PILOT TERROR

A terrorism-rocked public was relieved by the official explanation-turbulence and crew error-for the November 12 crash of American Airlines Flight 587 into New York's Rockaway Peninsula. But aviation experts and many pilots see danger lurking in the Airbus A300-600: possible flaws in the electronic control system and in the tail that may have created a high-tech time bomb

DAVID ROSE

INVESTIGATION

For a few nervous hours last November 12, it looked as if America's enemies were attacking once again. Sixty-two days after 9/11, an American Airlines passenger jet had fallen from an azure morning sky to devastate a New York City neighborhood— not the Manhattan financial district, but unpretentious Belle Harbor on the Rockaway Peninsula in Queens. As President Bush conferred with the director of homeland security, Tom Ridge, New York's airports, bridges, and tunnels were closed.

Then Marion C. Blakey, the newly appointed chair of the National Transportation Safety Board (N.T.S.B.), issued a statement: "All information we have currently is that this is an accident." The disaster took the lives of all 260 passengers and crew and another five people on the ground. But as The New York Times commented the next day, in the context of the fall of 2001, the fact that it hadn't been caused by terrorism meant the news came "as somewhat of a relief."

Flight 587 to Santo Domingo, capital of the Dominican Republic, took off 75 minutes late from John F. Kennedy International Airport, at 34 seconds after 9:14 A.M. An A300-600—a twin-engine, wide-body jet made by the European manufacturer Airbus Industrie—it climbed to more than 2,000 feet, then turned left across the lagoon of Jamaica Bay, heading south toward the open sea. In the cockpit were two men with thousands of hours' experience at flying jet airliners, Captain Edward States, aged 42, and First Officer Sten Molin, 34.

At 9:16, a minute and 26 seconds after takeoff, one of them spoke to air-traffic control. On the tapes made that morning, the sound is distorted, as if coming from the bottom of a deep well, but the words can be made out as "Mayday, losing control." Less than five seconds later, first the rudder and then the massive tail fin were ripped from the rest of the aircraft. The next words on the tape were spoken from another airplane near J.F.K. that morning: "Tower, look out to the south, there's an aircraft crashing. ... An aircraft just crashed to the south of the field." "American 587, I'm not receiving your transponder," one controller said. "American 587, [this is] New York." By now other pilots in the air were speaking of a "fireball" in Rockaway, and a huge plume of smoke. Impact was at 17 seconds after 9:16.

Within a few days, the safety board was advancing a theory that seemed to explain the disaster. Blakey told reporters that Flight 587 had encountered turbulence caused by the plane in front. Other board sources suggested that one of the crash's main factors appeared to be pilot error: it seemed the crew had overreacted to the turbulence by making a series of violent movements with their rudder. These had imposed huge side loads on the tail and snapped it off.

Some of those who fly the Airbus A300-600 do not find this story plausible. To have responded to turbulence in the manner suggested would have been to disregard everything a pilot learns in training, they say. They have logged a lengthy dossier of other incidents in which Airbus planes have flown out of control—not through pilot error, they say, but through malfunctions in their computerized control systems, which are the most advanced in the industry. In addition, they say, the inspection regime Airbus recommends for the revolutionary "composite" material used to build the A300-600's tail is inadequate and could allow dangerous flaws to remain undetected.

The investigation into the crash of Flight 587 "has literally shaken the foundations upon which we define what is, or is not, safe," said a group of eight American Airlines A300-600 pilots in a letter to Blakey and Jane Garvey, head of the Federal Aviation Administration. "Some of the issues being analyzed suggest that there are areas of concern which transcend AA 587, and have the potential to impact the future of commercial aviation in a manner never anticipated."

An investigation by Vanity Fair, based on confirmed official data, analysis by aviation experts, and dozens of interviews with pilots, scientists, and witnesses to the crash, casts further doubt on the "pilot error" explanation. This aircraft fell out of the sky on a beautiful morning after a routine takeoff when its tail fin and rudder were hurled into Jamaica Bay. In the 80-year history of civil aviation, this event was unprecedented.

Anyone who travels much by airplane, writes Tom Wolfe in his classic book about pilots and the space program, The Right Stuff, soon gets to know the voice of the pilot on the intercom. He speaks "with a particular drawl, a particular folksiness, a particular down-home calmness that is so exaggerated it begins to parody itself... the voice that tells you, as the airliner is caught in thunderheads and goes bolting up and down a thousand feet at a single gulp, to check your seatbelts because 'it might get a little choppy.'" Wolfe, who attributed the voice's origins to the test pilot Chuck Yeager, was writing 23 years ago, but this is one aspect of aviation which hasn't changed.

"I just knew from my experience of 30 years as an airline pilot that they were going to take a shot at my son."

You don't have to spend much time with pilots to realize that this sense of calmness, of deliberation, in everything they do isn't put on. Airline pilots take off and land a dozen, a hundred, a thousand times, and nothing untoward happens. But on the next flight they find themselves confronting an unexpected crisis, which they and their plane will survive only through the application of complex technical procedures. If one maneuver doesn't work, they must go on to try something else, even as they continue to plummet out of the sky. "I've thought about that Yeager thing," says Stan Molin, still a flight instructor at the age of 70, a retired jet captain who flew with Eastern Airlines for 25 years. "My feeling is, if you can't be like that naturally, you're going to find the job emotionally very difficult."

It was Stan's son Sten who was at the controls of Flight 587. Three days after the crash, Stan Molin traveled from his home in Greenwich, Connecticut, to Rockaway. He stood facing the ocean, and at that moment his grief was augmented by a new and bitter torment. "I told myself, 'He was at the controls, and the tail fell off.' I've read enough N.T.S.B. reports to know that at the very least they're likely to say, 'Contributing factor, pilot overcontrol.' I just knew from my experience of 30 years as an airline pilot that they were going to take a shot at my son."

The shot was not long in coming. Within days of the disaster, the safety board began to sketch its preliminary account of what had gone wrong. At 15 minutes and 39 seconds past nine A.M., 65 seconds after takeoff, according to the N.T.S.B., the plane apparently hit an instance of "wake vortex" caused by a Japan Airlines Boeing 747, which had taken off from the same runway at J.F.K. 105 seconds before Flight 587. Wake vortex is the turbulence an airplane makes as it passes through the air. It trails behind the wingtips in the form of two spiraling, tornado-like cones, and in certain circumstances it can be very dangerous—although it tends to affect light aircraft much more seriously than a widebody behemoth like an A300-600.

On the tapes made that morning, the sound is distorted, but the words can be made out as "Mayday, losing control."

According to the safety board, eight seconds after this alleged encounter, one of the crew was heard on the cockpit voice recorder suggesting that the plane had hit wake vortex. (The full cockpit transcripts have not been released.) As the board says, however, the bump caused by this alleged turbulence was mild. On the plane, it would have been felt as a sideways jolt with just a tenth of the force of gravity— the kind of deflection that experienced fliers, passengers and crew alike, would have found of little concern.

Twenty seconds after the supposed first vortex bump, the safety board claimed, came a second, which was no more severe. Then all hell broke loose. The flight-data recorder, the plane's "black box" containing electronic details of what happened during the flight, showed a series of five violent side-to-side rudder movements, which tossed the plane around in the sky like a cork in a stormy sea. Five and a half seconds after the alleged second vortex encounter, the rudder data on the flight recorder became "unreliable." That was probably the moment when the rudder split into three jagged segments and was ripped from its hinges, followed almost immediately by the rest of the tail being torn off the fuselage. With the plane now beyond all possibility of controllable flight, there were just 12 'A nightmare seconds to go before impact in Rockaway.

The N.T.S.B.'s official release of information was coupled with briefings to reporters that blamed the disaster on the crew. "The pilots might unintentionally have magnified a relatively minor problem," concluded Time magazine. In January, The New York Times added: "Investigators ... are now focusing on the performance of the pilots, who they believe triggered the airplane's wild rolling and yawing in the seconds before it went down."

On February 8, Blakey issued a statement. "We have calculated that certain rudder movement inputs by pilots could cause a catastrophic failure of an airliner's vertical tail fin," she said at a Washington, D.C., press conference. She was careful to state that Flight 587's rudder may not have been moved by the crew at all, but through some kind of malfunction. Nevertheless, the board was issuing an immediate, industrywide recommendation. It said that many pilots had not been informed that moving a rudder from side to side might be dangerous, and that they lacked awareness that on some planes, including the A300-600, it would take only a small force on the control pedals to move the rudder to its maximum angle. Airlines should devise new "pilot training programs," the N.T.S.B. said.

Stan Molin had taught Sten to fly at Bridgeport, Connecticut, while he was still a teenager, then watched as he pursued aviation as a career. Sten passed all the tests for his full jet license when he was only 22. With thousands of hours of flying time already behind him, he joined American Airlines when he was just 24— about a decade younger than average. Those who worked with him describe him as an unusually gifted flier—in pilots' slang, he was always "ahead of the plane."

Flight 587's captain, Ed States, was a former air-force pilot who joined American Airlines in 1986. "He was always very in tune with the fact that he was the captain," says his widow, Mary Alden, now left alone with the couple's two boys, aged 9 and 11. "After 9/11, he'd do security briefings with all the crew before each flight. He'd make jokes, but he was serious too. He had an incredibly even temperament." Deeply involved with youth sports teams and his local church, States used to re-arrange his flight schedule so as not to miss a Cub Scout committee meeting. "He was almost too good to be true," says his former roommate and fellow A300-600 pilot, Captain Paul Csibrik.

What many of States's and Molin's fellow pilots find hard to accept is the claim that on the day they died they forgot everything they had ever learned and responded to a trivial case of turbulence by wildly pumping the rudder pedals. "I can't emphasize enough how contrary to our training it would be to mash the rudder," says American Airlines first officer Jason Goldberg. "Our instincts would specifically be not to get on the rudder."

Captain Csibrik tried to reproduce the rudder movements in a flight simulator, a computerized replica of an A300-600 cockpit on hydraulic legs which mimics how it would feel on board a real plane in any given conditions. "I made the first three movements on the pedals, but after that I had to stop, because the simulator felt so out of control I couldn't physically do it anymore. It was just nauseating. I don't believe anyone in their right mind could have gone on and done all five movements."

"If he did do it—if he did make those rudder movements—I can only assume they were in response to something he saw or felt, something extreme," Stan Molin says. "He must have been desperately fighting some situation that threatened the plane's survival. I just don't believe he overreacted in the way it's been suggested."

By this late stage after an air crash, those outside the magic circle of the safety board would usually have access to a key source of hard information: the printouts from the main black box, the flight-data recorder. Flight 587 is different. The safety-board spokesman, Ted Lopatkiewicz, says the data records will not be published until the board holds public hearings into the disaster, sometime in October.

The resultant shortage of technical information makes any attempt to check the claims made to date about Flight 587 quite difficult. Not, however, impossible.

Victor Trombettas, aged 38, is a family man with a goatee from Middle Village in Queens who makes a living managing a nationwide computer network for a not-forprofit organization in Manhattan. Since the day of the crash, he has done what he can to scrutinize the safety board's activities, using the Internet to build up a network of aviation experts, former crash investigators, pilots, and engineers. Trombettas and his buddies conduct on-line brainstorming sessions far into the night, and when they come up with something, he posts it on his Web site—www.usread.com. Trombettas became skeptical on the day of the crash when Marion Blakey SUggeSted that it was likely an accident. At that time she was still in Washington and her "go team" had not reached the crash site: she was in no position to know. "As time has gone it's just gnawed at me," Trombettas says. "I guess you could say I'm obsessed."

CONTINUED ON PAGE 223

"After 9/11, he'd do security briefings with all the crew before each flight.... He had an incredibly even temperament."

CONTINUED FROM PAGE 216

His work has won respect from many of those with an interest in the crash investigation, including Stan Molin and several current A300-600 pilots. Another admirer is Vernon Grose, a former safety-board member and seasoned crash investigator, now the chairman of the Omega Systems Group, a risk-management company in Arlington, Virginia. "We've never had a Victor before," Grose says. "But, for good reasons now, people have doubts about what the N.T.S.B. is doing. Unfortunately, I'm among them."

Wake vortex, the supposed trigger of the crash, is a phenomenon that can be hard to predict. For example, it always dissipates over time, thus ceasing to pose a danger, but it's often hard to say how fast this will happen. But wake vortex does not ignore the laws of physics. For a plane to be affected by the wake from an aircraft in front, it has to be in the wrong place at the wrong time: it has to fly through the mass of air containing the vortex. In the simplest scenario, this might happen if two planes followed the same flight path on a day when the air was still. But the air around J.F.K. on the morning of November 12, 2001, was not still, and Flight 587 did not follow the same flight path as the Japanese 747. It climbed more slowly and turned left over Jamaica Bay in a markedly tighter arc.

Victor Trombettas looked at the weather data from J.F.K. It showed the wind at ground level was blowing at nine knots out of the northwest, on a heading of 300 degrees. At 2,779 feet—about 300 feet above the maximum altitude reached by

Experiments by the National Oceanic and Atmospheric Administration cast further doubt on the wake-vortex theory. Tests using Boeing 727, 757, and 767 aircraft indicated that wake vortex vanished less quickly when the winds were lightstronger winds "smoothed out" the turbulence and hastened its decay. In a 10-knot wind, a vortex might last as long as a minute; to persist as long as 85 seconds, the wind would have to be at 5 knots or less. To repeat: at the altitude Flight 587 supposedly hit the vortex from the 747, the wind was about 19 knots, and the two planes were about 100 seconds apart.

I traveled to the Massachusetts Institute of Technology in Cambridge to see R. John Hansman Jr., professor of aeronautics and astronautics and director of M.I.T's International Center for Air Transportation. A pilot with more than 4,200 flying hours, Hansman is an internationally acknowledged expert in flight safety and atmospheric conditions. The wind conditions, he says, make the safety board's version of events highly questionable. Flight 587—it was blowing at a speed of 19 knots. There were no localized gusts.

The N.T.S.B. has not yet released the records from the ground radar at air-traffic control that tracked the two planes in and around J.F.K., which ought to show where they were at 4.6second intervals. Trombettas obtained this information from the Megadata Corporation's PASSUR system—widely acknowledged as the world's most accurate source of flight-path data. He drew up a chart and did the math. At the two points where the board says Flight 587 hit the 747's wake vortex, the courses of the two aircraft were more than three-quarters of a mile apart. This, it seemed, was too far away for the wind to have blown the vortex across Flight 587's path.

The second time this was supposed to have happened—the crucial wake-vortex encounter that allegedly triggered the wild rudder movements and caused the crash—appeared especially improbable. Trombettas's calculations suggest that, to have gotten as far as Flight 587, the vortex would have had to have been blown at 39 knots—more than twice the wind's actual speed. If the vortex traveled at only 19 knots, as the J.F.K. reports suggest, when Flight 587 reached the place where the second encounter is said to have happened, the vortex would still have been half a mile away.

"It really does look as if it's stretching it to say it's wake the second time if the wind has to be 39 knots," he says. "If they think the second wake-vortex encounter was a cause of the crash, they need to understand how this could have happened. You have to ask them if there is an explanation. And if there isn't, you have to keep digging."

As yet, the board can't provide this explanation. It asked NASA to produce a computer model showing how the vortex may have affected Flight 587. As of July 2002, this work had barely started.

As the sun sets one late-spring evening, Victor Trombettas, Stan Molin, and I stir our coffee in the Rockaway Sunset Diner, 15 blocks from the crash site. Two big pieces of the aircraft landed on the roof above where we sit. Trombettas opens his laptop and clicks on a sound file—a copy of recordings made on November 12 by airtraffic control. It's not a complete record of what was said in the cockpit, only comments the crew made while a radio-transmission microphone was open. Out of the chatter comes a clear male voice. It utters a short quizzical phrase, its intonation rising: "Try escape?" Molin's tanned face turns pale. "That sounds like my son." He listens again. This time, he's certain.

"I felt this kick—like someone had just moved the plane to the right," says a pilot, describing an experience with an Airbus A300-600.

When the F.A.A. released the transcripts of this recording, it claimed the words used were "nice game"—a phrase that would have been meaningless. But "Try escape" isn't meaningless at all. It relates to a set procedure American Airlines teaches its A300-600 pilots at its flight school in Dallas. I interviewed nine Airbus pilots for this article: not one had ever used it, nor knew anyone who had. "Escape" is a so-called red-box procedure in the airline's training manual—meaning it has to be learned by heart and practiced regularly in a flight simulator. "It's basically a maneuver you use when the plane's out of control and in danger of smashing into the ground," says Captain Pete Bruder. His colleague Captain Bob Tamburini adds, "It's used when you're in an extreme situation, like trying not to crash into a mountain. Sten obviously sensed that's what he was dealing with."

In an escape maneuver, the crew tries to bring the plane's nose up by at least 15 degrees, and then they do something very unusual. They switch off the "limiter" that normally stops the engines from reaching maximum power, and move the engine controls to full throttle. (In an ordinary takeoff, a pilot might typically use about 80 percent of the engines' thrust.) Pilots are taught never to use the escape maneuver except in emergencies, because this may cause expensive damage and shorten the engines' life. In the words of another pilot, "Going to max power means, 'Fuck the engines, I want power!"' Ted Lopatkiewicz, the safety board's spokesman, insists there is "no evidence" that the "Try escape" radio message came from Flight 587: the words are not on the cockpit voice recorder. Glen Schulze, an air-crash data specialist who has worked with NASA and the C.I.A., has analyzed the message tapes and says there is a "high probability" that these words were spoken on the doomed plane. In any event, what isn't in doubt is that the crew was trying the escape maneuver. Months ago, the board disclosed that one of the pilots' voices was clearly recorded saying two words: "Max power." There's only one reason he would have done so in this case—he was trying the "escape."

In any crash investigation, among the first things investigators try to do is build a timeline. Sifting myriad data to hunt for cause and effect is futile unless one knows the order in which things happened. "Normally you'd get that readout within hours of receiving the black boxes," former N.T.S.B. member Vernon Grose says. "It's almost Step One." More than six months after the crash of Flight 587, the board's chair, Marion Blakey, claimed that no unified timeline had yet been produced and that the information from different sources—the flight-data and voice recorders and the ground radars—had yet to be matched. "That's a complicated process," she told reporters. "All of that will be provided for the docket [the reports to be released at the public hearings in October 2002] when we have it, but we don't have it now." Grose finds this hard to believe. "Don't tell me they haven't done that," he growls. "And if not, why not?"

Once again, it is Trombettas and his on-line advisers who are attempting to fill the void. With much of the data still withheld, Trombettas's timeline isn't complete. But he has been able to match the airtraffic-control recordings—which are precisely timed—with the PASSUR radar data. He correlated this with the times of key events from the flight-data and voice recorders released by the safety board last year. (Questioned by Vanity Fair, spokesman Lopatkiewicz warned against drawing conclusions from these timings, saying they were "preliminary.")

Matching all this data casts doubt on the official story so far disseminated.

The crucial moment comes when either Molin or States revealed that the plane was in deep trouble by calling for "Max power"—15 minutes and 58 seconds after nine A.M. This was about a second before Flight 587 is supposed to have hit the 747's wake vortex for the second time; about a second before the wild rudder movements began. The disputed "Try escape" call came another six seconds earlier. Even if Molin didn't say these words, the pilots would not have called for maximum power without careful thought, and they wouldn't have reacted instantaneously to a crisis. One of the board's nuggets of information provides another clue. Four seconds before the "Max power" call, the N.T.S.B. has said, the cockpit recorder picked up some "airframe rattling" noises. It seems an inescapable conclusion that the pilots feared they were losing their plane well before the board says anything went wrong. An American Airlines official—who asked to remain anonymous—says, "Something was going drastically wrong. And it's clear the crew didn't know what it was."

The final clue comes from the ground radars. Every 4.6 seconds, the transponder inside every airliner sends out a packet of electronic data, sometimes known as a "squawk," which identifies the aircraft and states its altitude. It has to be reliable. As American Airlines first officer Todd Wissing says, if it weren't, air-traffic control wouldn't know where planes are, and the risk of midair collisions would be considerable. He has, he says, heard of occasions when aircraft transponders malfunction, "but I've never heard of that happening with an A300-600."

Flight 587's transponder was malfunctioning—long before the rudder movements and the ripping off of its tail. According to the PASSUR radar data obtained by Trombettas, it sent out an unreadable, "corrupt" squawk very early in the flight—just 51 seconds after takeoff, 14 seconds before the first alleged wake-vortex encounter. It did so again a second before the "Max power" call. Finally, when the pilots said they were "losing control," the transponder said the plane was flying at 3,019 feet. In fact, says Lopatkiewicz, it never got above 2,500 feet. The transponder was sending out "erroneous data."

Was this radar fault merely a coincidence, unconnected to the crash? Or may it be evidence of some general electronic failure? In any event, it now seems clear that the rudder movements came near the end, not the beginning, of Flight 587's path to disaster.

June 27, 2000: a calm, sunny day over the green patchwork of Gloucestershire, England. Captain Pete Bruder was in command of an American Airlines A300-600 on its way from London's Heathrow airport to New York. At 22,000 feet, he says, "it just went, Bang! It was like someone pushed the whole plane. It went left, right, left, and back to where we started. We got slammed." In the main cabin, a flight attendant was thrown into a passenger's lap as the plane lurched from side to side. "Everyone in back was terrified," Bruder says. Unwilling to risk an Atlantic crossing, he returned to Heathrow.

The Air Accidents Investigation Branch, the British N.T.S.B., held an investigation. There was nothing on the flight-data recorder that indicated what might have happened, and no evidence of a fault. The weather was stable. Minutes ahead of the A300600 had been a Boeing 777. The investigators could not be certain, but reported that "it is most probable that the reason" for the Airbus's experience was the 777's wake vortex. Bruder—who at the time had 10,500 hours' flight experience—is unimpressed. "When you hit wake vortex, the plane rolls: up one side, then down again when you get through it. This was different. Something made an input on the rudder on that plane, and you'll never convince me it didn't."

American is the only U.S. passenger carrier that uses the Airbus A300600—mainly on its routes from New York and Miami to Latin America and the Caribbean. Dozens of other airlines in the rest of the world fly this plane, including Lufthansa, Thai Airways, Emirates, Olympic, and Korean Air. At American Airlines' New York station, the people most concerned about Flight 587 are some of the pilots still flying the 34 A300-600s the airline has left. Like Victor Trombettas, they have used the months since the crash to carry out their own research. Among their troubling findings are records from 21 incidents in which A300-600s appear to have undergone "uncommanded rudder inputs" of the kind Bruder describes.

As time has gone it's just gnawed at me," says Trombettas of the crash of Flight 587. "I guess you could say I'm obsessed."

One of the first came in the summer of 1989, says Dan Carey, now a 777 captain who flew the A300-600 for nine years. He recalls taking off from the Caribbean island of Aruba. "As we started getting faster, I saw the left rudder pedal moving. The faster we're going, the more the pedal is going in. And I see the pilot's right leg is starting to shake because he's putting so much pressure on to keep the plane straight." At a speed of 108 knots (about 120 m.p.h.), the pilot aborted the takeoff, slamming on the brakes and raising the spoilers. "The airplane was kind of hopping across the surface," Carey says. "It took me a while to tell the tower what had happened. I had the shakes, and I couldn't pick up the microphone."

In June 1999, American Airlines gave official recognition to the issue. In a "pink bulletin" circular to all its A300-600 captains and first officers, it cited a flight the previous month from Bogota, Colombia, to Miami, when the pilots had found themselves unable to stop multiple rudder movements which had caused the plane to lurch from side to side. It later emerged that ground engineers had miswired the controls. The pink bulletin had strong advice, printed in capitals, for pilots who experienced anything similar: LAND AS SOON AS PRACTICAL.

Less than a fortnight after the crash of Flight 587, an American Airlines A300-600 fishtailed in the sky after leaving Lima, Peru. In January 2002 another A300-600 reportedly experienced an uncommanded "rudder jolt" on its way from San Juan, Puerto Rico, to Newark, New Jersey. Afterward, Captain Glenn Schafer flew it across the Hudson for maintenance at J.F.K. Just 50 feet above the runway during takeoff, he says, "I felt this kick—like someone had just moved the plane to the right. I've never felt anything like that before." The same month, an A300-600 had climbed to 10,000 feet from takeoff in Miami when it underwent several minutes of "uncommanded yawing" that caused the plane's doors to "buckle and pop," says a crew member. The pilots turned around and made an emergency landing, but, after electronic parts governing the rudder were replaced overnight, another crew experienced further "uncommanded rudder inputs" the next day.

At the end of March, Schafer, Bruder, Wissing, and five of their colleagues submitted a 73-page dossier to Marion Blakey, chair of the N.T.S.B., and Jane Garvey, head of the F.A.A. They said the "flight control malfunctions" so frequently experienced on A300-600 planes "in many cases defy reasonable explanations." In a letter responding to the pilots' dossier, the F.A.A.'s director of aircraft-certification service, John J. Hickey, wrote: "To date, no information has come to my attention that would warrant grounding of the A300600 fleet." In a separate letter, the N.T.S.B. agreed with that assessment.

Alain du Piech, a spokesman for Airbus in Toulouse, France, declines to discuss the pilots' claims about uncommanded rudder movements in the A300-600. An American Airlines spokesman says the airline "does not believe there is any pattern" to these incidents, and that they may have several different causes, including miswiring and overreaction by the plane's computers to imbalances in engine power.

Aviation experts say the common factor is likely to lie somewhere in the plane's electronic control system. The A300-600 was the first in a series of Airbus models that took aircraft computerization to ever higher levels in an effort to eliminate the possibility of pilot error once and for all. Unfortunately, the growth of technology has brought new problems. John Hansman, the M.I.T. aeronautics professor, says: "When you create electronic control systems, you create the potential for uncommanded inputs."

One such system has apparently affected the Airbus A320, a single-aisle aircraft built to rival Boeing's 727 and 737. In 1994 an A320 crashed when it overshot the end of a runway on landing in Warsaw. It emerged that an A320's computer would allow the plane to brake after touching down only if its sensors said the wheels on both sides were running along the tarmac and bearing the weight of the plane. In certain wind conditions, pilots would try to stop, but the computer would disable the brakes, and the controls would not respond.

That fault was fixed, but there has been at least one other clash between pilots and the A320. On March 17, 2001, Northwest Airlines Flight 985 was taking off from Detroit. At a speed of 110 knots—much too slow for sustainable flight—the nose began to lift. The pilot tried to lower it, using the flaps, but, as the official report says, "the airplane was unresponsive. The airplane became airborne and climbed to an altitude of 20 to 30 feet above the runway." The only way to avoid a crash was to cut the engine power. At last the plane "settled to the runway," its tail end striking the tarmac. It plowed off the end and continued for another 700 feet before coming to a stop in mud. The aircraft was badly damaged, but no one was seriously hurt.

If the rudder movements on Flight 587 were uncommanded, there is a possible suspect. An A300-600's rudder can be moved not only by the control pedals but also by an electronic system known as the "yaw damper." Its purpose is to provide a smooth and even flight; it responds to winds, turbulence, or movements of the plane by making small adjustments to the rudder. The concerned Airbus pilots suspect faulty yaw-damper systems in several of the other incidents.

What we do know is that in Flight 587's pre-flight checks the crew discovered that the computer system controlling the backup autopilot command to the yaw damper was malfunctioning. They had to ask the ground engineers to fix it. Establishing whether this was a cause of the crash will not be easy.

In his office at M.I.T., James H. Williams Jr. hands me a smooth, black panel of carbon-fiber composite. The length and width of a paperback, it's about one-eighth of an inch thick. It seems to weigh almost nothing, but stressed from end to end, along the grain of the fibers, it might easily support a weight of 10 tons. Inadvertently, I flex it a little sideways. The panel cracks audibly. With a little more pressure, Williams confirms, I would have snapped it in half.

Williams, M.I.T. School of Engineering Professor of Teaching Excellence, is one of the world's leading authorities on the use of this material in aircraft. A longtime adviser to the U.S. government, he has consulted on some of the West's most advanced military aircraft. The response to the crash of Flight 587 from Airbus, American Airlines, and the federal authorities worries him deeply.

Flight 587's chances for survival ended when two composite components—first the rudder, then the vertical tail fin, a huge structure 28 feet high—became detached from the fuselage. This was unprecedented, but Williams's fear is that, without significant changes to the way some composite aircraft parts are designed, repaired, and inspected, it may turn out not to be unique. "Composites are wonderful materials, but there's a lot about them we do not understand," Williams says. "The safety and comfort of our families, friends, and the dedicated crews who serve us demand that these issues be addressed. And out of respect for those directly affected by Flight 587, the sooner the better."

Reduced to essentials, a composite of the kind found in an A300-600's tail is nothing more than hundreds of sheets like those in Williams's panel stuck together with epoxy glue—the carbon-fiber equivalent of plywood. However, actually making a composite durable enough to endure the stresses of tens of thousands of flying hours is a lot less simple than the idea. Because each layer is only strong in one direction, along the fiber grain, the engineers need to work out from which directions loads will come, and then lay the sheets in a complex, crisscross pattern. If they get this wrong, a big or unexpected load might cause an airplane part to fail as easily as I almost snapped the panel.

"It just went, Bang! It was like someone pushed the whole plane. It went left, right, left, and back to where we started."

It's also vital there be no kinks or folds as the layers are laid, and no gaps in their coating of glue. Williams illustrates what would happen if the epoxy bond between the layers was less than perfect by handing me a pair of thin carbon-fiber rulers, with a strip of foam sandwiched between them. I can flex them with little effort. He hands me a second sandwich made of identical materials, but with the three layers bonded to one another. It feels completely rigid. The simple fact that one layer can't move against another has increased its stiffness many times. By the same token, if the layers inside an aircraft part start to separate, to delaminate, much of the stiffness will be lost. Once delamination starts, it is likely to get worse. "One tiny flaw may cause the stress to become concentrated at that spot, so the delamination may spread."

Aircraft travel repeatedly from tropical temperatures on the ground to the minus50s Fahrenheit at 30,000 feet. That causes condensation: a typical aircraft composite, even in perfect condition, can absorb water to about 3 percent of its weight. But water inside a gap between carbon-fiber layers will freeze and expand. Like a pothole in a roadway in winter, Williams says, the gap may grow.

Until Airbus began to develop the A300-600, around 1980, civilianaircraft makers had employed composites only for peripheral items, such as wing flaps or passenger-compartment paneling. But composites are much lighter than steel and aluminum, and Airbus knew that using more of these lighter materials would enable airlines to cut their fuel costs. The A300-600 became the world's first airliner to use composites in a vital, load-bearing structure—its tail. In its sales literature, Airbus describes the A300-600 as "the regional profit machine." By the end of April 2002, 768 had been delivered worldwide, with 61 new orders in 2001 alone. This aircraft was the start of the stunning tide of success that has given Airbus primacy over Boeing, with 61 percent of world airliner sales.

Airbus recognized that its composite parts would need regular inspection. But the regime its engineers recommended, which the Federal Aviation Administration promptly approved, was far from rigorous, in Williams's opinion. All the F.A.A. required was a visual check every five years. According to Airbus, any damage or delamination within the composite tail that was serious enough to cause structural weakness would be visible on the surface. Even since Flight 587 smashed into Rockaway, both Airbus and the F.A.A. have maintained this position.

"Composites are wonderful materials, but there's a lot about them we do not understand," says Williams of the material in the A300-600 tail.

Professor Williams does not find this adequate. "In essence, Airbus's policy for its A300-600 composite vertical stabilizer is that damage that cannot be seen with the unaided eye will not compromise its structural integrity," he says. "This is a lamentably naive policy. It is analogous to assessing whether a woman has breast cancer by simply looking at her family portrait."

In his view, long before some composite flaws show up on the surface, the material can become dangerously weak. He says the only safe way to determine whether a composite aircraft part is starting to soften through cracks or delamination is to subject it to "modern nondestructive testing," employing technological methods of "seeing" beneath its skin. One common method is ultrasound, using a giant version of the machine an obstetrician employs to examine a fetus in utero. Another is thermography—a technique based on the principle that holes inside a piece of composite will conduct heat at a different rate from that of a solidly bonded, undamaged region. These approaches—thanks in part to Williams's research—have been accepted by the military for several years. Jet fighters that use composites in their tails are frequently inspected with ultrasound.

Airbus and American Airlines insist that nondestructive testing of A300600 tail fins that have experienced only normal flight is unnecessary and dangerous. The tails are fixed to the fuselage with bolts inserted through six huge composite lugs, which in turn slot inside six metal brackets—entirely hidden from view. That means that to submit the composites, lugs included, to ultrasound inspection, the tails have to be removed—a difficult and cumbersome process requiring a special lifting rig. This, claims the airline, risks damaging the lugs.

Williams has carried out research into the way composites decay and lose their strength and stiffness, even when there are no cracks or delamination. He has found that, like steel, composites may suffer fatigue. They tend to have a Fixed life span, with a finite number of times they can bear loads before they lose a significant fraction of their strength. But this period, he says, can be shortened drastically. "If the plane suffers a humongous bump, the fatigue process is accelerated, even though there may not appear to be any damage. If that happens, you've used up a lot of the material's life."

The plane that crashed in Rockaway, Serial Number 053, had undergone just such a bump. In 1994 it ran into some nasty clear-air turbulence on a flight from Miami to San Juan. Captain Dan Carey was asked to ferry it back. "The handbaggage bins had come away from the ceiling. Someone had been in the center toilet when they hit the turbulence. There the whole ceiling had gone—the passenger's head had simply smashed through it. I'd never seen a plane in such a state before. It was a wreck." He flew the plane back at 8,000 feet, 24,000 feet below normal cruising altitude, following a course from island to island, with the landing gear down.

The forces that produced this devastation—and injured 47 people aboard—must have been immense. In accordance with the Airbus policy, no one ever did more than "visually inspect" the tail.

There was something else in Plane 053's history that may have weakened it. It should have been the first of American Airlines' 35 A300-600s to enter service. In fact, it was the seventh. The reason for the delay was a manufacturing error discovered before the plane was delivered. In one of the lugs, a layer of composite had been allowed to kink, instead of lying flat against the layers on either side. In effect, here was serious delamination before the first flight. To fix the problem, Airbus attached an extra slab of composite, riveted to the original lug.

It may not be coincidence that this is one of the places where Flight 587's tail ripped from the fuselage. "Repairs may be quite unreliable," Williams says. His tests have shown that, depending on how it's done, riveting a patch to a weakened section, as Airbus did with Plane 053, will result in a part with anywhere from 20 to 90 percent of its original design strength. Williams says, "If you have a repair method, you need to have a way of checking how strong it is. The only way to do that safely is through destructive testing: to have a good technician fabricate a repair scheme and have it loaded to destruction many times."

"Given the number of unanswered questions right now, I just don't feel comfortable flying the A300-600," says pilot Jason Goldberg.

The safety board has said that Flight 587's tail bears the signs of extensive delamination—but the board adds that it is unclear "whether this occurred before impact or as a result of impact." After the crash, American Airlines used ultrasound to test the lugs from a second A300-600, which came close to crashing near West Palm Beach, Florida, in 1997. The test of this particular tail revealed considerable delamination prompting American to order a new tail for this plane. Visual inspections had not found any sign of this damage in either of these aircraft.

In Professor Williams's view, designers of passenger jets must make it easier for any vital parts made of composites to be inspected safely with ultrasound. He isn't alone in that view. In an official NASA report on composites, engineers Charles Harris and Mark Shuart agree that nondestructive "inspectability" is essential.

The strange thing is that the F.A.A. has stipulated that the composite tails of later Airbus models do require regular ultrasound testing. On March 11, 2002, the F.A.A. ordered A320 operators to examine their tails with ultrasound every 1,100 flights. The designs of A320 and A300600 tails are very similar.

With each successive new model, Airbus is relying more and more on composites. In its A380 superjumbo, a huge, double-decker plane now being built, which will have a capacity of 555 passengers, not just the tail but large parts of the wings and engines, and most of the fuselage, will be made of composites. I asked Airbus whether an ability to undergo ultrasound testing was part of its design. Du Piech, the Airbus spokesman, said he could not answer this question, and promised to arrange an interview with a design engineer. He failed to do so. He continues to maintain that the Airbus A300-600 tail is made so strong that such testing is unnecessary, adding that the only important question is why Flight 587 was flown in a manner that imposed loads beyond the plane's design limits. (In fact, as Lopatkiewicz of the N.T.S.B. confirms, the safety board has not yet established whether the tail did snap off beyond those limits—establishing that is the "$64,000 question," he says.) But why did the F.A.A. approve the visual-inspection regime? Spokesman Les Dorr says, "You're talking about an aircraft that was originally certified in France—by the certification authority of a major manufacturing country. They gave us the data and we accepted it. You really need to go back to the French."

For the time being, the crash of Flight 587 remains a mystery. Where was the start of the catastrophic chain? While the N.T.S.B. continues to guard the full flight-data record, there are few clues.

Some may come from eyewitnesses. In Rockaway, those who saw the crash say the N.T.S.B. has largely ignored them. As former board member Vernon Grose says, crash investigators need to be cautious with this kind of testimony. At the same time, "the automatic rejection of eyewitness accounts is unwise. If 40 people are saying roughly the same thing, you can't conclude they have no validity."

In and around Rockaway, 180 people are saying much the same thing—that they saw a thick smoke trail or, in most cases, livid fire coming from Flight 587 sometime before it crashed. One is John Power, who was walking with his wife in a nature preserve on the north side of Jamaica Bay, and who says he observed the plane for 25 to 30 seconds before it crashed. He saw a thick trail of smoke coming from the right-hand side. The plane seemed to be "skidding," its nose out of alignment with the direction of flight. Finally, he says, he saw the jet, with its tail still intact, perform a series of rolls, spins, and other gyrations.

Michael Benjamin, who works in Albany for the New York State Assembly, was driving south toward Jamaica Bay with his family. "My daughter screams, 'Dad! Look up!' There was a huge, roaring fire coming out of the plane on the right side by the wing. We started screaming because it was the most horrific thing. I was hoarse for two days." James Conrad, a newly retired police lieutenant, saw the plane from the Rockaway end of the Marine Parkway Bridge. He saw what looked like "an explosion, orange flame_The plane was fully enveloped." Some of the witnesses who say they saw the plane smoking or burning in the air have worked as professional firefighters. One is Tom Lynch, also a former air-force mechanic. Another is Peter Hayden—a deputy fire chief with the New York City Fire Department.

If the plane was on fire, it raises further questions. What started it? Was it the primary or a secondary cause of the crash? Meanwhile, the board has released data suggesting that before any of the rudder movements the cockpit voice recorder picked up two periods of "airframe rattling" noises. Were these the sounds of a plane starting to shake itself apart, already refusing to respond to its controls? For now, the only certainty is loss: a widow and two sons in Plainsboro, New Jersey; a family in Greenwich; dozens of Dominican families in America and Santo Domingo.

Some American Airlines A300-600 pilots are voting with their feet. Captain Tamburini has already managed to get himself transferred to Boeing 767s. Others are hoping to follow.

Jason Goldberg has started the 767 training course. The Boeing is a smaller plane, and the move means a 7 percent pay cut. Retraining is a huge inconvenience: he has a son aged five, and spending six weeks at flight school in Dallas means child-care arrangements of some complexity. "Given the number of unanswered questions right now, I just don't feel comfortable flying the A300-600," he says. "I had thought I'd be flying the Airbus for the rest of my career, but there you are.

I don't want to sound dramatic, but it's just how I feel."