October 7, 1997 USAir 427: ALPA's View of the Accident

Email this article |Print this article

by	The Editors of AVweb
	Documents Provided by ALPA and the NTSB

SUBMISSION OF THE AIR LINE PILOTS ASSOCIATION

TO THE NATIONAL TRANSPORTATION SAFETY BOARD

REGARDING THE ACCIDENT INVOLVING

USAIR FLIGHT 427

NEAR PITTSBURGH, PA

ON SEPTEMBER 8, 1994

TABLE OF CONTENTS

I. EXECUTIVE SUMMARY

II. B737 FLIGHT CONTROL SYSTEM DESIGN

a. Rudder Blowdown

b. B737 Rudder Control System Certification

c. B737 Flight Control Incidents

d. FAA Critical Design Review Team

e. NTSB Safety Recommendations and FAA Actions

III. AIRCRAFT PERFORMANCE

a. Simulator Validation Testing

b. Flight Kinematics Study

IV. B737 LATERAL VS. DIRECTIONAL CONTROL AUTHORITY

V. HUMAN PERFORMANCE

a. Flightcrew General: Health and Background

b. Flightcrew Psychological and Psychosocial Factual Information

c. Crew Communications - Intra-cockpit

d. Task-Related Speech

e. Procedural Speech

f. Non-Task-Related Speech

g. Crew Communications - ATC

h. Crew Interactions

I. Observance of Sterile Cockpit Procedures

j. Spatial Disorientation Studies

k. Biomechanics Associated with Attempting to Move Blocked or Jammed Rudder Pedals

l. Analysis of CVR - Speech and Physiological Aspects

m. Speech Analysis Background

n. Breathing Patterns and Muscular Exertion Background

o. Crew Psychological Stress During the Upset Event

p. Crew Physical Activity During the Upset Event

q. In-depth Examination of Attempted Flight Control Manipulations

r. Pilot Responses to Uncommanded Upsets

s. Unintended Acceleration

t. Rudder Pedal Damage

u. Seat Track Damage

VI. CONCLUSIONS

VII. RECOMMENDATIONS

I. Executive Summary

On September 8, 1994, USAir Flight 427, a Boeing 737-300, crashed while maneuvering to land at Pittsburgh International Airport. The airplane was being operated on an instrument flight plan under 14 CFR Part 121 on a regularly scheduled flight from Chicago, Illinois. The airplane was destroyed by impact forces and all 132 persons on board were fatally injured. Based on the evidence developed during the course of this accident investigation, ALPA believes that the airplane experienced an uncommanded full rudder deflection. This deflection was a result of a main rudder power control unit (PCU) secondary valve jam which resulted in a primary valve overstroke. This secondary valve jam and primary valve overstroke caused USAir 427 to roll uncontrollably and dive into the ground. Once the full rudder hardover occurred, the flight crew was unable to counter the resulting roll with aileron because the B737 does not have sufficient lateral control authority to balance a full rudder input in certain areas of the flight envelope.

Table of Contents

II. B737 Flight Control System Design

This section will show that:

1. The B737 rudder control system design is unique among jet transport designs in that it utilizes a single panel rudder and a single rudder PCU.

2. Since the B737 received its original FAA Type Certificate in 1967, the aircraft has had a history of uncommanded yaw incidents.

3. The B737 rudder control system does not meet the current FAR requirements, FAR 25.671, with regard to malfunction probability and effects.

4. During the course of the investigations of UAL 585, USAir 427, and Eastwinds 517 a number of failure modes have been identified with the B737 main rudder PCU which can lead to uncommanded full rudder hardovers and rudder reversals.

5. The B737 main rudder PCU's design redundancy is ineffective if any of these failure modes occur and, as a result, the aircraft is not in compliance with the FARs.

6. Some secondary valve jams leave no witness marks.

7. USAir 427 experienced a secondary valve jam and reversal in the main rudder PCU that resulted in an uncommanded full rudder deflection.

The Boeing 737 directional control system is unique among jet transport aircraft because of its single rudder panel, single rudder power control unit (PCU) combination. Other Boeing aircraft either have split rudders or command input via multiple PCU's. In normal operation, two independent (A and B) hydraulic systems provided hydraulic power to the rudder through the main rudder power control unit (PCU) which in turn moves the rudder surface. In addition, the A and B hydraulic systems also provide hydraulic power for the pitch and roll control systems. For pitch and roll control there is also manual control available to command pitch and roll inputs if the aircraft experiences a hydraulic failure. The rudder system does not have manual backup. For redundancy, the rudder has a third hydraulic system (Standby) that can provide hydraulic power through the standby rudder PCU if needed.

For rudder input, pilot commands are transmitted via stainless steel control cables to the hydraulic power control unit. There is a direct correlation between the magnitude of the pilot input and the resulting control surface movement at all airspeeds.

The single PCU on the B737 attempts to provide redundancy by using dual components and dual load paths within the PCU. By eliminating one actuator there was a significant weight saving. Later twin jet transports like the B757 and B767 use tandem (two different) PCU's to provide redundancy.

The control of movement of the rods and linkage within the B737 rudder system is essential for it to operate normally. Any unexpected movement in the system could result in uncommanded movement of the rudder. The linkages are load path redundant so that a single failure should not result in loss of control.

Mechanical linkages connect the control rod movement to the primary and secondary valves within the PCU servo valve. The servo valve directs high pressure (3,000 psi) hydraulic fluid to the extend or retract side of the main rudder PCU actuator. Additionally, the servo valve determines the amount and duration of the fluid flowing to the actuator.

The intended design of the PCU was such that in the event of a jam of either the primary or secondary valve, opposing movement by the non-jammed valve would result in control of the rudder. As an example, if the primary valve jams in a position that results in one gallon per minute airplane nose left, the secondary valve will center at a position of one gallon per minute nose right. The result is a higher that normal leakage rate and some reduction in the maximum rate of rudder travel. Pilots maintain control of the rudder, in the event of a jam, by this redundant valve design.

The design of this servo valve does not use "O" rings. Instead it relies on very close tolerances to limit hydraulic leakage. The total movement of the primary or secondary valve from center to its extreme travel is about 0.0045 of an inch (about the width of a dime). The clearance between the primary valve and the secondary or the secondary to the valve housing is less than a human hair. Close tolerances required that consideration be given to the effects of a foreign object obstructing movement of the valves. Chip shear force is a measure of the ability of a valve to shear a foreign object. That is, to actuate normally in spite of the presence of foreign material. The chip shear of the primary valve of the B737 main rudder PCU is significantly less than that of other similar aircraft. This chip shear capability is about 40 pounds on the B737 while the DC-9 and MD-80 are a minimum of 100 pounds. As a result it may be easier to jam the B737 PCU. The secondary valve of the B737 has a somewhat higher chip shear than the primary valve.

The redundant features of the servo valve are only effective if both valves are free to move. If one valve does not move freely, then a subsequent single failure or jam can cause uncommanded movement of the rudder. B737 pilots have no way to detect a jam of either a primary or secondary valve.

Testing of the PCU conducted during the course of this accident investigation have shown that differential cooling or heating can impede critical, free, movement of the servo valves. These tests proved that thermal binding could impair or prevent movement of either valve. During such circumstances a rudder reversal (rudder deflection in the direction opposite to that commanded) can occur. During post accident testing the PCU installed in USAir 427 has shown instances of reversal and binding. The cause for this reversal was the failure of the servo valve to perform its intended design purpose. The mis-positioning of the primary valve due to a jam of the secondary valve results in the loss of the required redundancy. Forces applied to the internal linkage of the PCU result in bending, or linkage deformation, when there is a jam of the secondary valve. This then forces the primary valve out of its customary position. As a result, the primary valve no longer provides redundancy or the ability to oppose the jam. Therefore, the rudder will deflect fully in the direction of the jam of the secondary valve. A pilot applying pressure to a rudder pedal, while a jam exists in the secondary valve, can result in the rudder deflecting fully in the opposite direction to pilot command.

The USAir 427 Systems Group extensively tested and confirmed the reversal condition. Jamming of the secondary valve for any reason can cause a reversal, leaving no witness marks on the valve (NTSB Systems Group Factual Report). Tests also showed that once the reversal begins a pilot cannot overcome it. A jam of the secondary valve and the resulting reversal applies continuous, unrelenting, pressure on the rudder pedals while driving the rudder to full deflection. In fact, as documented in Section V of this submission, the harder a pilot applies pressure to the right rudder pedal, the more likely it becomes that the rudder reversal will not clear.

There are documented cases of jams that leave no witness marks on the valves. As demonstrated in Systems Group tests, the USAir 427 servo valves jammed by thermal binding, left no marks after the jam cleared. The lack of witness marks on the valve does not indicate that a jam did not occur. The secondary valve in USAir 427's rudder PCU could have been jammed when the primary valve overstoked causing a rudder reversal.

In August 1997, the Systems Group convened at Parker in Irvine, California. The group conducted tests to better understand primary valve reversal. These tests provided data on the rate of actuator movement and the force available to move the rudder with different positions of the secondary valve. The tests showed a correlation between secondary valve position and both rate of movement and force available.

Results of these tests show that when the secondary valve is at the neutral (or null) position there is full force available, however, no reversal can occur. As the secondary valve moves away from neutral the force available to the rudder during a reversal drops significantly. After the initial drop, the force available to the rudder rises quickly as the secondary valve moves farther from neutral. At the point where the secondary valve is fifty percent (50%) along its travel almost full force is again available to the rudder.

The significance of the relationship of secondary valve position and force available to the rudder is that above fifty percent (50%) secondary valve travel a reversal results in a full rudder hardover. The rate of rudder movement will be one half (? ) the maximum rate due to the primary valve having no hydraulic fluid passing through it.

During the course of this investigation, the NTSB Systems Group identified a number of significant failure modes of the B737 main rudder PCU. These failure modes include:

1. A foreign object between the input crank and the external manifold stop

2. Overtravel of the primary valve

3. Overtravel of the secondary valve

4. Thermal binding of the primary valve to the secondary valve

5. Thermal binding of the secondary valve to the housing

6. Mis-positioning of the primary valve when the secondary valve is jammed

7. Uncontrollable actuator reversal due to mis-positioning of the primary valve

When each of these failure modes was tested by the NTSB Systems group using the USAir 427 main rudder PCU, the rudder either reversed or deflected to its maximum position.

Table of Contents

a. Rudder Blowdown

Unlike many jet transport aircraft, the B737 uses dynamic pressure, also known as blowdown, to determine the maximum rudder deflection possible when flying at high speeds. There is no mechanical limiting of rudder movement as a function of airspeed on the B737. Rudder movement is commanded via hydraulic pressure (3000 psi) in the rudder PCU. As the rudder moves, air load acts on the rudder panel, which results in a force that opposes rudder deflection. When the air load increases to the point that it equals the hydraulic pressure commanding rudder deflection, rudder movement will stop. This is known as the rudder blowdown limit. In the B737, the higher the airspeed the lower the maximum available rudder deflection possible. Unlike newer model aircraft, in the B737 there is no indication to the pilot in the cockpit of what the maximum rudder deflection available is.

B737 pilots can trim the rudder to relocate the neutral position. This is of use during engine out operation. The B737-1/200 uses manual cables to trim the rudder, while the B737-3/4/500 uses an electric motor to reposition the rudder's neutral position. The electric trim moves at ? ° per second up to a maximum of 16° . There have been cases of failure of the electric trim system resulting in uncommanded movement of the rudder.

Table of Contents

b. B737 Rudder Control System Certification

The Boeing 737 received its original type certificate in 1967. Since that original FAA type certificate was issued there have been a number of B737 derivative models developed by Boeing and certified by the FAA. As far as the B737 flight control system was concerned, each derivative model was certified based on the FAR regulations in place at the time the original type certificate was issued, 1967. The FAA granted a derivative type certificate for the B737-300 in 1984, 17 years after the original type certificate was issued by the FAA.

The criteria applied in 1967, 14 CFR § 25.695 stated,

"The failure of mechanical parts (cables, pulleys, piston rods, and linkages) and the jamming of power cylinders [such as hydraulic powered actuators] must be considered unless they are extremely remote."

The FAA at that time did not define "extremely remote". In their October 18, 1996 letter to Administrator Hinson, the NTSB referenced several FAA certification representatives who stated their belief that "extremely remote" is a failure rate of less than 1x 10^-6 per flight hour.

In 1967 the FAA received failure analysis data from Boeing that showed that the B737's lateral control (roll) authority exceeded the rudder authority. Therefore pilots could use lateral control to overcome a hardover rudder. This was later shown to be inaccurate under certain conditions. The NTSB concluded that "the lateral control system may not be able to counteract the effects of a fully deflected rudder at certain airspeeds and flap settings."

Boeing acknowledged this condition in a September 20, 1991 letter from Mr. John W. Purvis (Boeing) to Mr. John Clark (NTSB). In that letter, Mr. Purvis states, "a full rudder hardover on a B737-200 Advanced airplane in level flight and flaps 10 could not be countered with wheel." This letter further explained, "the left rolling moment due to full left wheel is not enough to counter the right rolling moment due to sideslip."

Another Boeing letter (signed by K. K. Usui) sent to Mr. Donald L. Riggin (Manager of the FAA Seattle Aircraft Certification Office) on September 14, 1992 stated, "The B737 lateral control system capability exceeds the rolling moment due to a full rudder sideslip for all landings flaps at normal landing speeds (V_REF + additives) and for flaps up at normal operational speeds. This is not true and conflicts with the September 20, 1991 letter from Boeing to NTSB on this subject. Further, testing conducted during the course of this investigation has proven that in certain areas of the flight envelop the B737 does not have sufficient lateral control authority to counter a full rudder input. As previously discussed with the FAA and NTSB during the investigation of the B737-200 ADV accident at Colorado Springs, the rolling moment produced by a full rudder sideslip exceeds the capability of the lateral system under the following conditions:

1) Flaps 1 to Flaps 10 at the low speed end of the flap operational envelope.

2) Flaps up and Flaps 15 if the aircraft is flown below normal operating speeds.

The 1967 certification requirements of 14 CFR § 25.695 required the B737 to consider only a single failure. Amendment 23 revised this FAR in 1970 to include undetected and multiple failures. The FAA did not and has not required the B737 to meet the updated FAR standards.

The "Control Systems, General" section of 14 CFR § 25.671 (c) requires that an airplane be capable of safe flight and landing after failure or jamming of a flight control system or surface without exceptional piloting skill or strength. If the probability of a malfunction is considered greater than 1x10^-5 it must have only a minor effect on the control system and be readily counteracted by the pilot.

Also, subsection (3) states: "Any jam in a control position normally encountered during takeoff, climb, cruise, normal turns, descent, and landing unless the jam is shown to be extremely improbable, or can be alleviated. A runaway of a flight control to an adverse position and jam must be accounted for if such runaway and subsequent jamming is not extremely improbable." Tests on the B737 PCU servo valve have identified failure modes that do not meet the "extremely improbable" clause in this FAR. As a result, ALPA concludes that the B737 does not meet the current requirements of 14 CFR § 25.671. ALPA recommends that in the future FAA and manufacturers evaluate derivative models against FARs in effect at the time of design.

There has been some concern by NTSB over the ambiguity in the FAR terminology. Additionally, the NTSB agreed with the FAA Critical Design Review (CDR) team concern that existing regulations only considered control positions that were "normally encountered." The CDR team recommended that flight control systems be tested with a jam at any control position possible. ALPA shares the NTSB's concern and agrees with the CDR team's recommendation. ALPA also supports and agrees with the NTSB's belief "that the FAA should revise 14 CFR § 25.671 to account for the failure or jamming of any flight control surface at its design-limit deflection." Further, ALPA believes that the FAA should re-evaluate all transport-category aircraft and ensure compliance with the revised criteria.

The CDR team reports stated that there are "a number of ways where loss of rudder control and potential for a sustained rudder hardover may occur...Since full rudder hardovers (a control surface hardover is defined as an uncommanded, sustained deflection of the control surface to its full travel position) and/or jams are possible, the alternate means for control, the lateral control system, must be fully available and powerful enough to rapidly counter the rudder and prevent entrance into a hazardous flight condition." ALPA concurs with this CDR recommendation.

Table of Contents

c. B737 Flight Control Incidents

Since the introduction of the B737, there have been recurring reports of flight control indents. On June 10, 1996 Eastwinds Airlines Flight 517, a B737-200, approached Richmond, Virginia. While descending for approach, the flight experienced at least two uncommanded rudder inputs. Other B737's have experienced uncommanded rudder inputs from the yaw damper. What made the Eastwinds flight notable was the magnitude of the rudder movement. The DFDR traces revealed that the rudder had deflected to near its blowdown limit. Another documented case of a rudder moving to its blowdown limit is USAir 427. The principle difference between the two events, and their outcome, was the airspeed at the time of the uncommanded rudder movement. Eastwinds 517 was operating at 250 knots with flaps up, which is well above crossover speed. USAir 427 was below crossover speed for its flap setting and weight. Recovery for the Eastwinds 517 flight crew proved difficult, for the flightcrew of USAir 427 recovery was impossible.

NTSB Chairman, Jim Hall, referred to Eastwinds 517 in a letter to FAA Administrator Hinson, "Under slightly different circumstances the Eastwinds incident could have been a third fatal B737 upset accident for which there was inadequate flight recorder information to determine the cause." ALPA agrees with Chairman Hall. The primary reason Eastwinds 517 did not result in a catastrophic accident is that Eastwinds 517 was above crossover speed when the rudder hardover occurred. The B737 crossover speed issue will be fully discussed in Section IV of this submission.

An NTSB investigation determined that one problem was that the Linear Variable Displacement Transducer (LVDT) had been mis-rigged which allowed the rudder to deflect to 4? ° . However, a second uncommanded rudder movement exceeded 4? ° and traveled to the blowdown limit (about 8° at 250 knots). As noted in the investigation, this airplane had experienced other rudder problems on May 14, 1996, June 1, 1996, and June 8, 1996. Eastwinds maintenance changed the main rudder PCU and the airplane returned to service.

A review of the B737 fleet record shows over 180 rudder related incidents since 1967. Explanation are yaw damper malfunctions, wake vortex encounters, or liquid contamination of the electronic boxes of the yaw damper. Some rudder event causes remain unknown.

Table of Contents

d. FAA Critical Design Review Team

On October 20, 1994, the FAA formed a Critical Design Review (CDR) team to review the design and certification of the B737 aircraft. On May 3, 1995 a report of the results of their review was issued. The members of the CDR team included FAA, Transport Canada, and US Air Force personnel.

Team members defined their objectives as:

1. Identify those failure events, both single and multiple, within certain flight control systems that result in an uncommanded deflection or jam of a flight control surface.

2. Identify latent failures in each axis of flight control.

3. Review the service history of the failed or malfunctioning component or subsystem through a review of ADs, Service Bulletins (SBs), Service Letters (SLs), Service Difficulty Reports (SDRs), NTSB recommendations, NASA Aviation Safety Reporting System (ASRS) reports, and other reports.

4. Identify and review the maintenance or inspection requirements (task and inspection interval), as provided by the manufacturer's Maintenance Planning Document (MPD), Maintenance Review Board (MRB) report, or maintenance manual for each identified component or subsystem with critical failure potential.

A review of 17 ADs, 54 SBs, and 37 SLs and visits to Boeing and other repair facilities (FAR Part 145) resulted in the following observations:

1. Valve chip-shearing forces (as low as 37 pounds) on the PCU actuator appeared to be low.

2. There is no adequate means for testing the dual spool servo valve for proper operation on the airplane.

3. The dual spool servo valve is a complex assembly and is a critical component of the rudder and aileron power control units and, therefore, critical to flight safety. Any facility authorized by the FAA to perform repair and maintenance or manufacture this component must assure the FAA of having the necessary equipment, personnel, and data (design, manufacture, qualification and acceptance tests procedures), including access to the latest revisions to the data provided by the Original Equipment Manufacturer (OEM).

After the team visited Douglas Aircraft Company (DAC) to compare their design and manufacturing practices to that of Boeing, the team published the following observations:

1. The earlier DAC airplanes employ direct cable-driven surface tabs as the primary control mechanism for many of the flight control systems.

2. The airplanes that have a hydraulically powered rudder have a built-in hardover protection with the use of split surfaces, or manual reversion via hydraulic shut-off lever. Earlier airplanes use rudder limiting devices with airspeed inputs. Later airplanes use aerodynamic (blowdown) limiting.

3. After breakout, the resulting prolonged forces required to control the airplane after a jam in the lateral control system are significantly lower than those of the B737.

4. The DAC minimum chip-shearing capability for hydraulic servo valves (100 pounds) is significantly higher than that of the B737 rudder PCU servo valve (minimum 37 in service, and 39 design).

5. DAC has more restrictive contaminated hydraulic fluid inspection requirements than the B737.

6. DAC performs flight tests of "rudder kicks" to determine structural strength issues; flight tests of rudder hardovers to determine lateral versus directional authority are not performed.

7. DAC employs a safety, reliability, and ergonomics group to perform hazard analysis on newer airplane models.

8. DAC's Failure Modes and Effects Analysis (FMEA) process is comprehensive and crosses engineering and operational disciplines.

9. In the DAC FMEA process for analyzing latent failures, DAC takes credit for the inspection interval of the identified failure, but does not make this inspection a Certification Maintenance Requirement.

A visit to Honeywell/Sperry by a CDR team representative resulted in two observations:

1. A 12-month accumulation of 200 failed Yaw Damper units were reviewed by the group in an effort to identify failure trends. Of the 200 failed units reviewed, 130 were due to rate gyro failures, and all of those were caused by damage to the rate gyro rotor bearings. Of the remaining 70 failures, 42 were confirmed as "No Fault Found", and the remaining 28 failures were considered "typical" (i.e. failed components, cold solder joints, etc.). The review suggests that the reason for the excessive frequency of rate gyro failures is due to a Boeing engine change. Boeing requested that Honeywell approve the existing Yaw Damper in the new vibration environment. That new vibration environment was a direct result of the engine change, which is the principle difference between the model -200 and the -300 aircraft. Honeywell has an action item to review those failures with Boeing.

2. There are a number of failure modes that could cause the Yaw Damper to command a rudder deflection to the Yaw Damper authority:

a. Electrical shorts of grounds,

b. Open feedback circuit, and

c. A condition involving an intermittent connection to the transfer valve and an integration circuit in the coupler where the Yaw Damper could command a rudder to deflect 3° for up to 120 seconds. Honeywell was not aware of this condition. Further investigation is being initiated by Honeywell.

The CDR team issued the following recommendations:

1. To develop a national policy for transport category airplane certification which includes consideration of a flight control jammed and any position including full deflection.

2. To develop a national policy requiring that when an alternate means of flying an airplane is employed they shall not require exceptional pilot skill and strength and that a pilot can endure the forces for a sufficient period of time to ensure a safe landing.

3. Require transport airplanes to have redundancy in the directional control system to maintain control in the event of a rotor burst for the most critical phase of flight.

4. Develop a national policy for transport airplanes requiring the determination of critical hydraulic flight control system and components sensitive to contamination, requirements for sampling hydraulic fluid, and requirements for actuator components to eliminate or pass (shear) particulate contamination.

5. Develop additional guidance for transport airplane failure analysis of flightcrew action items in response to failure conditions.

6. Establish a requirement for flightcrew action items to be developed and implemented or the failure analysis evaluated in order to justify no flight crew action items.

7. Review the adequacy of the B737 aileron transfer mechanism. Maintain a safe margin so that a pilot could continue a safe flight and land in a crosswind or go-around if necessary.

8. Ensure the B737 lateral control system is able to provide directional control throughout the airplane envelope with a jammed or hardover rudder, unless these type of failures are shown to be extremely improbable by the most rigorous methodology available.

9. Determine feasibility of improving the protection of the B737 main wheel well from the effects of environmental debris.

10. Ensure B737 wheels are based on TSO-C26 Revision C or later.

11. Require a failure analysis of the B737 yaw damper to identify all failure modes, malfunctions and potential jams.

12. Require corrective action(s) for those failure modes found in #12 that are not shown to be extremely improbable.

13. Require action to reduce the number of B737 yaw damper failures to an acceptable level.

14. Require action to correct galling of the standby rudder PCU input bearing.

15. Review and revise identified latent failures.

16. Require inspections of identified latent failures.

17. Revise the B737 MPD for inspection of latent failures of the Aileron Transfer Mechanism, Aileron Spring Cartridge, and the Standby Hydraulic System including Rudder Function.

18. Revise the B737 flightcrew training to include proper procedures for recovery from upsets caused by flight control system malfunctions.

19. Require that replacement parts of primary elements of flight control system (hydraulic servos and bypass valves) provided by sources other than the Original Equipment Manufacturer (OEM) have undergone qualifications of the OEM part so that the non-OEM part is equivalent under all design tolerance conditions.

20. Require the responsible FAA Aircraft Certification Office to concur with any non-OEM vendor.

21. Assess the repair procedures of every B737 PCU repair station in the US.

22. Evaluate the adequacy of the B737 maintenance manual actions addressing flight control cable inspection, rigging procedures and replacement criteria.

23. Require control cable service life limits unless acceptable inspection and/or test procedure are developed and utilized that can determine the continuing serviceability of the control cables.

24. Determine the degree of incorporation of the following SBs: B737-27-1060, B737-27-1033, B737-27-1081, B737-27-1125, B737-27-1134, B737-27-1152, B737-27-1154, B737-271155, B737-29-1062 and Report No. 95-04-2725.

25. Determine the degree of incorporation of the following SLs: B737-SL-27-16, B737-SL-27-24, B737-SL-27-30, B737-SL-27-57, B737-SL-27-71A.

26. Request NTSB to form a special accident investigation team to begin a new investigation of the B737 accidents at Colorado Springs and Pittsburgh.

Table of Contents

e. NTSB Safety Recommendations and FAA Actions

Prior to the accident involving USAir 427 there was some concern about the aircraft's rudder control system. In August 1991 the NTSB sent then FAA Administrator, James Busey a letter containing Safety Recommendation A-91-77. This recommendation called for an Airworthiness Directive (AD) to require inspection for galling (defined as the transfer of metal from one surface to another surface) in bearings of the standby rudder PCU control rod. The FAA first issued a Notice of Proposed Rulemaking (NPRM) for an AD but later withdrew it on April 19, 1993. The NTSB reiterated their recommendation in its report on the United Airlines 585 accident issued December 8, 1992. They classified A-91-77 as "Open--Unacceptable Action."

During the investigation of the UAL 585 accident a B737-300 experienced a rudder control system anomaly during a preflight rudder test on July 16, 1992. Bench tests identified a failure mode that could result in a rudder reversal. This failure mode involved the mis-positioning of the secondary slide by the internal summing linkage which would cause it to move too far or over-travel within the control valve.

On November 10, 1992, the NTSB issued Safety Recommendations A-92-118 through -121. These recommendations included maintenance and preflight tests to insure proper rudder operation. Additionally, the NTSB recommended that an AD be issued to require incorporation of design changes to preclude the possibility of rudder reversal and to conduct a design review of similar servo valves. The FAA agreed with these safety recommendations and in their response to NTSB stated,

"The problem was found to exist in the main rudder power control unit only on the Boeing 737 model airplanes."

In this response the FAA acknowledged the uniqueness of the B737 rudder control system and its susceptibility to malfunctions resulting in rudder reversal. In order to correct this possible failure mode and rudder reversal, the FAA then issued NPRM 93-NM-79-AD on August 9, 1993 followed by AD 94-01-07 on March 3, 1994. That AD required an inspection of all main rudder PCU's within 750 flight hours and mandated the replacement of the main rudder PCU with an updated PCU that contained internal mechanical stops to prevent secondary valve over-travel.

In early 1996 a B737 operator discovered that an incorrect bolt had been installed in a main rudder PCU during overhaul. Installation of incorrect bolts can cause cracking of bearings which can result in an uncommanded rudder hardover. As a result, the FAA issued AD 97-05-10 Effective March 19, 1996. This AD required that all B737 PCU's be inspection within 90 days to confirm proper operation. Additionally, a B737 operator found incomplete testing of PCU's after overhaul resulted in uncommanded actuator movement. These are two cases where repair facilities not meeting OEM standards introduced rudder anomalies through faulty overhaul procedures.

The complex nature of the PCU requires careful maintenance. An intricate mechanism of this type requires special training of personnel and approval of the FAA before any repair station undertakes repair. ALPA believes history shows that the current practice of allowing a Principle Maintenance Inspector (PMI) to permit a repair station to perform work on a component as complex as a PCU without meeting the same standard as the OEM is a degradation in safety.

Examples of the safety implications of this practice are two cases where repair stations performed FAA approved work on PCU's. The work, however, was not airworthy. The FAA issued Airworthiness Directives (ADs) to correct the work. The PMI of each repair station had approved the methods used in the repairs. While the FAA later determined these methods were unairworthy. One repair facility did not use a proper test fixture for the PCU while the other installed a bolt that did not comply with the manufacture's specifications. Holding repair stations to the same standard as the OEM will prevent occurrences like these from happening in the future.

The NTSB's investigation of USAir 427 provided investigators with an opportunity to expose weaknesses in the maintenance of hydraulic flight components. While the issue of allowing PMI's to approve work that does not meet the same standard as the OEM did not directly affect USAir 427, there is now recognition of the problem potential serious consequences of this practice. ALPA recommends that the FAA require all FAA approved repair stations meet the same standards as the OEM.

On August 22, 1996, the FAA issued several NPRMs for ADs. These ADs included inspections for galling of the standby rudder PCU (96-NM-147-AD), inspections of the bores on aileron, elevator, and rudder PCU's for chrome plating separation (96-NM-150-AD), and verification of the integrity of the yaw damper system within 3000 flight hours and every 6000 flight hours thereafter (96-NM-151-AD).

The NTSB Systems Group conducted tests in August and September 1996 which showed that binding and reversal was possible in the main rudder PCU servo valve. As a result, on November 1, 1996, the FAA issued Telegraphic AD T96-07-51. This AD required repetitive tests within 10 days and every 250 flight hours thereafter for correct operation of the secondary and primary valves. In coordination with this AD was Boeing Alert Service Bulletin 737-27A1202.

On October 18, 1996, proceeding the November 1, 1996 Telegraphic AD, the NTSB issued Safety Recommendations A-96-107 through A-96-120. ALPA concurs with these far-reaching Safety Recommendations aimed at addressing the many areas of concern including:

A-96-107 - Development of "operational measures and long term design changes to preclude the potential for loss of control from and inadvertent rudder hardover. Once operational measures and design changes have been developed, issue respective airworthiness directives to implement this actions."

A-96-108 - Revise 14 CFR 25.671 to account for fully deflected failed or jammed flight controls.

A-96-109 - Require the installation of a rudder surface position indicator.

A-96-110 - Redesign the yaw damper system to "eliminate the potential for sustained uncommanded yaw damper control events." Require installation of the improved yaw damper on all B737.

A-96-111 - Prohibit any operator from removing and replacing the LVDT without testing of proper operation.

A-96-112 - Establish inspection intervals and service life for the main rudder PCU.

A-96-113 - Devise a method for detecting a jam of the primary or secondary slide.

A-96-114 - Test the adequacy of chip shear capability of all sliding control valves.

A-96-115 - Require modification of the input rod bearing of the standby rudder actuator to prevent galling by August 1, 1997.

A-96-116 - Define standards for hydraulic fluid cleanliness and sampling.

A-96-117 - Conduct a design review of dual concentric servo valves for malfunction and/or reversals because of improperly positioned servo slides.

A-96-118 - Require pilots to memorize the procedure for disengaging the yaw damper in the event of uncommanded yaw.

A-96-119 - Require development of procedures and training for B737 pilots to effectively deal with uncommanded rudder movement to the limit of its travel for any flight condition within the operational envelope.

A-96-120 - Require pilot training to recognize and recover from unusual attitudes and upsets that can occur from flight control malfunctions and uncommanded flight control surface movement.

On January 2, 1997, the FAA issued an AD (96-NM-266-AD, 96-26-07) requiring a revision the B-737 FAA-approved Airplane Flight Manual (AFM). This AD required inclusion of a procedure for a flight crew action during uncommanded yaw or roll and to correct a jammed or restricted rudder.

At a press conference with Vice President Gore on January 15, 1997, the FAA announced four ADs for the B737. These ADs included: (1) a redesign of the main rudder PCU to eliminate any possibility of uncommanded rudder motion including rudder reversals; (2) an agreement to replace the mechanical yaw damper rate gyros with solid state rate gyros similar to the B747-400, B757, and B767; (3) incorporating a rudder limiter to decrease rudder movement and significantly improve a flight crew's ability to control a B737 experiencing a rudder hardover; and (4) redesign of bolts in the control rod that links the feel centering unit with the main rudder PCU so as to maintain a dual path. On March 14, 1997, the FAA issued NPRMs for these ADs (97-NM-28-AD and 97-NM-29-AD). It is important to point out that each of these 4 Airworthiness Directives requires the replacement of existing rudder control system components with new, improved components, not simply modifying existing components.

ALPA supports the NTSB and the FAA in their efforts to improve the B737. The changes to the B737 will help insure the highest level of safety for passengers and flight crew members. ALPA believes that the industry needs a maximum effort to hasten the replacement of the PCU's.

Table of Contents

III. Aircraft Performance

This section will show that:

1. The lack of detailed flight data recorder information hampered the accident investigation. As a result, new investigative techniques had to be developed in order to supplement the data recorded.

2. The Kinematic analysis conducted, while not 100% conclusive, resulted in one scenario that matched the recorded FDR data. That match involved a full rudder hardover, in magnitude and input rate, which was consistent with a rudder PCU secondary valve jam with a primary valve overstroke.

During the field phase of the investigation, readout of the accident aircraft's CVR and FDR revealed that Flight 427 had experienced a sudden, uncontrollable roll and dive into the ground while maneuvering for landing. Because the B737 had a history of past rudder control system anomalies that can result in unwanted rudder deflection, the rudder became suspect almost immediately. Unfortunately, in the case of USAir 427, only eleven (11) parameters were recorded by that aircraft's Flight Data Recorder. While the FDR did yield information concerning pitch attitude and bank angle during the accident upset, information regarding flight control surface movement and flight control inputs, with the single exception of control column, was not recorded.

Because of the extremely limited amount of data available from the USAir 427 FDR, the FDR data was taken to the Boeing Seattle facility for study using the Boeing multi-purpose (MCAB) simulator. It was hoped that by feeding the FDR data into the Boeing B737 simulation and observing the MCAB simulator results would yield additional clues concerning the cause of the accident.

During the course of this accident investigation, the Boeing MCAB simulator has been an invaluable tool. An initial simulator session was conducted immediately following the accident. During this session it became evident from the FDR data that there was a large heading change, both in magnitude and rate, during the initial accident upset. During that initial simulator session, a number of simulator "runs" were conducted, simulating a variety of aircraft malfunctions and pilot reactions, in an attempt to replicate the FDR data recorded in the accident sequence. Aircraft malfunctions studied included: (1) rudder, yaw damper and spoiler hardovers; (2) leading edge slat malfunctions; (3) trailing edge flap malfunctions; (4) engine failures and; (5) hydraulic system failures. In addition, because of the separation distance of USAir 427 behind a preceding B727 aircraft, the possibility of a wake vortex encounter was also explored. During this early testing, however, it was recognized that limitations in the B737 simulation fidelity would have to be resolved before certain scenarios could be focused on or ruled out. These limitations included:

1. Aerodynamic data package at high angles of attack ( a ) and sideslip angle (b ).
2. Modeling of wake vortex effects from the preceding B727, including limited knowledge on the behavior of the vortex itself.
3. Lateral and directional control effectiveness at high angles-of-attack ( a ) and sideslip (b ).
4. Maximum rudder control deflection (blowdown) as a function of altitude, airspeed and sideslip angle.

In order to quantify these limitations and improve the simulator's fidelity, a number of activities were undertaken during the course of the investigation. These activities included wind tunnel and flight-testing in order to obtain actual aerodynamic data at high angles-of-attack and sideslip and to improve the modeling of control system and control surface effectiveness. Once these limitations were mitigated to the extent possible, analysis showed that the rudder hardover scenario was the only scenario that could produce enough yaw to match the FDR data from the accident flight.

Table of Contents

a. Simulator Validation Testing

In order to improve the MCAB simulator's fidelity, wind tunnel and flight testing was conducted in order to obtain aerodynamic data at high angles-of-attack and sideslip. In addition, this testing was also aimed at obtaining data so that the simulator model could be modified in order to more accurately model B737 rudder blowdown characteristics. During the course of this testing, it was discovered that the B737-300 was capable of more rudder deflection at Flaps 1 and 190 KIAS than originally believed. This increase in rudder deflection capability further supported the hypothesis that a full rudder hardover had caused the USAir 427 accident.

Table of Contents

b. Flight Kinematics Study

In order to better understand the accident upset involving USAir 427, the Aircraft Performance Group initiated a Flight Kinematics Study. This was a study using the kinematic equations of motion and the accident aircraft FDR data in order to approximate or estimate other flight parameters which were not directly recorded on the FDR such as angle- of-attack and sideslip angle. This data was further resolved into estimates of aircraft aerodynamic force and moment coefficients. Assuming that these aerodynamic force and moment coefficients were due to flight control surface inputs, these forces and moments could then be equated to flight control surface positions. A major limitation in this process however is that the analysis assumes "calm" air in order to be reasonably accurate. Other limitations include the accuracy of the FDR data itself and the accuracy of the simulator aerodynamic model.

In January 1995, the results of the first kinematic study were provided to the NTSB (Exhibit 13G). The results of this first study presented "equivalent control positions" for both rudder and wheel derived from the estimated roll and yawing moment coefficients. These results included the combined effects of data errors and the unknown external forces acting on the aircraft, including wake turbulence.

An updated version of this Kinematic Study was presented to the NTSB in June 1995 (Exhibit 13X-D). This version differed from the first in that it considered the effect of a wake encounter by USAir 427. A B727 preceded USAir 427 in the approach into Pittsburgh. The B727 was 4.2 miles or 69 seconds ahead of USAir 427 at the time of the accident. Recorded ATC radar data shows that the tracks of the two aircraft cross at approximately the point of USAir 427's accident upset. In addition, regarding the vertical separation between the two flight paths, USAir 427 was approximately 300 feet below the B727. This is consistent with the theoretical wake descent rate of 300 feet per minute. Further, there were obvious abnormalities in the kinematically derived lift and pitching moment coefficients. These coefficients showed a loss in lift and an airplane nose up pitch, as well as a sudden increase in turbulence. The performance group concluded that USAir 427 did encounter the wake from the preceding B727.

In order for this analysis to be accurate "calm" atmospheric conditions must exist. Since the actual conditions were not calm considering the wake encounter, the next step in refining the results of the kinematic study was to create an accurate wake turbulence model. This allowed estimation of the effects of the wake during the encounter. Developing this wake model required that many assumption be made. These assumptions include:

1. wake circulation or strength,
2. wake vortex core diameter,
3. wake span,
4. disruption of the wake due to interaction with the aircraft,
5. instability of the wake,
6. the oscillatory nature of the wake vortex pair (Crow instability), and
7. the position of the wake relative to the aircraft throughout the encounter.

This effort was undertaken and the estimated rolling and yawing moments due to the wake encounter were subtracted out of the airplane motion derived in the first kinematic study and new "equivalent control deflections" for control wheel and rudder were calculated.

The estimated wheel and rudder positions shown in this analysis were intriguing in two respects. First, the wheel trace showed the wheel turning in the same direction as the roll caused by the wake. This is contrary to the expectation that the flight crew would input wheel to oppose the roll due to the wake. Second, the derived rudder position showed rudder deflection greater than what was believed to be the blowdown limit.

Finally, a third kinematic study was prepared by Boeing and presented to the Aircraft Performance Group in September 1996. While the two previous studies were conducted in close coordination with the group, this third study was conducted solely by Boeing with minimal input from the Performance Group. During the meeting in which Boeing presented the results of this study, numerous questions were raised by group members regarding the analysis of the wake encounter and derivation of the rudder and wheel time histories. First, Boeing determined that the effects of the low sample rate of the FDR had to be "corrected" and rather than use a linear interpolation or another curve-fit methodology to fair the heading data, Boeing chose to fit an unorthodox non-linear interpolation through the data. Second, based on the Boeing curve fit, Boeing compared their results with hypothetical rudder system malfunctions or failures. The Aircraft Performance Group does not agree with the Boeing curve fit, and this remains an open issue with this third draft report.

In addition, the wake model was substantially changed from the previous study. These changes were based on the results of the wake vortex flight testing which was conducted in Atlantic City in September 1995. Unfortunately the data acquired during this flight testing was arbitrarily applied by Boeing to the new wake model. For instance, while Crow instability [movement of the wake vortices up and down relative to the flight path of the aircraft] was evident during the majority of the testing, Boeing only applied this motion to the wake vortex pair when it was needed to match lift and pitching moment. This self serving use of the wake vortex test data was also apparent when a problem with the estimated rudder position at FDR time 135 to 136 seconds arose. When Boeing presented the results of this study in September 1996 the rudder position during the 135-136 time period should have been 3 degrees airplane nose right assuming a functioning yaw damper. However, the rudder position predicted by the Boeing kinematic study, based on non-linear interpolation, was 2 degrees airplane nose left, a difference of 5 degrees of rudder travel. Boeing had changed the predicted rudder value significantly by altering the wake vortex effects and changing the curve fit through the FDR heading data.

As part of their presentation of the results of the third kinematic study, Boeing demonstrated the effect of data sampling rate on the results of the study and the estimates of rudder position. The sample rate for aircraft heading on the FDR was 1 sample per second. Therefore in a dynamic situation, such as the accident sequence, aircraft heading is only known for the recorded intervals. There is no way to precisely determine aircraft heading between sample intervals. Since the estimate of rudder position is dependent on the determination of sideslip angle, which is calculated from FDR heading, the greater the sampling rate for heading, the more accurate the estimate of rudder position. Sample rates investigated by Boeing included 20, 4, 2, and 1 samples per second. Boeing's analysis showed that the rudder results based on heading sampled once per second were very "noisy," while the sample rates of 2, 4, and 20 were relatively accurate and consistent. Therefore Boeing unilaterally decided to perform a non-linear interpolation of the heading data in an attempt to generate the 2 samples per second accuracy from the 1 sample per second FDR data. In this case, the results of the study are influenced by the curve drawn through the FDR data. Variations in the curve fit produce variations in the resulting rudder trace. Boeing's interpolation through the heading data is not the only one that will fit.

All of the kinematic analyses conducted during the course of this investigation are based on the computed aerodynamic forces and moments using the Boeing B737-300 simulator database. Therefore any results are limited by the accuracy of the aerodynamic data in the simulator database. As mentioned previously, there are known limitations in the simulator aerodynamic data at high angles-of-attack and sideslip. These limitations will introduce errors in the results of the kinematic study. In addition, the kinematic analysis conducted is most accurate in calm wind conditions. USAir 427 encountered the wake turbulence from the preceding B727 4.2 miles or 69 seconds in front of them. As a result, an attempt was made to account for the wake effects of the B727 on USAir 427. There is no conclusive way of knowing whether those effects were accurately accounted for. Further, limitations in the recorded FDR heading data introduce additional potential errors in the estimates of rudder position. However, the results of each of the three phases of the overall kinematic study have consistently shown a full airplane nose left rudder input at the initiation of the upset. In addition, analysis of the rate of rudder input based on these kinematic results reveals that the rate and magnitude are both consistent with a secondary valve jam with a primary valve overstroke in the main rudder PCU.

As mentioned earlier, the lack of detailed flight data recorder information in this investigation lead to the development of new and innovative investigative techniques. The flight kinematics study was one such technique, however this study literally took years to complete. If there been detailed flight data recorder data available following this accident this kinematic analysis would not have been needed and conclusions regarding flight control positions during the accident sequence would have only taken days. ALPA applauds the NTSB's actions regarding improved flight data recorder standards. The NTSB's recommendations in this area have lead to new FAR requirements regarding the minimum number of parameters required to be recorded. ALPA is confident that these new standards will benefit the industry by leading to more thorough accident investigations in the future.

Table of Contents

IV. B737 Lateral vs. Directional Control Authority

This section will show that:

1. The B737 has limited lateral control authority which, at certain airspeeds and aircraft configurations, is unable to counter the roll due to sideslip caused by a full rudder hardover.
2. In the case of USAir 427, the lateral control authority available was not sufficient to maintain a wings level attitude once the flight experienced the full rudder hardover.

The B737 has insufficient lateral control at some airspeeds and flap settings to counter a fully deflected rudder. During the investigation of the UAL 585 accident at Colorado Springs, Boeing produced data which indicated that in certain aircraft configurations below certain airspeeds there was not enough lateral (roll) control authority to balance or counter the roll due to sideslip as a result of full rudder deflection. At that time Boeing stated that the aircraft configurations affected were Flaps 1 through Flaps 10. This information was relayed to the NTSB in a September 20, 1991 letter to Mr. John Clark (NTSB) from Mr. John Purvis (Boeing).

During the investigation of USAir 427 simulator validation flight testing was conducted and maneuvers were flown in order to examine the balance between lateral and directional control on the B737. During the course of this flight testing, Boeing and NTSB confirmed the data Boeing had provided during the UAL 585 investigation. For a B737-300 at Flaps 1 and weights above 110000 lbs, at speeds below 190 knots there was not enough lateral control authority to balance a full rudder hardover to the blowdown limit. The speed at which full lateral (roll) control is needed to balance the roll due to sideslip caused by full rudder deflection is referred to the "Crossover" speed. At the point of the USAir 427 upset, the aircraft was configured at Flaps 1 and was at a speed of 190 kts. It was determined that crossover speed is also affected by aircraft "g" loading such that an increase in "g" loading resulted in an increase in crossover speed for a given aircraft configuration. During the course of simulator validation flight testing, the investigation documented the exact speed at which crossover occurred. A review of the data found that this speed was significantly higher than Boeing had predicted. It was also within 3 knots of the Boeing suggested minimum maneuvering speed. At a Flap 1 setting and an aircraft weight of 110,000 lbs, flight tests found the crossover speed to be 187 knots. The Boeing suggested minimum maneuvering speed for this flight condition is 190 knots.

ALPA believes that this is an inadequate margin of safety. Adding 10 knots to the Boeing suggested minimum speed improves lateral control significantly. This increase in lateral control helps return the airplane to wings level flight much more rapidly in the event of a rudder hardover.

At the time of the upset, USAir 427 was operating at the Boeing recommended minimum maneuvering speed of 190 knots with the flaps set to "1". As the flight encountered the wake vortex of the preceding Delta Air Lines B727-200, the autopilot increased the pitch of the B737 to hold altitude when the aircraft rolled due to encountering the vortex. This slight increase in "g" load or angle-of-attack (a ) resulted in an increase in the crossover speed. Therefore, when the rudder went hardover there was insufficient lateral control to bring the airplane back to a wings level attitude. As the "g" load increased during the upset, the crossover speed continued to increase. As a result, the rate and magnitude of the roll increased.

Five seconds after the momentary five knot increase in airspeed that signifies that the airplane had encountered the wake of the B727, the bank angle was greater than 30° and increasing. Boeing charts predict that the crossover speed for a 110,000 lbs B737-300 in a 30° bank to be above 195 knots. USAir 427 was below the crossover speed and, due to the specific flight characteristics of a Boeing 737, lacked lateral control to return to wings level flight. Throughout its remaining short flight, USAir 427 was never above the crossover speed. As expected, the airplane continued to roll uncontrollably until impact.

During the course of this investigation much discussion and debate has taken place regarding the increase in "g" loading USAir 427 experienced during its accident upset and whether or not the upset was recoverable. ALPA believes that the increase in "g" loading experienced by USAir 427 during the upset was a combination of two factors. First, the natural stability of the aircraft would have caused an increase in "g" loading during the rollover and dive since the aircraft would have a desire to maintain its "trimmed" airspeed. Second, some time after the initiation of the upset and during the dive, the flight crew applied back pressure on the control yoke (airplane nose up elevator) instinctively trying to avoid impacting the ground.

As to whether this upset was recoverable or not, it is important to realize that we, in the investigation, are just now beginning to understand the concept surrounding B737 crossover speeds and the lateral control authority issue. This accident investigation has taken three years. Prior to this accident the B737 crossover speed issue and the effect of "g" loading and angle-of-attack on crossover speeds were unknown. The flight crew of USAir 427 had no way of determining what was wrong with their aircraft and why they could not regain or maintain control of their aircraft during the upset. This flight crew was helpless and the stall of the airplane experienced at the end of the accident upset is immaterial. So long as the airplane remained below crossover speed, recovery from the roll due to sideslip caused by the hardover rudder was impossible.

In the case of USAir 427, the crossover speed increased to the point that it was unattainable. The specific flight characteristics of the B737 and crossover speeds were not explored in detail and understood fully until this accident investigation. This knowledge has still not been passed on thoroughly to the piloting community. While ALPA applauds the initiative of the industry for the development of "Unusual Attitude" and "Aircraft Upset" training, we do not believe that enough has been done in the way of pilot education and the development of pilot operating procedures in order to prevent a loss of control accident.

In June 1997, Boeing undertook some additional flight testing on their own in order to further explore this crossover speed issue. During this flight testing, it was discovered that operations with flaps up was also impacted by crossover speed. Further, during this flight testing full rudder hardover malfunctions were conducted in order to quantify B737 handling characteristics and recovery techniques with full rudder deflections. It was determined that for the Flaps 1, 190 knot case, once a full rudder hardover was experienced, the aircraft had to accelerate to well above crossover speed before sufficient lateral control margin was reached and the aircraft could be recovered.

This idiosyncrasy of the B737 means that ALPA's recommended speeds would result in a flight crew having the ability to return to wings level flight over a much greater part of the flight envelope. Using ALPA's recommended speeds provides a greater margin of safety in the event of a hardover rudder, than the Boeing minimum maneuvering speeds for flap settings of "1" through "10".

During the course of this investigation, when the issue of crossover speed was confirmed, the NTSB issued Safety Recommendation A96-119. This recommendation called for the development of B737 operating procedures so that the aircraft could be safely operated in the event the aircraft experienced a full rudder hardover in any area of the flight envelope. To date, a number of B737 operating procedures have been developed aimed at eliminating a full rudder hardover should one occur in flight. However, a procedure aimed at providing a flight crew with more time in which to react and respond to a full rudder hardover has not yet been mandated by FAA. This procedure is relatively simple: increase the aircraft's minimum maneuvering speed to the Boeing recommended "Block" speed plus 10 knots. ALPA has been advocating this procedure during the past 2 years. Some airlines have adopted this procedure. Even though the FAA has not mandated this increase in minimum maneuvering speeds, they have however endorsed this concept of increasing the B737 minimum maneuvering speeds to "Block" speed plus 10 knots. In a June 4, 1997 letter to ALPA, the FAA stated:

"The Federal Aviation Administration (FAA) has reviewed your proposal and agrees that the approach recommended in this bulletin certainly does have merit. The

techniques recommended in Bulletin 95-3 would definitely result in a more expeditious and easier recovery from any uncommanded directional control system failure."

ALPA urges the NTSB to recommend that B737 operators increase B737 minimum maneuvering speeds to Boeing's recommended "Block" speed plus 10 knots. This would be the safest course of action until the FAA mandated changes in the B737 rudder PCU are completed in order to provide a margin of safety in the event of a rudder hardover.

Table of Contents

V. Human Resources

VI. Conclusions

The investigation into the cause of this accident focused in three primary areas:

• Aircraft Performance,
• Flight Crew Human Factors,
• B737 Rudder Control System.

Based on evidence collected during the course of this investigation ALPA concludes that the accident was the result of a PCU secondary valve jam resulting in primary valve overtravel which caused unwanted full airplane nose left rudder movement. The flight crew was unable to counter this full left rudder due to insufficient lateral control authority available to balance the roll due to sideslip caused by full left rudder.

Aircraft performance analysis revealed that the maneuver of USAir 427 is consistent with full nose left rudder travel. As for the cause of the rudder travel, the Human Factors analysis was unable to identify a possible reason the flight crew would command full left rudder. There was no evidence of any event or abnormality that would have adversely affected the airmanship abilities of either pilot. Further, the initial portion of the upset was found to not be disorienting. The flightcrew of USAir 427 properly and professionally performed their duties before and during the upset period. There is no evidence to support the hypothesis that the flightcrew mishandled the flight controls following the upset event, or that this control mishandling led to the accident.

As for the B737 rudder control system however, during the course of this investigation a number of failure modes have been identified which could result in an uncommanded full rudder input. It was also discovered that at least one failure mode, secondary valve jam resulting in primary valve overtravel, would not leave witness marks. In addition, this failure mode resulted in rudder movement that matched the rudder time history, in both magnitude and input rate, determined from the aircraft performance study necessary to match the maneuver.

B737 Flight Control System

• Tests have shown that a jammed PCU secondary valve may not leave detectable witness marks.
• A B737 flightcrew has no way to detect a jammed secondary valve.
• When the secondary valve jams, the primary valve may not perform its designed function of providing redundancy.
• Failure of the primary valve to perform its designed function can result in the main rudder power control reversing rudder direction from the pilot's command without warning.
• The industry and the flightcrew of USAir 427 were unaware of the potential for the main rudder power control unit to lose redundancy with a jammed secondary valve.
• The industry and the flightcrew of USAir 427 were unaware of the potential for rudder reversal.
• The industry and the flightcrew of USAir 427 were unaware of the lack of sufficient lateral control on B737 aircraft to counter a fully deflected rudder.
• A redesign of the main rudder power control unit is needed to prevent loss of redundancy.
• The industry and the flightcrew of USAir 427 were not aware of all possible failures of the main rudder power control unit.
• The FAA's certification of the Boeing 737 did not adequately evaluate the rudder control system.
• The FAA did not require retesting of the Boeing 737 rudder system during certification of later B737 derivative models.
• The B737 main rudder power control unit does not meet current FAA standards with regard to FAR 25.671.
• The FAA was aware of main rudder PCU problems.
• The FAA policy of allowing a principle maintenance inspector to solely supervise a repair station repairing B737 main rudder power control units is inadequate.
• USAir 427 flight profile is consistent with a rudder reversal due to secondary valve jam and primary valve failure and mis-positioning of the primary valve.
• Eastwinds 517 flight profile is similar that of USAir 427 except for the airspeed at the time of the reversal, which allowed Eastwinds 517 to recover due to being above the crossover speed.

Aircraft Performance

• The flight profile of USAir 427 is consistent with a hardover rudder.

Lateral vs. Directional Control

• The B737 has limited lateral control authority which, at certain airspeeds and aircraft configurations, is unable to counter the roll due to sideslip caused by a full rudder hardover.
• In the case of USAir 427, the lateral control authority available was not sufficient to maintain a wings level attitude once the flight experienced the full rudder hardover.
• The industry and the flightcrew of USAir 427 were unaware of the crossover speed being so near Boeing's recommended minimum maneuvering speed.
• An increase of 10 knots in minimum speed will increase controllability during flight with a hardover rudder at flap settings of "1" through "10".

Human Performance

Flightcrew General: Health and Background

• The crew members of this flight were healthy, both physically and mentally, and were fit for flight.
• No evidence exists of any active or pre-existing medical conditions that would have affected the performance of the flightcrew.

Crew Communications - Intra-cockpit

• The type and quality of intra-cockpit communications are predictors of crew performance.
• The crew of this flight communicated amongst themselves in a manner that is consistent with a high degree of professionalism and good crew coordination.

Crew Communications - ATC

• The captain of USAir 427 acknowledged each ATC radio transmission in accordance with accepted practices.
• 100 percent of the captain's clearance or frequency change readbacks contained both the full clearance readback and the complete aircraft call sign, compared to a recent FAA study that found that only 37 percent of pilot readbacks contain both the clearance readback and complete aircraft call sign.

• The captain's careful attention to ATC communications indicates that he was attentive during flight and suggests that his professionalism towards ATC communications was likely a reflection of his professional approach to flying.

Crew Interactions

• CRM allows crews to operate more effectively and better cope with non-routine situations.
• USAir's CRM program was well developed and CRM principals are constantly reinforced during training with USAir flightcrews, including the accident crew.
• Evidence gathered by a number of NTSB investigative groups indicates that the crew of USAir 427 performed in a manner that is consistent with good CRM during prior trips, as well as during the accident flight.
• The crew's use CRM practices helped foster a healthy crew concept, and this positive crew interaction well prepared them to deal with the emergency had it been a recoverable situation.

Spatial Disorientation Studies

• A NASA expert in spatial disorientation evaluated the possibility of flight crew disorientation and concluded that there was no compelling evidence that the pilots were disorientated, nor was there any evidence to believe that they applied incorrect control inputs in an attempt to overcome their disorientation, and thereby caused the accident.

Biomechanics Associated with Attempting to Move Blocked or Jammed Rudder Pedals

• In June 1997, Boeing Commercial Airplane Group conducted a ground demonstration to evaluate rudder pedal movement during simulated rudder Power Control Unit (PCU) secondary servo valve slide jams at different positions.
• The NTSB Human Performance Group Chairman for this accident participated in these tests, and confirmed that the jam caused uncommanded rudder reversals.
• The Human Performance Group Chairman stated that once a rudder reversal was initiated, stepping on the opposite rudder pedal would not stop the reversal; he, used the word "unrelenting" to describe that no matter how hard he pushed on the opposite rudder pedal, the rudder continued to move in the uncommanded direction.
• A secondary slide jam that occurred during the wake encounter could result in an uncommanded rudder movement to the left.
• The natural and correct tendency of an experienced pilot who faced a rapid rolling movement (such as that associated with wake turbulence) would be to try to counter the roll with a combination of aileron and rudder.
• As the roll rate began to intensify to the left, the first officer likely applied considerable pressure to the right rudder pedal to counter the roll.
• However, from the observations made by the Human Performance Group Chairman concerning uncommanded rudder pedal movement during secondary slide jams, ALPA concludes that the more pressure that the first officer applied right rudder pedal, the more likely it became that the rudder reversal would not clear, resulting in the aircraft continuing to roll rapidly and uncommandedly to the left.

Analysis of CVR - Speech and Physiological Aspects

• The NTSB Human Performance Group for this accident sought independent experts to assist with analyzing the flightcrew's speech and breathing patterns and muscular exertion.
• These analyses allowed investigators to evaluate crewmember levels of stress and physical exertion during the upset event.
• Although evidence suggests that the captain and first officer were surprised by the sudden and unexpected rolling of the aircraft, evidence indicates that the element of surprise immediately invoked an increased level of arousal within the captain which would have aided him with problem solving.

• The captain's level of stress was at Stage 1 or 2 until the aircraft was clearly unrecoverable, and these Stages are associated with increased performance due to the increased arousal factor.
• Not until after the point where the aircraft was clearly unrecoverable, did the stress level of both crewmembers increase to Stage 3, the highest level. Considering that death was clearly imminent, this response is understandable and predictable.
• Evidence suggests that the first officer was attempting to operate the flight controls throughout the upset period, and that the captain did not attempt to take over controls until the aircraft was clearly unrecoverable.
• Because the captain was not task saturated in attempting to control the aircraft, it likely allowed more of his cognitive resources to be devoted to trying to decipher the emergency situation and invoke a plan for recovery.
• To better understand the first officer's attempted flight control manipulations ALPA superimposed information from the reports from the experts, the CVR transcripts, the FDR data and data from the Performance Group's Kinematic Study.
• While listening to the Cockpit Voiced Recorder (CVR) the experts noted three grunts or explosive exhalations from the first officer.
• ALPA cross referenced these exhalations with the kinematic study and found that the first one corresponded with the control wheel being rotated sharply to the right. ALPA concluded that this grunt occurred when the first officer exerted force to override the autopilot "command" mode detent.
• The second grunt corresponded to a left rudder input that was denoted by the kinematic study. CVR data indicated that at this point the aircraft rolled rapidly to the left at a rate of approximately 35 to 40 degrees per second.
• In order to counter this abrupt rolling moment, the first officer's response would have likely been to apply considerable control forces to turn the control wheel to the right and attempt to push the right rudder pedal. The forces exerted on these controls likely resulted in the grunting that was heard on the CVR.
• The final grunting sound coincides with the kinematic analysis suggesting that the control wheel was once again being turned through approximately 35 degrees and the increasing rapidly traveling towards a full right direction. One of the experts compared this grunting to previous grunts by saying that this one was "was louder and more forceful representative of the use of increased muscular force".

• It is likely that this grunting "was louder and more forceful representative of the use of increased muscular force" because the first officer was desperately struggling to press the right rudder pedal, attempting unsuccessfully to oppose the uncommanded left rudder movement.

Pilot Responses to Uncommanded Upsets

• The NTSB's Human Performance Group for this accident turned to the NASA Aviation Safety Reporting System (ASRS) to learn more about how pilots have reacted to uncommanded upsets.
• ASRS conducted a special "structured callback" to assist with this understanding.
• Altogether, information from 589 turbojet loss of control events was analyzed.
• In many cases reporters acknowledged that the events startled them, and many perceived that the events were quite severe.
• Although the events may have startled pilots, and although they may have been severe events, in not one of these cases did the aircraft crash. In every case, regardless of how much the event surprised them, and regardless of how severe they perceived the event, crews were able to recover the aircraft and safely land it.

Unintended Acceleration

• Unintended acceleration has no relevance in explaining this accident scenario.

Rudder Pedal Damage

• Two medical experts formed differing opinions concerning interpretation of rudder pedal damage.
• Due to this conflicting interpretation, information concerning rudder pedal damage is inconclusive and therefore should be disregarded.

Seat Track Damage

• Information concerning seat position could not be determined from seat track damage.
• The lack of seat track damage has no relevancy to this investigation, because due to the first officer's height, he would have had full and unobstructed use of all flight controls, regardless of seat position.

Table of Contents

VII. Recommendations

Since the accident involving USAir 427 the NTSB has issued numerous safety recommendations, all aimed at improving the aviation system and making it safer for the traveling public. ALPA fully supports those recommendations. With regard to the specific event that initiated the USAir 427 accident upset, malfunction of the main rudder PCU which resulted in uncommanded full rudder deflection, ALPA believes that Boeing and Parker should work diligently to replace existing B737 rudder PCU's with improved units as quick as possible without sacrificing quality. In addition, ALPA offers the following recommendations:

• The FAA should eliminate the current practice of derivative certification. Newly developed aircraft should be carefully evaluated against FAR criteria in place at the time of aircraft development.

• For aircraft which were certified as "Derivative" models, the FAA should evaluate those aircraft against existing FAR requirements and those aircraft, to the extent feasible, should be modified in order to be in compliance with the current FAR regulations.

• The FAA should require all FAA certified repair stations to meet all the standards of the original equipment manufacturer.

• In order to increase B737 lateral control margin to an acceptable level, the FAA should mandate the development of additional operational techniques such as increasing B737 minimum maneuvering speeds to Boeing recommended "Block" speeds plus 10 knots.

• The industry should continue with the development and implementation of "Advanced Maneuver" or "Selected Event" training and that the FAA should require the inclusion of this training in every airline's training program.

Table of Contents