Rudder Malfunction Causes Loss of Control of Boeing 737

航空

游客，如果您要查看本帖隐藏内容请回复

航空

F L I G H T S A F E T Y F O U N D AT I O N
Accident Prevention
Vol. 56 No. 9 For Everyone Concerned with the Safety of Flight September 1999
Rudder Malfunction Causes
Loss of Control of Boeing 737
All 132 occupants were killed when the airplane struck terrain near Pittsburgh,
Pennsylvania, U.S. The investigation report said that, following an encounter with wake
turbulence, the airplane’s rudder moved to the limit of its travel, in a direction opposite to
that commanded by the flight crew. The report said that the rudder-control anomaly most
likely was caused by a malfunction of the rudder’s main power control unit.
FSF Editorial Staff
About 1903 local time on Sept. 8, 1994, USAir Flight
427, a Boeing 737-300, entered an uncontrolled
descent during approach to Pittsburgh (Pennsylvania,
U.S.) International Airport (PIT) and struck terrain
near Aliquippa, Pennsylvania. All 132 occupants
were killed. The airplane was destroyed.
The U.S. National Transportation Safety Board
(NTSB), in its final report, said, “The probable cause
of the USAir Flight 427 accident was a loss of control
of the airplane resulting from the movement of the
rudder surface to its blowdown limit.1
“The rudder surface most likely deflected in a direction
opposite to that commanded by the pilots as a result of a jam
of the main rudder power control unit [PCU] servo valve
secondary slide to the servo valve housing offset from its
neutral position and overtravel of the primary slide.”
The airplane was on a scheduled flight from Chicago, Illinois.
The flight crew was on the third day of a three-day flight
schedule. They had begun duty at 1215 in Jacksonville, Florida,
and had flown to Charlotte, North Carolina, and then to Chicago.
The captain, 45, had an airline transport pilot (ATP) certificate
and approximately 12,000 flight hours, including 3,269 flight
hours as a Boeing 737 (B-737) captain and 795 flight
hours as a B-737 first officer.
“The captain’s initial flight experience was in general
aviation, and he obtained a private pilot certificate
in August 1969,” the report said. He joined the U.S.
Air National Guard and in 1973 completed U.S. Air
Force pilot training. His early military records were
destroyed, but Air Force records from September
1975 through March 1979 show that he had 227
training hours and 667 flight hours in the Cessna
O-2 (military version of the Cessna 337).
The captain flew for Braniff Airways from 1977 to 1980. He
was hired by USAir (now US Airways) in 1981.
“USAir records indicated that the captain was on extended sick
leave from Jan. 25 to April 28, 1994, because of back surgery,”
the report said. The surgery was performed in March 1994 to
remove a ruptured disk. The captain’s wife said that he did not
complain of back pain after he returned to flight duty and that
he took no medication other than allergy injections.
“Several check airmen, instructors and first officers who
were acquainted with the captain and his piloting abilities
indicated that the captain was meticulous, very proficient, very
2 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
professional and attentive to detail, and that he flew ‘by the
book,’” the report said. “They also reported that the captain
was well liked and exhibited excellent [crew resource
management] skills.”
The captain’s civilian flight records and post-1975 military
records showed no aerobatic flight experience. The report said
that Air Force initial pilot training included aerobatic training
in jet trainers, but the captain’s Air Force initial pilot training
records were not available.
The first officer, 38, had an ATP certificate and 9,119 flight
hours, including 3,644 flight hours as a B-737 first officer.
The first officer’s initial flight experience was in general
aviation. He was hired in 1987 by Piedmont Airlines and flew
as a Fokker F28 first officer until 1989, when he transitioned
to the B-737 as a first officer. He became an employee of USAir
when the airline acquired Piedmont in 1989.
“Check airmen, instructors and captains who were acquainted
with the first officer and his piloting abilities indicated that the
first officer was friendly, very well qualified and an outstanding
first officer who exhibited exceptional piloting skills,” the report
said. “One captain who had flown with the first officer described
an in-flight hydraulic system emergency that occurred during
one of their flights. He stated that the first officer remained very
calm during the emergency situation.”
There was no record that the first officer had training or
experience in aerobatic flight. “However, his flight logbooks
indicated that he had performed spin recoveries in 1973 in
a Piper J-3 ‘Cub’ airplane when he had total flight times
between 77 [hours] and 93 hours.”
The accident airplane was manufactured and delivered to USAir
in 1987. At the time of the accident, the airplane had accumulated
approximately 23,846 flight hours and 14,489 cycles.
The estimated flight time from Chicago to Pittsburgh was
55 minutes. Visual meteorological conditions prevailed along
the route. The first officer was the pilot flying. The airplane’s
autoflight system2 was engaged.
At 1845 — about 35 minutes after departing from Chicago —
the crew was told by Cleveland Air Route Traffic Control Center
(Cleveland Center) to descend from Flight Level (FL) 290 to FL
240. The captain, the pilot not flying, acknowledged the clearance.
At 1850, Cleveland Center told the crew to cross CUTTA
intersection — an arrival fix approximately 30 nautical miles
(56 kilometers) northwest of PIT — at 10,000 feet. The captain
acknowledged the clearance and then listened to the PIT
automatic terminal information service (ATIS) report.
The reported weather conditions included scattered clouds
at 25,000 feet, 15 statute miles (24 kilometers) visibility,
Boeing 737-300
The Boeing Co. in 1965 announced the decision to build a
short-range, twin-turbofan transport. The aircraft, designated
the 737, was designed to use many components and
assemblies from the tri-engine B-727. The first B-737 flew
in April 1967, and deliveries of the first production model,
the B-737-200, began before the end of 1967.
Boeing in 1980 announced plans to build the B-737-300, a
larger version that would accommodate more passengers
and baggage, and have quieter and more fuel-efficient
engines. Fuselage plugs were installed forward of the wing
and aft of the wing carry-through structure to increase length
by 8.7 feet (2.7 meters). The airplane can accommodate 128
passengers to 149 passengers and 1,068 cubic feet (30.2
cubic meters) of freight, compared with accommodations in
the B-737-200 for 115 passengers to 130 passengers and
875 cubic feet (24.8 cubic meters) of freight.
The Pratt & Whitney JT8D-9A engines, each producing
14,500 pounds thrust (64.5 kilonewtons), on the B-737-200
were replaced with CFM International CFM56-B engines,
each producing 20,000 pounds thrust (88.97 kilonewtons)
on the B-737-300.
The prototype made its first flight in February 1984, and
deliveries of production B-737-300s began in November
1984. Maximum standard takeoff weight is 124,500 pounds
(56,473 kilograms). Maximum landing weight is 114,000
pounds (51,710 kilograms).
Maximum operating speed is Mach 0.84. Maximum cruising
speed at an average cruise weight of 100,000 pounds
(45,360 kilograms) at 33,000 feet is 462 knots (856
kilometers per hour [kph]). Economy cruising speed at
33,000 feet is Mach 0.73. Stalling speed in landing
configuration at 103,000 pounds (46,720 kilograms) is 102
knots (189 kph).
Source: Jane’s All the World’s Aircraft
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 3
temperature 75 degrees Fahrenheit (F; 24 degrees Celsius [C]),
dew point 51 degrees F (11 degrees C) and surface winds from
270 degrees at 10 knots. The ATIS report said that instrument
landing system (ILS) approaches were being conducted to
Runway 32 and Runway 28R.
At 1853, a flight attendant asked the flight crew if they had
received connecting-flight information and gate information.
The captain said that they had not received the information.
The flight attendant then asked if the pilots wanted anything
to drink, and both pilots requested juice.
At 1854, Cleveland Center told the crew to reduce airspeed to
250 knots.
“At that time, Delta Air Lines Flight 1083, a Boeing 727
[B-727] that had been sequenced to precede USAir Flight 427
on the approach to PIT from the northwest, was in level flight
at 10,000 feet with an assigned airspeed of 210 knots and
an assigned heading of 160 degrees,” the report said. “Delta
Flight 1083 was in communication with Pittsburgh Terminal
Radar Approach Control [Pittsburgh Approach] personnel.”
At 1856, Cleveland Center told the crew of Flight 427 to reduce
airspeed to 210 knots and said that the airspeed reduction had
been requested by Pittsburgh Approach. The controller then
told the crew to descend at pilot’s discretion to 10,000 feet
and to contact Pittsburgh Approach.
At 1857:07, the flight attendant returned to the cockpit with
juice for the pilots; she left the cockpit about one minute later.
At 1857:23, Pittsburgh Approach said, “USAir four twentyseven,
… heading one six zero, vector [for] ILS runway two
eight right final approach course. Speed, two one zero.” The
captain acknowledged.
At 1858:03, the controller told the crew of Delta Flight 1083
to descend to 6,000 feet. At 1858:33, the controller told the
crew of USAir Flight 427 to descend to 6,000 feet.
“The [USAir captain] acknowledged the descent instructions and,
about 1859:04, [the crew] started to accomplish the preliminary
landing checklist (altimeters/flight instruments, landing data,
shoulder harnesses and approach briefing),” said the report.
At 1900:08, Pittsburgh Approach told the crew of Delta Flight
1083 to turn left to a heading of 130 degrees and to reduce
airspeed to 190 knots. The controller then told the crew of
USAir Flight 427 to fly a heading of 140 degrees and to reduce
airspeed to 190 knots.
At 1900:24, the cockpit voice recorder (CVR) recorded the
sound of the flap handle being moved.
“According to USAir personnel, the standard configuration for
a [B-]737-300 airplane operating at an airspeed of 190 knots
Cockpit Voice Recorder Transcript,
USAir Flight 427, Boeing 737-300,
Near Aliquippa, Pennsylvania, U.S.,
Sept. 8, 1994
(FSF editorial note: The following transcript begins as the
aircraft is descending to 6,000 feet on approach to Pittsburgh
[Pennsylvania, U.S.] International Airport. The transcript is
as it appears in the U.S. National Transportation Safety Board
accident report, except for minor column rearrangement and
addition of notes defining some terms that may be unfamiliar
to the reader. Times are local.)
Time Source Content
1859:04 HOT-2 I guess we ought to do a preliminary
Pete.
1859:06 HOT-1 altimeters and flight instruments
thirty eleven?
1859:08 HOT-2 my side.
1859:11 HOT-1 aah, where are we … landing data is …
1859:12 285LM Pit, two eight five Lima Mike is
thirteen for uhh, ten with Allegheny’s
Hotel.
1859:14 HOT-2 posted on my side for a hundred and
nine.
1859:15 APR November two eight five Lima Mike,
Pittsburgh approach. direct Montour
vector ILS runway two eight final
approach course.
1859:16 HOT-1 thirty three, forty three an two hundred.
1859:21 285LM Montour on the vectors, Lima Mike …
1859:22 HOT-1 shoulder harness?
1859:24 APR USAir fourteen sixty two, descend
and maintain six thousand.
1859:25 HOT-2 on.
1859:28 CAM [sound of clicks similar to shoulder
harness being fastened]
1859:28 HOT-1 approach brief?
1859:30 APR USAir three seventy four, contact
approach one two three point niner
five, good day.
1859:31 HOT-2 plan two eight right. two seventy nine
inbound, one eleven seven.
1859:36 HOT-2 [sound similar to deep inhale and
exhale]
1859:41 APR USAir three zero nine, Pittsburgh
approach, heading zero five zero
vector ILS runway three two final
approach course.
1859:54 HOT-1 ah, don’t do this to me.
1859:56 HOT-2 [sound of chuckle] froze up did it?
4 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
Flight Data Recorder Data, USAir Flight 427, Boeing 737-300,
Near Aliquippa, Pennsylvania, U.S., Sept. 8, 1994
Source: U.S. National Transportation Safety Board
Figure 1
during an approach to land would be flaps 1, which provides for
partial extension of the wing leading-edge slats and full extension
of the Krueger (wing leading-edge) flaps, and one degree of
extension of the wing trailing-edge flaps,” said the report.
At 1900:44, the first officer made a routine public-address (PA)
announcement to the passengers and asked the flight attendants
to prepare the cabin for arrival.
“The CVR indicated that, while the first officer was making
the PA announcement … , [Pittsburgh Approach] instructed
Delta Flight 1083 to turn left to a heading of 100 degrees,” the
report said. “Also during the first officer’s PA announcement,
the captain of USAir Flight 427 asked [Pittsburgh Approach],
‘Did you say [runway] two eight left for USAir four twentyseven?’”
At 1901:06, Pittsburgh Approach said, “Uh, USAir four
twenty-seven, it will be two eight right.”
At 1902:24, Pittsburgh Approach said, “USAir four twentyseven,
turn left [to] heading one zero zero. Traffic will be [at
your] one [o’clock] to two o’clock [position], six miles
[distant]. [The traffic is a British Aerospace] Jetstream climbing
out of thirty-three [hundred feet] for five thousand [feet].”
The captain said, “We’re looking for the traffic [and] turning
to one zero zero, USAir four twenty-seven.”
Flight data recorder (FDR) data showed that, at 1902:53, the
airplane was in a seven-degree left bank, rolling out of the left
turn to the assigned heading of 100 degrees, at 6,000 feet
and 190 knots. (Figure 1 shows FDR data recorded during the
final 30 seconds of the flight.)
At 1902:54.3, the first officer told the captain, “Oh, ya, I see
zuh Jetstream.” The report said that the Jetstream would have
been visible through the lower part of the first officer’s middle
window.
“As the first officer finished this statement (at about 1902:57),
the CVR recorded a sound similar to three thumps in one
second, the captain stating ‘sheeez’ (at 1902:57.3) and the first
officer stating ‘zuh’ (at 1902:57.5),” the report said.
1.0
0.5
0.0
−20
−10
0
10
−180
−90
0
90
180
8000
5000
2000
80
60
40
20 4.0
3.0
2.0
1.0
0.0
30
00
−30
−60
−90
0
90
180
270
360
250
200
150
Pitch Angle (degrees)
Vertical
Acceleration (Gs)
2 N1 Right Engine (%)
1 N1 Left Engine (%)
Indicated Airspeed
(knots)
Magnetic Heading
(degrees)
Control Column
(degrees)
Longitudinal
Pressure Altitude (feet) Acceleration (Gs)
Roll (degrees)
19:02:52.0
19:02:54.0
19:02:56.0
19:02:58.0
19:03:00.0
19:03:02.0
19:03:04.0
19:03:06.0
19:03:08.0
19:03:10.0
19:03:12.0
19:03:14.0
19:03:16.0
19:03:18.0
19:03:20.0
19:03:22.0
Local Time
2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 2
2
1
1
1
2 1
2 1
2 1
2 1
2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1
N1 LEFT & RIGHT ENGINES
LONGITUDINAL ACCELERATION
VERTICAL ACCELERATION
CONTROL COLUMN POSITION
PITCH
ROLL
HEADING
ALTITUDE
INDICATED AIRSPEED
HOT-2 oh ya, I see zuh Jetstream.
HOT-1 [sound similar to three thumps]
HOT-1 sheeez.
HOT-2 zuh.
CAM [sound of thump]
HOT-1 [sound similar to person inhaling/exhaling quickly one time]
CAM [sound of “clickety click”]
HOT-1 whoa.
HOT-2 [sound similar to pilot soft grunting]
CAM [sound of “clickety click”]
HOT-1 hang on.
HOT-1 hang on.
CAM [sound of click and wailing horn similar to auto-pilot disconnect]
HOT-1 hang on.
HOT-2 oh #.
HOT-1 hang on.
CAM [sound of increasing amplitude similar to onset of stall buffet]
CAM [vibrating sound similar to aircraft stick shaker starts and continues to
HOT-1 what the hell is this?
HOT-1 what the …
HOT-2 oh …
HOT-1 oh God … oh God.
RDO-1 four twenty seven emergency.
HOT-2 #.
HOT-1 pull
HOT-2 oh #.
HOT-1 pull
HOT-1 (pull)
HOT-2 God.
HOT-1 [sound of screaming]
HOT-2 no.
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 5
“Between about 1902:57 and about 1902:58, FDR data
indicated that USAir Flight 427’s airspeed fluctuated from
about 190 knots to about 193 knots and then decreased to about
191 knots for the next four seconds.
“Between about 1902:57 and about 1902:59, FDR data
indicated that the airplane’s left bank steepened from slightly
less than eight degrees to slightly more than 20 degrees.”
The CVR recorded the sound of a thump and two “clickety
click” sounds.
“About 1902:59, the left roll was arrested, and the airplane began
to briefly roll right toward a wings-level attitude,” the report
said. “FDR data show that, between about 1902:59 and about
1903, the airplane’s left bank had decreased to about 15 degrees.”
The airplane yawed rapidly left through the assigned heading
of 100 degrees. The captain said “whoa,” and the first officer
grunted softly.
“By just after 1903, the airplane had begun to roll rapidly back
to the left again; its airspeed remained about 191 knots,” the
report said. “FDR heading data indicated that, by 1903:01, the
airplane’s heading had moved left through about 089 degrees
and continued to move left at a rate of at least five degrees per
second.”
The captain told the first officer to “hang on,” and the first officer
grunted loudly. The captain repeated “hang on” three more times.
The airplane’s left bank angle increased to approximately 43
degrees, and the airplane began to descend from 6,000 feet.
The control column began to move aft, and airspeed began to
decrease below 190 knots.
“The CVR recorded the sound of the autopilot disconnect
horn [at 1903:02.1],” the report said. “During the next five
seconds, the FDR recorded increasing left roll, aft control
column, decreasing altitude and a decreasing airspeed to
about 186 knots.”
At 1903:07.5, the CVR recorded a sound similar to the onset
of stall buffet and then a sound similar to activation of the
stick shaker, which is part of the airplane’s stall-warning
system.
The captain said, “What the hell is this?” The sound similar
to stick-shaker activation continued until the end of the
recording.
“At 1903:08.3, an aural tone similar to an altitude alert sounded,
and, one second later, the traffic-alert and collision avoidance
system [TCAS] sounded ‘traffic [traffic],’” the report said. The
reason for the TCAS traffic alert was not known, but the report
said that the airplane was within approximately three miles of
Atlantic Coast Flight 6425 (the Jetstream) at the time.
1900:08 APR Delta ten eighty three, turn left
heading one three zero. reduce speed
to one niner zero.
1900:12 HOT-1 [intermittent static sound (heard on
captain’s channel only) for seventeen
seconds]
1900:12 HOT-1 I hate it when you don’t hear the
other transmissions.
1900:13 DL1083 one thirty one ninety speed, Delta ten
eighty three.
1900:14 HOT-2 [chuckle] yeah.
1900:15 APR USAir four twenty seven turn left
heading one four zero, reduce speed
to one niner zero.
1900:20 RDO-1 OK, one four zero heading and one
ninety on the speed, USAir four
twenty seven.
1900:24 CAM [sound of three clicks similar to flap
handle being moved]
1900:26 CAM [sound of single chime similar to seat
belt chime]
1900:26 HOT-2 oops, I didn’t kiss ’em ’bye.
1900:28 CAM [clicking sound similar to trim wheel
turning at auto-pilot trim speed]
1900:31 HOT-2 what was the temperature, ’member?
1900:33 APR five Lima Mike contact Pittsburgh
departure one two four point seven
five.
1900:34 HOT-1 seventy five.
1900:35 HOT-2 seventy five?
1900:37 CAM [clicking sound similar to trim wheel
turning at auto-pilot trim speed]
1900:40 285LM twenty four seventy five, Lima Mike.
1900:43 PA-4 … seatbelts and remain seated for the
duration of the flight.
1900:44 PA-2 folks, from the flight deck we should
be on the ground in ’bout ten more
minutes. uh, sunny skies, little hazy.
temperature, temperature’s ah, seventy
five degrees. wind’s out of the west
around ten miles per hour. certainly
’preciate you choosing USAir for your
travel needs this evening, hope you’ve
enjoyed the flight. hope you come
back and travel with us again. this time
we’d like to ask our flight attendants
please prepare the cabin for arrival.
ask you to check the security of your
seatbelts. thank you.
1900:46 APR Delta ten eighty three, turn left
heading one zero zero.
1900:48 DL1083 one zero zero, ten eighty three.
6 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
1901:04 RDO-1 did you say two eight left for USAir
four twenty seven?
1901:06 CAM [chime similar to seatbelt chime]
1901:06 APR uh, USAir four twenty seven, it’ll be
two eight right.
1901:08 RDO-1 two eight right, thank you.
1901:10 HOT-1 two eight right.
1901:11 HOT-2 right, two eight right. that’s what we
planned on. autobrakes on one for it.
1901:18 APR Delta ten eighty three contact
approach one two four point one five.
1901:22 DL1083 twenty four fifteen, good day.
1901:26 APR USAir fourteen sixty two at six
thousand, reduce speed to one niner
zero.
1901:35 HOT-1 I can’t * * *.
1901:36 APR USAir three zero niner, descend and
maintain six thousand then reduce
speed to one niner zero.
1901:42 HOT-2 Bravo thirty nine … that’s not too bad
that’s …
1901:47 APR USAir eighteen seventy four turn
right heading one zero zero. contact
approach one two three point niner
five.
1901:48 HOT-2 … ’bout half way.
1901:50 CAM [aural tone similar to altitude alert]
1901:51 HOT-2 (then) … (works)
1901:56 HOT-1 seven for six.
1901:57 APR USAir fourteen sixty two turn right
heading zero eight zero.
1901:58 HOT-2 seven for six.
1902:06 HOT-1 boy, they always slow you up so bad
here.
1902:08 HOT-2 that sun is gonna be just like it was
takin’ off in Cleveland yesterday too.
I’m just gonna close my eyes. [sound
of laughter] you holler when it looks
like we’re close. [sound of laughter]
1902:24 HOT-1 [sound of chuckle] OK.
1902:24 APR USAir four twenty seven, turn left
heading one zero zero. traffic will be
one to two o’clock, six miles,
northbound Jetstream, climbing out
of thirty three for five thousand.
1902:32.0 RDO-1 we’re looking for the traffic, turning
to one zero zero, USAir four twenty
seven.
1902:32.9 CAM [sound similar to aircraft engines
increasing in RPM to a steady value]
A recording of air traffic control (ATC) communications
showed that, at 1903:10, one of the flight crewmembers said,
“Oh (unintelligible). Oh (expletive).” The approach controller
saw that Flight 427’s altitude readout was 5,300 feet, and he
said, “USAir four twenty-seven, maintain 6,000 [feet], over.”
The CVR transcript does not include these transmissions.
“From about 1903:09 to about 1903:22, the first officer’s radio
microphone was activated and deactivated repeatedly, so the
ATC tapes recorded exclamations and other sounds from the
accident airplane,” the report said.
At 1903:15, the captain told Pittsburgh Approach, “Four
twenty-seven, emergency.” He then told the first officer two
times or three times to “pull.”
“During postaccident interviews, air traffic controllers who
were in the tower cab when the accident occurred reported
that they observed dense smoke rising to the northwest of the
airport shortly after USAir Flight 427’s final transmission,”
the report said. “The CVR stopped recording at 1903:22.8.”
The airplane struck a densely wooded hill approximately six
nautical miles (11 kilometers) northwest of PIT. The report
said that the accident occurred in daylight, at 1903:23. The
airplane was destroyed by the impact and a postaccident fire.
The two pilots, three flight attendants and 127 passengers were
killed as a result of “blunt force impact trauma.” The report
said the accident was not survivable, because no occupiable
space remained intact.
“The airplane wreckage was severely fragmented, crushed
and burned,” the report said. “Some pieces of wreckage were
excavated from the hillside at depths of up to eight feet
[2.5 meters]. Most of the airplane wreckage … was located
within a 350-foot [107-meter] radius of the main impact crater.”
The U.K. Air Accidents Investigation Branch (AAIB), which
assisted NTSB in reconstructing the airplane, found no
evidence of a preimpact explosion. (NTSB asked AAIB to
assist in the reconstruction of the B-737 because of the AAIB’s
experience in reconstructing the Boeing 747 [Pan American
Airlines Flight 103] that experienced an in-flight explosion
and struck terrain near Lockerbie, Scotland, on Dec. 21, 1988.
All 259 airplane occupants were killed, and 11 people on the
ground were killed.)
“The wreckage was further examined by explosion
experts from the [U.S. Federal Aviation Administration
(FAA)] and the [U.S. Federal Bureau of Investigation], and
they also found no evidence of any preimpact explosion,”
said the report.
Because large flocks of migratory birds were seen by people
on the ground in the Pittsburgh area throughout the afternoon
and evening of the accident, the wreckage was examined for
indications of a bird strike. No such indications were found.
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 7
Investigators examined whether wake turbulence from the
Atlantic Coast Jetstream 31 or from the Delta B-727 was
involved in the upset.
The Jetstream was 1,500 feet (458 meters) lower and 3.5
nautical miles (6.5 kilometers) from Flight 427 when the upset
occurred. Thus, wake turbulence from the Jetstream did not
affect Flight 427, said the report.
The Delta B-727 was descending through 6,300 feet in the
approximate location where, 69 seconds later, the initial upset
of Flight 427 occurred at 6,000 feet. The report said that a
study performed jointly by NTSB and the U.S. National
Aeronautics and Space Administration (NASA) determined that
Flight 427 likely encountered wake turbulence from the B-727.
The report said that the characteristics of the wake turbulence
could not be identified because of FDR data limitations. The
FDR recorded 13 parameters, including altitude, indicated
airspeed, heading, roll attitude, pitch attitude, control-column
position and vertical acceleration. The FDR did not record
flight-control-surface positions or movements of the rudder
controls and aileron controls.
The report said, however, that further studies, including flight
tests, indicated that the wake turbulence from the Delta airplane
should not have caused significant control problems for the
USAir crew.
“According to the flight-test-pilot statements, although the
wake encounters had varying effects on the [B-]737 flighthandling
characteristics, the effects usually lasted only a few
seconds and did not result in a loss of control or require extreme
or aggressive flight control inputs to counteract,” the report
said. “The flight-test pilots with experience flying in air carrier
operations stated that the wake encounters experienced
during the flight tests were similar to those that they had
experienced during normal flight-line operations. The pilots
described the wake encounters as ‘routine’ and not startling.”
Sounds recorded by the CVR in the airplane used for the
wake-turbulence flight tests were similar to the thumps recorded
by the accident airplane’s CVR. The clickety-click sounds
recorded by the accident airplane’s CVR were identified as
possibly resulting from wake turbulence striking the windshield
wipers and causing them to chatter or slap against the windshield.
The report said that air traffic controllers had maintained the
required wake-turbulence separation between the airplanes.
“The accident airplane and the [B-727] that preceded it
inbound to PIT (Delta Flight 1083) were separated by at least
4.1 [nautical] miles [7.6 kilometers] when they were at the
same altitude,” said the report.
Investigators examined the possibility that the upset was
caused by several other factors, including: asymmetric
1902:34.8 CAM [clicking sound similar to trim wheel
turning at auto-pilot trim speed]
1902:54.3 HOT-2 oh ya, I see zuh Jetstream.
1902:57.0 HOT-1 [sound similar to three thumps]
1902:57.3 HOT-1 sheeez.
1902:57.5 HOT-2 zuh.
1902:58.0 CAM [sound of thump]
1902:58.5 HOT-1 [sound similar to person inhaling/
exhaling quickly one time]
1902:58.6 CAM [sound of “clickety click”]
1902:59.1 CAM [sound of thump of less magnitude
than the first thump]
1902:59.3 HOT-1 whoa.
1902:59.5 CAM [sound of “clickety click”]
1903:00.3 HOT-2 [sound similar to pilot soft grunting]
1903:00.7 CAM [sound of unknown click]
1903:01.1 HOT-1 hang on.
1903:01.1 CAM [sound similar to aircraft engines
increasing in RPM]
1903:01.5 HOT-2 [sound similar to pilot loud grunting]
1903:01.9 HOT-1 hang on.
1903:02.1 CAM [sound of click and wailing horn
similar to auto-pilot disconnect]
1903:03.6 HOT-1 hang on.
1903:04.4 HOT-2 oh #.
1903:05.2 HOT-1 hang on.
1903:07.5 CAM [sound of increasing amplitude
similar to onset of stall buffet]
1903:07.9 CAM [vibrating sound similar to aircraft
stick shaker starts and continues to
end of recording]
1903:08.0 HOT-1 what the hell is this?
1903:08.3 CAM [sound of aural tone similar to
altitude alert]
1903:09.4 JSAP traffic traffic
1903:09.4 CAM traffic traffic
1903:09.6 HOT-1 what the …
1903:09.9 HOT-2 oh …
1903:10.6 HOT-1 oh God … oh God.
1903:13.3 APR USAir …
1903:15.0 RDO-1 four twenty seven emergency.
1903:17.4 HOT-2 #.
1903:18.1 HOT-1 pull
1903:18.5 HOT-2 oh #.
8 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
1903:19.1 HOT-1 pull
1903:19.7 HOT-1 (pull)
1903:20.8 HOT-2 God.
1903:21.1 HOT-1 [sound of screaming]
1903:22.5 HOT-2 no.
1903:22.8 End of Recording
RDO = Radio transmission from accident aircraft
CAM = Voice or sound source recorded through
cockpit area microphone
HOT = Voice or sound source recorded through
cockpit hot microphone
PA = Voice or sound source recorded through
public address system
JSAP = Voice or sound source recorded through jump
seat audio panel
-1 = Voice identified as captain
-2 = Voice identified as first officer
-4 = Voice identified as male flight attendant
APR = Radio transmission from Pittsburgh approach
controller
DL1083 = Radio transmission from Delta flight 1083
285LM = Radio transmission from aircraft 285LM
* = Unintelligible word
# = Expletive
( ) = Questionable insertion
[ ] = Editorial insertion
… = Pause
Source: U.S. National Transportation Safety Board
system, or a severe atmospheric disturbance, such as a
rotor.3, 4
• On June 9, 1996, Eastwind Airlines Flight 517, a Boeing
737-200, abruptly yawed right and then rolled right while
descending through 4,000 feet on approach to Richmond,
Virginia, U.S. The captain, who was hand-flying the
airplane, said that he “stood pretty hard on the [left] rudder
pedal,” applied left aileron and advanced the right power
lever. The airplane rolled back to a wings-level attitude,
momentarily banked left, but then abruptly banked right
again. The crew conducted the emergency checklist, which
included disengaging the yaw damper. The upset event
stopped, and the airplane flew normally throughout the
remainder of the approach and landing. None of the
53 occupants was hurt, and the airplane was not damaged.
The investigation revealed that about one month before
the incident, the captain flew the same airplane back to
the departure airport after feeling a series of “taps” on
the rudder pedals just after takeoff. The main rudder PCU
was replaced, and the airplane was returned to service.
On June 1, 1996, and June 8, 1996, other pilots reported
yaw/roll events in the airplane.
“As a result of these reports, the yaw damper transfer
valve and the yaw damper linear variable displacement
transducer were removed and replaced on June 8,”
the report said. A postmaintenance test flight was
satisfactory, and the airplane was returned to service.
The incident occurred the next day, June 9.
After the incident, the main rudder PCU and yaw-damper
coupler were replaced, and new wiring was installed
between the PCU and the yaw-damper coupler. The report
said that no further rudder anomalies were reported.
The B-737-300 has a single rudder panel that normally is
actuated by a single PCU; a standby actuator is available if
either, or both, of the airplane’s primary hydraulic systems
fails. The report said that the B-737 is the only large transport
category airplane with two wing-mounted engines that was
designed with a single rudder panel and a single rudder actuator.
“All other large transport category airplanes with twin wingmounted
engines were designed with a split rudder panel,
multiple hydraulic actuators or a mechanical/manual/trim tab
rudder-actuation system,” said the report.
The B-737 main rudder PCU is powered by the two primary
hydraulic systems, each of which provides approximately
3,000 pounds (1,361 kilograms) of pressure to move the rudder.
The PCU is mounted on the vertical-fin structure and has an
actuator rod attached to the rudder.
“The [PCU] operates by converting either a mechanical
input from the rudder pedals or an electrical signal from the
deployment of thrust reversers; asymmetric activation of
the ailerons and spoilers; uncommanded flight control
movements resulting from transient electronic signals; yaw
damper malfunctions; and a rudder cable break or pull. The
investigation eliminated each of these factors as a possible
cause of the upset.
The report said that another factor that might have caused the
upset — an uncommanded movement of the rudder — was
identified very early in the investigation. Rudder-control
anomalies were suspected of having been involved in the
following accident and incident:
• On March 3, 1991, United Airlines Flight 585, a Boeing
737-291, was on a visual approach to Colorado Springs
(Colorado, U.S.) Municipal Airport in moderate-tosevere
turbulence and gusty-wind conditions when it
yawed right, rolled right, pitched nose down and struck
terrain. The 25 occupants were killed.
The probable cause of the accident was not determined,
but NTSB said that the two most likely events that could
have resulted in the upset were a malfunction of the
airplane’s lateral control system or directional control
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 9
yaw-damper system into motion of the rudder by means of
mechanical linkages (summing levers, input cranks and shafts)
and a servo valve that directs hydraulic fluid either to extend
or retract the PCU actuator rod that moves the hinged rudder
surface,” said the report.
The servo valve comprises a primary slide that moves
within a secondary slide that, in turn, moves within the
servo-valve housing (see Figure 2). The slides are moved by
summing levers activated by the rudder pedals or by the
yaw-damper system. Each slide can move a total distance of
about 0.09 inch (2.3 millimeters).
“The primary slide is normally displaced first, and the
secondary slide is displaced only when the primary slide does
not provide enough hydraulic flow to keep up with the input
commanded by the pilots or the yaw damper (that is, when the
movement of only the primary slide is not sufficient to move
the rudder at the commanded rate),” said the report.
The slides are designed to provide an equal flow of hydraulic
fluid. With no aerodynamic load on the rudder, the primary
slide can provide a rudder-travel rate of approximately
33 degrees per second; the primary slide and secondary slide
together can provide a rudder-travel rate of approximately
66 degrees per second.
The report said that flight tests and computer simulations
showed that the heading-change rates recorded by the FDR
during the upset of Flight 427 were consistent with the rudder
being deflected at 1903 to its left aerodynamic blowdown limit.
“This movement of the airplane’s rudder could only have been
caused by a flight-crew action or a mechanical rudder-system
anomaly,” said the report. “The potential for such a mechanical
rudder anomaly was demonstrated during postaccident tests
in which the [PCU] secondary slide was intentionally jammed
(pinned) to the servo valve housing and a rapid input was
applied in a direction that would oppose the jam.
“These tests showed that the primary slide could overtravel,
resulting in hydraulic fluid porting in such a way that the rudder
moves to its aerodynamic blowdown position in the direction
opposite to the rudder input (rudder reversal).”
When the accident airplane’s PCU was tested with hydraulic
fluid heated to a temperature 180 degrees F (82 degrees C)
higher than the temperature of the servo valve housing, the
secondary slide jammed against the servo valve housing, and
a momentary rudder reversal occurred. Following the tests,
there was no physical evidence that a jam had occurred, and
the slides moved freely.
“The temperature differential to which the accident PCU servo
valve was exposed [in these tests] was greater than that
expected in normal operation,” the report said. “Nonetheless,
these thermal tests demonstrate that it is possible for the
secondary slide … to jam to the valve housing and leave no
evidence of physical marks.
“These tests also demonstrate that, with the secondary slide
thus jammed, it is possible for the primary slide to overtravel
and cause a rudder hardover in the direction opposite to that
commanded without leaving any physical evidence.”
The report said that the USAir Flight 427 upset — and the
upsets of United Flight 585 and Eastwind Flight 517 — were
most likely caused by movement of the rudder surfaces to their
blowndown limits in directions opposite to that commanded
by the pilots.
“The rudder surfaces most likely moved as a result of jams of
the secondary slides to the servo valve housings offset from
their neutral position and overtravel of the primary slides,”
said the report.
The report said that evidence showed that the following
scenario likely occurred during the final moments of
Flight 427:
The captain’s “sheeez” and the first officer’s “zuh” at
1902:57 were exclamations of surprise regarding the
wake-turbulence encounter. The first officer then applied
significant right control wheel input to correct the left
roll caused by the turbulence. The airplane began rolling
back toward level flight, and the first officer relaxed the
right control wheel input.
Between 1902:58 and 1903, a significant yawing motion
caused the airplane’s heading to move rapidly past the
assigned 100 degrees to 94 degrees. The captain’s
“whoa” at 1902:59.3 likely was in response to the yawing
motion. (The captain did not make any control inputs
Primary
Slide
Servo Valve
Housing
Secondary
Slide
Boeing 737-300 Main Rudder Power
Control Unit Servo Valve
Source: U.S. National Transportation Safety Board
Figure 2
10 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
when the upset began; however, the captain might have
made control inputs later.)
“It would have been reasonable for the first officer to
respond to this yawing motion (and, possibly, to the
captain’s statement) by applying right rudder pedal
pressure about 1903,” the report said. “This right rudder
input, intended to relieve the sideforce and return the
airplane to its assigned heading, was instead followed
by a rapid rudder deflection to the left (rudder reversal)
that increased the left-yawing motion and accelerated
the airplane’s heading change to the left.”
As the rudder moved left to its blowdown position, the
right rudder pedal rose against the first officer’s right
foot and opposed his effort to depress the pedal. The
first officer grunted loudly as a result of expending
significant physical effort against the right rudder pedal.
He also applied full right control wheel in response to
the airplane’s left rolling and yawing motion.
The first officer’s loud grunting stopped at 1903:02.1, the
same time the CVR recorded the sound of the autopilot
disengaging. The control wheel briefly was returned to
near neutral, and no more grunting or straining sounds
were recorded until a few seconds before ground impact.
“This evidence is consistent with the first officer slightly
relaxing his control wheel [inputs] and rudder pedal
inputs — perhaps because he thought that he was
contending with a malfunctioning autopilot, in which
case autopilot disengagement would restore normal
control,” said the report.
The left bank continued to increase, however. The first
officer — and, possibly, the captain — applied aft control
column input to prevent the airplane from pitching
nose-down. Airspeed began to decrease. The airplane
pitched nose-down and began to descend. When the
stick shaker activated at 1903:07.9, the airplane was
descending through 5,700 feet in a 70-degree left bank
and a 20-degree nose-down pitch attitude.
“[About 1903:11], the control column reached its fullaft
position; the airplane’s bank angle had gone beyond
vertical (90 degrees), and its pitch attitude had exceeded
50 degrees below the horizon,” said the report. The
airplane struck terrain about 11 seconds later.
Flight tests and computer simulations showed that the crew might
have regained control of the airplane during the early stages of
the upset if they had maintained full right control wheel input
and applied sufficient forward pressure on the control column
to maintain airspeed above 187 knots — the crossover airspeed.5
“The flight tests revealed that … at airspeeds above 187 KCAS
[knots calibrated airspeed], the roll induced by a full rudder
deflection could be corrected by control wheel input; however,
in the same configuration at airspeeds of 187 KCAS and below,
the roll induced by a full rudder deflection could not be
completely eliminated by full control wheel input in the
opposite direction, and the airplane continued to roll into the
direction of the rudder deflection.”
The report said, “Flight simulations indicated that, with a
rudder deflected to its aerodynamic blowdown limit and in
the configuration and conditions of the USAir Flight 427
accident airplane, the roll could not be completely eliminated
(and control of the airplane could not be regained) by using
full control wheel inputs if the airspeed remained below
187 KCAS.
“The pilots who were involved in the flight [tests] and simulator
tests indicated that successful recovery required immediate
flight-crew recognition of the upset event and subsequent
prompt control wheel inputs to the full authority of the
airplane’s roll control limits and pitch flight control inputs to
maintain a speed above the crossover airspeed.
“To return the airplane to a wings-level attitude, the pilots had
to avoid excessive maneuvering that would increase the vertical
load factor, or angle-of-attack, and, thus, increase the crossover
airspeed.”
The report said that the crew of Flight 427 could not be expected
to have assessed the flight-control problem and to have
conducted the appropriate rudder-reversal recovery procedure.
“The pilots did not have foreknowledge of the problem,
immediate awareness of its onset and prior training and
experience with the crossover airspeed phenomenon,” said the
report.
At the time of the accident, the pilot-training programs used by
USAir and four other major airlines surveyed by investigators
did not include training in recovery from unusual attitudes or
upsets. Another airline surveyed by investigators, United Airlines,
recently had implemented flight-simulator training of B-757
pilots and B-767 pilots in unusual-attitude-recovery procedures.
According to FAA, as of January 1999, at least 13 U.S. air
carriers, including US Airways, had implemented “specialevents
training.” FAA, however, does not require such training
and does not address flight-control malfunctions in guidance
materials for unusual-attitudes-training programs.
The report said that training of many B-737 pilots in recovering
from a jammed or restricted rudder condition is inadequate
because flight simulators are not being used and the crossoverairspeed
phenomenon is not being demonstrated.
Also, the report said that many B-737s are operated at block
maneuvering speeds6 that do not provide an adequate margin
above the crossover speed.
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 1 1
“The Boeing-recommended block-maneuvering-speed
schedule specifies 190 knots, which only slightly exceeds the
1 G crossover airspeed, as the minimum speed for a [B-]737
operating at a gross weight of 110,000 pounds [49,896
kilograms] in the flaps 1 configuration,” the report said. “Only
one-third of the 12 U.S. [B-]737 air carrier operators contacted
… in July 1998 … actively promoted the practice of adding
10 knots to the [B-]737 block maneuvering speeds (for which
Boeing has expressed neither support nor disapproval).”
FAA in 1996 issued an airworthiness directive (AD) requiring
revision of the B-737 airplane flight manual (AFM) to include
procedures for maintaining airplane control during an
uncommanded yaw or roll, or with a jammed or restricted
rudder. Another AD, issued in 1997, required installation within
three years of a device to limit rudder authority in flight
conditions that do not require full rudder authority.
“The hydraulic-pressure reducer that is being retrofitted on
earlier series [B-]737 models and the hydraulic-pressure limiter
being installed in the [new] models should provide flight crews
with a greater margin of controllability and additional response
time for executing the required [AFM] procedures,” said the
report.
Nevertheless, the report said that the AFM procedures establish
the pilot’s ability to center the rudder pedals as an indication
of successful resolution of the rudder malfunction. This is not
a valid indication that a rudder reversal has been resolved.
“Compliance [elastic deformation] in the rudder system could
allow the rudder pedals to reach the neutral position while the
rudder surface remains deflected to the blowdown limit,” said
the report.
From April 1980 through January 1998, FAA issued 10 ADs
regarding the B-737 rudder system. (Two ADs were issued
before the accident; eight were issued after the accident.) A
1997 AD required installation of a redesigned PCU servo valve.
“The redesigned main rudder PCU servo valve should eliminate
the possibility of a rudder reversal from the specific
circumstances of a secondary slide jam to the servo valve
housing combined with overtravel of the primary slide,” the
report said. “When completed, the rudder design changes to
the [B-]737 should preclude the rudder reversal failure mode
that most likely occurred in the USAir Flight 427 and United
Flight 585 accidents, and the Eastwind Flight 517 incident.
“However, even with these changes, the [B-]737 series
airplanes … remain susceptible to rudder-system malfunctions
that could be catastrophic.”
On Feb. 23, 1999, a US Airways Metrojet 737 experienced a
rudder hardover in flight. (Preliminary investigation indicated
that the rudder, which incorporated the redesigned main rudder
PCU servo valve, had traveled slowly to its blowdown limit.)
The flight crew regained rudder control after activating the
standby-rudder-actuating system, as prescribed by the airline’s
“jammed-or-restricted-rudder” checklist.
“This event could have resulted in an unrecoverable loss of
control if it had occurred at a lower altitude or airspeed,” said
the report.
The original type certificate for the B-737 was issued in 1967.
The B-737-300 was added to that type certificate in 1984. Thus,
the airplane was not required to comply with a 1970
amendment of U.S. Federal Aviation Regulations (FARs) Part
25, the certification standards for transport category airplanes,
that requires that an airplane be capable of continued safe flight
after flight-control malfunctions, including “a runaway of a
flight control to an adverse position and jam … if such runaway
and subsequent jamming is not extremely improbable.”7
The report said, “The [B-]737 has a history of rudder systemrelated
anomalies, including numerous instances of jamming.”
When the main rudder PCU jams, the crew must manually
activate the standby PCU. Thus, the rudder-actuation system
is redundant, but it is not reliably redundant, because the
standby system does not activate automatically.
“If a jam were to occur close to the ground or result in an
unusual attitude, the pilots could lose control of the airplane
before they were able to diagnose the problem and engage the
standby rudder,” the report said.
The report said that the B-737 needs a reliably redundant
rudder-actuation system, one in which the standby PCU activates
automatically and immediately if the main PCU jams or moves
the rudder without a pilot command or yaw damper command.
As a result of the investigation, NTSB made the following
recommendations to FAA:
• “Require that all existing [B-737s] and future [B-737s]
have a reliably redundant rudder-actuation system.
(A-99-20);
• “Convene an engineering-test-and-evaluation board to
conduct a failure analysis to identify potential failure
modes, a component and subsystem test to isolate
particular failure modes found during the failure analysis,
and a full-scale integrated systems test of the [B-737]
rudder-actuation-and-control system to identify potential
latent failures and validate operation of the system without
regard to minimum certification standards and
requirements in [FARs] Part 25. Participants in the
engineering-test-and-evaluation board should include
[FAA], [NTSB] technical advisers, The Boeing Company,
other appropriate manufacturers and experts from other
government agencies, the aviation industry and academia.
A test plan should be prepared that includes installation
12 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
of original [B-737 main rudder PCUs], redesigned
[B-]737 main rudder [PCUs] and related equipment, and
exercises all potential factors that could initiate anomalous
behavior (such as thermal effects, fluid contamination,
maintenance errors, mechanical failure, system
compliance and structural flexure). The engineering
board’s work should be completed by March 31, 2000,
and published by the FAA. (A-99-21);
• “Ensure that future transport category airplanes
certificated by [FAA] provide a reliably redundant
rudder-actuation system. (A-99-22);
• “Amend [FARs Part] 25.671(c)(3) to require that
transport category airplanes be shown to be capable of
continued safe flight and landing after jamming of a
flight control at any deflection possible, up to and
including its full deflection, unless such a jam is shown
to be extremely improbable. (A-99-23);
• “Revise [AD] 96-26-07 so that procedures for addressing
a jammed or restricted rudder do not rely on the pilots’
ability to center the rudder pedals as an indication
that the rudder malfunction has been successfully
resolved, and require Boeing and U.S. operators of
[B-]737s to amend their [AFMs] and operations manuals
accordingly. (A-99-24);
• “Require all [FARs] Part 121 air carrier operators of the
[B-]737 to provide their flight crews with initial and
recurrent flight simulator training in the ‘uncommanded
yaw or roll’ [procedures] and ‘jammed or restricted
rudder’ procedures in Boeing’s 737 Operations Manual.
The training should demonstrate the inability to control
the airplane at some speeds and configurations by using
the roll controls (the crossover airspeed phenomenon),
and include performance of both procedures in their
entirety. (A-99-25);
• “Require Boeing to update its [B-]737 simulator package
to reflect flight-test data on crossover airspeed and then
require all operators of the [B-]737 to incorporate these
changes in their simulators used for [B-]737 pilot
training. (A-99-26);
• “Evaluate the [B-]737’s block-maneuvering-speed
schedule to ensure the adequacy of airspeed margins above
crossover airspeed for each flap configuration, provide
the results of the evaluation to air carrier operators of the
[B-]737 and [to NTSB], and require Boeing to revise the
block maneuvering speeds to ensure a safe airspeed margin
above crossover airspeed. (A-99-27);
• “Require that all [B-]737 airplanes operated under
[FARs] Parts 121 or 125 that currently have a flightdata
acquisition unit be equipped, by July 31, 2000, with
[an FDR] system that records, at a minimum, the
parameters required by [Parts] 121.344 and 125.226,
dated July 17, 1997, applicable to that airplane plus the
following parameters: pitch trim; trailing-edge [flaps]
and leading-edge flaps; thrust-reverser position (each
engine); yaw damper command; yaw damper on/off
discrete; standby rudder on/off discrete; and control
wheel [forces], control column [forces] and rudder pedal
forces (with yaw damper command; yaw damper on/off
discrete; and control wheel [forces], control column
[forces] and rudder pedal forces sampled at a minimum
rate of twice per second). (A-99-28); [and,]
• “Require that all [B-]737 airplanes operating under
[FARs] Parts 121 or 125 that are not equipped with a
flight-data acquisition unit be equipped, at the earliest
time practicable but no later than Aug. 1, 2001, with
[an FDR] system that records, at a minimum, the
parameters required by [Parts] 121.344 and 125.226,
dated July 17, 1997, applicable to that airplane plus the
following parameters: pitch trim; trailing-edge [flaps]
and leading-edge flaps; thrust-reverser position (each
engine); yaw damper command; yaw damper on/off
discrete; standby rudder on/off discrete; and control
wheel [forces], control column [forces] and rudder pedal
forces (with yaw damper command; yaw damper on/off
discrete; and control wheel [forces], control column
[forces] and rudder pedal forces sampled at a minimum
rate of twice per second). (A-99-29).”
On June 25, 1999, (three months after NTSB adopted the final
accident report), FAA issued the following responses to the
NTSB recommendations:
• “[Regarding A-99-20], [FAA] has established an
engineering-test-and-evaluation board to conduct an indepth
fault analysis of the rudder system. This group
will provide the FAA with valuable insights, information
and data to determine an appropriate course of action.
In the meantime, the FAA is working closely with The
Boeing Company to explore various design options for
existing and future [B-]737 airplanes;
• “[Regarding A-99-21], the FAA agrees with the intent
of this safety recommendation and has convened an
engineering-test-and-evaluation board to conduct a
failure analysis of the rudder system. The engineering
board consists of representatives from the FAA
(including two national resource specialists), The Boeing
Company, [NTSB, NASA], the [U.S.] Department of
Defense, the Air Line Pilots Association [International]
and the Air Transport Association of America. The
engineering board will also include an engineer from
the Ford Motor Co. and an engineer from Ilyushin
Aviation Complex (a Russian aircraft-manufacturing
company). The engineer from Ford is included on
the engineering board to obtain an industry perspective
that is different from the aviation industry’s perspective.
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 1 3
“The group will identify potential failure modes,
component and subsystem tests to isolate particular
failure modes found during the failure analysis and a
full-scale integrated system test of the [B-]737 rudderactuation-
and-control systems to identify potential latent
failures and to validate operation of the system without
regard to minimum certification standards and
requirements in [FARs] Part 25. The engineering board
will also focus on any malfunction that could affect
lateral/directional control of the [B-]737 airplane.
“The engineering board will prepare a test plan to
include installation of original and redesigned [B-]737
main rudder [PCUs] and related equipment, and exercise
all potential factors that could initiate anomalous behavior
(like thermal effects, fluid contamination, maintenance
errors, mechanical failure, system compliance and
structural flexure). The engineering board is tasked to
complete its action and publish a report by March 31, 2000;
• “[Regarding A-99-22], the FAA has convened an
engineering-test-and-evaluation board to conduct a
failure analysis of the [B-]737 rudder system. It is
expected that this group will provide the FAA with
valuable insights, information and data for the [B-]737
[rudder] and other rudders of similar design to determine
an appropriate course of action;
• “[Regarding A-99-23], currently, [Part] 25.671(c)(3) has
two separate requirements concerning jams. The first is
related to normally encountered positions for six
specified phases of flight, and the second is related to
runaways followed by jams. [Safety Recommendation
A-99-23] asks that the FAA replace those two separate
requirements with a single, all-encompassing
requirement. The FAA does not agree with this approach.
“From a practical standpoint, continued safe flight and
landing with full deflection of certain control surfaces
is not possible in all regimes of flight. For example, it is
possible (though unlikely) that a pilot could command
full elevator deflection during high-speed flight. On
many conventional aircraft, this would likely be a
catastrophic event, as the airplane would exceed its
structural limits. Such an event could not be shown to
be extremely improbable. On the other hand, full
deflection of certain surfaces might not prevent continued
safe flight and landing (for example, a spoiler panel
hardover). Adopting this safety recommendation would
not allow differentiation between these two kinds of
events as currently allowed in [Part] 25.671(c)(3).
“The Flight Controls Harmonization Working Group has
been tasked with revising [Part] 25.671 … to take into
account any safety recommendations, but specifically
Safety Recommendation A-96-108 [in which NTSB said
that Part 25.671 should be revised to account for the failure
or jamming of any flight-control surface at its designlimited
deflection, and that all transport category aircraft
should be required to comply with the revised criteria].
The subject of normally encountered flight-control
positions is currently being discussed. One of the early
proposals would have permitted a time-based averaging
approach to determine the normally encountered flightcontrol
positions. That would have led to a small range of
deflections since most of the flight is spent in cruise. That
approach was rejected. The eventual product of the
working group’s discussion will be an advisory circular,
which would define one means of establishing normally
encountered flight-control positions for the various
phases of flight. However, in general, the proposals of the
working group do not include full-surface deflections in
the range of normally encountered flight-control
positions. In addition, the working group is also tasked
with revising [Parts] 25.671(c)(1) and 25.671(c)(2) to
address control-surface runaway, regardless of whether
or not the runaway leads to a jam.
“Through the working group, the FAA has addressed
this safety recommendation completely;
• “[Regarding A-99-24], the FAA started an initiative, with
participation from The Boeing Company and [NTSB]
staff, to determine the scope and appropriate revision to
the procedures for addressing a jammed or restricted
rudder. It is anticipated that this project will result in a
formal evaluation of the current procedures using the
[B-]737 engineering simulator. Based on the results of
the evaluation, an appropriate revision to existing
procedures and [AD] 96-26-07 will be made;
• “[Regarding A-99-25], the FAA is working with Boeing
and [NTSB] staff to determine the scope and appropriate
revision to the procedures for addressing a jammed or
restricted rudder. It is anticipated that this project will
result in a formal evaluation of the current procedures
using the [B-]737 engineering simulator. The FAA will
take action to address the issues of this safety
recommendation upon completion of the evaluation in
response to Safety Recommendation A-99-24;
• “[Regarding A-99-26], on April 30, 1999, The Boeing
Company, based upon new flight-test results, updated
the [B-]737-300 aerodynamic model, which more
accurately represents roll [characteristics] and yaw
characteristics of the [B-]737-300 aircraft. In addition,
similar handling characteristics exhibited by other
[B-]737 models will result in the development of
revisions to other [B-]737 simulator models.
“As a result of new Boeing flight-test data, the FAA
sent a letter to all U.S. operators of [B-]737-300 simulators
on May 28, 1999, requiring that the [B-]737-300
aerodynamic revisions be incorporated in the [B-]737-300
14 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
Other Parties’ Submissions to the Official Accident Investigation Report
Representatives of the U.S. Federal Aviation Administration
(FAA), The Boeing Co., Parker Hannifin, USAir and the Air
Line Pilots Association, International (ALPA) were parties
to the investigation of the accident involving USAir Flight
427, a Boeing 737-300, near Aliquippa, Pennsylvania, U.S.,
on Sept. 8, 1994. The following information is from party
submissions that were made in September 1997 and August
1998 to the U.S. National Transportation Safety Board
(NTSB) and included in NTSB’s final report on the accident.
U.S. Federal Aviation Administration
FAA said, “While the investigation has produced evidence
[that supports] the scenarios where the rudder moved to a
full-left position after an encounter with wake turbulence,
the cause of the movement is still at issue. The FAA, upon
review of the evidence, cannot conclude that a failure mode
which resulted in an uncommanded rudder movement on
Flight 427 has been identified.
“Any causal findings, to be legitimate, must have conclusive
evidence to support findings of a [rudder] hard-over or
[rudder] reversal. Such evidence has yet to be found.
Consequently, a specific causal finding of this nature may
not be appropriate.”
FAA said that the B-737 rudder-system abnormalities
discovered during the investigation were not shown to have
occurred on USAir Flight 427.
“While the FAA acknowledges the fact that some failure modes
of the main rudder power-control unit [PCU] servo valve have
been discovered during this accident investigation, it has not
been substantiated that any of these failures occurred on the
accident aircraft,” the FAA said. “The FAA also acknowledges
that a secondary slide jam to the housing of the servo valve
or interference with the rudder input link could provide both
full rudder rate and full hinge movement. However, once again,
there is no direct evidence that this occurred.”
FAA said, “[Boeing] and the FAA have reacted to the discovered
failure modes with modifications of the [B-737] rudder system,
including some [modifications] recommended by [NTSB] that
are designed to prevent future events of this type.
“However, the FAA does not believe sufficient evidence
exists to establish a rudder-system failure as the cause of
the accident.”
The Boeing Co.
Boeing said that the flight crew was startled by the severity
of the unexpected wake encounter, a full rudder deflection
occurred, the pilots applied aft pressure on the control
column, and the airplane entered a stall and remained
stalled for approximately 14 seconds as it descended to
the ground. Boeing said that the cause of the rudder
deflection was “not clear” and that there is no proof that the
rudder deflection was caused by a system malfunction.
“There is no evidence to support a conclusion that an
uncommanded full rudder deflection occurred,” Boeing said.
“While there is [no] conclusive evidence of a crew-commanded,
sustained left-rudder input, such a possibility is plausible and
must be seriously considered, especially given the lack of
evidence of an airplane-induced rudder deflection.”
Boeing said that the following were the most significant
findings of the accident investigation:
• “Commercial transport flight crews need to be
specifically trained to handle large upsets.
Transport-pilot training widely used in the 1994
time frame did not prepare flight crews for recovery
from the highly unusual roll rates and roll-and-pitch
attitudes encountered by the crew of Flight 427;
• “[B-]737 yaw damper reliability enhancements are
needed to reduce potential airplane contribution
to upsets;
• “[The following] highly unlikely potential failure
modes can be eliminated:
– “Potential [B-]737 rudder PCU failure modes;
[and,]
– “Potential [B-]737 rudder PCU input rod
fastener failure mode;
• “We can reduce the impact of either airplanerelated
or crew-input-related rudder upsets by
limiting [B-]737 rudder control authority;
• “Research is needed on better ways to detect
and avoid wake vortices;
• “Existing [B-]737 flight-control anomaly procedures
could be improved; [and,]
• “The flight data recorder information from this
accident was inadequate to prove definitive events.”
Boeing also recommended that “the appropriate
organizations within the industry take steps to improve
industry understanding of possible flight crew responses to
wake vortex encounters and other upset events.”
Parker Hannifin
Parker Hannifin, manufacturer of the Boeing-designed main
PCU servo valve, said that examination of the accident
airplane’s PCU revealed no physical evidence of a jam or
other anomaly.
“The conclusion reached by Boeing was that the accident
PCU would not seize if subject to thermal shocks or
temperature differential consistent with those which could be
encountered in realistic flight conditions,” said Parker Hannifin.
FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999 1 5
The company said that a significant indication of the PCU’s
reliability is a comparison of the unit’s performance during
acceptance tests when it was manufactured in 1987,
maintenance tests in September 1992 and postaccident
tests in September 1994 and August 1997.
“In each of these instances, the PCU consistently operated
normally and within specifications,” Parker Hannifin said.
“In sum, after years of one of the most critical examinations
in aviation history, there is no evidence that the main rudder
PCU from Flight 427 malfunctioned or was other than fully
operational.”
USAir
USAir said, “Data demonstrate, and all parties seem to
agree, that USAir Flight 427’s rudder moved to a full-left
position shortly after the aircraft encountered wake vortices
generated by a preceding aircraft. It is also clear that the
wake vortex encounter did not directly cause the accident.”
The airline said, “[The pilots] did not apply full-left rudder
during the wake vortex encounter, oppose it with opposite
aileron and spoiler, and hold these cross-controlled positions
while the aircraft spiraled to the ground.”
USAir said that the probable cause of the accident was “an
uncommanded, full rudder deflection or rudder reversal that
placed the aircraft in a flight regime from which recovery
was not possible using known recovery procedures.”
The airline said that the rudder deflection or rudder reversal
resulted from a mechanical malfunction of the rudder PCU.
The airline said that a contributing cause of the accident was
“the manufacturer’s failure to advise operators that there was
a speed below which the aircraft’s lateral control authority
was insufficient to counteract a full rudder deflection.”
Air Line Pilots Association, International
ALPA said, “Aircraft performance analysis revealed that the
maneuver of USAir 427 is consistent with full nose-left
rudder travel. … There is no evidence to support the
hypothesis that the flight crew mishandled the flight control
following the upset event, or that this control mishandling
led to the accident.”
ALPA said, “The airplane experienced an uncommanded
full rudder deflection. This deflection was a result of a main
rudder [PCU] secondary valve jam which resulted in a
primary valve overstroke. This … caused USAir Flight 427
to roll uncontrollably and dive into the ground.
“Once the full rudder hard-over occurred, the fight crew was
unable to counter the resulting roll with aileron because the
B-737 does not have sufficient lateral control authority to
balance a full rudder input in certain areas of the flight
envelope.”
The pilots’ union made the following recommendations:
• “Boeing and Parker [Hannifin] should work
diligently to replace existing B-737 rudder PCUs
with improved units as quick[ly] as possible
without sacrificing quality;
• “The FAA should eliminate the current practice of
derivative certification. Newly developed aircraft
should be carefully evaluated against [U.S. Federal
Aviation Regulations (FARs)] criteria in place at
the time of aircraft development;
• “For aircraft which were certificated as ‘derivative’
models, the FAA should evaluate those aircraft
against existing [FARs], and those aircraft, to the
extent feasible, should be modified in order to be
in compliance with the current [FARs];
• “The FAA should require all FAA-certified repair
stations to meet all standards of the original
equipment manufacturer;
• “In order to increase B-737 lateral control margin
to an acceptable level, the FAA should mandate
the development of additional operational
techniques, such as increasing B-737 minimum
maneuvering speed to Boeing-recommended
‘block’ speed plus 10 knots; [and,]
• “The industry should continue with the
development and implementation of ‘advancedmaneuver’
[training] or ‘selected-event’ training,
and the FAA should require the inclusion of this
training in every airline’s training program.”♦
flight simulators by Oct. 1, 1999. … The FAA will also
issue similar letters to applicable operators when
Boeing completes the revisions to other [B-]737 models;
• “[Regarding A-99-27], on March 24, 1999, the FAA
issued Flight Standards Information Bulletin for
Air Transportation 99-02, Maneuvering Speeds and
Recovery Procedures for Boeing 737 Airplanes. The
bulletin recommended an across-the-board increase of
10 knots to the published [B-]737 maneuvering-speed
schedule for flap settings of ‘flaps up,’ ‘[flaps] 1,’ ‘[flaps]
5’ and ‘[flaps] 10.’ Subsequently, on April 5, 1999, The
Boeing Company issued Flight Operations Flight Crew
Information Bulletin 99-1, Maneuvering Speeds for
Boeing 737-100/200/300/400/500. The bulletin revised
all maneuvering speeds for ‘flaps up,’ ‘[flaps] 1,’ ‘[flaps]
5’ and ‘[flaps] 10’ by at least 10 knots (and as much as
20 knots for certain conditions with flap settings of ‘flaps
5’) and added new information for airplanes operating
at weights lower than 103,000 pounds [46,721
kilograms]. The FAA will revise the [B-]737 [AFM] to
reflect the new maneuvering speeds by July 1999; [and,]
16 FLIGHT SAFETY FOUNDATION • ACCIDENT PREVENTION • SEPTEMBER 1999
We Encourage Reprints
Articles in this publication, in the interest of aviation safety, may be reprinted, in whole or in part, in all media, but may not be offered for sale or used
commercially without the express written permission of Flight Safety Foundation’s director of publications. All reprints must credit Flight Safety
Foundation, Accident Prevention, the specific article(s) and the author(s). Please send two copies of the reprinted material to the director of publications.
These reprint restrictions apply to all Flight Safety Foundation publications.
What’s Your Input?
In keeping with FSF’s independent and nonpartisan mission to disseminate objective safety information, Foundation publications solicit credible
contributions that foster thought-provoking discussion of aviation safety issues. If you have an article proposal, a completed manuscript or a technical
paper that may be appropriate for Accident Prevention, please contact the director of publications. Reasonable care will be taken in handling a
manuscript, but Flight Safety Foundation assumes no responsibility for submitted material. The publications staff reserves the right to edit all published
submissions. The Foundation buys all rights to manuscripts and payment is made to authors upon publication. Contact the Publications Department for
more information.
ACCIDENT PREVENTION
Copyright © 1999 FLIGHT SAFETY FOUNDATION INC. ISSN 1057-5561
Suggestions and opinions expressed in FSF publications belong to the author(s) and are not necessarily endorsed by
Flight Safety Foundation. Content is not intended to take the place of information in company policy handbooks
and equipment manuals, or to supersede government regulations.
Staff: Roger Rozelle, director of publications; Mark Lacagnina, senior editor; Wayne Rosenkrans, senior editor; Linda Werfelman, senior editor;
John D. Green, copyeditor; Karen K. Ehrlich, production coordinator; Ann L. Mullikin, production designer;
Susan D. Reed, production specialist; and David A. Grzelecki, librarian, Jerry Lederer Aviation Safety Library.
Subscriptions: US$80 (U.S.-Canada-Mexico), US$85 Air Mail (all other countries), twelve issues yearly. • Include old and new addresses when requesting
address change. • Flight Safety Foundation, Suite 300, 601 Madison Street, Alexandria, VA 22314 U.S. • Telephone: +1(703) 739-6700 • Fax: +1(703) 739-6708
Visit our World Wide Web site at http://www.flightsafety.org
• “[Regarding A-99-28 and A-99-29], the FAA agrees with
the intent of these recommendations and will develop a
notice of proposed rule making (NPRM) proposing to
address these safety recommendations. It is anticipated
that the NPRM will be published by Sept. 30, 1999.”♦
[Editorial note: This article, except where specifically noted,
is based entirely on U.S. National Transportation Safety Board
Aircraft Accident Report: Uncontrolled Descent and Collision
with Terrain, USAir Flight 427, Boeing 737-300, N513AU,
Near Aliquippa, Pennsylvania, September 8, 1994. NTSB/
AAR-99/01, March 24, 1999. The 348-page report contains
diagrams, illustrations and appendixes.]
Notes
1. The U.S. National Transportation Safety Board (NTSB)
accident report defined blowdown limit as “the maximum
amount of rudder travel available for an airplane at a given
flight condition/configuration.” The report said, “Rudder
blowdown occurs when the aerodynamic forces acting on
the rudder become equal to the hydraulic force available
to move the rudder.”
2. The B-737-300 autoflight system includes the autopilot,
flight director and autothrottles. The autoflight system
does not provide control commands to the airplane’s
rudder system.
3. For more information, see NTSB Aircraft Accident Report:
United Airlines Flight 585, Boeing 737-291, N999UA,
Uncontrolled Collision with Terrain for Undetermined
Reasons 4 Miles South of Colorado Springs Municipal
Airport, Colorado Springs, Colorado, March 3, 1991,
NTSB/AAR-92/06, 1992. See also “U.S. Report: No
Conclusive Evidence Found to Explain Boeing 737 Crash.”
Accident Prevention Volume 50 (May 1993): 1–6.
4. The NTSB accident report defined rotor as “(when
referring to weather), an atmospheric disturbance
produced by high winds, often in combination with
mountainous terrain … . Rotation can occur around a
horizontal or vertical axis.”
5. The NTSB accident report defined crossover airspeed
as “the speed below which the maximum roll control (full
roll authority provided by control wheel input) can no
longer counter the yaw/roll effects of a rudder deflected
to its blowdown limit.”
6. The NTSB accident report defined block maneuvering
speeds as “the recommended maneuvering speeds for each
flap configuration that provide, for all airplane weights,
adequate airspeeds for maneuvering in at least a 40-degree
bank without activation of the stick shaker.”
7. The NTSB accident report said that the FAA defines an
extremely improbable failure condition as “a condition
that is so unlikely that it is not anticipated to occur during
the entire operational life of all airplanes of one type and
that has a probability on the order of 1 x 10-9 or less each
flight hour based on a flight of mean duration for the
airplane type.”

涟漪雨

好材料！