Boeing 737 rudder issues

Top: Boeing's original rudder design for the 737 with the single servo valve seen in yellow.
Bottom: Boeing's redesigned version with an added redundant valve seen in blue.

During the 1990s, a series of rudder issues on Boeing 737 aircraft resulted in multiple incidents. In two separate accidents, pilots lost control of their Boeing 737 aircraft due to a sudden and unexpected movement of the rudder, and the resulting crashes killed everyone aboard. A total of 157 people aboard the two aircraft were killed.^[1] Similar rudder issues led to a temporary loss of control on at least one other Boeing 737 flight before the problem was ultimately identified. The National Transportation Safety Board ultimately determined that the accidents and incidents were the result of a design flaw which could result in an uncommanded movement of the aircraft's rudder.^[2]:13[3]:ix The issues were resolved after the NTSB identified the cause of the rudder malfunction and the Federal Aviation Administration ordered repairs for all Boeing 737 aircraft in service.

Rudder function

Unlike other twin-engine large transport aircraft in service at the time, the Boeing 737 was designed with a single rudder panel and single rudder actuator.^[2]:14 The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU).^[2]:13 Inside the PCU is a dual servo valve which, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder.^[2]:19 The PCU for affected Boeing 737 aircraft was designed by Boeing and manufactured by Parker Hannifin.^[2]:20

First accident and investigation

On March 3, 1991, United Airlines Flight 585, a Boeing 737-200, crashed while attempting to land in Colorado Springs, Colorado. During the airplane's landing approach, the plane rolled to the right and pitched nose down into a vertical dive.^[2]:ix The resulting crash destroyed the aircraft and killed all 25 people on board.^[2]:ix

Although the NTSB investigated the accident, it was unable to conclusively identify the cause of the crash. The rudder PCU from Flight 585 was severely damaged, which prevented operational testing of the PCU.^[3]:47 A review of the flight crew's history determined that Flight 585's captain strictly adhered to operating procedures and had a conservative approach to flying.^[3]:47 A first officer who had previously flown with Flight 427's captain reported that the captain had indicated to him while landing in turbulent weather that the captain had no problem with declaring a go-around if the landing appeared unsafe.^[3]:48 The first officer was considered to be "very competent" by the captain on previous trips they had flown together.^[3]:48 The weather data available to the NTSB indicated that Flight 585 might have encountered a horizontal axis wind vortex that could have caused the aircraft to roll over, but this could not be shown conclusively to have happened or to have caused the rollover.^[3]:48–49

On December 8, 1992, the NTSB published a report which identified what the NTSB believed at the time to be the two most likely causes of the accident. The first possibility was that the airplane's directional control system had malfunctioned and caused the rudder to move in a manner which caused the accident. The second possibility was a weather disturbance that caused a sudden rudder movement or loss of control. The Board determined that it lacked sufficient evidence to conclude either theory as the probable cause of the accident.^[2]:ix[3]:49 This was only the fourth time in the NTSB's history that it had closed an investigation and published a final aircraft accident report where the probable cause was undetermined.^[4]

Second accident and Eastwind incident

On September 8, 1994, USAir Flight 427, a Boeing 737-300, crashed near Pittsburgh, Pennsylvania. While on approach to Pittsburgh International Airport, Flight 427 suddenly rolled to the left. Although the pilots were briefly able to roll right and level the plane, it pitched left a second time and the pilots were unable to recover.^[3]:4 The resulting crash killed all 132 people on board.^[3]:9 The NTSB realized early into its investigation that Flight 427 might have been caused by an unintended or uncommanded rudder movement, similar to the suspected (but not yet established) cause of the Flight 585 crash.^[3]:44 As a result, the NTSB conducted additional testing on United Flight 585's PCU servo during its Flight 427 investigation.^[2]:73

One of the problems facing investigators was the relative lack of precision in the data produced by the Flight Data Recorder (FDR) which only recorded control inputs at periodic intervals with significant time gaps between samples, gaps during-which no data was recorded no matter what the pilot did with the controls. This lack of precision led to it being possible for Boeing to interpret the data differently from the way the NTSB did, leading the manufacturer to suspect and insist that the pilot had responded incorrectly to a wake turbulence incident. ^[5]

At the request of the NTSB, data from the Penny & Giles Quick Access Recorder - "QAR" - of a British Airways (BA) Boeing 747-400 London-Bankok flight in which the aircraft had suffered an un-commanded elevator movement and momentary elevator reversal on take-off, the aircraft then continuing its flight and landing safely, was supplied to the NTSB by BA. Unlike a standard FDR, the QAR sampled control input data at much shorter time intervals, as well as sampling and recording many more other aircraft parameters.^[6] This BA data led to renewed suspicion of the similar valve design used on the 737 rudder. As a result of this earlier BA incident Boeing had in fact modified the design of the 747 elevator servo system, and the modified system had been retroactively fitted to all 747-400's in service. ^[7]

On June 9, 1996, while the NTSB's investigation of Flight 427 was still ongoing, the pilots of Eastwind Airlines Flight 517 briefly lost control of their aircraft while flying from Trenton, New Jersey to Richmond, Virginia.^[2]:ix The aircraft experienced two episodes of rudder reversal while on approach to land in Richmond. Unlike the two prior incidents, the rudder issues on Flight 517 spontaneously resolved and the pilots were able to safely land the aircraft, and none of the 53 people aboard were injured.^[3]:51

The NTSB investigated the Eastwind incident, and incorporated information from both United Flight 585 and Eastwind Flight 517 into its ongoing investigation of the Flight 427 crash.^[3]:44

Renewed investigation and conclusions

Because Eastwind Flight 517 had landed safely, the NTSB was also able to perform tests on a plane that had experienced problems similar to the accident aircraft. In addition, because the pilots of Flight 517 had survived, the NTSB was able to interview them and gain additional information on their experience. The flight's captain told the NTSB in a post-accident interview that they had not encountered any turbulence during the flight, and that during their landing descent he felt the rudder "kick" or "bump" even though neither pilot had moved the rudder pedals.^[3]:51 When the plane abruptly rolled to the right, the captain applied left aileron and attempted to move the rudder, but the rudder pedal controls felt stiffer than normal and did not seem to respond to his input.^[3]:51

The NTSB and Boeing engineers conducted a series of tests on the PCUs from Flight 517 and Flight 427, as well as PCUs used in other aircraft and a brand-new PCU that had not yet been used in flight.^{[3]:71,81–85} Testing revealed that under certain circumstances, the PCU's dual servo valve could jam and deflect the rudder in the opposite direction of the pilots' input.^[3]:81–85 Thermal shock testing revealed that the uncommanded rudder movement could be replicated by injecting a cold PCU with hot hydraulic fluid. Thermal shock resulted in the servo's secondary slide becoming jammed against the servo housing, and that when the secondary slide was jammed the primary slide could move to a position that resulted in rudder movement opposite of the pilot's commands.^{[2]:79[3]:294} The NTSB concluded that all three rudder incidents (United Flight 585, USAir Flight 427, and Eastwind Flight 517) were most likely due to the PCU secondary slide jamming and excessive travel of the primary slide, resulting in the rudder reversal.^[3]:294

On March 24, 1999, after a four-year investigation, the NTSB issued its probable cause finding for Flight 427. The NTSB concluded that the probable cause of the Flight 427 crash was rudder reversal due to the PCU servo malfunction.^[3]:295 Two years later, the NTSB published an amended accident report for Flight 585 which found the same probable cause for that accident as well.

As a result of the NTSB's findings, the Federal Aviation Administration ordered that the servo valves be replaced on all 737s by November 12, 2002.^[8] The FAA also ordered new training protocols for pilots to handle in an unexpected movement of flight controls.

Other suspected 737 rudder PCU malfunctions

The following Boeing 737 aircraft incidents were also suspected of being caused by a rudder PCU malfunction:

• On June 6, 1992, Copa Airlines Flight 201, a 737-200 Advanced, flipped and crashed into the Darién Gap jungle, killing 47 people. Investigators initially believed that the airplane experienced a rudder malfunction, but after an exhaustive and extensive inquiry, they concluded that the crash was caused by faulty instrument readings.
• On March 8, 1994, a Sahara Airlines aircraft that had 3 trainees and one supervising pilot on board crashed after performing a "Touch-and-go landing" at New Delhi Airport, and slammed into a Russian jet. The four pilots were killed, as were five ground workers. Although the repairs done to the PCU were not with authorized parts, the incident is still thought to be in part due to the plane's rudder reversing both right and left.^[9][10]
• On April 11, 1994, Continental Airlines pilot Ray Miller reported his aircraft rolled violently to the right and continued to pull to the right for another 18 minutes; the Boeing 737-300 landed safely. Continental removed the flight data recorder and rudder PCU from the incident aircraft and provided them to Boeing for investigation. Boeing concluded that the rudder had inadvertently moved due to an electrical malfunction, but only 2.5 degrees and for less than two minutes in total, a finding disputed by Miller.^[9]
• On February 23, 1999, MetroJet Flight 2710, a 737-200, experienced a slow deflection of the rudder to its blowdown limit while flying at 33,000 feet above Salisbury, Maryland. While a rudder malfunction was suspected, the aircraft was an older 737 and its flight data recorder only recorded 11 flight parameters, compared to the hundreds of parameters recorded by newer aircraft. NTSB chairman Jim Hall said that the investigation was "hampered by the lack of basic aircraft data."^[11][12]

SilkAir lawsuit

On December 19, 1997, SilkAir Flight 185 crashed in Indonesia, killing 104 people. Because the crash involved a Boeing 737-300 rolling and diving toward the ground at a steep angle, investigators considered the possibility of rudder hardover due to PCU servo malfunction.^[13] The Indonesian National Transportation Safety Committee, the lead investigating agency, concluded in its December 14, 2000 final report that it had found "no evidence to explain the cause of the accident."^[14]:24 However, on the same day the U.S. NTSB, which also participated in the investigation, issued its own final report which contradicted the Indonesian NTSC findings.^[14]:24–25 The NTSB's report found that there was sufficient evidence to rule out mechanical failure (based on examinations of the suspected PCU/dual-servo unit recovered from the SilkAir crash), and that the probable cause of the accident was "intentional pilot action" by a pilot, most likely the captain, intentionally crashing the aircraft by applying sustained nose-down control pressure.^{[14]:24–25[15]}

In 2004, following an independent investigation of the recovered PCU/dual-servo unit, a Los Angeles jury, which was not allowed to hear or consider the NTSB's conclusions about the accident, ruled that the 737's rudder was the cause of the crash, and ordered Parker Hannifin, a rudder component manufacturer, to pay US$44 million to the plaintiff families.^[16] Parker Hannifin subsequently appealed the verdict, which resulted in an out-of-court settlement for an undisclosed amount.

In popular culture

The Discovery Channel Canada / National Geographic TV series Mayday (also called Air Crash Investigation or Air Disasters) dramatized the NTSB's 737 rudder investigation in a 2007 episode titled Hidden Danger (broadcast in some countries as Mystery Crashes).^[4]

Mayday separately dramatized the SilkAir crash investigation and lawsuit, including its connection to the 737 rudder controversy, in a 2012 episode titled Pushed to the Limit (broadcast in some countries as Pilot Under Pressure).^[13]

References

External links

• How the 737 rudder works
• Boeing 737 Rudder Design Study