During the 1990s, a series of issues affecting the rudder of Boeing 737 passenger aircraft resulted in multiple incidents. In two separate accidents, pilots lost control of their aircraft due to a sudden and unexpected rudder movement, and the resulting crashes killed everyone on board, 157 people in total.[1] Similar rudder issues led to a temporary loss of control on at least one other Boeing 737 flight before the cause of the problem was ultimately identified.
The National Transportation Safety Board determined that the incidents were the result of a design flaw that could result in an uncommanded movement of the aircraft's rudder.[2] [3]
The issues were resolved after the Federal Aviation Administration ordered modifications for all Boeing 737 aircraft in service. In 2016, former NTSB investigator John Cox stated that time has proven the NTSB correct in its findings because no additional rudder-reversal incidents have occurred since Boeing's redesign.[4]
Unlike other twin-engine large transport aircraft in service at the time, the Boeing 737 was designed with a single rudder panel and single rudder actuator. The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU). Inside the PCU is a dual servo valve that, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder. The PCU for affected Boeing 737 aircraft was designed by Boeing and manufactured by Parker Hannifin.
See main article: article and United Airlines Flight 585. On March 3, 1991, United Airlines Flight 585, a Boeing 737-200, crashed while attempting to land in Colorado Springs, Colorado. During the airplane's landing approach, the plane rolled to the right and pitched nose-down into a near-vertical dive. The resulting crash destroyed the aircraft and killed all 25 people on board.Although the NTSB investigated the accident, it was unable to conclusively identify the cause of the crash. The rudder PCU from Flight 585 was severely damaged, which prevented operational testing of the PCU. A review of the flight crew's history determined that Flight 585's captain strictly adhered to operating procedures and had a conservative approach to flying. A first officer who had previously flown with Flight 585's captain reported that the captain had indicated to him while landing in turbulent weather that the captain had no problem with declaring a go-around if the landing appeared unsafe. The first officer was considered to be "very competent" by the captain on previous trips they had flown together. The weather data available to the NTSB indicated that Flight 585 might have encountered a horizontal-axis wind vortex that could have caused the aircraft to roll over, but this could not be shown conclusively to have happened or to have caused the rollover.
On December 8, 1992, the NTSB published a report that identified what the NTSB believed at the time to be the two most likely causes of the accident. The first possibility was that the airplane's directional control system had malfunctioned and caused the rudder to move in a manner that caused the accident. The second possibility was a weather disturbance that caused a sudden rudder movement or loss of control. The Board determined that it lacked sufficient evidence to conclude either theory as the probable cause of the accident. This was only the fourth time in the NTSB's history that it had closed an investigation and published a final aircraft accident report where the probable cause was undetermined.
See main article: article and USAir Flight 427. On September 8, 1994, USAir Flight 427, a Boeing 737-300, crashed near Pittsburgh, Pennsylvania. While on approach to Pittsburgh International Airport, Flight 427 suddenly rolled to the left. Although the pilots were briefly able to roll right and level the plane, it rolled left a second time and the pilots were unable to recover. The aircraft slammed into a hill and exploded, killing all 132 people on board. The NTSB realized early into its investigation that the crash of Flight 427 might have been caused by an unintended or uncommanded rudder movement, similar to the suspected (but not yet established) cause of the Flight 585 crash. As a result, the NTSB conducted additional testing on United Flight 585's Parker-Hannifin PCU servo during its Flight 427 investigation.
One of the problems facing investigators was the relative lack of precision in the data produced by the flight data recorder (FDR), which only recorded control inputs at periodic intervals with significant time gaps between samples, gaps during which no data was recorded no matter what the pilot did with the controls. This lack of precision led to it being possible for Boeing to interpret the data differently from the way the NTSB did, leading the manufacturer to suspect and insist that the pilot had responded incorrectly to a wake turbulence incident.[5]
At the request of the NTSB, data from the Penny & Giles quick access recorder (QAR) of a British Airways (BA) Boeing 747-400 was supplied to the NTSB by BA. The data was from a London-Bangkok flight in which the aircraft suffered an uncommanded elevator movement and momentary elevator reversal on take-off. The aircraft then landed safely. Operating alongside the FDR system, the QAR on BA's 747-400s, in conjunction with a Data Management Unit, received and recorded more aircraft parametric data, including control input values at a higher rate.[6] This BA data led to renewed suspicion of the similar valve design used on the 737 rudder. As a result of this earlier BA incident, Boeing had, in fact, modified the design of the 747 elevator servo system, and the modified system had been retroactively fitted to all 747-400s in service.
See main article: article and Eastwind Airlines Flight 517. On June 9, 1996, while the NTSB's investigation of Flight 427 was still ongoing, the pilots of Eastwind Airlines Flight 517 briefly lost control of their aircraft, a 737-200, while flying from Trenton, New Jersey, to Richmond, Virginia. The aircraft experienced two episodes of rudder reversal while on approach to land in Richmond. Unlike the two prior incidents, the rudder issues on Flight 517 spontaneously resolved and the pilots were able to safely land the aircraft. One of the 53 people on board were injured.
The NTSB investigated the Eastwind incident, and incorporated information from both United Flight 585 and Eastwind Flight 517 into its ongoing investigation of the Flight 427 crash.
Because Eastwind Flight 517 had landed safely and the pilots of Flight 517 had survived, the NTSB was also able to perform tests on a plane that had experienced problems similar to the accident aircraft, was able to interview them, and gain additional information on their experience. The captain told the NTSB in a post-accident interview that they had not encountered any turbulence during the flight, and that, during their landing descent, he felt the rudder "kick" or "bump" even though neither pilot had moved the rudder pedals. When the plane abruptly rolled to the right, the captain applied left aileron and attempted to move the rudder, but the rudder pedal controls felt stiffer than normal and did not seem to respond to his input; when his flight control inputs did not immediately resolve the roll upset, he also advanced the throttle of the right engine in an effort to compensate.
The NTSB and Boeing engineers conducted a series of tests on the PCUs from Flight 517 and Flight 427, as well as PCUs used in other aircraft and a brand-new PCU that had not yet been used in flight (the PCU from Flight 585, although it had been recovered, was too badly damaged to test in this manner). Testing revealed that under certain circumstances, the PCU's dual servo valve could jam and deflect the rudder in the opposite direction of the pilots' input. Thermal shock testing revealed that the uncommanded rudder movement could be replicated by injecting a cold PCU with hot hydraulic fluid. Thermal shock resulted in the servo's secondary slide becoming jammed against the servo housing, and when the secondary slide was jammed the primary slide could move to a position that resulted in rudder movement opposite of the pilot's commands. The NTSB concluded that all three rudder incidents (United Flight 585, USAir Flight 427, and Eastwind Flight 517) were most likely due to the PCU secondary slide jamming and excessive travel of the primary slide, resulting in the rudder reversal.
On March 24, 1999, after a four-year investigation, the NTSB issued its probable cause finding for Flight 427. The NTSB concluded that the probable cause of the Flight 427 crash was rudder reversal due to the PCU servo malfunction. Two years later, the NTSB published an amended accident report for Flight 585 that found the same probable cause for that accident as well.
As a result of the NTSB's findings, the Federal Aviation Administration ordered that the servo valves be replaced on all 737s by November 12, 2002.[7] The FAA also ordered new training protocols for pilots to handle in an unexpected movement of flight controls.
The following Boeing 737 aircraft incidents were also suspected of being caused by a rudder PCU malfunction:
See main article: article and SilkAir Flight 185. On December 19, 1997, SilkAir Flight 185 crashed in Indonesia, killing 104 people. Because the crash involved a Boeing 737-300 rolling and diving toward the ground at a steep angle, investigators considered the possibility of rudder hardover due to PCU servo malfunction. The Indonesian National Transportation Safety Committee, the lead investigating agency, concluded in its December 14, 2000 final report that it had found "no evidence to explain the cause of the accident."[11] However, on the same day the U.S. NTSB, which also participated in the investigation, issued its own final report that contradicted the Indonesian NTSC findings. The NTSB's report found that there was sufficient evidence to rule out mechanical failure (based on NTSB/Parker-Hannifin's own examinations of the suspected PCU/dual-servo unit recovered from the SilkAir crash), and that the probable cause of the accident was "intentional pilot action," most likely the captain, purposely crashing the aircraft by applying sustained nose-down control pressure.[12]
In 2004, following an independent investigation of the recovered PCU/dual-servo unit, a Los Angeles jury, which was not allowed to hear or consider the NTSB's conclusions about the accident, ruled that the 737's rudder was the cause of the crash, and ordered Parker Hannifin, the PCU/dual-servo component manufacturer, to pay US$44 million to the plaintiff families.[13] Parker Hannifin subsequently appealed the verdict, which resulted in an out-of-court settlement for an undisclosed amount.
The Discovery Channel Canada TV Series Mayday (called Air Crash Investigation or Air Disasters in some markets) dramatized the NTSB's 737 rudder investigation in a 2007 episode titled "Hidden Danger" (broadcast in some countries as "Mystery Crashes").[14]
Mayday separately dramatized the SilkAir crash investigation and lawsuit, including its connection to the 737 rudder controversy, in a 2012 episode titled "Pushed to the Limit" (broadcast in some countries as "Pilot Under Pressure").[15]
