The Accidents
3 March 1991, UA585, a 737-200Adv crashed on approach to ColoradoSprings. The aircraft departed from controlled flight approximately 1,000feet above the ground and struck an open field. After a 21-monthinvestigation, the Board issued a report on the crash in December 1992. Inthat report, the NTSB said it “could not identify conclusive evidence toexplain the loss of the aircraft”, but indicated that the two most likelyexplanations were a malfunction of the airplane’s directional control systemor an encounter with an unusually severe atmospheric disturbance.
8 Sep 1994, US427, a 737-300 was approaching Pittsburgh Runway 28Rwhen ATC reported traffic in the area, which was confirmed in sight by theFirst Officer. At that moment the aircraft was levelling of at 6000ft (speed190kts) and rolling out of a 15deg left turn (roll rate 2deg/sec) with flapsat 1, the gear still retracted and autopilot and auto-throttle systemsengaged. The aircraft then suddenly entered the wake vortex of a DeltaAirlines Boeing 727 that preceded it by approx. 69 seconds (4,2mls). Overthe next 3 seconds the aircraft rolled left to approx. 18deg of bank. Theautopilot attempted to initiate a roll back to the right as the aircraftwent in and out of a wake vortex core, resulting in two loud "thumps". TheFirst Officer then manually overrode the autopilot without disengaging it byputting in a large right-wheel command at a rate of 150deg/sec. The airplanestarted rolling back to the right at an acceleration that peaked 36deg/sec,but the aircraft never reached a wings level attitude. At 19.03:01 theaircraft's heading slewed suddenly and dramatically to the left (full leftrudder deflection). Within a second of the yaw onset the roll attitudesuddenly began to increase to the left, reaching 30deg. The aircraft pitcheddown, continuing to roll through 55deg left bank. At 19.03:07 the pitchattitude approached -20deg, the left bank increased to 70deg and the descentrate reached 3600f/min. At this point, the aircraft stalled. Left roll andyaw continued, and the aircraft rolled through inverted flight as the nosereached 90deg down, approx. 3600ft above the ground. The 737 continued toroll, but the nose began to rise. At 2000ft above the ground the aircraft'sattitude passed 40deg nose low and 15deg left bank. The left roll hesitatedbriefly, but continued and the nose again dropped. The plane descended fastand impacted the ground nose first at 261kts in an 80deg nose down, 60degleft bank attitude and with significant sideslip. All 132 on board werekilled.
In 1996 the crew of an Eastwind Airlines flight 517 briefly lost control oftheir 737 as they approached Richmond, Va.
Unfortunately none of the aircraft involved had modern, highlyinformative flight data recorders, so the NTSB staff were forced to makeassumptions in developing its hypotheses.
The NTSB, FAA, Boeing, US Airways and ALPA all had different opinionsabout the cause of these accidents:
The US Air View
According to US Airways the cause was: "An uncommanded, full rudderdeflection or rudder reversal that placed the aircraft in a flight regimefrom which recovery was not possible using the known recovery procedures. Acontributing cause of this accident was the manufacturer's failure to adviseoperators that there was a speed below which the aircraft's lateral controlauthority was insufficient to counteract a full rudder deflection.".
The ALPA View
ALPA believes that the airplane experienced an uncommanded full rudderdeflection. This deflection was a result of a main rudder power control unit(PCU) secondary valve jam which resulted in a primary valve overstroke. Thissecondary valve jam and primary valve overstroke caused USAir 427 to rolluncontrollably and dive into the ground. Once the full rudder hardoveroccurred, the flight crew was unable to counter the resulting roll withaileron because the B737 does not have sufficient lateral control authorityto balance a full rudder input in certain areas of the flight envelope.
The Boeing View
Charlie Higgins, a Boeing vice president who heads up airplane safety andperformance for Boeing, said the rudder control units from the 737s in thePittsburgh and Colorado Springs crashes were both thoroughly examined as apart of the NTSB's accident investigations. No jam was detected in eitherunit, he said. But the tests showed that extreme temperature differencesbetween the chilly outside atmosphere and piping-hot hydraulic fluidcoursing through the backup rudder could cause the mechanism to fail. Thatwould leave the plane without navigational control if the primary rudderfailed. Under even the most severe flying conditions, the temperaturedifferential between the hydraulic fluid and the surrounding componentsnever exceeds 90 degrees. The rudder failure took place only when thedifferential was 180 degrees or higher. We can't see a flight where thatwould occur.
The company points to pilot error in the Pittsburgh crash, suggesting thepilots may have mishandled the plane in reaction to the turbulence, with thefirst officer inadvertently holding the left rudder pedal to the co*ckpitfloor as he and the Captain pulled back on the control stick to break theirplunge. They blame a rogue wind in the United Airlines crash and a mis-riggedyaw damper for the Eastwind incident.
The NTSB View
Dennis Crider, chairman of the NTSB’s Aircraft Performance Group, toldthe board members “A rudder reversal scenario will match all three events,”
The Boeing Co., hotly contests such a finding, saying there is nophysical evidence that supports rudder reversal scenarios in the threeincidents.
The FAA View
The FAA argues that no one will ever know the cause with any certainty,so it has focused on making the plane safer.
A Series of FAA AD's
17 Jan 1997 - The FAA issued Airworthiness Directive AD 96-26-07. Thisintroduced a new QRH procedure entitled "Jammed Flight Controls". This waslater replaced by "UNCOMMANDEDRUDDER" and "UNCOMMANDEDYAW OR ROLL" in AD 2000-22-02
4 Mar 1997 - The FAA issued AD 97-05-10 thatrequires replacement of the main 737 rudder PCU and dual load fasteners onrudder control rods with newly designed units by August 4, 1999. This ADcorrects an unsafe condition due to an unapproved Hi-Lock bolt that wasinstalled in the lever assembly bearing of the main rudder PCU instead of thecorrect bolt. It alsorequires installation of a newly designed rudder hydraulic pressure reducerand yaw damper system by July 2000.
24 Nov 1998 - The FAA issued AD 97-09-15, Requires a one-time inspection of the engage solenoid valve ofthe yaw damper on the rudder power control unit (PCU) to determine the partnumber (P/N) of the valve, and replacement of certain valves with specified P/Nsif necessary.
AD 97-14-04, Requires tests of the main rudder PCU to detect excessiveinternal leakage of hydraulic fluid, stalling, or reversal, and to verify properoperation of the PCU; and replacement of the PCU with a unit having a differentpart number if necessary. Also requires replacement of the PCU and the verniercontrol rod bolts with newly designed units, leak tests of the PCU, andreplacement of the PCU with a serviceable or newly designed unit if necessary.
13 Jan 1998 - The FAAissued AD 98-02-01, Requiresremoving the yaw damper coupler; replacing its internal rate gyroscope witha new or overhauled unit; and performing a test to verify the integrity ofthe yaw damper coupler, and repair if necessary. However, that configurationof the yaw damper coupler, using mechanical rate gyroscopes, is no longerapproved for installation on Model 737 series airplanes. Instead, AD97-14-03, amendment 39-10060 (62 FR 34623, June 27, 1997), requires, amongother things, installation of a new yaw damper system that replaces thegyroscopes specified by AD 98-02-01. That new system is intended to preventmalfunction of the yaw damper system.
28 Jun 1999 (Revised 24 May 1999) - The FAA issued AD 99-11-05 which orders operators to performrepetitive displacement tests of the secondary slide in the dual concentricservo valve of the PCU to detectcracks in a joint in the servo valve that regulates the intake of hydraulicfluid to the PCU. This AD stems from cracks, found by the PCU supplier, in acomponent of a valve assembly. In addition, some cracks were found byoperators, but prior to the valves being installed in aircraft. Analysis hasshown that a single crack in one leg of the component is not in itself anunsafe condition. A crack in both legs could cause the component to breakapart and jam the valve assembly. If a crack is found during the testprocess, the AD requires the defective valve to be replaced with a modifiedvalve
More Incidents
Two further rudder incidents in 1999 caused concern because they involvedaircraft retrofitted with a PCU redesigned in accordance with the Accidents to make a valve jam impossible.After the incidents, the dual-servo valves on both airplanes were inspectedfor cracks but none were found.
19 Feb 1999 - The pilots of the United Airlines Boeing 737-300 reportedsluggish rudder control during a ground check, while taxiing atSeattle-Tacoma International Airport. The NTSB said the apparent problem wasa mis-positioned valve-spring guide in the rudder's power-control unit.
23 Feb 1999 - A Metrojet 737-200, made a precautionary landing inBaltimore after the aircraft rolled slightly and changed direction duringcruise flight. The MetroJet rudder actually moved involuntarily at tworates, first slowly and then more rapidly all the way over to the pointwhere the rudder deflects to its maximum extent, known as a "hardover." Thepilots could do nothing to make the rudder move, including the initialemergency procedures of turning off the autopilot and the yaw damper. Thepilots reported that when they turned off the plane's hydraulic pressure,the rudder "snapped back" into position but continued to "chatter" andvibrate through the emergency landing. No known scenario could cause such anevent. The NTSB examined the PCU but did not found evidence of acause. All that investigators were able to conclude is that a rudderdeflection did occur, according to information from the airplane'sflight-data recorder.
Mar 1999 - The NTSB release a report that says although there was no hardphysical evidence, both crashes were probably caused by an abrupt ruddermovement that surprised the crew and sent the planes spiralling into anuncontrollable dive.
16 April 1999 - The NTSB made the following recommendations to theFederal Aviation Administration:
- Require that all existing and future Boeing 737s have a reliablyredundant rudder actuation system.
- Convene an engineering test and evaluation board to conduct afailure analysis to identify potential failure modes, a component andsubsystem test to isolate particular failure modes found during thefailure analysis, and a full-scale integrated systems test of the Boeing737 rudder actuation and control system to identify potential latentfailures and validate operation of the system without regard to minimumcertification standards and requirements in 14 Code of FederalRegulations Part 25. Participants in the engineering test and evaluationboard should include the Federal Aviation Administration (FAA); NationalTransportation Safety Board technical advisors; the Boeing Company;other appropriate manufacturers; and experts from other governmentagencies, the aviation industry, and academia. A test plan should beprepared that includes installation of original and redesigned Boeing737 main rudder power control units and related equipment and exercisesall potential factors that could initiate anomalous behaviour (such asthermal effects, fluid contamination, maintenance errors, mechanicalfailure, system compliance, and structural flexure). The engineeringboard's work should be completed by March 31, 2000, and published by theFAA.
- Ensure that future transport-category airplanes certificated by theFederal Aviation Administration provide a reliably redundant rudderactuation system.
- Amend 14 Code of Federal Regulations Section 25.671(c)(3) to requirethat transport-category airplanes be shown to be capable of continuedsafe flight and landing after jamming of a flight control at anydeflection possible, up to and including its full deflection, unlesssuch a jam is shown to be extremely improbable.
- Revise Airworthiness Directive 96-26-07 so that procedures foraddressing a jammed or restricted rudder do not rely on the pilots'ability to center the rudder pedals as an indication that the ruddermalfunction has been successfully resolved, and require Boeing and U.S.operators of Boeing 737s to amend their Airplane Flight Manuals andOperations Manuals accordingly.
- Require all 14 Code of Federal Regulations Part 121 air carrieroperators of the Boeing 737 to provide their flight crews with initialand recurrent flight simulator training in the "Uncommanded Yaw or Roll"and "Jammed or Restricted Rudder" procedures in Boeing's 737 OperationsManual. The training should demonstrate the inability to control theairplane at some speeds and configurations by using the roll controls(the crossover airspeed phenomenon) and include performance of bothprocedures in their entirety.
- Require Boeing to update its Boeing 737 simulator package to reflectflight test data on crossover airspeed and then require all operators ofthe Boeing 737 to incorporate these changes in their simulators used forBoeing 737 pilot training.
- Evaluate the Boeing 737's block maneuvering speed schedule to ensurethe adequacy of airspeed margins above crossover airspeed for each flapconfiguration, provide the results of the evaluation to air carrieroperators of the Boeing 737 and the National Transportation SafetyBoard, and require Boeing to revise block maneuvering speeds to ensure asafe airspeed margin above crossover airspeed.
- Require that all Boeing 737 airplanes operated under 14 Code ofFederal Regulations Parts 121 or 125 be equipped, by July 31, 2000 ifthey are equipped a FDAU or at the earliest time practicable but nolater than August 1, 2001 if they are not equipped with a FDAU, with a flight datarecorder system that records, at a minimum, the parameters required byFederal Aviation Administration Final Rules 121.344 and 125.226, datedJuly 17, 1997, applicable to that airplane plus the followingparameters: pitch trim; trailing edge and leading edge flaps; thrustreverser position (each engine); yaw damper command; yaw damper on/offdiscrete; standby rudder on/off discrete; and control wheel, controlcolumn, and rudder pedal forces (with yaw damper command; yaw damperon/off discrete; and control wheel, control column, and rudder pedalforces sampled at a minimum rate of twice per second).
NTSB Revises UA585 Report
Oct 99 - The NTSB adopted a revised final report on the UA585 and US427 crashes.The Board said that the most likely cause of the accident was the movement ofthe rudder to its limit in the direction opposite that commanded by the flightcrew, "most likely" because of a jam in the device that moves the rudder. The decision tracks information learned from the investigation of UA585,US427 and the Eastwind incident.
The Crossover Speed
The Crossover speed is the speed at which full lateral (roll) control isneeded to balance the roll due to sideslip caused by full rudder deflection.
It is probably fair to say that before 1999 and the publication of the NTSBrecommendations above, very few 737 pilots knew about the crossover speed.However, during the investigation of the UAL 585 accident at Colorado Springs,Boeing produced data which indicated that crossover speed was an issue at theblock speeds of Flaps 1 to Flaps 10. This information was relayed to the NTSB ina September 20, 1991 letter to Mr. John Clark (NTSB) from Mr. John Purvis(Boeing). It should also be noted that crossover speed increases with g-loading.
At the point of the USAir 427 upset, the aircraft was configured at Flaps 1and 190kts, which combined with the g of the attempted recovery manoeuvre wouldhave made recovery almost impossible.
In June 1997, Boeing undertook some additional flight testing on their own inorder to further explore this crossover speed issue. During this flight testing,it was discovered that operations with flaps up was also impacted by crossoverspeed. Further, during this flight testing full rudder hardover malfunctionswere conducted in order to quantify B737 handling characteristics and recoverytechniques with full rudder deflections. It was determined that for the Flaps 1,190 knot case, once a full rudder hardover was experienced, the aircraft had toaccelerate to well above crossover speed before sufficient lateral controlmargin was reached and the aircraft could be recovered.
It was not until March 1999 that the increased block speeds for flaps 1 to 10were incorporated into the Boeing Ops Manual.
On 16 Feb 2000, papers released in a court case for punitive damages by a widowof a US427 passenger, say that US Airways officials asserted that Boeing Cowithheld flight test data about the crossover speed.
Boeing denied the US Airways allegations and said the information was madeavailable to the FAA when the airplane was being certified in 1984 forcommercial operations. During its flight test program on the 737-300 in 1984,Boeing found that at a speed of 190 knots and the flap-one setting, the planecould not overcome a full rudder deflection by using the ailerons, as wouldnormally be the case. "There is no FAA requirement that says this phenomenon isnot acceptable," Denton said. In the wake of the Pittsburgh crash and subsequentinvestigation, airlines have instructed their pilots to fly the 737 at 10 knotsfaster when first deploying the flaps, so ailerons would be more effective. Thehigher speed was officially adopted into Boeing's 737 operating manual lastMarch. Denton, who is now an engineering executive with Boeing's productdevelopment team, said the information about the 737's crossover speed was nothidden.
James Gibbs, flight manager for USAir at the time of the crash, and GordonKemp, 737 flight manager, said in depositions that if the airline had knownabout certain aerodynamic data concerning the 737, it would have changed itsflying procedures before the crash. With the new procedures, "I would haveexpected the 427 crew to have successfully been able to fly out of thesituation,"
Boeing's reply brief effectively said the crew mishandled the situation.Knowledge of how the aircraft reacts at certain speeds "is less important than apilot's ability to exercise proper recovery techniques during upsets, no matterwhat the cause."
The Flight Control Engineering and Test Evaluation Board (ETEB)
The ETEB was formed in May 1999 to look afresh at the 737 rudder in what hasbeen called the most in-depth scientific study ever of any commercial airplanesystem.
FAA officials stressed that the board was formed only to determine what couldhappen, not to evaluate the probability that it would happen. And they cautionthat they have found nothing that they believe will be sufficiently probable towarrant grounding the plane or even ordering immediate design changes. Anyeventual design change would be required on all existing and newly manufactured737s.
"We really haven't found anything that would cause us to do any remedialaction," said Thomas McSweeny, FAA associate administrator for regulation andcertification. "We don't want to push the science [and] create unintendedconsequences."
In assembling the ETEB, the FAA used two criteria: technical expertise, andno connection with or knowledge of the 737 rudder system.
Headed by John McGraw, manager of the FAA's Airplane and Flight CrewInterface Branch in Seattle, the board was composed of scientists from the FAA,NASA, the Defense Department, the Air Line Pilots Association, the Air TransportAssociation, the Russian Air Transport Accident Investigation Commission, FordMotor Co. and Boeing. However, Boeing personnel came from Boeing military andBoeing Long Beach, not from Boeing Seattle where the 737 is made, becauseSeattle engineers could be too familiar with the rudder.
Ford engineer Davor Hrovat was included on the team because he had developeda way to use ultrasound to determine movements of internal parts, such as theinner slide of the 737's dual-control valve.
A high-level, seven-person "challenge team" of outside experts was formed toreview every step of the board's work. It included Col. Charles Bergman, the AirForce deputy chief of safety; Vladimir Kofman, chairman of the Russian accidentinvestigation commission; and Tom Haueter, chief of the major investigationsdivision of the National Transportation Safety Board.
The evaluation board had full access to everything it wanted, including aspecial test aircraft owned by Purdue University and laboratory space at Boeing.They even constructed a first-of-a-kind test device called a "fin rig" - a full737 vertical tail fin and rudder connected to a sophisticated aircraftengineering simulator. Any rudder control commands by a pilot were mimicked inreal time on the rudder, which was placed where the pilot could easily see itsmovements.
Engineers used a vibration table to give a good shaking to rudder components,a "cold box" that could produce realistic flight temperatures, and a device thatcould produce sudden spikes in hydraulic fluid temperatures from 65 degreesbelow zero to 210 degrees above zero. They could also spray water into therudder mechanism, producing ice. It was during these tests that the engineersfound a new and unsuspected failure scenario.
During the study, the ETEB brought in 10 flight crews from 4 airlines on 737sto "fly" the simulator connected to the fin rig. They used the existing recoveryprocedures to deal with about 40 different rudder failure modes. They found, asexpected, that any rudder hardover while taking off or landing, moving slowlyand at low altitude, would be catastrophic. And they found that these pilots,who fly the 737s routinely for airlines and had normal training, performedpoorly in trouble-shooting rudder problems.
ETEB Preliminary Draft Report
12 Apr 2000 - In a preliminary draft report, the ETEB found that the "jammedor restricted rudder" procedures formulated by Boeing and often modified byairlines were "confusing and time consuming." They said the pilots showed a lackof training and "situational awareness" in controlling malfunctions, and as theyprepared to land they never checked to be sure the rudder was operatingproperly. Boeing seemed surprised at this and promised to revise it.
The evaluation board said it had detected 30 failures and jams that could becatastrophic on takeoff and landing. But partly because airplanes travel fasterat higher altitudes and other control systems can overcome the force of arudder, it considered no failures at cruising altitude to be catastrophic.Nonetheless, 16 of those failures and jams at higher altitudes would be"hazardous", meaning they would require prompt pilot action to prevent a crash.
The report said that another 22 "latent failures," such as a cracked part,combined with single failures and jams, could cause catastrophic or hazardousfailures. All but three of the failures found by the panel were also present inthe new-generation 737-6/7/800. "The large numbers of single failures and jamsand latent failure combinations are of concern."
They also found that current maintenance procedures were insufficient to findhidden problems in the rudder system.
The evaluation board's most unexpected finding was that an ice buildup cancause a 737 rudder to malfunction. The pilot's rudder pedals are connected bycables to a linkage in the tail section. A hydraulic servo valve in the linkagepowers an actuator that moves the rudder. The linkage includes a summing leverthat stops the rudder at the position specified by the pilot. Mechanical stopsprevent the summing lever from moving too far, this prevents proper operation ofother levers that shut off hydraulic fluid flowing through the dual controlvalve, allowing fluid to keep pumping until the rudder goes to its maximumdeflection. The linkage isn't pressurized or heated, and operates intemperatures as low as -60C. The board found that ice could form in the linkage,jamming the summing lever. Without the equalizing force of the lever, the servovalve could continue providing hydraulic pressure; the rudder then would keepmoving as far as it could go in the requested direction, a condition known as ahardover. There is no proof that this malfunction has ever occurred in flightbecause ice would melt afterwards, leaving no marks. FAA officials stressed thatthis phenomenon has not yet been tested in flight, but they are nonethelessworking on a fix to make certain ice does not form or is cleared away naturallyby the movement of the mechanisms.
The evaluation board recommended in the draft that Boeing modify the 737rudder control system so that "no single failure, single jam, or any latentfailure in combination with any single jam or failure will cause Class I[catastrophic] effects."
In the meantime, the draft report recommends alerting flight crews aboutearly signs of rudder malfunctions, most often rudder "kicks" that pilots mightchalk up to garden-variety yaw damper problems. It also recommends newmaintenance inspection procedures, a new co*ckpit instrument to tell the pilotsexactly how the rudder is moving and a new hydraulic system design to allowhydraulic pressure to be cut off to the rudder without affecting other airplanesystems.
Boeing Agree to Redesign the Rudder
13 Sep 2000 - The FAA reaches an agreement with Boeing to redesign therudder. Once the directive is issued, the company will have about five years tomake the changes in planes currently flying. The new design will be required inall newly made 737s. Because the redesign could take years to implement, the FAAsaid it will also announce new training procedures for pilots to use in theevent of rudder problems.
Earlier changes in the design had fixed problems with some control mechanismsand an earlier set of emergency rudder control problem training procedures forpilots was put in place although these were found by the ETEB to be too complexand pilots had not received enough training to handle them effectively.
So, to summarise so far: Since the first two Accidents were issued there have beenno further fatal accidents but there have been some unexplained rudderincidents. Boeing and the FAA maintain that the rudder safety problem was fixedafter the first Accidents.
The NTSB's chairman, Jim Hall, said that he was pleased Boeing and the FAAhave finally agreed that there was a need to redesign the 737 rudder controlsystem. The current design, Hall said, "represents an unacceptable risk to thetravelling public.". He went on "I hope this redesign and retrofit can beaccomplished expeditiously so that the major recommendation of our accidentreport last year will be realized, a reliably redundant rudder system for Boeing737s."
The FAA now says even more must be done to assure the redundancy of therudder's safety system, to assure it's impossible for it to malfunction and thatpilots must have more training to handle a rollover caused by a malfunctioningrudder. Boeing say the new rudder will take three years to develop and be fittedto the first aircraft and the FAA said the last will not be fitted until 2008because the retrofit work is expected to take as much as 200 hours per plane.Boeing will pay the full cost of the retrofit, estimated at $240 million.
Boeing's Allen Bailey, the engineer in charge of 737 safety certification.said "We are not fixing a safety problem with this enhancement we are making,"
14 Sep 2000 - NTSB Chairman Jim Hall makes a statement on the FAA release ofthe ETEB rudder study.
"The men and women of the Engineering Test and Evaluation Board can bejustifiably proud of the work they have done over the past year and for thefinal report issued today. The ETEB - made up of representatives from theFederal Aviation Administration and aircraft manufacturers - was the result of aSafety Board recommendation following our investigation of the crash of USAirflight 427. I think I can speak for my NTSB colleagues by saying that we aregratified that the ETEB essentially confirmed our findings in that accidentreport. The major finding of both reports is that the Boeing 737 rudder controlsystem has numerous potential failure modes that represent an unacceptable riskto the travelling public. The ETEB found dozens of single failures and jams andlatent failures in the 737 rudder system, in addition to the single point offailure we identified in our accident report, that can result in the loss ofcontrol of the airplane. Although the failure mechanism that we believed led tothe crashes of United Airlines flight 585 in 1991 and USAir flight 427 in 1994,and the near loss-of-control of Eastwind Airlines flight 517 in 1996, appears tohave been eliminated through a redesigned rudder power control unit, the resultsof the ETEB echo our findings that failure modes still exist in the Boeing 737rudder system. While we are very concerned that some ETEB recommendations willnot be adopted - particularly an independent switch to stop the hydraulic flowto the rudder and a rudder position indicator in 737 co*ckpits - we are pleasedthat both the FAA and Boeing Aircraft Company agree that there is a need for aredesign to the rudder actuator system. However, before the Board can determineif this will satisfy the goal of our recommendations, we will need to evaluatein detail the proposed design. I hope this redesign and retrofit can beaccomplished expeditiously so that the major recommendation of our accidentreport last year will be realized - a reliably redundant rudder system forBoeing 737s."
New QRH ProceduresIntroduced
20 Oct 2000 - FAA issues AD 2000-22-02 this supersedes AD 96-26-07 "Torequire revising the FAA-approved Airplane Flight Manual (AFM) procedure in theexisting AD to simplify the instructions for correcting a jammed or restrictedflight control condition. That AD was prompted by an FAA determination that theprocedure currently inserted in the AFM by the existing AD is not definedadequately. The actions required by that AD are intended to ensure that theflight crew is advised of the procedures necessary to address a conditioninvolving a jammed or restricted rudder."
In plain English, this ADreplaced "Jammed Flight Controls" which was introduced in 1996 with "UNCOMMANDED RUDDER" and "UNCOMMANDEDYAW OR ROLL"
5 Jun 2001 - NTSB adopts revised final report on the 1991 crash of UnitedAirlines Flight 585 in Colorado Springs, CO.; calls rudder reversal most likelycause.
Extracts follow...
WASHINGTON, D.C. - The National Transportation Safety Board has adopted arevised final report on the 1991 crash of a Boeing 737 near Colorado Springs,Colorado that killed all 25 persons aboard. The Board said that the most likelycause of the accident was the movement of the rudder in the direction oppositethat commanded by the flight crew. The decision tracks information learned fromthe investigation of two fatal 737 accidents - including this one - and anon-fatal incident.
... Break ....
The Board’s revised report on the crash of United Airlines flight 585 citesthe same probable cause as that of flight 427, that is:
“…a loss of control of the airplane resulting from the movement of the ruddersurface to its blowdown limit. The rudder surface most likely deflected in adirection opposite to that commanded by the pilots as a result of a jam of themain rudder power control unit servo valve secondary slide to the servo valvehousing offset from its neutral position and overtravel of the primary slide.”
In its revised report on flight 585, the Board noted that since the upsetoccurred less than 1,000 feet above the ground, the pilots had very little timeto react to or recover from the event. The Board concluded that the flight crewof United 585 “could not be expected to have assessed the flight control problemand then devised and executed the appropriate recovery procedure for a rudderreversal under the circ*mstances of the flight.” Although training and pilottechniques developed in recent years show that it is possible to counteract anuncommanded deflection of the rudder in most regions of the flight envelope,“such training was not yet developed and available to the flight crews of Unitedflight 585 and USAir flight 427.”
The Final AD ?
12 Nov 2002 - FAA issues AD 2002-20-07 R1 (Revision issued a month afteroriginal AD)
The actions specifiedin this AD are intended to prevent an uncommanded rudder hardover event andconsequent loss of control of the airplane due to inherent failure modes,including single-jam modes, and certain latent failures or jams combined with asecond failure or jam.
Install a new rudder control system that includes newcomponents such as an aft torque tube, hydraulic actuators, and associatedcontrol rods, and additional wiring throughout the airplane to support failureannunciation of the rudder control system in the flight deck. The system alsomust incorporate two separate inputs, each with an override mechanism, to twoseparate servo valves on the main rudder power control unit (PCU); and an inputto the standby PCU that also will include an override mechanism.
Note that in the first issue of AD 2002-20-07 it was stated:
"Because of the existingdesign architecture, we issued AD 2000-22- 02 R1 to include a specialnon-normal operational "Uncommanded Rudder" procedure, which providesnecessary instructions to the flightcrew for control of the airplane duringan uncommanded rudder hardover event. The revised rudder procedure includedin AD 2000-22-02 R1 is implemented to provide the flightcrew with a means torecover control of the airplane following certain failures of the ruddercontrol system. However, such a procedure, which is unique to Model 737series airplanes, adds to the workload of the flightcrew at a critical timewhen the flightcrew is attempting to recover from an uncommanded ruddermovement or other system malfunction. While that procedure effectivelyaddresses certain rudder system failures, we find that such a procedure willnot be effective in preventing an accident if the rudder control failureoccurs during takeoff or landing.
For these reasons, we have determined that the need for a unique operationalprocedure and the inherent failure modes in the existing rudder controlsystem, when considered together, present an unsafe condition. In light ofthis, we proposed to eliminate the unsafe condition by mandatingincorporation of a newly designed rudder control system. The manufacturer iscurrently redesigning the rudder system to eliminate these rudder failuremodes. The redesigned rudder control system will incorporate design featuresthat will increase system redundancy, and will add an active faultmonitoring system to detect and annunciate to the flightcrew single jams inthe rudder control system. If a single failure or jam occurs in the linkageaft of the torque tube, the new rudder design will allow the flightcrew tocontrol the airplane, using normal piloting skills, without operationalprocedures that are unique to this airplane model."
But this statement was withdrawn a month after it was issued saying "Retaining this procedure will ensure that the flightcrew continues to beadvised of the procedures necessary to address a condition involving a jammed orrestricted rudder until accomplishment of this new AD."
Further QRH Changes
Dec 2003 - The "UNCOMMANDED RUDDER" and "UNCOMMANDEDYAW OR ROLL" became "UNCOMMANDED RUDDER/YAWOR ROLL" which made reference to the STBY RUD ON light on the FlightControls panel. The procedure was after first taking out the A/P & A/T if youhad a STBY RUD ON light installed to accomplish the "JAMMED OR RESTRICTED FLIGHTCONTROLS" checklist. If you did not have a STBY RUD ON light then effectively dothe old uncommanded rudder procedure.
Dec 2004 - The "UNCOMMANDED RUDDER/YAWOR ROLL" procedure was modified further by adding a stage that called forflaps to be retracted to flap 1 if they were extended, before actioning the STBYRUD ON light options.
The End of the Story?
So by 12 November 2008, 17 years after the Colorado Springs accident, all737's should have been retrofitted with a new rudder control system. Only thencan this whole sorry episode be put to bed.
The FDR Issue Rumbles On
From Reuters:
"13 Dec 2006 Boeing and airlines are resisting a US government proposal torequire closer monitoring of rudder performance on 737 aircraft, years after twocrashes prompted a design change and other measures.
Industry and government correspondence show airlines and Boeing arecomfortable with measures already in place to address rudder problems on theworld's most popular commercial aircraft.
The manufacturer and the airlines reject the Federal AviationAdministration's plan for them to update flight data recorders to capture newinformation by 2008.
The redesign and extra monitoring were prompted by 737 crashes in Colorado in1991 and Pennsylvania in 1994 that killed more than 150 people.
Safety investigators found the accidents were likely caused by a mechanicalproblem with the 737 rudder, a movable tail-mounted panel used mainly to countercrosswinds during take-off or landing.
Investigators said 737 rudders may experience a sudden uncommanded movementor movement in the opposite direction of what the crew intended. Boeingredesigned the mechanism.
The correspondence and technical reports filed with the TransportationDepartment in recent weeks illustrates the degree to which the aircraftmanufacturer and major carriers dispute the views of aviation safety officials.
The Air Transport Association (ATA), trade group for major US airlines, saidin a December 4 report to the FAA that eight carriers under its umbrella operatemore than 1,180 737s.
More than 800 would not meet the basic requirements of the FAA monitoringproposal if it were finalized today, and most of those planes have already beenfitted with redesigned rudder systems, the report said. The rest have gottensome variation of rudder upgrades since 1999 and will get the newly designedrudder system within two years.
Airlines support extra monitoring for planes fitted with advanced recordertechnology on the assembly line but oppose expensive recorder retrofits for therest of their fleet.
"In view of these ongoing measures, we believe the proposal is unnecessary toensure the safety of Boeing 737 rudder control systems," ATA officials said inthe report.
But the FAA and the National Transportation Safety Board agree more oversightis needed to ensure Boeing's rudder redesign works as planned and any otherproblems are spotted.
"Without more data, neither the FAA nor the NTSB can definitively identifythe causes of suspected uncommanded rudder events," the FAA said.
The work and cost to upgrade flight recorders varies with the aircraft age.Newer planes include advanced equipment while older models require retrofits.
FAA estimates the cost at a total USD$225 million by 2020 of which more thanhalf would cover retrofits. Airlines estimate the cost at nearly USD$300million.
In addition to the US fleet, there are more than 5,000 737s registered tooverseas carriers. Foreign regulators usually follow FAA safety mandates forUS-made planes operated by their airlines. "
13 Feb 2007 - 737 rudder issues resurface despite redesign
Guy Norris, Flight International
Boeing's long-running problems with the 737 rudder, thought to have beenfinally settled six years ago with the redesign of the power control units (PCU),have resurfaced with the discovery of fractures in the input control rods to theunits, and a subsequent call for wide-ranging corrective action by the USFederal Aviation Administration.
The original rudder control system redesign was prompted by a number ofrudder incidents, and two fatal accidents judged to have been caused by large,uncommanded rudder deflections. The new system had a different rudder PCUdesign, with two independent valves and actuator arms or rods.
The latest FAA airworthiness directive (AD) follows reports of fractures inthe ends of rods connected to both the main and standby PCU. The FAA says theaction will "prevent failure of one of the two input control rods of the mainrudder PCU, which, under certain conditions, could result in reducedcontrollability of the airplane and to prevent failure of any combination of twoinput control rods of the main rudder PCU and/or standby rudder PCU, which couldcause an uncommanded rudder hardover event and result in loss of control of theairplane".
Boeing says the fractures in the rods have been caused by a quality controlissue that resulted in the units becoming "over-baked and brittle". AlthoughBoeing identified the problem in 2006 and initiated a retrofit programme, theFAA AD and acceleration of the replacement effort was made inevitable by "thesubsequent discovery of a second broken rod in December".
Boeing says 880 aircraft have been fitted with the "enhanced" rudder system,of which 681 were discovered to have been delivered with "suspect rods".
