Flight with disabled controls

Throughout a normal flight, a pilot controls an aircraft through the use of flight controls including maintaining straight and level flight, as well as turns, climbing, and descending. Some controls, such as a "yoke" or "stick" move and adjust the control surfaces which affects the aircraft's attitude in the three axes of pitch, roll, and yaw. Other controls include those for adjusting wing characteristics (flaps, slats, spoilers) and those that control the power or thrust of the propulsion systems. The loss of primary control systems in any phase of flight is an emergency. Aircraft are not designed to be flown under such circumstances; however, some pilots faced with such an emergency have had limited success flying and landing aircraft with disabled controls.

Control system failures resulting in disabled controls have resulted in a number of aviation incidents and accidents. Some incidents occurred where controls were not functioning correctly prior to take-off, others where the failure developed during flight. A loss of control can occur when an unrelated failure, such as an engine failure, causes damage to control related systems. For instances, in several incidents an engine broke apart, causing the failure of main and redundant hydraulic systems, which disabled all control surfaces. Some or all controls can become inoperative from extreme weather conditions, due to collisions, due to poor maintenance or mistakes made by maintenance workers, as a result of pilot error, due to failures of the flight control system, or due to design or manufacturing flaws.

In normal flight, maneuvering an aircraft requires some combination of controls, which are often interactive in their effect.

• For instance, to climb to a higher altitude, the pilot can increase thrust which will cause the aircraft to climb while maintaining airspeed.
  • Alternately, the pilot may climb by pitching the aircraft up, though in this case airspeed decreases.
• Normally to make a turn, the pilot banks left or right by adjusting the ailerons on the wings to increase lift on one wing, and decrease lift on the other. The asymmetric lift causes asymmetric drag, which causes the aircraft to yaw adversely. To correct the yaw, the pilot uses the rudder to perform a coordinated turn.
  • In a multi-engined aircraft, the loss of thrust in one engine can also cause adverse yaw, and here again the rudder is used to regain coordinated flight.

A basic means of controlling an aircraft with disabled flight controls is making use of the position of the engines. If the engines are mounted under the centre of gravity, as in underwing passenger jets, then increasing the thrust will raise the nose while decreasing the thrust will lower it. This control method may call for control inputs that go against the pilot's instinct: when the aircraft is in a dive, adding thrust will raise the nose and vice versa.

Additionally, asymmetrical thrust has been used for directional control: if the left engine is idled and power is increased on the right side this will result in a yaw to the left, and vice versa. If throttle settings allow the throttles to be shifted without affecting the total amount of power, then yaw control can be combined with pitch control. If the aircraft is yawing, then the wing on the outside of this yaw movement will go faster than the inner wing. This creates higher lift on the faster wing, resulting in a rolling movement, which helps to make a turn.

Controlling airspeed has been shown to be very difficult with engine control only, often resulting in a fast landing. A faster than normal landing also results when the flaps cannot be extended due to loss of hydraulics.

Another challenge for pilots who are forced to fly an aircraft without functioning control surfaces is to avoid the phugoid instability mode (a cycle in which the aircraft repeatedly climbs and then dives), which requires careful use of the throttle.

Because this type of aircraft control is difficult for humans to achieve, researchers have attempted to integrate this control ability into the computers of fly-by-wire aircraft. Early attempts to add the ability to real aircraft were not very successful, the software having been based on experiments conducted in flight simulators where jet engines are usually modelled as "perfect" devices with exactly the same thrust on each engine, a linear relationship between throttle setting and thrust, and instantaneous response to input. More modern computer systems have been updated to account for these factors, and aircraft have been successfully flown with this software installed.^[1] However, it remains a rarity on commercial aircraft.

Incidents where disabled, damaged, and/or failed control systems were a significant or primary cause of the accident.

In these incidents, a failure of propulsion systems (engine, fan, propeller, pumps) caused damage to control systems. (Engine mounting failures are covered under structural failures, below).

• Eastern Air Lines Flight 935, a Lockheed L-1011 TriStar, on September 22, 1981. Suffered an uncontained failure of the No. 2 engine on takeoff from Newark, New Jersey. The crew were able to land the aircraft safely at John F. Kennedy International Airport with some limited use of the outboard spoilers, the inboard ailerons and the horizontal stabilizer, plus the differential engine power of the remaining two engines.^[2]

• Reeve Aleutian Airways Flight 8, a Lockheed L-188 Electra, on 8 June 1983. Flying over Cold Bay, Alaska, the plane's number 4 engine propeller detached itself from the engine and cut a hole in the plane as it flew underneath it. The resultant damage inflicted by the propeller caused an explosive decompression, severed cables connected to the plane's throttles and control surfaces and left the flight deck crew of three with only autopilot that had no lateral control. After managing to wrench the ailerons and elevators into minimal working condition, the crew tried to land at Anchorage at high speed. They had to make a go-around, but landed on the second attempt, saving all 10 passengers on board.^[3]

• LOT Polish Airlines Flight 5055, an Ilyushin Il-62M, on 9 May 1987. According to the Polish investigatory commission, the cause of the crash was the disintegration of an engine shaft due to faulty bearings inside engine No. 2, which seized, causing extensive heat. This in turn caused the consequent damage to engine No. 1, rapid decompression of the fuselage, and a fire in the cargo hold, as well as the loss of elevator controls and progressive electrical failures. Zygmunt Pawlaczyk decided to return to Warsaw Okecie Airport using only trim tabs to control the flight of the aircraft. He lost his struggle to land about 5 km from the runway in the Kabacki Forest. All 172 passengers and 11 crew members perished.^[4]

• United Airlines Flight 232, a McDonnell Douglas DC-10, on 19 July 1989. A fan disk in the No. 2 engine fractured, severing most of the flight controls. Dennis Fitch, a deadheading DC-10 instructor who had studied the case of JAL Flight 123, was able to help the pilots steer the aircraft using throttle differential. Despite the break-up of the aircraft on landing, 175 of 285 passengers and 10 of the 11 crew members survived.^[5]
• Baikal Airlines Flight 130, a Tupolev Tu-154, on 3 January 1994. When starting the engines before takeoff, the pilots noticed a warning light signaling dangerous rotation of the starter in engine #2. Believing the warning to be false, they decided to take off anyway. During the initial climb, the starter failed and a fire broke out in the #2 engine. The fire damaged all three hydraulic lines, rendering the plane uncontrollable. After 12 minutes of the crew trying to control the sliding trajectory of the plane, it eventually crashed into a dairy farm near Mamony town at 500 km/h, killing all 124 people aboard and one man on the ground.^[6]

In these incidents, a failure of structural components (bulkheads, doors, struts, mounts, spars, hull) subsequently damaged control systems.

• American Airlines Flight 96, a McDonnell Douglas DC-10, on 12 June 1972. The failure of the rear cargo door caused an explosive decompression, which in turn caused the rear main cabin floor to collapse and severed flight controls. The pilots had only limited ailerons and elevators; the rudder was jammed. The number two engine also ran down to idle at the time of decompression. The aircraft landed safely at Detroit-Metropolitan Airport.^[7]

• Turkish Airlines Flight 981, a McDonnell Douglas DC-10, on 3 March 1974. Similar to American Airlines Flight 96, the flight experienced an explosive decompression, when flying over the town of Meaux, France, caused by a rear cargo door failure. The rear main cabin floor collapsed and severed all flight controls. While the plane went into a vertical dive, the captain called for "Speed!" meaning increasing engine thrust to pull the plane's nose up. The plane began to level out, but had lost too much altitude and slammed into the Ermenonville Forest. All 346 people on board were killed upon impact, and it became the worst single aircraft disaster without survivors, and the fourth deadliest aviation death count ever.^[8]

• Delta Air Lines Flight 1080, a Lockheed L-1011 Tristar, on April 12, 1977, suffered a structural failure of a bearing assembly controlling the aircraft's left stabilizer, which caused it to jam in a full trailing edge up configuration. The plane pitched violently upwards and the pilots could not counteract the pitching force even when pressing the control column fully down. This caused the plane to lose speed rapidly and nearly stall. The pilot managed to regain control by using the Tristar's tail engine at maximum power and lowering the thrust on the wing engines in order to generate differential thrust. The airliner landed at Los Angeles International Airport, with all 41 passengers and 11 crew being unharmed.^[9]

• American Airlines Flight 191, a McDonnell Douglas DC-10, on 25 May 1979. The failure of the #1 engine mounting pylon and subsequent separation of the engine from the aircraft resulted in severed hydraulic lines and electrical system damage. The left wing slats retracted due to the loss of hydraulic pressure and aerodynamic forces, while the right wing slats remained extended. The damaged electrical system prevented the slat retract indicators and stick-shaker on the yoke from functioning, so the crew was not alerted to the slat retraction nor impending stall. All 271 on board were killed, as well as two on the ground at O'Hare International Airport in Chicago, Illinois.

• Japan Airlines Flight 123, a Boeing 747, on 12 August 1985. A faulty repair years earlier had weakened the aircraft's rear pressure bulkhead, which failed in flight. The vertical stabilizer and much of the aircraft's empennage was blown off during the decompression. The decompression also ruptured all four hydraulic lines which controlled the aircraft's mechanical flight controls. The pilots were able to continue flying the aircraft with very limited control, but after 32 minutes the aircraft crashed into a mountain, killing 520 of the 524 people aboard in the deadliest single aircraft disaster in history.^[10]

• American Airlines Flight 587, Airbus A300, November 12, 2001. This was the second-deadliest aviation accident in U.S. history, with 251 passengers and 9 crew members killed, as well as five people on the ground. According to the NTSB, the aggressive use of the rudder controls by the first officer stressed the composite vertical stabilizer until it separated from the aircraft. The complete loss of the vertical stabilizer meant the loss of all rudder control. As the pilots struggled to control the aircraft, it entered a flat spin. The resultant forces caused the engines to separate from the aircraft, and it slammed into the ground 14 seconds later.

• Air Transat Flight 961, an Airbus A310, on 6 March 2005, catastrophic structural failure: the rudder detached from the aircraft with a loud bang and the aircraft began a dutch roll. The pilots regained enough control, albeit with difficulty on controlling the aircraft laterally, to land the aircraft safely at Varadero-Juan Gualberto Gomez Airport.^[11]

In these incidents, there was a failure of control system components themselves (e.g. cables, hydraulics, flaps, slats, ailerons, rudder, stabilizer, trim tabs, auto-pilot). (Control system fatigue failures are here, but improperly installed or incorrectly adjusted controls in the next section).

• United Airlines Flight 585, Boeing 737, March 3, 1991. The hydraulic servo that controlled the rudder had an un-commanded actuation, resulting in a "hardover" where the rudder unexpectedly reversed. All 20 passengers and 5 crew members were killed when the pilots were unable to regain control, and the aircraft slammed into the ground and exploded.

• USAir Flight 427, Boeing 737, September 8, 1994. A second rudder hardover crash killed all 127 passengers and five crew members on board.

• Eastwind Airlines Flight 517, Boeing 737-200, June 9, 1996. A third rudder hardover incident. This time, the crew were able to regain control and land the aircraft successfully. All 53 occupants on board the 737-200 survived with one flight attendant injured. This flight was instrumental in resolving the cause of the 737 rudder issues, because it was the first flight to land safely, allowing investigators to interview the pilots and study the aircraft.

• Alaska Airlines Flight 261, a McDonnell Douglas MD-80, on January 31, 2000. The acme nut/jack screw assembly, which adjusted the pitch of the horizontal stabilizer, failed. As a result, the pilots lost control of aircraft pitch, and the flight crashed into the Pacific Ocean killing all 5 crew and 83 passengers on board.

• Northwest Airlines Flight 85, a Boeing 747-400, on 9 October 2002. Midway through a flight from Detroit Metropolitan Wayne County Airport to New Tokyo International Airport, the aircraft suffered a rudder hardover event due to metal fatigue, jamming the lower rudder fully to the left. By manipulating the upper rudder, the crew was able to perform a successful landing at Ted Stevens Anchorage International Airport with no loss of life.

• Air Moorea Flight 1121, a de Havilland Canada DHC-6 Twin Otter, on 9 August 2007. Deterioration of the elevator cable from frequent takeoffs and landings, and likely jet-blast from larger aircraft, caused the cable to snap one minute after takeoff. The plane then nosedived and crashed into the ocean near Moorea-Temae Airport soon afterwards, killing all 19 passengers and the sole pilot.

In these incidents, the failure of control system components was caused by improper installation or adjustment of control systems components by maintenance personnel.

• Air Astana Flight 1388, an Embraer ERJ-E190, November 11, 2018. The aircraft suffered severe control issues from an incorrectly installed aileron cable shortly after taking off from Alverca Air Base, Portugal. The flight crew struggled to control the plane for about 90 minutes. During that period, they lost control of their aircraft multiple times but found they could gain more control by activating direct mode for flight controls which disconnects the FCM (flight control module). This greatly increased controllability of the pitch and yaw-axes, but control of the roll axis was still limited. After 90 minutes and two unsuccessful landing attempts, the flight crew managed to land the plane at Beja Airport. Everyone aboard survived the incident, but one suffered a leg injury.^[12]

• Emery Worldwide Airlines Flight 17, a McDonnel Douglas DC-8, February 16, 2000. Crashed shortly after taking off from Sacramento Mather Airport. The crash killed all three crew members. The investigation found that a control rod to the right elevator control tab detached, causing a loss of pitch control while taking off. The disconnection was caused by the failure to properly secure and inspect the attachment bolt during prior maintenance.

• Air Midwest Flight 5481, a Beechcraft 1900D, on 8 January 2003. On takeoff from Charlotte/Douglas International Airport, the aircraft pitched up and stalled, despite the captain attempting to push the yoke for full elevator down. The aircraft smashed into a US Airways hangar 37 seconds later, killing all 21 passengers and crew aboard and injuring one person on the ground. The NTSB found out that the plane had been overweight and that during maintenance, the tension turnbuckles that governed elevator movement had been set incorrectly by an inexperienced mechanic. This caused the elevators to lose control authority upon takeoff.^[13]

• Philippine Airlines Flight 434, a Boeing 747, on 11 December 1994. The hydraulics were damaged by a bomb in the passenger cabin.^[14]

• DHL shootdown incident in Baghdad on 22 November 2003. The Airbus A300 DHL aircraft, hit by a surface-to-air missile, was the first jet airliner to land safely without any hydraulics using only engine controls.^[15]

In these incidents, pilot error resulted in control system damage.

• Pan Am Flight 845, a Boeing 747, on 30 July 1971. When taking off from San Francisco International Airport, the plane struck the approach lighting system after taxiing onto a much too short runway. After the impact, the plane continued into the takeoff roll, though its fuselage, landing gear, and 3 out of 4 hydraulic systems were badly damaged. After making a full circle over the Pacific Ocean for an hour and 42 minutes and dumping fuel, the plane made a hard emergency landing at San Francisco, ending on its tail. All 218 passengers survived with a few minor injuries.^[16]

• Aerosucre Flight 157, a Boeing 727-2J0F, on 20 December 2016. The plane was overweight and in an incorrect takeoff configuration when it took off from Germán Olano Airport, where it overran the runway and struck a perimeter fence, a tree and a sentry box. The 727 also crossed a road, almost killing several people on the ground who narrowly avoided being struck by it before becoming airborne. The plane lost its right main landing gear, power from engine 3, and all of its hydraulic systems, as well as having damage to the inboard right flap. The plane struggled to maintain flight as it entered a right turn before crashing into the ground. Initially, 2 out of the six people on board survived, but one later died of his injuries.^[17][18]

• American Airlines Flight 587, Airbus A300, November 12, 2001. A pilot's excessive rudder inputs caused the vertical stabilizer to fracture and separate from the aircraft. See complete entry in structural failures above.

These incidents describe mid-air collisions that mainly damaged control systems of at least one of the aircraft, which may or may not have been recoverable.

• Eastern Air Lines Flight 853, December 4, 1965: collision with TWA Flight 42. Flight 853, a Lockheed Super Constellation, collided with Flight 42, a Boeing 707, damaging the 707's wing and the Constellation's tail. The damage to Flight 853 left the Constellation controllable only by adjusting the throttles. Despite the damage, the crew was able to perform a crash landing on a mountain, with 50 of the 54 occupants surviving the crash. The captain survived the crash and escaped, but died trying to save a passenger who remained in the wreckage. The 707 made a successful emergency landing at John F. Kennedy International Airport.

• Pacific Southwest Airlines Flight 182, September 25, 1978. The Boeing 727 collided with a Cessna 172 single engined aircraft over San Diego, CA. The damage to the 727's right wing control surfaces and control system hydraulics made the aircraft uncontrollable. All 135 people aboard the 727, both pilots in the Cessna, and 7 people on the ground were killed, for a total of 144 fatalities.
• Aeroméxico Flight 498, August 25, 1986, McDonnell Douglas DC-9. In an accident strikingly similar to PSA 182, a private, single engined Piper Cherokee Archer strayed into the TCA control area, and collided with the DC-9's vertical stabilizer, separating it and much of the rudder. Without the vertical stabilizer, the DC-9 entered an inverted dive and slammed into a residential area, killing all 58 passengers and 6 crew, plus 15 fatalities on the ground. The pilot and two passengers in the Piper were decapitated when they slammed into the DC-9's vertical stabilizer. This incident and PSA 182 led to the creation of tightly regulated Class B airspace around the nation's busiest airports.

• On 4 April 1975, A Lockheed C-5 Galaxy (registered as 68-0218) making the first flight of Operation Babylift, had the failure of the rear loading ramp, causing the cargo door to open explosively. This caused an explosive decompression, and in turn, severed control cables to the tail, causing two of four hydraulic systems to fail, including those for the rudder and elevator, and leaving the flight control with only the use of one aileron, spoilers, and power. The crew had to wrestle at the controls by adjusting the power setting and using the remaining one aileron and spoilers in order to return to Tan Son Nhut Air Base, but ended up crash landing in a rice paddy, killing 138^[b] of the 314 people on board.^[19][20]

• On 20 December 1943, a Boeing B-17F Flying Fortress of the 527th Bombardment Squadron was tasked with carrying out a bomb run on Bremen, Germany in formation with other B-17Fs. Before the bomber released its bomb load, accurate flak shattered the Plexiglas nose, knocked out the #2 engine and further damaged the #4 engine, which was already in questionable condition and had to be throttled back to prevent overspeeding. This caused the plane to fall back from the formation and left it vulnerable to enemy attack. The B-17F was then attacked by over a dozen enemy fighters (a combination of Messerschmitt Bf 109s and Focke-Wulf Fw 190s) of JG 11 for more than ten minutes, causing the pilot to lose consciousness and putting the B-17F into a steep dive. The pilot later regained consciousness and recovered the plane from the dive. Further damage was sustained from the attack, including to the #3 engine, reducing it to only half power (meaning the aircraft had effectively, at best, 40% of its total rated power available). The bomber's internal oxygen, hydraulic, and electrical systems were also damaged, and the bomber had lost half of its rudder and port elevator, as well as its nose cone. The crew on board were also wounded with one of them being killed. After being escorted by a Luftwaffe Messerschmitt Bf 109 G-6 to be out of German airspace, the B-17F landed at RAF Seething.^{[21][22][23][24]}

• On 1 February 1943, the All American B-17F was in formation with other bombers of the 414th Bombardment Squadron to return to their base near Biskra, Algeria when two Messerschmitt Bf 109s attacked the lead bomber and the All American. The first was downed by the bombers but the second continued its attack while flying towards the All American until its pilot was shot dead by machine gun fire and collided with the All American, making the bomber have its left horizontal stabilizer sheared off and leaving a huge hole at the tail section. The only thing holding the B-17F together is the metal frame connecting the tail section and the rear gunner.^[25][26][27] This caused the rudder, electricals, oxygens systems to be damaged, losing the tail wheel and having only one operating elevator cable when the other control cables were destroyed.^[28] Despite the mid-air collision, none of the crew on board were injured and the B-17F still remained airborne. The other bombers slowed down to maintain formation with the All American to protect it from potential attacks from other Messerschmitt Bf 109s, which never happened. The B-17F managed to land back at the base with the tail section dragging the landing strip.^[26]

On October 10, 1928, U.S. Army photographer Albert William Stevens and Captain St. Clair Streett, the chief of the U.S. Army Air Corps Materiel Division's Flying Branch, flew the XCO-5 experimental biplane to achieve an unofficial altitude record for aircraft carrying more than one person: 37,854 feet (11,538 m); less than 1,000 feet (300 m) short of the official single-person altitude record.^[29] Stevens snapped photographs of the ground below, warmed by electrically heated mittens and many layers of clothing. At that height the men measured a temperature of −78 °F (−61 °C), cold enough to freeze the aircraft controls.^[30] When Stevens was finished with his camera, Streett found that the aircraft's controls were rendered immobile in the cold, with Streett unable to reduce throttle for descent. The aircraft's engine continued to run at the high power level necessary for maintaining high altitude. Streett contemplated diving at full power, but the XCO-5 was not built for such strong maneuvers—its wings could have sheared off. Instead, Streett waited until fuel was exhausted and the engine sputtered to a stop, after which he piloted the fragile aircraft down in a gentle glide and made a deadstick landing.^[30] An article about the feat appeared in Popular Science in May 1929, entitled "Stranded—Seven Miles Up!"^[30]

• The aircraft designer Roy Chadwick was killed on 23 August 1947 during a crash on take-off of the prototype Avro Tudor 2, G-AGSU, from Woodford airfield. The accident was due to an error in an overnight servicing in which the aileron control cables were inadvertently crossed.
• X-15 Flight 3-65-97, a NASA test flight piloted by Michael J. Adams, on 15 November 1967. Adams was killed after an electrical disturbance caused the degradation of flight controls in his North American X-15 upon ascent. At 230,000 feet, the X-15 entered a Mach 5 spin. Adams used the minimal manual controls he had along with backup controls to attempt an emergency landing at Rogers Dry Lake, but only served to throw the aircraft into a pilot induced oscillation and a Mach 3.93 inverted dive. The plane began to break up 10 minutes and 35 seconds after takeoff, destroying the X-15 and killing Adams instantly.^[31]

NASA personnel at Dryden Flight Research Center worked on the design of an aircraft control system using only thrust from its engines. The system was first tested on a McDonnell Douglas F-15 Eagle in 1993, piloted by Gordon Fullerton.^[32] The system was then applied to a McDonnell Douglas MD-11 airliner, and Fullerton made its first propulsion-controlled landing in August 1995.^[32] Later flights were made with the center engine at idle speed so the system could be tested using the two wing-mounted engines, simulating the more common airliner layout.^[33]