NATIONAL TRANSPORATION SAFETY BOARD
Public Meeting of March 23-24, 1999
Abstract of Final Report
(Subject to Editing)
USAir flight 427
Boeing 737-300, N513AU
Aliquippa, Pennsylvania
September 8, 1994
This is an abstract from the Safety Board's report and does not include the Board's rationale for the conclusions, probable cause and safety recommendations. Safety Board staff is currently making final revisions to the report from which the attached conclusions and safety recommendations have been extracted. The final report and pertinent safety recommendation letters will be distributed to recommendation recipients as soon as possible. The attached information is subject to further review and editing. |
ACCIDENT SUMMARY
On September 8, 1994, about 1903:23 eastern daylight time, USAir (now US Airways) flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering to land at Pittsburgh International Airport, Pittsburgh, Pennsylvania. Flight 427 was operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled domestic passenger flight from Chicago-O'Hare International Airport, Chicago, Illinois, to Pittsburgh. The flight departed about 1810, with 2 pilots, 3 flight attendants, and 127 passengers on board. The airplane entered an uncontrolled descent and impacted terrain near Aliquippa, Pennsylvania. All 132 people on board were killed, and the airplane was destroyed by impact forces and fire. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan.
The safety issues addressed in this report are Boeing 737 rudder malfunctions, including rudder reversals; the adequacy of the 737 rudder system design; unusual attitude training for air carrier pilots; and flight data recorder (FDR) parameters.
Safety recommendations concerning these issues were addressed to the Federal Aviation Administration (FAA). Also, as a result of this accident, the Safety Board issued a total of 17 safety recommendations to the FAA on October 18, 1996, and February 20, 1997, regarding operation of the 737 rudder system and unusual attitude recovery procedures. In addition, as a result of this accident and the United Airlines flight 585 accident (involving a 737-291) on March 3, 1991, the Safety Board issued three recommendations (one of which was designated "urgent") to the FAA on February 22, 1995, regarding the need to increase the number of FDR parameters.
CONCLUSIONS
[NOTE: Because the Safety Board's analysis of this accident also included analysis of the United flight 585 accident and the Eastwind flight 517 incident, some of the findings below pertain to these two events.]
1. The USAir flight 427 flight crew was properly certificated and qualified, and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew's performance during the accident flight.
2. The USAir flight 427 accident airplane was equipped, maintained, and operated in accordance with applicable Federal regulations. The airplane was dispatched in accordance with FAA- and industry-approved practices.
3. All of USAir flight 427's doors were closed and locked at impact.
4. USAir flight 427 did not experience an in-flight fire, bomb, explosion, or structural failure.
5. Neither a midair collision with other air traffic, a bird strike, clear air turbulence, nor other atmospheric phenomena were involved in the USAir flight 427 accident.
6. Asymmetrical engine thrust reverser deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing uncommanded flight control movements, yaw damper malfunctions, and a rudder cable pull or break were not factors in the USAir flight 427 accident.
7. Although USAir flight 427 encountered turbulence from Delta flight 1083's wake vortices, the wake vortex encounter alone would not have caused the continued heading change that occurred after 1903:00.
8. About 1903:00, USAir flight 427's rudder deflected rapidly to the left and reached its left aerodynamic blowdown limit shortly thereafter.
9. Analysis of the human performance data shows that it is likely that the first officer made the first pilot control response to the upset event and manipulated the flight controls during the early stages of the accident sequence; although it is likely that both pilots manipulated the flight controls later in the accident sequence, it is unlikely that the pilots simultaneously manipulated the controls (possibly opposing each other) during the critical period in which the airplane yawed and rolled to the left.
10. Analysis of the human performance data (including operational factors) does not support a scenario in which the flight crew of USAir flight 427 applied and held a full left rudder input until ground impact more than 20 seconds later.
11. Analysis of the CVR, Safety Board computer simulation, and human performance data (including operational factors) from the USAir flight 427 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
12. The flight crew of USAir flight 427 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.
13. The flight crew of USAir flight 427 recognized the initial upset in a timely manner and took immediate action to attempt a recovery, but did not successfully regain control of the airplane.
14. It is very unlikely that the loss of control in the United flight 585 accident was the result of an encounter with a mountain rotor.
15. Analysis of the CVR, computer simulation, and human performance data (including operational factors) from the United flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
16. The flight crew of United flight 585 recognized the initial upset in a timely manner and took immediate action to attempt a recovery, but did not successfully regain control of the airplane.
17. The flight crew of United flight 585 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.
18. Training and piloting techniques developed as a result of the USAir flight 427 accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions of the flight envelope: such training was not yet developed and available to the crews of USAir flight 427 or United flight 585.
19. During the Eastwind flight 517 incident, the rudder reversed, moving to its right blowdown limit when the captain commanded left rudder, consistent with a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
20. It is possible that, in the main rudder PCUs from the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid or other unknown factors) the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position, without leaving any obvious physical evidence, and combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input.
21. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides.
22. When completed, the rudder system design changes to the Boeing 737 should preclude the rudder reversal failure mode that most likely occurred in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident.
23. Rudder design changes to Boeing 737-NG series airplanes and the proposed retrofit of the remainder of the Boeing 737 fleet do not eliminate the possibility of other potential failure modes and malfunctions in the Boeing 737 rudder system that could lead to a loss of control.
24. The dual-concentric servo valve used in all Boeing 737 main rudder PCUs is not reliably redundant.
25. A reliably redundant rudder actuation system is needed for the Boeing 737, despite significant improvements made in the system's design.
26. The results of this investigation have disclosed that the Boeing 737 rudder system design certificated by the FAA is not reliably redundant.
27. Transport-category airplanes should be shown to be capable of continued safe flight and landing after a jammed flight control in any position, unless the jam can be shown to be extremely improbable.
28. Pilots would be more likely to recover successfully from an uncommanded rudder reversal if they were provided the necessary knowledge, procedures, and training to counter such an event.
29. A neutral rudder pedal position is not a valid indicator that a rudder reversal in the Boeing 737 has been relieved.
30. The training being provided to many Boeing 737 flight crews on the procedures for recovering from a jammed or restricted rudder (including a rudder reversal) is inadequate.
31. The continued use by air carriers of airspeeds below the existing block maneuvering speed schedule presents an unacceptable hazard, and the existing block maneuvering speed for the flaps 1 configuration provides an inadequate margin of controllability in the event of a rudder hardover.
32. The FDR upgrade modifications required by the FAA for existing airplanes are inadequate because they do not require the FDR to be modified to record yaw damper command voltage, yaw damper and standby rudder on/off discrete indications, pitch trim, thrust reverser position, leading and trailing edge flap position, and pilot flight control input forces for control wheel, control column, and rudder pedals.
33. Based on the rudder-related anomalies discussed in this report, FDR documentation of yaw damper command voltage, yaw damper and standby rudder on/off discrete indications, and pilot flight control input forces for control wheel, control column, and rudder pedals is especially important in the case of the 737, and these parameters should be sampled on 737 airplanes at frequent intervals to provide optimal documentation.
34. The FAA's failure to require timely and aggressive action regarding enhanced FDR recording capabilities, especially on Boeing 737 airplanes, has significantly hampered investigators in the prompt identification of potentially critical safety-of-flight conditions and in the development of recommendations to prevent future catastrophic accidents.
The National Transportation Safety Board determines that the probable cause of the USAir flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
As a result of the investigation of this accident, the National Transportation Safety Board makes the following recommendations:
--to the Federal Aviation Administration:
1) Require that all existing and future 737s have a reliably redundant rudder actuation system.
2) Convene an engineering test and evaluation board to conduct a failure analysis to identify potential failure modes; a component and sub-system test to isolate particular failure modes found during the failure analysis; and a full-scale integrated systems test of the rudder actuation and control system of the Boeing 737 to identify potential latent failures and to validate operation of the system without regard to minimum certification standards and requirements in FAR Part 25. Participants in the board should include the FAA, NTSB technical advisors, the Boeing Company , other manufacturers as appropriate, and experts from other government agencies, industry, and academia. A test plan should be prepared that includes installation of original and redesigned Boeing 737 main rudder PCUs and related equipment and exercises all potential factors that could initiate anomalous behavior (such as thermal effects, fluid contamination, maintenance errors, mechanical failure, system compliance, structural flexure, etc.) The work of the engineering board should be completed by March 31, 2000, and should be published by the FAA.
3) Ensure that future transport category airplanes certificated by the FAA provide a reliably redundant rudder actuation system.
4) Amend 14 CFR Section 25.671(c)(3) to require that transport-category airplanes be shown to be capable of continued safe flight and landing after jamming of a flight control at any deflection possible, up to and including its full deflection, unless such a jam is shown to be extremely improbable.
5) Revise AD 96-26-07 so that procedures for addressing a jammed or restricted rudder do not rely on the pilots' ability to center the rudder pedals as an indication that the rudder malfunction has been successfully resolved, and require Boeing and U.S. operators of Boeing 737s to amend their Airplane Flight Manuals and Operations Manuals accordingly.
6) Require all 14 CFR Part 121 air carrier operators of the Boeing 737 to provide their flight crews with initial and recurrent flight simulator training in the "Uncommanded Yaw or Roll" and "Jammed or Restricted Rudder" procedures in Boeing's 737 Operations Manual. The training should demonstrate the inability to control the airplane at some speeds and configurations by using the roll controls (the crossover speed phenomenon) and include performance of both procedures in their entirety.
7) Require Boeing to update its Boeing 737 simulator package to reflect flight test data on crossover speed; then require all operators of the Boeing 737 to incorporate these changes in their simulators used for Boeing 737 pilot training.
8) Evaluate the Boeing 737's block maneuvering speed schedule to ensure the adequacy of airspeed margins above crossover speed for each flap configuration; provide the results of the evaluation to air carrier operators of the Boeing 737 and the Safety Board, and require Boeing to revise block maneuvering speeds to ensure a safe airspeed margin above crossover speed.
9) Require that each 737 airplane operated under 14 CFR Parts 121 or 125 that currently has a FDAU be equipped, by December 1999, with a flight data recorder system that records, at a minimum, the parameters required by FAA Final Rule 121.344, 125.226 dated July 17, 1997, applicable to that airplane plus the following parameters: pitch trim, trailing edge flaps, leading edge flaps, thrust reverser position (each engine), yaw damper command, yaw damper on/off discrete, standby rudder on/off discrete, and control wheel, control column, and rudder pedal forces (with yaw damper command, yaw damper on/off discrete, and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice-per-second).
10) Require that all 737 airplanes operated under 14 CFR Parts 121 or 125 not equipped with a FDAU be equipped, at the earliest time practicable, but no later than August 2001, with a flight data recorder system that records, at a minimum, the parameters required by FAA Final Rule 121.344, 125.226 dated July 17, 1997 applicable to that airplane plus the following parameters: pitch trim, trailing edge flaps, leading edge flaps, thrust reverser position (each engine), yaw damper command, yaw damper on/off discrete, standby rudder on/off discrete, and control wheel, control column, and rudder pedal forces (with yaw damper command, yaw damper on/off discrete, and control wheel, control column, and rudder pedal forces sampled at a minimum rate of twice-per-second).