EgyptAir Flight 990

The overnight departure from New York

EgyptAir flight 990 began at Los Angeles on 30 October 1999 and stopped at New York's John F. Kennedy International Airport before its scheduled onward flight to Cairo. The Boeing 767-366ER, registered SU-GAP, had been delivered to EgyptAir in September 1989. By the accident flight it had accumulated 33,354 operating hours and 7,594 flight cycles. It carried 203 passengers, four flight crew members and ten flight attendants on the New York to Cairo leg.

The planned ten-hour flight required a command crew and a relief crew, each comprising a captain and first officer. The command crew handled departure. At about 01:20 eastern standard time on 31 October, the aircraft lifted off runway 22R. Controllers issued successive climb clearances, and at 01:35:52 New York Center cleared flight 990 to flight level 330 and directly to DOVEY intersection. The flight operated on an instrument flight rules plan in visual meteorological conditions. The captain and relief first officer had completed the required checks and training, and the NTSB found their duty and rest periods within the applicable limits.

An early change at the right seat

About twenty minutes after takeoff, the relief first officer suggested taking over from the command first officer. EgyptAir crews generally arranged their own changeovers, with the command crew commonly flying the first three or four hours. The proposed change came much earlier. The command first officer initially resisted, then agreed. Sounds of seat movement, a seat belt and conversation indicated that the relief first officer occupied the right seat at about 01:42.

The aircraft leveled at 33,000 feet at 01:44:27. At 01:47:39 the captain reported on a new radio frequency, the aircraft's last transmission to air traffic control. Shortly afterward, the relief first officer asked someone to return a pen to another first officer in the cabin. At 01:48:03 the captain said he was going to the toilet. The voice recorder captured his seat motor and then a sound resembling the cockpit door. The NTSB's examination of the recorded voices and sounds placed the relief first officer alone in the cockpit from about 01:48:19 until the captain returned.

The first descent

The autopilot disconnected at 01:49:45. The aircraft remained essentially level for about eight seconds, with only small elevator movements and a slow left roll. No disconnect warning sounded. The NTSB judged this consistent with a manual disconnect. At 01:49:53 the throttles moved from cruise power to idle, followed one second later by a sustained nose-down elevator movement. The throttle levers traveled faster and farther aft than the automatic throttle system could command. The NTSB attributed their movement to the relief first officer.

As the aircraft pitched down, its load factor fell toward zero. Further nose-down elevator movement at about 01:50:05 produced briefly negative loads. At 01:50:06 the captain returned, asking what was happening. The relief first officer continued repeating a quiet Arabic phrase translated by the recorder group as 'I rely on God.' EgyptAir and ECAA explained that Egyptians commonly used the phrase to ask God's assistance in everyday activities. The captain's questions received no explanation of the developing emergency.

At 01:50:08 the aircraft exceeded its maximum operating speed of Mach 0.86, and a warning sounded. The pitch reached about 40 degrees nose down at 01:50:15, with the wings remaining close to level. The calculated descent rate reached approximately 39,000 feet per minute at 01:50:19. Four seconds later the calculated airspeed peaked at Mach 0.99.

Recovery inputs, split elevators and engine shutdown

At 01:50:15, while the aircraft was passing about 27,300 feet, both elevators began moving toward a nose-up command. The descent rate started to decrease. The NTSB considered these movements likely to have resulted from the captain's inputs after his return. At 01:50:21 the elevators passed through neutral into nose-up positions. The right elevator then reversed toward nose down, while the left continued nose up. This split persisted through the end of the flight data recording.

Between 01:50:21 and 01:50:23, both engine start levers moved from run to cutoff, stopping the fuel supply. The levers were spring-loaded switches that required lifting out of a detent before movement. Soon afterward, the throttles advanced fully and the speedbrake handle moved to its deployed position. The captain questioned the engine shutdown and repeatedly called for the relief first officer to pull with him. The NTSB attributed the shutdown to the relief first officer and the throttle and speedbrake movements to the captain.

The flight data recorder stopped at 01:50:36.64 and the cockpit voice recorder at 01:50:38.47. The NTSB found the cessation consistent with electrical power loss following the engine shutdown. At the last recorded instant the aircraft's pitch had risen to about eight degrees nose down and its load factor to about 2.4 G. The left elevator still commanded nose up and the right commanded nose down.

The climb, second descent and recovery of wreckage

Primary radar returns continued after the recorders stopped. The NTSB combined those returns with aircraft performance calculations to reconstruct the remaining movement. The first descent ended at about 16,000 feet. The aircraft then climbed to about 25,000 feet by approximately 01:51:15, changing heading from about 80 degrees to about 140 degrees. A second rapid descent followed. The estimated ocean impact time was about 01:52:30. All 217 occupants were killed.

Two underwater debris fields lay about 1,200 feet apart, centered near 40 degrees 21 minutes north and 69 degrees 46 minutes west. The western field mainly contained the left engine and smaller pieces; the eastern field contained most of the fuselage, wings, tail, right engine and recorders. The NTSB concluded that the aircraft remained intact through the initial dive and climb, with separation occurring during the last descent. About seventy percent of the aircraft was recovered in the first operation, which ended on 22 December 1999. A further recovery in March and April 2000 brought up the left engine and additional wreckage.

Testing the elevator failure scenarios

Each outboard elevator was driven by three hydraulic power control actuators, with each actuator supplied by a separate hydraulic system. The captain's control column connected directly to the left elevator system and the first officer's to the right. Linkages and override mechanisms normally coordinated the two sides. Testing showed that opposing control column forces could activate an override and produce elevator movements in different directions.

Investigators recovered four of the six actuators. One contained a sheared spring-guide pin and a displaced spring coil. The NTSB could not determine whether those conditions preceded impact. Several recovered bellcrank assemblies also had sheared rivets. Ground tests and calculations examined four principal combinations of jams, disconnected actuator linkages and a jammed and broken control cable. Predicted elevator positions were compared with the recorded sequence. For the three actuator scenarios, the initial predicted failed-surface deflection was approximately six degrees nose down, compared with the recorded movement of about 3.6 degrees.

The NTSB ruled out the evaluated mechanical failure scenarios because their predicted movements diverged from the flight recorder data. Simulator trials involving pilots from EgyptAir, Boeing, the FAA and NTSB produced recoveries using either control column with the modeled failures. Those simulations assumed that the other pilot was not applying opposing inputs. Testing also reproduced split elevator positions with opposing pilot forces.

The recorder measured elevator positions but did not record control column positions or forces. Investigators therefore reconstructed the pilots' inputs from the aircraft movements, system tests and cockpit sounds. The simulator also did not reproduce the negative loads experienced during the dive. The NTSB evaluated that limitation and considered the recovery tests valid.

ECAA's disagreement

Egypt was the state of registry and held jurisdiction under Annex 13. At the Egyptian government's request, the NTSB assumed responsibility for the investigation, with ECAA participating through an accredited representative. ECAA's response to the NTSB draft report appears in Attachment B of the published brief. ECAA rejected the pilot-action conclusion, arguing that the investigation and analysis were incomplete and that evidence of intent or motive was absent.

ECAA emphasized the sheared and deformed elevator bellcrank rivets, including failures found on other 767 aircraft, and the unusual damage inside a recovered actuator. It argued that these abnormalities pointed to a possible elevator system defect and potential actuator jams. It also challenged the simulation and aerodynamic analysis near the speed of sound, stating that validated Boeing data extended only to Mach 0.91 while flight 990 reached approximately Mach 0.99. ECAA requested further testing and disputed the NTSB's interpretation of the elevator split as opposing pilot commands. Its response argued that high-speed aerodynamic forces required closer investigation.

The NTSB finding and safety actions

The NTSB adopted its final aircraft accident brief on 13 March 2002. It determined that flight 990 departed normal cruise and struck the Atlantic Ocean as a result of the relief first officer's flight control inputs. Its findings attributed the later elevator split to opposing inputs from the two pilots. The reason for the relief first officer's actions was not determined.

During the investigation, Boeing and the FAA examined bellcrank rivet failures across the 767 fleet. FAA directive AD 00-17-05 required a one-time functional check of elevator bellcrank shear rivets, with rework or replacement when necessary. AD 01-04-09 subsequently required repetitive elevator control testing at least every 400 flight hours and further inspections as needed. ECAA's response described its June 2000 recommendations for cockpit indications of abnormal actuator operation, examination of the control system design, and procedures for uncommanded elevator movement. The NTSB also cited recommendations A-00-30 and A-00-31 for crash-protected cockpit image recording to improve investigation evidence.