefore, a study to determine an optimum angle for activation of the knockdown feature would be necessary. Therefore, the Safety Board believes that the FAA should review and, if appropriate, revise the DC-10 and MD-11 TRA-driven ground spoiler knockdown feature to ensure that it does not prevent ground spoiler deployment at moderate TRAs that could be associated with sink rate and airspeed corrections during the landing phase. Further, the Safety Board believes that the FAA should require DC-10 and MD-11 operators to provide their pilots with information and training regarding the ground spoiler knockdown feature and its effects on landing characteristics and performance.

2.4 Transport-Category Airplane Stability

and Control During the Landing Phase

The records of previous MD-11 accidents and incidents (reviewed in sections 1.18.4 through 1.18.7), including the accident airplane’s two hard landing events that preceded the Newark accident, have drawn attention specifically to the landing characteristics of the MD-11. However, other transport airplane types, including the Boeing DC-10 and 757/767 (as cited by the Safety Board in its June 16, 1994, safety recommendation letter), also have been involved in landing accidents that were or could have been catastrophic. Although improved pilot training in landing techniques and installation of the FCC-908 software upgrade can help prevent MD-11 landing incidents and accidents (see sections 2.2.2.6 and 2.3.2), the accident history involving the MD-11 and other transport airplane types prompted the Board to consider and review existing certification criteria for airplane handling qualities during landing operations.

The review indicated that, besides basic stability criteria, few objective standards exist for the assessment and acceptance of these handling qualities, including the interactions of airplane and pilot responses and the effects of adverse environmental conditions. Based on the accident and incident record, the Safety Board is concerned that certain complex system interactions, pilot input characteristics, and other factors, such as c.g. position and atmospheric conditions, may occasionally combine during the landing phase in undesirable ways that were not identified during the original certification of transport airplanes. Thus, the Safety Board concludes that additional basic research to identify undesirable landing phase combinations and to compare the overall qualitative and quantitative stability and control characteristics of widely used, large transport- Analysis 65 Aircraft Accident Report category airplanes is needed to improve certification criteria and reduce the incidence of potentially catastrophic landing accidents.

Therefore, the Safety Board believes that the FAA should sponsor a National Aeronautics and Space Administration (NASA) study of the stability and control characteristics of widely used, large transport-category airplanes to a. Identify undesirable characteristics that may develop during the landing phase in the presence of adverse combinations of pilot control inputs, airplane c.g.

position, atmospheric conditions, and other factors; and b. Compare overall qualitative and quantitative stability and control characteristics on an objective basis. The study should include analyses of DC-10 and MD-11 landing accidents and any other landing incidents and accidents deemed pertinent by NASA.

Further, the Safety Board believes that, based on the results of the study, the FAA should implement improved certification criteria for transport-category airplane designs that will reduce the incidence of landing accidents.

2.5 Structures

2.5.1 Right-Wing Structural Design and Failure Title 14 CFR Part 25 requires that an airplane’s landing gear and associated structure be able to withstand a 12 fps vertical speed when landing at maximum landing weight on one gear at zero roll angle and 1.0 g lift. This equates to a maximum energy capacity for a single MD-11 MLG, as required for certification, of 494,500 ft-lbs. Boeing estimates that the MD-11 landing gear strut will bottom and cause the wing rear spar to fail if approximately more than 1,500,000 ft-lbs of energy is transmitted into a single MLG. At 13.5 fps vertical speed, 0.5 g vertical acceleration, and 8° roll angle, the accident airplane’s right MLG experienced an energy input of 1,574,000 ft-lbs during the second touchdown, which was 3.2 times the maximum certification energy and slightly greater than the MD-11’s estimated ultimate capability.

The MDI/Boeing structural simulations of the accident sequence indicate that the right MLG strut and outboard tires bottomed at the second touchdown. Energy not absorbed by the landing gear was then transmitted to the right wing rear spar through the right MLG attach points. A corresponding down load was introduced from the left wing and fuselage, which produced additional torsional loads on the right wing. These torsional loads then produced a shear overload condition in the right wing rear spar according to MDI/Boeing simulations. Boeing stated that the MDI simulations indicate that the failure most probably “initiated at the rear spar/bulkhead (trunnion) rib interface and progressed through the primary wing box structure. As a result of this failure, the right MLG trunnion moved substantially upward and aft with respect to the trap [trapezoidal] panel fitting.” Thus, the Safety Board concludes that the energy transmitted into the right MLG during Analysis 66 Aircraft Accident Report the second touchdown was 3.2 times greater than the MD-11’s maximum certificated landing energy and was sufficient to fully compress (bottom) the right MLG strut and cause structural failure of the right wing rear spar.

Runway sooting consistent with a fuel fire near the right MLG was also found at the area of the second touchdown. Thus, on the basis of runway evidence, analysis of performance data, and the MDI/Boeing structural simulations, the Safety Board concludes that the structural failure of the right wing rear spar resulted in the rupture of the right wing fuel tanks and fire.

Although the Hong Kong Civil Aviation Department’s investigation of the August 22, 1999, China Airlines MD-11 accident at Hong Kong International Airport is ongoing, examination of the pertinent fracture surfaces suggests that the wing spar failure mode in this accident was very similar to that of FedEx flight 14. The Safety Board’s preliminary calculations of the China Airlines MD-11’s descent rate at impact, 18 to 20 fps, imply that like the FedEx accident at Newark, the wing spar failed in overload well in excess of certification requirements.

2.5.2 Landing Gear Certification The MD-11 MLG was designed to break from the wing (fuse) in a drag overload condition but not in a vertical overload condition. Boeing has stated that this design was implemented because data indicated that the most likely landing gear overload condition would occur as a result of striking an obstruction. This “sacrificial shedding” of MLG assemblies in the aft direction was intended to prevent catastrophic loads being transmitted to the wing box and causing rupture.

During its investigation of the FedEx Newark accident, the Safety Board reviewed the circumstances of several accidents involving other wide-bodied airplane types that greatly exceeded aircraft structural limits. A Martinair DC-10 touched down at Faro, Portugal, with a sink rate of 17 fps, at vertical energy loads 2.6 times greater than energy certification requirements for a single MLG. A TWA L-1011 landed in New York at 14 fps, exhibiting vertical energy loads more than twice its certification requirements.

Current landing phase structural design requirements only require consideration of 1.0 g vertical acceleration, small roll angles, and sink rates up to 12 fps. Manufacturers are also required to consider landing gear overloads in the up and aft directions but have the option of either fusing or overdesigning the gear for such loads. Several major landing accidents have now occurred as a result of pilots allowing their airplanes to land with more adverse combinations of lift, roll angle, and sink rate than those specified in the regulations. In each accident, a wing broke and a fuel fire erupted. Each of these accidents involved aircraft whose landing gear were not fused for upward (vertical) acting loads, which concerns the Safety Board. The Safety Board concludes that the failure modes and effects for vertically fused and overdesigned landing gear designs may have been inadequately researched to identify whether, under overload conditions, one design might provide a safer break-up sequence for the airplane than the other design. Therefore, the Analysis 67 Aircraft Accident Report Safety Board believes that the FAA should conduct a study to determine if landing gear vertical overload fusing offers a higher level of safety than when the gear is overdesigned.

If fusing offers a higher level of safety, the FAA should revise 14 CFR Part 25 to require vertical overload fusing of landing gear.

Further, peak vertical acceleration values recorded by the FDR at landing may not be sufficient for maintenance personnel to determine whether structural damage may have occurred during the landing. Data from the Newark accident indicate that initial vertical acceleration, pitch and roll rates, and attitudes should also be considered during FDR readout and evaluation of a potential hard landing event. The Safety Board notes that Boeing has revised its MD-11 maintenance manual to incorporate this guidance and that the company plans to revise the maintenance manuals of its other products based on the revised MD-11 maintenance manual example. However, the Board is concerned that this guidance will not be available to operators of non-Boeing products and that it is not binding.

Thus, the Safety Board concludes that current manufacturer guidance for hard landing identification and operator maintenance readouts and analysis of FDR data following suspected hard landings may not be adequate to identify landings in which structural damage may have occurred. Therefore, the Safety Board believes that the FAA should require manufacturers of 14 CFR Part 23 and Part 25 airplanes and Part 121 operators to revise their hard landing inspection and reporting criteria to account for all factors that can contribute to structural damage. The FAA should also instruct principal maintenance and operations inspectors assigned to Part 121 operators to ensure that these changes have been made to operator maintenance manuals and Flight Operations Quality Assurance exceedence monitoring programs.

2.6 Hazardous Materials Information Dissemination

After the accident airplane came to a stop inverted, the flight crew evacuated the burning airplane without retrieving shipping documents and hazardous materials information that were in the cabin beside the cockpit door. This is entirely understandable given the circumstances of the accident. According to 49 CFR 172.600, hazardous materials emergency response information (including the basic description, technical name, hazard, risks, precautions, and methods for dealing with releases) is required to be “immediately available” to appropriate personnel following an accident. The North American Emergency Response Guidebook also emphasizes the importance of identifying, within 30 minutes, hazardous materials involved in a transportation accident fire or potential spill runoff so that effective downwind evacuation measures can be implemented to minimize the public’s exposure to airborne dispersion clouds and runoff effluents.

However, the incident commander’s repeated requests for cargo manifest information went unanswered because FedEx personnel based in Newark did not have immediate access to this cargo information. FedEx personnel in Memphis spent hours Analysis 68 Aircraft Accident Report tracing flight 14’s cargo documentation because information requests had to be directed first to FedEx offices in Memphis, then to Anchorage, and then to the FedEx office in Narita, Japan, where the hazardous material shipments originated. Firefighting operations had been under way for nearly 2 hours before a partial, handwritten list containing the UN/North American hazard identification numbers for five of seven hazardous materials on board, including a notation about “36 pounds of unknown hazardous materials,” was provided to the incident commander.

Although he did not receive a complete list of the specific hazardous materials on board until the fire was nearly extinguished—more than 4 1/2 hours after making his initial request—the incident commander assumed, on the basis of Newark’s high volume of cargo shipments, that hazardous materials were on board the accident airplane and took precautionary firefighting measures. Thus, the Safety Board concludes that risks to firefighters and the surrounding community were minimized substantially because the incident commander assumed that hazardous materials were on board and acted accordingly. The Board notes that the incident commander’s decision to deploy firefighting units based on the assumption that hazardous materials were likely on board the airplane was prudent and in keeping with the North American Emergency Response Guidebook.

The accident at Newark was the second within a 12-month period involving a FedEx cargo airplane, and both accidents involved similar problems in the dissemination of important hazardous materials information to emergency responders. The Safety Board’s investigation of the first of these accidents—the September 5, 1996, accident at Newburgh—determined that emergency response agencies in Newburgh also had to repeatedly request specific information about the hazardous materials on board the airplane and that this information was delayed because FedEx was unable to provide complete information in a timely manner. In addition, faxes of shipping documents sent by FedEx personnel in Memphis did not reach the incident commander. The Board’s investigation of the Newburgh accident concluded that FedEx did not have the capability to generate, in a timely manner, a “single list indicating the shipping name, identification number, hazard class, quantity, number of packages, and the location of each declared shipment of hazardous materials on the airplane.” The Safety Board concludes that the Newark accident demonstrates that air carriers transporting hazardous materials continue to need a means to quickly retrieve and provide consolidated, specific information to emergency responders about the identity of all hazardous materials on an airplane.

Safety Recommendations A-98-75 and -80, issued on August 12, 1998, recommended to the FAA and RSPA, respectively, that, within 2 years, such a measure be required of all air carriers transporting hazardous materials (see section 1.18.1.2 for a detailed description of these recommendations). RSPA’s July 20, 2000, response indicates that, nearly at the end of the requested 2-year period, proposed action to address this safety issue is just in the beginning stages. It is apparent that the requested action is still many years from completion. Therefore, based on this delay, the Safety Board reclassifies Safety Recommendation A-98-80 “Open—Unacceptable Response” and urges RSPA to expedite the rulemaking process.

69 Aircraft Accident Report

3. Conclusions

3.1 Findings

1. There was no preexisting damage or degradation to the airplane structure, systems, or components that contributed to this accident.

2. The airplane’s approach before the landing flare was stabilized.

3. The captain’s execution of the beginning of the flare maneuver was normal and not a factor in the accident.

4. The accident airplane performed normally in response to the captain's flight control inputs until after the second touchdown.

5. The captain was concerned about the airplane’s touchdown location on runway 22R and intended to take measures during the landing to achieve an early touchdown and minimize the length of the rollout on the runway after touchdown.

6. The captain’s nose-down elevator input beginning at 17 feet radio altitude was not consistent with Federal Express guidance for landing the MD-11.

7. The captain’s nose-down elevator input at 17 feet radio altitude (2 seconds before the first touchdown) was consistent with an attempt to control the point of touchdown given his concerns about the runway length.

8. The captain made a nearly full nose-up elevator input and a large throttle increase to compensate for the increased sink rate caused by his previous nose-down input.

9. The captain’s full nose-down elevator control input at the time of the first touchdown was consistent with his continued concerns to avoid a long landing and his desire to avoid a tailstrike.

10. The captain’s overcontrol of the elevator during the landing and his failure to execute a go-around from a destabilized flare were causal to the accident.

11. The captain’s control inputs during the flare and bounce were not consistent with landing procedures and techniques outlined in the Federal Express MD-11 pilot training procedures, McDonnell Douglas flight crew operating manual, or with Federal Express’ MD-11 tailstrike awareness and high sink rate and bounce recovery training.

12. The captain had no previously documented skill deficiencies that contributed to this accident.

Conclusions 70 Aircraft Accident Report 13. Air carrier pilots’ performance would be improved by additional guidance and training in landing techniques.

14. The flight crew’s calculation error in determining the runway length required for landing influenced the captain’s subsequent actions during final approach and landing by creating a sense of urgency to touch down early and initiate maximum braking immediately.

15. Some flight crewmembers may lack proficiency in the operation of airport performance laptop computers, or similar airplane performance computing devices, and confusion about calculated landing distances may result in potentially hazardous miscalculations of available runway distances after touchdown.

16. The inoperative left landing light did not impede the captain’s ability to land the airplane.

17. The MD-11's tendency to pitch up at ground spoiler deployment did not contribute to the accident.

18. The handling changes incorporated in the MD-11 flight control computer-908 software upgrade will provide valuable improvements in safety during MD-11 landings.

19. With the information that is currently available from the flight data recorder, it may be impossible to distinguish the control inputs of the MD-11 flight control computer-908 longitudinal stability augmentation system from the pilots’ control inputs.

20. The MD-11’s throttle resolver angle-driven spoiler knockdown feature did not contribute to this accident.

21. Additional basic research to identify undesirable landing phase combinations and to compare the overall qualitative and quantitative stability and control characteristics of widely used, large transport-category airplanes is needed to improve certification criteria and reduce the incidence of potentially catastrophic landing accidents.

22. The energy transmitted into the right main landing gear during the second touchdown was 3.2 times greater than the MD-11’s maximum certificated landing energy and was sufficient to fully compress (bottom) the right main landing gear strut and cause structural failure of the right wing rear spar.

23. The structural failure of the right wing rear spar resulted in the rupture of the right wing fuel tanks and fire.

24. The failure modes and effects for vertically fused and overdesigned landing gear designs may have been inadequately researched to identify whether, under overload conditions, one design might provide a safer break-up sequence for the airplane than the other design.

Conclusions 71 Aircraft Accident Report 25. Current manufacturer guidance for hard landing identification and operator maintenance readouts and analysis of flight data recorder data following suspected hard landings may not be adequate to identify landings in which structural damage may have occurred.

26. Risks to firefighters and the surrounding community were minimized substantially because the incident commander assumed that hazardous materials were on board and acted accordingly.

27. The Newark accident demonstrates that air carriers transporting hazardous materials continue to need a means to quickly retrieve and provide consolidated, specific information to emergency responders about the identity of all hazardous materials on an airplane.

3.2 Probable Cause

The National Transportation Safety Board determines that the probable cause of this accident was the captain’s overcontrol of the airplane during the landing and his failure to execute a go-around from a destabilized flare. Contributing to the accident was the captain’s concern with touching down early to ensure adequate stopping distance.

72 Aircraft Accident Report

4. Recommendations

4.1 New Recommendations

As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendations: To the Federal Aviation Administration: Convene a joint government-industry task force composed, at a minimum, of representatives of manufacturers, operators, pilot labor organizations, and the Federal Aviation Administration to develop, within 1 year, a pilot training tool to do the following: Include information about factors that can contribute to structural failures involving the landing gear, wings, and fuselage, such as design sink rate limits; roll angle limits; control inputs’ roll rate; pitch rate; single-gear landings; the effect of decreased lift; and structural loading consequences of bottoming landing gear struts and tires; (A-00-92) Provide a syllabus for simulator training on the execution of stabilized approaches to the landing flare, the identification of unstabilized landing flares, and recovery from these situations, including proper high sink rate recovery techniques during flare to landing, techniques for avoiding and recovering from overcontrol in pitch before touchdown, and techniques for avoiding overcontrol and premature derotation during a bounced landing; (A-00-93) and Promote an orientation toward a proactive go-around. (A-00-94) Require principal operations inspectors assigned to Part 121 carriers that use auxiliary performance computers to review and ensure the adequacy of training and procedures regarding the use of this equipment and the interpretation of the data generated, including landing distance data.

(A-00-95) Require the installation, within 1 year, of the MD-11 flight control computer-908 software upgrade on all MD-11 airplanes. (A-00-96) Recommendations 73 Aircraft Accident Report Require, on all MD-11s equipped with the flight control computer-908 software, the retrofit of digital flight data recorder systems with all additional parameters required to precisely identify and differentiate between pilot and longitudinal stability augmentation system (LSAS) elevator control activity, including control column force, inertial reference unit pitch rate, LSAS command signals, elevator positions, and automatic ground spoiler command signals. (A-00-97) Review and, if appropriate, revise the DC-10 and MD-11 throttle resolver angle (TRA)-driven ground spoiler knockdown feature to ensure that it does not prevent ground spoiler deployment at moderate TRAs that could be associated with sink rate and airspeed corrections during the landing phase. (A-00-98) Require DC-10 and MD-11 operators to provide their pilots with information and training regarding the ground spoiler knockdown feature and its effects on landing characteristics and performance. (A-00-99) Sponsor a National Aeronautics and Space Administration (NASA) study of the stability and control characteristics of widely used, large transport- category airplanes to Identify undesirable characteristics that may develop during the landing phase in the presence of adverse combinations of pilot control inputs, airplane center of gravity position, atmospheric conditions, and other factors; and Compare overall qualitative and quantitative stability and control characteristics on an objective basis.

The study should include analyses of DC-10 and MD-11 landing accidents and any other landing incidents and accidents deemed pertinent by NASA.

(A-00-100) Based on the results of the study recommended in Safety Recommendation A-00-100, implement improved certification criteria for transport-category airplane designs that will reduce the incidence of landing accidents.

(A-00-101) Conduct a study to determine if landing gear vertical overload fusing offers a higher level of safety than when the gear is overdesigned. If fusing offers a higher level of safety, revise 14 Code of Federal Regulations Part 25 to require vertical overload fusing of landing gear. (A-00-102) Recommendations 74 Aircraft Accident Report Require manufacturers of 14 Code of Federal Regulations Part 23 and Part 25 airplanes and Part 121 operators to revise their hard landing inspection and reporting criteria to account for all factors that can contribute to structural damage; instruct principal maintenance and operations inspectors assigned to Part 121 operators to ensure that these changes have been made to operator maintenance manuals and Flight Operations Quality Assurance exceedence monitoring programs.

(A-00-103)

4.2 Previously Issued Recommendations

Classified in This Report

Safety Recommendation A-98-80, previously classified “Open—Acceptable Response,” is classified “Open—Unacceptable Response” in section 2.6 of this report.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL JOHN A. HAMMERSCHMIDT Chairman Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR.

Member CAROL J. CARMODY Member Adopted: July 25, 2000

75 Aircraft Accident Report

5. Appendixes

Appendix A

Investigation and Hearing

5.1 Investigation

The National Transportation Safety Board was initially notified of this accident about 0200 eastern standard time, on July 31, 1997. An investigative team was dispatched to the accident site shortly thereafter. Investigative groups were formed in the following specialties: operations/human performance, aircraft performance, hazardous materials, structures, systems/powerplants, airports, flight data recorder, and cockpit voice recorder.

Member John Goglia accompanied the team to Newark.

Parties to the investigation were: 1. Boeing Commercial Aircraft 2. Federal Express, Inc.

3. Port Authority of New York and New Jersey 4. Federal Aviation Administration 5. Federal Express Pilots Association 6. General Electric Aircraft Engines

5.2 Public Hearing

A public hearing was not held.

76 Aircraft Accident Report

Appendix B

Cockpit Voice Recorder Transcript

Appendix B 77 Aircraft Accident Report Appendix B 78 Aircraft Accident Report Appendix B 79 Aircraft Accident Report Appendix B 80 Aircraft Accident Report Appendix B 81 Aircraft Accident Report Appendix B 82 Aircraft Accident Report Appendix B 83 Aircraft Accident Report Appendix B 84 Aircraft Accident Report Appendix B 85 Aircraft Accident Report Appendix B 86 Aircraft Accident Report Appendix B 87 Aircraft Accident Report Appendix B 88 Aircraft Accident Report Appendix B 89 Aircraft Accident Report Appendix B 90 Aircraft Accident Report Appendix B 91 Aircraft Accident Report Appendix B 92 Aircraft Accident Report Appendix B 93 Aircraft Accident Report Appendix B 94 Aircraft Accident Report Appendix B 95 Aircraft Accident Report Appendix B 96 Aircraft Accident Report Appendix B 97 Aircraft Accident Report Appendix B 98 Aircraft Accident Report Appendix B 99 Aircraft Accident Report Appendix B 100 Aircraft Accident Report Appendix B 101 Aircraft Accident Report Appendix B 102 Aircraft Accident Report Appendix B 103 Aircraft Accident Report Appendix B 104 Aircraft Accident Report Appendix B 105 Aircraft Accident Report Appendix B 106 Aircraft Accident Report Appendix B 107 Aircraft Accident Report Appendix B 108 Aircraft Accident Report Appendix B 109 Aircraft Accident Report Appendix B 110 Aircraft Accident Report Appendix B 111 Aircraft Accident Report Appendix B 112 Aircraft Accident Report

113 Aircraft Accident Report

Appendix C

Excerpts from the Flight Data Recorder

Appendix C 114 Aircraft Accident Report Appendix C 115 Aircraft Accident Report Appendix C 116 Aircraft Accident Report Appendix C 117 Aircraft Accident Report Appendix C 118 Aircraft Accident Report Appendix C 119 Aircraft Accident Report Appendix C 120 Aircraft Accident Report

Appendix D 121 Aircraft Accident Report Appendix D Prior Incident Flight Data Recorder Data for the Accident Airplane Appendix D 122 Aircraft Accident Report Appendix D 123 Aircraft Accident Report

124 Aircraft Accident Report

Appendix E

FedEx Tail Strike Awareness Information Bulletin

Appendix E 125 Aircraft Accident Report Appendix E 126 Aircraft Accident Report Appendix E 127 Aircraft Accident Report Appendix E 128 Aircraft Accident Report

129 Aircraft Accident Report

Appendix F

FedEx Tail Strike Awareness

Training Instructor’s Guide

Appendix F 130 Aircraft Accident Report Appendix F 131 Aircraft Accident Report Appendix F 132 Aircraft Accident Report Appendix F 133 Aircraft Accident Report Appendix F 134 Aircraft Accident Report Appendix F 135 Aircraft Accident Report Appendix F 136 Aircraft Accident Report Appendix F 137 Aircraft Accident Report Appendix F 138 Aircraft Accident Report Appendix F 139 Aircraft Accident Report Appendix F 140 Aircraft Accident Report Appendix F 141 Aircraft Accident Report