PB99-910401 ‘I

NATIONAL

TRANSPORTATION

SAFETY

BOARD

WASHINGTON, D.C. 20594

AIRCRAFT ACCIDENT REPORT

UNCONTROLLED DESCENT AND COLLISION WITH TERRAIN

USAIR FLIGHT 427

BOEING 737-300, N513AU

NEAR ALIQUIPPA, PENNSYLVANIA

SEPTEMBER 8, 1994

NTSB/AAR-99/01

DCA94MA076

6472A
The National Transportation Safety Board is an independent Federal Agency

dedicated to promoting aviation, raiload, highway, marine, pipeline, and hazardous

materials safety. Established in 1967, the agency is mandated by Congress through the

Independent Safety Board Act of 1974 to investigate transportation accidents, study

transportation safety issues, and evaluate the safety effectiveness of government agencies

involved in transportation. The Safety Board makes public its actions and decisions

through accident reports, safety studies, special investigation reports, safety

recommendations, and statistical reviews.

Recent publications are available in their entirety at http://www.ntsb.gov/. Other

information about available publications may also be obtained from the Web site or by

contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 L’Enfant Plaza, East, S.W.

Washington, D.C. 20594

Safety Board publications may be purchased, by individual copy or by subscription,

from the National Technical Information Service. To purchase this publication, order

report number PB99-910401 from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(800) 553-6847 or (703) 605-6000

Abstract: This report explains the accident involving USAir flight 427, a Boeing

737-300, which entered an uncontrolled descent and impacted terrain near Aliquippa,

Pennsylvania, on September 8, 1994. Safety issues in the report focused on Boeing 737

rudder malfunctions, including rudder reversals; the adequacy of the 737 rudder system

design; unusual attitude training for air carrier pilots; and flight data recorder parameters.

Safety recommendations concerning these issues were addressed to the Federal Aviation

Administration.
AIRCRAFT ACCIDENT REPORT

NTSB/AAR-99/01 (PB99-910401)

 UNCONTROLLED DESCENT AND COLLISION WITH TERRAIN

USAIR FLIGHT 427, BOEING 737-300, N513AU

NEAR ALIQUIPPA,

PENNSYLVANIA

SEPTEMBER 8, 1994

• Pages 29-31 have been updated to correct figure placement. (4 Nov 99)

Figures 9 and 10 were originally reversed.

• Page 45 has been updated to correct a quotation mark. (4 Nov 99)

"wow about 0943:08" was incorrectly quoted.

• Page 102 has been updated to correct figure references for the United flight 585 simulations on 

roll and yaw rate. (16 Feb 00)

THESE CORRECTIONS ARE INCLUDED

IN THIS VERSION OF THE PUBLISHED REPORT:

Aircraft Accident Report

Uncontrolled Descent and Collision With Terrain 

USAir Flight 427

Boeing 737-300, N513AU

Near Aliquippa, Pennsylvania

September 8, 1994

NTSB/AAR-99/01

PB99-910401 National Transportation Safety Board

Notation 6472A 490 L’Enfant Plaza, S.W.

Adopted March 24, 1999 Washington, D.C. 20594

E P LUR IBUS UNUM

N AT I O N A L T R A S PO R TA T IO N

B O A R D

SA F E T Y

N

Contents iii Aircraft Accident Report

Contents

Executive Summary................................................................................................ ix

Abbreviations.......................................................................................................... xi

Glossary of Terms...................................................................................................xv

1. Factual Information..................................................................................................1

1.1 History of Flight ..................................................................................................1

1.2 Injuries to Persons ...............................................................................................7

1.3 Damage to Aircraft..............................................................................................7

1.4 Other Damage......................................................................................................7

1.5 Personnel Information .........................................................................................7

1.5.1 The Captain.....................................................................................................8

1.5.2 The First Officer ...........................................................................................10

1.5.3 Flight Attendant Information........................................................................11

1.6 Airplane Information.........................................................................................11

1.6.1 Accident Airplane Maintenance Information ...............................................12

1.6.1.1 Inspections.............................................................................................12

1.6.1.2 Events on Earlier Flights .......................................................................14

1.6.2 Boeing 737 Hydraulic System Information..................................................15

1.6.2.1 Hydraulic System Maintenance.............................................................18

1.6.3 Boeing 737 Flight Control Systems..............................................................19

1.6.3.1 Auto-Flight System ...............................................................................19

1.6.3.2 Rudder Control System .........................................................................23

1.6.3.2.1 Main Rudder PCU and Servo Valve ..............................................29

1.7 Meteorological Information...............................................................................33

1.8 Aids to Navigation.............................................................................................34

1.9 Communications................................................................................................34

1.10 Airport Information ...........................................................................................35

1.11 Flight Recorders ................................................................................................35

1.11.1 Cockpit Voice Recorder ...............................................................................35

1.11.2 Flight Data Recorder.....................................................................................35

1.12 Wreckage and Impact Information....................................................................36

1.12.1 On-Site Examination ....................................................................................36

1.12.2 Reconstruction Examination.........................................................................39

1.12.2.1 Flight Control System Components ......................................................40

1.12.2.2 Examination/Reconstruction of Cargo Compartments..........................41
Contents iv Aircraft Accident Report

1.12.2.3 Examination/Reconstruction of the Auxiliary Fuel Tank .....................41

1.12.3 Examination of Wreckage for Indications of Possible Bird Strike...............42

1.13 Medical and Pathological Information ..............................................................43

1.14 Fire.....................................................................................................................43

1.15 Survival Aspects................................................................................................44

1.16 Tests and Research ............................................................................................44

1.16.1 Background Information—Other Significant Yaw/Roll Events...................44

1.16.1.1 United Airlines Flight 585 Accident .....................................................44

1.16.1.2 Eastwind Airlines Flight 517 Incident...................................................51

1.16.2 Wake Vortex Tests and Studies Resulting From the 

USAir Flight 427 Accident...........................................................................54

1.16.3 Flight and Simulator Tests of Effects of Various Flight Control 

and System Failures......................................................................................59

1.16.3.1 Eastwind Flight 517 Flight Tests...........................................................61

1.16.4 Flight Control Characteristics Flight Tests (Blowdown and

Crossover Airspeed) .....................................................................................63

1.16.5 Examination and Testing of Flight Control Systems/Components ..............65

1.16.5.1 Rudder Pedal Assemblies......................................................................65

1.16.5.2 Tests to Determine the Effects of Rudder Cable External Forces, 

Breaks, and Blocked Input Linkage ......................................................66

1.16.5.3 Examination and Testing of Standby Rudder........................................68

1.16.5.3.1 Metallurgical Examination of Standby Rudder Components ........68

1.16.5.3.2 Standby System Actuator Binding/Jam Tests ................................69

1.16.5.4 Detailed Examinations and Tests of Main Rudder PCUs .....................71

1.16.5.4.1 Detailed Examinations of Main Rudder PCU Servo Valves..........71

1.16.5.4.1.1 Examination of Exemplar Servo Valves for White Layer.........73

1.16.5.4.2 PCU Dynamic Testing ...................................................................73

1.16.5.4.3 Tests of Hydraulic Fluid.................................................................74

1.16.5.4.4 Tests to Determine the Effects of Silting .......................................75

1.16.5.4.5 PCU Servo Valve Chip Shear Tests...............................................76

1.16.5.4.6 PCU Tests Conducted to Determine the Effects of Air in 

the Hydraulic Fluid.........................................................................76

1.16.5.4.7 PCU Thermal Testing.....................................................................77

1.16.5.4.7.1 Baseline Test Condition ............................................................78

1.16.5.4.7.2 Simulated Hydraulic System Failure Condition........................78

1.16.5.4.7.3 Extreme Temperature Differential Test Condition....................79

1.16.5.4.7.4 Additional Testing.....................................................................80

1.16.5.4.8 Rudder Actuator Reversals During Servo Valve 

Secondary Slide Jams.....................................................................81
Contents v Aircraft Accident Report

1.16.5.4.9 Ground Demonstration of Rudder PCU Servo Valve Jam.............85

1.16.6 Flight Performance Simulation Studies........................................................87

1.16.6.1 USAir Flight 427 Simulation Studies....................................................90

1.16.6.2 United Flight 585 Simulation Studies .................................................100

1.16.6.3 Eastwind Flight 517 Simulation Studies .............................................116

1.16.7 Identification of CVR Sounds/Sound Spectrum Analysis..........................129

1.16.7.1 Sounds Similar to Thumps (Three Initial Thumps Within 1 Second 

and Two Subsequent Thumps About 1 Second Apart) .......................130

1.16.7.2 Sound of Electrical Impulse Recorded on the Captain’s 

Radio Channel .....................................................................................131

1.16.7.3 Sound Similar to Airplane Engines Increasing in Loudness...............132

1.16.7.3.1 Comparison of Engine Sound Signatures From the 

United Flight 585 CVR and a CVR From 737-200 

Flight Tests...................................................................................134

1.16.7.4 Sounds of “Clickety Click” .................................................................134

1.16.7.5 Sound of Wailing Horn .......................................................................135

1.16.8 Study of Pilots’ (USAir Flight 427 and United Flight 585) Speech, 

Breathing, and Other CVR-recorded Sounds .............................................135

1.16.8.1 Independent Specialists’ Review of Pilots’ Speech, Breathing, 

and Other Sounds—USAir Flight 427 ................................................140

1.16.8.1.1 Summary of Observations of Interstate Aviation 

Committee Specialist....................................................................141

1.16.8.1.1.1 Interstate Aviation Committee Specialist’s Guidelines 

Applied to United Flight 585 CVR Information .....................143

1.16.8.1.2 Summary of Observations of U.S. Naval Aerospace 

Medical Research Laboratory Specialist......................................144

1.16.8.1.3 Summary of Observations of NASA’s Ames Research 

Center Specialist...........................................................................145

1.17 Operational and Management Information .....................................................145

1.17.1 USAir..........................................................................................................145

1.17.2 USAir Flight Training ................................................................................146

1.18 Additional Information....................................................................................147

1.18.1 Overall Accident Record and History of the 737 .......................................147

1.18.1.1 History of 737 Potential Rudder System and/or PCU-Related 

Anomalies/Events................................................................................148

1.18.1.1.1 QAR Data Findings......................................................................159

1.18.1.2 Recent Rudder-Related Events on 737s Equipped With the 

1998 Redesigned Servo Valve.............................................................159

1.18.2 Independent Technical Advisory Panel......................................................162

1.18.3 Boeing 737 Certification Requirements and Information ..........................163
Contents vi Aircraft Accident Report

1.18.3.1 Initial Certification of the 737-100 and -200 Series............................163

1.18.3.2 Regulatory Changes Made After Certification of the 737-100 

and -200 Series (Sections 25.671 and 25.1309) ..................................165

1.18.3.3 Certification of the Boeing 737-300, -400, and -500 Series 

(Derivative Certification) ....................................................................167

1.18.3.4 Certification of the 737-600, -700, and -800 Series ............................169

1.18.4 Critical Design Review Team 737 Certification Information and 

Recommendations ......................................................................................175

1.18.5 Boeing 737 Rudder System Design Improvements....................................178

1.18.5.1 Fractures in 1998 Redesigned Servo Valve Secondary Slides............181

1.18.6 Human Performance Considerations ..........................................................183

1.18.6.1 Pilot Incapacitation..............................................................................183

1.18.6.2 Spatial Disorientation ..........................................................................184

1.18.7 Wake Turbulence/Upset Event Information...............................................185

1.18.7.1 Previous Wake Turbulence Accidents.................................................185

1.18.7.2 Aviation Safety Reporting System Reports of Uncommanded 

Upsets/Wake Turbulence Encounters..................................................186

1.18.8 Ergonomics—Study of Maximum Pilot Rudder Pedal Force ....................189

1.18.9 Unusual Attitude Information and Training ...............................................194

1.18.9.1 Preaccident Activity ............................................................................194

1.18.9.2 Postaccident Activity...........................................................................197

1.18.10 Procedural Information Available to Boeing 737 Flight Crews.................198

1.18.10.1 Preaccident Information Available to 737 Pilots Regarding 

Abnormal Procedures (Flight Controls Malfunctions)........................198

1.18.10.2 Postaccident Changes/Information Available to 737 Pilots 

Regarding Abnormal Procedures (Flight Controls Malfunctions) ......200

1.18.10.2.1 1994 Through 1995—Information and Changes 

Disseminated by Boeing...............................................................200

1.18.10.2.2 1996 Through 1997—FAA Issuance of Airworthiness Directive 

96-26-07 .......................................................................................200

1.18.10.2.3 1997 Through 1998—Information and Changes 

Disseminated by Boeing...............................................................202

1.18.10.2.3.1 Implementation of AD 96-26-07 and Boeing 737 Operations 

Manual Revision by U.S. 737 Air Carrier Operators ..............206

1.18.10.2.4 Safety Board Recommendations Relating to Unusual 

Attitude Training..........................................................................207

1.18.11 History of Safety Recommendations Resulting From the

United Flight 585 and USAir Flight 427 Accidents and the 

Eastwind Flight 517 Incident......................................................................207
Contents vii Aircraft Accident Report

1.18.11.1 Galling of Standby Rudder Actuator Bearings—United Flight 585 

Accident (Safety Recommendation A-91-77).....................................207

1.18.11.2 Weather-Related Recommendations—United Flight 585 Accident 

(Safety Recommendations A-92-57 and -58)......................................209

1.18.11.3 Recommendations Resulting From the July 1992 United Airlines 

Ground Check PCU Anomaly (Safety Recommendations A-92-118 

Through -121)......................................................................................211

1.18.11.4 Flight Data Recorder Recommendations (Safety Recommendations 

A-95-25 Through -27) .........................................................................213

1.18.11.5 October 1996 Recommendations Issued as a Result of 

United Flight 585, USAir Flight 427, and Eastwind Flight 517 

(Safety Recommendations A-96-107 Through -120)..........................219

1.18.11.6 February 1997 Recommendations Issued as a Result of 

United Flight 585, USAir Flight 427, and Eastwind Flight 517 

(Safety Recommendations A-97-16 Through -18)..............................230

1.18.12 Party Submissions.......................................................................................232

1.19 New Investigative Techniques ........................................................................237

2. Analysis..................................................................................................................240

2.1 General ............................................................................................................240

2.2 USAir Flight 427 Upset...................................................................................241

2.2.1 USAir Flight 427 Computer Simulation Analysis......................................246

2.2.2 USAir Flight 427 Human Performance Analysis .......................................247

2.2.2.1 Rudder Jam/Reversal Scenario............................................................249

2.2.2.2 Pilot Input Scenario .............................................................................252

2.2.2.3 USAir Flight 427 Scenario Summary..................................................255

2.2.2.4 Likelihood of Recovery From a Rudder Reversal...............................256

2.3 United Flight 585 Upset ..................................................................................258

2.3.1 United Flight 585 Computer Simulation Analysis .....................................258

2.3.2 United Flight 585 Human Performance Analysis.......................................260

2.4 Eastwind Flight 517 Upset ..............................................................................263

2.4.1 Eastwind Flight 517 Computer Simulation Analysis .................................265

2.4.2 Eastwind Flight 517 Human Performance Analysis...................................267

2.5 Rudder System Jam Scenarios.........................................................................271

2.6 Adequacy of the Boeing 737 Rudder System Design .....................................273

2.6.1 FAA Certification System ..........................................................................281

2.7 Flight Crew Procedures and Training..............................................................283

2.7.1 Unusual Attitude Training for Air Carrier Pilots........................................283

2.7.2 Unusual Attitude Training for Boeing 737 Pilots.......................................284

2.8 Flight Data Recorder Capabilities ...................................................................288
Contents viii Aircraft Accident Report

3. Conclusions............................................................................................................292

3.1 Findings ...........................................................................................................292

3.2 Probable Cause ................................................................................................295

4. Recommendations.................................................................................................296

5. Appendixes............................................................................................................299

Appendix A: Investigation and Hearing ................................................................299

Appendix B: Cockpit Voice Recorder Transcript .................................................300

Appendix C: History of Federal Aviation Administration 

Airworthiness Directives Related to the 

Boeing 737 Rudder System .............................................................328

Appendix D: Critical Design Review Recommendations and 

Federal Aviation Administration Responses ...................................333

Appendix E: List of Documented Boeing 737 Events ...........................................339

Appendix F: Boeing’s “Blue Water” Assessment Team........................................345
Executive Summary ix Aircraft Accident Report

Executive Summary

On September 8, 1994, about 1903:23 eastern daylight time, USAir (now US

Airways) flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering

to land at Pittsburgh International Airport, Pittsburgh, Pennsylvania. Flight 427 was

operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled

domestic passenger flight from Chicago-O'Hare International Airport, Chicago, Illinois, to

Pittsburgh. The flight departed about 1810, with 2 pilots, 3 flight attendants, and 127

passengers on board. The airplane entered an uncontrolled descent and impacted terrain

near Aliquippa, Pennsylvania, about 6 miles northwest of the destination airport. All 132

people on board were killed, and the airplane was destroyed by impact forces and fire.

Visual meteorological conditions prevailed for the flight, which operated on an instrument

flight rules flight plan.

The National Transportation Safety Board determines that the probable cause of

the USAir flight 427 accident was a loss of control of the airplane resulting from the

movement of the rudder surface to its blowdown limit. The rudder surface most likely

deflected in a direction opposite to that commanded by the pilots as a result of a jam of the

main rudder power control unit servo valve secondary slide to the servo valve housing

offset from its neutral position and overtravel of the primary slide. 

The safety issues in this report focused on Boeing 737 rudder malfunctions,

including rudder reversals; the adequacy of the 737 rudder system design; unusual attitude

training for air carrier pilots; and flight data recorder (FDR) parameters.

Safety recommendations concerning these issues were addressed to the Federal

Aviation Administration (FAA). Also, as a result of this accident, the Safety Board issued

a total of 22 safety recommendations to the FAA on October 18, 1996, and February 20,

1997, regarding operation of the 737 rudder system and unusual attitude recovery

procedures. In addition, as a result of this accident and the United Airlines flight 585

accident (involving a 737-291) on March 3, 1991, the Safety Board issued three

recommendations (one of which was designated “urgent”) to the FAA on February 22,

1995, regarding the need to increase the number of FDR parameters.

Abbreviations xi Aircraft Accident Report

Abbreviations

AAIB Air Accidents Investigation Branch

AC advisory circular

ACO Aircraft Certification Office

AD airworthiness directive

AFIP Armed Forces Institute of Pathology

AFA Air Force Academy

AFM airplane flight manual

AFS auto-flight system

agl above ground level

ALPA Air Line Pilots Association

APU auxiliary power unit

ARAC Aviation Rulemaking Advisory Committee

ASB Alert Service Bulletin

ASRS Aviation Safety Reporting System

ATC air traffic control

ATP airline transport pilot

ATR Avions de Transport Regional

BAC British Aerospace Corporation

BWI Baltimore-Washington International Airport

CAM cockpit area microphone

CAMI Civil Aeromedical Institute

CDR critical design review

CFR Code of Federal Regulations

CMD command (autopilot mode)

CRM crew resource management

CVR cockpit voice recorder

CWS control wheel steering (autopilot mode)

DER Designated Engineering Representative

DNA deoxyribonucleic acid

DOT Department of Transportation
Abbreviations xii Aircraft Accident Report

EDP engine-driven hydraulic pump

EDS energy dispersive x-ray spectrum

E/E bay electrical/electronic compartment

EGT exhaust gas temperature

EMI electromagnetic interference

EPR engine pressure ratio

F Fahrenheit

FAA Federal Aviation Administration

FAR Federal Aviation Regulations

FBI Federal Bureau of Investigation

FD flight director

FDAU flight data acquisition unit

FDR flight data recorder

FL flight level

FSIB Flight Standards Information Bulletin

GPR ground penetration radar

GPWS ground proximity warning system

HBAT Handbook Bulletin for Air Transportation

HIRF High-intensity radiated fields 

Hg mercury

HRC Hardness Rockwell C (scale)

Hz Hertz

IFR instrument flight rules

IOE initial operating experience

IRS inertial reference system

KCAS knots calibrated airspeed

KIAS knots indicated airspeed

LIDAR Light Distancing and Ranging

LOFT line-oriented flight training

LVDT linear variable displacement transducer

LWD left wing down
Abbreviations xiii Aircraft Accident Report

M-CAB multipurpose cab (simulator)

MCP mode control panel

MM Maintenance Manual

MPD Maintenance Planning Document

MRB Maintenance Review Board

MSG-3 Maintenance Steering Group 3

msl mean sea level

N1 engine fan speed

N2 engine compressor speed

NAS National Aerospace Standard

NASA National Aeronautics and Space Administration

NCAR National Center for Atmospheric Research

NG next generation

nm nautical mile

NOAA National Oceanic and Atmospheric Administration

NPRM notice of proposed rulemaking

NTSB National Transportation Safety Board

OEM original equipment manufacturer

ORD Chicago-O’Hare International Airport

OSHA Occupational Safety and Health Administration

OTS Officer Training School

PA public address

PADDS portable airborne digital data system

PC production certificate

PCU power control unit

PF pilot flying

PIT Pittsburgh International Airport

PIT TRACON Pittsburgh terminal radar approach control

PMA parts manufacturing approval

P/N part number

PNF pilot not flying

POI principal operations inspector

PPE personal protective equipment

PSA Pacific Southwest Airlines

psi pounds per square inch
Abbreviations xiv Aircraft Accident Report

QAR quick access recorder

RA radio altitude

RWD right wing down

SAE Society of Automotive Engineers

SB service bulletin

SEM scanning electron microscope 

SET special events training

SFAR Special Federal Aviation Regulation

SL service letter

S/N serial number

TOGA takeoff/go-around

T/R thrust reverser

UCP Unified Command Post

USAF U.S. Air Force

VFR visual flight rules

VMS vertical motion simulator

WSFO Weather Service Forecast Office

WSR-88D Weather Surveillance Radar 
Glossary of Terms xv Aircraft Accident Report

Glossary of Terms

Acceptance Test Procedure (for the Boeing 737 main rudder power control unit): A

series of post-production functional tests used by Parker Hannifin Corporation to

measure the performance of the main rudder power control unit (PCU).

Actuator: A device that transforms fluid pressure into mechanical force.

Adverse tolerance buildup: A description for a condition in which the assembling

(stacking) of a series of parts, all of which are individually built within tolerances (that

is, within an allowable deviation from a standard), has an adverse result.

Aileron: An aerodynamic control surface that is attached to the rear, or trailing, edges of

each wing. When commanded, the ailerons rotate up or down in opposite directions. 

Auto-flight system: A system, consisting of the autopilot flight director system and the

autothrottle, that provides control commands to the airplane’s ailerons, flight spoilers,

pitch trim, and elevators to reduce pilot workload and provide for smoother flight. The

auto-flight system does not provide control commands to the 737 airplane’s rudder

system.

Bank: The attitude of an airplane when its wings are not laterally level.

Block maneuvering speed: The recommended maneuvering speeds for each flap

configuration that provide, for all airplane weights, adequate airspeed for maneuvering

in at least a 40° bank without activation of the stickshaker. The “block” term

simplified the concept so that a single airspeed was specified for all airplane weights

less than 117,000 pounds; thus, airplanes operating at weights lighter than 117,000

pounds (such as the USAir flight 427 accident airplane) had a greater maneuvering

margin. 

Blowdown limit: The maximum amount of rudder travel available for an airplane at a

given flight condition/configuration. Rudder blowdown occurs when the aerodynamic

forces acting on the rudder become equal to the hydraulic force available to move the

rudder.

Blue water: Lavatory fluid. Boeing’s Blue Water Assessment Team reviewed fluid

contamination in the electrical/electronic compartment (E/E bay) from various

potential sources, including lavatories, galleys, rainwater, and condensation.

Catastrophic failure condition: A failure condition that will prevent continued safe

flight and landing. (Source: Federal Aviation Administration Advisory Circular

25.1309-1A.)

Command mode: A position on the two autopilot flight control computers that, when

engaged, allows the autopilot to control the airplane according to the mode selected

via the Mode Selector Switches, which include Altitude Hold, Vertical Speed, Level

Change, Vertical Navigation, VOR Localizer, Lateral Navigation, and Heading Select. 
Glossary of Terms xvi Aircraft Accident Report

Compliance (when referring to PCU linkages): The elastic deformation of PCU internal

input linkages that does not damage the linkages but allows additional motion. 

Computer simulation: A term in this accident report that refers to models of the USAir

flight 427, United flight 585, and Eastwind flight 517 upsets that were used to develop

potential accident scenarios. The Safety Board’s computer workstation-based flight

simulation software used flight controls, aerodynamic characteristics, and engine

models (developed by Boeing) to derive force and moment time histories of the

airplanes. The Board developed its own equations to convert these forces and

moments into airplane motion. Boeing performed similar flight simulations on its own

computer workstations.

Control wheel steering mode: A position on the two autopilot flight control computers

that, when engaged, allows the autopilot to maneuver the airplane through the

autoflight system in response to control pressure, similar to that required for manual

flight, applied by either pilot. The use of control wheel steering does not disengage the

autopilot.

Cross-coupled: The ability of the aerodynamic motion about an airplane’s control axes to

constantly interact and affect each other in flight.

Crossover airspeed: The speed below which the maximum roll control (full roll authority

provided by control wheel input) can no longer counter the yaw/roll effects of a rudder

deflected to its blowdown limit.

Directional control: The function that is normally performed by the rudder by pilot input

or yaw damper input. (Also known as yaw control.)

Dual jam (as used in this accident report): The simultaneous jams of the main rudder

PCU primary to secondary slides and the secondary slide to the servo valve housing.

Dutch roll: A combination yawing and rolling oscillations that is an inherent

characteristic of all swept-wing airplanes.

E/E bay: An airplane compartment that contains electrical and electronic components.

Elevator: An aerodynamic control surface to the back of the horizontal stabilizer that

moves the airplane’s nose up and down to cause the airplane to climb or descend.

Empennage: The tail section of an airplane, including stabilizing and flight control

surfaces.

Extremely improbable failure condition: A condition that is so unlikely that it is not

anticipated to occur during the entire operational life of all airplanes of one type and

that has a probability on the order of 1 × 10-9 or less each flight hour based on a flight

of mean duration for the airplane type. (Source: Federal Aviation Administration

Advisory Circular 25.1309-1A.)

Flap: An extendable aerodynamic surface usually located at the trailing edge of an

airplane wing. The 737 also has an extendable aerodynamic surface located at the

wing’s leading edge, which is called a Krueger flap.
Glossary of Terms xvii Aircraft Accident Report

G: A unit of measurement. One G is equivalent to the acceleration caused by the earth’s

gravity (32.174 feet/sec2).

Galling: A condition in which microscopic projections or asperities bond at the sliding

interface under very high local pressure. Subsequently, the sliding forces fracture the

bonds, tearing metal from one surface and transferring it to the other.

Heading: The direction (expressed in degrees between 001 and 360°) in which the

longitudinal axis of an airplane is pointing, in relation to north.

Hinge moment: The tendency of a force to produce movement about a hinge; specifically,

the tendency of the aerodynamic forces acting on a control surface to produce motion

about the hinge axis of the surface.

Hydraulic fluid: Liquid used to transmit and distribute forces to various airplane

components that are being actuated.

Hydraulic pressure limiter: A device incorporated in the design of the main rudder PCU

on all 737 next-generation (NG) series airplanes to reduce the amount of rudder

deflection when active. It is commanded to limit hydraulic system A pressure (using a

bypass valve) as the airspeed is increased to greater than 137 knots, and it is reset as

the airspeed is decreased to less than 139 knots.

Hydraulic pressure reducer: A modification on 737-100 through -500 series airplanes to

reduce the amount of rudder authority available during those phases of flight when

large rudder deflections are not required. The pressure reducer, added to hydraulic

system A near the rudder PCU, will lower the hydraulic pressure from 3,000 to 1,000

pounds per square inch (psi) on 737-300, -400, and -500 series airplanes or to 1,400

psi on 737-100, and -200 series airplanes.

Hydraulic system A (for 737-300, -400, and -500 series airplanes): A system that

includes an engine-driven hydraulic pump and an electrically powered pump that

provides power for the ailerons, rudder, elevators, landing gear, normal nosewheel

steering, alternate brakes, inboard flight spoilers, left engine thrust reverser, ground

spoilers, the system A autopilot, and the autoslats through the power transfer unit. 

Hydraulic system B (for 737-300, -400, and -500 series airplanes): A system that

includes an engine-driven hydraulic pump and an electrically powered pump that

provides power for the ailerons, rudder, elevators, trailing edge flaps, leading edge

flaps and slats, autoslats, normal brakes, outboard flight spoilers, right thrust reverse,

yaw damper, the system B autopilot, autobrakes, landing gear transfer unit, and

alternate nose-wheel steering (if installed). 

Input shaft (of the 737 main rudder PCU): When rudder motion is commanded, this

device moves the primary and secondary dual-concentric servo valve slides by way of

the primary and secondary internal summing levers to connect hydraulic pressure and

return circuits from hydraulic systems A and B so that hydraulic pressure is ported to

the appropriate sides of the dual tandem actuator piston to extend or retract the main

rudder PCU piston rod. 

Interpolation: The determination, or approximation, of unknown values based on known

values. 
Glossary of Terms xviii Aircraft Accident Report

Iteration: A process used by the Safety Board that includes repeating Board computer

simulations to compare the flights of USAir flight 427, United Airlines flight 585, and

Eastwind Airlines flight 517 with available flight data recorder (FDR) data from those

flights. The simulation process includes inputting assumed flight control surface

(aileron, rudder, and elevator) positions, running the flight simulations, and comparing

the output of the simulations (for example, altitude, airspeed, and heading) with FDR

data.

Kinematics: A process used by Boeing and the Safety Board that involves fitting curves

through available FDR data (such as heading, pitch, and roll), obtaining flight control

time history rates from these curves, and obtaining accelerations from these rates.

Forces, moments, and aerodynamic coefficients are then obtained from these

accelerations using Newton’s Laws.

Knot: A velocity of 1 nautical mile per hour.

Linear variable displacement transducer: An electromechanical device that measures

linear movement and converts the measurement into an electrical signal (output

voltage) that relates position to signal. In the 737 main rudder PCU, it is used to sense

the yaw damper position. (Also referred to as a linear variable displacement

transformer.)

M-CAB: A Boeing multipurpose cab flight simulator that can be modified to simulate a

variety of aircraft models and scenarios. It is an engineering simulator that is capable

of simulating events that are outside of normal flight regimes, but it is not used for

flight training.

Metering edges: The sides of grooves that are cut into the land surface of the primary or

secondary slides of the main rudder PCU servo valve. Flow of hydraulic fluid is

controlled by positioning a metering edge relative to a metering port (that is, a

rectangular hole in the valve housing and secondary slide through which hydraulic

fluid flows). Metering occurs when the metering edge opens and closes the metering

port.

Minimum tolerance servo valve: A servo valve used by Boeing during thermal shock

testing (for this accident investigation) because it had the tightest diametric clearances

(between the primary and secondary slides and the secondary slide and valve housing)

that would pass the PCU acceptance test procedure friction requirements.

NG: Boeing’s next-generation 737 series, designated as the 737-600, -700, -800, and -900

models.

Overtravel: The ability of a device to move beyond its normal operating position or

range. Within the main rudder PCU servo valve, overtravel of the primary or

secondary slides would be the result of elastic deformation of the mechanical input

mechanism.

Pitch control: The function that is performed by the elevator by moving the control

column forward or aft, which raises or lowers the nose of the airplane.

Portable airborne digital data system: A self-contained flight test data recording system

developed by Boeing that was installed on a flight test airplane to record parameters
Glossary of Terms xix Aircraft Accident Report

needed to evaluate airplane performance. For USAir 427 and Eastwind 517 flight

testing, the system recorded all data at a sampling rate of 20 times per second.

Power control unit (PCU): A hydraulically powered device that moves a control surface,

such as a rudder, elevator, and aileron.

Roll: Rotation of an airplane about its longitudinal axis.

Roll control: The function that is performed by the ailerons and flight spoilers by moving

the control wheel to the right or the left.

Rotor (when referring to weather): An atmospheric disturbance produced by high

winds, often in combination with mountainous terrain, and expressed by a rotation rate

(in radians per second), a core radius (in feet), and a tangential speed (in feet per

second). Rotation can occur around a horizontal or vertical axis.

Rudder: An aerodynamic vertical control surface that is used to make the airplane yaw, or

rotate, about its vertical axis.

Rudder control quadrant: A device in the rudder system that connects rudder cables to

control rods to transmit rudder system inputs.

Reverse rudder response: A rudder surface movement that is opposite to the one

commanded.

Rudder hardover: The sustained deflection of a rudder at its full (blowdown) travel

position.

Rudder trim: A system that allows the pilots to command a steady rudder input without

maintaining foot pressure on the rudder pedals. It can be used to compensate for the

large yawing moments generated by asymmetric thrust in an engine-out situation.

Servo valve (in the 737 main rudder PCU): A valve used to control rudder direction and

rate of movement. The valve comprises a primary slide that moves within a secondary

slide that, in turn, moves within the servo valve housing. These slides direct hydraulic

fluid through passages to cause rudder movement.

Servo valve housing (in the 737 main rudder PCU): A cylinder-shaped assembly that

contains hydraulic fluid passages and interacts with the servo valve secondary slide.

Servo valve primary slide (in the 737 main rudder PCU): A cylindrical piston that

moves within the servo valve secondary slide. It is moved by an internal primary

summing lever, which translates inputs from the yaw damper and/or the external input

crank (which moves when a pilot applies pressure to a rudder pedal) into axial

movement of the primary slide.

Servo valve secondary slide (in the 737 main rudder PCU): A cylindrical “sleeve” that

encloses the servo valve primary slide. It is moved by the internal secondary summing

lever, which translates inputs from the yaw damper and/or the external input crank

(which moves when a pilot applies pressure to a rudder pedal) into axial movement of

the secondary slide.

Sideload: The effect of lateral acceleration, typically the result of sideslip or yaw

acceleration.
Glossary of Terms xx Aircraft Accident Report

Sideslip: The lateral angle between the longitudinal axis of the airplane and the direction

of motion (flightpath or relative wind). It is normally produced by rudder forces,

yawing motion resulting from asymmetrical thrust, or lateral gusts.

Silting: The accumulation of particles of contaminants in hydraulic fluid in a hydraulic

component. The particles are smaller than the filter on the inlet side of the component

and tend to settle at various edges and corners of valves and stay there unless washed

away by higher flow rates.

Slat: An aerodynamic surface located on an airplane wing’s leading edge that may be

extended to provide additional lift.

Spoiler: A device located on an airplane wing’s upper surface that may be activated to

provide increased drag and decreased lift.

Standby hydraulic system: An independent hydraulic system that contains its own

electric pump that, when activated, powers the standby rudder system. It also provides

an alternate source of power for both thrust reversers and extends the leading edge

flaps and slats in the “ALTERNATE FLAPS” mode.

Standby rudder system: A system that provides backup control of the rudder when

activated or in the event of a hydraulic system failure. It is powered by the standby

hydraulic system and is unpressurized during normal operations.

Summing lever (in the 737 main rudder PCU): One of two internal levers (primary or

secondary) within the main rudder PCU that applies force to move the servo valve’s

primary or secondary slides, respectively. Also, an external lever that transmits rudder

pedal and trim input to the PCU’s external input crank.

Vertical motion simulator: A simulator at the National Aeronautics and Space

Administration’s Ames Research Center that is the world's largest motion simulator

(with 60 feet of vertical travel). It can be adapted to represent a large number of

airplanes, helicopters, and spacecraft. The large motion of this simulator provides a

more accurate representation of flight dynamics and accelerations than can be

experienced in the Boeing M-CAB or a normal pilot training simulator.

Wake vortex: A counterrotating airmass trailing from an airplane’s wing tips. The

strength of the vortex is governed by the weight, speed, and shape of the wing of the

generating aircraft; the greatest strength occurs when the wings of the generating

aircraft are producing the most lift, that is, when the aircraft is heavy, in a clean

configuration, and at a slow airspeed. (Also known as wake turbulence.)

Yaw: Rotation of an airplane about its vertical axis.

Yaw control: The function that is normally performed by the rudder by pilot input or yaw

damper input. (Also known as directional control.)

Yaw damper (in the 737 main rudder PCU): A system, composed of the yaw damper

control switch and a yaw damper coupler, that automatically corrects for yaw motion.

The 737 yaw damper coupler includes a rate gyro that senses aircraft motion about the

yaw axis and converts the motion to an electrical signal that is sent to the main rudder

PCU, which applies the rudder to stop the yaw. 
Factual Information 1 Aircraft Accident Report

1. Factual Information

1.1 History of Flight

On September 8, 1994, about 1903:23 eastern daylight time,1 USAir (now US

Airways)2 flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering

to land at Pittsburgh International Airport (PIT), Pittsburgh, Pennsylvania. Flight 427 was

operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 as a

scheduled domestic passenger flight from Chicago-O'Hare International Airport (ORD),

Chicago, Illinois, to Pittsburgh. The flight departed ORD about 1810, with 2 pilots,

3 flight attendants, and 127 passengers on board. (Table 1, in section 1.2, shows an injury

chart.) The airplane entered an uncontrolled descent and impacted terrain near Aliquippa,

Pennsylvania. All 132 people on board were killed, and the airplane was destroyed by

impact forces and fire. Visual meteorological conditions prevailed for the flight, which

operated on an instrument flight rules (IFR) flight plan. 

The accident occurred on the third day of a 3-day trip sequence for the flight crew.

The pilots reported for duty on the day of the accident about 1215 in Jacksonville, Florida,

and departed Jacksonville International Airport in the accident airplane, designated as

USAir flight 1181, to Charlotte, North Carolina, about 1310. Flight 1181 arrived at

Charlotte-Douglas International Airport about 1421. The next trip segment, also

designated as flight 1181, departed Charlotte for ORD about 1521. The airplane arrived at

the destination airport about 1707.

At ORD, the accident airplane was designated as USAir flight 427 with an

intended destination of Pittsburgh and the same flight crew performing flight duties. Flight

427 departed the gate at ORD about 1802, and became airborne about 1810. The flight

plan filed for flight 427 indicated an estimated en route time of 55 minutes. Review of air

traffic control (ATC) and cockpit voice recorder (CVR) information3

 indicated that the

captain was performing the radio communications and other pilot-not-flying (PNF) duties

and that the first officer was performing the pilot-flying (PF) duties with the auto-flight

system (AFS) engaged.4

The CVR indicated that, about 1845:31, ATC personnel at Cleveland Air Route

Traffic Control Center cleared USAir flight 427 to descend from its en route cruise

altitude of flight level (FL) 290 to FL 240.5 The captain responded, “out of two nine oh for

1

 Unless otherwise indicated, all times are eastern daylight time, based on a 24-hour clock. 

2

 For consistency, US Airways is referred to as USAir. 

3

 A complete transcript of the CVR is included in appendix B of this report.

4

 For additional information regarding the AFS, see section 1.6.3.1. 

5

 FL 290 is 29,000 feet mean sea level (msl), based on an altimeter setting of 29.92 inches of mercury

(Hg). Likewise, FL 240 is 24,000 feet msl.
Factual Information 2 Aircraft Accident Report

two four oh....” As the airplane neared its destination (about 1850:56), Cleveland Center

controllers advised the pilots of USAir flight 427 to “cross CUTTA [intersection]6

 at and

maintain one zero thousand....” The flight crew acknowledged the descent clearance, and

the CVR recorded PIT automatic terminal information service information Yankee

beginning about 1851:22. 

About 1853:15, the CVR recorded the cockpit door being opened and closed.

About 1853:26, a flight attendant inquired about connecting flight and gate information

and asked if the pilots wanted anything to drink. About 1854:02, the flight attendant exited

the cockpit. About 1854:27, Cleveland Center reiterated the instructions to cross CUTTA

intersection at 10,000 feet mean sea level (msl) and instructed the pilots to reduce the

airspeed to 250 knots. According to ATC and radar information, at that time, Delta Air

Lines flight 1083, a Boeing 727 that had been sequenced to precede USAir flight 427 on

the approach to PIT from the northwest, was in level flight at 10,000 feet msl with an

assigned airspeed of 210 knots and an assigned heading of 160°. Delta flight 1083 was in

communication with Pittsburgh terminal radar approach control (PIT TRACON)

personnel.7

About 1856:16, Cleveland Center stated, “USAir [427] reduce speed to two one

zero [210 knots] that’s at the request of [PIT] approach....” About 11 seconds later, the

Cleveland Center controller told the pilots of USAir flight 427 that they did not have to

make the previously issued crossing restriction (cross CUTTA at 10,000 feet msl), “just

uh, speed first...pd [pilot’s discretion] to ten....” About 1856:32, Cleveland Center told

the pilots to “contact PIT approach (on frequency 121.25 Hertz [Hz]).” The captain

acknowledged the instructions about 1856:36 and advised PIT TRACON about 1856:52

that he was “descending to ten [thousand feet msl].” 

About 1857:07, the CVR recorded the flight attendant returning to the cockpit and

delivering juice drinks to the pilots. About 1857:23, PIT TRACON responded to the initial

contact from the pilots of USAir flight 427. The controllers instructed the pilots to turn

right to a heading of 160°, advised them that they would receive radar vectors to the final

approach course for runway 28 right (28R) at PIT, and instructed them to reduce airspeed

to 210 knots. About 1858:03, PIT TRACON instructed the pilots of Delta flight 1083 to

descend to and maintain an altitude of 6,000 feet msl. About 1858:24, the accident

airplane’s CVR recorded the sound of an aural tone similar to an altitude alert and the

flight attendant stated, “OK, back to work.” Flight data recorder (FDR) information8

indicated that the airplane was at 10,818 feet msl at that time. About 1858:29, the CVR

recorded the sound of the cockpit door opening and closing. 

6

 CUTTA intersection is located about 30 nautical miles (nm) northwest of PIT and is a northwest

arrival fix for traffic landing at PIT. 

7

 Radar data show that, at their closest point (about 1902:39), Delta flight 1083 and USAir flight 427

were 4.1 nm apart at 6,000 feet msl. For additional information regarding radar data for airplanes in the

vicinity of the accident site, see section 1.16.2. 

8

 For more information about the data recorded by the FDR, see sections 1.11.2 and 1.16.6.1.
Factual Information 3 Aircraft Accident Report

About 1858:33, PIT TRACON controllers instructed USAir flight 427 to descend

and maintain an altitude of 6,000 feet msl. The pilots acknowledged the descent

instructions and, about 1859:04, started to accomplish the Preliminary Landing checklist

(altimeters/flight instruments, landing data, shoulder harnesses, and approach briefing).

The pilots conducted an approach briefing about 1859:28. 

According to ATC transcripts, about 1900:06, PIT TRACON instructed Delta

flight 1083 to turn left to a heading of 130° and reduce airspeed to 190 knots. About

1900:14, the approach controllers assigned USAir flight 427 a heading of 140° and an

airspeed of 190 knots, and the flight crew acknowledged the instructions. About 1900:24,

the CVR recorded a sound similar to the flap handle being moved.9 About 1900:43, the

first officer began a routine public address (PA) announcement,10 thanking the passengers

for traveling with USAir and asking the flight attendants to prepare the cabin for arrival.

At 1901:06, the CVR recorded a chime similar to the seatbelt chime. 

The CVR indicated that, while the first officer was making the PA announcement

(about 1900:44), PIT TRACON instructed Delta flight 1083 to turn left to a heading of

100°. Also during the first officer’s PA announcement (about 1901:02), the captain of

USAir flight 427 asked the controllers “did you say two eight left for USAir four twenty

seven?” About 1901:06, the PIT TRACON controller responded “...USAir [427] it will be

two eight right.” About 1901:16, the approach controller advised Delta flight 1083 to

contact approach control on a different frequency.11

According to the CVR and ATC transcripts, about 1902:22 PIT TRACON stated

“USAir 427, turn left [to] heading one zero zero. Traffic will be [at your] one to two

o’clock [position, and] six miles, northbound, [a] Jetstream climbing out of thirty-three

[hundred feet msl] for five thousand [feet msl].”12 The pilots of USAir flight 427

acknowledged the approach controller’s transmission at 1902:32 and stated, “We’re

looking for the traffic [and] turning to one zero zero, USAir 427.” 

9

 According to USAir personnel, the standard configuration for a 737-300 airplane operating at an

airspeed of 190 knots during an approach to land would be flaps 1, which provides for partial extension of

the wing leading edge slats and full extension of the Krueger (leading edge) flaps and 1° of extension of the

wing trailing edge flaps. During postaccident examination, the accident airplane’s flaps were found in the

flaps 1 position (see section 1.12). 

10 FDR data indicated that, when the first officer started the PA announcement, the airplane was

descending through 7,800 feet msl.

11 Review of the ATC transcripts indicated that USAir flight 427 and Delta flight 1083 were using a

common Pittsburgh approach control frequency for approximately 4 minutes 40 seconds. When he was

interviewed after the accident, the captain of Delta flight 1083 stated that he did not recall hearing USAir

flight 427 on the frequency. He described the flight conditions as “good weather, with no turbulence or bird

activity.” He further stated that the horizon was clearly visible and that visibility was not restricted. 

12 This traffic was an Atlantic Coast Airlines Jetstream 31, operating as flight 6425 and departing the

Pittsburgh area on a 360° heading. Although ATC issued a traffic advisory to Atlantic Coast flight 6425

regarding “traffic at 11 o’clock” (USAir flight 427), the captain and first officer of the Jetstream stated that

they did not see flight 427. The captain of Atlantic Coast flight 6425 recalled seeing traffic at his 12:30 to

1 o'clock position, which he believed to be a 727. This position and type of airplane was consistent with that

of Delta flight 1083. 
Factual Information 4 Aircraft Accident Report

FDR data indicated that, about 1902:53, USAir flight 427 was rolling out of the

left bank (moving through 7° of left bank toward a wings-level attitude) as it approached

the ATC-assigned heading of 100° and was maintaining the ATC-assigned airspeed (190

knots) and altitude (6,000 feet msl). According to the CVR transcript, about 1902:54 the

first officer stated, “oh, ya, I see zuh Jetstream.”13 As the first officer finished this

statement (about 1902:57), the CVR recorded a sound similar to three thumps in

1 second,14 the captain stating “sheeez” (at 1902:57.5), and the first officer stating “zuh”

(at 1902:57.6).15 Between about 1902:57 and about 1902:58, FDR data indicated that

USAir flight 427’s airspeed fluctuated from about 190 knots to about 193 knots and then

decreased to about 191 knots for the next 4 seconds. Between about 1902:57 and about

1902:59, FDR data indicated that the airplane’s left bank steepened from slightly less than

8° to slightly more than 20°. Figure 1 shows a plot of the FDR data during the last 30

seconds of the flight, along with CVR comments and sounds.16 About 1902:58, the CVR

recorded an additional thump, two “clickety click” sounds, the sound of the engine’s noise

getting louder,17 and the sound of the captain inhaling and exhaling quickly one time. Also

about 1902:58, the FDR recorded a brief forward movement of the control column. 

About 1902:59, the left roll was arrested, and the airplane began to briefly roll

right toward a wings-level attitude; FDR data show that, between about 1902:59 and about

1903, the airplane’s left bank had decreased to about 15°). Also about 1902:59, the

airplane’s heading data, which had been moving left steadily toward the ATC-assigned

heading of 100°, began to move left at a more rapid rate, passing through the 100°

heading. At 1902:59.4, the CVR recorded the captain stating “whoa” and, at 1902:59.7,

the sound of the first officer grunting softly. By just after 1903:00, the airplane had begun

to roll rapidly back to the left again; its airspeed remained about 191 knots. FDR heading

data indicated that, by 1903:01, the airplane’s heading had moved left through about 089°

and continued to move left at a rate of at least 5° per second until the stickshaker activated

about 1903:08. Between about 1903:01 and about 1903:04, the CVR recorded the sound

of the first officer grunting loudly and making brief exclamatory remarks18 while the

airplane continued to roll left, with several fluctuations in the roll rate.

13 The 737 has three windows on each side of the cockpit. These windows consisted of a forward-facing

windscreen, a window located at the pilot’s side, and a middle window (located between the forward and

side windows). Postaccident examination of radar data and simulations revealed that the Jetstream traffic

would have been visible at that time through the lower part of the middle window on the first officer’s side

of the airplane. 

14 These sounds (and other sounds that occurred during the upset sequence) are discussed in detail in

section 1.16.7. 

15 In this report, CVR comments and noises, which are recorded continuously and can be accurately

transcribed to the nearest one-tenth of a second, are depicted to the nearest one-tenth of a second during

descriptions of the upset sequence portion of the flight for detail and clarity. FDR data are sampled at

specific times and intervals, which vary depending on the parameter; therefore, FDR times in this report are

referenced to the nearest full second. 

16 The CVR time equals the FDR time in seconds plus 1900:43 (local time).

17 The sound of the engine noise getting louder was determined from a spectrum analysis of sounds

recorded on the CVR (see section 1.16.7.3). This sound cannot be discerned simply by listening to the CVR

and is therefore not described on the CVR transcript.

18 The pilots’ speech, breathing, and other sounds are discussed in greater detail in section 1.16.8. 
Factual Information 5 Aircraft Accident Report

Figure 1. FDR data during the final 30 seconds of USAir flight 427.
Factual Information 6 Aircraft Accident Report

FDR information revealed that, just before 1903:03, the airplane’s left bank angle

had increased to about 43°, the airplane had begun to descend from its assigned altitude of

6,000 feet msl, the control column had started to move aft, and the airspeed started to

decrease below 190 knots. Less than 1 second later, the CVR recorded the sound of the

autopilot disconnect horn. During the next 5 seconds, the FDR recorded increasing left

roll, aft control column, decreasing altitude, and a decreasing airspeed to about 186 knots. 

Also between 1903:02.7 and 1903.07.7, the CVR recorded several brief remarks

on the flight crew channels. At 1903:07.5, the CVR recorded a sound of increasing

amplitude similar to onset of stall buffet and the captain stating “what the hell is this?”

The CVR transcript indicated that, at 1903:08.1, a vibrating sound similar to aircraft

stickshaker started and continued until the end of the recording. At 1903:08.3, an aural

tone similar to an altitude alert sounded, and 1 second later, the traffic alert and collision

avoidance system sounded “traffic traffic.”19

According to the ATC transcript, a radio transmission from USAir flight 427 about

1903:10 stated, “Oh (unintelligible) Oh [expletive].”20 The approach controller reported

that, at that time, flight 427’s altitude readout on the radar screen indicated 5,300 feet.

About 1903:14, the controller stated “USAir 427 maintain 6,000, over.” About 1903:15,

the CVR transcript indicated that the captain made a radio transmission, stating “four

twenty seven emergency.” Between 1903:18.1 and 1903:19.7, the CVR recorded the

captain stating “pull...pull...pull.” From about 1903:09 to about 1903:22, the first

officer’s radio microphone was activated and deactivated repeatedly, so the ATC tapes

recorded exclamations and other sounds from the accident airplane. During postaccident

interviews, air traffic controllers who were in the tower cab when the accident occurred

reported that they observed dense smoke rising to the northwest of the airport shortly after

USAir flight 427’s final transmission. The CVR stopped recording at 1903:22.8.

About 1903:23, the airplane impacted hilly, wooded terrain near Aliquippa,

Pennsylvania, approximately 6 miles northwest of PIT. The location of the accident was

40° 36 minutes, 14.14 seconds north latitude, 80° 18 minutes, 36.95 seconds west

longitude at an elevation of about 930 feet msl. The accident occurred during daylight

hours. 

19 The traffic alert and collision avoidance system is an airborne system based on radar beacon signals

that operate independent of ground-based equipment. Although it was not possible to positively determine

what triggered the system’s alert, radar information indicated that, during the accident sequence, USAir

flight 427 was within about 3 miles of Atlantic Coast flight 6425 when the accident airplane descended

through the Atlantic Coast flight’s altitude. 

20 The CVR transcript also indicated that the pilots of USAir flight 427 made a radio transmission to

ATC about 1903:10 and that the captain’s cockpit microphone recorded the statement, “Oh God...Oh God.”
Factual Information 7 Aircraft Accident Report

1.2 Injuries to Persons

1.3 Damage to Aircraft

The airplane was destroyed by ground impact and postcrash fire. According to

insurance company records, the airplane was valued at $30 million. 

1.4 Other Damage

No structures on the ground were damaged. Trees and vegetation near the accident

site were destroyed or damaged by the impact, fuel blight, and postcrash fire and during

wreckage removal. 

1.5 Personnel Information

The flight crew consisted of the captain and the first officer. Three flight attendants

were also on duty aboard the airplane. The 3-day trip sequence during which the accident

occurred was the first time the captain and the first officer had flown together. 

Both pilots were off duty on Monday, September 5, 1994 (Labor Day holiday).

According to their wives, both pilots spent their off-duty time relaxing with family and

friends and received a normal amount of sleep21 before they reported for flight duty. 

The pilots reported for duty in Philadelphia, Pennsylvania, on Tuesday,

September 6, about 1615 for the 3-day trip sequence. On the first day, the pilots flew to

Indianapolis, Indiana, returned to Philadelphia, and then continued to Toronto, Ontario,

Canada. They arrived in Toronto about 2310, completed their flight-related duties about

2327, and remained in Toronto overnight. According to the flight logs, the pilots’ duty

time for the first day of their trip sequence was about 7 hours 12 minutes, including about

4 hours 56 minutes of flight time. At Toronto, the pilots had a scheduled layover of about

14 hours 30 minutes. 

Table 1. Injury chart.

Injuries Crew Passengers Others Total

Fatal 5 127 0 132

Serious 0 00 0

Minor/None 0 00 0

Total 5 127 0 132

21 The captain’s wife reported that he normally slept about 71⁄2 hours each night when he was not

working. She indicated that, on September 4 and 5, the captain went to bed between 2300 and 2400 and

awoke between 0700 and 0800 the following mornings. The first officer’s wife reported that he normally

slept about 8 hours each night when he was not working. She indicated that, on September 4, the first officer

went to bed about 2200 and awoke about 0630 the next morning; on September 5, he went to bed about 2200

and awoke earlier than usual (about 0500) the next morning to begin the commute from his home near

Houston, Texas, to Philadelphia, Pennsylvania, to report for duty later that day. 
Factual Information 8 Aircraft Accident Report

On the second day of the trip sequence (Wednesday, September 7), the pilots’ duty

period began about 1400 at Toronto. They flew to Philadelphia, then Cleveland, Ohio;

then Charlotte, North Carolina; and then Jacksonville, Florida. They arrived in

Jacksonville about 2254, completed their flight-related duties about 2321, and remained in

Jacksonville overnight. According to the flight logs, the pilots’ duty time for the second

day of their trip sequence was about 9 hours 21 minutes, including about 5 hours

16 minutes of flight time. At Jacksonville, the pilots had a scheduled layover of nearly

13 hours before reporting for duty about 1215 on Thursday, September 8.

1.5.1 The Captain

The captain, age 45, was hired by USAir on February 4, 1981, while on furlough

from Braniff Airways. He held airline transport pilot (ATP) certificate No. 1954135 with a

multiengine land airplane rating and a type rating in the 737. Additionally, he held a flight

engineer certificate and a commercial pilot certificate with single-engine land,

multiengine land, and instrument ratings. The captain’s most recent first-class Federal

Aviation Administration (FAA) airman medical certificate was issued on July 9, 1994,

with no restrictions or limitations. 

The captain’s initial flight experience was in general aviation, and he obtained a

private pilot certificate in August 1969. He subsequently entered the U.S. Air National

Guard and successfully completed the U.S. Air Force (USAF) pilot training program22 in

December 1973. The Safety Board was unable to review the captain’s USAF training and

flight records from before September 3, 1975, because, according to a USAF

representative, flight records dated before then (including the captain’s initial training

records) had been destroyed. The captain’s available military flight records indicated that,

between September 3, 1975, and March 15, 1979, he accumulated about 894 hours of

military flight time, including 227 hours of training and 667 hours in the Cessna O-2

observation airplane.23

The captain obtained a commercial pilot certificate in June 1974, a flight engineer

certificate on July 28, 1976, and an ATP certificate with a type rating in the 737 on

August 25, 1988. He was hired by Braniff Airways on October 17, 1977. His initial

assignment with Braniff was as second officer on a Douglas Aircraft Company DC-8. On

December 1, 1980, the captain was furloughed by Braniff. Two months later, the captain

was hired by USAir. As he neared the end of the required 1-year probation period at

USAir, the captain submitted a letter of resignation to Braniff on January 25, 1982, with an

effective date of February 4, 1982. Braniff personnel records indicated that the captain

would be considered for rehire.

The captain’s first assignment with USAir was as a flight engineer on the 727. He

was upgraded to first officer on the British Aerospace Corporation (BAC) 111 in

22 The USAF provides pilot training for Air National Guard personnel. 

23 The Cessna O-2 is the military version of the Cessna 337, an in-line thrust, twin reciprocating enginepowered airplane. The Cessna O-2 is used in forward air control observations and is not approved for

aerobatic maneuvers. 
Factual Information 9 Aircraft Accident Report

November 1982. He transitioned to the 737 in September 1987 as a first officer and was

upgraded to captain on the 737 on August 25, 1988. According to USAir records, at the

time of the accident, the captain had flown approximately 12,000 flight hours, including

3,269 hours as a 737 captain. He also had 795 flight hours as a 737 first officer. 

USAir records indicated that the captain was on extended sick leave from

January 25 to April 28, 1994, because of back surgery.24 When he returned to flight duty,

the captain underwent 737 requalification and crew resource management (CRM)

training, which he completed on April 29, 1994. The captain’s most recent line check was

completed on May 6, 1994, and his most recent line-oriented flight training (LOFT) was

completed on July 19, 1994.

A review of USAir’s training records indicated that the captain performed

satisfactorily in initial, recurrent, CRM, and LOFT training and line and proficiency

checks in all airplanes and all positions.25 Additionally, a review of the captain’s USAir

personnel records, FAA airman certification records, and FAA accident/incident and

violation histories revealed nothing noteworthy. During postaccident interviews, several

check airmen, instructors, and first officers who were acquainted with the captain and his

piloting abilities indicated that the captain was meticulous, very proficient, very

professional, and attentive to detail and that he flew “by the book.” They also reported that

the captain was well liked and exhibited excellent CRM skills. 

According to his wife, the captain did not complain of back pain after he returned

to flight duty. She stated that he took no medication, other than allergy injections,26 and

drank alcohol rarely. She considered his overall health to be “very good.” A review of the

USAir-sponsored insurance company medical records revealed that, during the 5 years

before the accident, the medical claims submitted by the captain indicated no significant

illnesses or hospitalizations except for the back surgery shown in company records.

The Safety Board’s review of the captain’s available flight records (civilian and

post-1975 military records) revealed no documentation of aerobatic flight experience.27

24 The captain underwent back surgery in March 1994 to remove a ruptured disk. 

25 Although the captain’s training records indicated that he satisfactorily completed all training and line

and proficiency checks in all airplanes and all positions, the training record from his September 1987

transition from BAC-111 first officer to 737 first officer contained the instructor’s remark, “I would place at

end of training, [the captain] in [the] lower 10 percent.” During postaccident interviews, the instructor stated

that he did not recall the circumstances that prompted him to make this remark. He further stated that, if the

captain had not satisfied all the requirements, he would have graded the captain’s performance

unsatisfactory. 

26 During postaccident interviews, the captain’s allergist stated that the captain exhibited mild allergy

symptoms, such as sneezing, runny nose, and postnasal drip, which responded well to allergy injections. The

allergist reported that the captain was current with his allergy injections, having received the most recent one

in August 1994. 

27 The Safety Board is aware that the USAF’s initial pilot training program included aerobatic training

in the T-37 and T-38 jet trainers. (No records were available of the captain’s initial training in the Air Force.)
Factual Information 10 Aircraft Accident Report

1.5.2 The First Officer

The first officer, age 38, was hired by Piedmont Airlines in February 1987 and

became a USAir employee after USAir acquired Piedmont Airlines in June 1989. He held

ATP certificate No. 2238867 with single-engine and multiengine land airplane ratings.

Additionally, he held a commercial pilot certificate with single-engine land, multiengine

land, and instrument ratings. The first officer’s most recent FAA first-class airman

medical certificate was issued on July 7, 1994, with no restrictions or limitations. 

The first officer’s initial flight experience was in general aviation. He was issued a

private pilot certificate in May 1973, multiengine and instrument ratings in December

1980, a commercial pilot certificate in January 1981, and the ATP certificate in October

1982. 

The first officer’s initial position with Piedmont Airlines was as a first officer on

the Fokker F.28. He transitioned to first officer on the 737 on May 1, 1989, and remained

in that position after he became a USAir employee in June 1989. At the time of the

accident, the first officer had a total of 9,119 flight hours, including 3,644 flight hours as a

737 first officer. His most recent proficiency check, which included CRM refresher

training, was satisfactorily completed on May 12, 1994. 

A review of the first officer’s USAir personnel records, FAA airman certification

records, and FAA accident/incident and violation histories revealed nothing noteworthy.

According to his training records, the first officer performed satisfactorily in initial and

LOFT training and line and proficiency checks in all airplanes and all positions. During

postaccident interviews, check airmen, instructors, and captains who were acquainted with

the first officer and his piloting abilities indicated that the first officer was friendly, very

well qualified, and an outstanding first officer who exhibited exceptional piloting skills.

USAir’s Philadelphia-based chief pilot stated that the first officer was a "very dedicated,

professional, dependable person." One captain who had flown with the first officer

described an in-flight hydraulic system emergency that occurred during one of their

flights. He stated that the first officer remained very calm during the emergency situation.

According to the first officer’s wife, he did not take medication and was a

moderate, occasional drinker. She characterized the first officer’s overall health as

“excellent.” A review of the USAir-sponsored insurance company medical records

revealed that the first officer had not made any medical claims during the 5 years before

the accident.

Examination of the first officer’s personal logbooks and records did not indicate

any aerobatic flight training or experience. However, his flight logbooks indicated that he

had performed spin recoveries on three occasions in 1973 in a Piper J-3 “Cub” airplane

when he had total flight times between 77 and 93 hours.
Factual Information 11 Aircraft Accident Report

1.5.3 Flight Attendant Information 

The lead, or “A” position flight attendant was hired by Piedmont Airlines in May

1989. He completed the USAir Merger Module Training that was required when USAir

acquired Piedmont Airlines in June 1989. His most recent recurrent training was

satisfactorily completed on June 14, 1994, and he was qualified on the 737-300. The “B”

position flight attendant was hired by Piedmont Airlines in March 1989. She also

completed the USAir Merger Module Training in June 1989. Her most recent recurrent

training was satisfactorily completed on February 2, 1994, and she was qualified on the

737-300. The “C” position flight attendant was hired by USAir in October 1988. Her most

recent recurrent training was satisfactorily completed on October 14, 1993, and she was

qualified on the 737-300. 

1.6 Airplane Information

N513AU, a 737-300 series airplane (model 737-3B7),28 serial number (S/N)

23699, was a pressurized, low-wing, narrow-body transport-category airplane, equipped

with two CFM International29 CFM56-3B-2 engines (operated at the CFM56-3-B1 thrust

rating). The No. 1 (left) engine, S/N 725150, had been operated about 13,880 flight hours

since new, including 3,462 flight hours and 2,160 flight cycles since it was overhauled and

installed on N513AU in August 1993. The No. 2 (right) engine, S/N 720830, had been

operated about 16,810 flight hours since new, including 3,789 flight hours and 2,340 flight

cycles since it was overhauled and installed on N513AU in July 1993. At the time of the

accident, the airplane had been operated about 23,846 total hours of flight time and 14,489

cycles. When the accident airplane was manufactured and delivered to USAir in October

1987, it was registered as N382AU; USAir re-registered the airplane as N513AU in

December 1987 after the airline acquired Pacific Southwest Airlines (PSA). 

The airplane was equipped with an auxiliary fuel tank, which had been deactivated

and held no fuel at the time of the accident.30 The presence of the auxiliary fuel tank

limited the cargo capacity of the aft cargo compartment. 

Dispatch records indicate that the airplane held a total of 15,400 pounds of fuel

when it left the gate at ORD and that the estimated fuel consumption for the flight to

Pittsburgh was about 6,400 pounds. According to the USAir dispatch papers for USAir

28 The 737-300 series airplane is one of several 737 models. Other 737 models include the -100, -200,

-400, -500, -600, -700, -800, and -900. The 737-600 through -900 series airplanes are referred to as the 737

next-generation (NG) airplanes. 

29 CFM International is a joint venture engine-manufacturing company formed in 1974 by General

Electric (now General Electric Aircraft Engines) of the United States and Society National d’Etude et de

Construction de Moteurs d’Aviation of France.

30 The accident airplane was equipped with a Patrick Aircraft Tank System auxiliary fuel tank system.

This 425-gallon-capacity auxiliary fuel tank system was located in the forward end of the aft cargo bay.

According to USAir maintenance records, the auxiliary fuel tank was installed in the accident airplane on

October 17, 1987, and was deactivated in accordance with the manufacturer’s procedures on January 10,

1994. 
Factual Information 12 Aircraft Accident Report

flight 427, 8 passengers were seated in the first-class cabin, and 119 passengers were

seated in the coach cabin. According to USAir’s dispatch papers, flight 427’s documented

cargo consisted of 10 boxes of magazines weighing 1,939 pounds. The boxes were loaded

in the forward compartment with about 425 pounds of passenger baggage; the aft cargo

compartment was loaded with 1,275 pounds of passenger baggage. USAir’s dispatch

papers also indicated that the airplane’s gross takeoff weight when it departed ORD was

114,969 pounds. The airplane had a certificated maximum gross weight of 135,500

pounds and a maximum takeoff weight for the departure runway (32L) at ORD of 118,700

pounds. On the basis of Safety Board calculations, flight 427, at the time of the accident,

had an estimated operating weight of 108,600 pounds and a center of gravity of 19 percent

mean aerodynamic chord, which was within the allowable weight and balance envelope

for the approach and landing phase of flight. 

1.6.1 Accident Airplane Maintenance Information

1.6.1.1 Inspections 

USAir’s FAA-accepted continuous airworthiness maintenance program for its

737s included six specific checks to be accomplished at various calendar or operating time

intervals. The maintenance inspection intervals and the times and dates that those

inspections were last accomplished on the accident airplane were as follows: 

• Wheel/Oil Check—Accomplished once every operating day. Accomplished on

the accident airplane during transit check on September 8, 1994, about 53⁄4

flight hours before the accident. 

• Transit Check—Accomplished every 35 flight hours or 7 calendar days,

whichever comes first. Accomplished on the accident airplane on September 8,

1994, about 53⁄4 flight hours before the accident. 

• "A" Check—Not to exceed 200 flight hours. Accomplished on the accident

airplane on August 25, 1994, about 133 flight hours before the accident.

• "B" Check—Not to exceed 1,150 flight hours. Accomplished on the accident

airplane on May 19, 1994, about 1,008 flight hours before the accident.

• "C" Check—Not to exceed 4,600 flight hours. The C check is broken down

into four segments at 1,150-hour intervals. A quarter C check was completed

on the accident airplane on July 20, 1994, about 433 flight hours before the

accident.

• "Q" Check—Not to exceed 11,000 hours or 42 months, whichever comes first.

The initial Q check is not required until 20,000 hours or 80 months, whichever

comes first. The Q check is an approved alternative to the structural inspection

("D" check). Maintenance endorsements for work completed during the

accident airplane’s last Q check were dated February 3 through 5, 1993, about

19 months before the accident. 
Factual Information 13 Aircraft Accident Report

A review of the accident airplane’s maintenance records from June 2, 1994, to the

accident date revealed the following five maintenance carryover items: 

• the left aft inboard flap assembly was dented, 

• an interim repair to correct a soft and spongy aisle floor section adjacent to seat

row number 5 (about fuselage station 360) was needed, 

• the attach mount bushing on the thrust reverser “C” duct for the right engine

was worn, 

• the lower left and right C duct sliders on the right engine were worn 30 to 49

percent, and 

• the lower left and right C duct sliders on the left engine were worn 30 to 49

percent. 

Examination of the maintenance work cards from the most recent C and Q checks

noted several reports of lavatory fluid, known as “blue water,” leaking under the sink and

toilet of the forward lavatory.31 Additionally, the work cards noted corrosion in the

forward galley floor structure. 

Maintenance records for the most recent Q check indicated that a thrust reverser

synchronizer lock (sync-lock) system32 was installed in accordance with Boeing Service

Bulletin (SB) 737-78-1053, dated December 17, 1992, and USAir engineering

authorization 18190. However, on February 11, 1993, Boeing issued Service Letter (SL)

737-SL-78-26, which advised all 737 operators to deactivate the sync-lock system (if

installed) because of “the possibility of an intermittent condition which results in the

inability to attain reverse thrust when commanded.” A USAir work card, dated

February 5, 1993, stated “accomplish...de-activation of T/R [thrust reverser] sync lock

system...[according to] 737-SL-78-26”33 and referenced USAir engineering authorization

18477, “De-activation of Thrust Reverser Sync Lock System,” dated February 4, 1993.

The system’s wiring harness remained installed with its electrical connectors capped and

secured and the electric synchronizer locks removed. The sync-lock system on the

accident airplane remained deactivated on the date of the accident. 34

31 The last report of blue water leakage on the accident airplane was in May 1994, when blue fluid was

found aft of the main entry door. The area was inspected and cleaned, and no additional leakage was noted.

32 The thrust reverser sync-lock system was designed to minimize the possibility of in-flight thrust

reverser deployment. 

33 Boeing’s 737-SL-78-26 was dated February 11, 1993, 6 days after USAir’s maintenance personnel

indicated that they accomplished the deactivation of the thrust reverser sync-lock system (according to work

card No. 3-72-93853, dated February 5, 1993). According to USAir personnel, they deactivated the thrust

reverser sync-lock system in response to an advance copy of 737-SL-78-26, which they received in early

February 1993. The installation and subsequent deactivation were completed during the same maintenance

visit. 

34 After the accident, the FAA issued Airworthiness Directive (AD) 94-21-05 R1, which became

effective November 25, 1994. The AD required the installation of the sync-lock feature on all 737-300, -400,

and -500 series airplanes.
Factual Information 14 Aircraft Accident Report

Maintenance records also indicated that the main rudder power control unit (PCU)

was replaced during the last Q check (February 1993) after leakage was observed at the

rear seal. Three of the Q check work cards described the work pertaining to the main

rudder PCU as follows: 

Work card No. J3-64-55501-2 indicated that the PCU “reference rod [had]

been scraped against [the] vertical fin liner structure” and that the damaged

area was cleaned up, inspected, and “found to be within limits.” 

Work card No. J3-65-27500-2 indicated that the “main bolt which attaches

power control unit to rudder attach point has slight step worn in it.” The

worn bolt was replaced. 

Work card No. J3-65-27500-3 indicated that the “rod bearing on [the] PCU

at [the] PCU to rudder attach point has rough feel during operation” and

that the PCU was replaced “due to leakage.”

The replacement main rudder PCU, S/N 1596A, was examined and tested

thoroughly during the accident investigation. (For additional information regarding the

main rudder PCU, see sections 1.6.3.2 and 1.16.5.) 

USAir’s maintenance records showed that the periodic rudder functional checks

required by Airworthiness Directive (AD) 94-01-07 (explained in more detail in sections

1.6.3.2.1 and 1.18.5) were successfully performed on the accident airplane three times in

1994. The initial check was performed on March 21, 1994, at 22,368 flight hours and

13,511 flight cycles. Repetitive inspections were performed on June 14, 1994, at 23,100

hours and 13,994 cycles and on August 8, 1994, at 23,572 hours and 14,298 cycles. The

maintenance records also indicated that the accident airplane was in compliance with all

other applicable ADs at that time.

1.6.1.2 Events on Earlier Flights 

The accident airplane departed Windsor Locks, Connecticut,35 about 0620 on the

morning of September 8, 1994, and was flown to Syracuse and Rochester, New York;

Charlotte; and Jacksonville (where the accident flight crew boarded). The pilots of the

earlier flights reported no difficulties with the airplane. However, a passenger who was on

the accident airplane when it arrived in Jacksonville reported an "abrupt maneuver" during

the approach to Jacksonville. Subsequent examination of the FDR information for this

approach indicated a roll of 9° to the left followed by a roll of 12° to the right. The FDR

indicated the event, from the beginning of the left roll to the return to wings-level attitude,

occurred over 20 seconds. The pilots of that flight stated that they did not notice any

unusually abrupt maneuvers. They suggested that a slight roll might have occurred as they

changed to different modes of the autopilot, but they had no recollection of an unusual roll

event. The pilots stated that the airplane’s systems and controls functioned normally

during the flight. 

35 The accident airplane remained in Windsor Locks on the night of September 7, 1994, where a

maintenance transit check was accomplished. Records indicated that only routine service was performed and

that no discrepancies were noted during this inspection.
Factual Information 15 Aircraft Accident Report

The Safety Board also received postaccident passenger reports of an unusual

sound that occurred during the flight immediately preceding the accident flight, from

Charlotte to ORD. An off-duty/commuting USAir captain who traveled on flight 1181

from Jacksonville to Charlotte and then to ORD occupied a seat in the passenger cabin

during the flight from Jacksonville to Charlotte; however, he occupied the observer’s

jumpseat36 in the cockpit during the flight from Charlotte to ORD because of a full

passenger load. According to the off-duty captain, during the flight from Charlotte to

ORD, a passenger in the forward cabin told the flight attendant that he heard an unusual

noise, and the flight attendant informed the flight crew of the passenger’s comment. While

the flight crew attempted to determine the origin of the noise, the off-duty captain noted

that the cabin address microphone had come out of its holder. The microphone was

returned to its holder, and there were no further reports of unusual noises. 

During the Safety Board’s January 1995 public hearing regarding this accident,37

the off-duty USAir captain indicated that airplane operations during the two flights

appeared to be "normal." He stated that the flight and cabin crew interaction appeared to

be routine and professional and that both pilots seemed to be friendly and in good spirits.

He observed no problems with the airplane and reported that the captain was performing

the PF duties for the leg from Charlotte to Chicago.

1.6.2 Boeing 737 Hydraulic System Information

Hydraulic power on the 737-300 is provided by three independent hydraulic

systems, each of which is capable of operating pressures of about 2,950 pounds per square

inch (psi). The systems are designated as hydraulic system A, hydraulic system B, and the

standby hydraulic system. Hydraulic systems A and B have independent hydraulic

reservoirs and two hydraulic pumps each. Although hydraulic systems A and B normally

operate together to provide dual hydraulic power for primary flight controls (ailerons,

elevators, and rudder), either system is capable of powering the flight controls alone if the

other system fails. Further, if one of the hydraulic pumps in either the A or B systems were

to fail, the remaining pump has sufficient capacity to provide full flight control authority

for its respective system operation.

The 737-300 hydraulic system A is powered by one engine-driven hydraulic pump

(EDP) and one electrical-powered hydraulic pump. Hydraulic system A provides power

for the ailerons, rudder, elevators, landing gear, normal nosewheel steering, alternate

brakes, inboard flight spoilers, left engine thrust reverser, ground spoilers, the A system

autopilot, and the autoslats through the power-transfer unit. The 737-300 hydraulic

36 The cockpit was configured with two crew seats (captain on the left and first officer on the right) with

the throttle/communication/navigation console located between them. The observer seat is located behind

the flight crew seats and console and in front of the cockpit-to-cabin access door. 

37 The Safety Board conducted two sessions of its public hearing regarding this accident. The first

session was held in Pittsburgh in January 1995, and the second session was held in Springfield, Virginia, in

November 1995. Although it is unusual for the Safety Board to hold two sessions of a public hearing, the

Board believed that a second session was warranted, given the scope and technical depth of the accident

investigation. 
Factual Information 16 Aircraft Accident Report

system B is also powered by one EDP and one electrical-powered hydraulic pump.

Hydraulic system B provides power for the ailerons, rudder, elevators, trailing edge flaps,

leading edge flaps and slats, autoslats, normal brakes, outboard flight spoilers, right

engine thrust reverser, yaw damper, the system B autopilot, autobrakes, landing gear

transfer unit, and alternate nose wheel steering (if installed). 

The 737-300 standby hydraulic system is unpressurized during normal operations.

This system is powered by an electric pump and can be activated manually by the pilots by

arming “ALTERNATE FLAPS” or selecting the hydraulic system A or B flight control

switch to “STBY RUD” (standby rudder) on the overhead panel in the cockpit.38 The

737-300 standby hydraulic system will activate automatically in the event of a loss of

hydraulic system A or B pressure during takeoff or landing. (For automatic operation,

speed must be greater than 60 knots, or the airplane must be airborne with wing flaps

extended.) The standby hydraulic system powers the standby rudder system, provides an

alternate source of power for both thrust reversers, and extends the leading edge flaps and

slats in the ALTERNATE FLAPS mode. In the event of a failure of both hydraulic systems

A and B, the ailerons and elevators can be operated manually without hydraulic power

(referred to as manual reversion).39 The rudder has no manual reversion capability but can

be operated with the standby hydraulic system.40

Controls and indicators for hydraulic systems A and B are located on the first

officer’s overhead panel in the cockpit;41 they include on/off switches for each pump and

amber lights that indicate hydraulic system low pressure or overheat conditions for the

electrically driven pumps. Figure 2 illustrates the hydraulic system panel. 

38 During normal operation, the hydraulic system A and B flight control switches would be in the ON

position, and the ALTERNATE FLAPS switch would be in the OFF position. 

39 According to Boeing, manual reversion requires approximately 40 pounds of force at the control

wheel to initiate a roll and approximately 60 pounds of force at the control column to initiate a pitch change.

40 Although the 737 rudder technically has no manual reversion capability, it is possible for a pilot (with

sufficient rudder pedal force) to command some rudder movement with no hydraulic system power.

41 Although located on the first officer’s overhead panel, the hydraulic system control panel is

accessible to both pilots.
Factual Information 17 Aircraft Accident Report

Figure 2. Boeing 737 hydraulic system panel.

29(5+($7 29(5+($7

/2:

35(6685(

/2:

35(6685(

/2:

35(6685(

/2:

35(6685(

<$:

'$03(5

)((/ ',))

35(66

63((' 75,0

)$,/

0$&+ 75,0

)$,/

$872 6/$7

)$,/

/2:

35(6685(

/2:

48$17,7<

67$1'%<

+<'

)/7 &21752/

632,/(5

<$: '$03(5

$/7(51$7( )/$36

/2:

35(6685(

/2:

35(6685(

(1*####4#######(/(&####5

2))

21

$

(/(&###4#######(1*#####5

2))

21

+<' 38036 %

$#################%

$#############%

67'%<

58'

2))

$##21

67'%<

58'

2))

%##21

2))

$50

2))

21

2))

21

2))

21

83

'2:1

2))
Factual Information 18 Aircraft Accident Report

1.6.2.1 Hydraulic System Maintenance 

USAir’s maintenance records indicated that the accident airplane had been

serviced at the time of manufacture with Skydrol LD4 hydraulic fluid manufactured by

Monsanto.42 According to Boeing, it ensures that the particulate count in the hydraulic

systems of newly delivered airplanes meets the cleanliness requirement of National

Aerospace Standard (NAS) 1638 Class 9. According to NAS 1638, “Cleanliness

Requirements of Fluid Used in Hydraulic Systems,” the “cleanliness limit of the

representative fluid sample from parts, assemblies, lines and fittings shall not exceed the

permissible maximum contamination limits of the specified class...in Table I....” NAS

1638 Table I lists hydraulic fluid cleanliness limits by particle count and size, ranging

from Class 00 to Class 12. Table 2 shows excerpts from the NAS table.43

Boeing's Maintenance Planning Document recommends the replacement of the

hydraulic system A and B filters at C check intervals and the replacement of filters located

at the flight control system PCUs "on condition"44 during maintenance of the filters’

respective components. USAir’s maintenance program incorporated these recommended

replacement intervals. 

Boeing’s 737 Maintenance Manual (MM) did not recommend any specific interval

for the sampling or replacement of the hydraulic fluid during the life cycle of the airplane.

However, section 29-15-00 in the MM (pages 601-606), which describes Boeing’s

recommended “Hydraulic Systems A, B, and Standby—Inspection Check” procedures

and limits, states the following on page 601 (dated November 15, 1993): 

The operational environment of the airplane hydraulic system can affect

the service life of the hydraulic fluid. You make a decision to take a sample

of the hydraulic fluid for analysis if you find that it is necessary from your

service experience.... If the fluid properties are greater than the

limits...replace some quantity of fluid with new fluid until the fluid

properties agree with the limits shown. 

42 Skydrol LD4 is a phosphate ester hydraulic fluid. It is part of the Skydrol family of fire-resistant

hydraulic fluids and meets the airframe manufacturer’s specifications for viscosity, flashpoint, and moisture

content as a Type IV fluid. It has been used commercially since 1978.

Table 2. Hydraulic fluid cleanliness limits from NAS 1638 Table I.

 5-15 μ 15-25 μ 25-50 μ 50-100 μ >100 μ

Class 00 125 22 4 1 0

Class 1 500 89 16 3 1

Class 9 128,000 22,800 4,050 720 128

Class 12 1,024,000 182,400 32,400 5,760 1,024

43 The symbol μ in table 2 represents the unit of measurement termed a micron, which is 1/1,000 of a

millimeter. For a point of reference, a 0.5-millimeter mechanical pencil is 500 microns in diameter. 

44 Replacement “on-condition” means that the component or part is removed/replaced only after a

defect or anomaly is noted during an inspection. The replacement is not based on a time or cycle limit. 
Factual Information 19 Aircraft Accident Report

During postaccident discussions, Boeing personnel stated that fluid sampling (or

replacement/replenishment) intervals were to be established by the operator (along with

the operator’s hydraulic fluid supplier) based on service experience and the operational

environment. USAir’s maintenance program did not include a requirement to sample or

replace the hydraulic fluid in the systems, and such sampling or replacement of hydraulic

fluid were not required by the FAA. The Safety Board examined hydraulic fluid samples

from the accident airplane during the investigation (see section 1.16.5.4.3 for details).45

1.6.3 Boeing 737 Flight Control Systems 

The flight controls on the 737 are the ailerons, flight spoilers, elevators, horizontal

stabilizer, rudder, flaps, and slats. Flight control about the longitudinal (roll) axis of the

airplane is provided by an aileron on each wing assisted by two flight spoilers. Flight

control about the lateral (pitch) axis is provided by the horizontal stabilizer and two

elevators. Flight control about the vertical or directional (yaw) axis is provided by the

single-panel rudder.46 The ailerons and flight spoilers (roll control) are operated by

moving the control wheel clockwise or counterclockwise,47 the elevator (pitch control) is

operated by moving the control column forward or aft, and the rudder (directional/yaw

control) is operated by moving either the right or left rudder pedal forward or aft. Figure 3

depicts the three axes of motion, and figure 4 shows the flight control surface locations.

Boeing stated that the 737 roll and yaw control systems were designed to be

capable of countering the effects of failures (such as loss of power on one engine, flap and/

or slat asymmetries, and hydraulic system failure) and achieve the desired crosswind

control capability. According to Boeing, the 737 is aerodynamically cross-coupled (as are

most airplanes); that is, motions about the roll and the yaw axes constantly interact and

affect each other in flight. Thus, any yawing motion (sideslip) would cause the airplane to

roll unless countered by the control wheel. The 737 rudder system is discussed in greater

detail in section 1.6.3.2.

1.6.3.1 Auto-Flight System 

When engaged, the 737-300 AFS provides control commands to the airplane’s

ailerons, flight spoilers, horizontal stabilizer, and elevators to reduce pilot workload and

provide for smoother flight. The AFS does not provide control commands to the airplane’s

rudder system. A yaw damper system automatically stabilizes the airplane about its yaw

axis by limiting yaw motions caused by atmospheric disturbance or the airplane (an

45 On October 18, 1996, the Safety Board issued Safety Recommendation A-96-116, asking the FAA to

“define and implement standards for in-service hydraulic fluid cleanliness and sampling intervals for all

transport-category aircraft.” See section 1.18.11.5 for a full discussion of the FAA’s response to this

recommendation.

46 For more information about the 737 rudder design, see section 1.6.3.2.

47 A clockwise control wheel input commands roll in a right-wing-down (RWD) direction, whereas a

counter-clockwise control wheel input commands roll in a left-wing-down (LWD) direction. In this report,

clockwise and counter-clockwise control wheel inputs will be described as right and left control wheel

inputs, respectively. 
Factual Information 20 Aircraft Accident Report

Figure 3. Three axes of motion.

Figure 4. Boeing 737 flight control surface locations.

Angle of Airflow Sensors

Leading Edge Flaps

Leading Edge Slats

Flight Spoilers

Trailing Edge Flaps

Ailerons Stabilizer B alance Tabs

Elevator

Rudder

Ground Spoilers
Factual Information 21 Aircraft Accident Report

inherent characteristic of all swept-wing airplanes). Section 1.6.3.2 contains additional

details about the yaw damper system. Rudder trim control during flight is maintained by

the pilots with automatic assistance from the yaw damper. 

The AFS consists of the autopilot flight director system and the autothrottle.

Within the autopilot flight director system, commands from two flight control computers

move the related flight controls (elevators, stabilizer trim, ailerons, and flight spoilers)

through the hydraulic systems. The autopilot flight director system mode control panel

(MCP) is located on the glareshield between the pilot positions and provides coordinated

control of the autopilot and flight director (FD).48 The MCP contains power switches;

indicator lights; flight mode selectors; and airspeed, altitude, vertical speed, heading, and

bank angle selectors/displays. Figure 5 shows a 737 MCP display. The autothrottle moves

thrust levers to maintain airspeeds and/or thrust settings selected by the pilots and/or

calculated by the flight management computer. The autothrottle is armed by a switch on

the MCP and is activated by the takeoff/go-around (TOGA) switches on the throttles.

Page 14-15-1 of USAir’s 737-300 and -400 Pilot’s Handbook, under the heading

“Autopilot Engagement Criteria,” states that the two autopilot flight control computers are

engaged with separate switches, each of which can be in one of three positions:

mechanically latched in the OFF position, magnetically held in the control wheel steering

(CWS) or in the command (CMD) position,49 or magnetically released from the CWS or

the CMD position. According to Boeing’s 737 Pilot’s Handbook, manually overriding

autopilot commands with the control wheel or control column does not disengage the

autopilot but shifts autopilot control from CMD to CWS mode.50 Manual override can

shift the autopilot from CMD to CWS in the pitch and roll axes separately or together,

depending on the inputs made by the pilot. When the airplane is operating in the CWS

mode and the pilot is not exerting force on the control column or control wheel, the

48 The FD provides command bar “pointers” on the attitude indicator display to guide pilots when hand

flying the airplane.

Note: Autothrottle is depicted as A/T, and autopilot is depicted as A/P.

Figure 5. Boeing 737 MCP display. 

49 With CWS engaged, the autopilot maneuvers the airplane in response to control pressure applied by

either pilot. The control pressure is similar to that required for manual flight, and the use of CWS does not

disengage the autopilot. With CMD engaged, the autopilot will control the airplane according to the mode

selected via the Mode Selector Switches, which include Altitude Hold, Vertical Speed, Level Change,

Vertical Navigation, VOR Localizer, Lateral Navigation, and Heading Select. 

50 If both autopilots are engaged (that is, for a dual-channel autoland operation), the autopilots will not

shift from CMD mode to CWS mode. 

N1 SPEED LVL C HG HDG SEL APP ALT HO LD V/S

C O URSE A /T IA S/MA C H VN AV HEADIN G LNAV A LTITUD E VERT SPEED A /P ENG A G E C O URSE

ARM

O FF

O FF

O N

F/D

VO R LO C

C MD

C WS

O FF

D N

UP

O FF

O N

F/D

125 280 130 31700 0000 125
Factual Information 22 Aircraft Accident Report

autopilot will attempt to maintain constant pitch and bank attitude or, under certain

circumstances, to roll level and maintain the previously selected altitude. 

A magazine article published in Boeing’s October through December 1995 issue

of Airliner, entitled “737 Directional Control System,” stated that when a “force of

10 pounds is applied to the yoke, the control wheel moves and the autopilot reverts into

CWS [mode].” The article indicated that the autopilot would continue to function in the

CWS mode until the CMD mode was reselected or the autopilot was disengaged. The

article also stated the following:51

Normally in CWS, pilots use wheel input rates of 5 to 10 degrees per

second. If the wheel is turned at a high rate (40 degrees per second, or

more), then the force required to turn the wheel approximately triples. This

happens because the autopilot actuators can not respond fast enough and

are being forced by the pilot’s input. So, for a very quick wheel motion, the

lateral control forces can noticeably increase, but the corresponding roll

rate doesn’t.

According to USAir’s 737-300/400 Pilot’s Handbook, the autopilot disengages

under the following circumstances:

• Pressing either [autopilot] disengage switch.

• Pressing either TOGA switch with a single [autopilot] engaged in CWS or

CMD below 2,000 feet RA [radio altitude].

• Pressing either TOGA switch after touchdown with both [autopilots] engaged

in CMD.

• Moving the [autopilot] engage switch to OFF.

• Activating either pilot’s control wheel trim switch.

• Moving the stabilizer trim autopilot cutout switch to CUTOUT.

• Loss of respective hydraulic system pressure.

• Either left or right IRS [inertial reference system] failure or FAULT light

illuminated. 

• Loss of electrical power or a sensor input which prevents proper operation of

the engaged [autopilot] and mode. 

Page 14-55-1 of USAir’s 737-300/400 Pilot’s Handbook describes the autopilot

disengage switches, which are located on the outer grips of each control wheel. The

handbook states that, if a pilot presses the autopilot disengage switch on either control

wheel, the switch “disengages both [autopilots]. [Autopilot] disengage lights flash and

[autopilot] disengage warning tone sounds for a minimum of 2 seconds. Second push

extinguishes [autopilot] disengage lights and silences disengage warning tone.” 

51 This description of control wheel forces was supported in a September 26, 1995, letter from Boeing’s

Director of Air Safety Investigation to the Safety Board.
Factual Information 23 Aircraft Accident Report

1.6.3.2 Rudder Control System

The 737-300 has a single rudder panel actuated by a single hydraulic rudder PCU.

A standby rudder actuator is available to move the rudder if hydraulic systems A and/or B

fail. According to a Safety Board review of large transport-category airplanes (including

Boeing, McDonnell Douglas, Airbus, and Lockheed models), the 737 is the only twin

wing-mounted engine, large transport-category airplane designed with a single rudder

panel and single rudder actuator. All other large transport-category airplanes with twin

wing-mounted engines were designed with a split rudder panel, multiple hydraulic

actuators, or a mechanical/manual/trim tab rudder actuation system.

Pilot control of the 737-300 rudder is transmitted in a closed-loop system from the

pilots’ rudder pedals in the cockpit through a single cable system to the airplane’s tail

section and then through linkages to the main rudder PCU and a standby rudder PCU in

the aft portion of the vertical stabilizer. The rudder pedals at each pilot position are located

on either side of the control column stem, which is protected within a housing (commonly

termed the “doghouse” by 737 flight crews) that is located between each pilots’ lower legs

at the pilot positions. Figures 6 and 6a show the 737 rudder system. 

Figure 6. Boeing 737 rudder system.

Standby Rudder PCU

C aptain’s R udder Pedals

Switch and Indicator

R udder C ontrol Cables Aft Torque Tube

Feel and 

Centering Unit

Left Rudder Motion

Electric Rudder Trim Actuator

Rudder Hinge

Line

Aft Rudder Power 

Control Unit Input Rod

Rudder Main P CU
Factual Information 24 Aircraft Accident Report

According to Boeing personnel, because of the engine placements on the wings,

the 737 rudder has to be sufficiently powerful to effectively counter the effects of a loss of

engine power on one side during a maximum gross weight takeoff at low airspeeds,

especially in crosswind conditions. A loss of engine power on one side of the airplane

would result in a large yawing moment, in the direction of the inoperative engine,

produced by thrust from the operating engine. The loss of engine power can be countered

Figure 6a. Detailed view of 737 aft rudder system controls and linkages.

Upper Crank

Standby Power

Unit Input Rod

A ft Torque Tu be

Center Crank

Lower Crank

(Bell Crank)

Rudder Power

C ontrol Unit

Input Rod

Aft Rudder Control

Quadrant Input

Rod

Trim and 

Feel Rod

C able RB

C able RA

AFT Quadrant
Factual Information 25 Aircraft Accident Report

by a rudder input in the opposite direction (for example, left pedal input to counter loss of

power on the right engine).52

When properly installed and rigged, the 737-300 main rudder PCU can command a

maximum deflection of 26° to the right and the left of the rudder’s neutral position (under

no aerodynamic load conditions); the rudder can travel to those limits at a maximum rate

of 66° per second. (The 737 main rudder PCU is capable of producing about 5,900 pounds

of output force to move the rudder when both hydraulic systems are operating at their

normal operating pressure—2,950 psi each.) The rudder pedals move about 1 inch (from

their neutral position) for every 6.5° of rudder surface travel (under no aerodynamic load

conditions) until the rudder pedals reach their maximum travel of about 4 inches

(backward and forward) from the neutral position. The rudder pedal stops at the pilots’

forward rudder control quadrant are set to provide a mechanical stop at 28° of rudder

travel (exceeding the rudder’s travel authority) because compliance in the cable system

(cable stretch) may require rudder pedal travel beyond the 4-inch limit to achieve the full

travel rudder movement of 26°. With the aerodynamic loads encountered in flight, the

available amount of rudder surface travel is reduced. The maximum amount of rudder

travel available for an airplane at a given flight condition/configuration is referred to as

the rudder’s “blowdown” limit.53

The rudder feel and centering unit is attached to the aft rudder torque tube in the

vertical fin, forward of the main rudder PCU (see figure 6). This unit holds the rudder at

the neutral (or trimmed) position when no rudder pedal force is applied. It also provides a

feedback force to the rudder pedals that increases as the rudder pedals are depressed. The

pilot rudder pedal force required for full rudder deflection is about 70 pounds; however,

the rudder trim system allows the pilots to maintain a rudder deflection without having to

maintain a rudder pedal force. 

During normal and abnormal operations, the rudder can be moved beyond the

movement commanded by the hydraulic actuator through a pilot’s application of force on

the rudder pedals. (Normal operation of the rudder refers to the rudder’s motion, or lack

thereof, resulting from normal PCU servo valve operation. Abnormal operation refers to

the rudder’s motion that results from a PCU servo valve that is functioning abnormally, for

example, because of a rudder jam and/or reversal.54 Both types of operation can include

rudder movement within the range of the rudder authority on the ground and/or to the

rudder’s in-flight blowdown limit.) 

52 The rudders on airplanes with fuselage-mounted engines are typically less powerful than the rudders

on airplanes with wing-mounted engines. The rudders for fuselage-mounted engine airplanes do not have to

be designed to counter as significant an asymmetrical thrust effect in the event of a loss of power on one

engine. Because the rudder on airplanes with fuselage-mounted engines is less powerful, the consequences

of a rudder hardover are less serious; thus, the Safety Board’s investigation did not consider this type of

airplane. 

53 Rudder blowdown is the maximum rudder angle resulting from a pilot-commanded full rudder input

under the existing flight conditions. It represents a balance between the aerodynamic forces acting on the

rudder and the mechanical forces produced by the PCU. The maximum rudder angle can be increased

beyond that produced by the hydraulic force if the pilot exerts sufficient force on the rudder pedals.

54 Rudder reversals are discussed in section 1.16.5.4.7. 
Factual Information 26 Aircraft Accident Report

During normal rudder operation, if a pilot applies a sufficiently rapid rudder pedal

input (the rudder pedal must move faster than the PCU’s ability to respond to the input),

the PCU input crank would contact the PCU external body stop (manifold stop),

transmitting force from the rudder pedal input to the rudder surface through the main

rudder PCU and the rudder system's linkages. Also, the additional force applied by the

pilot would increase the rudder PCU output force, moving the rudder farther in the

intended direction of travel. The rudder feel and centering unit would oppose the rudder

pedal force (decrease the force applied by the pilot’s foot)55 with about 9 to 70 pounds of

force, depending on how far the rudder is away from its centered position. 

During normal operation of the rudder in flight, if a pilot applied between 9 and 70

pounds of force to a rudder pedal, the rudder would move in response until it reached its

blowdown limit (when the aerodynamic forces acting on the rudder surface equal the

hydraulic actuator force). According to Boeing engineers, if the pilot were to then apply

additional force to the rudder pedal, the pedal would move about 1 inch farther, with no

corresponding movement of the rudder, as the slack in the rudder linkage system is

removed and the external input crank contacts the external stop. Any additional pilot

application of force to the rudder pedal would result in rudder pedal movement of about

1 inch for each 300 pounds of rudder pedal force, which in turn would move the rudder

surface slightly beyond the maximum deflection possible from the hydraulic actuator force. 

During a servo valve jam/rudder reversal, the rudder pedal force from a pilot

resisting the jam would cause the rudder to move in the direction opposite the jam (toward

the rudder’s neutral position). The feel and centering unit would add to the rudder pedal

force. As a pilot applied force to a rudder pedal in opposition to the jam/reversal, the first

inch of movement of the pedal would cause the PCU input crank to move to the PCU

manifold body stop. After the PCU input crank contacts the manifold body stop,

approximately 300 additional pounds of pilot rudder pedal force would be required to

move the rudder pedal each additional 1 inch of travel until the rudder pedal contacts the

forward quadrant stops. Pilot rudder pedal force in opposition to a jammed/reversing

rudder malfunction would reduce the deflection of the rudder. 

The 737 rudder trim system allows the pilots to command a steady rudder input

without maintaining foot pressure on the rudder pedals. The primary purpose for rudder

trim is to compensate for the sustained large yawing moments generated by asymmetric

thrust in an engine-out situation. Pilots also sometimes use a small amount of rudder trim

during normal flight to compensate for slight yawing moment asymmetries, such as those

caused by flight control and engine rigging imperfections. To trim the rudder on the

737-300, -400, and -500, the pilot uses an electrical trim motor activated by the trim

switch located on the flight deck center pedestal. The rudder trim switch activates an

electric rudder trim actuator (located near the aft control torque tube in the vertical fin)

that rotates the feel and centering unit, thus changing the neutral, or zero, position of the

rudder.56 The 737-300 electric rudder trim moves the rudder at a rate of about 0.5° per

55 USAF ergonomic studies indicate that the maximum rudder pedal force pilots can exert on the rudder

pedals is about 500 pounds. For additional information regarding pilot rudder pedal force, see sections

1.16.6 and 1.18.8.
Factual Information 27 Aircraft Accident Report

second to the desired rudder trim deflection; maximum rudder trim authority is ± 16°.

According to USAir’s 737-300 Pilot’s Handbook, when the rudder trim is used, the rudder

pedals are displaced proportionately. 

The 737 yaw damper system improves ride comfort by sensing turbulence- or

airplane-generated yaw motion and countering the yaw with rudder surface movement.

The system is initially activated by the yaw damper switch on the overhead panel in the

cockpit and is continuously engaged during normal operations; all inputs are automatic

and require no pilot action. The yaw damper system comprises the yaw damper control

switch and a yaw damper coupler, which includes a rate gyro that senses airplane motion

about the yaw axis and converts the motion to an electrical signal that is sent to the main

rudder PCU. An electrohydraulic servo valve (or transfer valve) converts the electrical

signal from the yaw damper coupler to PCU motion by directing hydraulic fluid from

hydraulic system B to move the rudder left or right. The yaw damper system also includes

a cockpit indicator of yaw damper activity. 

In the 737-300 series, the yaw damper can command up to 3° of rudder surface

deflection in either direction at a rate of 50° per second (when correctly assembled/

rigged).57 Rudder movements that result from yaw damper system inputs do not move the

rudder pedals.

Figure 7 shows the main rudder PCU. Figure 8 shows the main rudder PCU

schematic and installation. Figure 9 depicts the rudder, rudder trim, and yaw damper

authority limits.

56 To trim the rudder on the 737-100 and -200, the flight crew turns a knob on the flight deck center

pedestal that is mechanically connected to the rudder trim actuator.

57 The 737-300 yaw damper was initially designed with ± 30° of rudder authority. The -100 and -200

series airplanes’ yaw dampers were designed to command either ± 2 or ± 4° of rudder authority. Boeing

indicated that units permitting ± 2, 3, or 4° of rudder deflection may be used interchangeably on 737-100 and

-200 series airplanes, and units permitting ± 2 or ± 3° of rudder deflection may be used interchangeably on

737s in the -300, -400, and -500 series. For information regarding rigging of the yaw damper linear variable

displacement transducer (LVDT), see section 1.16.1.2.

Figure 7. Boeing 737 main rudder PCU.

Servo Control Valve

Yaw Dam per LVD T
Factual Information 28 Aircraft Accident Report

Figure 8. Boeing 737 main rudder PCU schematic and installation.

Primary

Summing

Lever

Yaw Dam per

Actuator Com pensator

Secondary 

Summing 

Lever

Com pensator

Spring

Electrical 

Connector

Yaw Dam per

Position

Transm itter

Transfer Valve

Caging 

Spring

Yaw Dam per

Shutoff Valve

Primary 

Valve

Secondary 

Valve

Input 

Shaft

Internal 

Input 

Crank

Dual 

Concentric

Servo Valve

To Vertical Fin

R A

PA

A System - Off

B System - On

To Rudder

Tander

Actuator

Bypass

Valve

Power

Unit

Torque 

Tube

System A 

Input

Return System B

Input

Rudder

Hinge Line

External

Summing 

Lever

Input 

Crank

Forward (External)
Factual Information 29 Aircraft Accident Report

Figure 9. Boeing 737-300, -400 and -500 rudder, rudder trim, and 

yaw damper authority limits.

Note: The maximum 737 rudder deflection that the yaw damper can command is only a

small portion of the total rudder travel. Yaw damper limits of the 737-100 and -200 can be

2, 3, or 4°, depending upon the installation.
Factual Information 30 Aircraft Accident Report

1.6.3.2.1 Main Rudder PCU and Servo Valve

The main rudder PCU is powered by hydraulic systems A and B, each of which

provides about 3,000 pounds of output force to move the rudder, for a total output force of

about 6,000 pounds. The main rudder PCU operates by converting either a mechanical

input from the rudder pedals or an electrical signal from the yaw damper system into

motion of the rudder by means of mechanical linkages (summing levers, input cranks, and

shafts) and a servo valve that directs hydraulic fluid either to extend or retract the PCU

actuator rod that moves the hinged rudder surface.

The body of the main rudder PCU is attached to the airplane vertical fin structure,

and the actuating rod is attached to the rudder. The PCU moves the rudder right or left

when actuated by rudder pedal or trim input or signals from the yaw damper. Rudder pedal

and trim input are transmitted to the PCU’s external input crank through an external

summing lever and linkage. The external input crank is also moved by feedback from

motion of the rudder, which comes from a mechanical system linkage (see figure 8). The

input shaft rotates, actuating the internal summing levers and moving the primary and

secondary slides of the servo valve. 

The 737 main PCU servo valve was designed by Boeing and is manufactured to

Boeing specifications by Parker Hannifin Corporation. It is a dual-concentric tandem

valve composed of a primary slide that moves within a secondary slide that, in turn, moves

within the servo valve housing. The primary and secondary concentric slides are moved

by primary and secondary internal summing levers, which translate inputs from the yaw

damper58 and/or the external input crank (which moves when a pilot steps on the rudder

pedals) into axial movement of the slides. Figure 10 shows an expanded view of the servo

valve.

 When rudder motion is commanded (by the yaw damper, rudder pedal input, and/or

rudder trim), the internal input shaft moves the servo valve slides through the internal

summing levers to connects hydraulic pressure and return circuits from hydraulic systems

A and B so that hydraulic pressure is ported to the appropriate sides of the dual-tandem

actuator piston to extend or retract59 the main rudder PCU piston rod. At the same time,

fluid is directed from the other side of the piston to the hydraulic return system. As the

58 When the yaw damper solenoid control valve is energized, 3,000 psi of hydraulic pressure is applied

to the transfer valve, which proportionally converts electrical signals from the yaw damper coupler into

hydraulic flow and control pressure. The control pressure moves the yaw damper actuator assembly piston

(mod piston), which moves the pivot point of the internal summing levers. The internal summing levers

move the primary and secondary slides of the servo valve from neutral, which causes movement of the

pistons in the actuator assembly. Movement of the yaw damper actuator piston generates a balancing signal

by the LVDT, which assists in returning the transfer valve to the neutral position. Feedback, provided

through the external summing lever and linkage, returns the slides of the servo valve to near neutral, which

maintains hydraulic pressure to hold the actuator position against the air load while not commanding further

motion. 

59 When the actuator moves in the extend direction, it commands left rudder; when it moves in the

retract direction, it commands right rudder.
Factual Information 31 Aircraft Accident Report

rudder reaches the commanded deflection, external linkages reposition the servo valve’s

internal summing levers to nullify the initial command signal and arrest further motion. 

During normal operation, the primary summing lever applies force to move the

primary slide, and the secondary summing lever applies force to move the secondary slide

as needed. The primary slide is normally displaced first, and the secondary slide is

displaced only when the primary slide does not provide enough hydraulic flow to keep up

with the input commanded by the pilots or the yaw damper (that is, when the movement of

only the primary slide is not sufficient to move the rudder at the commanded rate). The

normal maximum axial movement from the neutral positions to the extreme travel

positions in either the extend or retract directions is about 0.045 inch for both the primary

and secondary slides, for a combined distance of about 0.090 inch. Both the primary and

secondary slides are designed so that they can move about 0.018 inch axially beyond their

normal operating range (overtravel capability). 

The two slides are designed to provide approximately equal flow. Thus, the

primary slide alone can provide a rudder rate of about 33° per second, and the primary and

secondary slides together can provide a rudder rate of about 66° per second (under zero

aerodynamic load conditions). 

The outside diameter surfaces of the primary and secondary slides are composed

of Nitralloy 135 that, in its prefinished form (slightly larger in diameter than its finished

form), is nitrided60 to a depth from 0.005 to 0.008 inch to a surface hardness of 55 to 58 on

Figure 10. Boeing 737 main rudder PCU servo valve.

60 Nitriding is a process in which the surface of the part is impregnated with nitrogen to increase

hardness.

Primary 

slide

Secondary 

slide

Servo valve

housing
Factual Information 32 Aircraft Accident Report

the Hardness Rockwell C (HRC) scale. The inside surfaces of the secondary slide and the

servo valve housing are made of 52100 hardened steel (surface hardness 57 to 62 on the

HRC scale). The outside diameter surfaces of the primary slide are very close to the inside

diameter surfaces of the secondary slide, and the outside diameter surfaces of the

secondary slide are very close to the inside diameter surfaces of the servo valve housing.

In a March 18, 1999, letter, Parker advised the Safety Board that two engineering

documents from 1966,61 which were produced during prototype testing of the servo valve,

revealed that dimensional changes were made to the prototype because of conditions and

performance results observed during the initial testing. According to the letter, a

March 11, 1966, Parker engineering order modified certain dimensions in the servo valve

slightly to “insure accumulated tolerances will not cause reverse flow.” Additionally, the

letter stated that a December 9, 1966, Parker engineering order indicated that other

modifications were made “to preclude bottoming of [the] secondary slide at the detent at

the max[imum] tolerance stackup.” According to the letter, after the dimensional changes

were incorporated into the prototype servo valve’s design, it passed the acceptance test

procedure, and no further flow problems were noted. Parker personnel stated that no servo

valves with the original prototype dimensions were provided to customers. The letter

further stated, “as we can best determine, ‘reverse flow’ was used to refer to cross-flow or

higher internal leakage in the servo valve than is desirable...but had nothing to do with

reversal in the dual concentric servo valve” and indicated that “the reversal phenomenon

in the servo valve...was first seen in the 1992 examination of the...United Airlines

Boeing 737 rudder power control unit [which resulted from a July 16, 1992, anomaly

found during a ground check, as discussed later in this section and in more detail in

sections 1.16.1.1 and 1.18.1.1]—rudder or servo valve reversal was not an issue

recognized at the time of the 1966 Engineering Orders.” 

Before 1989, the servo valve assembly engineering drawings did not specify

diametrical clearances between the primary and secondary slides or between the

secondary slide and servo valve housing. However, “shop travelers” (manufacturing

documents that include instructions for specific tasks) used before 1989 indicated that the

minimum and maximum clearances were 0.00010 and 0.00015 inch, respectively. On

March 14, 1989, Parker released an engineering order that amended the servo valve

assembly drawings to specify minimum and maximum diametrical clearances of 0.00015

and 0.00020 inch, respectively, between the outside diameter of the secondary slide and

the inside diameter of the servo valve housing assembly and between the outside diameter

of the primary slide and the inner diameter of the secondary slide assembly.

According to Parker, the engineering drawing clearances normally allow the servo

valve assembly to pass the functional testing that is part of the acceptance test procedure,

and the servo valve components may then be individually polished based on functional

test results to obtain the proper ease of movement. Because of the variability in

dimensions of individual servo valve primary and secondary slides and the tight

61 These documents were located by Parker in response to requests made in the context of litigation

resulting from the USAir flight 427 accident.
Factual Information 33 Aircraft Accident Report

clearances required by the design, the servo valve components are assembled, installed,

and maintained as matched sets.

Before 1992, the acceptance test procedure for the servo valve assembly was based

on compliance with performance standards. (According to Parker, each valve was to be

“trimmed”62 until the desired functional performance was obtained.) Actual travel (or

overtravel) capability of the primary and secondary slides had not been measured. In

1992, as a result of findings from the main rudder PCU anomaly found during a July 1992

United Airlines ground check, Boeing established maximum axial distances between

metering edges for both the primary and secondary slides, and Parker instituted a

functional test. In addition, the FAA issued AD 94-01-07, effective March 3, 1994, which

required operators to test 737 main rudder PCUs at 750-hour intervals for internal

hydraulic fluid leakage until they are replaced with new PCUs containing servo valves

designed to prevent secondary slide overtravel. (For additional information regarding this

part of AD 94-01-07, see section 1.18.5 and appendix C.)

In addition to the functional testing performed on each individual main rudder

PCU servo valve, one valve was subjected to qualification testing at the time of the 737’s

initial certification.63 The purpose of this qualification testing was to ensure that the servo

valve would be able to withstand the operational and environmental stresses expected

during its life. 

1.7 Meteorological Information 

The official PIT hourly weather observation taken at 1852 stated:

sky condition—clear, visibility—5 miles, temperature—73o Fahrenheit (F), dew

point—1o F, wind—250o

 at 7 knots, altimeter setting—30.10 inches Hg [mercury],

remarks—few cumulus cirrus.

A PIT special weather observation taken at 1932 stated: 

sky condition—clear, visibility—15 miles, wind—240° at 6 knots, altimeter setting—

30.10 inches Hg; remarks—few cumulus cirrus.

The PIT hourly weather observation taken at 1952 stated: 

sky condition—clear, visibility—15 miles, temperature—69° F, dew point—54° F,

wind—240° at 5 knots, altimeter setting—30.10 inches Hg.

62 Trimming is the machine grinding of the outside diameter/groove interface that forms the metering

edges for the primary and secondary slides. Trimming moves the metering edges to new longitudinal

positions to better align the metering edges with the metering ports to meet functional test requirements.

63 The qualification testing involved functional and environmental testing (including pressure, vibration,

and thermal testing) under conditions that replicated assumed operating conditions (based on Boeing’s

analyses). The redesigned servo valve being retrofitted on earlier 737 series airplanes and installed on the

737-NG series airplanes (see section 1.18.5) also underwent qualification testing, and those tests included

conditions that exceeded the assumed operating conditions (including thermal conditions that simulated an

overheated hydraulic system) to evaluate the component’s functional limits.
Factual Information 34 Aircraft Accident Report

The PIT Weather Service Forecast Office (WSFO) is located about 2 miles northnorthwest of PIT and about 6 miles southeast of the accident site. A Weather Surveillance

Radar-88 Doppler (WSR-88D) is installed at that location. (At the time of the accident, the

WSR-88D was operational but had not been officially commissioned.) The WSR-88D

base reflectivity products64 provided to the WSFO for the times of 1859 and 1905

indicated random radar returns in the PIT area. According to PIT WSFO personnel, those

returns were consistent with the local ground clutter pattern around the radar. No primary

radar returns were noted in the vicinity of the accident airplane. Some witnesses reported

that they observed large flocks of migrating birds and geese in the area the afternoon and

evening before the accident. However, radar data revealed no evidence of such activity in

the vicinity of the accident site at the time of the accident. 

According to measurements transmitted by a radiosonde balloon65 launched by the

PIT WSFO at 1914, the winds near 6,000 feet msl were from 274° at 15 knots, and the

temperature at that altitude was about 47° F. The wind gust recorder at PIT indicated that

wind speeds at the surface varied from 6 to 8 knots between 1840 to 1940. (Wind directions

were not recorded by the wind gust recorder.) 

According to sunrise and sunset tables, on September 8, 1994, at 1903 at the accident

location, the altitude of the sun above the horizon was approximately 7.9°. The magnetic

bearing from the accident location to the sun was about 278.7°. Sunset at 6,000 feet occurred

about 1949.

During postaccident interviews, witnesses on the ground reported that the weather

was clear and sunny at the time of the accident, and the winds were calm near the accident

site. Pilots of other airplanes that were operating in the vicinity of PIT about the time of

the accident were also interviewed. They reported that the sky was clear with unlimited

visibility and that the air was smooth with light winds and no turbulence. The captain of

Delta flight 1083, which was sequenced ahead of the accident flight on the approach,

stated that the horizon was clearly defined and that visibility was not restricted.

1.8 Aids to Navigation

No difficulties with the navigational aids were known or reported.

1.9 Communications

No difficulties with communications were known or reported.

64 Base reflectivity products display weather echo intensity and are used to detect precipitation. 

65 A radiosonde balloon is an instrument used for the simultaneous measurement and transmission of

meteorological data. The PIT WSFO launches two radiosonde balloons about 0700 and 1900 every day.
Factual Information 35 Aircraft Accident Report

1.10 Airport Information

PIT is located 15 miles northwest of the city of Pittsburgh. The airport elevation is

1,203 feet. The airport has four runways. Flight 427 was scheduled to land on runway

28R, which is 10,502 feet long and 150 feet wide. No significant Notices to Airmen were

in effect for PIT during the time period in which USAir flight 427 was estimated to arrive.

1.11 Flight Recorders

The two flight recorders installed on the accident airplane were removed from the

wreckage and sent to the Safety Board’s laboratory in Washington, D.C., for readout. 

1.11.1 Cockpit Voice Recorder

The CVR installed on the accident airplane was a Fairchild model A-100A.66 The

CVR recording consisted of four channels of audio information: the cockpit area

microphone (CAM), the captain position, the first officer position, and the jumpseat/

observer position.67 Although the CVR unit showed evidence of external and internal

structural damage, the recording medium (magnetic tape) was in good condition, and the

quality of the recording was excellent.68 A transcript was prepared of the entire 30-minute

56-second recording. A copy of the CVR transcript appears in appendix B. 

1.11.2 Flight Data Recorder

The FDR was a Loral/Fairchild Data Systems model F1000 (S/N 442), which

recorded 13 parameters69 of airplane flight information using solid-state nonvolatile flash

memory as the recording medium. Although the FDR exhibited external and internal

impact damage, the crash-protected memory module unit and recording medium were

66 The CVR identification plate and S/N were missing; however, USAir maintenance records indicate

that the CVR on the accident airplane was S/N 5061. 

67 The audio obtained from the jumpseat/observer channel was of a lower intensity and sounded more

“hollow” than that obtained from the CAM. Further investigation revealed that similar audio information

was obtained in a 737 airplane in which the microphone selector switch at the jumpseat/observer position

was left in the oxygen mask position and the oxygen mask was stowed correctly in its formed plastic sleeve.

68 The Safety Board uses the following categories to classify the levels of CVR recording quality:

excellent, good, fair, poor, and unusable. An excellent recording is one in which virtually all of the crew

conversations can be accurately and easily understood. The transcript that is developed from the recording

may indicate only one or two words that were not intelligible, usually because of simultaneous cockpit/radio

transmissions that obscured each other.

69 Title 14 CFR Section 121.343 required that, by May 26, 1995, large airplanes type certificated before

October 1, 1969 (which included the accident airplane), be equipped with FDRs that record 11 parameters.

The regulations also required that airplanes type certificated after October 1, 1969, and airplanes

manufactured after May 26, 1989, be equipped with FDRs that record 17 parameters. Additionally, the

regulations required that airplanes manufactured after October 11, 1991, be equipped with FDRs that record

31 parameters. Even though the accident airplane’s FDR recorded 13 parameters, it has often been referred

to as an 11-parameter recorder because it was not required by 14 CFR Section 121.343 to record the engine

EGT and fuel flow parameters. 
Factual Information 36 Aircraft Accident Report

intact and yielded good data. Recorded parameters that were sampled at once-per-second

intervals were altitude, indicated airspeed, heading, microphone keying, exhaust gas

temperature (EGT, both engines), fuel flow (both engines), compressor speed (N2,

measured as a percentage, for both engines), and fan speed (N1, measured as a percentage,

for both engines). Recorded parameters that were sampled at more frequent rates were roll

attitude and control column position (two times per second), pitch attitude and

longitudinal acceleration (four times per second), and vertical acceleration (eight times per

second). The FDR did not record data regarding the flight control surface positions, and

Federal regulations (14 CFR Section 121.343) did not include a requirement to record

such data. (See section 1.18.11.4 for information about Safety Board recommendations

regarding FDRs.)

1.12 Wreckage and Impact Information

1.12.1 On-Site Examination

The on-site phase of the investigation, including examination, documentation,

decontamination, and recovery of the wreckage, occurred between September 9 and

September 20, 1994. 

The accident airplane’s primary impact point was in a densely wooded area on an

up-sloping hillside on the south side of a dirt road that was oriented southwest/northeast and

accessed three houses. The airplane wreckage was severely fragmented, crushed, and

burned, and some sections had been destroyed or nearly destroyed by fire. Because some

portions of the wreckage were not visible above the ground, investigative personnel used

ground-penetrating radar (GPR) to locate and recover additional pieces of the wreckage.

(See section 1.19 for details about the use of GPR.) Some pieces of wreckage were

excavated from the hillside at depths of up to 8 feet. Most of the airplane wreckage,

including all flight controls and major components, was located within a 350-foot radius of

the main impact crater. 

The left wing and the No. 1 engine, which were located south of the access road

and east of the main impact crater, exhibited severe impact and postimpact fire damage.

The No. 1 engine was separated from the left wing and partially covered by burned left

wing skin and spar materials. A ground scar, about 25 feet in length, extended in an

easterly direction from the No. 1 engine and left wing wreckage on an up-sloping hill. The

outboard end of the ground scar contained several small pieces of red glass, and portions

of the left wing tip were located nearby. Trees located near the ground scar and the left

wing had broken limbs and branches. 

The right wing, which was located along the northern edge of the access road

about 40 feet west of the main impact crater, also exhibited severe impact damage. The

No. 2 engine was separated from the right wing and located along the northern edge of the

access road about 30 feet west of the main impact crater. Sections of the right wing were

found on the north side of the access road and the adjacent hillside, and the inboard section
Factual Information 37 Aircraft Accident Report

of the wing was facing in the northeast direction. The remaining leading edges of both

wings were crushed in an aft and up direction.

Examination of the spoiler control surfaces and actuators revealed that the four wing

spoilers were located in the retracted position at impact with no evidence of preimpact

failure. Examination of the Krueger (leading edge) flaps and leading edge slats indicated that

they were extended symmetrically at impact with no evidence of preimpact failure of the

flaps; slats; and their attachments, rollers, or tracks.70 The trailing edge flaps were in a

partially extended symmetrical position. Jackscrew and hydraulic actuator measurements

indicated that the leading and trailing edge devices were positioned consistent with a flaps 1

setting. The trailing edge flaps exhibited compression damage and postimpact fire damage.

No evidence was found of structural fatigue or preimpact fire on the trailing edge flaps or

flap tracks. The wing spoilers were fractured and exhibited fire damage. The landing gear

were found in the retracted position. 

Both engines were found fragmented, burned, and separated from their respective

pylons. The pylons, nacelles, and thrust reverser components from both engines were

fragmented and scattered around the impact crater. Examination of the engines, nacelles, and

pylons revealed damage that was consistent with engine low- and high- pressure rotors

rotating at impact.71

Fragments of engine thrust reverser components (including the cascades, hinges,

latches, cowls, and bulkhead) and the 12 thrust reverser actuators72 were located, identified,

and examined. All thrust reverser components exhibited damage consistent with ground

impact and exposure to heat. Examination of the thrust reverser actuators indicated that the

left engine thrust reverser locking actuators were in the stowed position at impact; however,

the right engine thrust reverser locking actuators were discovered in the extended position.

(Three of the four left engine nonlocking thrust reverser actuators and all four right engine

nonlocking thrust reverser actuators were in the stowed position.) The four locking thrust

reverser actuators were removed from the main wreckage for further inspection and

disassembly. Subsequent x-ray inspection and disassembly of the four thrust reverser

locking actuators indicated that all four locking actuator pistons were in the stowed position,

with locking keys engaged, at impact. 

The airplane’s tail section was located in an inverted position near the north edge

of the access road, about 20 feet west of the left wing. The horizontal stabilizers and

elevators remained attached to the tail section. The outboard trailing edge of the right

70 Because of unusual damage observed on the inboard hinge of the No. 1 slat, the Safety Board

conducted ultraviolet light and metallurgical inspections of components of the slat track. For additional

information regarding these inspections, see section 1.12.3.

71 FDR data indicated that the engines were operating normally and symmetrically until ground impact.

However, the CVR and physical evidence indicated that the auxiliary power unit (APU) was not operating

up to ground impact.

72 Six thrust reverser actuators, two locking and four nonlocking, were located on each of the two

engines. The locking actuators are designed to prevent thrust reverser deployment without the application of

hydraulic pressure. 
Factual Information 38 Aircraft Accident Report

horizontal stabilizer and the right elevator exhibited heat, smoke, and soot damage

patterns consistent with postimpact fire. The outboard 5 feet of the leading edge of the left

horizontal stabilizer was destroyed. The inboard 7 feet of the left horizontal stabilizer,

adjacent to the auxiliary power unit (APU) access door, was crushed 5 feet in the aft

direction, exposing the internal spars and ribs. Both elevators were attached at their

respective horizontal stabilizers, and flight control continuity was established within the

tail section. The elevator tab rods were connected and operated properly (that is, elevator

"up"/tab "down," and vice versa). Both elevator balance weights were attached, and the

elevator neutral shift rods were attached to the stabilizer and the elevator centering unit.

The elevators were positioned about 14° trailing edge up, and the horizontal stabilizer was

in an intermediate position.

The vertical stabilizer and rudder were located adjacent to the tail section. The

vertical stabilizer was resting on its left side with the lower portion of the vertical fin

adjacent to the horizontal stabilizer. The leading edge of the vertical stabilizer skin was

destroyed, and the exposed vertical webs were crushed in the upward and aft direction. The

vertical stabilizer aft of the rear spar sustained fire damage, and an 11- by 4-foot area, about

61⁄2 feet from the base of the vertical stabilizer, was consumed by fire. The rudder had a

10-foot, 3-inch area, about 61⁄2 feet from the base of the rudder hinge, of burned and

missing structure. A bend in the PCU actuator rod was consistent with a rudder position of

about 2° to the right (airplane nose right).

The cockpit, which was found approximately 45 feet south of the main impact crater,

was severely fragmented. The identified sections of the cockpit and the forward portion of

the fuselage exhibited compression damage, deformation along the airplane's longitudinal

axis, and some postimpact fire damage. Although sections of the seat tracks for both pilots

were identified, it was not possible to determine either seat position at impact.73 The left

rudder pedal shafts were sheared at both pilot positions; both right rudder pedals exhibited

bending but were not sheared.74 Cockpit instrumentation and switches that were identified

included a radio magnetic indicator, two airspeed indicator digital displays, the autopilot

MCP, ground proximity warning system (GPWS) switch, and an FD switch. The radio

magnetic indicator showed 212°, the airspeed displays indicated 264 knots, and the GPWS

and FD switches were in the “on” position; damage to the autopilot MCP precluded a

determination of the preimpact mode selections. 

A ground and helicopter search for additional airplane components was conducted

during the on-site phase of the investigation, but no additional components were found.

Several light-weight items (for example, pieces of interior insulation and a passenger

business card) were discovered as far as 21⁄2 miles east-northeast of the main wreckage;

these items exhibited soot and smoke damage. One witness stated that he heard the sound

of the crash while he was playing golf about 2 miles east-northeast of the accident site;

about 2 minutes later, he observed blackened insulation falling onto the golf course. The

insulation, business card, and sections of the airplane’s cargo liner were sent to

73 Pilot seat position is discussed further in section 1.18.8. 

74 The rudder pedal assemblies were retained for further examination, as described in section 1.16.5.1. 
Factual Information 39 Aircraft Accident Report

Safety Board and Federal Bureau of Investigation (FBI) laboratories for examination,

which revealed no evidence of explosive residue.

Before removal from the accident site, the wreckage was thoroughly examined,

components were identified and photographed, and critical measurements were recorded.

Also, fire and explosives experts examined pieces of the wreckage for evidence of

preimpact fire and/or explosion, and no such evidence was found. After the airplane

wreckage was documented and decontaminated, it was relocated from the accident site to

a hangar facility at PIT for further examination and a two-dimensional reconstruction.

Except for certain components and control cables that were retained for further

examination,75 the airplane wreckage was released to USAir on April 3, 1995. 

1.12.2 Reconstruction Examination

Between October 30 and November 11, 1994, the Safety Board conducted a twodimensional reconstruction of the wings and the fuselage, including the forward pressure

bulkhead, floor beams, wheels and tires, wheel wells, auxiliary fuel tank, and roll control

cables. The reconstruction was accomplished to determine whether a control cable failure,

bird (or other airborne object) strike, floor beam failure, or in-flight explosion were

involved in the accident. 

Because of its experience in reconstructing the Boeing 747 airplane involved in the

Pan American World Airways flight 103 in-flight explosion and crash that occurred near

Lockerbie, Scotland,76 the Air Accidents Investigation Branch (AAIB) of Farnborough,

England, was asked to and did participate in the effort to reconstruct the USAir flight 427

accident airplane. The AAIB representatives stated that the destruction and fire damage

(which they considered “extreme for that associated with civil aircraft accidents”)

complicated efforts to identify components and reconstruct the airplane. Despite the

complications, the AAIB found no evidence of any preimpact explosion. The wreckage was

further examined by explosion experts from the FAA and the FBI, and they also found no

evidence of any preimpact explosion.

With the use of Boeing drawings, Safety Board investigators identified pieces of

the fuselage and wings, and the pieces were positioned on the hangar floor according to

their structural station locations. Numerous pieces of the lower forward fuselage and

sections of the wing were too small, fragmented, or severely damaged by postimpact fire

to be identified. The lateral and longitudinal floor beam structures were severely

fragmented. The amount of identifiable lateral floor beam structure varied at each fuselage

station, with a minimum of 5 percent identified forward of the center wing section and a

maximum of about 95 percent identified at the rear galley/lavatory. Overall, about

50 percent of the floor beams (lateral and longitudinal, forward and aft) were recovered

and identified for use in the reconstruction. 

75 For additional information on the retained items, see section 1.12.2.1. 

76 See Air Accidents Investigation Branch. 1990. “Report on the accident to Boeing 747-121, N739PA,

at Lockerbie, Dumfriesshire, Scotland on 21 December 1988.” Aircraft Accident Report 2/90. 
Factual Information 40 Aircraft Accident Report

No sections of the forward galley or the forward lavatory floor structure were

identified. The aft galley floor panel was charred, and the attached seat tracks exhibited

fire and heat damage; however, the floor beams that supported the aft galley exhibited no

signs of fire or heat damage. The floor of the lavatory in the aft cabin was charred, and the

attached forward and aft floor beams displayed evidence of peeled paint and sooting.

The identifiable sections of passenger cabin and cockpit structure exhibited no

evidence of streaking or burns that would be consistent with preimpact fire or explosion.

No evidence of streaking or burned/sooted structure was found on the interior or exterior

surfaces of cabin and cockpit materials. 

Portions of all of the doors and their respective frames were identified and

documented. These doors included the forward entry, forward service, aft entry, aft galley

service, forward cargo, rear cargo, lower nose compartment access, electrical/electronic

compartment (E/E bay), overwing emergency exit, and APU service doors. The majority

of structure identified in the forward fuselage was located near the fuselage doorways. The

doors forward of the wing were the most severely fragmented. The examination of the

remains of the doors, door frames, and locking mechanisms revealed witness marks and

other evidence that was consistent with all of the doors being in the closed position at

impact.

The wing center section and the main landing gear wheel wells were severely

fragmented and exhibited minimal fire damage. Approximately 60 percent of the center

section wing structure was positively identified. Examination of the reconstruction

confirmed that the landing gear were in the retracted position at impact. No evidence of

preimpact failures or fire in the wheel wells before impact was found. The examination of

the tires and wheels revealed no evidence of a tire explosion or fire damage before impact. 

1.12.2.1 Flight Control System Components 

During the wreckage reconstruction, flight control system components were

examined and separated by location and system function. The following flight control

system items were removed from the wreckage for further examination: the main rudder

PCU, standby rudder PCU, rudder trim actuator, rudder feel and centering unit, aileron

PCUs, spoiler mixer and ratio changer, flight and ground spoiler actuators, slat control

valve, autopilot servos, various autopilot electrical relays, both pilots’ rudder pedal and

control yoke systems, and most of the control cables. In addition, hydraulic fluid samples

were obtained from various locations in the accident airplane’s hydraulic systems for

laboratory evaluation and analysis. (See section 1.16.5.4.3 for further information.) 

The aft rudder control quadrant was found attached to its mounting bracket and

separated from the vertical stabilizer. The aft rudder control quadrant input rod, the main

rudder PCU input rod, and the lower end of the rudder torque tube (see figures 6 and 6a)

were fractured, and the cable attach points were separated from the quadrant on each end.

The upper portion of the tower shaft was located at the vertical fin with the main and

standby rudder PCUs attached. The input rod for the standby PCU remained attached with

no signs of damage or binding.
Factual Information 41 Aircraft Accident Report

The broken ends of all identified flight control cables, and several unidentified

cable sections, were inspected at 10-power magnification to determine their mode of

failure. The examination revealed no evidence of preimpact cable failure. Measurements

of the broken aileron cable sections and pulley positions indicated a right control wheel

input at impact. 

Safety Board investigators identified about 60 percent of the rudder control cable

length for the right-side cable and about 20 percent of the rudder control cable length for

the left-side cable. Both right- and left-side cables were kinked about every 20 inches (the

approximate distance between floor beam locations), and both cables exhibited multiple

breaks at the turnbuckle locations. Some recovered and identified cables were sent to the

Safety Board materials laboratory for metallurgical examination, which revealed that the

cable breaks resulted from tensile overload. No evidence of preimpact failure of the rudder

cables was found.

1.12.2.2 Examination/Reconstruction of Cargo Compartments 

Identified sections of the forward and aft cargo compartments were examined for

evidence of preimpact fire or explosion. One section of aluminum flooring from the

forward cargo compartment exhibited sooting on the lower side, but no evidence of fire,

heat, or soot damage was found on the upper (inner) floor surface. Neither of the two

cargo compartment pressure relief/emergency access panels (which form a section of the

cargo compartment ceiling liner in the forward and aft compartments) displayed fire

damage on either side. No evidence of fire damage or soot was found on either the aft

cargo door or the recovered pieces of the forward cargo door. In addition, the forward

outflow valve showed no evidence of soot deposits. Pieces of cargo compartment liner

exhibited evidence of smoke and fire damage that was consistent with a postimpact fire. 

1.12.2.3 Examination/Reconstruction of the Auxiliary Fuel Tank

Safety Board investigators examined the recovered pieces of the auxiliary fuel

tank system for evidence of preimpact fire, explosion, corrosion, or structural failure.

Investigators identified about 85 percent of the auxiliary tank fuel control valve box

components and fuel transfer/vent hoses and fittings, about 50 percent of the electrical

control box components, and about 40 percent of the auxiliary fuel tank structure. The

identified sections of the auxiliary fuel tank included portions of the upper panel

(including a 5-inch portion of the forward upper seam), the center and lower portions of

the forward panel, center and lower portions of the aft panel, side angle panels, and sump

drain doubler from the lower panel. The compression beams located at the aft pressure

bulkhead were the only pieces of auxiliary fuel tank support structure that were identified.

Although a small section of the forward tank panel displayed fire damage, identified

mating sections of the tank structure contained no evidence of heat or fire damage. Further

examination of the auxiliary fuel tank panels and support structure revealed no additional

evidence of heat or fire damage. 

 The auxiliary fuel tank components (valves, screens, filters, and motors) did not

exhibit any abnormal characteristics, and the auxiliary fuel tank valve positions were
Factual Information 42 Aircraft Accident Report

consistent with a deactivated fuel tank.77 The auxiliary fuel tank pressure relief valve was

found intact. Postaccident pressure and leak tests revealed that the relief valve opened at

9 psi; the valve is designed to open at 10 ± 1 psi. The bleed air filter exhibited no evidence

of internal or external contamination and no odor of fuel. 

Examination of the identified fuel lines and hoses revealed varying amounts of

heat and fire damage. For example, the portion of steel braid-covered fuel hose that

extended forward from the auxiliary fuel tank to the bulkhead at body station 727 showed

no evidence of heat or fire damage. However, the steel braid-covered fuel hose that

extended forward from the body station 727 bulkhead to the wing center section exhibited

severe heat and fire damage; only the end fittings and steel braid remained intact. One

portion of the wing center section structure, installed 4 feet away from the charred portion,

exhibited severe charring; however, the center section structure exhibited no evidence of

heat or fire damage. The fuel hose assembly contained in the airplane’s center fuel tank

exhibited heat exposure and burned hose rubber; however, the crossfeed line (external to

the center fuel tank) was not charred. 

1.12.3 Examination of Wreckage for Indications 

of Possible Bird Strike

Because of witness reports that large flocks of migratory birds were observed in

the Pittsburgh area throughout the afternoon and evening of the accident,78 the Safety

Board examined the wreckage for indications of a possible bird strike. Ultraviolet light, a

method commonly used for detecting blood,79 was used to examine several pieces of the

radome, portions of the forward pressure bulkhead, left wing slats, cockpit flight control

components, and leading edges of the vertical and horizontal stabilizers for bird remains. 

Although no evidence of bird stains, remains, or other organic matter was found on

most of the examined areas, investigators noted a small (10- by 5-inch chordwise) stain on

the outer surface of the outboard No. 1 slat. A 3- by 5-inch section of the stain, located in

the upper external portion aft of the leading edge of the slat and oriented in a spanwise

direction, exhibited a more intense white fluorescence when illuminated by ultraviolet

light. The stained area was adjacent to fractured segments of the No. 1 outboard slat track.

Two small samples of the fluorescent debris were removed from the slat surface and the

adjacent interior slat cavity. The samples were examined by an ornithologist at the

77 According to USAir’s maintenance procedures, after auxiliary fuel tank deactivation, the fuel transfer

valve and the fuel fill valve should be in the closed position, with the fuel fill valve circuit breaker in the

cockpit pulled and collared to ensure that the valve remains closed (unless intentionally reactivated). The

auxiliary fuel tank bleed air circuit breaker (which controls the bleed air solenoid valve) is also pulled during

the deactivation process. The fuel fill valve and auxiliary fuel tank bleed air circuit breakers were not located

in the wreckage.

78 No such observations were reported in official weather observations, by pilots of other airplanes in the

area, or in WSR-88D data.

79 According to an Armed Forces Institute of Pathology (AFIP) laboratory report on its examination of a

portion of the accident airplane’s left wing, biological material can fluoresce when viewed under an

ultraviolet light of the appropriate wavelength.
Factual Information 43 Aircraft Accident Report

Smithsonian Institution’s Associate Division of Birds, who determined that the debris

exhibited no characteristics that resembled those of a bird.

The outboard No. 1 slat was also examined by specialists from the Armed Forces

Institute of Pathology (AFIP). According to the AFIP laboratory report, the pieces of

debris were inspected using an Omnichrome Alternate Light Source unit (all wavelength

spectrums and all optical filters), a Luminol solution, and Leucomalachite Green solution.

The AFIP report stated that none of the inspection techniques revealed any luminescence

that would indicate the presence of blood or blood-like material on the debris pieces but

that “several type of fibers, minerals and other fuel and petroleum products were present

in the samples collected [on scene].” The report concluded that the samples examined

contained “no blood or blood-like products.” 

The fractured segments of the No. 1 outboard slat track that were adjacent to the

stained area of the No. 1 slat were removed from the wreckage and transported to the

Safety Board’s materials laboratory for metallurgical examination. The metallurgist’s

report of the examination stated that the aileron hinge bracket “was grossly distorted and

separated approximately at a roller position. Visual examination of the separated arm

revealed features typical of an overstress separation. No evidence of preexisting fracture

areas was noted.” 

1.13 Medical and Pathological Information

Toxicological samples (muscle tissue) from both pilots were sent to the FAA’s

Civil Aeromedical Institute (CAMI) in Oklahoma City, Oklahoma, for examination.

Although ethanol was detected in muscle tissue samples from both the captain (34 mg/dl,

or 0.034 percent weight/volume—also known as blood alcohol content) and first officer

(54 mg/dl, or 0.054 percent blood alcohol content), the toxicological reports stated that

“the delay in the collection and the analysis of specimens may have resulted in

postmortem ethanol production.” The pilots’ toxicological results were negative for all

drugs of abuse and prescription as well as over-the-counter medications.

1.14 Fire

An intense postimpact fire melted localized sections of the airplane structure and

scorched nearby trees and the ground surrounding the crash site. Fire-fighting personnel

and equipment from Hopewell Township and Beaver and Allegheny Counties,

Pennsylvania, arrived at the accident site within minutes of the crash, and firefighters

began efforts to extinguish the fire immediately after arriving on the scene. The fire

burned for approximately 5 hours before it was extinguished but continued to smolder for

several days.
Factual Information 44 Aircraft Accident Report

1.15 Survival Aspects

Because the airplane was destroyed and no occupiable space remained intact, the

accident was not survivable. The Beaver County Coroner’s Office investigative report

stated that all airplane occupants were killed as a result of “blunt force impact trauma.”

The emergency response by Hopewell Township, Beaver County, and Allegheny

County authorities was initiated after they received telephone calls informing them of the

accident. The authorities began to arrive at the accident site within minutes after the crash. 

1.16 Tests and Research

1.16.1 Background Information—Other Significant 

Yaw/Roll Events 

Because of early indications that the initial upset of USAir flight 427 might have

been caused by an unintended or uncommanded rudder movement, which was considered

(but not established as a cause or factor) in connection with the 1991 crash of a 737 at

Colorado Springs, Colorado (United Airlines flight 585),80 the Safety Board reviewed all

of the information collected for the investigation of that accident during the investigation

of the USAir flight 427 accident.81 In addition, the Safety Board investigated a 1996

yaw/roll incident involving a 737 near Richmond, Virginia (Eastwind flight 517), to

determine if the upset event may have been related to an anomalous rudder movement.

Because much of the testing and research that was done in connection with the USAir

flight 427 investigation also incorporated information or examined components from the

United accident and Eastwind incident,82 factual information from these two events is

presented in the next two subsections. 

1.16.1.1 United Airlines Flight 585 Accident 

On March 3, 1991, United Airlines flight 585, a 737-291, N999UA, was rolling

out of a right turn to the north on the final approach for runway 35 at Colorado Springs

Municipal Airport in Colorado Springs, Colorado, when it suddenly yawed and then rolled

to the right, pitched nose down, and crashed short of the runway. The airplane impacted

80 See National Transportation Safety Board. 1992. United Airlines Flight 585, Boeing 737-291,

N999UA, Uncontrolled Collision With Terrain for Undetermined Reasons, 4 Miles South of Colorado

Springs Municipal Airport, Colorado Springs, Colorado, March 3, 1991. Aircraft Accident Report

NTSB/AAR-92/06. Washington, DC.

81 In addition, one of the recommendations in the FAA’s 1995 Critical Design Review (CDR) report was

that the Safety Board begin a combined investigation of the United flight 585 and USAir flight 427

accidents. (See section 1.18.4 for more information on the CDR team and its report.)

82 For more information, see, for example, section 1.16.3.1 (Eastwind Flight 517 Flight Tests), section

1.16.6 (Flight Performance Simulation Studies), section 1.16.5.4 (Detailed Examinations and Tests of Main

Rudder PCUs), and section 1.16.7.4.1 (Comparison of Engine Sound Signatures From United Flight 585

CVR and CVR from 737-200 Flight Tests).
Factual Information 45 Aircraft Accident Report

the ground about 0943:42.83 All 25 people aboard the airplane were killed, and the

airplane was destroyed by impact forces and postcrash fire.

When the accident sequence began (CVR and FDR evidence indicated that the

upset began about 0943:32), the airplane was operating at 160 knots with flaps extended to

30° and the landing gear extended. CVR and meteorological information indicated that the

pilots of United flight 585 were conducting a visual approach to the runway in moderateto-severe turbulence and gusty wind conditions; low-level windshear was reported. 

The United flight 585 CVR indicated that, as the pilots prepared for the approach

to the destination airport, they discussed the strong gusty winds and windshear conditions

they expected to encounter during the approach, airspeed adjustments to compensate for

those conditions, and missed approach procedures. The captain was performing the PF

duties, and the first officer was performing PNF duties. About 0938:14, the first officer

requested information from ATC regarding pilot reports concerning loss or gain of

airspeed. About 0939:26, when the airplane was on a southerly heading and had just

passed abeam (and to the east) of the end of runway 35, the CVR recorded the captain

saying “...we’re not gonna be in a rush...we want to stabilize it out here....” The first

officer responded, “yeah, I feel the same way.” About 0940:44, while the first officer was

busy completing a checklist, the captain requested additional information from ATC

regarding traffic. The pilots began a series of right turns toward the (northbound) final

approach. They incrementally extended flaps, extended the landing gear, and

accomplished the final descent checklist. Figure 11 shows a plot of United flight 585’s

ground track based on FDR and radar data.

As the pilots began to align the airplane with the final approach course, the

airplane was experiencing airspeed changes (± 10 knots) and rapid heading changes.84

About 0942:29, 0942:31, and 0943:01, the CVR recorded the flight crew stating

information related to uncommanded airspeed changes. According to the CVR, the first

officer said “wow” about 0943:08 and “we’re at a thousand feet” at 0943:28.2. At

0943:32.6, the CVR recorded the first officer exclaiming “oh god;” less than 1 second

later (at 0943:33.5), the captain stated “fifteen flaps,” and the first officer responded

“fifteen.” The CVR sound spectrum study indicated that the sounds before impact were

consistent with both engines accelerating.85

FDR data indicated that United flight 585 began a sharp heading change to the

right and a sudden descent about the time the captain called for “fifteen flaps.” The CVR

recorded the first officer stating “oh” at 0943:34.4 and the captain exclaiming “oh” loudly

at 0943:34.7. One second later, the first officer and the captain each stated “[expletive]”

83 All times in this subsection are mountain standard time, based on a 24-hour clock. The CVR time

equals FDR time in seconds plus 0941:55 (local mountain standard time).

84 The FDR installed on United flight 585, a Fairchild Digital Flight Recorder Model F800 (S/N 4016),

directly recorded five parameters. Altitude, indicated airspeed, magnetic heading, and microphone keying

versus time were recorded at once per second, and vertical acceleration was recorded eight times per second.

The Safety Board conducted simulation studies to derive additional flight-related information from the FDR

and radar data (see section 1.16.6). 
Factual Information 46 Aircraft Accident Report

(at 0943:35.4 and 0943:35.7, respectively). At 0943:36.5, the CVR recorded the captain

stating “no” very loudly and, about 1 second later, the first officer and the captain stating

“oh, [expletive]” (at 0943:37.5 and 0943:38.2, respectively). The CVR recorded the first

officer stating “oh, my god...oh, my god....” beginning at 0943:38.4, the captain stating

“oh, no, [expletive]” beginning at 0943:40.5, and the sound of impact just before the CVR

recording ended at 0943:41.5.

The accident airplane’s maintenance history included two rudder-related pilot

writeups during the week before the accident. On February 25, 1991, a pilot wrote that “on

departure got an abnormal input to rudder that went away. Pulled yaw damper circuit

breaker.” The noted corrective action was “replaced yaw damper coupler and tested per

maintenance manual.” On February 27, 1991, a pilot wrote that “yaw damper abruptly

85 According to United Airlines personnel, the command “fifteen flaps” is part of the company’s goaround procedure. Although United’s standard procedure for a go-around at the time of the accident

included the statement “go-around thrust” before reducing the flap setting, no such statement was recorded

by the accident airplane’s CVR. Company personnel advised the Safety Board that the “fifteen flaps”

command would have no function, other than a go-around, at the United flight 585 airplane’s altitude and

configuration. Further, the Safety Board’s report regarding the United flight 585 accident stated, “four or

five seconds prior to impact, two signatures were noted that are consistent with two engines accelerating.”

These indications of increasing engine power are consistent with an attempted go-around. 

Figure 11. Ground track of United flight 585.
Factual Information 47 Aircraft Accident Report

moves rudder occasionally for no apparent reason on ‘B’ actuators. Problem most likely in

yaw damper coupler...unintended rudder input on climbout at FL250. [Autopilot] not in

use, turned yaw damper switch OFF and pulled circuit breaker. Two inputs, one rather

large deflection.” The main rudder PCU yaw damper transfer valve (see figure 8) was

removed and replaced, and the airplane was returned to service. 

The main rudder PCU from United flight 585 was severely damaged by ground

impact and postcrash fire. Operational testing of the complete PCU was not possible

because of fire damage. However, visual examination of the servo valve indicated that the

secondary slide of the PCU servo valve was at its neutral position during the postcrash

fire. 

The Safety Board’s investigation of the rudder anomaly discovered during a July

1992 United Airlines ground check (discussed earlier in section 1.6.3.2.1 and further in

section 1.18.1.1) revealed that the 737 rudder had the potential to operate in a direction

opposite to that commanded by the flight crew if the main rudder PCU primary slide

became jammed to the secondary slide and pushed the secondary slide to its internal stop.

Adverse tolerance buildup86 in some secondary slides and servo valve housings could

allow a rudder reversal if the secondary slide was forced to its internal stop. Examination

of the United flight 585 servo valve indicated that the buildup of tolerances of the

secondary slide and servo valve components were such that the maximum travel of the

secondary slide (regardless of the relative position of the primary slide) would not result in

a reversal of the rudder surface motion. 

Examination of the standby rudder actuator input bearing revealed evidence of

metal transfer (also referred to as galling)87 between the input shaft and the bearing.

However, the examination determined that the galling did not have sufficient contact area

to result in binding that could not be overcome by pilot input on the rudder pedals.

(Galling of the input bearing of the standby rudder actuator is discussed in more detail in

section 1.16.5.3.2.) 

During its investigation of the United flight 585 accident, the Safety Board also

reviewed the performance of the flight crew. First officers who had flown recently with

the captain of United flight 585 described his strict adherence to standard operating

procedures and conservative approach to flying. They indicated that the captain briefed all

approaches even in visual conditions, always reported equipment malfunctions, and

discussed deferred maintenance items with the first officer. The first officers also reported

that, if the captain had not previously flown with a first officer, he would observe that first

officer perform PF duties during the first leg of a trip sequence. Further, a first officer who

had previously flown with the captain in gusty, turbulent weather reported during a

86 Adverse tolerance buildup occurs when the assembling (stacking) of a series of parts, all of which are

individually built within tolerances (that is, within an allowable deviation from a standard), has an adverse

result.

87 Galling is a condition in which microscopic projections or asperities bond at the sliding interface

under very high local pressure. The sliding forces subsequently fracture the bonds, tearing metal from one

surface and transferring it to the other. 
Factual Information 48 Aircraft Accident Report

postaccident interview that the captain had advised him to conduct a go-around if

windshear was encountered. The first officer stated that the captain had indicated that he

had no problem with an early go-around and had encouraged the first officer to conduct a

go-around if he thought the approach was unsafe. Regarding the first officer’s

performance, the captain of United flight 585 had flown a 3-day trip sequence with the

United flight 585 first officer a few weeks before the accident and had described her to a

friend as “very competent.” According to the Safety Board’s final report on this accident,

“comments on the CVR indicate that the pilots were alert and aggressive throughout the

final 9 seconds [of the accident sequence].” 

The Safety Board also examined the available information regarding the weather

conditions present in the Colorado Springs area at the time of the accident (strong gusty

winds with the potential for mountain rotors88 and windshear). Additional expertise in this

area was provided by the National Oceanic and Atmospheric Administration (NOAA),

National Center for Atmospheric Research (NCAR), and National Aeronautics and Space

Administration (NASA). The Safety Board’s final report on the United flight 585 accident

stated the following:

Normally, intense rotors produce a distinctive “roaring” sound. A person

12 miles north of COS [Colorado Springs airport] reported a rotor hitting

the ground about noon. He was inside a building and went outside to

observe the rotor after hearing what he described as a roaring sound.

However, there were no reports from witnesses to this accident hearing

such sounds.

Most of the weather investigation focused on the possibility of a rotor as a

cause or a factor in this accident....

While approaching [Colorado Springs], flight 585 probably encountered

orographically induced atmospheric phenomena, such as updrafts and

downdrafts, gusts, and vertical and horizontal axis vortices. The most likely

phenomenon that would cause the airplane to roll was a horizontal axis

vortex.... It is possible that flight 585 encountered a strong horizontal axis

vortex that induced a rolling moment which exceeded the airplane’s control

capabilities, but the FDR data is not consistent with such an encounter.

[The Safety Board’s review of FDR data from airplanes that had penetrated

horizontal axis vortices89 revealed that the FDRs recorded a transient

altitude increase (pressure decrease) and anomalous airspeed indications.

These were not observed in the FDR data from United flight 585.] 

NOAA originally estimated, and NOAA research work has confirmed, that

a typical rotor on the day of the accident could have a rotational velocity of

0.06 radians/second (3.4 degrees per second) with a radius of 1,640 feet.

The tangential velocity at the core radius would have been 100 feet per

second. Simulations showed that such a rotor had little effect on airplane

control except that performance problems could develop if the airplane

88 A rotor is an atmospheric disturbance produced by high winds, often in combination with

mountainous terrain, and expressed by a rotation rate (in radians per second), a core radius (in feet), and a

tangential speed (in feet per second). Rotation can occur around a horizontal or vertical axis. One radian

equals approximately 57°.
Factual Information 49 Aircraft Accident Report

remained in the downflow field of the rotor. In a sustained downflow, the

airplane would either have to lose altitude or airspeed, similar to the

outcome of entering the downflow field of a microburst.... The airplane

did lose altitude at a higher than normal rate, but the airspeed remained

constant....

...It was determined that rotors with rotation rates of 0.6 radians/second

(34 degrees per second) with a 250 feet core radius (150 feet/second

tangential velocity) generated extreme control difficulties....

Wind shears or gust fronts severe enough to produce control difficulties

also produced flight responses that were clearly different than those

recorded on the accident airplane.... Large changes in heading into the

wind, large increases in airspeed, and rapid rolling away from the wind if

not controlled by the pilot.... Wind-induced side slip...with marked

increases in normal acceleration (G-load). 

On December 8, 1992, the Safety Board adopted the following probable cause

statement for the United flight 585 accident:

The National Transportation Safety Board...could not identify conclusive

evidence to explain the loss of United Airlines flight 585. 

The two most likely events that could have resulted in a sudden

uncontrollable lateral [roll] upset are a malfunction of the airplane’s lateral

[roll] or directional control system or an encounter with an unusually

severe atmospheric disturbance. Although anomalies were identified in the

airplane’s rudder control system, none would have produced a rudder

movement that could not have been easily countered by the airplane’s

lateral [roll] controls. The most likely atmospheric disturbance to produce

an uncontrollable rolling moment was a rotor (a horizontal axis vortex)

produced by a combination of high winds aloft and the mountainous

terrain. Conditions were conducive to the formation of a rotor, and some

witness observations support the existence of a rotor at or near the time and

place of the accident. However, too little is known about the characteristics

of such rotors to conclude decisively whether they were a factor in this

accident.

As a result of the United flight 585 accident investigation, the Safety Board made

seven safety recommendations, including Safety Recommendations A-92-57 and -58,

which were issued on July 20, 1992.90 These recommendations asked the FAA to 

89 The Safety Board’s review of its accident/incident database revealed that, although several highaltitude horizontal axis vortex encounters resulted in serious injuries (from turbulence), only one instance of

such a vortex resulted in a catastrophic air carrier accident. (See National Transportation Safety Board.

1967. Braniff Airways, Inc., BAC-111, N1553, August 6, 1966, near Falls City, Nebraska. Washington, DC.)

During the Safety Board’s investigation of the USAir flight 427 accident (and subsequent reexamination of

United flight 585 data), Air Line Pilots Association (ALPA) personnel advised the Safety Board of a

documented mountain rotor encounter that occurred on January 29, 1993. A 737-200 operating as Alaska

Airlines flight 66 encountered a mountain rotor while climbing through 900 feet above ground level (agl)

after takeoff from Juneau, Alaska. (For additional information, see Human Performance Segment Factual

Report, Addendum, November 20, 1998.) 
Factual Information 50 Aircraft Accident Report

Develop and implement a meteorological program to observe, document,

and analyze potential meteorological aircraft hazards in the area of

Colorado Springs, Colorado, with a focus on the approach and departure

paths.... This program should be made operational by the winter of 1992.

(A-92-57)

Develop a broader meteorological aircraft hazard program to include other

airports in or near mountainous terrain, based on the results obtained in the

Colorado Springs, Colorado, area. (A-92-58)

In response to Safety Recommendation A-92-57, NOAA and NCAR collected

weather and wind data in the Colorado Springs area between February and April 1997.

The June 1998 NOAA/NCAR interim report91 indicated that numerous mountain-induced

weather phenomena were observed, including low-altitude windflow reversals,

windshears, and horizontal axis vortices (rotors). The Safety Board’s review of the

NOAA/NCAR data revealed that, in several cases, the upper wind directions were similar

to, but weaker than, those that existed in the Colorado Springs area when the United flight

585 accident occurred.92 The data from these cases showed that mountain rotors were

present. Some of the weaker rotors measured by NOAA/NCAR were located between the

surface and about 3,000 feet above ground level (agl), whereas other (stronger) rotors

were observed at altitudes exceeding 4,000 feet agl. 

The rotors observed during the NOAA/NCAR data gathering program had a

maximum rotational rate of 0.05 radians per second, which is less than the rotational rate

of 0.6 radians per second that was demonstrated during the investigation of the United

flight 585 accident to be necessary to produce extreme control difficulties in a 737

airplane. According to NOAA scientists, stronger upper windspeeds produce

proportionally stronger rotors. Therefore, if the upper windspeeds encountered by United

flight 585 were three times stronger than those measured by NOAA/NCAR, the rotor

rotational rate could be three times stronger. (For example, a rotor three times stronger

than the maximum observed by NOAA/NCAR would have a maximum rotational rate of

0.15 radians per second.)

In its January 20, 1999, letter to the FAA, the Safety Board indicated that, pending

the issuance of the NOAA/NCAR final report, Safety Recommendation A-92-57 was

classified “Open—Acceptable Response.” The Safety Board’s letter also indicated that,

pending further information about a meteorological program to observe, document,

analyze, and report meteorological hazards at other airports in mountainous areas, Safety

Recommendation A-92-58 was classified “Open—Unacceptable Response.”

90 For additional information regarding the seven recommendations, see sections 1.18.11.1, 1.18.11.2,

and 1.18.11.3.

91 A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs Area:

Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997), NOAA/NCAR, June 1998. As of March

1999, a final report had not been issued.

92 The Safety Board’s review of the data indicated that the upper winds present at the time of the United

flight 585 accident were about two to three times stronger than those observed in the NOAA/NCAR data.
Factual Information 51 Aircraft Accident Report

Further, in connection with its investigation of the USAir flight 427 accident, the

Safety Board reexamined the CVR, FDR, meteorological data, airplane performance data,

and physical evidence from the United flight 585 accident investigation. As part of its

reexamination of airplane performance data, the Safety Board conducted additional

airplane performance simulation studies using the FDR and radar data (see section

1.16.6.2). The Safety Board also conducted additional human performance studies based

on the FDR and CVR data from the United flight 585 accident (see sections 1.16.8 and

1.18.8). 

1.16.1.2 Eastwind Airlines Flight 517 Incident

On June 9, 1996, Eastwind Airlines flight 517, a 737-200, N221US, experienced a

yaw/roll upset about 2200 near Richmond, Virginia. The airplane was operating at an

airspeed of about 250 knots and an altitude of about 4,000 feet msl in visual flight rules

(VFR) conditions when the yaw/roll event occurred. The pilots were able to regain control

of the airplane and land at the destination airport without further incident. None of the 53

airplane occupants were injured, and no damage to the airplane resulted from the incident. 

During postincident interviews, the captain reported that he was flying the airplane

with the autopilot disengaged93 and his feet resting lightly on the rudder pedals during the

descent to land at Richmond. Both the captain and first officer reported that they had not

encountered any turbulence or unusual weather during the flight, which originated from

Trenton, New Jersey, or the approach to land. However, the captain said that, as the

airplane descended through about 5,000 feet msl, he felt a brief rudder “kick” or “bump”

on the right rudder pedal but that the pedal did not move. The captain stated that he

glanced at the first officer’s feet to see if he had contacted the rudder pedals but that the

first officer had his feet flat on the floor. 

FDR information94 and flight crew and flight attendant interviews indicated that,

as the airplane descended through about 4,000 feet msl, the airplane yawed abruptly to the

right and then rolled to the right. The captain stated that he immediately applied “opposite

rudder and stood pretty hard on the pedal.” The captain stated that, almost simultaneously

with these rudder inputs, he applied left aileron.95 Further, the captain consistently

reported that the rudder pedal control felt stiffer than normal and did not seem to respond

normally throughout the upset event. The first officer stated that he saw the captain

93 The captain reported that it was his practice to disconnect the autopilot when descending through

10,000 feet msl and manually fly the airplane to landing.

94 The FDR installed on the Eastwind flight 517 airplane, a Loral/Fairchild Data Systems model F1000

(S/N 00948), recorded 11 parameters. Altitude, airspeed, magnetic heading, engine pressure ratio (EPR)

engine No. 1, EPR engine No. 2, and microphone keying were recorded at once-per-second sampling

intervals. Parameters that were sampled more frequently than once per second were roll attitude and control

column position versus time (two times per second), pitch and longitudinal acceleration (four times per

second), and vertical acceleration (eight times per second). The CVR installed on the incident airplane,

which was designed to preserve about 30 minutes of data, continued to record after the upset event and

recorded over the data pertinent to the incident. Because no pertinent CVR data was available, the Safety

Board referenced the incident times as follows: radar time equals FDR time in seconds minus 11,000 plus

2205:47 (local eastern standard time).
Factual Information 52 Aircraft Accident Report

“fighting, trying to regain control” and “standing on the left rudder.” According to the

captain, these flight control inputs slowed the yaw/roll event; however, the airplane “was

still trying to roll,” so he advanced the right throttle to compensate for the rolling tendency

with differential power.96 The captain stated that, after he made these inputs, the airplane

appeared to move back toward neutral “for one or two seconds” and “might have

momentarily banked left because of all the correction present” before returning abruptly to

a right bank.

The flight crew performed the emergency checklist, which included disengaging

the yaw damper. Subsequently, the upset event stopped, and the airplane flew normally for

the remainder of the flight. The pilots reported a delay of several seconds between the

disengagement of the yaw damper and the end of the upset event.

During postincident interviews, the lead flight attendant of Eastwind flight 517

stated that she was standing in the aisle near the rear of the airplane cabin before the upset

began. At that time, she heard a distinct thump from below but not directly underneath her

feet. (The rear flight attendant also reported hearing a thump sound while the airplane

yawed to the right) She reported that, immediately after the thump occurred, the airplane

began “rocking with a violent back and forth motion.... The motions...lasted no more

than fifteen seconds, were violent from start to finish, and appeared to come in cycles.” 

The FDR data revealed that the airplane rolled rapidly to the right about 10° with a

simultaneous heading change to the right of about 5° per second. The FDR data also

revealed that the airplane rolled back to the left, to a maximum left bank angle of

approximately 15°, while the right engine thrust increased. 97 (The airplane was in a 15°

left bank for approximately 3 seconds and remained in a left bank for an additional

9 seconds while the engine thrust increased; however, the FDR recorded little heading

change.) While the right engine pressure ratio (EPR) increased, the airspeed increased from

about 250 to about 254 knots. The airplane’s heading changed to the left; hesitated at about

95 During an interview 5 days after the incident, the captain estimated that he input about 40 to 45° of

control wheel displacement and stated that “the airplane seemed to hold in a 25 to 30° bank.” A statement

obtained from the first officer at the same time was consistent with the captain’s estimates of control wheel

input and bank angle. However, during an interview 10 days later, the captain indicated that a flight test in

which the airplane rolled about 15° “provided a better recreation of the motions of the airplane during the

incident.” (FDR data indicated that the incident airplane rolled between 10 and 15° during the upset event.)

Although both pilots estimated the captain’s control wheel input during the incident to be about 40 to 45°,

Safety Board and Boeing kinematic studies indicated that the initial control wheel input was closer to 60°.

Additionally, during the interview 5 days after the incident, the captain estimated that he input about 3 to 4

inches of left rudder pedal displacement; however, in an interview 2 years later, the captain stated that the

rudder pedals moved no more than 1 or 2 inches. The captain stated that he immediately put “a lot” of

pressure on the rudder pedals but that they “did not go down to the floor.”

96 During postincident interviews, the captain told Safety Board investigators that his automatic

decision to use differential power to counter the yaw/roll event reflected his experience in turbopropellerdriven airplanes.

97 About 5 seconds after the beginning of the upset, the EPR values for the right (No. 2) engine began to

increase. The right engine EPR values increased to a maximum of 1.32; remained constant at 1.26 for

5 seconds; increased to 1.30 for 1 second; and then decreased to about 1.01, which was consistent with EPR

values of the left (No. 1) engine for the entire incident.
Factual Information 53 Aircraft Accident Report

242°; and began a series of heading oscillations of decreasing magnitude, including a left

heading excursion of 4.1° and a right heading excursion of 5.6° (both in 1 second). During

the heading oscillations, the airplane’s roll attitude also oscillated between an approximate

wings-level attitude and 10° left wing down (LWD). The heading and roll oscillations

decreased while the airplane maintained an approximate constant heading of about 240°. 

Postincident examination of the airplane’s maintenance records revealed three

flight crew-reported rudder-related events during the month preceding the incident. The

first event occurred on May 14, 1996, when the captain of the June 9 Eastwind incident

flight experienced a series of uncommanded “taps” on the right rudder pedal just after

takeoff, which he stated felt “like someone hitting their foot on the right rudder.” The

captain returned to the departure airport and landed without further incident. As a result of

the uncommanded rudder movements reported to have occurred on May 14, the main

rudder PCU was replaced that same day,98 and the airplane was returned to service.99

During a May 21 overnight inspection, rudder sweep and PCU leak examinations were

conducted. 

The captain reported that the rudder pedal bumps he experienced on May 14 felt

identical to the rudder pedal bump he felt at the onset of the yaw/roll event on June 9.

Additionally, the Eastwind flight 517 lead flight attendant was a cabin crewmember on the

May 14 flight, during which the captain experienced the uncommanded rudder “taps.” The

flight attendant stated that she did not hear any sounds during the May 14 event and

reported that the event was much less intense than the June 9 incident. She was in the front

of the cabin during the May 14 event but was near the rear of the cabin during the June 9

incident.

The other two uncommanded yaw/roll events were reported to have occurred on

June 1 and June 8, 1996.100 As a result of these reports, the yaw damper transfer valve and

the yaw damper linear variable displacement transducer (LVDT) were removed and

replaced on June 8. The incident pilots performed a postmaintenance test flight on the

morning of June 9 and reported that the airplane performed normally, with no rudder

system anomalies noted during the test flight. Because the airplane performed

satisfactorily during the test flight, it was returned to service. 

When Safety Board investigators examined the rudder system and the main rudder

PCU after the June 9 incident, they observed that the rudder’s yaw damper system had

been adjusted such that the rudder neutral (at rest) position was 1.5° to the left when the

98 The Eastwind flight 517 main rudder PCU servo valve was assembled and tested at Parker on

April 15, 1996. 

99 As a result of the uncommanded rudder movements reported to have occurred on May 14 (and

another undocumented rudder event that occurred on or about May 31), on June 2, 1996, Eastwind issued

Flight Crew Briefing Bulletin 96-03, which advised company pilots of the circumstances of the events and

requested that pilots notify maintenance immediately if an unexplained yaw movement occurred. 

100 The airplane’s June 1, 1996, logbook entry stated, “...[airplane] may have exp[erienced] 2 each

[slight] rudder yaws [to] the left...approx[imately] 30 sec[onds] apart.... No rudder pedal movement....”

The June 8, 1996, logbook entry stated, “with yaw damper off in level flight aircraft rolls to the right and the

yaw damper test indicator also goes to the right.” 
Factual Information 54 Aircraft Accident Report

yaw damper system was engaged and the rudder trim was set at zero. The active yaw

damper could move the rudder 1.5° farther to the left of this neutral position and 4.5° to

the right of this neutral position with no aerodynamic loads.101 Postincident PCU testing at

Parker’s facility indicated that the yaw damper LVDT neutral position was incorrectly set.

(The normal limit of yaw damper authority on the rudder, if properly set, would have been

3° to the left and 3° to the right of the rudder’s neutral position.) 

Additional examination and testing conducted by the Safety Board, Eastwind, and

Boeing revealed that the wiring from the yaw damper coupler to the main rudder PCU was

chafed and could have resulted in a short circuit, causing a full yaw damper command left

or right. Additionally, examination of the yaw damper system revealed damage from

infiltration of fluid that was consistent with, but not conclusive evidence of, an electrical

fault. The main rudder PCU and yaw damper coupler were removed and replaced, new

wiring was installed between the PCU and the yaw damper coupler, and the airplane was

returned to service. To date, no further pilot complaints or maintenance writeups regarding

rudder “bumps” or other anomalous rudder motions have been reported on the incident

airplane. 

1.16.2 Wake Vortex Tests and Studies Resulting From the 

USAir Flight 427 Accident 

The PIT Automated Radar Terminal System III radar tracking data indicated that

the only airplanes operating in the vicinity of USAir flight 427 when the upset occurred

were Atlantic Coast flight 6425, a Jetstream 31 that had just departed PIT and was

climbing and heading north, and Delta flight 1083, a 727-200 that was preceding USAir

flight 427 to PIT. The Safety Board plotted radar tracking data for these three airplanes to

determine whether the wake vortices102 from either the Atlantic Coast or Delta airplanes

might have played a role in the USAir airplane’s accident sequence.

The radar data indicated that, at the time of the upset, USAir flight 427 and

Atlantic Coast flight 6425 were separated by 1,500 feet vertically (flight 427 was at the

higher altitude) and 3.5 nautical miles (nm) horizontally (with flight 427 northwest of

flight 6425). About 8 seconds later (about 1903:11), radar data showed that USAir flight

427 was at 5,300 feet msl (600 feet above Atlantic Coast flight 6425) and that the

airplanes were 3.1 nm apart. About 1903:20, the radar data indicated that USAir flight 427

was at 2,300 feet msl (2,600 feet below Atlantic Coast flight 6425) and that the airplanes

were 2.8 nm apart.103 The radar tracks of the two airplanes did not cross at any time.

101 With the rudder trim set at zero, the yaw damper travel limits were ± 3° about the 0° rudder position

(not the rudder’s neutral position). 

102 According to the FAA’s Aeronautical Information Manual, all airplanes generate wake vortices (a

pair of counterrotating airmasses trailing from the wing tips) while in flight. The strength of these vortices

depends on the weight, speed, and shape of the wing of the generating aircraft. The greatest vortex strength

occurs when the generating aircraft is heavy, in a clean configuration, and at a slow airspeed. 

103 The recorded radar data plots and separation tables are included in the Performance Group

Chairman’s Report of Investigation, dated January 14, 1995. 
Factual Information 55 Aircraft Accident Report

The radar data showed that Delta flight 1083 was descending through 6,300 feet

msl on an easterly heading when it passed the approximate location where the initial upset

of USAir flight 427 subsequently occurred. The accident airplane reached that location

about 69 seconds after Delta flight 1083. According to information provided by Delta Air

Lines and ATC records, Delta flight 1083 would have been operating at an estimated

weight of 126,400 pounds, in the flaps 1 configuration, and at an ATC-assigned airspeed

of 190 knots when it passed the location where the initial upset occurred. USAir flight

427, also on an easterly heading, was at 6,000 feet msl when the initial upset occurred.

The closest Delta flight 1083 and USAir flight 427 were to each other was 4.1 nm apart

(both airplanes were at 6,000 feet msl) about 24 seconds before the upset occurred. About

the time of the upset (1902:50), the distance between the two airplanes had increased to

4.5 nm.

NASA and Safety Board aerodynamics experts performed a study of the most

likely movement of the wake vortices produced by Delta flight 1083 (at its estimated

weight and configuration). The study indicated that the wake vortices would have drifted

with the wind104 and descended at a rate of 300 to 500 feet per minute. On the basis of

these rates, the wake vortices would have likely descended to between 5,800 and 6,000

feet msl during the 69 seconds after Delta flight 1083 descended through 6,300 feet msl

near the location of the initial upset. The study indicated that USAir flight 427 most likely

encountered the wake vortices produced by Delta flight 1083 about the time of the initial

upset.

In September and October 1995, the Safety Board conducted a series of flight tests

near Atlantic City, New Jersey, to examine the aerodynamic effects of 727-generated wake

vortices on a 737. These tests were conducted with participation and support from parties

to the USAir flight 427 investigation, including the FAA, Boeing, USAir, and the Air Line

Pilots Association (ALPA), as well as other interested parties, including NASA. The tests

used a highly instrumented 737-300 provided by USAir105 and a 727-100 owned by the

FAA and equipped with wing-tip smoke generators to assist in the visual identification of

the wake vortex core.106 To accurately simulate the wake turbulence conditions

encountered by the accident airplane, the test airplanes were loaded to the approximate

weights of USAir flight 427 and Delta flight 1083 at the time of the wake vortex

encounter. Most of the flight tests were conducted in early morning hours when calmer

104 As previously indicated, a radiosonde balloon that was launched approximately 6 miles southeast of

the accident site about 11 minutes after the accident measured winds at 6,000 feet msl from 274° at 15 knots. 

105 The 737 used for the wake turbulence flight tests (which was flown by FAA, Boeing, USAir, and

ALPA pilots during the flight tests) was equipped (by Boeing) with an FDR that had enhanced recording

capabilities. More parameters, such as control input and control surface position, were included, and

parameters were sampled and recorded more frequently than those parameters recorded by the FDR on the

accident airplane. The flight test airplane also had a digital audiotape recorder and a video recording system

with seven cameras (two in the cockpit facing forward out the windshield, one in the cockpit facing the

flight crew and the instruments, one under each wing tip facing forward, one on the vertical fin facing

forward, and two in the midcabin facing out windows toward the wing tips). A T-33 observation airplane

(provided by Boeing) also used video recording equipment to document the flight tests. 

106 The 727-100 provided by the FAA (and flown by FAA flight test pilots) for the wake turbulence

flight tests is shorter than the 727-200, but both airplanes’ wing lengths and shape are identical. 
Factual Information 56 Aircraft Accident Report

atmospheric conditions would be most likely to permit strong, stable, long-lasting wake

vortices.

During the tests, the 737 penetrated the 727’s smoke-indicated wake vortex cores

about 150 times107 from various intercept angles; in turns, climbs, descents, and level

flight at various altitudes;108 and at separation distances of between 2 and 4.2 nm (USAir

flight 427 and Delta flight 1083 were 4.5 nm apart at the time of the upset). For other

flight test conditions, the flight test pilots positioned the 737 so that specific airplane

surfaces (for example, left wing, right wing, vertical fin, engine, and fuselage) passed

through the wake vortex cores. The pilots performed intercepts under the following

conditions: autopilot on without pilot input, autopilot on with pilot input (in CWS mode),

autopilot off without pilot input (hands off), and autopilot off with pilot input.

Information was obtained from the videotapes, enhanced FDR, Boeing’s portable

airborne digital data system (PADDS),109 the 2-hour CVR installed on the 737, and test

pilot statements. These data revealed that the 727 wake vortices remained intact as much

as 6 to 8 miles behind the wake-generating airplane, and wake strength values ranged from

800 to 1,500 feet/sec2

. The videotapes revealed numerous examples of wake vortices

breaking apart; linking up; and moving up, down, and sideways. The 737 encounters with

the wake vortices occasionally resulted in rapid airspeed fluctuations of ± 5 knots,

although some fluctuations resulted from the wake vortices’ interaction with the pitotstatic system and low-level (± 0.1 G) turbulence.

Further, the data showed that the wake vortices did not move in a straight or

uniform path (as previously assumed by wake turbulence models that had been developed

before the accident). Rather, flight test participants noted large fluctuations in the vertical

position of the wake vortex cores over short distances. The wake movement was

especially unpredictable when the wake was generated during a descent. During public

hearing testimony related to the USAir flight 427 accident, Boeing’s flight test pilot

described the 727 wake vortices as follows: 

...the wakes...stay at this three, four, five foot diameter core all the way

back until they burst.... They flow left, right, up and down, inside maybe a

15 foot diameter tube on a stable day. It is possible to quickly hit the same

wake twice, because the wake is not fixed in space. You could possibly get

a left roll and...[if] the wake vortex is actually on your left side at that

point...if you cross over, it means that you roll right back into the wake....

107 Data from the 150 wake encounters were examined to identify 737 flight characteristics during wake

vortex encounters; CVR sound signatures from 50 of the 150 wake encounters were selected and compared

with the sounds recorded by the accident airplane’s CVR. 

108 According to the FAA test pilot involved in the wake turbulence flight tests, part of the flight test

safety plan “required that we do this at a high altitude...15,000 feet [msl] or greater, in case there was some

type of an upset that would take some time to recover from.... We were above a deck of clouds at about

[18,000] or 19,000 feet [msl] for the first encounter....” 

109 PADDS is a high-rate, self-contained flight test data recording system developed by Boeing that was

installed on the flight test airplane to allow investigators to record and evaluate parameters that were not

recorded by the accident airplane’s FDR system. The PADDS system recorded all data at higher sampling

rates (20 times per second) than the FDR system that was installed on the incident airplane. 
Factual Information 57 Aircraft Accident Report

According to the flight test pilot statements, although the wake encounters had

varying effects on the 737 flight handling characteristics, the effects usually lasted only a

few seconds and did not result in a loss of control or require extreme or aggressive flight

control inputs to counteract. The flight test pilots with experience flying in air carrier

operations stated that the wake encounters experienced during the flight tests were similar

to those that they had experienced during normal flight line operations. The pilots

described the wake encounters as “routine” and not startling. 

The flight test data also indicated that even “routine” wake vortices could result in

strong rolling110 and yawing moments,111 depending on the wake vortex intercept angle.

During public hearing testimony, the FAA flight test pilot reported that, at wake vortex

intercept angles of less than 10° (particularly at intercept angles of between 2 and 5°), the

airplane experienced strong rolling tendencies. However, the pilot stated that, at intercept

angles of 10° or more, the encounter did not result in a significant rolling moment,

although the airplane experienced a couple of sharp bumps as it crossed the wake vortex.

The FAA flight test pilot reported that, when the airplane encountered the wake vortex

with no autopilot or manual control (hands-off condition), he observed uncommanded roll

angles between 15 and 30°. When the airplane encountered the wake vortex under manual

control (hands-on condition) and with the autopilot on (with and without pilot input), the

FAA pilot observed roll angles between 10 and 20°.

According to the flight test pilots, the rolling moment tended to self-correct as the

airplane passed through the wake vortex. The FAA flight test pilot said that “the airplane

would start to roll as you [entered the wake]...then as you hit the right vortex, it would roll

you back up to level again....” Several of the flight test pilots reported that the wake

vortex encounters were generally short in duration (unless the pilots intentionally

maneuvered the airplane to stay in the wake effect) because the wake vortex tended to

force the airplane out of its effects. The FAA test pilot stated that it was very difficult to

keep the airplane in the vortex. During test conditions in which the vortex was positioned

on the top of the airplane and hit the vertical fin (in the flaps 1 configuration at 190 knots),

the pilot reported that full aileron deflection was required to counter the vortices’ tendency

to push the airplane out of the vortex. 

During the public hearing testimony, Boeing’s flight test pilot stated that he did not

use much rudder during the wake turbulence flight tests; rather, he used mostly aileron.

The pilot stated that “the only time you use the rudder pedal is when you have a definitive

yawing moment... or you have a very...high rolling moment....” Boeing’s flight test pilot

also reported that “every now and then, I started to use the rudder, but then you would

translate left or right out of the full effect of the [wake vortex] core and then I would be

left with either putting... the [control] wheel back in or leaving the rudder there and just

playing with the [control] wheel.” The pilot stated he did not experience anything during

110 Boeing’s flight test pilot stated that the effect of the wake turbulence was “a bit stronger than I would

have expected...[resulting in] probably 25 to 30 [degrees of roll].” 

111 Wake turbulence-related yawing moments were transient in nature and did not result in large

sustained heading changes. 
Factual Information 58 Aircraft Accident Report

the wake vortex encounters that he believed would prompt a pilot to apply and hold full

rudder. 

In the public hearing testimony, the flight test pilots indicated that the wake

encounters they experienced during the flight tests were not disorienting or violent enough

to have caused a sustained loss of control. However, the flight test pilots said that a strong

wake vortex encounter would likely be startling and surprising to pilots when encountered

unexpectedly during otherwise smooth, routine flight operations.

The wake turbulence encounter flight test data were compared with the results of

computer flight simulations112 performed at Boeing using its previously developed

mathematical model. The comparison indicated that the simulation model adequately

predicted wake-induced lift, roll, and pitch characteristics; however, the mathematical

model did not accurately predict the wake-induced yawing moment characteristics of the

airplane during certain wake encounters. The videotape taken during the flight tests

revealed that, when the airplane passed over or directly through the wake vortex cores, the

wake (as shown by the smoke) was disrupted by the 737’s wings, fuselage, and horizontal

tail surfaces; under these circumstances, the yawing moments predicted by the simulation

were not evident in the flight test data. However, when the airplane was slightly

underneath the wake so that its vertical tail surface passed through the wake vortex core

generated by the 727, the wake that contacted the vertical tail surface had not been

previously disrupted. The flight test data revealed that this situation resulted in a transient

yaw response that exceeded the yaw predicted by the simulation wake turbulence model. 

Boeing’s mathematical wake vortex model was refined based on the wake

turbulence encounter flight test data, and additional flight simulations were performed by

investigators to further evaluate the interaction of USAir flight 427 with Delta flight

1083’s wake vortices. The simulations employed various wake vortex characteristics,

wake vorticities, positions, and core sizes; the accident airplane’s closure rates and

intercept angles with the wake; and the use or operation of the airplane’s autopilot, yaw

damper, and autothrottle. Encounters with wake vortices in these simulations did not result

in significant problems controlling the airplane. 

112 Flight simulations were conducted at Boeing using its computer workstation-based flight simulation

software and its multipurpose cab (M-CAB) engineering simulator. The M-CAB utilizes a standard,

6 degree-of-freedom motion base to provide some acceleration cues to the occupants of the cab. The motion

base can replicate some short-term accelerations or some smaller magnitude, long-term accelerations. It can

rotate the cab through roll, pitch, and yaw angles of about ± 30° and can translate the cab in the forward/aft,

side, and vertical directions about up to about ± 2 feet. Long-term vertical accelerations, such as those from

sustained normal flight loads, cannot be duplicated. Some side loads, such as those from sustained sideslips,

can be duplicated by rolling the cab to a steady angle, similar to tilting a chair sideways. Forward

accelerations, such as those felt during a normal takeoff roll acceleration, can be somewhat replicated by

rotating the cab upward to a steady pitch attitude. 
Factual Information 59 Aircraft Accident Report

1.16.3 Flight and Simulator Tests of Effects of Various Flight 

Control and System Failures 

The Safety Board used Boeing’s multipurpose cab (M-CAB) engineering

simulator, “flown” by FAA flight test pilots, to document and test several possible 737

failure or malfunction scenarios. The following possible flight control/system failure

scenarios were examined: 

• loss of engine power, with various flight control inputs and rates;

• asymmetric thrust reverser extension;

• yaw damper hardover;

• leading edge asymmetry, with or without autoslats;

• asymmetric autoslat deployment at stickshaker;

• flap malfunction; 

• loss of roll control spoilers;

• elevator malfunction;

• outer slat damaged and extended over wing; and

• rudder hardover, at various rates of input, with AFS on and off.

Of all the simulations conducted, only the rudder hardover simulation produced

results that were generally consistent with the data from USAir flight 427’s FDR.113

Specifically, some of the results of the M-CAB simulation of the rudder hardover scenario

were similar to FDR heading data that were recorded several seconds after the initial

upset. This similarity prompted additional investigation of rudder hardover scenarios. 

Because the pilots who flew the M-CAB simulator responded differently (either in

the magnitude or the timing of their responses), the simulator results were not consistent

among the pilots, and precise matches of the FDR data were thus not possible. As a result,

the Safety Board and Boeing conducted flight simulations on computer workstations to

remove the individual variances introduced by the pilots who participated in the M-CAB

study. The workstation simulations enabled engineers to make small parametric changes

to the input data and then determine the effects of various rudder hardware scenarios and

resultant wheel and elevator responses. These simulation studies are discussed in section

1.16.6. 

113 For example, for an asymmetric thrust reverser extension to result in the left yawing moment

recorded by the accident airplane’s FDR during the first several seconds of the upset, the right engine would

have had to have been in forward thrust and the left engine in reverse. Boeing’s calculations revealed that the

net thrust differential required to sustain the left yaw recorded by the FDR during the first few seconds of the

upset would be 37,890 pounds, affecting the airplane’s yaw to the left. However, the FDR’s recorded engine

power settings (66 percent N1 at 190 knots), indicated that the accident airplane’s engines could have only

been producing a net thrust differential of 13,269 pounds (4,500 pounds forward thrust on the right engine

and 8,769 pounds reverse thrust on the left engine), affecting the airplane’s yaw to the left. 
Factual Information 60 Aircraft Accident Report

Boeing’s M-CAB simulator was also used to conduct postaccident simulator

flights using the accident airplane’s FDR data, with a rudder hardover induced either

manually or electronically to represent the USAir flight 427 upset condition. During the

simulator exercise, the participants114 were briefed by Boeing personnel regarding the

circumstances of the USAir flight 427 accident, prepared for and expecting the upset event

when it occurred, and coached through a specific recovery technique (full right control

wheel maintained throughout the duration of the event, and forward control column

pressure sufficient to reduce the normal load factor and maintain airspeed above the

crossover point).115 The pilots were able to recover from the upset (or at least stabilize the

roll to the point at which a continued loss of control would not have likely occurred) when

they applied the recovery technique promptly at the beginning of the event. If the pilots

varied their responses from the specific techniques that they were told to apply (for

example, when they modified the control wheel input in anticipation of the simulator’s

responses to the inputs or applied aft control column pressure to maintain 6,000 feet), it

became much less likely that the pilots would successfully recover from the upset event.) 

Additionally, Safety Board investigators, with representatives from parties to the

investigation and a research scientist from NASA’s Ames Research Center, documented

possible pilot responses to the upset using the vertical motion simulator (VMS) at the

Ames Research Center.116 The VMS had a larger range of motion than the Boeing M-CAB

and could therefore more accurately replicate the airplane motion recorded by the accident

airplane’s FDR. The time histories of the airplane motion, as documented by the FDR and

the initially derived positions of the flight control surfaces (based on computer

workstation modeling), were input into the VMS. In addition, a portion of the accident

airplane’s CVR was synchronized to the FDR data and replayed during the VMS runs. The

VMS cab did not resemble a 737 cockpit; however, the cab included a view of a computersimulated horizon, which was adjusted to the accident airplane’s attitude. The VMS

allowed participants to feel the motion of the airplane, listen to the CVR excerpts, and

view the horizon and control inputs to assess possible flight crew responses (such as

whether the flight crew might have responded to the upset with left rudder pedal input). In

addition, a NASA specialist on human spatial orientation rode in the simulator to provide

observations on the possibility that pilot disorientation contributed to the accident. (See

section 1.18.6.2 for additional discussion regarding the NASA specialist’s observations.)

114 Participants in these postaccident simulator flights included pilots and nonpilots from the Safety

Board and parties to the investigation.

115 See section 1.16.4 for more information on the crossover airspeed.

116 A research scientist from NASA’s Ames Research Center described the VMS as “...a full 6 degreeof-freedom simulator that has a vertical thrust of plus and minus 30 feet, lateral thrust of plus and minus 20

feet, and a fore and aft thrust of 2.5 feet.... there are full visual simulations on the VMS....” The motion base

of the VMS simulator permits an improved replication of the feel of the airplane motion over that of

Boeing’s M-CAB (or most other motion-based simulators.) Although the acceleration cues are better

represented by the VMS, its range of motion limits the range of lateral and vertical acceleration cues

available to the occupants of the VMS cab. 
Factual Information 61 Aircraft Accident Report

1.16.3.1 Eastwind Flight 517 Flight Tests

On June 22 through 24, 1996, the Safety Board conducted flight tests in the

Eastwind flight 517 incident airplane, with Boeing, FAA, and Eastwind Airlines

participation. The flight tests were to document the operation and limits of the airplane’s

yaw damper system, test and record the airplane’s responses to various rudder inputs, and

expose the captain of Eastwind flight 517 to various rudder inputs and document his

reactions to and insights on the inputs. For the flight tests, the airplane’s yaw damper

system bias remained misadjusted so that it could command 1.5° to the left and 4.5° to the

right of the rudder’s trimmed position (as it was at the time of the incident). As with the

wake vortex tests, additional test equipment and instrumentation were installed on the

incident airplane to record and document the flights.117

During the ground and flight tests,118 the incident airplane was operated with a

Boeing flight test pilot in the left seat and an FAA flight test pilot in the right seat; the

captain of Eastwind flight 517 and additional Boeing and FAA personnel were seated in

the cabin. The first flight test was conducted at altitudes between 8,000 and 13,000 feet

msl, at an airspeed of 250 knots, and with the yaw damper engaged and the flaps and

landing gear retracted. Attempts were made to induce an in-flight yaw damper failure and

subsequent hardover command through a series of rapid and abrupt rudder pedal and

control wheel inputs; however, the flight test pilots were unsuccessful in inducing a yaw

damper hardover. Before the second test flight, the incident yaw damper coupler was

removed, and a different yaw damper coupler, a yaw damper fault insertion box, and

associated wiring were installed to allow the flight test pilots to command a yaw damper

hardover condition using an electrical signal. 

The second flight test was also conducted at altitudes between 8,000 and 13,000

feet msl; at an airspeed of 250 knots; and with the yaw damper engaged, autopilot

disengaged, and flaps and landing gear retracted. Yaw damper hardovers to the left and

right were electronically commanded by the flight crew via the cockpit switchbox, and the

maximum rudder and control wheel positions needed to stabilize the airplane were noted.

Additionally, rudder pedal release tests were conducted using the following procedures: 

117 During the Eastwind flight tests, the PADDS system recorded 28 parameters, including 5 yaw

damper-related parameters and 3 rudder system parameters, which provided valuable data for investigators.

(The Eastwind flight 517 FDR recorded 11 parameters, none of which provided yaw damper or rudder

position information.) The PADDS system recorded all data at higher sampling rates (20 times per second)

than the FDR system that was installed on the airplane at the time of the incident. Additionally, a digital

audiotape was installed to record CVR data beyond the normal 30-minute duration, and a Boeing noise

recording system was installed to record noises emanating from the aft cabin and galley area during the

flight tests (to determine the source of the thump noise described by the flight attendants from flight 517).

118 Ground taxi tests were conducted before each of the two test flights to test the rudder and yaw

damper system for anomalies that would preclude safe test flights and perform operational tests of the

additional test equipment and instrumentation installed on the airplane. 
Factual Information 62 Aircraft Accident Report

• While maintaining straight and level flight using control wheel and rudder

pedal inputs, right rudder trim was added in 1° increments, from 0 to 6° trailing

edge right rudder position. 

• Rudder pedal inputs were released.

• Rudder position and control wheel input needed to control bank angle were

noted. 

During portions of the second flight test, the captain of Eastwind flight 517

occupied the right pilot seat previously occupied by the FAA flight test pilot119 and

controlled the airplane during a series of yaw damper hardover insertions and rudder pedal

release conditions (including four yaw damper hardovers of 4.5° right rudder, three rudder

pedal releases from the 6° right rudder trim position, and three rudder pedal releases from

the 4° right rudder trim position). 

Recorded FDR and PADDS data indicated that the captain responded to the first

yaw damper hardover 0.6 seconds after its initiation by stepping on the left rudder pedal.

The flight test FDR data indicated that the airplane’s bank angle increased to a maximum

of about 4.5° right wing down (RWD) and that its heading changed about 2° (both in

1 second) before the airplane responded to the Eastwind flight 517 captain’s recovery

efforts. During the three subsequent yaw damper hardovers, the Eastwind flight 517

captain, at the direction of the Boeing flight test pilot, allowed the airplane to respond to

the hardover condition for a few seconds before the captain responded with rudder pedal

input.

When the Eastwind flight 517 captain was exposed to the 6° right rudder pedal

release test condition (during which FDR and PADDS equipment recorded a 4° right

heading excursion and a bank angle increase to 8° RWD, both within 2 seconds), he stated

“that was more like it.” (The incident FDR data indicated a 4.1° right heading change

within 1 second and a maximum bank angle increase to 10° RWD within 2 seconds.) 

The Eastwind flight 517 captain indicated that the motion of the airplane during

the portion of the second test flight, for which he was seated in the right pilot seat in the

cockpit, was similar to the airplane motion he recalled experiencing during the incident

and that the yoke pressure felt the same. However, the captain indicated that the rudder

response during the first and second tests seemed different from what he experienced

during the incident. He stated that the rudder felt stiffer and less effective during the actual

incident.

119 The FAA test pilot moved to the cockpit observer jumpseat and continued to control the yaw damper

hardover switchbox.
Factual Information 63 Aircraft Accident Report

1.16.4 Flight Control Characteristics Flight Tests (Blowdown 

and Crossover Airspeed)

In September 1995, a series of flight tests were conducted from Boeing Field in

Seattle, Washington, to validate existing and acquire additional aerodynamic data for the

737-300 flight simulator data tables, study the airplane’s performance during high sideslip

conditions, and measure the airplane’s response to various roll and yaw inputs. The flight

tests were conducted with the USAir 737-300 that was used for the wake vortex tests

conducted in September and October 1995 (see section 1.16.2). The flight tests included

operating the 737-300 (instrumented with the Boeing PADDS system) at a flaps 1 setting

and at airspeeds from 150 to 225 knots calibrated airspeed (KCAS). The flight test

conditions included steady heading sideslips; airplane roll response to control wheel input,

rudder pedal input, cross controls of control wheel and opposite rudder pedal input, and

combined controls of control wheel and rudder pedals; autopilot turns; and slowdown

turns to aerodynamic stall. 

Several flight test conditions required the test pilots to maintain control of the

airplane and, if possible, a constant (or steady) heading by using the control wheel to

oppose full rudder surface deflections. These tests revealed that, in the flaps 1

configuration and at certain airspeeds, the roll authority (using spoilers and ailerons) was

not sufficient to completely counter the roll effects of a rudder deflected to its blowdown

limit. The airspeed at which the maximum roll control (full roll authority provided by

control wheel input) could no longer counter the yaw/roll effects of a rudder deflected to

its blowdown limit was referred to by the test group participants as the “crossover

airspeed.”

The flight tests revealed that, in the flaps 1 configuration and at an estimated

aircraft weight of 110,000 pounds,120 the 737-300 crossover airspeed was 187 KCAS at

one G.121 At airspeeds above 187 KCAS, the roll induced by a full rudder deflection could

be corrected by control wheel input; however, in the same configuration at airspeeds of

187 KCAS and below, the roll induced by a full rudder deflection could not be completely

eliminated by full control wheel input in the opposite direction, and the airplane continued

to roll into the direction of the rudder deflection. The flight test data also confirmed that an

increase in vertical load factor, or angle-of-attack, resulted in an increase in the crossover

airspeed. 

The flight tests also revealed that the test airplane’s rudder traveled slightly farther

than originally indicated by Boeing’s 737-300 computer models before reaching its

aerodynamic blowdown limit. Data from the flight test were incorporated into Boeing’s

M-CAB engineering software, and flight simulations were performed. The M-CAB flight

simulations indicated that, with a rudder deflected to its aerodynamic blowdown limit and

in the configuration and conditions of the USAir flight 427 accident airplane, the roll

120 At the time of the initial upset, USAir flight 427 had an estimated operating weight of 108,600

pounds and was operating at an airspeed of about 190 knots.

121 One G is equivalent to the acceleration caused by the earth’s gravity (32.174 feet/sec2

). 
Factual Information 64 Aircraft Accident Report

could not be completely eliminated (and control of the airplane could not be regained) by

using full control wheel inputs if the airspeed remained below 187 KCAS. The pilots who

were involved in the flight and simulator tests indicated that successful recovery required

immediate flight crew recognition of the upset event and subsequent prompt control wheel

inputs to the full authority of the airplane’s roll control limits and pitch flight control

inputs to maintain a speed above the crossover airspeed.122 To return the airplane to a

wings-level attitude, the pilots had to avoid excessive maneuvering that would increase

the vertical load factor, or angle-of-attack, and thus increase the crossover airspeed. 

In June 1997, additional flight tests were conducted by FAA and Boeing test

pilots123 using a newly manufactured 737-500124 to obtain additional information

regarding crossover airspeeds and quantify 737-300 controllability, handling

characteristics, techniques, and altitude required for recovery from rudder deflections to

aerodynamic blowdown limits. (Earlier flight tests had been limited to 75 percent of the

available rudder rate deflection because of concern that, at higher deflection rates, the

vertical fin would be overstressed during a dynamic maneuver.) The flight test conditions

included full-rate rudder deflections and/or maximum rate aileron roll maneuvers that

were initiated at various airspeeds, configurations, and aircraft weights and with variable

pilot responses (delayed and immediate response, aggressive flight control input, and

autopilot on and off). During the tests, strain gauges attached to the vertical fin revealed

that the full-rate rudder deflections did not exceed the design loads for the vertical fin

structure. Because the flight test airplane was to be subsequently delivered to a customer,

all maneuvers were conducted within the airspeed, G, and roll angle limitations specified

in the 737 airplane flight manual (AFM). 

The Boeing test pilots described the handling of the airplane when they applied

full left rudder with the test airplane configured similar to the USAir flight 427 accident

airplane (190 knots and flaps 1). One pilot described how the airplane would initially

respond to aileron inputs and begin to roll out of the rudder-induced bank attitude and

how, by pulling back on the control column and adding some vertical load factor, the

recovery could be stopped and the airplane could hang in a sideslip bank. The test pilot

said that he did not apply additional aft column inputs at these moments but that these

inputs would have caused the airplane to “roll into the rudder.” The pilot concluded that

“you can control roll rate with the control column.” The other Boeing test pilot said that,

in referring to the control inputs required to perform a recovery from full rudder input,

“there is some technique required between the G [normal load factor] and the roll.”

122 Pilots who participated in these M-CAB simulations reported that, for a full rudder hardover

condition with an airspeed greater than 187 KCAS, they initially applied full opposite control wheel and

then slightly reduced the wheel deflection in response to the recovery rate. The pilots then found it necessary

to apply more wheel to counter the roll being produced by the rudder. The pilots reported that three such

cycles of the wheel were normally required to find the control wheel position that would neutralize the roll. 

123 Safety Board staff were not on board the airplane during the flight tests. However, Safety Board

investigators helped design the test procedures, attended postflight debrief sessions and discussions, and

reviewed all the data gathered during the flight tests.

124 The 737-500 series airplane is approximately 8 feet shorter than the 737-300 series and requires less

roll authority (ailerons and spoilers) to counter the effects of a rudder deflection. After the flight tests,

Boeing adjusted the data in the 737 simulator model to account for this difference. 
Factual Information 65 Aircraft Accident Report

The flight test pilots affirmed that the Boeing M-CAB and computer simulation

models incorporated the tradeoff between normal load factor and roll control but that the

tradeoff occurred at a greater load factor in the simulator than in the airplane. (Thus, the

airplane was somewhat more prone to a loss of roll control from an aft control column

input than was the simulator.) The flight test pilots said that the Boeing simulation would

need to be modified according to the flight test results. 

Boeing’s flight test pilots stated that, when they allowed the airspeed to increase to

about 220 to 225 KCAS (sacrificing altitude as necessary to maintain airspeed),125 the

airplane recovered easily. The pilots reported that, when they initiated the event at higher

airspeeds, the airplane was easier to control and that recovery was accomplished with less

roll. The Boeing flight test pilots also indicated that, when the airplane was configured at

higher flap settings at the initiation of the event, recovery was easier but that the airframe

experienced considerable vibration.

1.16.5 Examination and Testing of Flight Control 

Systems/Components 

The 737 flight control systems from the USAir flight 427 airplane were examined

and tested to determine if they were a factor in the upset event and the accident.

Examination of the airplane’s flight control system components revealed no physical

evidence of preimpact malfunction. The Safety Board also examined and tested the

accident airplane’s rudder system components, including rudder pedal assemblies; rudder

cables; and standby and main rudder PCUs, yaw damper, linkages, and input arms. 

1.16.5.1 Rudder Pedal Assemblies

The accident airplane’s rudder pedal assemblies from both flight crew positions

were removed from the wreckage. Both rudder pedal assemblies were fragmented and

heavily distorted. The rudder pedal assembly from the first officer’s position exhibited

postimpact fire damage. The left rudder pedal pivot lugs on both rudder pedal assemblies

were fractured near their respective support tubes.126 Figure 12 shows a diagram of the

rudder pedal assemblies as installed on the accident airplane.

The rudder pedal assemblies were visually and microscopically examined by a

Safety Board metallurgist and others on December 8, 1994, at Boeing’s Equipment

Quality Analysis Laboratory in Renton, Washington. According to the Safety Board

metallurgist, microscopic examination of the fracture faces revealed features typical of

bending overstress fractures on both pivot lugs. With the support tubes positioned

vertically, both left rudder pedal pivot lugs failed in the forward (and slightly downward)

125 The test pilots indicated that the amount of altitude lost during the recoveries varied but that, with a

prompt response and good technique, control could be regained with a loss of less than 500 feet. The pilots

also indicated that, if they did not have to comply with the vertical load factor restrictions imposed for the

tests, they would have been able to recover with less lost altitude.

126 During normal operation, the rudder pedal pivot lugs are held stationary in the upper ends of the

support tubes and allow the pedals to pivot and articulate as they are activated and as the brake is applied. 
Factual Information 66 Aircraft Accident Report

direction. The right rudder pedal pivot lugs on both assemblies were bent but remained

attached to their support tubes. With the support tubes positioned vertically, the right

rudder pedal pivot lug at the captain’s position was bent forward and downward, but the

right rudder pedal pivot lug at the first officer’s position was bent forward and upward. 

1.16.5.2 Tests to Determine the Effects of Rudder Cable External Forces, 

Breaks, and Blocked Input Linkage 

The Safety Board used an out-of-service 737-200 for a series of flight control

system tests that examined the effects that external (nonsystem) inputs to the rudder cables

from within the airplane’s cargo compartment and rudder cable separations127 would have

on the rudder. All tests were conducted on the ground (with no aerodynamic loads). CVR

equipment similar to that on the USAir flight 427 airplane was installed on the test airplane.

To examine the effects of pressure applied to the rudder cable from within the cargo

compartment (possibly from a passenger stepping through a soft spot in the cabin floor),

incremental loads of between 50 and 250 pounds were applied vertically to the rudder

cables within the forward cargo compartment, and the rudder deflection was measured. The

testing showed that a maximum rudder deflection of 3.2° was measured when a 250-pound

force was applied to the left rudder cable; all other test conditions (lesser loads and the right

rudder cable) resulted in rudder deflections of no more than 2.3°.

Figure 12. Rudder pedal assemblies as installed on the USAir flight 427 airplane.

127 The maintenance records for the USAir flight 427 airplane indicated that a temporary patch had been

made to the floor above an area of the rudder cable. Thus, the testing attempted to simulate an outside force

from above the patched area that could have deflected the rudder cable.

Captain’s Rudder Pedals

First O fficer’s R udder Pedals

Forward Rudder

 Control Quadrants

Bus Rod between

Captain’s and First 

Officer’s Control 

Quadrants
Factual Information 67 Aircraft Accident Report

To examine the effects on the rudder system of rudder cable separations, the rudder

cables in the test airplane were cut, and the rudder system responses (sounds and rudder

pedal and rudder surface movement) were recorded. A cable was cut during two tests

(under light and no load conditions at two different locations within the fuselage), and the

rudder cable was replaced between test conditions. The first cable cut was performed at

fuselage station 360128 with no pressure on the rudder pedals. A loud “bang” was recorded

by the CVR when the cable was cut, but no rudder pedal or rudder surface movement

resulted. The second cable cut was performed at fuselage station 259.5129 with the pilot’s

feet resting lightly on the rudder pedals. Another “bang” was recorded by the CVR when

the cable was cut, and no rudder surface movement resulted. However, the left rudder

pedal, which corresponded to the cut cable, moved to the -5° position. In both cable

separation conditions, normal leg force applied to the rudder pedals after the cable cut

resulted in the rudder pedal connected to the cut cable moving to the floor, but the rudder

pedal attached to the uncut cable maintained the ability to move the rudder surface in the

direction of the intact cable. 

The Safety Board’s review of the sounds recorded by the CVR during the rudder

cable separation tests revealed that the sounds generated by cutting the rudder cables were

impulsive and had energy that was distributed throughout the frequency spectrum.

Another characteristic of the sounds recorded during the tests was the multiple secondary

signals that appeared to be the result of mechanical “ringing” of the rudder cable system.

The unknown thump sounds recorded by the CVR during the upset of flight 427 (see

section 1.16.7.1) were in the low-frequency (below 500 Hz) range only and exhibited no

“ringing” or secondary signals.

Other tests were conducted to determine the effects on the rudder system of the

presence of a foreign object or blockage between the main rudder PCU external input

crank and one of the PCU external manifold stops. Figure 13 shows the locations of the

737’s external manifold stops. Safety Board investigators inserted a business card (folded

three times) between the manifold body stop and the input crank arm and observed the

effect of this blockage on yaw damper and rudder pedal inputs. 

The tests indicated that, when the input crank arm’s movement was blocked at the

aft stop, a sustained left yaw damper command caused the rudder to travel to its full left

deflection. The test also showed that, when the blockage was positioned at the forward

side of the external input crank, a sustained right yaw damper command caused the rudder

to travel to a full right rudder deflection. When the yaw damper command was sustained,

the movement in either direction could not be stopped until the blocking material was

removed from its position between the manifold stop and the external input crank; yaw

damper (or rudder pedal) input opposite the direction of rudder movement tended to keep

the blockage in place. When the yaw damper input command was stopped, the rudder

128 Fuselage station 360 is located near seat row 5 in the cabin; maintenance records for the accident

airplane indicated that a soft interim floor panel repair was accomplished in this location. 

129 Fuselage station 259.5 was selected for the cable cut test because that location allowed easy control

cable access. 
Factual Information 68 Aircraft Accident Report

surface returned to neutral. In some tests, yaw damper or rudder pedal input in the

direction of the rudder movement dislodged the blockage, and normal rudder control was

regained. 

Examination of the main rudder PCU, as installed in an in-service 737 airplane,

revealed that the PCU linkage was positioned so that it prevented a foreign object from

dropping into the space between the aft stop and the crank arm. The PCU’s orientation

would also make it difficult for a foreign object to lodge between the forward stop and

input link. The external summing lever effectively covers the gap in the PCU retract

direction (left rudder command). 

1.16.5.3 Examination and Testing of Standby Rudder 

1.16.5.3.1 Metallurgical Examination of Standby Rudder Components

The Safety Board conducted a metallurgical examination of USAir flight 427’s

standby rudder actuator input shaft, bearing, and thrust bearing race in its materials

laboratory in Washington, D.C. Initial examination of the components revealed the effects

of galling. The input shaft exhibited two areas of material buildup on the lubricated land

surface on the inboard side of the shaft’s Teflon seal. The bore of the bearing in which the

shaft turns contained two shallow cavity areas corresponding in orientation, size, and

shape to the two areas on the shaft that contained the material buildup, and the thrust

bearing race exhibited a non-uniform roller contact pattern. 

Energy dispersive x-ray spectrum (EDS) analyses were performed on the input

shaft and the bearing. According to a Safety Board metallurgist, EDS performed on the

surface of the input shaft in an area not affected by the galling produced a spectrum

consistent with the type 440C stainless steel specified for the input shaft. However, the

Figure 13. Locations of Boeing 737 main rudder PCU external manifold stops.

Internal Servo Stops

External M anifold Stop

(Retract)

External Servo Stops

External M anifold Stop

(Extend)
Factual Information 69 Aircraft Accident Report

metallurgist stated that EDS performed on the bearing bore and the galled areas of the

shaft generated spectra that were consistent with the type 416 stainless steel specified for

the bearing. Measurements of the accident airplane’s standby rudder actuator components

were within the engineering drawing specifications. 

1.16.5.3.2 Standby System Actuator Binding/Jam Tests

Safety Board investigators conducted tests on the rudder system of a 737 to

examine the effects of variable input shaft binding forces and input shaft binding at

different positions, with and without yaw damper input and various hydraulic system

failures. Before testing, the investigators verified that the airplane’s rudder system rigging

and main and standby rudder PCU installations met in-service standards; the investigators

also cycled the rudder systems to verify instrumentation and operational limits and

establish a baseline. The standby rudder actuator was removed from the test airplane and

replaced with a standby rudder actuator that was selected for the testing because it

exhibited input shaft and bearing galling similar to the unit that was installed on the USAir

flight 427 accident airplane. 

The following rudder commands were input with the main and standby rudder

PCUs pressurized:130 full rudder pedal inputs in both directions with the yaw damper

disengaged, full rudder pedal inputs in both directions with the yaw damper engaged, and

full yaw damper commands in both directions. In all of these tests, the rudder system

functioned normally, and higher-than-normal pilot rudder pedal forces were not

required.131

After these tests, the standby rudder actuator was replaced with one that had an

input shaft that could be adjusted to various levels of binding (intended to simulate

galling). The replacement actuator was used to determine the effects of binding of the

standby rudder input shaft and bearing and the various levels of force that would be

required to overcome such binding. Tests were conducted with the actuator adjusted so

that 60 to 70 and 100 pounds of force were required to move the actuator input arm. The

tests also measured the effects of left, right, and no yaw damper commands.

The tests showed that, with 60 to 70 pounds of standby rudder binding force, the

rudder could travel 7° to the left with a full left yaw damper command and 8° to the right

with a full right yaw damper command. With 100 pounds of standby rudder binding force,

the rudder could travel 8° to the left and right with full left and right yaw damper

commands, respectively.132 Test conditions that simulated hydraulic system failures, along

with binding of the standby actuator, did not significantly affect the rudder system’s

130 The standby and main rudder PCU input rods move together regardless of which PCU is pressurized.

131 According to Boeing, normal input force is about 0.5 pounds. 

132 The 737-300 yaw damper still commanded ± 3° of motion. Therefore, if the standby actuator

jammed when the rudder was positioned 3° left of its neutral position, the yaw damper could command

rudder movement 3° in either direction, resulting in left rudder movement to 6° of left, or right deflection

back to neutral. If the rudder was at 6° left when the standby actuator binding occurred, the yaw damper

could command rudder movement that would result in between 3 and 9° of left rudder deflection. 
Factual Information 70 Aircraft Accident Report

operation. Ergonomic research indicates that pilots should have no difficulty applying 80

to 100 pounds of leg-pushing force against the rudder pedal, thus overriding the effect of

such standby rudder actuator binding. (For additional information regarding ergonomic

research on pilot rudder pedal forces, see section 1.18.8.) 

Tests were also conducted to determine the effects of a hard jam (not just binding)

of the standby rudder actuator input shaft and bearing at the neutral, 3° (simulating left and

right yaw damper inputs), and maximum standby rudder actuator positions (limited by the

main rudder PCU external manifold stop). The tests showed that, with the standby rudder

actuator input shaft jammed at the neutral position, the rudder could travel 6° to the left

and 4° to the right with respective full yaw damper commands. A force of 45 pounds on

the left rudder pedal or 55 pounds on the right rudder pedal would return the rudder to the

neutral position; when the yaw damper command was turned off, the rudder remained at

neutral. 

When the standby rudder actuator input shaft was jammed at the 3° left position,

the rudder could travel 10° to the left with a full left yaw damper command and 3° to the

right with a full right yaw damper command. With the yaw damper at its full deflection, a

force of 95 pounds or 25 pounds on the appropriate rudder pedal, respectively, would

return the rudder to the neutral position. When the yaw damper was turned off, the rudder

was positioned 2° left of the neutral position 

When the standby rudder actuator input shaft was jammed at the 3° right position,

the rudder could travel 2° to the left with a full left yaw damper command and 13° to the

right with a full right yaw damper command. With the yaw damper at its full deflection, a

force of 30 or 110 pounds on the appropriate rudder pedal, respectively, would restore the

rudder to the neutral position. When the yaw damper was turned off, the rudder was

positioned 4° to the right of the neutral position. 

With the standby rudder actuator input shaft jammed at a position required for a

full maximum rate left rudder input (limited by the main rudder PCU external manifold

stop), the rudder traveled 19° to the left of the neutral position. Under this test condition,

65 pounds of force applied to the right rudder pedal returned the rudder to the neutral

position. The 65-pound force to the right rudder pedal would create a 140-pound force on

the standby PCU input arm. 

Regardless of whether the standby rudder actuator input shaft was jammed at

3° left or 3° right of the neutral position or at the main rudder PCU body stop in either

direction, the rudder moved to an off-neutral position when the hydraulic system was

powered. With the standby rudder actuator input shaft and bearing jammed at the neutral

position, no initial offset to the rudder occurred. In every case, the rudder could be

centered by applying rudder pedal force to oppose the offset. 

The replacement standby actuator contained an input shaft and bearing that

displayed galling similar to the unit that was installed in the United flight 585 airplane.

Subsequent testing indicated that a full 3° yaw damper command would result in a

5° rudder movement to the left and a 6° rudder movement to the right. Another galled
Factual Information 71 Aircraft Accident Report

input shaft and bearing were installed in the standby rudder actuator, and subsequent tests

indicated that full 3° yaw damper commands to the left and right resulted in 6° of rudder

movement in the respective directions. 

1.16.5.4 Detailed Examinations and Tests of Main Rudder PCUs 

1.16.5.4.1 Detailed Examinations of Main Rudder PCU Servo Valves 

Several times during this investigation, the Safety Board subjected the USAir

flight 427 PCU133 to Parker’s postproduction acceptance test procedure (which is a

performance-based test only and does not require the measurement of diametrical

clearances). The acceptance tests did not reveal any disqualifying anomalies. To determine

the diametrical clearances that existed within the USAir flight 427 PCU servo control

valve slides and clarify the variability of clearances that passed the acceptance tests, the

Safety Board measured the clearances between the primary and secondary slides and

between the secondary slide and the servo valve housing on three PCU servo valves—a

new-production PCU servo valve and the PCU servo valves from the USAir flight 427 and

Eastwind flight 517 airplanes.134 The primary and secondary slides and the servo valve

housing of each PCU were measured in three places—at the input lever end, midpoint, and

spring end (see figure 10). Table 3 lists the minimum diametrical clearances (in inches)

measured for each PCU at each position.

As part of its investigation, the Safety Board conducted further detailed

examination and testing of the main rudder PCU servo valves from USAir flight 427,

Eastwind flight 517, and United flight 585. The Safety Board also examined a “minimum

tolerance” servo valve that was used by Boeing during thermal shock testing (see section

1.16.5.4.7);135 new-production servo valves; the servo valve from the Silk Air flight 185

accident in Palembang, Indonesia;136 and five servo valves supplied by Parker that had

been removed from service and had varying hours of operation (referred to as exemplar

valves). The Safety Board’s materials laboratory examined the primary and secondary

133 Postaccident tests and examinations were performed on the USAir flight 427 main rudder PCU servo

valve and the primary and secondary slides in their condition as recovered. The PCU actuator rod and

external input linkage, however, exhibited impact damage that precluded normal operation; thus, these

components (and their associated hardware) were replaced to facilitate testing. 

134 It was not possible to measure the clearances that existed within the PCU servo valve from United

flight 585 because the valve was damaged by the postaccident fire and attempts to remove the PCU from the

wreckage. 

Table 3. Diametrical clearance measurements (in inches) for three PCUs.

Measurement 

position

427 PCU 

slide to 

housing

427 PCU 

slide to 

slide

517 PCU 

slide to 

housing

517 PCU 

slide to 

slide

New PCU 

slide to 

housing

New PCU 

slide to 

slide

Input lever end 0.000130 0.000170 0.000190 0.000200 0.000195 0.000190

Midpoint 0.000140 0.000140 0.000170 0.000180 0.000215 0.000200

Spring end 0.000170 0.000150 0.000180 0.000190 0.000190 0.000210
Factual Information 72 Aircraft Accident Report

slides and housing from each of these main rudder PCU servo valves137 using a specially

designed borescope and video recording system. Each segment of the primary and

secondary slides’ outside diameter surfaces, the metering ports,138 and the inside diameters

of the secondary slide and the servo valve housing were examined with a 90° borescope at

magnifications up to 130 times. The outside diameter surfaces of the primary and

secondary slides were also examined with a binocular microscope. 

A few small chipped areas were noted on the metering edges of the primary slide

of each of the units examined; the locations of the chipped areas did not correspond

circumferentially to the metering port areas. Examination with a scanning electron

microscope (SEM) revealed that the dimensions of the largest chipped area on the USAir

flight 427 primary slide was 0.006 inch in circumference by 0.002 inch in length. The

other primary slides examined (including the new-production servo valve primary slide)

had chipped areas of similar or larger size yet still met specifications. 

The metering ports for the secondary slide and the servo valve housing inside

diameter surfaces were also examined using a 15° borescope so that the metering port

edges could be better viewed. No evidence of deformation or distress was noted on any of

the metering ports on any of the secondary slides and servo valve housings.

In addition, small deposits of material that appeared to have the same composition

as the secondary slide were observed on the slide’s outside diameter surface adjacent to

the metering edge. To identify the origin of these material smears, the Safety Board

reviewed Parker’s manufacturing procedures. This review found that, during manufacture,

the servo valve slides are trimmed (or cut) at the metering edges, burr-wiped (or polished),

and functionally tested in matched assemblies. The Safety Board obtained from Parker

135 This servo valve was specifically selected from existing stock because it had the tightest tolerances

between the primary and secondary slides and the secondary slide and the servo valve housing that would

pass the PCU acceptance test friction requirements. According to Boeing, the diametric clearance between

the secondary slide and the servo valve housing was 0.000070 inch. (The same clearance in the USAir flight

427 valve was 0.000130 inch.)

136 The December 19, 1997, accident involving Silk Air flight 185, a 737-300, 9V-TRF, had not, as of

March 1999, revealed any evidence that the accident was related to a rudder anomaly. The airplane was en

route from Jakarta, Indonesia, to Singapore when it disappeared from the ATC radar screen at 35,000 feet

msl and crashed at the mouth of a river about 33 miles northeast of Palembang. The Safety Board is

participating in the Indonesian government’s ongoing accident investigation under the provisions of Annex

13 to the Convention on International Civil Aviation. The airplane’s CVR and FDR were evaluated by the

Safety Board’s laboratory in Washington, D.C. That evaluation revealed that both had stopped recording

before the airplane disappeared from the radar screen. (The CVR stopped recording first and the FDR

stopped recording about 6 minutes later, 1 minute 14 seconds before the airplane’s last radar return was

recorded.) The recorded data indicated no problems with the airplane or unusual comments by the flight

crew. 

137 The main rudder PCU from the Silk Air accident airplane was examined by Safety Board

investigators under the supervision of a representative from the Indonesian government. The examination

did not reveal any evidence of a preimpact jam or failure. 

138 Metering ports are rectangular holes in the servo valve housing and secondary slide through which

hydraulic fluid flows to cause actuation of the unit. Metering edges are the sides of grooves that are cut into

the outside diameter surface of the primary and secondary slides. Flow of hydraulic fluid is controlled by

positioning the metering edges relative to the metering ports.
Factual Information 73 Aircraft Accident Report

two primary slides in an intermediate manufacturing condition to microscopically observe

the trimmed and trimmed/burr-wiped conditions. SEM examination of the trimmed-only

primary slide revealed numerous pieces of folded-over metal curled over the metering

edge at the trimmed edge of the slide. SEM examination of the trimmed and burr-wiped

primary slide showed areas on the slide’s outside diameter adjacent to the trimmed edge

that appeared to be flattened down and smoothed over, similar to that observed on the

USAir flight 427 primary slide. 

1.16.5.4.1.1 Examination of Exemplar Servo Valves for White Layer

As discussed in section 1.16.5.4.1, the five servo valves supplied by Parker that

had been removed from service were referred to as exemplar servo valves. During

manufacture, the outside diameter surfaces of the primary and secondary slides in the

servo valve were nitrided (impregnated with nitrogen to increase hardness). The nitriding

process can produce a brittle surface layer, referred to as a “white layer.” The Safety Board

considered whether such a layer, if it remained after the manufacturing process, could

have provided chips that could cause jamming of the unit. Parker reported that the

thickness of the white layer created during nitriding is monitored by cutting into samples

and that the manufacturing process removes an amount of material from the outside

diameter surface that is far greater than the typical thickness of the white layer. Also, the

grooves in the primary and secondary slides are cut after the parts are nitrided, preventing

the accumulation of the white layer at the corner between the grooves and outside

diameter surfaces. The Safety Board’s materials laboratory cross-sectioned the five

exemplar slides and found no white layer on the slides’ outside diameter surfaces or

within the grooves.

1.16.5.4.2 PCU Dynamic Testing

On September 16 through 20, 1996, the Safety Board conducted a series of tests to

examine the effects of dynamic external loads (such as those that the USAir flight 427

airplane might have experienced during the wake turbulence encounter) applied axially to

the main rudder PCU actuator rod. These tests, conducted on a new-production PCU and

the flight 427 PCU,139 included the following test conditions: (1) wake encounter

simulation tests (600- and 1,200-pound140 load inputs to the PCU in the left and right

rudder directions while the yaw damper was cycling), (2) yaw damper hardover tests

(hardover commands input coincident with 600- and 1,200-pound loads applied to the

PCU in the left and right rudder directions), (3) manual rudder input with no yaw damper

input (600- and 1,200-pound loads applied to the PCU actuator rod in the left and right

rudder directions coincident with manual left and right rudder input commands),

(4) manual rudder input with no yaw damper input but with hydraulic system pressurization

failures, and (5) a 3,500-pound input test (performed on the production PCU only). Both

PCUs responded normally throughout all tests without any abnormal motions.141

139 The PCU from United flight 585 was too badly damaged to test. 

140 The main rudder PCU output rod on the accident airplane might have been subjected to a load as

high as 600 pounds as a result of its encounter with wake turbulence from Delta flight 1083; the Safety

Board doubled that load to 1,200 pounds for the dynamic tests to establish a margin of confidence.
Factual Information 74 Aircraft Accident Report

1.16.5.4.3 Tests of Hydraulic Fluid 

During on-site and reconstruction activities for USAir flight 427, the Safety Board

obtained hydraulic fluid samples from the accident airplane’s main rudder PCU and other

portions of hydraulic systems A and B for further examination.142 After visual inspection

for color and clarity, a small portion of each fluid sample was analyzed using gas

chromatography/mass spectrometry143 and tested for moisture content; the remaining fluid

was filtered for contaminant particle counting and tested for acidity.

The tests revealed that the system A hydraulic fluid was 94 percent Skydrol LD4

fluid and that the system B hydraulic fluid was 77 percent Skydrol LD4 fluid; the

remaining percentage in both systems was identified as Chevron HyJet fluid. The average

system moisture content, color of the fluid, and average system acid numbers for the fluids

in both systems A and B met the specifications for in-service fluid limits in Boeing

Material Specification 3-11J, dated December 22, 1993.144 Table 4 shows those

specifications.

Table 5 shows the results of the contaminant particle counting tests of the

hydraulic fluid in one sample from the accident airplane’s PCU. The results correspond to

NAS 1638 fluid standards for Class 11.145

141 Because the tests showed that dynamic loads had no effect on PCU operation, the tests were not

repeated on the Eastwind PCU.

142 Tests performed using hydraulic fluid samples from the USAir flight 427 airplane could not be

conducted in accordance with standard industry practices because of the limited volume of fluid in the

samples available. According to NAS, the “fluid sample size shall be proportional of the total volume of

fluid contained in the device being checked.... The sampling procedure shall provide a method of applying

motion to the item being checked which will result in fluid agitation within, so that a reasonable assumption

shall be made that the fluid [sample] will be representative of particle dispersion in the total fluid volume.”

The hydraulic fluid samples from the accident airplane were obtained from damaged and broken

components under uncontrolled circumstances, and it is possible that the fluid samples did not represent the

true contamination level of the hydraulic fluid in the system before the accident.

143 In this analysis method, a mixture of compounds is separated by gas chromatography, and the

molecular composition of each is determined by mass spectrometry.

144 According to this document’s Qualified Products List for hydraulic fluid, both identified fluids were

classified by Boeing as Class 1, Grade A hydraulic fluids and were approved for use in 737 hydraulic

systems.

Table 4. Boeing Material Specification 3-11J specifications for in-service fluid limits.

Fluid properties In-service fluid limits

Visual Must be transparent. No phase separation or 

precipitation. All colors are satisfactory.

Percent of water by weight 0.1 to 0.8.

Neutralization (acid No.—in mg KOH/gm) 1.5 mg KOH/gm maximum.

145 As previously mentioned, Boeing ensures that the hydraulic fluid particulate count of newly

delivered airplanes meet the NAS 1638 fluid standards for Class 9. Tests conducted on hydraulic fluid

samples from the Eastwind flight 517 airplane indicated that the level of contaminants in that fluid was

roughly equivalent to the NAS 1638 fluid standards for Class 10, which permits a lower number and smaller

size of particles than Class 11 but a higher number and larger size of particles than Class 9. 
Factual Information 75 Aircraft Accident Report

1.16.5.4.4 Tests to Determine the Effects of Silting 

The primary slide metering edges are “underlapped” relative to the secondary slide

metering ports, which allows a certain amount of hydraulic fluid circulation.146 In contrast,

the secondary slide metering edges are “overlapped” relative to the servo valve housing

metering ports, which minimizes hydraulic fluid flow.147 Because of the possibility that

the fine, subfiltration-size particles that normally circulate through the hydraulic system

suspended in hydraulic fluid could build up in the servo valve and restrict the movement

of the secondary slide, the Safety Board conducted tests, using hydraulic fluid from an

in-service 737,148 to determine if such a buildup (or silting)149 within the PCU could result

in a jam of the PCU servo valve primary or secondary slides or an increase in sliding force

to cause an anomalous rudder command. The USAir flight 427 PCU external input crank

was rigidly fixed (pinned in position), which prevented the PCU servo valve from moving

off its neutral position. Hydraulic pressure was applied to the PCU in its neutral position

for about 1.2 hours to allow silting to occur. The pin was then removed.

The external input crank did not move after it was released. (According to Boeing

representatives, a servo valve bias spring normally allows the external input crank to move

toward the retract direction when the external input crank is not fixed.) A force of

Table 5. Results of contaminant particle counting tests.

Particle size 5-15 μ 15-25 μ 25-50 μ 50-100 μ >100 μ

Hydraulic

system A 482,116 8,897 1,328 70 6

Hydraulic

system B 489,510 7,631 733 5 0

146 When the primary slide is in its neutral position relative to the secondary slide, the axial position of

the metering edges on the primary slide falls short (typically by 0.001 to 0.002 inch) of closing off the

secondary slide metering ports. This shortfall allows for some hydraulic fluid to continually circulate

throughout the area. The amount of hydraulic system A fluid flowing through the servo valve when it is not

in motion varies from 300 cc/min in a new servo valve up to 3,000 cc/min in an old servo valve. The

hydraulic system B (including yaw damper) fluid flows through the servo valve at 1,370 cc/min. 

147 When the secondary slide is in its neutral position relative to the servo valve housing, the metering

edges of the secondary slide extend axially beyond (typically by 0.001 to 0.002 inch) the edges of the servo

valve housing metering ports, completely covering the metering ports and restricting hydraulic fluid flow.

However, a small amount of hydraulic fluid leakage occurs around the metering ports through the

diametrical clearance between the secondary slide and the servo valve housing. 

148 At the beginning of the testing, the hydraulic fluid used met the hydraulic fluid cleanliness limits in

NAS 1638 standard for class 10 fluid. At the end of the testing, the fluid met the limits for class 12. (See

table 2 for permissible contaminant ranges for selected fluid classes.)

149 The term “silting” refers to the accumulation of particles of contaminants in hydraulic fluid in a

hydraulic component. The particles are smaller than the filter on the inlet side of the component and tend to

settle at various edges and corners of valves and stay there unless washed away by higher flow rates. In other

words, when the servo valve is in the hydraulically neutral position, the flow of hydraulic fluid is restricted,

and the servo valve can function as a filter by catching some of the particles. These particles tend to

accumulate at the upstream side of edges and corners of narrow orifices (such as the servo valve ports);

however, movement of the servo valve from the hydraulically neutral position results in increased hydraulic

fluid flow, which tends to flush any accumulated particles through the servo valve. 
Factual Information 76 Aircraft Accident Report

4 pounds was required to move the external input crank. Normal input crank operation

requires about 1.5 pounds of force. 

1.16.5.4.5 PCU Servo Valve Chip Shear Tests

The Safety Board conducted two series of tests to determine if a chip of material

could lodge between the PCU servo valve primary and secondary slides or between the

secondary slide and the valve housing and result in a jammed servo valve. The first series

of tests were conducted at Boeing’s Equipment Quality Analysis Laboratory in January

1995 with chips of various materials that could be found in an airplane system. These

materials included rubber, Teflon, steel wire, aluminum alloys, hardened and stainless

steels, lockwire, aluminum-nickel-bronze, and chrome plating. The chip sizes were

manufactured so they would be large enough to fill as much as possible of the 0.015- by

0.045-inch primary metering ports. Chips were inserted into these metering ports at the

interface of the primary and secondary slides of a servo valve slide assembly. The primary

slide was then moved to close off the metering port. 

The tests demonstrated that, when forces of up to 44 pounds were applied150 to

move the primary slide to close off the secondary slide metering ports, all but one type of

chip sheared. The chip that did not shear was a hardened-steel chip that jammed the

primary slide to the secondary slide and did not shear with the maximum force of 44

pounds applied.151 When investigators examined the servo valve after the primary slide

jammed on the hardened-steel chip, they noted a physical mark on the surface of the

primary slide where the chip was inserted. The physical mark had the approximate size

and shape of the hardened-steel chip.

A second series of chip shear tests was conducted at Boeing’s facility in Everett,

Washington, in February 1997. These chip shear tests were similar to the January 1995

tests except that (1) the February 1997 test chips were inserted in the secondary metering

ports at the interface of the secondary slide to the servo valve housing, (2) different sizes

of hardened-steel chips were used and (3) forces of up to 140 pounds were applied. In the

February 1997 tests, all of the chips were successfully sheared, and each shearing event

created a mark on the secondary slide that was approximately the shape of the chip. The

maximum shear force needed was 140 pounds for a 0.042-inch wide by 0.014-inch thick

chip. The minimum shear force for the same material was 23 pounds for a 0.011-inch wide

by 0.013-inch thick chip.

1.16.5.4.6 PCU Tests Conducted to Determine the Effects of Air in 

the Hydraulic Fluid

To determine the effects that air in the hydraulic fluid would have on the main

rudder PCU operation, the Safety Board conducted operational tests in August 1996 of the

USAir flight 427 PCU. During these tests, nitrogen was introduced into the system A

150 According to Boeing, the PCU design allows a maximum input force of about 50 pounds to the

primary slide and 200 pounds to the secondary slide. 

151 This chip was 0.032 to 0.058 inch wide by 0.012 to 0.016 inch thick.
Factual Information 77 Aircraft Accident Report

hydraulic fluid, upstream of the PCU. (Gaseous nitrogen was used to simulate air for these

tests.) Tests were conducted with manual inputs at the external input crank with a cyclic

yaw damper input (hydraulic system A pressure off with a sustained 0.3-Hz152 cyclic

damper input, hydraulic system B pressure off with a sustained 0.3-Hz cyclic yaw damper

input, and a ± 3° stepped yaw damper command in each direction). The PCU responded

normally (the output command matched the input command) during these tests.

1.16.5.4.7 PCU Thermal Testing 

A hydraulic system thermal analysis by Boeing engineers indicated that the failure

of one of the 737 airplane’s EDPs could result in the overheating of the fluid in one of the

hydraulic systems. Further, in response to recommendations made by an independent

technical advisory panel,153 the Safety Board conducted two series of thermal tests (in

August and October 1996)154 to identify the effects of thermal variations on the operation

of the main rudder PCU. The hydraulic fluid used in the Safety Board’s silting tests was

used for both series of thermal tests.155

During the August 1996 thermal tests, a total of 12 tests were conducted: 4 on a

new-production PCU and 8 on the USAir flight 427 PCU. During the October 1996

thermal tests, a total of 19 tests were conducted: 8 on the new-production PCU and 11 on

the USAir flight 427 PCU. The tests for both series were conducted first on the newproduction PCU (to verify setup and methodology) and then on the USAir flight 427 PCU.

Testing under all of the thermal test conditions was accomplished by pushing or pulling

the external PCU input crank with a rod (simulating a left or right input command) and

using sufficient force to move the secondary slide. (In the absence of jamming or binding,

the secondary slide moves when about 12 pounds of force is applied at the input crank.)

The results of three thermal test conditions (performed on both PCUs during both

the August and October 1996 test series) are discussed in this report section. Two of these

test conditions were included in this section because the tests and their results were

representative of all other thermal tests that were conducted under conditions believed at

the time to approximate those that a 737 airplane might encounter during normal operation

(baseline and with a hydraulic system failure). The third test condition, which used hot

hydraulic fluid injected directly into a cold PCU to explore the effects of extreme

temperature differentials on the main rudder PCU’s operation, was selected for inclusion

152 0.3 Hz—about 1 cycle every 3+ seconds—approximates the airplane’s nominal dutch roll frequency

and corresponding yaw damper output to dampen dutch roll. 

153 The independent technical advisory panel was created by the Safety Board in January 1996 to review

the work of the Safety Board’s Systems Group. See section 1.18.2 for more information about the panel. 

154 The October 1996 tests used improved temperature control and data recording capabilities. For

additional information regarding thermal tests, see “Systems Group Chairman’s Factual Report of

Investigation Addendum—Main Rudder PCU Thermal Testing and Dimensional Examinations,” dated

April 18, 1997. 

155 As previously discussed, the hydraulic fluid used in the silting tests was collected from in-service

737 aircraft and met the NAS 1638 hydraulic fluid cleanliness limits for Class 10 and Class 12 fluids.
Factual Information 78 Aircraft Accident Report

in this section because the USAir flight 427 PCU exhibited anomalous behavior during

this test condition. 

For these three thermal test conditions, the exterior temperature of the PCU servo

valve housing was allowed to reach and stabilize at a temperature believed, at the time the

tests were conducted, to be representative of the vertical stabilizer cavity (where the

rudder PCU is located) of the accident airplane just before the upset (-27 to -40° F).156

These temperatures were achieved before each test without hydraulic fluid circulating

through the PCU. Also, the PCU servo valve housing continued to be cooled by the cold

ambient air inside the test chamber and was warmed to varying degrees and at varying

rates by the introduction of hydraulic fluid into the servo valve.

1.16.5.4.7.1 Baseline Test Condition

This test condition approximated the system operating temperatures that

investigators initially hypothesized for the USAir 427 accident airplane if both hydraulic

systems A and B were operating normally (PCU temperatures of about 10 to 20° F and

hydraulic fluid temperatures of about 70° F at the PCU inlet). Test results for this

condition indicated that the difference in the servo valve exterior surface temperature and

the hydraulic fluid temperature at the PCU was approximately 50 to 60° F. Both the newproduction PCU and the accident airplane’s PCU responded normally during all tests

under this condition.

1.16.5.4.7.2 Simulated Hydraulic System Failure Condition

In this test condition, the temperature of the hydraulic fluid entering the PCU was

raised to simulate a malfunction of one of the EDPs. Boeing could not provide flight test

data for the temperature of the hydraulic fluid at the PCU. Therefore, at the Safety Board’s

request, Boeing performed a thermal analysis, which indicated that a failed EDP could

raise the temperature of the hydraulic system reservoir associated with the pump failure to

180 to 207° F. (The 737 incorporates a hydraulic fluid temperature sensor near the EDPs

that provide a cockpit indication of an overheat condition when the hydraulic fluid reaches

or exceeds 220° F. The accident airplane’s CVR recorded no flight crew comment

regarding hydraulic system overheating.) Boeing’s thermal analysis also indicated that, if

the hydraulic fluid were to overheat to a point just below the threshold of the overheat

detector, the hydraulic fluid would cool to about 170° F as it passed from the hydraulic

pumps to the end of the pressurized section of the fuselage. The fluid would then pass

through about 15 feet of 3/8-inch diameter steel tube before it would reach the hydraulic

fluid inlet point on the main rudder PCU.

156 The temperatures used during these tests (-27 to -40°F) were based on the results of Boeing’s thermal

analyses. In October and December 1996, Boeing conducted flight tests to measure the operating

temperatures of the 737 hydraulic system and main rudder PCU in a normal operating environment. The

December 1996 tests indicated that the PCU servo valve housing operating temperature was greater than

-27°F, as discussed at the end of this section. 
Factual Information 79 Aircraft Accident Report

The tests for this condition were conducted with the hydraulic fluid temperature

raised to about 170° F at the point that the fluid entered the thermal test chamber. The fluid

was then cooled by the ambient conditions in the chamber (temperatures in the chamber

were between -27 and -40° F) as the fluid passed through the steel tubing into the main

rudder PCU. Testing was conducted with both hydraulic systems A and B overheated and

with only system A overheated (system B was at about 60° F). Test results for these

conditions indicated that the difference in the servo valve exterior surface temperature and

the hydraulic fluid temperature at the PCU inlet was approximately 100° F. Both the newproduction PCU and the accident airplane’s PCU responded normally during all tests

under this condition.

1.16.5.4.7.3 Extreme Temperature Differential Test Condition

This test condition examined the effects of subjecting the PCU to a relatively

extreme differential between the hydraulic fluid temperature at the PCU inlet and the

servo valve exterior surface temperature. The extreme temperature differential produced

during this test condition would not be expected during normal flight operations. For this

test condition, the PCU was cooled to about -40° F while both hydraulic systems were

depressurized (no hydraulic fluid passing through the PCU). At the beginning of these

tests, heated hydraulic fluid only from system A (at a temperature of 170° F) was inserted

directly into the PCU. The maximum temperature differential between the inlet hydraulic

fluid and the servo valve housing of 180° F was attained 25 seconds after insertion of the

heated hydraulic fluid. 

The new-production PCU responded normally under the extreme temperature

differential test condition. However, the USAir flight 427 PCU exhibited anomalous

behavior during these tests. During the August 1996 extreme temperature differential

tests, the accident airplane’s PCU responded normally for the initial three external input

crank commands, but the external input crank stuck in the full left rudder position for

about 5 seconds at the end of the fourth input command. Afterward, the movement of the

external input crank was normal, except for a hesitation in motion as the crank was pushed

and pulled on each input command in both the rudder left and rudder right directions. 

The anomalous operation of the USAir flight 427 PCU was verified by a repeat

test. During this repeat test, the PCU responded normally for one input command.

However, during the next two input command cycles, the external input crank moved

slower than normal for the left rudder command. At the end of the fourth left rudder

command cycle, the external input crank stuck in the full left rudder position for about

1 second, after which the movement of the external input crank returned to normal. 

To further examine the extreme temperature differential test condition, the PCU

temperature was once again lowered to about -40° F and stabilized, and the test was

repeated again. During this repeat test, the PCU responded normally for the first three

input commands. During the next 3 input commands, however, the external input crank

moved slower than normal during the left rudder command. At the end of each of these

left rudder command inputs, the force required to return the input crank to neutral
Factual Information 80 Aircraft Accident Report

increased to about 124 pounds for about 1 second. Afterward, the external input crank

returned to its neutral position with the application of less than 5 pounds of force. 

The October 1996 tests under the extreme temperature differential test condition,

which utilized improved temperature control and data collection systems, yielded similar

results for the USAir flight 427 PCU. Examination of the hydraulic fluid flow data

revealed that momentary, anomalous increases in hydraulic system fluid return flow

occurred during the jamming/binding. Further examination of the data indicated that the

servo valve secondary slide momentarily jammed to the servo valve housing and that the

subsequent overtravel of the primary slide resulted in an increase in system return flow

that could cause a rudder actuator reversal (travel in the direction opposite to that

commanded). Although reversal of the PCU actuator was not noted by any of the

participants or observers during the tests, the periods of anomalous hydraulic system fluid

flow observed in the data were consistent with the misporting of the hydraulic fluid from

the effects of the jammed secondary slide and overtravel of the primary slide, resulting in

a momentary output command opposite to the input command. 

1.16.5.4.7.4 Additional Testing

The USAir flight 427 PCU was disassembled and examined at Parker after both of

the August and October 1996 test series were completed. The primary slide, secondary

slide, and interior of the servo valve housing showed no evidence of damage or physical

marks from jamming or binding during the thermal testing. The PCU also passed the

functional acceptance test procedure used by Parker for validating PCU performance.

On October 4, 1996, at the Safety Board’s request, Boeing conducted a flight test

to measure the operating temperatures of the 737 hydraulic system and main rudder PCU

in a normal operating environment. A test airplane was flown for about 2 hours at an

altitude of up to 30,000 feet. Measurements included static air temperature outside the

airplane (-40° F), temperature on PCU body (20° F), and temperature of the hydraulic

fluid exiting the EDP (100° F). 

Additional temperature data was obtained during a flight test on December 6,

1996, that was conducted by Boeing (at the request of the Safety Board) with additional

instrumentation. During this flight test, a test airplane was flown for about 2 hours at an

altitude of up to 35,000 feet, and then the airplane descended to 20,000 feet for 1 hour.

Data from this flight test indicated the following temperatures at 35,000 feet: static air

outside the airplane, -58° F; hydraulic system A fluid at the outlet of the EDP, 58° F;

hydraulic system A fluid at the PCU inlet, 22° F; hydraulic system B fluid at the PCU

inlet, 34° F; PCU servo valve housing, 35° F; and ambient air around the PCU (inside the

vertical stabilizer), -15° F.

Data from this flight test indicated the following temperatures at 20,000 feet; static

air outside the airplane, -36° F; hydraulic system A fluid at the outlet of the EDP, 65° F;

hydraulic system A fluid at the PCU inlet, 35° F; hydraulic system B fluid at the PCU

inlet, 35° F; PCU servo valve housing, 38° F; and ambient air around the PCU (inside the

vertical stabilizer), 0° F. 
Factual Information 81 Aircraft Accident Report

In February 1997, Boeing independently conducted a third series of thermal

tests.157 These tests were conducted on a main rudder PCU that was specifically selected

by Boeing because it had the tightest diametrical clearances (between the primary and

secondary slides and between the secondary slide and servo valve housing) that would

pass the Parker functional acceptance test procedure frictional requirements.158

Boeing reported that this minimum tolerance PCU servo valve operated normally

for each test condition designed to simulate a hydraulic system overheat, with one or both

hydraulic systems circulating fluid through the servo valve before insertion of the heated

fluid and at Boeing’s estimated normal operating temperatures within the vertical fin

(conditions similar to those used in the Safety Board’s simulated hydraulic system failure

tests). Boeing conducted additional tests in which hot hydraulic fluid was injected directly

into the minimum tolerance servo valve. Hydraulic fluid was not circulated through the

servo valve before insertion of the heated hydraulic fluid (conditions similar to those used

in the Board’s extreme temperature differential tests). In some tests under these two

conditions, the minimum tolerance servo valve’s secondary slide jammed to the servo

valve housing (and remained jammed as long as the force on the input crank was

maintained). The smallest temperature differential between the inlet hydraulic fluid and

the servo valve housing at which the minimum tolerance PCU jammed was 145° F.

1.16.5.4.8 Rudder Actuator Reversals During Servo Valve Secondary 

Slide Jams

After the Safety Board’s October 1996 thermal tests, Boeing engineers began an

independent detailed examination of the test data. Their review of the data indicated that

the PCU servo valve responded slowly and erratically to the input commands when the

secondary slide was jammed to the housing by the thermal shock and an input was applied

to the external input arm. Boeing subsequently conducted tests using a new-production

PCU that had been modified to simulate a jam of the secondary slide to the servo valve

housing at various positions and then to simulate the application of a full rudder input to

the PCU. These tests revealed that, when the secondary slide was jammed to the servo

valve housing at certain positions, the primary slide could travel beyond its intended stop

position because of bending or twisting of the PCU’s internal input linkages (compliance).

This deflection allowed the primary slide to move to a position at which the PCU

commanded the rudder in the direction opposite of the intended command (reversal).

Specifically, the tests revealed that, when the secondary slide was jammed at positions

greater than 50 percent off neutral toward the extend or retract position and a full-rate

command was applied to the PCU, the rudder would move opposite to the commanded

position.159

157 See Boeing’s Test and Analysis of 737 Rudder Power Control Unit (PCU) Valve Thermal Jam

Potential, Boeing correspondence B-B600-16147-ASI, May 29, 1997.

158 As noted in section 1.16.5.4.1, the diametrical clearance of the minimum tolerance servo valve

(secondary slide to servo valve housing) was 0.000070 inch. (The same clearance in the USAir flight 427

main rudder PCU servo valve was 0.000130 inch. 
Factual Information 82 Aircraft Accident Report

Figures 14 and 15 show normal operation of the servo valve. Figure 16 shows the

servo valve with a secondary slide jam (normal operation). Figure 17 shows the servo

valve with a secondary slide jam and primary slide in the overtravel condition.

159 The Safety Board has investigated several fatal aviation accidents that have involved flight control

reversals. In some cases, improper maintenance resulted in an airplane’s aileron controls being connected

backward so that a pilot control wheel input intended to command a right turn resulted in a left turn. See the

following National Transportation Safety Board accident reports: ANC94LA101 (August 3, 1994),

FTW92FA218 (August 25, 1992), ATL88LA149 (June 4, 1990), ANC88FA062 (May 20. 1988),

LAX85LA104 (January 10, 1985), MIA84FA040 (December 4, 1983), and MKC83FA090 (April 15, 1983).

Also, see National Transportation Safety Board Briefs of Accident 1469 (August 20, 1982) and 3-1496

(June 9, 1976).

Figure 14. Normal operation of the 737 PCU servo valve with slides in the neutral 

position (no jam).

5#####/HIW####3###5LJKW#####5

Primary Slide

P rim a ry an d S e c o n d ary S lid e s a t Ne u tra l

Ru d d e r Ra te = 0

Neutral

Secondary Slide

Valve Body
Factual Information 83 Aircraft Accident Report

Figure 15. Normal operation of the 737 PCU servo valve with slides in the extend 

command position (no jam).

Figure 16. PCU servo valve intended operation with the secondary slide jammed to the 

servo valve housing and primary slide opposing.

No rm a l Fu ll Rate Co m m a n d -

P rim a ry & S e c o n d a ry S lid e s Fu ll Op e n

Rudde r Rate TEL

5#####/HIW####3###5LJKW#####5

Primary Slide

Neutral

Secondary Slide

Valve Body

Inte nde d Ope ratio n:

S e c o ndary S lide Jam m e d Full Ope n, Prim ary S lide Oppo s ing

(Fu ll Cro s s Flo w )

Rudde r Rate = 0

Secondary Slide - Jam med To Valve Body

5#####/HIW####3###5LJKW#####5

Primary Slide

Neutral

Valve Body
Factual Information 84 Aircraft Accident Report

After studying the thermal test conditions in which the USAir flight 427 main

rudder PCU jammed, the Safety Board attempted to determine the combined effects of

PCU servo valve secondary slide jamming and input linkage deflections (compliance) to

determine if the USAir flight 427 PCU was more susceptible to reversal than other servo

valves. These tests were conducted in November 1996 on three PCUs: a new-production

PCU, the USAir flight 427 PCU, and the Eastwind flight 517 PCU. For this series of tests,

a tool was used to mechanically jam the secondary slides of all three PCUs to their

respective servo valve housings. Manual inputs were then applied to the PCUs with the

yaw damper energized and deenergized (no yaw damper command was applied in both

cases). When inputs at a less-than-maximum rate were made to the PCU, all three PCUs

operated normally. However, if the external input crank rate exceeded the capability of the

PCU to respond at its maximum rate, the input caused deflection of the internal linkages

(that is, caused them to bend or twist), resulting in overtravel of the primary slide and a

reverse rudder response (that is, a response opposite to that commanded). 

To identify the threshold for reversal, the Safety Board conducted tests on the three

PCUs to determine the distance that the secondary slides had to be placed away from the

neutral (“no rudder command”) position to result in rudder actuator reversal when an input

force was applied to the PCU. The tests indicated that each of the three PCUs would stall

(stop movement) or reverse when the secondary slide was jammed at or beyond the

following positions (expressed as a percentage of full secondary slide travel from the

neutral position): 

Figure 17. PCU servo valve with the secondary slide jammed to the servo valve housing 

and the primary slide in the overtravel condition.

S econdary Slide - Jam med To Valve Body

Ne w ly Dis c o v e re d Fa ilu re Effe c t:

S e c o n d ary S lid e J am m e d Fu ll Op e n , P rim ary S lid e Ov e r-S tro ke d

In Oppo s in g Dire c tio n

Ru dde r Rate TEL

5#####/HIW####3###5LJKW#####5

Primary Slide

Neutral

Valve Body
Factual Information 85 Aircraft Accident Report

• New-production PCU: 38 percent in the extend direction, 54 percent in the

retract direction.

• USAir flight 427 PCU: 12 percent in the extend direction, 41 percent in the

retract direction.

• Eastwind flight 517 PCU: 17 percent in the extend direction, 30 percent in the

retract direction. 

On August 20, 1997, the Safety Board conducted additional tests on the USAir

flight 427 and Eastwind flight 517 PCUs to determine the effects of a jammed secondary

slide on the force and rate of rudder movement. For these tests, each PCU was installed in

a test fixture at Parker that simulated the airplane installation, and the servo valve

secondary slide was jammed with the jamming tool. Table 6 shows the test results, which

indicated that the position of the secondary slide jam affected the rudder’s output (force

and rate).

1.16.5.4.9 Ground Demonstration of Rudder PCU Servo Valve Jam

In June 1997, the Safety Board participated in a ground demonstration conducted

by Boeing at its facility in Seattle, Washington.160 The demonstration was intended to

identify and document the cockpit characteristics of a rudder PCU servo valve secondary

slide jam. The demonstration was accomplished in a newly manufactured 737-300

airplane that was fitted with a special tool to simulate a rudder PCU servo valve secondary

Table 6. Test results on the effects of a jammed secondary slide on the force and rate of 

rudder movement.

PCU

Position 

(percent off neutral)

Force 

(percent of full PCU 

output capability)a

Rate 

(degrees per second)

USAir 427 0 100 31.7

USAir 427 12 50 3.9b

USAir 427 22 76 9.5b

USAir 427 50 88 17.8b

USAir 427 71 93 26.6b

USAir 427 100c ~ 100 ~ 33

Eastwind 517 0 100 31.7

Eastwind 517 22 34 4.8b

Eastwind 517 50 79 14.3b

Eastwind 517 71 89 25.4b

Eastwind 517 100c ~ 100 ~ 33

a Full PCU output capability is 5,800 pounds.

b Rudder motion was in the opposite direction from that commanded.

c The 100-percent secondary slide jam position was not tested for either PCU because of test equipment 

limitations. Force and rate values for both 100-percent positions are estimated by Boeing. 
Factual Information 86 Aircraft Accident Report

slide jam at three different positions (about 0 percent, about 25 percent, and about

50 percent of travel from the neutral position). The demonstration was conducted while

the airplane was parked on the ground with both engines off and with hydraulic systems

powered by an external source of power.

Before the demonstration began, the participants sat in the pilot seats of another

newly manufactured 737-300 and manipulated the rudder pedals to become familiar with

the feel of a normally functioning 737 rudder system on the ground. The participants then

moved to the airplane that was fitted with the special jamming tool, and each participant

manipulated the rudder pedals under the three simulated rudder jam conditions. As

recorded in the Human Performance Group Chairman’s addendum report, one Safety

Board participant described the demonstration as follows:

All demonstrations were conducted in the cockpit, with Boeing test

pilot...sitting in one of the pilot seats to coordinate the procedure.... When

I was the active participant, I sat in the right seat wearing the seat belt.

The first demonstration in the test airplane represented a jam of the

secondary slide about 25 percent off [its] neutral position. I pushed the

respective rudder pedals slowly to their full down positions as though

I were performing a slow rudder system check. The right rudder pedal

seemed easier to push down than the left pedal, although the difference

seemed subtle. I then performed about 7 tests in which I [applied] hard left

rudder. With one or two exceptions, this input triggered a rudder reversal

on the pedals. Immediately after my input, the left rudder pedal began

moving outwards until it reached the upper stop. The motion was slightly

slower than an input I would expect from a human. The motion was steady

and continued without pause no matter how hard I pushed to counter it

(“unrelenting” was a description that, at the time, seemed to capture my

impression).... [When] I...“stopped fighting” the motion, [the] action of

the rudder system ended almost immediately and the rudder pedals

returned to the neutral position. On subsequent trials, I “stopped fighting”

the rudder motion earlier, before the left pedal had reached the upper stop.

Again, the rudder motion stopped almost immediately as soon as I stopped

applying pressure, no matter where the pedal was located, and the pedals

returned to neutral. 

The second demonstration represented a jam of the secondary slide about

0 percent off [its] neutral position. I pushed each respective rudder pedal

slowly to the lower stop as though performing a rudder system check. The

right pedal again seemed easier to push than the left pedal, although the

difference was small. I also pushed the rudder pedals aggressively and

abruptly, but this did not produce a rudder reversal situation. 

The third demonstration represented a jam of the secondary slide about

50 percent off [its] neutral position. I performed about 9 trials. When

160 Representatives of the interested parties who were members of the Human Performance Group were

notified of the demonstration but declined to participate. However, party members of the Systems Group and

a representative from the expert technical panel were present during the testing and participated informally

in the tests.
Factual Information 87 Aircraft Accident Report

I moved the pedals slowly and steadily [as though performing a rudder

system check], I was generally able to move the pedals to their stops

without starting a reversal. Sometimes, however, even a slow input

initiated a rudder reversal situation (this time with the right pedal moving

to the upper stop). Any abrupt motion on the pedals initiated an immediate

rudder reversal situation. The rudder reversal motion was faster than was

the case with a jam in [the] 25 percent position, perhaps similar to a relaxed

or slow input speed by a human operator. Again, it was impossible to stop

the motion by physically pushing against the rudder pedal. On several

trials, I tried relaxing my input momentarily before the rudder pedal

reached the upper stop. I found that the rudder reversal motion continued.

This [was not true in the jam at the approximate 25 percent position], when

the relaxation of pressure seemed to automatically stop the reversal motion.

This motion was faster, easier to initiate, and more difficult to stop. 

Other participants reported similar experiences during the demonstrations They

described the rudder back pressure during the reversal as “machine-like,” “startling,” and

“relentless.”

Another Safety Board employee who participated in the demonstrations stated that

he switched the hydraulic system B flight control switch to “standby rudder” during the

simulation of a secondary slide jam near the 50-percent position, which eliminated the

rudder reversal and allowed the rudder to be centered by rudder pedal inputs in the normal

direction. He reported that the centering was slow and required more rudder pedal

pressure than in the absence of a jam but that there was no need to release the rudder pedal

pressure and reapply it to eliminate the reversal. During subsequent rudder sweeps with

the standby rudder system engaged, the rudder did not reverse. This Safety Board

employee (who is 5 feet 8 inches tall) further stated that he was able to reach the hydraulic

system A and B flight control switches in the overhead panel without difficulty from either

the left or right pilot seats. 

1.16.6 Flight Performance Simulation Studies 

During the investigation of the USAir flight 427 accident, Boeing applied a

“kinematics analysis,” that is, a technique developed from prior flight test activities to

derive from available FDR data the position of the flight control surfaces that were not

among the parameters recorded by the FDR.161 The Safety Board reviewed Boeing’s

kinematics process early in the investigation and then developed its own kinematics

programs that ran on the Board’s computer workstation. The Safety Board developed the

programs to validate the kinematics solutions being developed by Boeing for the USAir

flight 427 investigation and now has the technique available for use in future aviation

investigations.

161 Boeing’s kinematics process involves fitting curves through available FDR data (such as heading,

pitch, and roll), obtaining time histories of rates from these curves, and obtaining accelerations from these

rates. Forces, moments, and aerodynamic coefficients are then obtained from these accelerations using

Newton’s laws of physics. Boeing uses its aerodynamic models to derive flight control time histories from

the aerodynamic coefficients. 
Factual Information 88 Aircraft Accident Report

The Safety Board’s kinematic results were compared with Boeing’s kinematic

results for the same inputs. Because the review of the kinematic results indicated that more

frequent heading samples were needed to effectively perform the kinematic calculations,

the Safety Board and Boeing used interpolation techniques to curve fit the FDR’s

magnetic heading data and thereby provide data between the FDR data points. (As

indicated in section 1.11.2, the accident airplane’s FDR recorded magnetic heading data at

a once-per-second rate.) The FDR’s once-per-second magnetic heading data could be

matched by different interpolation techniques, each resulting in different rudder surface

time histories. Further, kinematics techniques magnified the noise162 that was inherent in

the accident airplane’s FDR data, so smoothing techniques were needed to reduce this

noise and minimize the potential for erratic signatures in the extracted control surface time

histories. 

Safety Board investigators used the Safety Board’s workstation-based flight

simulation computer program163 for the 737-200 and -300 to perform simulations of the

flights of USAir flight 427, United flight 585, and Eastwind flight 517.164 The flight

simulation process was used by the Safety Board, rather than the kinematics process,

because it eliminated the uncertainties introduced into the kinematics process through the

data interpolation and smoothing techniques (required because of the limited number of

FDR parameters recorded and the limited sampling of the data). The Safety Board initially

used assumed flight control (control wheel [aileron and spoilers], rudder, and control

column [elevator]) positions (based on earlier Boeing and Safety Board kinematic

solutions and FDR-recorded column position when available) as inputs into its computer

simulations and then compared the output of the simulations—such as altitude, airspeed,

and heading—with the available FDR data. Safety Board investigators then modified the

control input, reran the simulations, and continued this process (known as iteration) until a

good match with the FDR data was obtained.165

Various factors affect the extent to which the derived control surface positions

reflect the actual control surface positions. For example, the accuracy of the USAir flight

427 simulations is affected by the fidelity of the aerodynamic modeling of the airplane in

the flight conditions at the time of the upsets. The aerodynamic models used in the

simulations are validated by flight tests, but this validation process is limited by safety

162 According to page 60 of Boeing’s “Submission to the National Transportation Safety Board for the

USAir 427 Investigation,” dated September 30, 1997, “when the heading data is sampled at less than twice a

second, the rudder position derived using kinematics becomes contaminated with an overlying ‘noise’ signal

that shows up as an oscillation in derived rudder.... Proper interpolation can reduce the ‘noise’ providing

more reliable information on rudder movement.”

163 The Safety Board’s flight simulation computer program is a WindowsTM-based executive program

that uses Boeing-developed flight control, aerodynamics, and engine models to derive force and moment

time histories of the airplane. Safety Board-developed equations of motion convert these forces and

moments into airplane motion.

164 The Safety Board’s workstation-based flight simulations used computer software that describes the

physics of the motion of an airplane in flight and various computer subroutines, including those that use data

and equations from Boeing, to describe the 737’s aerodynamic characteristics and engine thrust.

165 Boeing also performed similar flight simulations on its own computer workstations. 
Factual Information 89 Aircraft Accident Report

factors, such as the structural load limits for which flight tests can be safely conducted,

and the number of flight tests to be conducted.

In addition, the computer simulations generally assumed calm air conditions.

Although most of the flight from ORD to PIT occurred in smooth air, studies of FDR,

CVR, and radar data indicate that, during the initial upset, USAir flight 427 encountered

wake vortices from the 727 that preceded it on the approach to PIT (Delta flight 1083).

Therefore, the effect of the wake was taken into account at the times when the FDR and

CVR data indicated that the accident airplane was being affected by the wake vortices.

The effects of the wake vortices on the airplane’s motion were based on a theoretical

model that was modified to account for the effects on the yawing moment that were

developed from the wake vortex flight tests and improve the match with vertical

acceleration and pitch angle FDR data.166

Further, the United flight 585 airplane most likely encountered significant winds

and turbulence; thus, the computer simulations were adjusted to account for such winds.

However, because the actual wake vortex and turbulence conditions were not known, the

respective contributions of the flight control surfaces and wake turbulence/winds to the

motion of the airplane are uncertain. For example, if a large rolling moment resulting from

a wind gust was quickly countered by the flight crew through a large control wheel

movement, the resulting roll recorded by the FDR would be relatively small. If the wake

turbulence/wind gust effect introduced into the simulation was less than the actual wake

turbulence/wind gust experienced by the flight crew, the control wheel movements

derived through the simulations would be less than the movements that actually occurred. 

Other factors affecting the accuracy of the simulation studies include

instrumentation calibration errors and time lags in data recording. In addition, the

directional gyroscopes that provided heading information to the FDRs in the Eastwind

flight 517 and United flight 585 airplanes could have introduced errors in the recording of

the heading data when the airplanes were operating in certain flight attitudes. The Safety

Board accounted for part of the potential heading gyro gimbal errors by using a computer

program especially developed for that purpose.167

166 The effects of the wake vortices were introduced into the simulations by slight modifications to the

coefficients from the 737 aerodynamic model. Initially, the wake was modeled at Boeing using a Rankine

vortex model and aerodynamic strip theory for all aerodynamic coefficient wake deltas except yaw. The

Rankine wake vortex model assumes that the rotational velocity increases linearly with distance from the

center of the vortex to the core radius. The velocity then decreases as the square of the distance beyond the

core radius. The effect of the wake on the yawing moment coefficient was obtained using empirical data

from the wake vortex flight tests. The wake was positioned relative to the airplane by Boeing to match the

peaks and valleys in the FDR-recorded vertical acceleration data. The Safety Board modified Boeing’s lift

and pitching moment coefficient wake deltas (preserving the locations of the peaks and valleys) to better

match FDR vertical acceleration and pitch angle data. The original wake resulted in a full control wheel

input at 1902:58.5, when the bank angle was about 15°. This result was judged to be an excessive response

from a human performance standpoint. A wheel response range of 40 to 60° at that time was considered

more realistic, so the wake rolling moment was modified to match a 60° wheel input. The yawing moment

from the wake resulted from the encounters of the vertical stabilizer with the wake. The vertical stabilizer

wake encounter at 1902:58.5 was extended by 0.10 second to facilitate a match with the FDR heading data.

Similarly, the vertical stabilizer wake encounter at 1903:01.5 was extended by about 0.35 second. 
Factual Information 90 Aircraft Accident Report

Because a pilot exerting considerable force on the rudder pedals could alter the

rudder blowdown limit that would result from the hydraulic actuator alone,168 the

simulations also had to account for the estimated pilot rudder pedal force time history.

This estimation was accomplished for the USAir flight 427 and United flight 585

accidents and the Eastwind flight 517 incident based on the physical characteristics of the

flying pilot, available human performance research data, and CVR information. (See

section 1.18.8 for further information.) 

The Safety Board used its computer simulation studies to evaluate a significant

number of potential scenarios for the USAir flight 427 and United flight 585 accidents and

the Eastwind flight 517 incident. The Safety Board also used Boeing’s kinematic results

(flight control surface time histories) for USAir flight 427 in performing computer

simulations to assess how well the Boeing heading (and pitch and roll) results matched the

FDR data.169 Boeing used its kinematic results in performing its own computer

simulations for Eastwind flight 517 and comparing the heading results with FDR data. 

All parties to the investigation had the opportunity to submit proposed accident

scenarios. However, only Boeing submitted detailed simulations or studies. The Safety

Board notes that Boeing may be one of the few entities in the world with the technological

ability and knowledge of the 737 airplane to conduct the complex and sophisticated

simulations that were used during this investigation to evaluate potential accident

scenarios. Accordingly, the Safety Board assumed that the alternative scenarios provided

by Boeing were the best alternatives that could be developed. The Safety Board therefore

gave serious consideration to the scenarios submitted by Boeing for the USAir flight 427,

United flight 585, and Eastwind flight 517 upset events. The results of the Safety Board’s

best-match solutions170 from simulation studies and Boeing’s kinematic solutions are

discussed in sections 1.16.6.1, 1.16.6.2, and 1.16.6.3 for the USAir flight 427 and the

United flight 585 accidents and the Eastwind flight 517 incident, respectively. 171

1.16.6.1 USAir Flight 427 Simulation Studies

USAir flight 427 was flying in calm air while making a left turn to a heading of

100°. About 1902:57, as the airplane was rolling toward wings level, it was experiencing

167 A heading gyro consists of a rotating gyro mounted inside two gimbals, and heading data is subject

to gyro gimbal error. Heading is determined by the angle of the outer gimbal to the airplane body.

Combinations of pitch, roll, and gyro rotor alignment introduce angle errors into the outer gimbal and

produce predictable heading errors that can quantified and corrected. For a further description of gimbal

error, refer to the Safety Board’s “Addendum to Eastwind Rudder Jam Study,” November 11, 1998.

168 During normal rudder operation, a considerable pilot force on the rudder pedals can result in the

rudder moving beyond its blowdown limit based on hydraulic actuator force alone. However, in a rudder

reversal situation, a considerable pilot force on the rudder pedals can reduce the blowdown limit. 

169 The USAir flight 427 FDR recorded roll attitude twice per second and pitch attitude four times per

second.

170 The Safety Board’s best-match solutions are the derived flight control surface position time histories

that best match the recorded FDR data, radar data, and human performance information. 

171 For additional information regarding the Safety Board’s simulation studies, see the Board’s “Rudder

Jam Simulation Study,” dated January 27, 1998. 
Factual Information 91 Aircraft Accident Report

airspeed deviations and accelerations consistent with wake turbulence produced by the

wake vortex of a Boeing 727.172 Within the next few seconds, USAir flight 427 rolled to

about 20° of left bank, back to 15° left bank, and then farther to the left. The airplane

entered an aerodynamic stall about 1903:08 and rolled more rapidly to the left. The Safety

Board’s workstation-based flight simulator computer program for a 737-300 airplane was

used to simulate the event. Input to the simulation for engine thrust was based on N1 (fan

speed) data recorded on the FDR. 

As previously mentioned, the flight control surface position time histories needed

for the computer simulations were not available from the FDR and had to be estimated or

derived. The Board derived the elevator position time history from the control column

position recorded by the FDR. The initial control wheel (aileron and spoilers) position

inputs were based on kinematic solutions and were then derived by iteration. The Safety

Board’s best-match simulation showed that, just after 1902:58, the wake vortex produced

a nose left heading change. This simulation assumed that the flight crew responded to the

nose left yawing motion with a right rudder pedal input about 1903:00. This scenario

further assumed that the secondary slide was jammed to the servo valve housing and that

the flight crew’s rudder pedal input resulted in a rudder motion reversal, with the rudder

reaching its blowdown limit (about 12.5°) about 1903:00. Thus, the best-match simulation

indicates that the initial wake vortex-related left yaw (and left heading change) was

followed about 1 second later by movement of the rudder to its left blowdown limit, which

resulted in a continuing left yaw/heading change.

On the basis of these assumptions, rudder position time histories were developed

for jams of the secondary slide to the servo valve housing at 100, 71, 50, and 22 percent

from the neutral position.173 The rudder position, once reversed,174 was assumed to remain

at the blowdown limit175 corresponding to a main rudder PCU servo valve jam at the

100-percent position (blowdown limit is partly dependent on jam position, airspeed, and

172 Evidence of the turbulence is reflected in the vertical acceleration and airspeed data recorded on the

FDR.

173 For more information on the Safety Board’s USAir flight 427 rudder jam studies, see “Rudder Jam

Simulation Study,” dated January 27, 1998, and “Addendum to Rudder Jam Simulation Study,” dated

February 26, 1999. In addition, the “Kinematics Validation Study,” dated August 4, 1997, contains

information regarding basic kinematics validation, curve fits, and simulation closure. 

174 In a reversal scenario, the primary and secondary slides are misaligned to produce reverse flow and

internal leakage, which creates a restricted flow and loss of pressure. Because of the reduced hydraulic

pressure ported to (moving) the actuator in the overtravel situation, the 100-percent jam resulted in the

rudder moving at a reduced rate of about 32° per second. 

175 Rudder blowdown is the maximum rudder angle resulting from a pilot-commanded full rudder input

under the existing flight conditions. It represents a balance between the aerodynamic forces acting on the

rudder and the mechanical forces produced by the PCU. The maximum rudder angle can be increased (or

decreased if the rudder reverses) beyond that produced by the hydraulic force if the pilot exerts sufficient

force on the rudder pedals. Rudder blowdown was modeled in the simulation using Boeing data and

equations that rigorously model the PCU from the valve input to rudder deflection. For the blowdown

simulation, the valve input was set to full open (full commanded rudder), and provisions for pilot rudder

pedal forces were added, which lower the blowdown angle in a reversal. The blowdown simulation was

verified by comparing its output with Boeing’s blowdown rudder plots for several conditions based on a

normally operating actuator and available flight test data. 
Factual Information 92 Aircraft Accident Report

sideslip angle) until 1903:08, about the time the airplane stalled. The timing of the rudder

inputs was modified by iteration until the simulation produced heading time histories

consistent with the FDR data.

The heading data that resulted from the simulation with the secondary slide

jammed to the servo valve housing at the 100-percent position matched the FDR heading

data better than simulations with the secondary slide jammed at the other three positions.

Control surface position data are presented for the 100-percent jam. The pilot rudder pedal

force time history is shown in figure 18a.176 The rudder surface and control wheel

positions are shown in figures 18b and 18c, and the resultant heading, bank angle, pitch

angle, and vertical acceleration data, compared with the FDR data, are shown in figures

18d through 18g, respectively.

176 The Safety Board’s best-match simulation used 400 pounds of rudder pedal force reducing to 200

pounds, based on ergonomic and other research data (see section 1.18.8). However, the Safety Board was

also able to match the USAir flight 427 FDR data using only the minimum pedal force necessary to sustain

full rudder authority (about 70 pounds). 

Figure 18a. Pilot rudder pedal force for USAir flight 427.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

0

100

200

300

400

500

600

oh ya, Isee zuh jetstreamsheez/zuhwhoasoft gruntingloud gruntingsound similar to autopilot disconnectoh #

Right 

USAir 427

Simulator Input

100% Jam Solution

Pedal Force (lbs)

Time (hr:min:sec)
Factual Information 93 Aircraft Accident Report

Figure 18b. Rudder surface positions for USAir flight 427.

Figure 18c. Control wheel positions for USAir flight 427.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-5

0

5

10

15

20

25

USAir 427

Simulator Input

100% Jam Solution

Rudder (deg)

Time (hr:min:sec)

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-20

0

20

40

60

80

100

oh ya, Isee zuh jetstreamsheez/zuhwhoasoft gruntingloud gruntingsound similar to autopilot disconnectoh #

USAir 427

Simulator Input

100% Jam Solution

Wheel (deg)

Time (hr:min:sec)
Factual Information 94 Aircraft Accident Report

Figure 18d. Heading data for USAir flight 427.

Figure 18e. Bank angle data for USAir flight 427.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

20

30

40

50

60

70

80

90

100

110

120

USAir 427

Simulator Response to 100% jam

 FDR data

 Simulation

Heading (deg)

Time (hr:min:sec)

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-80

-70

-60

-50

-40

-30

-20

-10

0

10

20

oh ya, Isee zuh jetstreamsheez/zuhwhoasoft gruntingloud gruntingsound similar to autopilot disconnectoh #

USAir 427

Simulator Response

100% Jam Solution

 FDR data

 Simulation

Bank Angle (deg)

Time (hr:min:sec)
Factual Information 95 Aircraft Accident Report

Figure 18f. Pitch angle data for USAir flight 427.

Figure 18g. Vertical acceleration data for USAir flight 427.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-30

-20

-10

0

10

oh ya, Isee zuh jetstreamsheez/zuhwhoasoft gruntingloud gruntingsound similar to autopilot disconnectoh #

USAir 427

Simulator Response

100% Jam Solution

 FDR data

 Simulation

Pitch Angle (deg)

Time (hr:min:sec)

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

0.6

0.8

1.0

1.2

1.4

1.6

1.8

2.0

2.2

USAir 427

Simulator Response

100% Jam Solution

 FDR data

 Simulation

Vertical Load Factor - Nz

Time (hr:min:sec)
Factual Information 96 Aircraft Accident Report

According to Boeing’s September 30, 1997, submission to the Safety Board,177

Boeing first improved its wake vortex model using the results of the wake vortex flight

tests. Boeing then used its kinematics process to determine the flight control position time

histories during the upset sequence of USAir flight 427. Boeing’s kinematic analysis

required that the FDR heading data be curve fit using interpolation techniques178 and then

run through data smoothing techniques. These various techniques resulted in numerous

curves that could fit the USAir flight 427 FDR heading data.179

Boeing’s scenario assumed that, about 1902:58, the first officer input right control

wheel (overriding the autopilot, which had been commanding some right control wheel)

because of the continuing left acceleration that the wake vortex encounter produced. The

first officer applied considerable right control wheel, which arrested the left roll and

increased the right roll acceleration. Boeing’s scenario then assumed that a left rudder

input occurred just after 1902:59, resulting in a left rudder movement of about 12° just

before 1903:00. About 1903:00, the full right control wheel and the left rudder inputs were

being returned to neutral (the left rudder deflection was reduced to about 3°), but the

airplane was still in the effect of the wake, which was rolling the airplane to the left. To

counter the left roll, the first officer again applied considerable right control wheel;

however, the airplane continued to accelerate in a left roll. Boeing’s scenario also assumed

that, between 1903:00 and 1903:01, the first officer again applied left rudder pedal

pressure, driving the rudder hard to the left, and maintained the left rudder pedal input

until ground contact.180

The rudder surface and control wheel position time histories resulting from

Boeing’s kinematic analysis for this scenario are presented in figures 19 and 20,

respectively. Further, the Safety Board used Boeing’s kinematically derived flight control

position time histories as inputs in the Board’s computer simulation to derive heading,

bank angle, pitch angle, and vertical acceleration data and compared these results with the

FDR data. These results are presented in figures 21a through 21d, respectively. 

177 Boeing first presented its kinematic analysis of the USAir flight 427 upset event in its “Submission

to the National Transportation Safety Board for the USAir 427 Investigation,” dated September, 30, 1997.

On October 31, 1997, Boeing presented the Safety Board with a refined version of its USAir flight 427

kinematic analysis. The Board used Boeing’s data from its later presentation for this report. 

178 A variety of methods exist for curve-fitting data, including mathematical models such as the cubic

spline, least squared polynomial, and fast Fourier transform techniques. Boeing used a technique that

involved fitting the data manually. (This manual technique involved reviewing the data and providing a

nonlinear fit between the FDR data points.) 

179 See page 17 of Boeing’s “Submission Supplement USAir 737-300 accident near Pittsburgh,” dated

September 30, 1997.

180 Page 49 of Boeing’s September 30, 1997, submission states that “from [just after stickshaker

activation] until ground impact, the controls remained at full right wheel, full left rudder, and full aft

column.” 
Factual Information 97 Aircraft Accident Report

Figure 19. USAir flight 427 rudder surface positions resulting from 

Boeing’s kinematic analysis.

Figure 20. USAir flight 427 control wheel positions resulting from 

Boeing’s kinematic analysis.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-5

0

5

10

15

20

25

Nose Right

Nose Left

USAir 427

Simulator Input

Boeing Kinematic Solution

Rudder (deg)

Time (hr:min:sec)

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-20

0

20

40

60

80

100

Left

Right

USAir 427

Boeing Kinematic Solution

Simulator Input

Wheel (deg)

Time (hr:min:sec)
Factual Information 98 Aircraft Accident Report

Figure 21a. Derived heading data for USAir flight 427 using 

Boeing’s kinematic analysis.

Figure 21b. Derived bank angle for USAir flight 427 using 

Boeing’s kinematic analysis.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

20

30

40

50

60

70

80

90

100

110

120

USAir 427

Simulator Response to Boeing Solution

 FDR data

 Simulation

Heading (deg)

Time (hr:min:sec)

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-80

-70

-60

-50

-40

-30

-20

-10

0

10

20

Left Wing Down

Right Wing Down

USAir 427

Simulator Response

to Boeing Solution

 FDR data

 Simulation

Bank Angle (deg)

Time (hr:min:sec)
Factual Information 99 Aircraft Accident Report

Figure 21c. Derived pitch angle for USAir flight 427 using 

Boeing’s kinematic analysis.

Figure 21d. Derived vertical acceleration data for USAir flight 427 using 

Boeing’s kinematic analysis.

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

-30

-20

-10

0

10

USAir 427

Simulator Response

to Boeing Solution

 FDR data

 Simulation

Pitch Angle (deg)

Time (hr:min:sec)

19:02:50.00 19:02:55.00 19:03: 0.00 19:03: 5.00 19:03:10.00

0.6

0.8

1.0

1.2

1.4

1.6

1.8

2.0

2.2

USAir 427

Simulator Response

to Boeing Solution

 FDR data

 Boeing Oct 31st solution

Vertical Load Factor - Nz

Time (hr:min:sec)
Factual Information 100 Aircraft Accident Report

According to Boeing’s September 30, 1997, submission, three of the hypothetical

system-related scenarios (a dual slide jam, a secondary slide jam with primary slide

overtravel, and an input linkage jam) and one hypothetical flight crew input scenario

evaluated during the investigation all “potentially fit a kinematic analysis.” However, with

regard to the three hypothetical system-related scenarios, Boeing’s submission

commented that “evidence does not support finding as probable cause.” Boeing’s

submission further stated that “there is no evidence to support a conclusion that an

uncommanded full rudder deflection occurred. While there is no evidence of a crewcommanded, sustained left-rudder input, such a possibility is plausible and must be

seriously considered, especially given the lack of evidence of an airplane-induced rudder

deflection.” 

1.16.6.2 United Flight 585 Simulation Studies

United flight 585 was flying in turbulent air while making a right turn to the final

approach to Colorado Springs Municipal Airport. Strong winds aloft created complex

airflow patterns that moved from west to east across the mountains located west of the

airplane’s flightpath; these airflow patterns likely included strong turbulence, eddies,

rotational flow fields, and crosswind shear. The FDR data showed that, as the airplane was

descending through an altitude of about 1,000 feet agl and was about on track to approach

the airport from the south (about 0943:32)181, its heading changed to the right. The

airplane impacted the ground about 9 seconds later. The airplane’s orientation and

flightpath angle at impact were near vertical. The airplane was aligned approximately 205°

magnetic heading, and the ground track (as defined by the debris field) was about 020°

magnetic heading.182

 The Safety Board’s workstation-based simulator for a 737-200 airplane was used

to simulate the event. The simulation process used available FDR data, radar data, and

information on the accident location and airplane orientation at impact. Input to the

simulation for engine thrust was based on engine sounds recorded on the CVR. The flight

control surface position time histories needed for the simulation were not among the

parameters recorded by the FDR and thus had to be estimated or derived. The control

wheel (aileron and spoilers), rudder surface, and elevator position time histories used in

each simulation were derived by iteration. 

The simulations assumed that the airplane encountered turbulence with a

crosswind gust (perhaps associated with a mountain rotor).183 In the Safety Board’s bestmatch simulation that involved a rudder movement for this event, these winds produced a

heading change and yaw rate to which the pilot was assumed to have responded (about

0943:32) with left rudder pedal input.184 This scenario further assumed that this input

181 All times in this subsection are mountain standard time, based on a 24-hour clock. 

182 The heading and ground track were about 180° opposed because of the near-vertical flightpath angle.

183 The Safety Board considered several rotor scenarios in its studies, including moving rotors above,

below and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s

flightpath; and horizontal rotors that transitioned to vertical rotors along the airplane’s flightpath.
Factual Information 101 Aircraft Accident Report

occurred while the main rudder PCU servo valve secondary slide was jammed to the servo

valve housing, resulting in a rudder reversal to the right. 

The general wind field was derived by comparing the ground track from the radar

data with the airspeed and heading data from the FDR. An approximation of a vertical gust

profile was developed from the vertical load factor data. Crosswind gust components were

also used in this best-match simulation. 

In this simulation, at 0943:21, when the airplane was nearly aligned with the

landing runway, the airplane began to experience a significant heading change to the right.

The simulation indicated that a right bank angle of about 30° was required to produce this

heading change. The Safety Board determined that the heading change and the rolling

moment that occurred after 0943:21 were likely the result of turbulence, and these data

became the baseline for the turbulence models used in some of the Board’s simulations.185

Rudder position time histories were developed for jams of the secondary slide to

the servo valve housing at 100, 71, 50, 40, and 30 percent from the neutral position. The

rudder position, once reversed, was assumed to remain at the blowdown limit186

corresponding to a servo valve jam at the 100-percent position (blowdown limit is partly

dependent on jam position, airspeed, and sideslip angle) for the duration of the reversal.

The timing of the rudder inputs was modified by iteration until the simulation produced

heading time histories consistent with the FDR data.

The heading data that resulted from the simulation with the secondary slide

jammed to the housing at 100 percent produced the Safety Board’s best-match with the

FDR heading data.187 The pilot rudder pedal force, rudder surface, and control wheel time

histories for the 100-percent jam are presented in figures 22a through 22c, respectively.188

The resultant heading, normal load factor, pitch angle, and bank angle data for the Safety

Board’s 100-percent jam solution compared with the FDR data are presented in figures

22d through 22g, respectively. Roll and yaw rate, two parameters pertinent to human

184 The complete data sets for this and other scenarios can be found in the Safety Board’s “United flight

585 Simulation Study,” dated October 19, 1998, and the Board’s “Addendum to Simulation Study,” dated

February 23, 1999. 

185 The 100-percent jam scenario does not include the rotational eddy from the turbulence model; the

30-percent jam (which is not presented in this report) does include the eddy. 

186 Because of fire damage to the United flight 585 PCU, the Safety Board was unable to perform

laboratory tests to determine the rudder deflection rate and the hinge moment capability of the PCU with the

secondary slide jammed at various positions from neutral. Therefore, data from the USAir flight 427 PCU

servo valve tests in which the secondary slide was jammed at 71, 50, and 22 percent from neutral were used.

Data from the Eastwind flight 517 PCU servo valve tests were not used because that servo valve had a leaky

bypass valve. 

187 Because of the reduced hydraulic pressure ported to the actuator in the overtravel situation, this

100-percent jam would result in the rudder moving at a reduced rate of about 32° per second to the reduced

blowdown limit.

188 The Safety Board’s best-match simulation used 300 pounds of force reducing to 200 pounds, based

on ergonomic and other research data (see section 1.18.8). The Safety Board was also able to match the

United flight 585 FDR data using only the minimum pedal force necessary to sustain full rudder authority

(about 70 pounds). 
Factual Information 102 Aircraft Accident Report

performance, are presented in the figures 22h and 22i, respectively, for the 100-percent

jam case. CVR data are presented on figures 22f, 22g, and 22i to correlate verbal

responses of the pilots to simulated pitch angle, bank angle, and yaw rate, respectively.

Wind direction and horizontal and vertical windspeeds used in the Safety Board’s bestmatch scenario are presented in figures 22j through 22l, respectively.

Figure 22a. Pilot rudder pedal force positions for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-500

-450

-400

-350

-300

-250

-200

-150

-100

-50

0

50

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Input

Left

Right Pedal Force (lbs)

Time (hr:min:sec)
Factual Information 103 Aircraft Accident Report

Figure 22b. Rudder surface positions for United flight 585.

Figure 22c. Control wheel positions for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-30

-25

-20

-15

-10

-5

0

5

10

15

20

25

30

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Input

Nose Left

Nose Right Equivalent Rudder (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-100

-80

-60

-40

-20

0

20

40

60

80

100

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Input

Left

Right Equivalent Wheel (deg)

Time (hr:min:sec)
Factual Information 104 Aircraft Accident Report

Figure 22d. Heading data for United flight 585.

Figure 22e. Normal load factor data for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

300

310

320

330

340

350

360

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

 FDR points 

 Simulation

Heading (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

 FDR data 

 Simulation

Normal Load Factor (G's)

Time (hr:min:sec)
Factual Information 105 Aircraft Accident Report

Figure 22f. Pitch angle data for United flight 585.

Figure 22g. Bank angle data for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-90

-80

-70

-60

-50

-40

-30

-20

-10

0

CAM_2-wowCAM-2_We're_at_a_thousanCAM-2_Oh_God_(flip)CAM-1_fifteen_flapsCAM1- Oh(exclaimed loudlSound_of_impact

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Pitch Angle (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-180

-160

-140

-120

-100

-80

-60

-40

-20

0

20

40

60

80

100

120

140

160

180

CAM_2-wowCAM-2_We're_at_a_thousanCAM-2_Oh_God_(flip)CAM-1_fifteen_flapsCAM1- Oh(exclaimed loudlSound_of_impact

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Left

Right Bank Angle (deg)

Time (hr:min:sec)
Factual Information 106 Aircraft Accident Report

Figure 22h. Roll rate for United flight 585.

Figure 22i. Yaw rate for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-10

0

10

20

30

40

50

60

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Body Axis Roll Rate - pb (deg/sec)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-15

-10

-5

0

5

10

15

20

CAM_2-wowCAM-2_We're_at_a_thousanCAM-2_Oh_God_(flip)CAM-1_fifteen_flapsCAM1- Oh(exclaimed loudlSound_of_impact

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Body Axis Yaw Rate - rb (deg/sec)

Time (hr:min:sec)
Factual Information 107 Aircraft Accident Report

Figure 22j. Wind direction for United flight 585.

Figure 22k. Horizontal windspeeds for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

220

230

240

250

260

270

280

290

300

310

320

UAL 585

Simulator Study

100% Secondary Slide Jam

Wind Direction (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0

10

20

30

40

50

60

70

UAL 585

Simulator Study

100% Secondary Slide Jam

Wind Speed (kts)

Time (hr:min:sec)
Factual Information 108 Aircraft Accident Report

One of the Safety Board simulation scenarios that produced a good match with the

FDR data and other physical evidence assumed a sustained equivalent control wheel input

to the right with no rudder input. The equivalent control wheel input could represent a

pilot command, a rotational wind, or a combination of the two. Figures 23a through 23g

show the resultant data for rudder surface and control wheel positions and heading, normal

load factor, calibrated airspeed, pitch angle, and bank angle data, respectively. Figures 23f

and 23g also show CVR data. 

Figure 22l. Vertical windspeeds for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-15

-10

-5

0

5

10

15

20

UAL 585

Simulator Study

100% Secondary Slide Jam

Vertical Wind Speed (kts - positive down)

Time (hr:min:sec)
Factual Information 109 Aircraft Accident Report

Figure 23a. Rudder surface positions for United flight 585 assuming a sustained 

equivalent control wheel input.

Figure 23b. Control wheel surface positions for United flight 585 assuming a sustained 

equivalent control wheel input.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-25

-20

-15

-10

-5

0

5

10

15

20

25

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Input

Nose Left

Nose Right Equivalent Rudder (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-100

-80

-60

-40

-20

0

20

40

60

80

100

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Input

Left

Right Equivalent Wheel (deg)

Time (hr:min:sec)
Factual Information 110 Aircraft Accident Report

Figure 23c. Heading data for United flight 585 assuming a sustained 

equivalent control wheel input.

Figure 23d. Normal load factor for United flight 585 assuming a sustained 

equivalent control wheel input.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-15

-10

-5

0

5

10

15

20

UAL 585

Simulator Study

100% Secondary Slide Jam

Vertical Wind Speed (kts - positive down)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

 FDR data 

 Simulation

Normal Load Factor (G's)

Time (hr:min:sec)
Factual Information 111 Aircraft Accident Report

Figure 23e. Calibrated airspeed for United flight 585 assuming a sustained 

equivalent control wheel input.

Figure 23f. Pitch angle data for United flight 585 assuming a sustained 

equivalent control wheel input.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

140

160

180

200

220

240

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

 FDR data

 Simulation

Vcas (Kts)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-90

-80

-70

-60

-50

-40

-30

-20

-10

0

CAM_2-wowCAM-2_We're_at_a_thousanCAM-2_Oh_God_(flip)CAM-1_fifteen_flapsCAM1- Oh(exclaimed loudlSound_of_impact

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

Pitch Angle (deg)

Time (hr:min:sec)
Factual Information 112 Aircraft Accident Report

In a June 23, 1997, letter to the Safety Board, Boeing provided its analysis of the

United flight 585 accident.189 Boeing’s analysis concluded that a rudder hardover scenario

did not fit the FDR data and that a “new rotor model” did match the data.190 Further,

Boeing derived this new rotor model to match the available data and introduced a

rotational effect of near zero just before 0943:28, which increased linearly to about 0.4

radians per second just before 0943:29 and then increased linearly to about 1.8 radians per

second about the time the airplane impacted the ground (just before 0943:42).

Boeing’s simulation using its new rotor model produced the data shown in figures

24a through 24g for rudder surface positions, windshear, control wheel positions, heading,

bank angle, normal load factor, and pitch angle, respectively. As shown in figure 24c,

Boeing’s simulation assumed a left control wheel input by the flight crew just after

0943:30.

Figure 23g. Bank angle data for United flight 585 assuming a sustained 

equivalent control wheel input.

189 Boeing’s analysis was resubmitted to the Safety Board in a September 14, 1998, letter. 

190 According to Boeing, “the new rotor model is significantly different from that evaluated during the

original [United flight] 585 investigation. The original [rotor] model was a solid rotating core of air with a

distinct boundary. This meant that the air at the outside edge of the core was at a very high velocity for large

cores with high rotational velocity. [Boeing’s new rotor] model is not a solid rotating body, but has a velocity

profile which varies significantly as the distance from the center core increases. The model was developed

based on a simulation of the weather conditions that existed in the Colorado Springs area on the day of the

accident.”

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-160

-140

-120

-100

-80

-60

-40

-20

0

20

40

60

80

100

120

140

160

CAM_2-wowCAM-2_We're_at_a_thousanCAM-2_Oh_God_(flip)CAM-1_fifteen_flapsCAM1- Oh(exclaimed loudlSound_of_impact

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

Left

Right Bank Angle (deg)

Time (hr:min:sec)
Factual Information 113 Aircraft Accident Report

Figure 24a. United flight 585 rudder surface positions according to 

Boeing’s new rotor model.

Figure 24b. Rotational windshear encountered by United flight 585 according to 

Boeing’s new rotor model.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-25

-20

-15

-10

-5

0

5

10

15

20

25

Boeing Simulation Match UAL585

Rudder (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

Boeing Simulation UAL585

P Shear (rad/sec)

Time (hr:min:sec)
Factual Information 114 Aircraft Accident Report

Figure 24c. United flight 585 control wheel positions according to 

Boeing’s new rotor model.

Figure 24d. United flight 585 heading data according to 

Boeing’s new rotor model.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-120

-100

-80

-60

-40

-20

0

20

40

60

80

100

120

Boeing Simulation Match UAL585

Wheel (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

300

310

320

330

340

350

360

Boeing Simulation Match UAL585

 Simulation

 FDR Points

Heading (deg mag)

Time (hr:min:sec)
Factual Information 115 Aircraft Accident Report

Figure 24e. United flight 585 bank angle data according to 

Boeing’s new rotor model.

Figure 24f. United flight 585 normal load factor data according to 

Boeing’s new rotor model.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-180

-160

-140

-120

-100

-80

-60

-40

-20

0

20

40

60

80

100

120

140

160

180

Boeing Simulation Match UAL585

Bank Angle (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Boeing Simulation Match UAL585

 Simulation

 FDR Data

Normal Load Factor (G's)

Time (hr:min:sec)
Factual Information 116 Aircraft Accident Report

1.16.6.3 Eastwind Flight 517 Simulation Studies

Pilot statements and data from Eastwind flight 517 indicated that the airplane was

flying in relatively calm air191 when it rolled and yawed to the right. The event lasted

about 13 seconds. Postincident investigation revealed that the airplane’s yaw damper had

been rigged incorrectly so that the neutral point of the rudder would be 1.5° to the left if

the rudder trim knob were set to zero. Ground tests and measurements indicated that, in

this incorrectly rigged condition, a yaw damper hardover would move the rudder an

additional 1.5° to the left or 4.5° toward the right. Flight tests conducted in the Eastwind

flight 517 airplane indicated that compliance within the rudder system would reduce the

right yaw damper authority from 4.5 to 3.7° (± 0.25° error band) right during the flight

conditions at the time of the upset.

The Safety Board’s workstation-based simulator for a 737-200 airplane was used

to simulate the events. Input to the simulation for engine thrust was based on data recorded

on the FDR. The flight control surface position time histories needed for the simulations

were not among the parameters recorded by the FDR and thus had to be estimated or

derived. With the use of a detailed Boeing elevator model, the elevator input was derived

from the control column position recorded by the FDR. The control wheel (aileron and

spoilers) position input time histories were initially estimated from a kinematic analysis;

the final control wheel position time histories were derived by iteration. 

Figure 24g. United flight 585 pitch angle according to 

Boeing’s new rotor model.

191 Although the Eastwind flight 517 FDR data showed that the flight was mostly smooth, there were

two positive spikes in the vertical load factor of about 1.2 Gs about 45 and 5 seconds before the event. There

were coincident signatures in the longitudinal load factor data.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-90

-80

-70

-60

-50

-40

-30

-20

-10

0

Boeing Simulation Match UAL585

Pitch Angle (deg)

Time (hr:min:sec)
Factual Information 117 Aircraft Accident Report

For the rudder position time history input in the Safety Board’s best-match

simulation, the rudder was assumed to have been trimmed to its zero position at some time

before the roll and yaw event to compensate for the yaw damper offset. (This action would

result in the trim knob being positioned about 1.5° to the right, which is the position where

the trim knob was discovered during postincident cockpit documentation.) The Safety

Board’s best-match simulation also assumed a rudder input similar to a yaw damper

hardover to the right followed by a left rudder pedal input by the pilots to counter the yaw

from this rudder input. The Board’s simulation scenario then assumed that a rudder

reversal occurred as a result of the left rudder pedal input while the PCU servo valve

secondary slide was jammed to the servo valve housing. 

Rudder position time histories were developed for a number of different

conditions, including jams of the secondary slide to the servo valve housing at 100, 71, 55,

43, and 30 percent from the neutral position. The rudder position, once reversed, was

assumed to remain at the jam-reduced blowdown limit (which is partly dependent on jam

position within the servo valve, airspeed, and sideslip angle) for about 13 seconds,

consistent with the period of heading shift recorded by the Eastwind flight 517 FDR

during the incident. The timing of the rudder inputs was modified by iteration until the

simulation produced heading time histories consistent with the FDR data.

The simulation assumed that, consistent with flight crew reports, the rudder PCU

servo valve became unjammed at some point, enabling the captain to regain control of the

airplane. Because there was no evidence of the rudder position after the captain regained

control of the airplane, the Safety Board considers its simulation to be meaningful only

until 2210:42. This time is also when Boeing terminated the data in its simulations that

were presented in its August 14, 1998, submission supplement.192

The heading data that resulted from the simulation with the secondary slide

jammed to the servo valve housing at the 55-percent position provided the best-match

with the FDR heading data. 193 This scenario assumed that the rudder pedal input resulted

in a rudder reversal and rudder movement194 to the (reduced) blowdown limit (6.5°)

corresponding to the 55 percent jam.195 Figure 25a shows the right and left EPR settings

recorded by the FDR and those used in the Safety Board’s simulations. The control wheel,

pilot rudder pedal force, and rudder surface time histories for a 55-percent jam are shown

in figures 25b through 25d, respectively. The resultant roll angle, vertical acceleration, and

192 See Boeing’s “Submission Supplement USAir 737-300 Accident Near Pittsburgh,” dated August 14,

1998. 

193 The Safety Board’s best-match simulation used 500 pounds of force reducing to 250 pounds, then

gradually reducing to 0 pounds, based on ergonomic and other research data (see section 1.18.8). The Safety

Board was also able to match the Eastwind flight 517 FDR data using only the minimum pedal force

necessary to sustain full rudder authority (about 70 pounds).

194 Because of the reduced hydraulic pressure ported to the actuator in the overtravel situation, this

55-percent jam would result in the rudder moving at a reduced rate of about 15° per second. 

195 For data related to other jam scenarios, refer to the Safety Board’s “Eastwind Rudder Jam Study,”

dated June 5, 1998; its “Addendum to Eastwind Rudder Jam Study,” dated November 11, 1998; and its

“Addendum 2 to Eastwind Rudder Jam Simulation Study,” dated February 18, 1999. 
Factual Information 118 Aircraft Accident Report

heading data, compared with the FDR data, are shown in figure 25e through 25g,

respectively. Figure 25h shows the simulator heading, corrected for gimbal error,

compared with the FDR-recorded heading data for a family of gyro gimbal spool-up

angles for the 55-percent jam case. Yaw and roll rates (parameters pertinent to human

performance) are presented in figures 25i and 25j, respectively, for the 55-percent jam

case. 

Figure 25a. Right and left EPR settings for Eastwind flight 517.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

0.7

0.8

0.9

1.0

1.1

1.2

1.3

1.4

Eastern Daylight Time (HH:MM:SS)

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

 FDR Right EPR

 Simulation Right EPR

 FDR Left EPR

 Simulation Left EPR

EPR right
Factual Information 119 Aircraft Accident Report

Figure 25b. Control wheel positions for Eastwind flight 517.

Figure 25c. Pilot rudder pedal force for Eastwind flight 517.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-80

-70

-60

-50

-40

-30

-20

-10

0

10

20

30

40

50

60

70

80

Eastern Daylight Time (HH:MM:SS)

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Left

Right Effective Wheel (deg)

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-650

-600

-550

-500

-450

-400

-350

-300

-250

-200

-150

-100

-50

0

50

Eastern Daylight Time (HH:MM:SS)

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

pedal force, lb
Factual Information 120 Aircraft Accident Report

Figure 25d. Rudder surface positions for Eastwind flight 517.

Figure 25e. Roll angle data for Eastwind flight 517.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-10

-9

-8

-7

-6

-5

-4

-3

-2

-1

0

1

2

Eastern Daylight Time (HH:MM:SS)

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Nose Left

Nose Right

Effective Rudder (deg)

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-20

-15

-10

-5

0

5

10

15

20

Eastern Daylight Time (HH:MM:SS)

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Left

Right

 FDR Data

 Simulation

Roll Angle (deg)
Factual Information 121 Aircraft Accident Report

Figure 25f. Normal acceleration data for Eastwind flight 517.

Figure 25g. Heading data for Eastwind flight 517.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

0.7

0.8

0.9

1.0

1.1

1.2

1.3

1.4

1.5

Eastern Daylight Time (HH:MM:SS)

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

 FDR data

 Simulation

Normal Acceleration - Nz (G's)

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

230

235

240

245

250

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Eastern Daylight Time (HH:MM:SS)

 FDR 

 Simulation

Heading (deg)
Factual Information 122 Aircraft Accident Report

Figure 25h. Heading data corrected for gimbal error for Eastwind flight 517.

Figure 25i. Yaw rate for Eastwind flight 517.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

230

235

240

245

250

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Gimbal Error Corrected Indicated Heading

 0 deg spool-up

 15 deg spool-up

 30 deg spool-up

 45 deg spool-up

 60 deg spool-up

 75 deg spool-up

 90 deg spool-up

 105 deg spool-up

 120 deg spool-up

 135 deg spool-up

 150 deg spool-up

 165 deg spool-up

 180 deg spool-up

 FDR data

Indicated Heading (deg)

Eastern Daylight Time (HH:MM:SS)

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-10

-5

0

5

10

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Left

Right Body Axis Yaw Rate - rb (deg/sec)

Eastern Daylight Time (HH:MM:SS)
Factual Information 123 Aircraft Accident Report

Boeing’s August 14, 1998, submission supplement presented four scenarios for the

Eastwind incident that were evaluated using Boeing’s kinematic analysis and computer

simulations.196 In its submission supplement, Boeing suggested that one of its scenarios

(number 4) was most consistent with the physical evidence, pilot reports, and kinematic

analysis. Scenario 4 involves a preexisting yaw damper hardover condition that resulted in

a rudder surface movement to 3° to the right, which the pilots compensated for with 3° of

left rudder trim. According to this scenario, the yaw damper hardover condition cleared

itself at the beginning of the upset event (about 2210:28), resulting in a sudden rudder

movement to 3.7° to the left197 and prompting a right rudder input (just after 2210:28) by

the pilot(s), which resulted in the rudder moving to 6° to the right. In a February 19, 1999,

letter to the Safety Board, Boeing provided “the results and analysis of a flight test...in

support of conclusions made in [scenario 4 of Boeing’s submission supplement].”

Boeing’s letter included a rudder plot that demonstrated a pilot rudder pedal response

within 1⁄4 second after the yaw damper hardover condition cleared (see figures 26a

through 26c).

Figure 25j. Roll rate for Eastwind flight 517.

196 According to Boeing’s submission supplement, scenario 1 involved a preexisting left yaw damper

hardover with a subsequent right yaw damper hardover, followed by a small nose-right rudder pedal input;

scenario 2 involved a right yaw damper hardover with a servo valve secondary slide jam and reversal;

scenario 3 involved a preexisting left yaw damper hardover with a subsequent right yaw damper hardover,

plus a secondary slide jam and reversal; and scenario 4 involved a preexisting right yaw damper hardover

that subsequently cleared, and the resultant yaw damper movement prompted a right rudder pedal input. 

197 The 3.7° left rudder position occurred because of the previous left rudder trim, the misrigged LVDT

(see section 1.16.1.2), and compliance within the airplane’s rudder system. 

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-15

-10

-5

0

5

10

15

Eastwind Event

55% Jam Simulation with rudder round-over

varying left pedal force input & subsequent release

Left

Right Body Axis Roll Rate - pb (deg/sec)

Eastern Daylight Time (HH:MM:SS)
Factual Information 124 Aircraft Accident Report

Figure 26a. Eastwind flight 517 heading data according to 

Boeing’s scenario.

Figure 26b. Eastwind flight 517 pilot rudder pedal force according to 

Boeing’s scenario.

22:10:25.00 22:10:30.00 22:10:35.00

234

235

236

237

238

239

240

241

242

Eastwind Event

Boeing Solution

from fig 4 of February 24, 1999 letter

 FDR data

 Boeing Heading Solution

Heading (deg)

Time (hr:min:sec)

22:10:28.00 22:10:29.00 22:10:30.00

-5

-4

-3

-2

-1

0

1

2

3

4

5

6

7

8

9

10

Nose Left

Nose Right

Eastwind Event

Boeing Solution

from fig 4 of February 24, 1999 letter

Rudder Pedal (deg)

Time (hr:min:sec)
Factual Information 125 Aircraft Accident Report

In Boeing’s scenario, the pilots subsequently maintained the pressure on the right

rudder pedal and used left control wheel and differential engine power to maintain

directional control until the roll and yaw event ended. Boeing’s August 1998 submission

supplement stated the following regarding scenario 4: 

The airplane rolls to the left during the initiation of the event and matches

the heading very closely.... This scenario correlates with the reported

nearly simultaneous input of rudder and wheel during the recovery.... [The

captain’s] usage of significant rudder input...is consistent with the manner

in which [he] used rudder...during flight testing. The [captain’s] stiff

rudder comment may have been caused by the lack of expected airplane

response to the significant rudder pedal input made by the pilot. The only

significant discrepancy with the pilot report is the direction of his pedal

command and his report that there was no yaw to the left.

Boeing’s submission supplement also stated that “the yaw damper hardover and

recovery proposed in scenario 4 does match the flight data recorder information.”

According to Boeing’s scenario 4, the yaw damper would have been active after the yaw

damper hardover cleared at the beginning of the upset event. Boeing’s estimated rudder,

yaw damper response, and rudder command is shown in figures 27a, and Boeing’s

estimated rudder with pilot command and no yaw damper activity is shown in figure 27b.

Figure 26c. Eastwind flight 517 rudder positions according to 

Boeing’s scenario.

22:10:28.00 22:10:29.00 22:10:30.00

-5

-4

-3

-2

-1

0

1

2

3

4

5

6

7

8

9

10

Eastwind Event

Boeing Solution

from fig 4 of February 24, 1999 letter

Rudder (deg)

Time (hr:min:sec)
Factual Information 126 Aircraft Accident Report

Figure 27a. Boeing’s kinematic rudder for Eastwind flight 517 and rudder with 

pilot command and yaw damper activity.

Figure 27b. Boeing’s kinematic rudder for Eastwind flight 517 with pilot command 

and no yaw damper activity.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-8

-6

-4

-2

0

2

4

Eastwind

Boeing Kinematic Analysis

Fig 11, May 12, 1998 presentation

 Kinematic Rudder

 Rudder with pilot command & Yaw damper

Rudder (deg)

Time (hr:min:sec)

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00 22:10:50.00

-8

-6

-4

-2

0

2

4

Eastwind

Boeing Kinematic Analysis

Fig 11, May 12, 1998 presentation

 Pilot Command

Rudder (deg)

Time (hr:min:sec)
Factual Information 127 Aircraft Accident Report

Figure 28a presents the rudder time history that resulted from Boeing’s kinematic

analysis of scenario 4. The heading time history that Boeing derived from its

kinematically developed rudder (uncorrected for what Boeing has determined to be a

simulator heading error) and used in its computer simulations is shown in figure 28b.

Figure 28c shows the average flight test heading error, and 28d presents the “error

corrected” heading time history compared with the FDR heading data. 

Figure 28a. Eastwind flight 517 rudder positions according to Boeing’s scenario.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00

-10

-5

0

5

10

Eastwind Event

Boeing Solution

from fig 16 of August 14, 1998 submittal

Nose Left

Nose Right

Time (hr:min:sec)

Effective Rudder (deg)
Factual Information 128 Aircraft Accident Report

Figure 28b. Eastwind flight 517 heading data according to Boeing’s scenario.

Figure 28c. Eastwind flight 517 average flight test heading error according to 

Boeing’s scenario.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00

230

235

240

245

250

Eastwind Event

Boeing Solution

from fig 16 of August 14, 1998 submittal

 FDR data

 Boeing Heading Curve fit

 Heading

Heading (deg)

Time (hr:min:sec)

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00

-10

-5

0

5

10

Eastwind Event

Boeing Solution

from fig 16 of August 14, 1998 submittal

Time (hr:min:sec)

Heading Errro (deg)
Factual Information 129 Aircraft Accident Report

Boeing’s submission supplement concluded that “multiple scenarios have been

identified that match at least some of the data and crew reports from the Eastwind 517

event. None of the scenarios fully match all the data, kinematic analysis, and crew

reports.” The submission supplement also included Boeing’s belief that, “...under the

NTSB standard for identifying ‘probable cause,’ there is insufficient data to find a

‘probable cause’ for this event.”

1.16.7 Identification of CVR Sounds/Sound Spectrum Analysis

During the examination of the CVR recording from the USAir flight 427 airplane,

the CVR Group members noted several sounds that occurred during the initial upset and

descent into terrain that they were initially unable to identify or explain. These sounds

were as follows: 

• sound similar to three thumps (at 1902:56.547, 1902:56.72, and 1902:56.855); 

• sound of electrical impulse recorded on the captain’s radio channel 

(at 1902:56.9); 

• sound of two thumps (at 1902:58.2 and 1902:59.2);

• sound similar to airplane engines increasing in loudness (at 1902:58.27);

• sound of “clickety click” (at 1902:58.6 and 1902:59.5); and

• sound of wailing horn (at 1903:02.1).

Figure 28d. Eastwind flight 517 corrected heading according to Boeing’s scenario.

22:10:10.00 22:10:20.00 22:10:30.00 22:10:40.00

230

235

240

245

250

Eastwind Event

Boeing Solution

from fig 16 of August 14, 1998 submittal

 FDR data

 Boeing Heading Curve fit

 Sim Heading minus sim heading error

Heading (deg)

Time (hr:min:sec)
Factual Information 130 Aircraft Accident Report

To identify the sources of the sounds, the Safety Board examined the recording on

a spectrum analyzer, which gives a visual presentation of the frequency content of the

signals, and a computer signal analyzer, which allows detailed analyses of the analog

waveform, frequency content, and detailed timing information. (Additionally, at Boeing’s

request, the Safety Board’s Sound Spectrum Group conducted an additional review of the

CVR sounds with Boeing flight test and system design engineers participating; no

additional information was gained as a result of this review.)

When Safety Board investigators compared the CVR sounds from USAir flight

427 with CVR sounds obtained from known in-flight explosions, no similarities were

noted. The Safety Board also provided the original CVR recording to the FBI’s forensic

audio laboratory in Quantico, Virginia, which examined the recording to identify any

unusual sounds or signatures that might be associated with criminal or terrorist activity.

The laboratory discovered no sounds that appeared to result from explosions, gun shots, or

any other identifiable acts of violence. 

1.16.7.1 Sounds Similar to Thumps (Three Initial Thumps Within 1 Second 

and Two Subsequent Thumps About 1 Second Apart) 

Beginning at 1902:56.5, the accident airplane’s CVR recorded a sound on the

CAM channel, which investigators characterized as similar to three thumps within

1 second. Simultaneously, the CVR recorded an electrical impulse (when plotted, this

impulse showed itself as a voltage spike) on the captain’s channel (see section 1.16.7.2).

These sounds were followed by two additional thump sounds, about 1902:58.2 and

1902:59.2. Examination of the entire 31-minute CVR recording revealed that the CVR

had not recorded anything similar to the thump sounds during the previous 301⁄2 minutes.

Examination of each of the thump sounds using the spectrum analyzer and computer

signal analyzer revealed that the sounds exhibited frequency signatures with most of their

energy in the low-frequency (below 500 Hz) range. The “impulse” type of sound that is

usually formed when two hard surfaces strike each other contains energy distributed

equally through a large range of frequencies.

Because investigators were initially unable to identify the source of these thump

sounds, and because of the circumstances of the accident, the Safety Board devised a test

to document the effects (and sounds) of rudder cable(s) breaking. As previously discussed,

the sounds recorded by the CVR during these tests were impulsive in nature, with energy

distributed throughout the frequency spectrum. (See section 1.16.5.2 for details of the

rudder cable break tests.) 

Because the sounds were recorded by both the CAM and the jumpseat/observer

channels of the CVR, indicating that the sounds could have been transmitted to those

microphones through the air and/or through the airplane’s metal structure, the Safety

Board conducted tests to derive the source and relationship of the thump sounds. A test

737-300 was configured to represent the accident airplane’s condition at the time the

thump sounds were recorded: the cabin and cockpit doors were closed, the jumpseat/

observer position oxygen mask was stowed properly,198 the CAM was positioned in the

same location as in the accident airplane, and two crew microphones were used. 199
Factual Information 131 Aircraft Accident Report

Investigators then struck the airplane structure at various locations (inside and outside)

with a rubber mallet and moved/bumped service equipment within the cabin, with the

CVR recording the resultant sounds. 

Examination of the CVR recording from the tests revealed that the rubber mallet

impact sounds were recorded by each microphone as two distinct events; in both cases, the

first recorded event was the sound transmitted through the airplane structure, and the

second was the sound that was transmitted through the air. The time difference between

the recorded sounds for any given mallet strike corresponded directly to the distance

between the microphone and the location of that mallet strike. Further, investigators noted

that the sound signals would arrive first at the microphone closest to the mallet strike.

Thus, it was possible to calculate the approximate distance and direction to the source of

the sounds. Reexamination of the thump sounds recorded by the accident CVR, in relation

to the sounds recorded by the CVR recording from the tests, revealed that the accident

CVR recorded sounds consistent with a sound from a source approximately 12 to 16 feet

back from the CAM (corresponding to the fuselage area about the location of passenger

seat row 1 or 2). Although the rubber mallet strike tests could duplicate the timing of the

thump sounds, the sound signatures produced during the tests (whether from mallet

strikes, jumping in the cabin, or movement of cabin service equipment) were distinctly

different from those recorded by the accident CVR. 

The pilots who participated in the wake turbulence encounter test flights reported

that, under some flight test conditions, they heard sounds in the cockpit that they

associated with the wake turbulence encounters. The pilots described the sounds as

“whooshing” sounds and stated that they were usually heard during the test conditions in

which the main fuselage passed through the center of the wake core. The Sound Spectrum

Group compared the CVR sounds from USAir flight 427 with the CVR sounds recorded

during the wake turbulence flight tests and noted that the sounds recorded during some of

the wake encounters were very similar in frequency, energy, and timing to the thumps

recorded by the accident CVR.

1.16.7.2 Sound of Electrical Impulse Recorded on the Captain’s 

Radio Channel

At 1902:56.9, an electrical impulse (a voltage spike) of unknown origin was

recorded on the captain’s radio channel. The duration of the voltage spike was measured to

be 0.0068 seconds. Further examination of the voltage spike revealed that it was

composed primarily of two frequencies (2818 and 400 Hz) superimposed on one another.

Safety Board investigators subjected a representative CVR installation to a test series of

198 For additional information regarding the jumpseat/observer position oxygen mask, see section

1.11.1. 

199 The thump sounds on the accident airplane’s CVR were not recorded on either pilots’ channel.

Investigation revealed that both pilots wore headsets with boom microphones that were wired “hot” to the

CVR. According to the manufacturer, the microphones were designed to pick up voice frequencies and

suppress most background noises. Further, the microphones would not be sensitive to sounds transmitted

through the airplane structure because they were isolated from the structure by the human body. 
Factual Information 132 Aircraft Accident Report

disturbances, including electrical field, magnetic field, induced voltage spike, radio

frequency susceptibility, over- and undervoltage transients, power interruptions, and high

voltage induced transients (simulating lightning strikes). The CVR recording from the test

revealed that, although some of the test conditions induced voltage spikes and noise on the

CVR recording, none of the spikes resembled the voltage spike recorded by the accident

CVR. However, during the testing, investigators noted that activation of a radio/intercom

selector switch in the intercom position produced a voltage spike nearly identical to the

spike recorded by the accident CVR. The spring-loaded radio/intercom selector switch on

the radio selector panel is located outboard of the pilots’ knees in the cockpit. 

1.16.7.3 Sound Similar to Airplane Engines Increasing in Loudness 

A review of the sound signatures associated with the rotating engines recorded by

USAir flight 427’s CVR revealed that, throughout the 31-minute CVR recording, the

engine’s sound signatures changed in frequency as the engine speed increased or

decreased200 but remained constant in intensity (volume). During the upset sequence, the

CAM channel of the accident CVR also recorded variations in the volume of the sound

signatures associated with the engines. The sound spectrum study indicated that, at

1902:58.27 and 1903:02.3, the sounds on the CVR recording that were associated with

both engines simultaneously increased in volume by about 30 percent; at the same time,

the frequency of the engine sound signatures, and the volume of all other background

noises, remained constant. The first increase signature occurred about 0.17 seconds after

the first thump in the second set of thump sounds; the second increase occurred about

1 second later, just before the captain exclaimed “hang on.” Although FDR data indicated

that the engine power settings changed during the accident sequence,201 the engine sounds

(when identifiable) remained at the increased volume throughout the remainder of the

CVR recording. 

The Safety Board attempted to determine why the volume of the engine sound

signatures increased in a manner that did not correspond to FDR-recorded changes in

engine power setting during the upset sequence. The Board considered the following

possibilities: the ability of the CVR recording system to pick up these sounds had

increased; the sound transmission path between the engines and the CVR area microphone

had changed; and the amount of engine inlet fan noise had increased. The Safety Board

could not identify any physical or electrical phenomena that would account for an increase

in the ability of the CVR recording system to record the volume of the engine sound

signatures, while sound signatures at all other frequencies remained unchanged, as they

did in the accident airplane’s CVR recording. The engine noise volume increase affected

200 Examination of these sound signatures revealed two distinct traces, one being slightly higher in

frequency than the other. Review of the FDR data revealed that the right engine fan speed (N1) was

operating at 1 to 3 percent higher revolutions per minute than the left engine fan speed. This difference

coincided with the difference in engine fan speeds calculated from the CVR engine sound signatures. 

201 The FDR data indicated that, after a brief increase in engine power setting at 1903:02, the engine

power settings began to decrease from the peak power setting recorded during the accident sequence (about

80 percent N1); by 1903:09, the engine power settings had decreased to about 30 percent N1, at which point

they remained until ground impact. 
Factual Information 133 Aircraft Accident Report

both engines equally and symmetrically, and the accident CVR did not record an increase

in background wind noise. In other accident investigations,202 the Safety Board observed

that a change in the engines’ sound transmission path because of a change in the airplane’s

structure (loss of a fuselage panel or a cabin door opening in flight) was accompanied by a

dramatic increase in background wind noise. No such increase in background wind noise

was recorded by the USAir flight 427 CVR. The Safety Board’s review of CVR

information from previous investigations yielded several occurrences (such as a bird strike

or a loss of engine cowling structure) that affected the amount of inlet fan noise that one of

the engines produced. However, these occurrences on previous accidents did not affect

both engines equally and simultaneously. 

Safety Board investigators also examined a representative sample of the CVR

recordings from the wake vortex flight tests203 (discussed in section 1.16.2) in an attempt

to identify any potential relationship between crossing a wake vortex and the engine sound

signature recorded by the CVR. None of the sampled CVR recordings showed any

significant change in the engine sound signatures as a result of the wake encounters. 

During a series of flight tests on the 737-300 conducted by the Safety Board in

September 1995 to evaluate flight control characteristics and validate and expand

Boeing’s 737 mathematical simulator model, the instrumented airplane was subjected to

several full rudder deflection and maximum rate aileron roll maneuvers. During postflight

examination of the audio recordings from these flights, Safety Board investigators

observed that, during some of the maneuvers, the engine sound signatures increased in

volume, similar to the volume increases that were observed on the accident CVR

recording. The airplane maneuvers that resulted in such changes to the engine sound

signatures included large rudder displacements (both right and left) at various angles and

rates in which flight test pilots utilized opposite aileron to limit rudder-induced bank angle

(steady heading sideslip) and rudder-only flight control input (both right and left) at

various rudder displacement angles and rates. The test maneuvers in which large and rapid

rudder displacements were applied resulted in the greatest change in engine sound

signature intensity. When the CVR recordings from the flight tests were compared with

the CVR recording from the USAir flight 427 airplane, the best match was with the flight

test condition involving rapid rudder input from 0 to 14° rudder. 

202 See National Transportation Safety Board. 1990. Aloha Airlines Flight 243, In-flight Structural

Failure, near Maui, Hawaii, April 28, 1988. Aircraft Accident Report NTSB/AAR-89/03. Washington, DC.

Also see National Transportation Safety Board. 1990. United Airlines Flight 811, In-Flight Cargo Door

Separation, near Honolulu, Hawaii, February 24, 1989. Aircraft Accident Report NTSB/AAR-90/01.

Washington, DC.

203 Fourteen encounters were selected for this examination; these selections were considered

representative of wake vortex penetrations from all the various entry angles and trailing distances behind the

wake-producing airplane. 
Factual Information 134 Aircraft Accident Report

1.16.7.3.1 Comparison of Engine Sound Signatures From the 

United Flight 585 CVR and a CVR From 737-200 Flight Tests 

Because of the Safety Board’s findings (discussed in section 1.16.7.3) that certain

sideslip and yaw maneuvers in a 737-300 could result in changes in engine sound

signatures, investigators next attempted to determine whether such maneuvers in a

737-200 would result in similar changes in engine sound signatures and, if so, whether any

such changes could be discerned on the United flight 585 CVR. 204 According to Boeing,

the overall geometry and proportions of the 737-200 and -300 series fuselages are very

similar; however, the airplanes are equipped with significantly different engines. The

737-200’s engines are equipped with inlet vanes or diffusers that intentionally make the

inlet airflow turbulent.205 Therefore, investigators recognized the possibility that

maneuvers causing the inlet airflow to be slightly more turbulent might not produce

significant change in the engine’s noise-producing characteristics. 

On June 3, 1996, the Safety Board conducted an engine perturbation flight test

using a United Airlines 737-200 at the United Airlines Maintenance Operations facility in

Indianapolis, Indiana. The flight test consisted of airplane maneuvers similar to those

conducted during 737-300 flight control characteristics testing in September 1995. (See

section 1.16.4.) The CVR recordings of the 737-200 flight test during sideslip and yaw

conditions revealed engine sound signature changes similar to those heard in the 737-300

flight test CVR recordings for the same conditions. 

The CVR recording from United flight 585 was compared with the CVR recording

from the 737-200 flight test. However, analysis of the engine sounds on the United flight

585 CVR was hampered by two factors: the recording was of poor quality with obscuring

background noise and the pilots of United flight 585 were changing the engine power

settings—and therefore, varying the revolutions per minute frequency—almost constantly

during the approach to land. Investigators attempted to compensate for these factors when

possible and then extracted and plotted the resulting engine sounds. Further, investigators

plotted the FDR data (heading, altitude, vertical Gs, and indicated airspeed) along with the

CVR data. No changes in engine sound volume were detected on the United flight

585 CVR.

1.16.7.4 Sounds of “Clickety Click”

During public hearing testimony, Boeing’s flight test pilot speculated that the

clickety click sounds might have been caused by the windshield wipers “chattering” or

“slapping” on the windshield as the wake vortex impacted the airplane’s fuselage. He

204 The Safety Board would have attempted to apply the same techniques to the CVR recording from the

Eastwind flight 517 incident, which also involved a 737-200; however, the 30-minute CVR tape continued

to run after the airplane landed, and the relevant portion of the flight was recorded over. 

205 According to the engine manufacturer, the engines installed on the 737-200 series airplane were

designed when controlling/reducing inlet noise was not a critical issue for manufacturers. Because of the

differences in engine inlet design, the engines installed on the 737-200 series airplanes produced more noise

than the engines installed on the 737-300 series airplanes. 
Factual Information 135 Aircraft Accident Report

stated that when the wake core hit the fuselage, “it actually lifted the windshield wiper

perpendicular off the wind screen and then it popped back with a rather subtle clicking

noise.” The Safety Board was unable to find a sound on the wake turbulence flight test

CVR recordings that matched the clickety-click sounds recorded by the accident CVR at

1902:58.6 and 1902:59.5. 

1.16.7.5 Sound of Wailing Horn

Although the wailing horn sound that was recorded by the USAir flight 427 CVR

was originally identified as being “similar to autopilot disconnect,” further investigation

revealed that the wailing horn recorded by the accident CVR did not sound the way the

autopilot disconnect aural warning was designed to sound. According to Boeing

engineers, the autopilot aural warning is generated by sweeping electronic sound

oscillators from low to high frequency, resulting in a sound that is described in Boeing

literature as a “fast wailer.” The aural warning is designed to continue to cycle every

second for as long as the horn is activated. On the accident CVR recording, the wailing

horn started as a fast wailer but, after one cycle, lapsed into a fast-cycle warbling tone,

which continued to the end of the recording. 

Investigation revealed that the unit that generated the autopilot disconnect aural

warning on the accident airplane also generated most of the cockpit aural warnings. The

unit was equipped with multiple sound oscillators and bells and generated aural warnings,

in addition to autopilot disconnect, for engine fire, loss of pressurization, aircraft

overspeed, and takeoff/landing conditions. The unit was designed with a warning priority

schedule—when a warning is being sounded and a warning with a higher priority is

sensed, the unit will stop the lower priority warning and sound the higher priority warning. 

The Safety Board conducted tests on a USAir 737-300 that was equipped similarly

to the accident airplane. These tests revealed that, when the autopilot disconnect and

landing gear warnings206 were sounded simultaneously, the test airplane unit produced a

cockpit aural warning that appeared to mix the steady landing gear warning tone with the

wailing autopilot disconnect horn, producing a warbling tone centered around the landing

gear warning tone—similar to the aural warning recorded by the accident airplane’s CVR.

However, when the test airplane unit was examined on a test bench, all warnings were

within specification, and the warning priority specifications functioned in a manner

consistent with their design. Further examination revealed that unintended mixing of aural

warnings can result from incomplete electrical grounding of the warning system.

1.16.8 Study of Pilots’ (USAir Flight 427 and United Flight 585) 

Speech, Breathing, and Other CVR-recorded Sounds 

As part of its investigation of the USAir flight 427 accident, the Safety Board

examined the pilots’ speech (voice fundamental frequency, or pitch; amplitude, or

206 According to Boeing representatives, the landing gear warning can be activated when one or both

throttles are retarded to idle and the landing gear is not extended. 
Factual Information 136 Aircraft Accident Report

loudness; speaking rate; and content) and breathing (inhaling, exhaling and grunting)

patterns recorded by the CVR during the routine portions of the flight, the initial upset,

and the uncontrolled descent. Investigators extracted several acoustical measures of

speech (fundamental frequency, amplitude, and speaking rate) from pilot statements on the

CVR recording to understand the actions and emotional states of the pilots during the

accident sequence.207 Similar speech analysis techniques have been used previously by

Russian, Japanese, and Australian investigative and research authorities208 and by Safety

Board investigators on three occasions before this investigation.209

The Safety Board reviewed the USAir flight 427 CVR for pilot speech samples

appropriate for computer speech analysis. The Safety Board observed that the captain

spoke the airplane’s call sign, “four twenty seven,” during routine and emergency radio

transmissions, providing a basis for direct comparison using the same words. When the

captain spoke the phrase “four twenty seven” during routine flight operations, the average

fundamental frequency value was 144.6 Hz. However, when the captain stated four twenty

seven about 1903:15 during the emergency descent, the speech fundamental frequency

increased 47 percent, to 214 Hz. Figure 29 graphs the fundamental frequency measures

obtained for the captain’s statements before and during the upset period, showing changes

in the fundamental frequency of his speech as the emergency situation developed.210

Figure 30 graphs the amplitude measures obtained for the same statements. According to

scientific literature,211 fundamental frequency, amplitude, and speaking rate tend to

increase in response to increased psychological stress.

The captain’s speech fundamental frequency during the 3 minutes before the initial

upset event generally ranged between 127 and 148 Hz and then increased to 210 Hz when

he stated “sheeez.” Additionally, the captain’s amplitude during the 3 minutes before the

upset event ranged between 237 and 520 volts212 and then increased to 904 volts when he

207 See “Speech Examination Factual Report, May 5, 1997” for details on the extraction procedures,

which employed computer analysis. 

208 For additional information, see Brenner, Malcolm, Mayer, David, and Cash, James [NTSB]. “Speech

Analysis in Russia.” In Methods and Metrics of Voice Communications. 1996. Ed. B.G. Kanki and O.V.

Prinzo. Washington, DC: Department of Transportation, Federal Aviation Administration, Office of Aviation

Medicine, DOT/FAA/AM-96/10. Also see Mayer, David L., Brenner, Malcolm, and Cash, James R.

[NTSB]. “Development of a Speech Analysis Protocol for Accident Investigation.” In Methods and Metrics

of Voice Communications. 1996. In addition, see Aircraft Accident Investigation Report [Japan], Japan Air

Lines Co., Ltd., Boeing 747 SR-100, JA8119, Gunman Prefecture, Japan, August 12, 1985 and Bureau of Air

Safety Investigation Accident Investigation Report, Mid-Air Collision Between Cessna 172-N VH-HIZ and

Piper PA38-112 VH-MHQ, near Tweed Heads, New South Wales, 20 May 1988 (BASI Report 881/1042).

209 For additional information, see NTSB Aircraft Accident Reports FTW91FA144 and SEA95FA175.

Also see National Transportation Safety Board. 1990. Grounding of the U.S. Tankship EXXON VALDEZ on

Bligh Reef, Prince William Sound near Valdez, Alaska, March 24, 1989. Marine Accident Report

NTSB/MAR-90/04. Washington, DC. In addition, see Brenner, M., and Cash, J. 1991. “Speech Analysis as

an Index of Alcohol Intoxication—The Exxon Valdez Accident.” Aviation, Space, and Environmental

Medicine, 62, 893-98.

210 Only those statements that were free of artifacts caused by background conversation or other sounds

appear on this graph and the one in figure 30. Of the three measured aspects of the captain’s speech,

fundamental frequency provided the most measurable data. Missing data precluded similar measurements of

the captain’s speech rate or amplitude.
Factual Information 137 Aircraft Accident Report

stated “sheeez.” (The captain’s speech amplitude reached its maximum measured value of

2,865 volts at 1903:18.1 during the emergency descent.) Review of the first officer’s

speech during the accident flight revealed that he did not speak enough during the

emergency period to provide a basis for meaningful analysis. 

The Safety Board conducted a similar laboratory speech analysis examination of

the speech and other sounds recorded by the United flight 585 CVR. The only measurable

data obtained during this examination was for speech fundamental frequency.213 The

captain’s speech fundamental frequency when he spoke the word “flaps” during routine

and emergency radio transmissions provided a basis for direct comparison. When the

captain said “flaps” during routine flight operations, his speech exhibited an average

fundamental frequency of 131 Hz. However, when the captain stated “flaps” at 0943:33.5

during the upset event, the fundamental frequency of his speech had increased 77 percent,

to 233 Hz.

211 See Ruiz, R., Legros, C., and Guell, A. 1990. “Voice analysis to predict the psychological or physical

state of a speaker.” Aviation, Space, and Environmental Medicine, 61, 266-71. Also, see Brenner, M.,

Doherty, E.T., and Shipp, T. 1994. “Speech measures indicating workload demand.” Aviation, Space, and

Environmental Medicine, 65:21-26. 

212 Amplitude is often measured in decibels, a logarithmic scale determined relative to an internationally

accepted calibration standard. Because no calibration standard was available in the CVR recording,

amplitude was measured in volts (the direct measure of physical intensity) and plotted on a logarithmic scale

for convenience. 

213 Amplitude could not be measured because of the automatic gain control feature on the microphone.

Speech rate could not be measured because of the limited amount of speaking by either crewmember during

the emergency period. 
Factual Information 138 Aircraft Accident Report

Figure 29. Fundamental frequency measures of the USAir flight 427 captain’s speech.

Fundamental Frequency (Hertz)

0 50 100 150 200 250 300 350 400

Altimeters and flight instruments thirty 

eleven?

approach brief?

ah, don’t do this to me.

OK, one

four zero heading and one ninety on the 

speed, 

did you say two eight left for USAir

 four twenty seven?

two eight right, thank you. 

two eight right.

seven for six.

boy, they always slow you up so bad 

here.

we’re looking for the traffic, turning to 

one zero zero, USAir four twenty seven.

sheez.

whoa. 

hang on.

hang on.

hang on.

hang on.

what the hell is this?

oh God..

oh God.

four twenty seven em ergency. 

pull

pull

USAir from twenty seven
Factual Information 139 Aircraft Accident Report

Figure 30. Amplitude measures for the USAir flight 427 captain’s speech.

Log Amplitude (Volts)

100 1000 10000

Altimeters and flight instruments thirty 

eleven?

approach brief?

ah, don’t do this to me.

OK, one

four zero heading and one ninety on the 

speed, 

did you say two eight left for USAir

 four twenty seven?

two eight right, thank you. 

two eight right.

seven for six.

boy, they always slow you up so bad 

here.

we’re looking for the traffic, turning to 

one zero zero, USAir four twenty seven.

sheez.

whoa. 

hang on.

hang on.

hang on.

hang on.

what the hell is this?

oh God..

oh God.

four twenty seven emergency. 

pull

pull

USAir from twenty seven

(Invalid data)

(Invalid data)

(Invalid data)

(Invalid data)

(Invalid data)

(Invalid data)
Factual Information 140 Aircraft Accident Report

1.16.8.1 Independent Specialists’ Review of Pilots’ Speech, Breathing, and 

Other Sounds—USAir Flight 427

The laboratory speech analysis results and CVR tape and transcript from USAir

flight 427 were provided to three independent specialists from the Interstate Aviation

Committee, Moscow, Russia;214 the U.S. Naval Aerospace Medical Research Laboratory,

Pensacola, Florida;215 and NASA’s Ames Research Center, Moffett Field, California.216

Their areas of specialization were general speech analysis (focusing on issues of

psychological stress and physical effort), breathing physiology,217 and communication

information, respectively. 

The specialists agreed that the USAir flight 427 CVR recorded no speech patterns

by the pilots or other sounds to indicate that either pilot was physiologically impaired or

incapacitated; rather, the specialists stated that both pilots sounded alert and responsive

throughout the flight, including the upset and accident sequence. The specialists agreed

that the first indication of the upset event on the CVR recording occurred about 1902:57,

just as the first officer finished stating, “oh, ya, I see zuh Jetstream.” Within 1 second, the

CVR recorded a sound similar to three thumps (see section 1.16.7.1), “sheeez” from the

captain, and “zuh” from the first officer. The specialists stated that the speech patterns of

the pilots indicated that they were surprised by the initial upset, but the specialists agreed

that the pilots responded promptly to the situation and were attempting to control the

airplane and identify the problem. None of the specialists were able to determine if the

pilots were operating the control wheel, the rudder, or both in their efforts to control the

airplane.

To ensure that all the straining, grunting, and other sounds recorded by the CVR

were thoroughly and accurately documented,218 the Safety Board and the independent

speech experts from Moscow’s Interstate Aviation Committee and the U.S. Naval

214 This specialist is the Chief of the Acoustical Laboratory at the Interstate Aviation Committee. He has

a medical degree and graduate level training in psychology. He has participated in more than 250 aviation

accident investigations and specializes in medical and psychological aspects, especially the psychological

analysis of speech.

215 This specialist is a Research Physiologist in the Aviation and Operational Medicine Department of

the U.S. Naval Aerospace Medical Research Laboratory. He has a doctorate degree in exercise physiology,

and his research includes work on the effects of physical fitness on normal load factor tolerance and the

development of anthropometric standards for naval aviators.

216 This specialist is a Research Psychologist at the NASA’s Ames Research Center. She has a doctorate

degree in behavioral sciences, and her research addresses aerospace human factors, focusing on crew

communication, coordination, and performance issues.

217 Breathing sounds are normally not audible on the CAM channel, which is recorded by a microphone

in the overhead panel above the pilots (and used for most CVR transcripts). However, breathing sounds are

often audible on the “hot microphone” channels recorded from boom microphones attached to the headset of

each pilot and positioned directly in front of each pilot’s mouth. The breathing information in this

investigation was recorded on these hot microphone channels.

218 The CVR transcript indicates that the captain inhaled and exhaled quickly at 1902:58.7 and that the

first officer was grunting at 1903.01.6. Several other instances of such sounds on the CVR are not noted in

the transcript. The Safety Board does not generally document every such sound when preparing official

transcripts of CVR recordings.
Factual Information 141 Aircraft Accident Report

Aerospace Medical Research Laboratory reexamined the sounds recorded by the CVR

between 1902:57.6 and 1903:23. Both experts noted additional sounds recorded on the

first officer’s hot microphone channel that could indicate high physical loads. These

sounds and their duration were documented by Safety Board investigators as follows: 219

• “zuh” from 1902:57.6 to 1902:57.8,

• a rapid inhale from 1902:59.7 to 1902:59.9,

• a soft grunt from 1903:00.3 to 1903:00.5,

• a louder grunt from 1903:01.5 to 1903:01.6,

• a loud exhale from 1903:01.8 to 1903:02.1, and

• “oh [expletive]” from 1903:04.6 to 1903:05.1.

No other inhaling, exhaling, or vocalizing sounds were detected during this time

period.

1.16.8.1.1 Summary of Observations of Interstate Aviation Committee 

Specialist

The specialist from Moscow’s Interstate Aviation Committee reviewed the pilots’

speech communication and other noise evidence recorded by the CVR to evaluate the

pilots’ responses, actions, and psychological state during the emergency. He stated that, at

1902:57.5, both pilots exhibited symptoms of sudden surprise that were “characteristic of

a human response to sudden motion or to a physical disturbance.” 

The specialist observed that both pilots showed symptoms of psychological stress

(increased amplitude and fundamental frequency of speech, increased frequency of

breathing, and reduced information within a statement) beginning almost immediately

after the initial upset and that these symptoms increased throughout the accident sequence.

However, the specialist believed that the increased psychological stress did not necessarily

interfere with the pilots’ ability to respond to the emergency situation. The specialist’s

report stated that stress can be viewed as having the following three increasing stages,220

which reflect typical changes in performance: 

Psychological stress, at low levels, can improve a person’s performance by

providing a constructive mobilization of attention and resources (first

stage). As the person’s stress increases, the performance often displays

219 One participant in this examination thought that the louder grunting and loud exhale (the fourth and

fifth sounds on the list) were part of the same straining effort but agreed with the other participants to

provide separate timings for both sounds.

220 As a guideline, the specialist from the Interstate Aviation Committee indicated that stage 1 speech is

characterized by an intra-individual increase in fundamental frequency of about 30 percent compared with

that individual’s speech in a relaxed condition, stage 2 speech is characterized by an increase in fundamental

frequency of 50 to 150 percent, and stage 3 speech is characterized by an increase of 100 to 200 percent.

These guidelines are advisory and considered with other speech factors in characterizing the speaker’s level

of stress.
Factual Information 142 Aircraft Accident Report

hasty or premature actions [such as the omission of words or checklist

items]. However, they can still accomplish their task (second stage). It is

only at the highest levels of stress (third stage, or “panic”), that the person

can not think or perform clearly. 

The specialist further observed that, although the captain’s level of psychological

or emotional stress was increasing during the emergency, he was still capable of adequate

responses; the captain’s attempts to evaluate the situation were reflected in his statements

“hang on” and “what the hell is this?” (about 1903:05 and 1903:08, respectively).

According to the specialist, although the captain’s response to an ATC transmission at

1903:15 was “incomplete and it is obvious that the situation was unclear for him,” the

attempt to respond demonstrated that the captain was capable of appropriate responses. 

The specialist’s review of the USAir flight 427 captain’s fundamental frequencies

indicated that when he spoke the phrase “four twenty seven” during the emergency (about

1903:15), the fundamental frequency was 47 percent higher than the average fundamental

frequency when that phrase was spoken during routine flight operations. Additionally,

although this communication was incomplete (“four twenty seven emergency”), it was

appropriate for the situation. The specialist believed that the captain was operating at the

second stage of psychological stress at that time because his speech displayed

characteristics of a significant level of stress but did not indicate that he had reached a

level of panic (the third stage).

The specialist stated that neither of the USAir flight 427 pilots exhibited the third

stage of psychological stress until 1903:17.4 (about 5 seconds before ground impact). The

specialist reported that the captain then appeared to enter the highest stage of emotional

stress because he issued inadequate commands between 1903:18.1 and 1903:19.7

(“pull...pull...pull”) and was unable to “act and react in accordance to the situation.” The

specialist also noted that the first officer “demonstrated high levels of psychological stress

before the impact, reflected by the speech degrading into short exclamations and

expletives.” 

In his analysis of the pilots’ physical responses, the specialist reported that the first

officer exhibited signs of high physical effort (coinciding with signs of increased

psychological stress). According to the specialist, the first officer exhibited speech

disruptions, such as grunts and forced exhalations beginning at 1902:59.7 (when he was

likely to have been actively controlling the airplane) and continuing for several seconds.

The specialist stated that:

...a person making a great physical effort develops a musculo-skeletal

“fixation” (of the chest), which leads to deterioration of the normal

expansion and ventilation of the lungs (inhaling and exhaling). These

changes are manifested during speech. Sounds such as grunting and strain

appear in speech as the person tries to minimize the outflow of air. Inhaling

and exhaling become forced and rapid.” 

The specialist further stated that normal use of the cockpit controls should not

produce these types of sounds. He said that the sounds emitted by the first officer during
Factual Information 143 Aircraft Accident Report

the upset sequence indicated that “[he] was struggling unusually hard...[as] if he was

experiencing unusual resistance in the use of a control.” 

The specialist noted that, although the first officer displayed signs of significant

physical effort almost immediately after the upset event, he did not display those signs

throughout the entire accident sequence. At 1903:04.6, when the first officer stated “oh

[expletive],” no evidence of grunting, straining, or forced exhalation was recorded.

However, at 1903:18.5, the first officer’s statement of “oh [expletive]” was accompanied

by forced exhalation, exhibiting evidence of high physical exertion. The specialist stated

that the first officer’s “unconscious pressing of ATC/intercom switch suggests that he

could be trying to position his hands on the control wheel during the high pulling

forces.”221

According to the specialist, during the last 5 seconds of the flight, the captain

began to exhibit symptoms of increased physical effort, as evidenced by short, forced

inhalations after each “pull” command. On the basis of his observations, the specialist

from the Interstate Aviation Committee developed the following conclusions:

• The accident sequence was completely unexpected by the crew. It caused their

orientation response of the “What is that?!” type.

• The accident sequence was completely unclear for the crew.

• From the beginning of the accident sequence until 1903:18.1 the captain did

not apply high physical loads to the controls and, most likely, did not

participate in the control.

• The first officer applied physical loads and controlled the airplane. The loads

were high, probably maximum, but varied during the upset period.

• Both crew members experienced high psychological stress. At the last

moments (beginning at 1903:17.4), stress increased and became a panic

(stage 3).

1.16.8.1.1.1 Interstate Aviation Committee Specialist’s Guidelines Applied 

to United Flight 585 CVR Information

The Safety Board applied the specialist’s guidelines and criteria to the speech and

other sounds recorded by the United flight 585 CVR. In this case, when the captain spoke

the word “flaps” during the accident sequence (at 0943:33.5),222 his speech fundamental

frequency was 77 percent higher than when he spoke the same word during routine flight

operations. In addition, the captain’s statement “fifteen flaps” (at 0943:33.5) signified a

221 Evidence from the ATC transcript and the CVR indicated that the first officer’s ATC/intercom switch

was intermittently activated from 1903:09:4 (shortly after CVR began to record a vibrating sound similar to

an airplane stickshaker at 1903:08.01) to the end of the CVR recording at 1903:22.8. In addition to the

intercom switches located on the radio selector panels outboard of each pilot’s knees in the cockpit

(discussed in section 1.16.7.2), an intercom switch is also located on the forward side of the control wheel

(away from the pilots). 

222 All times in this section are mountain standard time, based on a 24-hour clock.
Factual Information 144 Aircraft Accident Report

go-around decision but occurred without the captain first stating “go-around thrust,” as

specified in the procedures section of the company flight manual at the time of the

accident. According to the specialist’s guidelines, the captain’s responses (high

fundamental frequency value and omission of a standard procedure item while

communicating and responding appropriately to the situation) indicated that he was likely

operating at the second stage of stress at 0943:33.5. He had not reached panic but was

displaying characteristics of a high level of stress within about 11⁄2 seconds of the onset of

the emergency period. The Safety Board’s examination of the remaining 8 seconds of

CVR information indicated that the pilots likely reached the third stage of stress—panic—

before the airplane crashed.

1.16.8.1.2 Summary of Observations of U.S. Naval Aerospace Medical 

Research Laboratory Specialist 

The specialist from the U.S. Naval Aerospace Medical Research Laboratory

reviewed the USAir flight 427 CVR to provide observations on pilot breathing and

muscular exertion. The specialist stated that both pilots appeared “conscious and fully

aware of the emergency nature of the situation” and that “neither seemed impaired or

incapacitated [according to] the sounds heard on the tape.” 

 With regard to the captain, the specialist noted that “after the onset of the

emergency period, the rate of breathing of the [captain] increased...there was an initial,

large exhalation with the utterance ‘sheeez’ in response to the first sudden, unusual

movement of the aircraft at the start of the emergency sequence. That was followed

shortly by a deep, rapid inhalation223 before the word ‘whoa’ was heard from the captain,

almost as if he was startled by the continued departure of the aircraft from normal flight.

The breathing response of the captain after the onset of the emergency appears to have

been a normal sympathetic nervous system response that would include increased heart

rate, breathing rate, body temperature, and blood pressure, all commonly observed in

emergency situations.”

The specialist stated that, almost immediately after the initial upset, the CVR

recorded two rapid grunting exhalations on the first officer’s channel, which the specialist

attributed to the first officer’s muscular exertion to control the airplane during the accident

sequence. The specialist also stated that the first grunting sound was soft, whereas the

second was louder and more forceful, representing the use of increased muscular force.

Other than the first officer’s deep rapid breathing, no additional audible (nonverbal) noises

were recorded on the first officer’s channel during the remainder of the recording. The

specialist stated that, although the CVR did not record similar indications of muscular

exertion/strain on the captain’s channel, “that is not to say that the [captain] was not on the

controls, but only that he did not appear to be exerting increased muscular force....”224

223 The USAir flight 427 captain’s breathing response is noted in the CVR transcript at 1902:59.1 as a

“sound similar to person inhaling/exhaling quickly one time.”

224 This specialist stated that the captain (who had recently returned to flying duties after back surgery)

may have been reluctant to exert excessive muscular force with his upper body because of the surgical

repair. 
Factual Information 145 Aircraft Accident Report

The specialist stated that “the physical act of manipulating the controls of modern aircraft

under normal conditions does not usually require excessive muscular force...during

emergency situations, increased muscular force may be needed....”

1.16.8.1.3 Summary of Observations of NASA’s Ames Research Center 

Specialist

The specialist from NASA’s Ames Research Center reviewed the USAir flight 427

CVR, focusing on the flight crew’s task-related (routine and emergency), procedural (ATC

communications, checklists, and PA announcements), and nontask-related (interpersonal

interactions) speech communications. She stated that the pilots’ speech communications

during the routine portion of the flight appeared to be complete, cooperative, and

responsive and that the interactions between crewmembers were casual and friendly. She

reported that crew coordination was thorough and that neither pilot appeared reluctant to

seek or incorporate information from each other or ATC. The specialist noted that all

coordination issues and questions had been resolved and that all appropriate procedural

communications appeared to have been accomplished (checklists and PA announcements)

before the initial upset occurred. 

The specialist indicated that an evaluation of the speech communications recorded

during the emergency portion of the flight was made difficult because flight crew speech

in the final 25 seconds of the CVR recording was minimal and often fragmented. The

specialist stated that the comments made by the first officer throughout the accident

sequence did not contain much information. She reported that the best source of verbal

information during the accident sequence was contained in the captain’s statements

between about 1902:57 and about 1903:10. The specialist stated that, although the

captain’s language was ambiguous during this period, it indicated that he recognized that a

problem existed but that he had not yet identified the source or nature of the problem.

1.17 Operational and Management Information

1.17.1 USAir

At the time of the accident, USAir employed approximately 46,000 people and

operated a fleet of 443 aircraft, including 234 Boeing 737s.225 USAir maintained major

hub operations in Pittsburgh and Charlotte and smaller hub operations in Philadelphia;

Indianapolis; and Baltimore, Maryland. USAir’s heavy maintenance, structural repairs,

and overhauls were accomplished in Pittsburgh; Charlotte; and Winston-Salem, North

Carolina.

In the 6 years preceding the accident, USAir had grown as the result of several

mergers. The largest mergers occurred in 1988, when USAir acquired PSA, and in 1989,

when USAir merged with Piedmont Airlines. According to USAir personnel,

225 Records indicate that the 234 Boeing 737 airplanes operated by USAir included 79 737-200 series

models, 101 737-300 series models, and 54 737-400 series models. 
Factual Information 146 Aircraft Accident Report

standardization of the different pilot groups that resulted from the mergers was

accomplished through a process described as “mirror-imaging.” Specifically, USAir

developed a team of check airmen from USAir, PSA, and Piedmont Airlines to establish

standardized procedures for the merged aircraft fleet based on the procedures used by

USAir at the time. Checklists, flight operations manuals, and pilot handbooks were

rewritten, and flight and simulator training sessions were revised to implement the

standardized procedures. A review of USAir staffing assignments revealed that

management and training positions were staffed by personnel with backgrounds from

USAir, PSA, and Piedmont. USAir management and training personnel reported that they

believed that the merged airlines’ procedures, personnel, and aircraft had been

successfully integrated. 

At the time of the accident, USAir had a full-time Quality Assurance/Flight Safety

Department that was responsible for identifying, communicating, and resolving flight

safety-related issues. The Director of Flight Safety reported to the Vice President of Flight

Operations. The Quality Assurance/Flight Safety Department interacted with the FAA,

ALPA, USAir management, USAir training personnel, and line pilots to develop and

disseminate safety-related information to flight crews. Safety information was

communicated to employees via electronic mail; bulletin boards; attachments to flight

paperwork; printed notices distributed to company mailboxes; periodic “Flight Crew

View” publications; and USAir’s Flight Training and Standards Department during

simulator, line check, CRM, and LOFT training sessions.

Because USAir was a military contract carrier, the Department of Defense

completed a survey in June 1994 that rated the airline’s capabilities. USAir received

“excellent” to “above average” ratings in all areas of flight crew operations, training, and

safety.

1.17.2 USAir Flight Training

USAir’s Flight Training and Standards Department was responsible for ensuring

the continuing competency of the pilots, check pilots, and instructors in each of the

aircraft operated by the company. At the time of the accident, six flight training managers

were responsible for training in the following aircraft:

• Boeing 727, 757, and 767;

• Boeing 737-300 and -400;

• Boeing 737-200;

• Douglas DC-9 and McDonnell Douglas MD-80;

• Fokker F.100; and 

• Fokker F.28.

The training staff for the 737-300 and-400 airplanes consisted of two senior check

airmen, 6 check pilot designees, and 47 full-time check pilots. According to the Director
Factual Information 147 Aircraft Accident Report

of Flight Training and Standards, USAir flight training staff performed all training and

flight check functions, including initial simulator training, initial operating experience

(IOE), proficiency checks, requalifications, line checks, CRM, LOFT, and special airport

qualification training. Additionally, the Director of Flight Training and Standards stated

that the FAA, ALPA, and USAir flight training personnel met regularly to discuss

standardization matters, such as syllabi, procedures, training techniques, grading criteria,

and trend analyses.

1.18 Additional Information

1.18.1 Overall Accident Record and History of the 737 

According to Boeing, 737 series airplanes have flown more than 92 million hours

since entering service in December 1967. During its investigation of the USAir flight 427

accident, the Safety Board reviewed the overall accident history record of the Boeing 737

airplane and compared this record with other generally comparable airplane types. The

Safety Board examined worldwide aviation accident and departure data provided by

Airclaims Limited of London, England.226 These data indicated that 737 series airplanes

were involved in 43 total loss accidents227 between January 1988 and December 1997,

which corresponds to 0.99 total loss accidents per 1 million departures.228 Table 7 shows

total loss accident data for several airplane types arranged in order of least to most number

of total loss accidents per 1 million departures.

226 Airclaims Limited is an aviation consulting firm that collects data, in part, for the aviation insurance

industry. The Airclaims Limited database is recognized by the aviation industry as a definitive source for

worldwide aviation accident information. 

227 Airclaims Limited defines a total loss as an aircraft that has been destroyed or for which the

estimated repair costs rendered the aircraft a total loss under the terms of the insurance contract. (Airclaims

Limited notes that some aircraft that became total losses have been repaired and returned to service.) Any

total losses that Airclaims listed as the result of a deliberate violent act were eliminated from these data.

228 Airclaims Limited. 1998. Airliner Loss Rates. Heathrow Airport, England. 

Table 7. Number of worldwide total loss accidents and total loss accidents per 1 million 

departures for selected aircraft types, 1988-97.

Airplane type

Total number 

of loss accidents

Total loss accidents 

per 1 million departures

Boeing 757 4 0.62

Douglas DC-9/McDonnell 

Douglas MD-80 27 0.86

Airbus A319, A320, and A321 5 0.95

Boeing 737 43 0.99

Boeing 727 23 1.19

Fokker F.28, F.70, and F.100 15 2.23
Factual Information 148 Aircraft Accident Report

1.18.1.1 History of 737 Potential Rudder System and/or PCU-Related 

Anomalies/Events

The following list of selected 737 yaw/roll events describes identified rudderrelated anomalies that were reported before the USAir flight 427 accident. (Yaw/roll

events reported after the USAir flight 427 accident are discussed later in this section and

are listed in appendix E.) Some of the anomalies summarized in this section were

previously discussed in the Safety Board’s final report on the 737 accident at Colorado

Springs, and others were reported to Boeing through various means (such as reports from

AAIB and the civil airworthiness authority of New Zealand). As a result, the extent to

which these events were documented and the amount of available data regarding these

events varied widely. 

• On July 24, 1974, the flight crew of a 737 reported that a rudder moved "full

right" upon touchdown. The investigation revealed that the primary and

secondary slides were stuck together by a shotpeen ball lodged in the servo

valve.

• On October 30, 1975, during a main rudder PCU inspection, shotpeen balls

were found in a servo valve that had undergone chrome plating. 

• On August 26, 1977, the flight crew of a 737 reported that, during taxi, the

right rudder pedals moved in "half way" and then jammed. This event

happened three times and was corrected each time by cycling the rudder with

the standby rudder system. Further examination indicated that the main rudder

system was contaminated by metal particles.

• On August 31, 1982, a 737 reported that the rudder "locked up" on approach

and that the flight crew initiated a go-around and activated the standby rudder

system. The subsequent landing was uneventful. The examination of the PCU

revealed internal contamination and worn seals, which resulted in the PCU

having a limited capability to generate enough force to move the rudder.

• On November 8, 1990, during an overhaul, a main rudder PCU was found to

have internal corrosion. The primary slide was stuck to the secondary slide at

the neutral position as a result of the corrosion. No malfunctions were reported

before disassembly.

• On January 4, 1993, the flight crew of a United Airlines 737-300, N309UA,

reported a “hydraulic block/binding” during the flight control check. The main

rudder PCU was removed from the airplane and shipped to Parker for

examination. When tested in its “as received” condition, the PCU exhibited

reduced rates, complete stalls, and reversals while being commanded in the

retract direction (right rudder). Further examination at the Parker facility

revealed that the servo valve retaining nut was loose; when the retaining nut

was tightened properly (to 170 inch-pounds), investigators were unable to

duplicate the anomalies that were observed during the previous testing. As a

result of this investigation, Boeing and Parker modified the spring guide

(which locks the retaining nut in place) to provide better engagement with and
Factual Information 149 Aircraft Accident Report

retention of the nut. The companies also devised an additional test procedure to

stroke the secondary slide within the internal limits of the servo valve. This test

procedure was added to Parker’s acceptance test procedure and Boeing’s

Overhaul Manual.

• On April 16, 1993, the flight crewmembers of an Air New Zealand 737-200

reported that they were descending from FL 350 to FL 330 (because of

turbulence encountered at the higher altitude) when they experienced a series

of uncommanded rudder inputs (with rudder pedal feedback) that continued

(randomly right and left) throughout the remainder of the flight. The pilots

reported that, during landing, a “large” left rudder offset was experienced. Both

pilots stated that the rudder was stiffer than normal throughout the incident

flight. Postincident testing revealed that the yaw damper coupler was capable

of normal operation (although the rate gyro tested “out of limits”) and that the

standby and main rudder PCUs operated normally except when the standby

PCU was tested at cooler temperatures229 with 3,000 psi hydraulic pressure.

Under those test conditions, the input arm required up to 4.5 pounds of force

before it moved; the input arm normally moves with about 0.5 pounds of force.

Evidence of corrosion was found on the outer diameter of the bypass valve

sleeve, and slight galling was noted on the input shaft and bearing.

• On August 31, 1994, a British Airways 737-200, G-BGJI, experienced a full

left rudder deflection and subsequent rudder jam when the standby rudder

system was selected during ground operations. According to the United

Kingdom civil airworthiness authority, when the standby rudder system was

selected, no rudder movement was possible through the rudder pedals.

However, when the standby rudder system was deactivated and rudder system

operation was transferred to hydraulic systems A and/or B, the rudder jam was

eliminated, and the rudder returned to neutral. The standby rudder actuator was

removed and replaced, and the rudder subsequently functioned normally on

hydraulic systems A and B and the standby hydraulic system. A partial

teardown of the standby rudder actuator revealed that the servo valve had

seized; examination revealed corrosion and water in the unit and corrosion in

the bypass valve, input shaft, and input shaft bearing.

In January 1999, Parker notified the Safety Board that a recent search of its files

produced three additional reports of anomalous Boeing 737 main rudder PCU operation.

Two reports were from 1982, and one was from 1984.

The first report, dated October 4, 1982, indicated that Parker had examined a main

rudder PCU at Boeing’s request “to determine the cause for rudder lockup during

flight.”230 No date for the rudder lockup event was specified in the report. Fluid samples

removed from the unit were found to be contaminated, but the nature of the contamination

229 Since the time that it was notified of this event, the Safety Board has made several requests (first in

May 1993 and most recently in October 1998) for additional information regarding the temperatures used

during these tests. To date, officials at Air New Zealand, the New Zealand civil airworthiness authority, and

Boeing have been unable to provide the requested information. 
Factual Information 150 Aircraft Accident Report

was not described in the report. The PCU passed Parker’s acceptance test procedure at

room temperature; however, when it was cooled to -65° F, the PCU failed the linkage

breakout friction test (which measures the amount of force needed to move the input arm)

in the extend direction and the yaw damper system test (which measures consistency of

yaw damper response). According to the report, a new-production PCU also failed these

tests at -65° F. The incident PCU was disassembled after the testing, and no discrepancies

were noted.

Parker summarized the results of its examination as follows:

...no determination could be made as to the cause for the rudder lockup.

Both units, during the subtemperature tests, exhibited high friction and

reduced reactions to electrical input signals. These high frictions and

reactions exceeded the allowable specifications [sic]; however, it is

Parker[]’s opinion that this would be expected at the low temperatures.

This friction would be the result of changes in the materials, which would

affect the close tolerance fit of mating parts, ie: linkages, bearings, lap fits

of valve assemblies, etc.....

The second report, dated October 8, 1982, also stated that a main rudder PCU was

examined “to determine the cause for rudder lockup during flight.” The report did not

specify a date of the rudder lockup event. The PCU passed all of Parker’s acceptance tests

with the exception of the yaw damper system test and the yaw damper engage test (which

tests the yaw damper’s response when it is switched on). Disassembly of the PCU

indicated excessive wear on the yaw damper’s walking beam assembly. When the servo

valve was removed from the PCU and the primary slide was fully retracted into the

secondary slide, the primary slide jammed against the secondary slide. However, when the

servo valve was reinstalled on the PCU, the primary slide could not travel as far in the

secondary slide as it had when it was removed from the PCU; thus, the primary slide did

not jam in the secondary slide. The report indicated that the servo valve was removed and

tested again but that “no evidence of binding, jamming, or lockup could be verified.”

Parker summarized the results of its examination as follows: 

...no determination could be made as to the cause for a rudder lockup. The

test findings for the phase Lag and Yaw Damper Engage tests were

determined to have been caused from the Transfer Valve being off null

position. It was determined that the Servo Slide does not have enough

travel by design to allow the Primary Slide to bottom into the Secondary

Slide and jam. Parker[]’s conclusion to the investigation is that none of the

noted findings could have caused the rudder lockup.

The third report, dated May 11, 1984, describes a January 25, 1984, examination

of a main rudder PCU that experienced an “intermittent kick and hardover condition.”

According to the report, Boeing notified Parker that an operator had experienced an

intermittent rudder kick and hardover condition during flights at high altitude and that the

230 According to the report, a Parker facility had previously examined the unit, found no fault with it,

and returned it to the customer.
Factual Information 151 Aircraft Accident Report

PCU had been removed and overhauled at a repair station. According to the report, after

the PCU was reinstalled on another airplane in the operator’s fleet, that airplane also

experienced a “rudder kick and hardover condition.” Boeing requested that the operator

remove the PCU and send it to Parker for detailed analysis. When tested at room

temperature, the PCU passed all of Parker’s acceptance tests except the linkage breakout

friction test in both the extend and retract directions. When tested at -65° F, the PCU failed

the yaw damper system test. The report stated that, after the examinations, the unit was

reassembled, recertified, and returned to the operator.

Parker summarized the results of its examination as follows:

...a determination as to the cause of the rudder kick and hardover condition

could not be made from the discrepancies found during testing and

disassembly.” 

As a result of the USAir flight 427 accident and other accidents and incidents

involving apparent 737 directional control anomalies, the Safety Board reviewed available

information regarding more than 100 other 737 yaw/roll upset events and anomalies that

were reported since the 737 was initially certificated.231 Further, the Safety Board

examined more thoroughly available data from many of these events for evidence that

servo valve jamming or other main rudder PCU anomalies were involved (including the

events described individually in this report).232 When available, FDR and/or quick access

recorder (QAR)233 data from these 737 events were obtained by the Safety Board for

examination, comparison, and evaluation. The Safety Board’s review indicated that 71 of

the reported yaw/roll events involved anomalous operation of the rudder system. In many

cases, the identified causes were yaw damper anomalies; others were attributed to rudder

PCU anomalies. 

The Safety Board determined that several of the anomalous yaw damper events

were the result of a failure within the yaw damper rate gyro, which is located in the yaw

damper coupler in the E/E bay beneath the cabin directly behind the cockpit. In many

airplanes, the forward lavatory or galley is located directly above the E/E bay, and several

231 Information from Boeing indicates that, between 1990 and 1994 (before the USAir flight 427

accident) there were 187 reported yaw/roll events involving the 737. (Yaw/roll event reporting is mostly

voluntary. The number of such reports increased considerably after the USAir flight 427 accident.) In

comparison, information from Boeing’s Douglas Products Division indicates that, over about 75 million

flight hours, there had been only 3 reported yaw/roll events involving the DC-9/MD-80 series airplanes.

Information from Airbus indicates that, over about 4 million flight hours as of November 1995, there had

been only one reported yaw event involving the A-320, and that event was caused by a rudder mistrim. 

232 See appendix E for a complete list of the 112 documented 737 rudder events that were examined by

the Safety Board. This list is not necessarily intended to suggest that the events are similar to those involved

in the USAir flight 427 accident; it is simply a documentation of 737 yaw/roll events that have been reported

to and followed by the Safety Board. Additionally, the list is not necessarily a complete list of all yaw/roll

events because air carriers often do not report events in which the yaw/roll anomaly ceased when the yaw

damper or autopilot system was disengaged. Thus, although several air carriers have been aggressive about

reporting yaw/roll events (especially during the months after the USAir flight 427 accident), many such

events may not have been reported.

233 QARs have greater data storage capabilities than FDRs but are primarily intended for air carrier

maintenance fault analysis. QARs are not protected/hardened to survive crash impact or fire conditions. 
Factual Information 152 Aircraft Accident Report

737 yaw damper system-related anomalies were found to be the result of fluid

contamination (resulting from leakage of lavatory fluid, or “blue water”) of the yaw

damper coupler, associated wires, and/or connectors. (The 737 series airplanes have a

documented history of blue water contamination and erosion;234 see appendix F for more

information.) Another possible source of yaw damper anomalies that was considered is

electromagnetic interference (EMI) or high-intensity radiated fields (HIRF).235

Several events that appear to involve PCU servo valve and/or rudder-related

anomalies and may have potential relevance to the flight control issues investigated in

connection with the USAir flight 427 accident are discussed in the following text. Two

additional events that also appear to have potential relevance to the USAir flight 427

accident—the United flight 585 accident and the Eastwind flight 517 incident—were

discussed previously (in section 1.16.1) and are not discussed further in this section. 

July 1992 United Airlines Ground Check PCU Anomaly (737-300)

On July 16, 1992, during a preflight rudder control ground check at ORD, the

captain of a United Airlines 737-300 noted that the left rudder pedal stopped and jammed

near 25-percent pedal travel. The captain reported that he was moving the rudder pedals

more rapidly than usual when the jam occurred. He further stated that the rudder pedals

returned to their neutral position after he removed foot pressure from the left rudder pedal.

The airplane returned to the gate, and the main rudder PCU was removed for further

examination. 

The main rudder PCU was tested and examined at United Airlines’ facility in San

Francisco, California, and Parker’s facility in Irvine, California. The testing revealed that

the PCU exhibited anomalous behavior, ranging from sluggish movement of the actuator

piston to a full reversal in the direction of piston travel opposite to the direction being

commanded, when the input crank was fixed against the PCU body stops (to move the

primary and secondary slides throughout their full travel) and the yaw damper piston was

in the extend position. The testing also revealed high internal fluid leakage. When

investigators tapped on the dual servo valve housing or the summing levers or released the

force on the input crank, the PCU returned to normal operation. 

234 According to Boeing, the 737 is not designed to port excess blue water overboard; instead, the

airplane is equipped with a shallow drip pan at each lavatory, which is intended to catch spills and overflows

and prevent blue water contamination/erosion. However, 737 operators report that the drip pan cannot catch

large spills, such as those that result from overfilling the lavatory system. See section 1.6.1.1 for information

regarding blue water contamination from the accident airplane’s maintenance records. 

235 EMI or HIRF can induce an electrical potential in electrical wiring and circuits or be received by an

airplane’s navigational systems. Numerous navigational anomalies and sudden flight control movements on

737s and other airplanes have been attributed to EMI (generated by on-board portable devices, such as

laptop computers, electronic games, or cellular telephones) or HIRF (generated from outside sources, such

as radio towers, radar sites, and power stations). Technical literature indicates that it is possible for EMI or

HIRF to affect an airplane’s autopilot or yaw damper system up to the limits of the system. See Shooman,

M.L. “A Study of Occurrence Rates of Electromagnetic Interference to Aircraft with a Focus on HIRF....”

National Aeronautics and Space Administration, Langley Research Center, Hampton, Virginia, April 1994,

pp. 2, 7, and 20. Also see Flight Standards Information Bulletin for Airworthiness 97-16A, “Lightning/High

Intensity Radio Frequency Protection Maintenance,” Federal Aviation Administration, August 4, 1997.
Factual Information 153 Aircraft Accident Report

Further examination of the servo valve components showed that the secondary

slide could move axially beyond its designed operating position (overtravel), resulting in

abnormal porting of hydraulic fluid. When the secondary slide overtraveled to its

mechanical stop (internal stop) in the servo valve housing, the abnormal flow could

produce full pressure opposite to that intended at the actuator piston. Thus, the rudder

would move in a direction opposite to the commanded direction; for example, rudder input

intended to command left rudder could result in the rudder moving right. 

The Safety Board’s examination of this servo valve revealed that overtravel of the

secondary slide occurred when the rudder pedals were moved rapidly to command a

maximum rate of rudder travel or when a pedal was fully depressed to command full

deflection of the rudder. During subsequent tests, the overtravel of the secondary slide was

determined to be the result of the failure of the secondary summing lever to maintain

contact with its respective external stop. Examination of the summing levers revealed that

the secondary summing lever did not meet design specifications in that the chamfer236 on

the summing lever was 50°, rather than the specified 45°, at the point where it contacted

the external stop. This anomaly allowed the secondary summing lever to move beyond its

external stop; thus, the secondary slide and summing lever could continue to move beyond

the normal range of travel until the secondary slide bottomed out at its internal stop in the

servo valve housing.237

As a result of its investigation of this incident, the Safety Board became concerned

about the potential for rudder reversal in all 737 main rudder PCUs, specifically, that the

internal stops of the dual-concentric servo valve could allow sufficient movement to route

hydraulic fluid through a flow passage located outside the normal valve operating range,

resulting in movement in the direction opposite to the control input. On November 10,

1992, the Safety Board issued Safety Recommendations A-92-120 and -121. 

Safety Recommendation A-92-120 asked the FAA to 

Issue an airworthiness directive mandating design changes for main rudder

PCU servo valves that would preclude the possibility of rudder reversal

attributed to the overtravel of the secondary slide.

On March 3, 1994, AD 94-01-07 became effective (see sections 1.6.3.2.1 and

1.18.5). Because the Safety Board determined that the AD satisfied the intent of Safety

Recommendation A-92-120, it was classified “Closed—Acceptable Action” on

August 11, 1994. 

236 A chamfer is an oblique face located at a corner (a beveled edge). 

237 The servo valve was designed to prevent abnormal flow if the secondary slide bottomed out at its

internal stop; however, during the investigation of this incident, it was discovered that parts built within

tolerances could be assembled with a resulting tolerance buildup that would allow the abnormal flow to

occur if the secondary slide moved to its internal stop. Thus, in addition to the potential for overtravel

because of the incorrect chamfer, it became evident that the secondary slide could also be forced into the

overtravel range if it became jammed to the primary slide. Normal movement of the primary slide could

produce a rudder reversal if a primary to secondary slide jam existed.
Factual Information 154 Aircraft Accident Report

Safety Recommendation A-92-121 asked the FAA to

Conduct a design review of servo valves manufactured by Parker Hannifin

that have a design similar to the 737 rudder power control unit servo valve

that control essential flight control hydraulic power control units on

transport-category airplanes certificated by the Federal Aviation

Administration to determine that the design is not susceptible to inducing

flight control malfunctions or reversals due to overtravel of the servo

slides. 

On January 19, 1993, the FAA stated that it had completed a design review of the

servo valves manufactured by Parker on all transport-category airplanes. The FAA stated

that its review indicated that the problem identified in this incident investigation existed

only in the main rudder PCU on the 737 airplane. Because this design review met the

intent of Safety Recommendation A-92-121, it was classified “Closed—Acceptable

Action” on June 10, 1993. (See section 1.18.11.3 for additional information regarding

these recommendations and two others related to this incident.) 

British Airways Incident (747-436, G-BNLY) 

On October 7, 1993, a British Airways 747-436, G-BNLY, experienced an in-flight

upset as the airplane climbed through 100 feet agl during its departure from London’s

Heathrow Airport. The airplane suddenly pitched down from 14 to 8° nose up because of

uncommanded downward travel of the elevators on the right side of the airplane. The

flight crew maintained control of the airplane and landed uneventfully at Bangkok,

Thailand, the flight’s intended destination. The incident was investigated by the AAIB. 

The elevators on the 747-400 are not interconnected. Postincident examination of

the airplane’s QAR238 indicated that the elevators on the right side of the airplane moved

to near their maximum downward deflection limit. The elevators on the left side of the

airplane moved upward to counter the right-side downward deflection, which allowed

recovery of the airplane. The AAIB’s investigation revealed that failure of the inboard

elevator PCU occurred because the servo valve secondary slide overtraveled to the

internal retract stop and that the primary slide had moved to the limit of the extend linkage

stop. (The 747 elevator PCU, as with the 737 main rudder PCU, contains dual-concentric

servo control valves and is manufactured by Parker.) 

The AAIB issued its final report on this accident on December 14, 1994.239 The

report identified the following causal factors:

The secondary slide of the servo valve of the inboard elevator Power

Control Unit (PCU) was capable of overtravelling to the internal retract

stop; with the primary slide moved to the limit imposed by the extend

238 In testimony at the Safety Board’s January 1995 public hearing session regarding USAir flight 427,

the AAIB investigator stated that, without the information available on the QAR, the event would have

probably been attributed to a wake vortex encounter rather than an elevator-related anomaly. 

239 See Air Accidents Investigation Branch. 1994. Report on the incident to Boeing 747-436, G-BNLY,

at London Heathrow Airport on 7 October 1993. Aircraft Accident Report 1/95.
Factual Information 155 Aircraft Accident Report

linkage stop, the four chambers of the actuator were all connected to both

hydraulic supply and return, the servo valve was in full cross-flow resulting

in uncommanded full down travel of the right elevators. 

A change to the hydraulic pipework associated with the right inboard

elevator Power Control Unit was implemented on the Boeing 747-400

series aircraft without appreciation of the impact that this could have on the

performance of the unit and consequently on the performance of the

aircraft elevator system, in that it could exploit the vulnerability of the

servo valve identified in (i) above. 

As a result of its investigation, the AAIB recommended that the Safety Board

“consider re-issuing safety recommendation A-92-121 [asking the FAA to determine

whether servo valves in other than those in the 737 PCU could induce flight control

malfunctions or reversals] to verify that its full intent has been met.” Page 22 of the AAIB

final report stated that Boeing was queried about what consideration it gave to the 747

inboard elevator PCU based on the Safety Board’s Safety Recommendation A-92-121 and

that Boeing replied:

Parker did an analysis to support the NTSB recommendation. Parker

looked at all possible jam positions with pilot limiting linkage stops,

specifically with the primary slide jammed at null and determining possible

reversals. There were no discrepancies uncovered and therefore no actions

taken. The extreme stop condition was not envisioned at the time. 

In connection with its investigation of the USAir flight 427 accident and because

of its continuing concern about the potential for failure of the PCU servo valves in other

designs and applications, the Safety Board issued Safety Recommendation A-96-117 on

October 18, 1996. Safety Recommendation A-96-117 requested the FAA to

Conduct a detailed design review of all dual-concentric servo control

valves that control essential flight control system actuators on transportcategory airplanes certificated by the FAA to determine if the design is

susceptible to inducing flight control malfunctions and/or reversals as a

result of unexpected improper positioning of the servo slides. If the design

is determined to be susceptible, mandate appropriate design changes. 

On May 13, 1998, the FAA stated that its detailed design review of dual-concentric

servo valves would address the intent of this safety recommendation. However, on

February 2, 1999, the Safety Board indicated that airplanes produced by Airbus were not

included in the FAA’s review. Pending the Safety Board’s review of the FAA’s detailed

design review, including information on Airbus airplanes, Safety Recommendation

A-96-117 was classified “Open—Acceptable Response.” (See section 1.18.11.5 for

additional information regarding this recommendation.) 

Sahara India Airlines Training Flight Accident (737-200, VT-SIA)

On March 8, 1994, a Sahara India Airlines 737-200, VT-SIA, was on a training

flight when it experienced a loss of control during initial climbout after takeoff at the

Palam Airport in New Delhi, India. The airplane crashed on an airport ramp area, caught
Factual Information 156 Aircraft Accident Report

fire, and collided with a parked Aeroflot IL-86 near the international terminal. The four

pilots on board the 737 (three pilots-in-training and one instructor pilot) and five

individuals on the ground were killed, and four individuals on the ground received serious

injuries. The final accident investigation report, issued in November 1996,240 stated that

the cause of the accident was “the application of wrong rudder by [the] trainee

pilot...during [an] engine failure exercise.” 

On November 14, 1994, the main rudder PCU from the Sahara Airlines 737 was

examined at Parker’s facility in Irvine, California, under the supervision of Safety Board

investigators. Examination of the PCU revealed that the unit had apparently been serviced

at a facility other than the manufacturer and that a different serial number had been applied

to the PCU. A servo valve test was performed to simulate a jammed primary slide and

subsequent overtravel of the secondary slide. The test indicated that the PCU could

reverse if the primary slide was jammed to the secondary slide and the rudder was moved

rapidly or to its limits. According to Parker personnel, the PCU spring guide appeared to

have been modified to a different configuration (one which would have fit a Boeing 707).

Parker personnel attributed the PCU’s reversal potential to the use of this modified spring

guide, which permitted more overtravel than a properly configured spring guide would

have. It was not possible to determine where the spring guide had been reworked or when

it had been installed. 

On December 5, 1994, the U.S. Accredited Representative to the Sahara accident

(under the provisions of Annex 13 to the Convention on International Civil Aviation)

advised the Indian Court of Inquiry of the incorrect spring guide installation and the

resultant potential for reverse rudder operation. In a June 6, 1995, letter, the U.S.

Accredited Representative advised the Indian Court of Inquiry that the final report

regarding the Sahara accident did not mention the PCU-related findings. The Safety Board

did not receive a response to either of these letters. 

Continental Airlines Flight 1057 (737-300, N17344)

On April 11, 1994, Continental Airlines flight 1057, a 737-300, N17344,

experienced flight control anomalies during a flight between Houston, Texas, and

Tegucigalpa, Honduras. The flight crew diverted to San Pedro Sula, Honduras, and made a

successful emergency landing. During postincident interviews, the pilots reported that

they were in cruise flight at FL 370 when they heard a muffled boom and felt an

uncommanded yaw and roll to the right. The pilots applied full opposite aileron to

counteract the roll and disengaged the autopilot; however, they reported that control wheel

forces were high for the remainder of the flight. The pilots reported that they maintained

higher-than-normal airspeeds for improved controllability during the approach and

landing. 

Review of the FDR information revealed that the yaw/roll event was consistent

with a 2.5° sustained rudder input, which was consistent with the yaw damper authority

240 Report on Accident to Sahara India Airlines 737 Aircraft VT-SIA During Training Flight at IGI

Airport, Delhi, on March 8, 1994. Indian Director General—Civil Aviation, November 1996. 
Factual Information 157 Aircraft Accident Report

for the given flight conditions (241 knots at 37,000 feet msl). Postincident examination of

the airplane’s yaw damper revealed a higher-than-normal output voltage on the rate gyro

of the yaw damper coupler. Further examination of the yaw damper revealed an

intermittent open resistance condition in the yaw damper engage solenoid valve; this

condition could allow the voltage from the PCU to build up over time within the yaw

damper coupler and result in a maximum yaw damper command. The cause of the

intermittent yaw damper engage solenoid operation was determined to be hydraulic fluid

contamination of the solenoid’s coil assembly. On June 9, 1997, the FAA issued

AD 97-09-15, which requires replacing the yaw damper engage solenoid with a solenoid

that has encapsulated electrical coils to prevent the intrusion of hydraulic fluid. The

solenoid was to be replaced the next time the PCU is repaired or within 5 years or 15,000

flight hours from the AD’s date of issuance.

British Airways Maintenance Test Flight Incident (737-236, G-CBJI)

On October 22, 1995, a British Airways 737-236, G-CBJI, experienced several

yaw/roll oscillations during a postmaintenance test flight. The pilots were preparing to test

the passenger oxygen mask automatic deployment system at an altitude of about 20,000

feet msl and an airspeed of 290 knots when the oscillations began. The pilots disconnected

the autopilot and autothrottle system, and the captain reported that he believed he turned

off the yaw damper system; however, the oscillations continued. The oscillations

exceeded 10° of bank with a period between peaks of about 2 seconds. The flight crew

declared an emergency and started a descent back to the departure airport (London’s

Gatwick Airport). At an altitude of about 7,000 feet msl and an airspeed of 250 knots, the

oscillations began to decrease in severity and subsequently stopped completely. The pilots

landed the airplane at Gatwick Airport without further incident. 

The incident was investigated by the AAIB, which determined that the cause of the

yaw/roll oscillations was corrosion of a multipin electrical connector inside the yaw

damper coupler. The failure resulted in the yaw damper moving the rudder back and forth

within the yaw damper limits (± 2° on this airplane). The combination of rudder

oscillations, air density, and airspeed allowed for excitation of the airplane’s natural

frequency in the dutch roll mode. Once the airplane descended to denser air and reduced

airspeed, the excitation was damped and the oscillations stopped. 

The AAIB’s investigation found that the corrosion in the electrical connector was

most likely the result of leakage from the forward lavatory or galley. Additionally, the

investigation revealed that it might be possible to “generate stray current paths capable of

sustaining engagement of the yaw-damper system when selected to OFF, but only in the

presence of a high resistance in the engage-switch earth [ground] path.”

As a result of this incident and others involving fluid contamination of the 737 E/E

bay components, Boeing created an assessment team to investigate the problem and

recommend solutions. Appendix F provides information about the assessment team’s

activities, composition, and recommendations. 
Factual Information 158 Aircraft Accident Report

Delta Air Lines Incident (737-200, N377DL)

On August 13, 1998, a Delta Air Lines 737-200, N377DL, experienced a yaw/roll

event while en route from Houston to Cincinnati, Ohio. The event occurred while the

airplane was in cruise flight at FL 330 in the vicinity of Memphis, Tennessee. The airplane

was operating on the autopilot and in the “heading select” and “altitude hold” modes with

the autothrottles engaged. The pilot stated that the first irregularity he noted was that the

airplane did not turn when the heading bug was moved a few degrees. He noted that the

control wheel was not centered so he added rudder trim and disengaged the autopilot. He

then reengaged the autopilot, but rudder trim was required again. About 5 minutes after

reengaging the autopilot, the airplane made an abrupt uncommanded right turn. The pilot

said that he then took the controls, disengaged the autopilot, and applied left rudder and “a

little left aileron.” He did not turn off the yaw damper. The pilot stated that he thought the

airplane had lost an engine. After the event, the flight continued uneventfully and landed

in Cincinnati. The pilot made a maintenance entry regarding the autopilot, and the airplane

was decommissioned by Delta maintenance for the subsequent flight.

The FDR on the airplane recorded 11 parameters, but rudder surface or rudder

pedal position were not among those parameters. Examination of the FDR and radar data

revealed that on the flight from Houston to Cincinnati, while at an altitude of 34,000 feet

and an airspeed of 320 knots on a northerly heading, the airplane experienced a right

heading excursion of 4.2° within 1 second. The airplane’s bank angle changed from about

1° RWD to about 13° RWD within 2 seconds of the initial heading change. After the 4.2°

heading change, the airplane’s heading increased in an oscillatory manner until the

airplane was steadied after a total heading change of 7°. The heading was stabilized within

20 seconds of the initial heading excursion.

On the subsequent flight, the same airplane experienced a yaw/roll event while en

route from Cincinnati to Greensboro, North Carolina. The flight crew reported that the

airplane abruptly yawed left and then started to roll left. The captain reported that, during

this left yaw event, he had to apply considerable right control wheel input to maintain

wings-level flight. The flight crew reported that the yaw stopped but that the airplane then

yawed to the right just past neutral. The flight crew then disengaged the yaw damper. Both

crewmembers reported that the rudder pedals “pulsed” for the remainder of the flight.

Further examination of the FDR data indicated that, while at a cruise altitude of

23,000 feet and an airspeed of 325 knots, the airplane first experienced a left heading

change of 1.6° within 1 second, followed approximately 20 seconds later by a right

heading change of 2° within 1 second. During the same time, the airplane’s roll angle was

between 3° LWD and 5° RWD. Further calculations by the Safety Board determined that

the rudder position changes necessary to produce the abrupt yaws were consistent with a

yaw damper system input to the rudder and would not have exceeded the yaw damper

system authority. Delta subsequently examined the main rudder PCU and yaw damper

coupler and reported that no anomalies were found.
Factual Information 159 Aircraft Accident Report

1.18.1.1.1 QAR Data Findings

Although the origins of many 737 yaw/roll events were identified, some were not

as easily explained, including the anomalous yawing motions reported by the pilots who

flew the United flight 585 airplane during the month before the accident; the accidents

involving United flight 585, Sahara India Airlines, and USAir flight 427; the preincident

Eastwind Airlines rudder “bumps;” the Eastwind flight 517 uncommanded yaw/roll

incident; and the SilkAir accident (for more information regarding the SilkAir accident,

see section 1.16.5.4.1). 

During its investigation of the USAir flight 427 accident, the Safety Board

contracted with Flight Data Limited. in the United Kingdom to examine QAR data from

737s operating in Europe for evidence of unusual rudder activity and rudder movements

opposite to the control wheel movements. Review of the resultant QAR data (about

57,000 hours of operational data from 27 airplanes, including rudder position and control

wheel position) indicated the following: 

• 737 rudder position remained within the yaw damper range of operation during

97 to 98 percent of the samples (including departure, cruise, and approach-tolanding phases of flight).

• 737 control wheel position data showed that pilots were not likely to exceed

20° of control wheel input during cruise flight (99.9 percent of cruise flight

control wheel position samples were within 20° of neutral). 

• 737 control wheel position data indicated that the control wheel remained

within 20° of neutral in 94.4 percent of the samples during the departure phase

of flight (between 50 and 5,000 feet agl) and in 95.9 percent of the samples

during the approach-to-landing phase of flight (between 5,000 and 50 feet agl).

1.18.1.2 Recent Rudder-Related Events on 737s Equipped With the 1998 

Redesigned Servo Valve

Parker redesigned the main rudder PCU servo valve twice—once in response to

Safety Recommendation A-92-120 and AD 94-01-07 and again after Safety Board testing

in 1996 revealed the potential for the servo valve primary slide to overtravel if the

secondary slide jammed to the housing. (See section 1.18.5 for additional information.)

The second redesigned servo valve was completed in 1998. The following two rudderrelated events involved 737s that were equipped with the newly redesigned servo valve:

United Airlines Ground Check Rudder Anomaly (737-300, N388UA)

On February 19, 1999, the flight crew of a 737-300, N388UA, operated by United

Airlines reported a stiff or sluggish rudder response during a pre-takeoff flight control

check at Seattle, Washington. The flight crew stated that, when left rudder pedal was

applied, the required pedal pressure felt somewhat greater than normal and that the right

pedal would only move with an unusually large amount of force. After the pilots repeated

the check several times with similar results, they returned to the terminal gate.
Factual Information 160 Aircraft Accident Report

Maintenance personnel tested the rudder pedals and also found that an unusual amount of

force was required to move the right rudder pedal. The maintenance personnel further

found that the force required to move the right rudder pedal increased with the rate of

input and that the left rudder pedal required slightly more force than that normally

experienced.

The rudder system was examined, and no discrepancies were noted in the cables,

linkages, and push rods. The main rudder PCU was removed from the airplane. After a

replacement PCU was installed, the forces required to move the rudder pedals returned to

normal. The airplane was then returned to service, and no further problems with the rudder

system have been reported.

The main rudder PCU (which was equipped with the modified servo valve per AD

97-14-04 and had been tested to check for cracking of the secondary slide 71 flight hours

[61 flights] before the anomalous ground check in Seattle)241 was examined under the

Safety Board’s direction at United’s maintenance facility in San Francisco. Before

disassembly, the PCU input crank was noted to be visibly offset. Further, the PCU did not

pass Parker’s standard acceptance test procedure. After disassembly of the PCU servo

valve, the valve spring guide was found to be mispositioned, thereby pushing the

secondary slide off center and resulting in high leakage and an unequal amount of force

necessary to achieve a right or left rudder input. After the guide was properly positioned,

the servo valve passed the acceptance test procedure.

The mechanic who had previously performed the test to detect secondary slide

cracking on the incident servo valve indicated to Safety Board investigators that the servo

valve was the first one at United to be tested for such cracks. The mechanic stated that,

after he tested the servo valve for a cracked secondary slide, the PCU passed the

acceptance test procedure. However, the mechanic reported that he then demonstrated the

test to detect secondary slide cracking to another United employee using the same PCU

but that he did not repeat the acceptance test procedure after completing the second

(demonstration) test.

Parker representatives indicated that implementation of the secondary servo valve

slide test procedures to detect cracking could have displaced and rotated the spring guide.

They also stated that a mispositioned spring guide should have been noted during an

acceptance test procedure or after testing of the rudder system when the PCU was installed

on the airplane. Additionally, Parker representatives indicated that improper rudder

response caused by the mispositioned spring guide should have been noticed either during

flight control checks or in flight. The Safety Board’s investigation of this incident is

continuing.

USAirways Metrojet In-flight Rudder Movement (737-200, N282AU)

On February 23, 1999, a 737-200 operated by USAirways as Metrojet flight 2710,

N282AU, made an emergency landing at Baltimore-Washington International Airport

241 For additional information regarding AD 97-14-04, see section 1.18.5.
Factual Information 161 Aircraft Accident Report

(BWI) after the flight crew reported to ATC that it was experiencing control problems

with the airplane’s rudder. The flight crew consisted of a training captain and a captain

who was receiving initial operating experience (IOE). The training captain reported that,

while in cruise flight with the autopilot engaged, he noticed that the control wheel was

rotating to the left but that the airplane was not turning. The training captain stated that,

after he disconnected the autopilot and took control of the airplane, he noticed that the

right rudder pedal was displaced at what appeared to be full forward travel. The training

captain stated that he had to apply left aileron input and asymmetric engine power to

prevent the airplane from rolling to the right. Further, that captain reported that he pushed

on the left rudder pedal but that it would not move. The captain receiving IOE stated that

he also pushed on the left rudder pedal and found that it would not move. According to the

pilots, they turned off the yaw damper, but the right rudder pedal remained displaced. The

pilots reported that, after they moved the hydraulic system B switch to the standby rudder

position242 the rudder pedals returned to their neutral position. The flight crew reported

that the rudder pedals moved, or “kicked,” several times during the approach to landing.

The airplane was examined at BWI by Safety Board investigators with

participation from Boeing, FAA, USAirways, ALPA, and International Association of

Machinists and Aerospace Workers representatives. Investigators inspected the operation

of the rudder system from the rudder pedals to the main rudder PCU and standby rudder

PCU for any evidence of jamming or other malfunction that could have caused the event

but found no evidence of any jam. Investigators also tested the landing gear (by retracting

them while the airplane was raised on jacks) but found no evidence of binding or jamming

in the nosewheel steering mechanism. The main rudder PCU and a standby rudder PCU

were removed from the incident airplane at the Safety Board’s request. After replacement

PCUs were installed, the airplane was returned to service. No problems with the rudder

system have been reported since the airplane reentered service. 

The main rudder PCU (which was equipped with the modified servo valve per AD

97-14-04) was removed from the airplane and examined by investigators at Parker’s

facility in Irvine, California. The PCU passed all functional examinations, and the

subsequent teardown examination found no evidence of a jam or binding in the servo

valve. Examination of the standby rudder PCU revealed no discrepancies and no galling of

the input rod bearing. 

The FDR from the incident airplane was examined at the Safety Board’s

laboratory. The FDR recorded 11 parameters, and rudder surface and rudder pedal position

were not among the parameters. Simulation and kinematic studies of the data are being

conducted by the Safety Board and Boeing. Preliminary results of these studies indicate

that, during the upset, the rudder moved slowly to the blowdown limit. The Safety Board's

investigation of this incident is continuing.

242 Moving the B hydraulic system switch to the standby rudder position removes B hydraulic system

pressure from the main rudder PCU and energizes the standby hydraulic pump, thus pressurizing the standby

rudder PCU. 
Factual Information 162 Aircraft Accident Report

1.18.2 Independent Technical Advisory Panel

In January 1996, the Safety Board formed an independent advisory panel to review

the work accomplished by the Systems Group in the USAir flight 427 investigation,

ensure that all systems issues had been fully addressed, and provide guidance and

suggestions to the Systems Group as appropriate. The six-member advisory panel

consisted of five technical experts and engineers specializing in aircraft systems and

hydraulic components from NASA, the FAA, the USAF, and two hydraulic component

manufacturing companies and one independent system safety and reliability consultant.

The advisory panel members’ areas of specialization included

• failure analysis,

• hydraulic systems and components,

• contamination/filtration,

• FAA Critical Design Review (CDR) team/hydraulics, and

• powered flight controls.

The advisory panel’s initial meeting was held in Washington, D.C., on February 8,

1996. At the meeting, the panel members were presented with all completed factual

reports, test data, transcripts of public hearing testimony, and an outline of further planned

engineering tests and actions for the USAir flight 427 accident as well as pertinent

information regarding the United flight 585 accident. During the first meeting, one of the

panel members stated that he had worked on a military fighter project that had used a

control system PCU similar in design to the 737 main rudder PCU. He stated that an

accident caused by a jammed PCU occurred very early in the initial production test flights.

According to the panel member, the investigation of that accident determined that the PCU

jammed when a sudden full-rate input caused hot hydraulic fluid to enter the cold PCU.

The panel member reported that the thermal expansion of the inner parts of the PCU into

the cold PCU body resulted in the jammed condition.

The Systems Group developed thermal shock test plans and, with the panel’s

participation, conducted these tests on a new-production main rudder PCU and the USAir

flight 427 airplane’s main rudder PCU. (The results of those tests are discussed in section

1.16.5.4.7.) 

In comments dated October 31, 1996, another panel member stated that the

accident airplane’s PCU servo valve had characteristics that might have made it more

susceptible to binding than other main rudder PCU servo valves. That panel member

stated that the characteristics that may have made the accident PCU servo valve more

susceptible to binding resulted from a combination of factors, such as dirty hydraulic

fluid, thermal shock, rapid input, and normal load factors. The panel member further noted

that, although the accident PCU servo valve diametrical clearances met the specifications

that existed at the time it was manufactured, those specifications had been refined since

that time. Other panel members did not provide formal comments on the thermal test

results. 
Factual Information 163 Aircraft Accident Report

In addition, the independent technical advisory panel was also involved in the

following investigative activities:

• Tests to determine the effects of silting from fluid contamination on the main

rudder PCU. 

• Cable break tests.

• Review of wake turbulence encounter flight test data. The advisory panel

concluded that the forces involved in wake encounters were not sufficient to

produce a yaw of the magnitude observed (after the initial upset) in flight

dynamics simulations of USAir flight 427. 

• Examination and hardness tests of the bent PCU actuator rod. The advisory

panel concluded that the actuator rod exhibited impact-related damage and that

the rod hardness was found to be within specifications. 

• Review of other scenarios, including (1) separation of rudder skin, leading

edge slat failure over the wing, and asymmetric spoilers—the advisory panel

considered these were unlikely to have resulted in the accident because of the

low yaw moments produced; (2) yaw damper anomalies—the advisory panel

concluded that most yaw damper anomalies involve minor flight control

interruptions, which would not result in a loss of aircraft control; and

(3) foreign object jam at the external stop or external link that would prevent

return of the input lever—the advisory panel concluded that the external

protection of the stop gap made this scenario unlikely. 

• Review of available information regarding 737 yaw incidents. 

• Review of 1990 revision to the servo valve tolerances.

• Review of maintenance records for the accident airplane.

• Examination of the mechanical linkage and cables for rudder jam/reversal

mechanism.

In April 1997, the independent technical advisory panel briefed the Safety Board

on its work. The panel recommended several areas for further study, including the thermal

shock phenomenon, the servo valve’s tight diametrical slide clearances, possible causes of

linkage binding, and the effects of silting. The Safety Board conducted further study in

some of these areas. In September 1997, the advisory panel’s formal efforts ended, but

individual members of the panel continued to be contacted for consultation as needed by

the Safety Board.

1.18.3 Boeing 737 Certification Requirements and Information

1.18.3.1 Initial Certification of the 737-100 and -200 Series

The Boeing 737 design was conceived in the early 1960s, and the original type

certificate (which included the 737-100 and -200 series airplanes) was issued in December

1967. According to original type certification documentation, Boeing performed analysis
Factual Information 164 Aircraft Accident Report

and testing and demonstrated compliance with the type certification requirements that

were contained in 14 CFR Part 25 at that time. 

When the 737-100 and -200 series airplanes were certificated, 14 CFR Section

25.695, entitled “Power-boost and power-operated control system,” stated the following: 

(c) The failure of mechanical parts (cables, pulleys, piston rods and

linkages) and the jamming of power cylinders must be considered unless

they are extremely remote.243

According to transcripts of meetings attended by FAA and Boeing personnel on

May 4 and 5, 1965, FAA certification personnel raised questions during the 737-100 and

-200 certification process about the airplane’s single-panel, power-actuated rudder design.

At that time, Boeing personnel stated that redundancy was provided by the dualconcentric PCU servo valve and dual load path design244 of the rudder actuator system.

The Boeing officials indicated that the servo valve assembly was designed to

accommodate a single jam (primary slide to secondary slide or secondary slide to housing)

without resulting in a loss of control of the PCU because, if either the primary or

secondary slides were to jam, the other slide should still move to counteract the jam and

connect the proper flow paths to command rudder movement in the intended direction.

Boeing officials also acknowledged that such a single jam could remain undetected until

the valve assembly was removed and examined and that a single jam might not be

perceptible to the pilot during normal operations, although it would result in a slower

rudder movement and a reduced hinge moment.

During the 737 initial certification process, Boeing provided the FAA with a

failure analysis of possible malfunctions of the rudder control system (Boeing document

D6-14072, dated March 1967). In addressing several possible rudder control system

failures, this analysis stated repeatedly that a jammed rudder or rudder control system

could be “countered by the use of the lateral [roll] control system.” The Boeing analysis

also stated that the 737’s “lateral [roll] control authority exceeds the rudder control

authority at any rudder angle it would be reasonable to expect the pilot to command under

all flight conditions” and that lateral control authority could therefore be used “to

overcome the effect of a jammed rudder control system or loss of rudder control.” 245

Further, in specifically addressing the requirements of 14 CFR Section 25.695(c), Boeing

stated in the March 1967 failure analysis report that “...in the event of a jamming failure

243 “Extremely remote” was not specifically defined, and a mathematical probability was not officially

provided. However, during postaccident discussions, several FAA aircraft certification representatives stated

their belief that extremely remote was essentially a probability of 1 × 10-6 or less for each flight hour. 

244 The dual load path design provides two structurally redundant paths for inputting pilot commands to

the main rudder PCU, including separate and independent linkages, levers, and cranks, so that a failure or

malfunction in one load path will not affect the proper operation of the PCU. The redundant paths are

created by the use of redundant designs (such as a push rod within a push rod or a fastener within a fastener)

or mirror-image designs (for levers, linkages, and cranks). 

245 This statement was made in the context of addressing the effects of a failure of the manual control

system between the rudder pedals and the forward rudder quadrants at the pilots’ stations.
Factual Information 165 Aircraft Accident Report

that immobilizes the rudder system[,] yaw control can be maintained through the use of

lateral [roll] control.” 

1.18.3.2 Regulatory Changes Made After Certification of the 737-100 

and -200 Series (Sections 25.671 and 25.1309)

In April 1970, the FAA issued amendment 25-23 to 14 CFR Part 25. According to

the FAA, the amendment was intended “to improve the airworthiness requirements

applicable to the type certification of transport category airplanes.” (35 Federal Register

5665, April 8, 1970.) Among the new requirements promulgated in the amendments were

those in Section 25.671 (which appears in Subpart D of Part 25, “Design and

Construction,” and supersedes the requirements of 25.695). Section 25.671, entitled

“General,” states in part:

(c) The airplane must be shown by analysis, tests, or both, to be capable of

continued safe flight and landing after any of the following failures or

jamming in the flight control system and surfaces (including trim, lift, drag,

and feel systems), within the normal flight envelope, without requiring

exceptional piloting skill or strength.[246] Probable[247] malfunctions must

have only minor effects on control system operation and must be capable of

being readily counteracted by the pilot. 

(1) Any single failure, excluding jamming (for example, disconnection

or failure of mechanical components, such as actuators, control

spool housing, and valves).

(2) Any combination of failures not shown to be extremely

improbable,[248] excluding jamming (for example, dual electrical or

hydraulic system failures, or any single failure in combination with

any probable hydraulic or electrical failure). 

(3) Any jam in a control position normally encountered[249] during

takeoff, climb, cruise, normal turns, descent, and landing unless the

jam is shown to be extremely improbable, or can be alleviated.

A runaway of a flight control to an adverse position and jam must

be accounted for if such runaway and subsequent jamming is not

extremely improbable. 

246 The terms “normal flight envelope” and “exceptional piloting skill” are not defined in the Federal

Aviation Regulations (FAR). However, the 737 AFM contains flight limitations, such as allowable load

limits and airspeeds in the “Limitations” section. 247 Probable was (and is) defined in FAA Advisory Circular (AC) 25.1309-1A, “System Design and

Analysis,” June 21, 1988, as a probability of failure on the order of greater than 1 × 10-5 for each flight hour. 

248 “Extremely improbable” failure conditions are described in FAA AC 25.1309-1A as “those so

unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type”

and “having a probability on the order of 1 × 10-9 or less each flight hour, based on a flight of mean duration

for the airplane type.”

249 The term “normally encountered” was not defined in the FARs. However, as further discussed in

section 1.18.3.4, the FAA defined a “normally encountered” rudder position for the 737-NG certification as

2.5° or less. 
Factual Information 166 Aircraft Accident Report

FAA Amendment 25-23 also included new requirements in Section 25.1309,

entitled “Equipment, Systems, and Installations” (which appears under Subpart F of

Part 25, “Equipment”). That section states in part:

(a) The equipment, systems, and installations, whose functioning is

required by this subchapter, must be designed to ensure that they perform

their intended functions under any foreseeable operating condition.

(b) The airplane systems and associated components, considered separately

and in relation to other systems, must be designed so that – 

(1) The occurrence of any failure condition which would prevent the

continued safe flight and landing of the airplane[250] is extremely

improbable, and

(2) The occurrence of any other failure conditions which would reduce

the capability of the airplane or the ability of the crew to cope with

adverse operating conditions is improbable.[251]

(c) Warning information must be provided to alert the crew to unsafe

system operating conditions, and to enable them to take appropriate

corrective action. Systems, controls, and associated monitoring and

warning means must be designed to minimize crew errors, which could

create additional hazards.

(d) Compliance with the requirements of paragraph (b) of this section must

be shown by analysis, and where necessary, by appropriate ground, flight,

or simulator tests. The analysis must consider –

(1) Possible modes of failure, including malfunctions and damage from

external sources;

(2) The probability of multiple failures and undetected failures;

(3) The resulting effects on the airplane and occupants, considering the

stage of flight and operating conditions, and

(4) The crew warning cues, corrective action required, and the

capability of detecting faults.

The FAA’s Advisory Circular (AC) 25.1309-1A describes various acceptable

means for showing compliance with the requirements of Section 25.1309(b), (c), and (d).

According to the AC, Section 25.1309 requires that there be “a logical and acceptable

inverse relationship between the probability and the severity of each failure condition,

such that ‘minor’ failure conditions may be probable, ‘major’ failure conditions must be

250 Such a failure is referred to as a “catastrophic” failure condition in FAA AC 25.1309-1A.

251 “Improbable” failure conditions are described in the FAA’s AC 25.1309-1A as “those not anticipated

to occur during the entire operational life of a single random airplane. However, they may occur

occasionally during the entire operational life of all airplanes of one type.” These conditions are further

defined as “those having a probability on the order of 1 × 10-5 or less, but greater than on the order of 1 × 10-9

each flight hour, based on a flight of mean duration for the airplane type].”
Factual Information 167 Aircraft Accident Report

improbable, and ‘catastrophic’ failure conditions must be extremely improbable.”252 The

AC provides the following definitions of those failure conditions:

• Minor: those that would not significantly reduce airplane safety, and which

involve crew actions that are well within their capabilities. Minor failure

conditions may include, for example, a slight reduction in safety margins or

functional capabilities, a slight increase in crew workload, such as routine

flight plan changes, or some inconvenience to occupants;

• Major: those that would reduce the capability of the airplane or the a crew to

cope with adverse operating conditions to the extent that there would be, for

example, a significant reduction in safety margins or functional capabilities, a

significant increase in crew workload or in conditions impairing crew

efficiency, or some discomfort to occupants; or, in more severe cases, a large

reduction in safety margins or functional capabilities, higher workload or

physical distress such that the crew could not be relied on to perform its tasks

accurately or completely, or adverse effects on occupants; and

• Catastrophic: those that would prevent continued safe flight and landing.

In a May 13, 1998, letter, the FAA Administrator offered the following additional

explanation of the term “catastrophic failure condition:”

A catastrophic failure is one that will always result in an accident. In the

case of a dual slide jam in the rudder PCU, this condition will not always

result in an accident. The airplane is fully controllable in that configuration

throughout much of its flight envelope. Thus, it is not a catastrophic event

as defined by FAA regulations and policy. Not being catastrophic, the

regulations do not require that the dual slide jam be extremely improbable.

Nevertheless, with the service history and the number of hours of operation

on the 737, the FAA believes a dual slide valve jam has been shown to be

extremely improbable and in compliance with the regulations.

1.18.3.3 Certification of the Boeing 737-300, -400, and -500 Series 

(Derivative Certification)

According to 14 CFR Section 21.17, an applicant for a type certificate must show

that the aircraft meets the applicable regulatory requirements “that are effective on the

date of application for that certificate.” However, according to Section 21.19, when a

manufacturer proposes a change to an aircraft that has already been certified, a new

application for a new type certificate is required only if

(a) The Administrator finds that the proposed change in design,

configuration, power, power limitations (engines), speed limitations

252 The AC further states that “the failure of any single element, component, or connection during any

one flight...should be assumed, regardless of its probability” and that “subsequent failures during the same

flight, whether detected or latent, and combinations thereof, should also be assumed, unless their joint

probability with the first failure is shown to be extremely improbable.” 
Factual Information 168 Aircraft Accident Report

(engines), or weight is so extensive that a substantially complete

investigation of compliance with the applicable regulations is required [or];

(b) ...the proposed change is...in the number of engines or rotors; or...[t]o

engines or rotors using different principles of propulsion or to rotors using

different principles of operation. 

Further, 14 CFR Section 21.101 states that

(a) ...an applicant for a change to a type certificate must comply with

either–

(1) The regulations incorporated by reference in the type certificate; or

(2) The applicable regulations in effect on the date of the application,

plus any other amendments the Administrator finds to be directly

related.

(b) If the Administrator finds that a proposed change consists of a new

design or a substantially complete redesign of a component, equipment

installation, or system installation, and that the regulations incorporated by

reference in the type certificate for the product do not provide adequate

standards with respect to the proposed change, the applicant must comply

with–

(1) The applicable [regulatory] provisions . . . in effect on the date of

the application for the change, that the Administrator finds necessary to

provide a level of safety equal to that established by the regulations

incorporated by reference in the type certificate for the product; and

(2) Any special conditions, and amendments to those special

conditions, prescribed by the Administrator to provide a level of safety

equal to that established by the regulations incorporated by reference in

the type certificate for the product.

When the 737-300 series airplane was added to the 737 type certificate in

November 1984 (followed by the 737-400 series in 1988 and the -500 series in 1990),

some updated regulations were added to the type certification basis for those models.

However, the certification basis for those airplanes consisted primarily of the same

certification requirements and design criteria that existed for the original -100 and -200

series airplanes (certificated 17 years earlier). The -100 through -500 series airplanes were

certificated with the original rudder system design.

According to Boeing and FAA personnel, the newer series 737 airplanes (737-300,

-400, -500) were derived from the existing certificated models (737-100 and -200) and the

flight control system designs for the newer series airplanes were similar to the existing

models (and not unique to the newer series airplane). The officials stated that the FAA

therefore did not require Boeing to meet the certification requirements of 14 CFR Sections

25.671 or 25.1309. In a November 24, 1998, letter to the Safety Board, the FAA stated that

“it is by no means certain that if [Section] 25.671 amendment 23 had been applied to the

original 737 certification, that the system would have been significantly different.”
Factual Information 169 Aircraft Accident Report

According to an appendix to Boeing’s 1967 analysis report that was added in 1984

to address the certification of the 737-300, “the 737-300 rudder control system is

essentially unchanged from the 737-200 design. Modifications to the 737-200 design have

been made due to differences in 737-300 requirements, aerodynamic characteristics, and

to provide improved uncontained engine failure protection. All of the modifications have

no effect on the basic method of system operation, failure modes, redundancy, or

interaction with other systems.” In addressing the requirements of Section 25.695(c), the

1984 appendix stated that, in the event of a jamming failure that immobilized the rudder

system, yaw control can be maintained through the use of the lateral (roll) system. 

In a separate failure analysis report pertaining to the 737-300, -400, and -500 series

airplanes that addressed potential rudder system failures (prepared by Boeing in February

1995 at the FAA’s request), Boeing indicated that lateral control authority would be

adequate to control a rudder offset for a jam at a normally encountered flight position. In

discussing a jam of the manual input linkage to the hydraulic control valve in the main

rudder PCU, the analysis report stated that roll control authority “exceeds the rudder

control authority for most but not all flight conditions.” In discussing the effects of a jam

of the main rudder PCU servo valve’s primary or secondary slides, the analysis report

stated that “for most valve jams the rudder would remain operable and no pilot action

would be required” but that “for a worst case jam [seizure of either the primary or the

secondary slide at its fully deflected position, resulting in the loss of actuator force

capability in one direction] the pilot could maintain flight path control using the lateral

control system.” 

The Safety Board notes that the Boeing 757, which was certificated in 1982, was

designed with three rudder actuators. Boeing indicated that the use of three actuators on

that airplane allowed autopilot control over the rudder during autolandings and removed

the need to mass balance the rudder.

1.18.3.4 Certification of the 737-600, -700, and -800 Series

According to the FAA type certification data sheets, Boeing showed compliance

with most of the current requirements of 14 CFR Part 25, including Section 25.671, during

certification of the 737-600, -700, and -800 series airplanes (737-next-generation [NG]

series airplanes).253 In a November 24, 1998, letter to the Safety Board, the FAA indicated

that it had encouraged Boeing to comply with the newer regulations in certifying the

737-NG series airplanes and that Boeing had elected to do so.

During meetings in January and February 1996, Boeing, the FAA, and Joint

Airworthiness Authority representatives developed an agreement for an acceptable means

253 According to Boeing, 737-NG series airplanes fly for longer ranges, at higher altitudes, and at faster

speeds; use less fuel; and produce less noise that the earlier series 737s. The 737-NG series airplanes also

have a longer/wider wing with improved aerodynamics, advanced cockpit displays, and more powerful

engines. Because of the enhanced engine power, the 737-NG series airplanes have a larger rudder so that

airplane control can be maintained in the event of an engine failure. The main rudder PCU of the 737-NG

series airplanes is more powerful than that used on earlier series airplanes, and the PCUs are therefore not

interchangeable. 
Factual Information 170 Aircraft Accident Report

of showing 737-NG compliance with Section 25.671(c)(3). The representatives agreed

that service history and exposure time could be used to show compliance.254

In a February 1996 document entitled “Primary Flight Controls, Ground Spoilers,

and High Lift System Certification Plan,” Boeing indicated that it intended to show

compliance with Section 25.671(c)(3) by design review, safety assessment, flight tests and

simulations, and service experience. This document also contained a description of the

intended means of compliance, which stated in part:

A system safety analysis will be conducted to show that failure conditions

that could prevent continued safe flight and landing are extremely

improbable. Design changes have been made to ensure that uncommanded

rudder motion is controllable with wheel in the vast majority of the flight

envelope. Means are available on the flight deck which will allow the

rudder to return to the faired position. Jams causing uncommanded motion

that could be uncontrollable will be shown to be extremely improbable due

to the very short exposure time and the very low failure rate demonstrated

in service.

In an April 23, 1996, letter, the FAA informed Boeing that its proposed

certification plan for the 737-NG was acceptable (with some exceptions that were not

relevant to Section 25.671). On September 29, 1997, the FAA closed issue paper F-2,

which addressed flight control jams for the 737-NG series airplanes. The issue paper

defined the normally encountered flight control positions for the 737-NG, noting that

“applicants have generally been unable to demonstrate that it would be extremely

improbable for a flight control jam to occur in a control position normally encountered, or

that a jam could be alleviated” and that “therefore, it must be shown that the airplane

retains structural integrity, has sufficient remaining control authority, and is controllable

following such a jam, without requiring exceptional piloting skill or strength.” The FAA

stated that a jam in a flight control is expected to occur approximately once every 10

million flight hours. Boeing indicated its belief that a jam in a flight control is expected to

occur approximately every 9 million flight hours.

The FAA indicated in issue paper F-2 that, during takeoff, normally encountered

roll/yaw control positions were those necessary to counteract a steady 15-knot crosswind

and that it would also be necessary to consider approach and landing configurations to

address jams during the final flight phase. The issue paper further defined normally

encountered roll/yaw control positions after takeoff as the more critical of one-third of the

total travel of the control surface, the authority limit of the yaw damper, or those positions

required to counter a 25-foot-per-second discrete gust. In its November 24, 1998, letter to

the Safety Board, the FAA indicated that it considered the normally encountered control

position for the 737-NG series airplanes to be 2.5° of rudder, which is approximately the

maximum yaw damper authority.

254 The information in this paragraph and in several of the paragraphs that follow is contained in briefing

materials prepared by Boeing for presentations it made to the FAA during October 1997. Boeing provided

those briefing materials to the Safety Board in response to its requests for information pertaining to

certification of the 737-NG series airplanes.
Factual Information 171 Aircraft Accident Report

Issue paper F-2 also described Boeing’s position, as indicated in a June 26, 1997,

document, that a 2° rudder displacement should be accepted as the maximum normally

encountered position. Boeing stated that the “service history of these systems on previous

models provides evidence to validate the qualitative evaluations of these areas.

Additionally, further jam protection features have been added to the flight control system

for the 737-600/-700/-800.”

Boeing also stated that 

...for areas of the flight control system where rigid jams cannot be shown

to be extremely improbable, Boeing plans to conduct analysis and/or

testing to demonstrate that continued safe flight and landing is possible,

without requiring exceptional piloting skill or strength, after a jam in a

normally encountered position. Based on a review of in-service jam

incidents, there is no evidence which would indicate that a jam failure

becomes more likely [at] greater...deflection[s]. From Boeing service

history, the probability of a jam is less than 10-7/flt hr. ...therefore,

evaluation of jams will be accomplished at the maximum control position

which addresses 99% of system operational exposure time. Jams outside

the 99% boundary are extremely improbable based on the 10-7/flt hr failure

rate. This maximum control position will be determined from a survey of

in-service and flight test recorded data. 

According to Boeing’s October 1997 briefing materials, the FAA informed Boeing

on October 15, 1997, that the 737-NG elevator and rudder control systems did not comply

with Section 25.671(c)(3). The FAA indicated that the definition of extremely improbable

in Section 25.671(c)(3) did not allow the use of exposure time and that the possibility of

the jam itself must be less than 10-9. In its November 24, 1998, letter to the Safety Board,

the FAA indicated that it initially concluded that the use of a small exposure time (as

proposed by Boeing) was not appropriate to show a jam to be extremely improbable. The

FAA stated that its conclusion was based on the belief that this type of probability analysis

had never been used to show compliance with Section 25.671(c)(3) and that no existing

policy provided direction on the use of this type of analysis.

The briefing materials stated that Boeing appealed the FAA’s finding of

noncompliance and presented its position on October 22 and 27, 1997, to local FAA

certification officials in Seattle and on October 28 and 29, 1997, to FAA upper

management in Washington, D.C. Boeing’s position was that a showing of jam avoidance

was permitted by Section 25.671(c)(3). Boeing stated that its interpretation of Section

25.671(c)(3) was that a new airplane without a service history must be designed for jam

tolerance but that derivative airplanes with a proven service history could be designed for

jam tolerance where possible and jam avoidance in other areas. Boeing stated that the

FAA’s interpretation of Section 25.671(c)(3) was inconsistent with the language of the

rule. Boeing cited AC 25.1309-1A, paragraphs 10a and 10b, in its argument that existing

FAA policy allowed an event to be shown to be extremely improbable by multiplying the

failure rate of the jam by the exposure time of the flight phase(s) when the jam would be

catastrophic.
Factual Information 172 Aircraft Accident Report

Boeing further asserted that the FAA’s interpretation of Section 25.671(c)(3)

would not have allowed a finding that the Boeing 747, 757, 767, and 777 complied with

that rule, even though the FAA had already made such findings. Boeing indicated that its

proposed exposure time-based analysis had been used in past certifications of these

airplanes for failures that are only catastrophic during short segments of flight, such as

rudder control on takeoff with an engine out, spoiler surface hardover at low altitude,

autolands, 777 rejected takeoffs, and 777 thrust asymmetry compensation failures on

takeoff. Boeing stated that both the 737-NG and 747 were exposed to rate jams, which

could result in rudder hardovers that would be controllable except at a low altitude, and

that a jam avoidance design philosophy had been used in the certification of the 747.

Boeing argued that, because the 747 and the 737-NG have the same certification basis, the

rule has not been changed, and no advisory material has been issued, the 747 precedent

established policy and an acceptable means of showing compliance with the rule. 

Boeing indicated that the FAA’s change in position regarding the acceptability of

Boeing’s originally proposed means of showing 737-NG compliance came “late in the

game” with no practical opportunity for a design fix. Boeing argued that the change in the

FAA’s past interpretation of the rule was not justified, given the number of flight hours

accumulated by the existing 737 series and the design improvements incorporated to

enhance the system, and that the new interpretation had not achieved consensus across the

aviation industry. 

Boeing indicated during its October 1997 presentations to the FAA that it did not

believe a “position jam” (defined by Boeing as one that would occur in a normally

encountered position and fix the rudder in a steady-state position) was an issue because

the failure would be controllable. Boeing indicated that rate jams (defined by Boeing as

those that would cause a hardover position outside of that normally encountered) could be

caused either by a dual slide jam or an input arm jam. (Boeing’s presentation did not

address the single jam/reversal failure mode.) According to Boeing, concerns about a dual

slide jam could be eliminated because of the servo valve’s dual concentric design.255

Further, Boeing indicated that no input arm rate jams had been identified in the 737 fleet’s

service history and that, as a result of this finding, a design review, and tests, no input arm

rate jam scenario was foreseeable. As further protective measures, Boeing cited the

addition of a hydraulic pressure limiter, which would reduce the exposure time of a

catastrophic rudder hardover to a 60- to 90-second window on takeoff and landing, and a

rudder hardover shutdown procedure. 

Boeing’s qualitative assessment indicated that a catastrophic rate jam (that is, one

that would occur during the 60- to 90-second exposure window at takeoff or landing) was

extremely improbable based on service experience, design, and limited exposure.

255 Boeing indicated that the probability of a jam of the primary slide was 2.36 × 10-3 and that the

probability of a secondary slide jam was 2.10 × 10-8. These calculations were based on Boeing’s awareness

of 7 possible occurrences of a jam of the primary slide in 74 million flight hours and the recognition that the

jam could be latent over the entire mean time between unscheduled removal of the PCU (estimated by

Boeing to be 25,000 hours). Boeing indicated that there have been no known occurrences of a jam of the

secondary slide and that one failure was assumed for the calculation.
Factual Information 173 Aircraft Accident Report

Additionally, Boeing’s calculations of failure rate and exposure time indicated that the

quantitative probability of such a catastrophic rate jam was 7.02 × 10-10. 

The certification fault tree analysis provided by Boeing to the FAA indicated that

the possibility of an engine out during takeoff and a jammed servo valve were considered.

However, Boeing indicated that the exposure time for this potential scenario was

7 seconds “during takeoff from V1 through liftoff where the lateral controls can be used to

help control the engine out.” The fault tree analysis assumed that “there is always

adequate lateral control to overpower a rudder hardover when the rudder pressure limiter

is operational.” The analysis also assumed that “under normal circumstances flight crew

members, ground crew members and maintenance personnel will perform their routine

tasks without errors or omission. Additionally, under anticipated normal circumstances,

flight crew members will perform their non-normal procedures and basic airmanship per

their training.” 

In its November 24, 1998, letter to the Safety Board, the FAA stated that, in

response to Boeing’s October 1997 presentations, it agreed that Section 25.671 allowed

the type of qualitative analysis proposed by Boeing and that, based on the Boeing 747

precedent, the use of such analysis was appropriate to demonstrate compliance with the

rule. However, the FAA requested that Boeing show that it had evaluated the design of the

737-NG flight control system with regard to critical jam conditions, considered postulated

jams, and determined that they were extremely improbable. 

On November 1, 1997, a group of Boeing engineers, including four Designated

Engineering Representatives (DER) performed an inspection of the 737-NG elevator

control system for position jams and the rudder system for rate jams. Boeing provided the

FAA with the documentation of these inspections and FAA Form 8110-3, Statement of

Compliance with the Federal Aviation Regulations (FAR), in which the DERs requested a

finding of compliance with Section 25.671 (c)(3). The form indicated that the DERs

performed an inspection of the elevator, rudder, main rudder PCU and associated input

and feedback linkages, and the standby rudder PCU and associated input and feedback

linkages. The form stated that “the inspections identified eight areas of interest with regard

to jam potential [one of which pertained to the rudder]. Each jam area was analyzed or

tested by the DERs and design specialists. For each jam case, it was concluded that either

the jam could not occur or sufficient control movement would be available for continued

safe flight and landing.” 

In supplemental data provided to the FAA to support the requested finding of

compliance with Section 25.671(c)(3), Boeing indicated that the DERs concluded that the

“rudder PCUs are not susceptible to jams that cause uncommanded motion” and that the

“service history shows that there have been NO events or PCU rate jams in flight on

Boeing models.” Boeing concluded that “(1) rudder position jams are controllable when

the jam occurs within a normally encountered position and (2) Rudder PCU rate jams are

extremely improbable as supported by analysis, test, and service history.” 
Factual Information 174 Aircraft Accident Report

Boeing listed rudder system design features of the 737-NG series that preclude

jamming, including the following:

• Dual concentric control valves allow continued control if either valve jams

(rate jam)—designed for jam tolerance.

• Internal summing levers are bussed together to increase stiffness (for chip

shearing capability)—designed for jam tolerance.

• The input stops are oriented to prevent exposure to jams—designed for jam

avoidance.

In its November 24, 1998, letter to the Safety Board, the FAA stated that Boeing

provided data that showed the ability of the 737-NG to land safely with the rudder jammed

at 2.5° of deflection (defined by the FAA’s issue paper F-2 as the maximum normally

encountered control position). The FAA further stated that with the incorporation of the

hydraulic pressure limiter, rate jams (rudder hardovers) were found to be controllable

throughout the flight envelope except for a short period of time during takeoff and

landing, which the FAA identified as being about 2 minutes. According to the FAA,

Boeing showed that a rate jam during this exposure time is extremely improbable. In

addition, the FAA stated that some detailed design features of the rudder control system

aid in jam protection, including the following:

• controlled clearances between bearing races and interfacing surfaces so that a

bearing jam does not seize a rotating joint or shaft,

• a controlled clearance between internal summing linkages and the PCU

manifold that is much larger than possible debris particles,

• increased servo valve chip shear capability,

• PCUs installed in a sealed compartment that is rarely accessed and only for

maintenance, 

• before each takeoff, a system functional check or operational check by a

maintenance crew to ensure no anomalies after rudder system maintenance,

and

• a rudder system freedom-of-control check by the flight crew before each

takeoff to ensure that no anomalies are present.

The FAA stated in its November 24, 1998, letter that, after reviewing the data

provided by Boeing and all known jams on 727, 737, and 747 airplanes, it determined that

the design changes made for the 737-600, -700, and -800 rudder system would prevent

similar jams from occurring or would allow alleviation of such jams. The FAA also

indicated that it was able to find compliance with Section 25.671 for the 737-NG series

airplanes based on the certification of the 747, the DER evaluation, flight tests, and

simulator tests that showed that jam overrides are acceptable to overcome jams and that

the override system operates correctly when installed.
Factual Information 175 Aircraft Accident Report

1.18.4 Critical Design Review Team 737 Certification Information 

and Recommendations 

Because the USAir flight 427 accident and other 737 accidents raised questions

regarding the 737’s flight control systems, the FAA stated that, on October 20, 1994, its

Transport Airplane Directorate began a Critical Design Review (CDR) of the 737 flight

control systems with emphasis on the roll control and directional flight control systems.

The CDR was conducted by a team of seven flight control systems specialists from the

FAA, Transport Canada (the Canadian airworthiness authority), and the USAF.256

According to the CDR team’s report,257 the team’s specific objectives were to

• identify those failure events, both single and multiple, within certain flight

control systems that result in an uncommanded deflection or jam of a flight

control surface;

• identify latent failures in each axis of flight control;

• review the service history of the failed or malfunctioning component or

subsystem through a review of ADs, SBs, SLs, Service Difficulty Reports,

Safety Board recommendations, NASA Aviation Safety Reporting System

(ASRS) reports, and other reports; 

• identify and review the maintenance or inspection requirements (task and

inspection interval), as provided by the manufacturer’s Maintenance Planning

Document, Maintenance Review Board report, or MM for each identified

component or subsystem with critical failure potential.

The CDR reviewed the certification basis and compliance of the 737-100 and -200

and 737-300, -400, and -500 series airplanes. The CDR team noted that the results of the

analyses and tests conducted by Boeing during certification of the 737-100 and -200 and

737-300, -400, and -500 series airplanes showed compliance with the applicable

certification regulations. However, the CDR noted the ambiguity of some of the

terminology used in 14 CFR Section 25.671 (although that section was not part of the

certification basis of the -100 through -500 series 737s); specifically, the CDR questioned

the usage of the terms “normal flight envelope” and “normally encountered.” The CDR

team’s report indicated that it did

“not agree with the rationale that only control positions associated with

‘normally encountered’ should be considered. There are too many

256 The CDR team also involved one Safety Board observer. Five of the seven flight control specialists

were employed by the FAA in the following capacities: aviation safety inspector, aircraft certification

engineer, flight test pilot, aerospace mechanical systems engineer, and project engineer. Another specialist

was employed by Transport Canada as an Airworthiness Inspector, and the other specialist was a Chief

Master Sergeant in the Colorado Air National Guard. Each of the seven specialists had expertise in 737

certification, 737 operations, systems and/or maintenance, flight control and hydraulic systems design/

specifications, or latent failures.

257 The CDR team’s report, entitled “B-737 Flight Control System Critical Design Review,” was issued

May 3, 1995. 
Factual Information 176 Aircraft Accident Report

variables (atmospheric conditions, pilot technique, airplane condition [trim

requirement], air traffic, etc.) to define ‘normally encountered’ other than

that it may be less than full deflection. The Team’s position is that if a

control position is possible, it is there for a purpose, and the pilot can use

that control authority.”

The CDR team’s report further stated that it believed “the interpretations that have

been applied in the past, regarding amount of flight control input to be considered in

showing compliance with the referenced regulations, may not be sufficient.” Therefore,

the CDR team reviewed failures, combinations of failures, and malfunctions without

regard to their probability of occurrence. 

The CDR team’s report also cited an FAA issue paper developed during the

certification of the 737-300 that addressed maintenance items resulting from certification

activities. According to the report, the FAA determined that it was not necessary to

establish a maintenance interval to show compliance with certification requirements.

However, the report stated that the CDR team had “identified a number of latent failures

that require some maintenance/flightcrew action to ensure that a latent failure, combined

with any subsequent failure, is not hazardous.... The Team believes that inspection tasks

and intervals should be established for vital components whose latent failure could have

hazardous consequences, even though a failure analysis has shown a numerical probability

of failure that allows the component to go uninspected for the life of the airplane or until

an ‘on-condition’ overhaul.” 

According to the CDR report, the team also had general concerns regarding the

design of the 737 aileron and rudder PCUs and specifically cited the use of the dual

concentric servo valves and the potential for jamming as a latent condition of the PCU.

According to the CDR team’s report, “...when considering some undetected (latent)

failures...in the directional control system, in combination with some of the single

failures...the potential for a sustained jam of the rudder at full deflection, as limited by

blowdown, is increased. Since full rudder hardovers and/or jams are possible, the alternate

means for control, the lateral control system, must be fully available and powerful enough

to rapidly counter the rudder and prevent entrance into a hazardous flight condition.”

The CDR team’s report included the results of a series of simulator exercises in

Boeing’s M-CAB simulator (configured as a 737-300) that the team conducted on

November 17, 1994. The purpose of these exercises was to determine the degree of hazard

associated with certain control system malfunctions, including a rudder hardover. The

rudder hardover was simulated by the PNF applying full rudder pressure to one pedal as

rapidly as possible and holding the rudder pedal to the floor. This pressure resulted in

rudder deflection rates of about 40° per second (the rudder system is capable of deflecting

the rudder at a rate of 66° per second under no aerodynamic load). According to the CDR

team’s report, tests evaluating “lateral [roll] versus directional control power” during a

rudder hardover 

...basically confirmed Boeing’s contention that lateral [roll] control has

more roll authority than does the dihedral effect from full rudder inputs for

flight conditions tested except the flaps 1, 190 KIAS [knots indicated
Factual Information 177 Aircraft Accident Report

airspeed] condition. For this condition lateral [roll] control also

predominated, but recovery from a rudder “hardover” was slow and

required precise pilot control of resulting pitch/airspeed. Prompt pilot

response was required to prevent entering the inverted flight regime at high

altitude/speed. 

The team’s report stated, “as qualified by Boeing, the rudder PCU dual concentric

valve...was intended to prevent unacceptable rudder deflection after a single slide

jam....The dual concentric arrangement does play a vital part in maintaining flight

safety....the crew should be assured that they have a properly operating valve assembly.”

The CDR team’s report further stated the following: 

There is no adequate means for testing the dual spool servo valve for

proper operation on the airplane. 

The dual spool servo valve is a complex assembly and is a critical

component of the rudder and aileron power control units and, therefore,

critical to flight safety. Any facility authorized by the FAA to perform

repair and maintenance or manufacture this component must assure the

FAA of having the necessary equipment, personnel and data (design,

manufacture, qualification and acceptance test procedures), including

access to the latest revisions to the data provided by the [original

equipment manufacturer]. 

The CDR team’s report made 27 recommendations to the FAA regarding 737

certification issues, including the following:

Develop national policy and or rule making as necessary and applicable to

transport category airplanes that define “normal,” with respect to jams.

This definition should include consideration of a jam of a control surface at

any position up to its full deflection as limited by design

Develop national policy requiring that, when alternate means for flying an

airplane are employed, those means shall not require exceptional pilot skill

and strength and that the pilot can endure the forces for a sufficient period

of time to ensure a safe landing 

Develop national policy for transport category airplanes requiring the

determination of critical hydraulic flight control system and component

sensitivity (jam potential and actuator performance) to contamination,

requirements for sampling hydraulic fluid, and requirements for actuator

components to eliminate or pass (shear) particulate contamination, 

Require failure analysis of the B-737 yaw damper identified components

and any relevant tests be conducted to identify all failure modes,

malfunctions and potential jam conditions of these vital elements.

Require corrective action(s) for those failure modes or malfunctions not

shown to be extremely improbable.

Require appropriate action be taken to reduce the number of B-737 yaw

damper failure occurrences to an acceptable level.
Factual Information 178 Aircraft Accident Report

Require appropriate action be taken to correct the referenced galling

condition of the standby rudder on the B-737. 

Revise B-737 flightcrew training programs to ensure the use of the proper

procedures for recovery from flight path upsets and flightcrew awareness

regarding the loss of airplane performance due to a flight control system

malfunction. Consideration should be given to flightcrew action items as a

consequence of the failure analysis developed for the relevant flight control

system and the failure conditions/malfunctions examined....

Request the NTSB form a special accident investigation team to begin a

new combined investigation of both the B-737 Colorado Springs and the

Pittsburgh accidents. 

In an August 27, 1998, letter to the Safety Board, the FAA described its actions in

response to the CDR team’s recommendations. The FAA, among other things, referred

several of the regulatory and policy issues raised by the CDR team’s recommendations

(including the definition of normally encountered) to an Aviation Rulemaking Advisory

Committee; referred the issue of hydraulic fluid contamination to the Society of

Automotive Engineers (SAE) A-6 Committee—Aerospace Fluid Power, Actuation, and

Control Technologies—which made recommendations on contamination limits; and

issued several ADs to address operational and maintenance issues. (A complete list of the

recommendations made by the CDR team and the FAA’s follow-up actions in response to

those recommendations are contained in appendix D.)

Also in response to the CDR team’s recommendations, the Safety Board convened

an independent technical panel of consultants (see section 1.18.2) and combined the

investigation of USAir flight 427 with the investigation of United flight 585 (see section

1.16.1.1).

1.18.5 Boeing 737 Rudder System Design Improvements

As a result of the rudder reversal mechanism that became apparent during the

investigation of the July 16, 1992, United Airlines ground check incident (see section

1.18.1.1), the Safety Board issued Safety Recommendation A-92-120, asking the FAA to

issue an AD to require 737 operators to incorporate design changes for the main rudder

PCU servo valves that would preclude the possibility of rudder reversals attributed to

overtravel of the secondary slide.258 In response to this recommendation, the FAA issued

AD 94-01-07, effective March 3, 1994. The AD required a leak test of the 737 main

rudder PCU in accordance with Boeing SL 737-SL-27-82-B. The leak test involved

inputting full rapid rate rudder commands and monitoring the hydraulic system flow

demand to detect signs of internal leakage, which would indicate that the secondary slide

was extending beyond its design limits. The AD required the leak test to be repeated at

750-flight hour intervals until the main rudder PCU was replaced with a unit designed to

preclude overtravel of the secondary slide and included improved control of dimensional

258 As previously discussed, overtravel is the axial movement of the servo valve slides beyond the

intended design limit. 
Factual Information 179 Aircraft Accident Report

tolerances and part matching. The AD required replacement of the main rudder PCUs

within 5 years of the AD’s effective date. The redesign of the servo valve was approved by

the FAA by the time that AD 94-01-07 became effective.

The FAA also issued AD 96-23-51, effective November 27, 1996. The AD

required that all 737 airplanes be inspected within 10 days and tested in accordance with

Boeing SB 737-27A1202 every 250 flight hours thereafter until the main rudder PCU was

replaced with one that incorporated the redesigned servo valve. Boeing’s SB and the

FAA’s AD required that the rudder pedals be exercised to determine if a secondary slide

jam to the servo valve housing had previously occurred but had not been detected.

Further, the FAA issued AD 97-14-04, which became effective on August 4, 1997,

and superceded the servo valve replacement requirement of AD 94-01-07. The new AD

required, within 2 years of its effective date, that the main rudder PCUs on all 737-100

through -500 series airplanes be replaced with units containing a redesigned servo

valve.259 AD 97-14-04 also required the replacement of outer bolts on 737 main rudder

PCU input rods. This requirement was mandated because fractured outer bolts had been

discovered on two occasions during normal maintenance activities. In each case, the

fracture was found to have initiated when the nut was sufficiently tightened to cause the

nut threads to contact the shank of the bolt. The bolts are used in a dual load path design

with inner and outer elements, either of which is sufficient to retain the input rod.

However, if the redundant load path is compromised and fails, a fully deflected rudder is

possible; therefore, a new bolt was designed to prevent the shank from contacting the nut

threads. These bolts are to be replaced when the main rudder PCUs are removed to

incorporate the redesigned servo valve.

After Safety Board testing in 1996 showed that the servo valve primary slide could

overtravel (move past its intended position) if the secondary slide jammed to the housing,

Parker redesigned the servo valve again. The redesign, which was completed in 1998,

lengthened the primary and secondary slides about 0.5 inch, modified the servo valve end

cap, and moved the flow port pathways and metering edges farther apart so that, if the

secondary slide were to jam to the servo valve housing, overtravel of the primary slide

would not connect ports that could cause reverse operation. All 737-NG series airplanes

(the -600, through -900 series) are being produced with the newly redesigned servo valve.

The original servo valve design incorporated small washer-like “inserts” that had

fluid passages cut into them. These inserts (made of 52100 steel) were installed in the

inner diameter of the housing and secondary slide (made of surface-hardened Nitralloy)

and formed the passages for hydraulic fluid flow through the valve. In the 1998 redesigned

servo valve, the inserts were replaced with a one-piece design (made of 52100 steel) that

provides the same function and reduces the number of parts required. The redesign of the

inserts to the single-piece configuration was made possible by advances in manufacturing

technology that allows the small fluid passages to be Electro Discharge Machined into the

259 According to Boeing, as of September 1998 there were 2,776 in-service 737s in the -100 through

-500 series and 3,187 in-service PCUs (accounting for serviceable spares not installed on in-service

airplanes). 
Factual Information 180 Aircraft Accident Report

single piece rather than built up by a group of smaller parts. Figure 31 shows the 1998

redesigned servo valve for both the earlier 737 series airplanes and the 737-NG airplanes.

In addition, the FAA issued AD 97-14-03, which requires a redesigned yaw

damper system on all 737-100 through -500 series airplanes by August 1, 2000. The

redesigned system is to replace the current yaw damper coupler with a single

electromechanical rate gyro that includes an improved coupler with a dual solid-state rate

sensor. The system is also to provide improved system monitoring and fault analysis

through improvements in built-in test equipment. The yaw damper system wire shielding

and isolation are to eliminate potential electrical interference. All 737-NG series airplanes

incorporate the redesigned yaw damper system. 

AD 97-14-03 also requires that all 737-100 through -500 series airplanes be

modified by adding a hydraulic pressure reducer to hydraulic system A near the rudder

PCU to reduce the amount of rudder available to the flight crew during those phases of

flight when large rudder deflections are not required. The reduced rudder authority is to be

accomplished by lowering the hydraulic pressure from 3,000 to 1,000 psi (737-300, -400,

and -500) or 1,400 psi (737-100, and -200 series airplanes). The yaw damper system is not

affected by the hydraulic pressure reducer because that system operates off hydraulic

system B. The hydraulic pressure reducer system is inactive in the two situations in which

full rudder authority may be required: below 1,000 feet agl during takeoff climb and

below 700 feet agl during landing approach. The hydraulic pressure reducer to be installed

on the 737-300, -400, and -500 series airplanes also restores full rudder authority

regardless of altitude when the rotation speed of the two engines differs by more than 45

percent. According to Boeing personnel, because the hydraulic pressure reducer control

and indication logic are incorporated into the redesigned yaw damper coupler, the pressure

reducer will be added at the same time as the yaw damper system changes. 

Figure 31. Parker’s 1998 redesigned servo valve for 737 airplanes.

737 100/-200/-300/-400/-500

737- NG Valve
Factual Information 181 Aircraft Accident Report

All 737-NG series airplanes incorporate a hydraulic pressure limiter into the main

rudder PCU. The limiter is controlled by airspeed and limits pressure to hydraulic system

A inputs of the PCU by a bypass valve. The limiter is commanded to limit hydraulic

pressure as the airspeed is increased to greater than 137 knots and resets as the airspeed is

decreased to less than 139 knots.

1.18.5.1 Fractures in 1998 Redesigned Servo Valve Secondary Slides 

In August 1998, Parker staff became aware that, during production slide testing,

fractures had been discovered in several of the newly redesigned servo valve secondary

slide legs. Subsequent examination of 502 servo valves in Parker’s stock revealed a total

of 9 fractured secondary slides; 1 fractured secondary slide and 1 chipped secondary

slide260 were subsequently discovered in stock by Olympic Airways personnel. (Another

cracked secondary slide was also discovered in a Maersk 737 main rudder PCU that was

removed from service on February 3, 1999, because of a malfunctioning yaw damper and

leakage. The crack was discovered as a result of a test performed at Parker on February 9,

1999, to detect cracking of the secondary slide.) According to Parker and Boeing

personnel, of the 1,686 redesigned servo valves that had been shipped (to Boeing or the

airlines), about 969 had been installed on airplanes before the fractured secondary slides

were discovered. Boeing and Parker personnel stated that all of the fractured secondary

slides had been magnetic particle inspected in their preassembled form with no fractures

detected.261

Safety Board personnel became aware in late September 1998 of the fractures in

the redesigned servo valve secondary slides. The Safety Board’s (visual and microscopic)

examination of the fractured secondary slides revealed that the fractures consistently

occurred on only one of the two legs at the input side of the secondary slide. The fracture

appeared to initiate at the relatively sharp radius where the secondary slide reduces in

cross section to accommodate the input mechanism for the primary and secondary slides,

and the fracture progressed all the way through the leg, deviating on an angle, in all but

one secondary slide. (The location of the crack on the remaining slide was farther along

the leg.)

According to Boeing and Parker personnel, they examined several known and

suspected cracking scenarios to determine the source of the cracks. These scenarios

included delayed quench cracking, delayed cracking resulting from transformation of

retained austenite to martensite, residual tensile stresses (from grit or bead blasting after

machining), slow overstress, improper rig pin installation, and external impact loads.

(External impact loads were generated by dropping the secondary slide from a height of

about 3 feet onto a steel plate floor.) According to Boeing and Parker personnel, the

fractures that resulted during tests involving external impact loads produced a fracture

260 According to Boeing personnel, the chipped secondary slide leg was not fractured completely

through: both sides of the leg exhibited what appeared to be marks from a rigging tool, and Boeing indicated

that the chip likely resulted from abusive handling of that rigging tool. 

261 After the servo valve components undergo inspection, the servo valves are assembled, rigged, and

tested at Parker. 
Factual Information 182 Aircraft Accident Report

surface with characteristics similar to those exhibited by the 10 fractured secondary slides.

Boeing personnel stated that, although the cause of the fractured secondary slides has not

yet been identified, improper handling would be the most likely mechanism.

During a December 3, 1998, briefing at Safety Board headquarters in Washington,

D.C., Boeing personnel stated that review of the potential fractured secondary slide leg

scenarios indicated the following: 

• if only one leg of the secondary slide failed, rudder performance would be

normal;

• if the second leg of the secondary slide also failed, but the end piece remained

in place, rudder performance would be normal except that trailing edge left

movements would occur at half rate; and

• if the second leg failed and the separated end piece moved within the PCU

cavity, an input link jam off neutral might occur, resulting in a rudder hardover.

Boeing and Parker personnel have developed and are instituting a modified servo

valve production plan, which includes new (postassembly) servo valve dye penetrant

inspection and PCU servo valve secondary slide displacement tests. Boeing drafted two

alert service bulletins (ASB)262 that describe procedures for the PCU servo valve

secondary slide displacement test, criteria for passing the test, and procedures for

replacement of any discrepant servo valve assembly with one having a secondary slide

that passed the displacement test.

During the December 1998 briefing, Boeing personnel also prioritized the

fractured secondary slide problem, asking “what’s more important: crack fix or reversal

fix?” Boeing’s proposal indicated that its analysis showed that continued use of the current

servo valve would be preferred over the 1998 redesigned servo valve. The proposal further

stated that “as a precaution, Boeing believes correction of crack issue should have priority

over correction of reversal scenario.” Because of this proposed shift in priorities, Boeing

recommended that the deadline for the installation of redesigned servo valves (required by

AD 97-14-04, which addressed the potential of a rudder reversal condition) be extended to

August 2000 or later (instead of August 1999, as currently required).

On January 13, 1999, the FAA issued a Notice of Proposed Rulemaking (NPRM,

Docket No. 98-NM-383-AD), proposing an AD that would require operators to perform

PCU servo valve secondary slide displacement tests (as described in Boeing’s draft ASBs)

at regular intervals and replace the servo valve assembly if necessary. The NPRM stated

that because the proposed AD is an “interim action and a final action has not yet been

identified to adequately address the identified unsafe condition, it will be necessary to

repeat the displacement test on all [737] series airplanes, including airplanes that are

produced subsequent to those with line numbers specified in the draft alert service

bulletins.”

262 When finalized, ASBs 737-27A1221 and 737-27A1222 will apply to 737-100 through -500 series

airplanes and 737-NG series airplanes, respectively. 
Factual Information 183 Aircraft Accident Report

1.18.6 Human Performance Considerations

1.18.6.1 Pilot Incapacitation

The Safety Board is aware of two instances of pilot incapacitation involving

unintentional rudder inputs during flight.263 The first instance occurred on June 11, 1980,

and involved a Frontier Airlines 737 on a visual approach to its destination airport in

Cheyenne, Wyoming. The captain of this flight reported that the first officer was manually

flying the airplane and that he decided to fly the approach 10 knots faster than the normal

approach airspeed because of a possible windshear encounter during the approach. The

captain indicated that, as the airplane descended through about 800 feet agl, he observed

the airspeed increasing and commented “we are too...fast” but that the first officer did not

respond. The captain reported that, when he called for a go-around and reached for the

throttles, the airplane’s nose yawed to the left. According to the captain’s postincident

written report, “I...glanced at the First Officer and realized that he was incapacitated and

apparently unconscious. I added full power and began a climb and missed approach. The

aircraft was still wallowing around and I was having a problem getting the controls into a

coordinated flight situation. The airplane flew best in a climbing left turn.” 

The captain stated that he instructed a flight attendant to put an oxygen mask on

the first officer. The flight attendant advised the captain that the first officer’s left leg was

rigid and was pushing against the left rudder pedal. The flight attendant moved the first

officer’s leg off the rudder, and the captain regained normal control of the airplane. The

captain stated that he returned to land without further incident, and the first officer began

to revive as the airplane taxied to the terminal. (The article in Flying magazine indicated

that the first officer’s incapacitation/seizure was the result of a chemical imbalance, which

was subsequently treated successfully.) 

During postincident interviews with Safety Board personnel, the captain reported

that he was “startled” at the beginning of the incident; he stated that he flew reflexively

and that his motor responses were sharp and unaffected by the sudden change of events.

However, the captain stated that, until the flight attendant observed that the first officer

was depressing the left rudder pedal, he did not know what was causing the airplane to

yaw to the left. The captain reported that he was surprised that he was not aware that the

left rudder pedal was pushed forward. 

The second instance of pilot incapacitation involving unintentional rudder inputs

occurred on March 29, 1994, and involved a Southwest Airlines 737 on approach to its

destination airport in Oakland, California. During postincident interviews with Safety

Board personnel, the captain of the Southwest Airlines flight stated that the first officer

263 The Safety Board became aware of the first incident when a staff member read an account of the

event in the January 1996 issue of Flying magazine. The captain of the Frontier Airlines flight told Safety

Board investigators that he decided to write the article after the United Airlines flight 585 accident in March

1991 and that the article was accepted for publication in July 1994. After learning about this incident, Safety

Board staff asked the FAA’s CAMI to search the Pilot Incapacitation Database for similar incidents. This

search revealed a second incident, involving a Southwest Airlines 737. 
Factual Information 184 Aircraft Accident Report

was performing PF duties during the approach with the autopilot engaged in CWS mode.

The captain stated that the airplane was in clouds and fog, about 1,500 feet agl, when the

first officer “let out a blood curdling scream.” The captain reported that the first officer

was staring out the forward cockpit window, his eyes were extremely large, and his back

was arched. (These observations led the captain to wonder at first whether the first officer

might have been shocked by the circuit breakers located behind his seat). 

The captain reported that, seconds later, the first officer screamed another time, his

back went rigid, and he clutched at the control column. The captain noticed that the

airplane began to roll right and felt the left rudder pedal hit his ankle. The captain stated

that, when he placed his feet on the rudder pedals, he noted the left rudder pedal was

displaced aft about 5 to 6 inches. The captain reported that he disconnected the autopilot,

applied aileron in the direction opposite the roll, and physically struggled (against the

rudder pressure applied by the first officer) to neutralize the rudder pedal position. The

captain stated that he also tried to use differential engine thrust to counter the effects of the

rudder pressure. When a flight attendant unlatched the first officer’s lap belt and shoulder

harness, the pressure on the rudder pedals was released, and the captain landed the

airplane without further incident. The captain stated that he was startled at the beginning

of the incident, which delayed his action by no more than 2 to 3 seconds. The captain also

stated that he later learned that the first officer had suffered a seizure and had no

recollection of the incident.

1.18.6.2 Spatial Disorientation 

According to a book on flightdeck performance,264 spatial disorientation (a loss of

correct perception of one’s orientation with respect to the ground—typically from a

conflict between vestibular cues and those of visual and kinesthetic cues) can contribute to

incorrect pilot control inputs. The book states that a pilot uses information from vestibular

(inner ear) and visual (internal—flight instrumentation, external—horizon) cues to

determine the airplane’s position in space, making disorientation more likely when fewer

cues exist. The book further states that spatial disorientation is unlikely when strong

external visual cues exist; however, abrupt, rapid aircraft movements and accelerations

can lead to spatial disorientation if combined with a loss of external visual references (or

the presence of misleading external visual references). 

At the request of the Safety Board, a research scientist from NASA’s Ames

Research Center, who is an experimental psychologist specializing in human spatial

orientation, reviewed the FDR information, the CVR transcript, and a description of the

USAir flight 427 accident circumstances. The research scientist was also involved in the

Safety Board’s wake encounter simulations in NASA-Ames’ VMS simulator (see section

1.16.3), which attempted to represent the conditions and forces experienced by the pilots

of flight 427.

264 Roscoe, S., and O’Hare, D. 1990. Flightdeck Performance; The Human Factor. Ames, Iowa: Iowa

State University Press, chapter 2.
Factual Information 185 Aircraft Accident Report

During the series of wake encounter simulations, the NASA research scientist

occupied either the right or left seat of the simulator, with a Safety Board, ALPA, USAir,

or Boeing official occupying the other seat.265 The research scientist stated that the

simulator was programmed so that he received motion cues alone (without any visual

display) during several of the simulations and motion cues combined with simulated, but

representative, external visual cues during other simulations. At one of the public hearing

sessions related to the USAir flight 427 investigation, the research scientist described his

impressions of the wake turbulence encounter (the initial portion of flight 427’s upset

event) as follows:

...I was surprised at how gentle it all was. I had thought that the upset

would be more severe. It was a surprise, it did get my attention. But it was

not a violent kind of an upset that would...have me fail to know where I

was and what my orientation was....

The research scientist strongly believed that the simulator pilots were not spatially

disoriented during the initial upset event because clear external visual cues (the sky,

ground, and horizon cues provided by the VMS visual simulation) were available

throughout the simulation and the motions of the simulator were gradual and not

excessively violent. The scientist further stated that, during postsimulator ride interviews,

the simulation pilots reported that they always knew the location and orientation of the

airplane in relation to the ground and that they could have flown out of the wake

turbulence portion of the upset event.266

With regard to the accident flight, the research scientist stated:

I believe that the pilots probably would have experienced little difficulty in

maintaining an accurate perception of their orientation, even during any

brief periods when they may have lost sight of the visual horizon due to the

pitch down attitude of the airplane. In addition, perturbations of the flight

path generally appear to have been followed by verbal comments from the

pilots, indicating that they were fully aware of their trajectory, and that they

were not able to change it...it does not appear at all likely that pilot

disorientation due to abnormal vestibular stimulation provided a major

contribution to this accident.

1.18.7 Wake Turbulence/Upset Event Information

1.18.7.1 Previous Wake Turbulence Accidents

The Safety Board’s Aviation Accident Database (which contains information

regarding aviation accidents that occurred in the United States since 1962) revealed three

air carrier accidents in which wake turbulence encounters were determined to be causal

265 The individuals who participated in these simulator sessions were passengers in the simulator and

did not manipulate the simulator’s flight controls. 

266 As previously discussed, although the VMS is better able to represent airplane motions than most

simulators, even VMS motions do not realistically represent some airplane motions and accelerations

(lateral and vertical). 
Factual Information 186 Aircraft Accident Report

factors in the accident. All three accidents occurred when the airplanes were at a low

altitude in the vicinity of airports. 

• On March 8, 1964, a Douglas DC-3 crashed while landing at Chicago, Illinois.

According to the accident report, the airplane was following a Boeing 707 jet

aircraft. The probable cause of the accident was “the failure of the crew to

utilize available de-icing equipment and engine power to maintain positive

control of the aircraft under conditions of rapid airframe ice accretion and

vortex induced turbulence.” 267

• On July 15, 1969, a deHavilland DHC-6 crashed while taking off at Jamaica,

New York, behind a “recently departed jet.” 268 All other material regarding this

accident was destroyed in 1984 (15 years after the accident).

• On May 30, 1972, a Douglas DC-9 crashed while landing at Fort Worth, Texas,

behind a DC-10. The DC-9 was being operated in the airport traffic pattern

under VFR, which places the responsibility for ensuring adequate air traffic

separation on the pilots. The DC-9 was following 53 to 54 seconds behind the

preceding DC-10. Although this accident involved VFR traffic separation, the

FAA increased ATC IFR separation standards 2 months after the accident;

since this change, there have been no documented air carrier accidents in

which wake turbulence encounters were determined to be causal factors.

Review of FDR data from this accident airplane revealed that, during the wake

vortex encounter, the airspeed decreased from about 130 to about 60 knots and

then increased to about 300 knots. Further, the FDR-recorded altitude (which

had been descending consistent with approach to landing) changed from about

600 to 6,300 feet. These variations are consistent in direction and scale with

FDR data from other rotor encounters.269

1.18.7.2 Aviation Safety Reporting System Reports of Uncommanded 

Upsets/Wake Turbulence Encounters 

To support the Safety Board’s investigation of the USAir flight 427 accident,

NASA personnel reviewed the agency’s ASRS pilot report database270 and produced

reports in several subject areas, including 737-type reports, 737-type rudder trim/control

reports, Pittsburgh terminal area conflicts, and wake turbulence encounter/uncommanded

upset/loss of control events in multiengine turbojet aircraft. These reports assisted the

Safety Board in conducting a thorough review of previous yaw/roll events (as discussed in

section 1.18.1.1.) ASRS personnel also accomplished “structured callback” studies in

267 See Civil Aeronautics Board. 1965. Hansen Air Activities, Douglas DC-3A, N410D, near ChicagoO’Hare International Airport, Chicago, Illinois, March 8, 1964. CAB File 2-0002. Washington, DC. 

268 See National Transportation Safety Board. Brief of Accident. New York Airways, Inc., deHavilland

DHC-6, N558MA, at JFK International Airport, Jamaica, New York, July 15, 1969. NTSB File 1-0020.

Washington, DC.

269 See National Transportation Safety Board. 1973. Delta Air Lines, Inc., McDonnell Douglas

DC-9-14, N3305L, Greater Southwest International Airport, Fort Worth, Texas, May 30, 1972. Aircraft

Accident Report NTSB/AAR-73/03. Washington, DC.
Factual Information 187 Aircraft Accident Report

which they interviewed the pilots who provided the original reports. (After preliminary

processing, ASRS personnel typically deidentify all incoming ASRS reports to protect the

identity of the reporting individuals; however, the pilots who were interviewed on a

voluntary basis as part of the structured callback studies waived that anonymity.) 

Data from the “Multi-Engine Turbojet Uncommanded Upsets Structured Callback

Summary” (a project conducted to support the USAir flight 427 investigation) revealed

that wake turbulence was the most common cause of the upset/loss of control events

reported by pilots between January 1987 and May 1995, cited in 96 of 297 cases. Pilots

reported using rudder during recovery efforts in one-third (11 events) of the 33 upset

events reported by airline pilots to ASRS between May 1 and October 31, 1995 (and

examined in depth through structured callback efforts).271

Data from the ASRS “Wake Turbulence Structured Callback Project” (a project

conducted by the FAA in response to a Safety Board recommendation) 272 revealed that

166 wake turbulence events were reported between April 1995 and August 1997, of which

101 were from pilots of multiengine turbojet airplanes (including 33 from 737 pilots).273

Review of the ASRS reports and comments obtained from the pilots during followup

interviews revealed that flight crews were frequently surprised by the suddenness and

severity of the wake turbulence encounters.274 The pilots’ comments included the

following:

“The severity of this encounter surprised me.... I could have very easily

ended up on my back, and this was from another 737!”

“[The pilots] encountered a violent roll [to the left] 25 [degrees] and then a

violent roll back to [the right] into a 25 [degree] bank.”

“It took almost full aileron input to keep from rolling past 45 degrees....

The wake I encountered was considerably more than normal.”

“During that time we experienced very rapid roll rates...rolling 45 degrees

left and right, and full aileron often required to keep...right side up.”

“[An uncommanded upset that produced aircraft roll of] at least 45

[degrees],” and that the “[aircraft] felt out of control, very mushy...didn’t

think...could control the [aircraft].” 

“We were rolled into an approx[imately] 45-50 [degree] bank from wake

turbulence.... Such encounters...are highly distracting and require

immediate attention.”

270 ASRS is a national repository for reports regarding aviation safety-related issues and events. ASRS

reports are voluntarily submitted by pilots, air traffic controllers, air carrier personnel, and other aviation

professionals when they want to make known a potentially unsafe condition or event. The Director of

NASA’s ASRS program cautions that the existence of reports pertaining to any subject area should not be

considered a statistically valid indication of the prevalence of that problem within the aviation system;

however, the ASRS database may provide some indication of the number of aviation safety-related events

that occur in any given subject area, and the reports are a useful source of narrative descriptions of in-flight

events.
Factual Information 188 Aircraft Accident Report

The Safety Board’s review also revealed that, among pilots of multiengine turbojet

airplanes, 30 percent reported that the wake turbulence encounter occurred at night, and

7 percent reported that the encounter occurred in IFR conditions.275 Of the reported

encounters, 55 percent occurred at altitudes at or below 6,000 feet msl (the altitude of

USAir flight 427 at the time of the initial upset); 18 percent occurred at altitudes at or

below 500 feet. In addition, 25 percent of the pilots reported that the autopilot remained

engaged during the turbulence encounter. In all the cases examined through the ASRS

reports, the pilot(s) maintained or regained control of the airplane and landed without

further incident.

271 To obtain additional data regarding rudder use during air carrier operations, the Safety Board

reviewed more than 100 references to accidents and incidents that were provided by Boeing (in its “Human

Factors Supplement, Submission to the National Transportation Safety Board for the USAir 427

Investigation,” September 30, 1997), the Board’s own records of 737 accidents and incidents, and additional

737 incident data and QAR information obtained from accident investigation authorities worldwide.

Examination of the available data revealed that cross-control conditions (rudder pedal input opposing

control wheel input) occurred occasionally in response to an unexpected anomaly or wake turbulence. One

such event occurred on October 27, 1986, and involved a Trans Australia Airlines 737 during its approach to

land at Canberra, Australia. The airplane’s FDR data indicated that a cross-control condition existed for

about 21 seconds during the airplane’s right turn to align with the runway. FDR data indicated that the extent

of the cross-control varied during the event; at its most severe, the cross-control consisted of about 60° of

left control wheel input and 12° of right rudder pedal input. The pilots stated that they perceived an airframe

vibration and performed a go-around, during which coordinated control was maintained. Throughout the

cross-control event, the airplane’s right bank remained stable at 20° to 25°. FDR records indicate that a

similar cross-control situation occurred during the airplane’s second approach to the runway. That crosscontrol condition was less severe; the pilots resumed coordinated flight and an uneventful landing ensued. 

Another cross-control condition occurred on April 23, 1993, and involved a United Airlines 737 that

encountered wake turbulence at 6,500 feet msl during its approach to its destination airport. FDR data

indicated that the incident involved about 9 seconds of rudder activity, during which moments of crosscontrol occurred. Maximum rudder input during this event was less than 7°. On July 25, 1995, a USAir 737

was approaching to land at Richmond, Virginia. Pilot statements and incident airplane FDR data indicated

that the pilots responded to an uncommanded roll event appropriately with coordinated left aileron and

rudder. However, after the uncommanded roll event subsided, moments of cross-control occurred when

several degrees of left rudder input remained while the aileron position varied, providing mostly right

aileron input until the airplane landed. The pilots’ statements indicated that they made rudder and aileron

inputs “as necessary throughout the approach and landing to maintain directional control of the aircraft.”

Maximum rudder input during this event was about 7°. In June 1997, a 737 encountered wake turbulence at

10,000 feet msl behind a 747. FDR data from the incident airplane indicated that the pilots had commanded

right aileron and right rudder as the airplane began to roll left at the beginning of the wake encounter; the

right rudder input remained (although reducing gradually) for about 14 seconds, but moments of crosscontrol occurred when the aileron input varied during the recovery. Maximum rudder input was less than 7°. 

Although not a wake turbulence event, an example of an accident resulting from improper rudder input

occurred on September 6, 1985, and involved a Midwest Express Airlines DC-9 that crashed after

experiencing a loss of engine power shortly after liftoff (see National Transportation Safety Board. 1987.

Accident Involving Midwest Express Airlines, Inc., Flight 105, Douglas DC-9-14, N100ME, Milwaukee,

Wisconsin, September 6, 1985. Aircraft Accident Report NTSB/AAR-87/01. Washington, DC.) The Safety

Board’s accident report indicated that, because of the airplane’s nose-high pitch attitude, the pilots were

operating with reduced external visual cues. Although the pilots initially applied correct rudder in response

to the loss of engine power, incorrect rudder was applied about 4 to 5 seconds later.
Factual Information 189 Aircraft Accident Report

1.18.8 Ergonomics—Study of Maximum Pilot Rudder 

Pedal Force

As previously discussed, one of the variables in the Safety Board’s computer

simulations was pilot rudder pedal force. Because pilot rudder pedal force was not

recorded by the FDRs in the USAir flight 427, United flight 585, and Eastwind flight 517

airplanes, the Safety Board conducted a study, using ergonomic research and other data, to

estimate the rudder pedal forces that the pilots might have applied during the upset events. 

A researcher at the USAF’s Armstrong Laboratory studied strength capability for

operating aircraft controls in a study often used as a standard for aircraft design.276 The

data reported in this study represent the maximum isometric strength demonstrated by

USAF subjects operating the aircraft controls of a laboratory simulator. Subjects were

healthy volunteers, either from the Air Force Academy (AFA) or Officer’s Training

School (OTS), who were instructed to push forward on the rudder pedal with as much

force as they could exert and hold that force for 5 seconds. 

Among 199 of the subjects (male AFA students between 19 and 25 years old),

median strength output of the left leg against the left rudder pedal was 624 pounds, and

median strength output of the right leg against the right rudder pedal was 623 pounds.

Among 249 other subjects (male OTS students between 21 and 34 years old), median

strength output of the right and left legs was 510 pounds each. These results were some of

the highest leg force outputs obtained in a laboratory setting and cited in the available

ergonomic literature,277 even when the results were compared with other studies using

USAF subjects.278

The results from the USAF study involving OTS subjects were considered to be

more representative of the airline pilot population for two reasons: the OTS subjects

(although physically fit) were not subject to the rigorous physical selection and exercise

272 See National Transportation Safety Board. 1994. Safety Issues Related to Wake Vortex Encounters

During Visual Approach to Landing. Special Investigative Report NTSB/SIR-94/01. Washington, DC.

273ASRS reports of wake turbulence encounters by general aviation and air carrier pilots increased after

NASA began its Wake Turbulence Project in April 1995, which was publicized in the piloting community.

Before 1995, ASRS received an average of 55 wake turbulence reports annually. In 1995, 109 reports of

wake turbulence encounters were received. In 1996, 60 reports were filed, and 87 reports were filed in 1997.

274 In many cases, review of the FDR data revealed that the flight crews overestimated the degree of

bank experienced as a result of the wake turbulence encounters. The flight crew of Eastwind flight 517

overestimated the degree of bank experienced during the incident. 

275 The data reported here were extracted by ASRS staff at the request of the Safety Board to focus on

reports from pilots of multi-engine turbojets.

276 McDaniel, J.W. 1995. “Strength capability for operating aircraft controls.” SAFE Journal, 25,

pp. 28-34.

277 Weimer, J. 1993. Handbook of ergonomic and human factors tables. Englewood Cliffs, New Jersey:

Prentice Hall, pp. 90-91.

278 Hertzberg, H.T.E., and Burke, F.E. 1971. “Foot forces exerted at various aircraft brake-pedal angles.”

Human Factors, 13, pp. 445-56.
Factual Information 190 Aircraft Accident Report

requirements that were applied to the AFA students, and the OTS students, on average,

were older than the AFA subjects. Therefore, the Safety Board used the results of the

USAF studies involving OTS subjects as a baseline for its ergonomic study; an output of

510 pounds, sustained for a short period of time, was deemed as a reasonable estimate for

the maximum leg force output of an airline transport pilot. 

In evaluating the leg force that could have been applied during the three upset

events, the Safety Board also considered the effect that seat position and knee angle would

have on that force. Ergonomic studies indicate that an individual’s maximum potential leg

thrust varies dramatically with knee angle, with an optimal knee angle range of between

140 and 160° (180° corresponds to a straight leg).279 (The knee angles of the subjects in

the USAF studies were between 130 and 140° for a neutral pedal position, which provided

for adequate leg extension to obtain a full rudder input with the most effective knee

angles.)

The Safety Board also considered the effect that age might have on a pilot’s ability

to exert leg forces approaching those demonstrated in the USAF studies. Research

indicates a loss of strength in leg extension forces among subjects older than those in the

USAF studies (about a 6 percent reduction in strength per decade in individuals older than

30 years old).280 However, studies also indicate that general muscle loss can be prevented

or reversed as a result of regular exercise.281

Further, the Safety Board researched the correlation between physical size (such as

height) and leg strength and found that the correlation between the two was low. In other

words, the research showed that a shorter person may be extremely strong, whereas a

taller person may be comparatively weak. 

The Safety Board recognizes that a pilot’s leg force output in a real cockpit

emergency (such as those that occurred on USAir flight 427, United flight 585, and

Eastwind flight 517) may also depend on the motivation and perception of the pilots about

their situation. Thus, laboratory results may not necessarily replicate actual flight

situations. 

279 Woodson, W.E., Tillman, B., and Tillman, P. 1993. Human Factors Design Handbook. New York:

McGraw Hill. Kroemer, K.H.E., Kroemer, H.B., and Kroemer-Elbert, K.E. 1994. Ergonomics: how to

design for ease and efficiency. Englewood Cliffs, New Jersey: Prentice Hall, p. 379.

280 Hortob’agyi, T., Zheng, D., Weidner, M., Lambert, N.J.; Westbrook, S.; and Houmard, J.A. 1995.

“The influence of aging on muscle strength and muscle fiber characteristics with special reference to

eccentric strength.” Journal of Gerontology, Biological Sciences, 50: B399-406. Bemben, M.G., Massey,

B.H., Bemben, D.A., Misner, J.E., and Boileau, R.A. 1996. “Isometric intermittent endurance of four muscle

groups in men aged 20-74 yr.” Medicine and Science in Sports and Exercise, 28 (1), pp. 145-54. Borges, O.

1989. “Isometric and isokinetic knee extension and flexion torque in men and women aged 20-70.”

Scandinavian Journal of Rehabilitation Medicine, 21 (1), pp. 45-53 Sanders, M.S., and McCormick, E.J.

1993. Human Factors in Engineering and Design. New York: McGraw Hill, Inc., p. 251.

281 Yukitoshi, A., and Shephard, R.J. 1992. “Aging and muscle function.” Sports Medicine, 14 (6),

pp. 376-396. Sanders and McCormick, p. 251.
Factual Information 191 Aircraft Accident Report

Therefore, in estimating the maximum rudder pedal force applied by the flying

pilots in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517

incident, the Safety Board used the available ergonomic and other data, including the leg

strength results from the USAF OTS subject study and the pilot’s knee angle, age,

physical fitness, physical size, motivation, and perception of the situation. In the case of

the Eastwind flight 517 incident, the Safety Board also used the flight crew’s statements,

the flying pilot’s actual knee angle, and pilot rudder pedal force measurements. 

USAir Flight 427

The Safety Board modeled the pedal forces exerted by the first officer of USAir

flight 427 based on the pilot rudder pedal force norms identified in the USAF OTS study.

The first officer, who was 6 feet 3 inches tall, was reported to be healthy and, at 38 years

old, might have been subject to a small degradation in leg extension strength (perhaps 6

percent) compared with the younger USAF OTS subjects. The CVR indicated physical

straining sounds over a period of less than 5 seconds at the beginning of the upset period,

which was consistent with the period of maximum effort exerted by the subjects in the

USAF study. Thus, on the basis of his age (and the assumption of an optimal knee angle),

the first officer could be expected to have been able to exert about 480 pounds of force on

a single rudder pedal (510 pounds minus 6 percent, or about 30 pounds).

To estimate the first officer’s probable seat position and knee angle during the

upset, postaccident ergonomic measurements were conducted in a 737 cockpit using a

Safety Board employee who was similar to the first officer in height, weight, and inseam

measurement.282 The Safety Board employee found it necessary to place the right-hand

cockpit seat in its farthest aft position and the rudder pedal adjustment in its farthest

forward position for optimal flight control usability and leg room comfort. He adjusted the

seat height to the correct eye reference position, according to guidance in the USAir

Operations manual.283 In this position, the Safety Board employee’s right knee angle was

133° when his foot was pushing on the right rudder pedal in its neutral position. When the

right rudder pedal was displaced 11⁄4 inches aft (toward the Safety Board employee), his

right knee angle was 122°. 

Ergonomic research indicates that a pilot’s maximum leg thrust with a 122° knee

angle would be further degraded by about 28 percent (compared with the 130 to 140°

range in the USAF study). The Safety Board used the blowdown limit for USAir flight

427 to calculate that the right rudder pedal would likely have moved about 1 inch aft of its

neutral position, causing the first officer’s knee angle to diverge from the optimum range.

On the basis of this information and the results of measurements of the Safety Board

282 Information about the first officer’s height and weight was based on his most recent flight physical.

The first officer’s inseam measurement was provided by his wife.

283 According to US Airways personnel, no eye reference adjustment device was in the cockpit of the

accident airplane. The company 737 Pilot’s Handbook directed pilots to adjust the seat for the correct eye

reference position, which is established when the top-most flight mode annunciators are just in view below

the glareshield and, at the same time, a slight amount of the aircraft nose structure is visible above the

forward lower window sill.
Factual Information 192 Aircraft Accident Report

employee’s seat position and knee angle, the Safety Board assumed that the USAir flight

427 first officer’s right rudder pedal force was reduced about 15 to 20 percent as the right

rudder pedal moved aft during the upset event.

Accordingly, on the basis of the available information, the Safety Board’s

computer simulation studies (discussed in section 1.16.6.1) assumed that the first officer

of USAir flight 427 would have applied an initial maximum force of about 400 pounds on

the right rudder pedal in response to a rudder reversal. Further, the simulation studies

assumed that the first officer reduced his leg force on the right rudder pedal by about

50 percent (to about 200 pounds) later in the upset sequence when he would have been

maintaining rudder pedal pressure but making less than a maximum effort so he could

attend to other aspects of the emergency. (See section 2.2.2 for more discussion of this

rudder pedal force reduction.) 

United Flight 585

The captain of United flight 585 was 5 feet 7 inches tall, which permitted him to

make seat adjustments that could have obtained an optimum knee angle for exerting force

on the rudder pedals (unlike the first officer of USAir flight 427). The captain was

assumed to have selected a seat and rudder pedal adjustment that resulted in the optimal

(130 to 140°) knee angle with the rudder pedals in the neutral position and allowed for leg

extension to command full rudder. (The CVR transcript indicates that the captain

performed a rudder check before takeoff,284 which would have required the captain to

adjust his seat position to allow for the full range of motion on the rudder pedals.)

Although the captain’s age (52 years) might have resulted in some degradation in

maximum leg force,285 postaccident interviews indicated that the captain was in excellent

health and followed a rigorous exercise regimen. 

Because the captain’s personal health characteristics might have countered the

normal age-related loss of strength, the Safety Board did not reduce its estimate of the

captain’s leg force from the USAF norms based on his age. However, the United flight 585

circumstances indicated that, in a rudder reversal situation, the left rudder pedal could

move as much as 3 inches aft (toward the captain) during the rudder’s movement to its

blowdown limit (and within about 1 additional second as sideslip allowed the rudder to

deflect more). This rudder pedal movement would have forced the captain to use a less

effective knee angle than that of the USAF OTS subjects, which would have reduced his

rudder pedal input force.

Further, because of the suddenness of the United flight 585 upset and the airplane’s

rapid departure from controlled flight, it is possible that the captain never reached his

personal maximum leg force effort. In the short time available to recover from the upset,

the captain may have pushed hard on the left rudder pedal only long enough to realize that

284 The CVR transcript indicates that, at 0914:20, before taxiing for takeoff, the captain warned the first

officer to “watch your feet here comes the rudder.” 

285 Research indicated that a loss of about 15 percent in pilot rudder pedal force might be expected in an

individual the same age as the captain.
Factual Information 193 Aircraft Accident Report

there was a serious problem in the flight control and then shifted his focus to attempt a

go-around and stop the yaw/roll with control wheel inputs. Therefore, on the basis of the

available information, the Safety Board’s simulation studies assumed that the captain

applied a force of about 300 pounds during the brief period between pedal input and the

go-around decision/control wheel input and that he subsequently reduced his rudder pedal

force to about 200 pounds (see section 2.3.2 for more discussion of the force reduction).286

Eastwind Flight 517

The captain of Eastwind flight 517 was 5 feet 10 inches tall. Postincident

measurements in a cockpit identical to that of the incident airplane showed that, when the

seat and rudder pedals were adjusted to the positions the captain normally used in landing,

his left knee angle was 130° when his left foot was pushing the left rudder pedal in its

neutral position. The captain estimated that, during the incident, the left rudder pedal

moved 11⁄2 inches forward of its neutral position in response to his efforts to depress it.287

With the left rudder pedal in this position, the captain’s left knee angle was 140° when his

left foot pushed the pedal. Further, when the captain demonstrated how he “stood on the

pedal” during the incident to gain greater pushing force, he used a raised posture in which

his body moved upward by 2 inches (as measured at the shoulder). In this posture, his left

knee angle was 145° when he pushed on the left pedal, which was displaced 11⁄2 inches

forward of its neutral position. Ergonomic literature indicates that this posture may have

increased the captain’s maximum leg force by as much as 35 percent compared with the

USAF OTS subject norm.

 During postincident testing, the captain displayed a leg strength on a standard

medical rehabilitation testing protocol that placed him below average compared with

norms established by a sample of healthy, recreationally active adults. However, in

allowing for the advantage that may have been provided by his effective knee angle, the

Safety Board assumed that the captain could produce a maximum force in the 500-pound

range when “standing” on the rudder pedal to oppose a rudder reversal.

On the Eastwind flight 517 airplane, a force of about 300 pounds would have been

required to move the rudder pedal beyond its neutral position in a rudder reversal

situation. Therefore, the captain’s demonstration to investigators of the left rudder pedal

position that he recalled obtaining during the incident (about 11⁄2 inches forward of

neutral) would correspond to an effort of about 450 pounds. This rudder pedal force is

286 This model of pilot rudder pedal force was considered the most appropriate, but a second model also

provided a good fit of the data. In this second model, the captain was assumed to have initially input a rudder

pedal force of about 500 pounds and then reduced this input force to 250 pounds. 

287 During a June 14, 1996, interview, the captain stated that he stood hard on the rudder pedal and

applied about 3 to 4 inches rudder displacement. During a June 17, 1998, interview, the captain stated that

the rudder pedals moved no more than 1 or 2 inches. In a February 4, 1999, cockpit test, in which the captain

moved actual rudder pedals, the left pedal moved downward by 11⁄2 inches on his first demonstration and by

1-5/8 inches on his second demonstration (as measured by a Safety Board investigator seated in the opposite

pilot seat). On the basis of all four estimates, and the simplicity of a pedal demonstration compared with a

verbal description, the Safety Board employed a 11⁄2-inch displacement as a representation of the captain's

recall. (A 4-inch displacement would move the pedal down to its lower stop, which would contradict the

captain's numerous reports that the pedal was stiff and would not go down to the floor.)
Factual Information 194 Aircraft Accident Report

consistent with the Board’s estimates based on the USAF data, adjusted for the captain’s

measured strength and knee angles.

Accordingly, on the basis of the available information, the Safety Board’s

simulation studies assumed that the captain’s initial rudder pedal force was about 500

pounds. The simulation studies further assumed that this rudder pedal force was reduced

later in the incident sequence (see section 2.4.2 for more discussion of the force

reduction).

1.18.9 Unusual Attitude Information and Training

The FAA’s AC 61-27C, “Instrument Flying Handbook,” defines an unusual

attitude as “...any airplane attitude not normally required for instrument flight.” The AC

states that an unusual attitude may result from “a number of conditions, such as

turbulence, disorientation...or lack of proficiency in aircraft control.” 

The Airplane Upset Recovery Training Aid (developed in 1997 and 1998 by a

working group, as described in section 1.18.9.2) states that “while specific values may

vary among airplane models, the following unintentional conditions generally describe an

airplane upset [unusual attitude]: Pitch attitude greater than 25° nose up; pitch attitude

greater than 10° nose down; bank angle greater than 45°; and within the above parameters,

but flying at airspeeds inappropriate for the conditions.”

1.18.9.1 Preaccident Activity

Before the USAir flight 427 accident, the Safety Board had issued three safety

recommendations that addressed training flight crews involved in 14 CFR Part 121

operations in the recognition of and recovery from unusual flight attitudes. Safety

Recommendation A-70-21, issued on May 1, 1970, referenced an accident that occurred

on November 16, 1968, in which a flight crew lost control of a 737 near Detroit,

Michigan, in poor weather conditions.288 The Safety Board recommended additional flight

crew training in which pilots would be required to periodically demonstrate proficiency in

recovery from unusual attitudes. The Safety Board also suggested that a simulator be

utilized to provide flight crew familiarization with (1) the various instrument displays

associated with and resulting from encounters with unusual meteorological conditions,

(2) the proper flight crew response to the various displays, and (3) demonstration of and

recovery from possible ensuing unusual attitudes. 

In its May 21, 1970, letter to the Safety Board, the FAA stated that airline training

was now emphasizing the proper use of trim, attitude control, and thrust, which the FAA

believed was far more effective than the practice of recovery from unusual attitude

maneuvers. The FAA indicated that unusual attitude maneuvers had been deleted from the

pilot proficiency check in 1965. The FAA also believed that it was inconceivable to

require training maneuvers that would place a large jet airplane in a nose high, low

airspeed, high angle-of-attack situation. 

288 See National Transportation Safety Board. 1969. NTSB Log 69-0115, notation 413.
Factual Information 195 Aircraft Accident Report

In a July 8, 1970, letter to the Safety Board, the FAA stated to the Safety Board

that changes in airline training and operational procedures had resulted from this safety

recommendation and cited a “marked decrease in upset events” as evidence that these

actions had addressed the intent of the recommendation. The FAA further stated that it

would discuss with industry representatives the feasibility of simulating large excursions

from flightpath caused by abnormal meteorological conditions. Because no further action

was taken by the FAA, the Safety Board classified Safety Recommendation A-70-21

“Closed—Unacceptable Action” on August 17, 1972.

On March 31, 1971, a Boeing 720B yawed and crashed while the flight crew was

attempting a three-engine missed approach. The Safety Board attributed the probable

cause of the accident to a failure of the airplane’s rudder actuator and expressed concerns

regarding the flight crew’s ability to rapidly assess the situation and recover. As a result of

this accident, the Safety Board issued Safety Recommendation A-72-152, which asked the

FAA to require pilots to demonstrate their ability to recover from abnormal regimes of

flight and unusual attitudes solely by reference to flight instruments. The Board

recommended the use of simulators for this demonstration and noted that current

simulators should be modified if they were not capable of being used for this purpose.

In its response, the FAA stated that it did not believe that simulators were capable

of simulating certain regimes of flight that go beyond the normal flight envelope of the

aircraft. Further, because an aircraft simulator is not required as part of an air carrier

training program, the FAA stated that it could not require that a simulator be replaced or

modified to simulate regimes of flight outside the flight envelope of the aircraft. On the

basis of this response, Safety Recommendation A-72-152 was classified “Closed—

Unacceptable Action” on January 16, 1973.

The Safety Board issued Safety Recommendation A-92-20 as a result of a July 10,

1991, Beech C99 accident at Birmingham, Alabama.289 The recommendation asked the

FAA to require that recurrent training and proficiency programs for instrument-rated pilots

include techniques for recognizing and recovering from unusual attitudes.

In its July 9, 1992, letter to the Safety Board, the FAA stated that pilots are already

required to demonstrate recovery from unusual flight attitudes on their private pilot

examination. In addition, the FAA noted that the instrument rating requires a pilot to be

proficient in recovery from unusual attitudes. Therefore, the FAA believed that, by the

time a pilot had the required experience to become part of a flight crew with a 14 CFR Part

121 or 135 air carrier, the pilot would have received extensive training and flight checks

for procedures and techniques in recovery from unusual attitudes. The FAA further cited

existing requirements for the ATP certificate and pilot training under Part 121, including

recovery from “specific flight characteristics that are considered reasonably probable for

the airplane (such as dutch roll recovery in the Boeing 727), steep turns, approaches to

stalls, and the windshear escape maneuver.” 

289 For more information, see National Transportation Safety Board. 1992. L’Express Airlines, Inc.,

Flight 508 Beech C99, N7217l, Weather Encounter and Crash Near Birmingham, Alabama, July 10, 1991.

Aircraft Accident Report NTSB/AAR-92/01. Washington, DC.
Factual Information 196 Aircraft Accident Report

In a January 26, 1993, letter to the FAA, the Safety Board stated that it continued

to believe that instrument-rated pilots should receive recurrent training in techniques for

recognizing and recovering from unusual attitudes and that proficiency programs should

include this same training. The letter also stated the Board’s belief that requiring such

training annually would greatly enhance a pilot’s ability to safely recover from an unusual

attitude. Because the FAA planned no additional response, Safety Recommendation

A-92-20 was classified “Closed—Unacceptable Action.”

The Safety Board’s accident report of a DC-8-63, near Swanton, Ohio, on

February 15, 1992,290 addressed the subject of airline pilots’ reluctance to aggressively

apply flight controls. The report stated the following: 

...basic control manipulations by the first officer during the recovery

attempt were in general accordance with accepted procedures in that he

attempted to roll the wings level and then began pulling the nose up. If he

had been more aggressive with both sets of controls, he might have

succeeded. A larger, more rapid aileron input would have leveled the wings

faster[,] and a more aggressive pullout could have been within the

operating envelope of the aircraft.... Obviously, this situation called for

extremely quick and aggressive control inputs. 

According to USAir flight training personnel, the flight training syllabus at the

time of the USAir flight 427 accident included pilot training in the following maneuvers:

• recovery from approaches to stalls,

• recovery from a dutch roll,

• high-speed buffet,

• steep turns (45° bank), and

• windshear escape. 

However, the Safety Board’s review of the USAir training syllabus that was in

effect before the accident for both the ground and simulator training programs revealed

that the training being conducted did not include recovery from unusual attitudes or

upsets, as defined in AC 61-27C or in the Airplane Upset Recovery Training Aid.

Additionally, the Safety Board surveyed the content of the flight training syllabi of

six other major airlines at the time of the flight 427 accident. Of the six airlines surveyed,

five had training syllabi similar to the USAir training syllabus. The sixth, United Airlines,

had recently developed and implemented an Advanced Maneuvers Package291 for its

Boeing 757 and 767 flight crew simulator training program. According to United Airlines

290 See National Transportation Safety Board. 1992. Air Transport International, Inc., Flight 805,

DC-8-63, N794AL, Loss of Control and Crash, Swanton, Ohio, February 15, 1992. Aircraft Accident Report

NTSB/AAR-92/05. Washington, DC.

291 United Airlines’ training captains developed the Advanced Maneuvers Package over a 2-year period,

and it was incorporated into the 757 and 767 training program in July 1994. The program involves

recognition and recovery from unusual flight attitudes, including nose high, nose low, and inverted.
Factual Information 197 Aircraft Accident Report

flight training personnel, the Advanced Maneuvers Package received an “overwhelmingly

positive” response from flight crews and instructors, and the airline was incorporating the

training throughout its fleet.

On July 13, 1993, Boeing published a Flight Operations Review article, which

addressed the subject of unwanted roll tendencies, as follows:

If aileron control is affected, rudder inputs can assist in countering

unwanted roll tendencies. The reverse is also true if rudder control is

affected.

If both aileron and rudder control are affected, the use of asymmetrical

engine thrust may aid roll and directional control. 

When encountering an event of the type described above, the flightcrew’s

first consideration should be to maintain or regain full control of the

airplane and establish an acceptable flight path. This may require the use of

unusual techniques such as the application of full aileron or rudder.

1.18.9.2 Postaccident Activity

On August 16, 1995, the FAA disseminated Flight Standards Handbook Bulletin

for Air Transportation (HBAT) 95-10, entitled “Selected Events Training” (SET), to its

principal operations inspectors (POI). The HBAT contains “...guidance and information

on the approval and implementation of ‘Selected Events Training’ for operators training

under 14 CFR Part 121, who use flight simulation devices as part of their flight training

programs.” 

The HBAT states that the SET is “voluntary flight training in hazardous inflight

situations which are not specifically identified in FAA regulations or directives.” Some of

the examples of these selected events include false stall warning in rotation, excessive roll

attitude (in excess of 90°), and high pitch attitude (in excess of 35°). The HBAT further

states that the SET program was developed jointly by the FAA and the aviation industry in

response to previously issued Safety Board recommendations addressing the need for

unusual events and unusual attitude training for Part 121 and 135 air carrier pilots.

In 1996, USAir implemented SET as a required recurrent training element for all

of its pilots. The training program at USAir included simulator training in recovering from

nose high, nose low, and inverted airplane attitudes. Also, many air carriers began

implementing SET/Advanced Maneuvers Package programs patterned after the guidelines

of the FAA’s HBAT 95-10 and United Airlines’ program, respectively. 

On October 18, 1996, the Safety Board issued Safety Recommendation A-96-120.

This recommendation asked the FAA to require 14 CFR Part 121 and 135 operators to

provide training to flight crews in the recognition of and recovery from unusual attitudes

and upset maneuvers, including upsets that occur while the aircraft is being controlled by

automatic flight control systems and unusual attitudes that result from flight control

malfunctions and uncommanded flight control surface movements. 
Factual Information 198 Aircraft Accident Report

In a January 16, 1997, letter to the Safety Board, the FAA stated that it was

considering an NPRM proposing to require that air carriers conduct training that will

emphasize recognition, prevention, and recovery from aircraft attitudes that are normally

not associated with air carrier flight operations. In its July 15, 1997, response, the Safety

Board stated that it was not aware of any training programs that specifically addressed

unusual attitudes that resulted from a control system failure or for which some flight

controls would not be available, or would be counterproductive to, the recovery. (This

recommendation is discussed more fully in section 1.18.11.5.)

In a November 2, 1998, letter to the FAA, the Safety Board listed those safety

recommendations, including A-96-120, for which no recent action had been taken by the

FAA. In a January 13, 1999, letter to the Safety Board’s Director of the Office of Aviation

Safety, the FAA’s Associate Administrator for Regulation and Certification stated that

“14 CFR part 121, subparts N and O (Training Program and Crewmember Qualifications,

respectively), are being extensively rewritten. The rulemaking is expected to contain

specific requirements addressing the NTSB’s concerns.” (See section 2.7 for the Safety

Board’s review and evaluation of the FAA’s action in response to Safety Recommendation

A-96-120 and the recommendation’s current classification.) 

During 1997 and 1998, a working group composed of representatives of aircraft

manufacturers, air carriers, pilot associations, training organizations, and government

agencies (including the FAA) developed the Airplane Upset Recovery Training Aid. This

publication and video program provided background information for air carrier pilots and

managers on jet aerodynamics, stability, control, and upset recovery. The training aid also

provided a model curriculum for classroom and flight simulator training in recovering

from unusual flight attitudes. As of late 1998, the Airplane Upset Recovery Training Aid

publication and video program were being distributed by two major air transport

manufacturers (Boeing and Airbus) to their customers. This training aid, however, does

not include simulator training in unusual attitudes resulting from flight control

malfunctions and uncommanded flight control surface movements.

1.18.10 Procedural Information Available to Boeing 737 

Flight Crews

1.18.10.1 Preaccident Information Available to 737 Pilots Regarding 

Abnormal Procedures (Flight Controls Malfunctions)

The abnormal operations section of the USAir 737-300 Pilot’s Handbook that was

in effect at the time of the flight 427 accident contained procedural guidance for abnormal

flight control and hydraulic system conditions. Page 1-307-3 of the Pilot’s Handbook,

dated May 8, 1992, listed abnormal checklist procedures for flight control low pressure

and yaw damper anomalies. Page 1-307-6 of the Pilot’s Handbook, dated June 17, 1994,

listed abnormal checklist procedures for “Jammed or Restricted Flight Controls.” 

Under “Flight Control Low Pressure,” the abnormal checklist procedures stated:
Factual Information 199 Aircraft Accident Report

Flight Control Switch ............ STBY RUD [bold original to text]

Placing a flight control switch to STBY RUD starts the standby

hydraulic pump and arms the STANDBY LOW PRESSURE light. The

FLT CONTROL LOW PRESSURE light extinguishes, indicating the

standby rudder shutoff valve has opened. 

CAUTION: If flight control malfunctions are indicated, do not

deactivate systems until the cause is established. If any flight control

caution lights illuminate during flight, check position of corresponding

switches, and monitor hydraulic system indications. 

CAUSE: The light indicates low hydraulic system pressure to ailerons,

elevators, and rudder. 

Under “Yaw Damper,” the abnormal checklist procedures stated:

Yaw Damper Switch....... OFF, THEN ON [bold original to text]

If light remains illuminated: [bold original to text]

Yaw Damper Switch........................... OFF [bold original to text]

NOTE: Flying in turbulence with the yaw damper inoperative can be

difficult, and uncomfortable for the passengers. Before commencing a

flight with yaw damper inoperative, insure that turbulence (especially

continuous turbulence of moderate or greater intensity) can be avoided. 

Under “Jammed or Restricted Flight Conditions,” the abnormal checklist

procedures stated:

This procedure is accomplished when jammed or restricted movement

of flight controls in roll, pitch, or yaw control is experienced. 

Jammed or Restricted System ...........................OVERPOWER

[bold original to text]

Use maximum force, including a combined effort of both pilots, if

necessary. 

Note: A maximum two-pilot effort on the control will not cause a cable

or system failure. 

Do NOT turn off any flight control switches unless the faulty

control is positively identified. [bold original to text]

If the aileron or spoiler is jammed, force applied to the Captain’s and

the First Officer’s control wheels identifies which lateral control

system (aileron or spoiler) is usable, and which control

wheel...provides roll control....

With a jammed elevator, manual or electric trim may be used to trim in

either direction to offload control column forces....
Factual Information 200 Aircraft Accident Report

Should the rudder control cable system fail, inputs to the rudder can be

accomplished through the rudder trim control mechanism. If the rudder

pedals are jammed, rudder control, rudder trim, and nose wheel pedal

steering are inoperative. 

If freezing water is the suspected cause, consider descent to warmer air

if conditions persist and re-attempt to override the jammed or restricted

controls. 

If faulty system cannot be overpowered, use operative flight controls,

trim and thrust, as required for airplane control.

1.18.10.2 Postaccident Changes/Information Available to 737 Pilots 

Regarding Abnormal Procedures (Flight Controls Malfunctions)

1.18.10.2.1 1994 Through 1995—Information and Changes Disseminated 

by Boeing

On July 22, 1994, (less than 2 months before the USAir flight 427 accident)

Boeing issued an internal document entitled “Change Proposal” (Flight Operations

Review Board control No. 2247). The document recommended that the 737 Operations

Manual include a procedure directing the flight crew to turn off the yaw damper if

uncommanded yaw or rudder oscillations occurred in flight. The document also noted that

the 737 AFM stated that “if directional hunting or rudder oscillations occur, turn the yaw

damper off” but that the Operations Manual did not include a similar procedure. In

addition, the document indicated that Air France had questioned the discrepancy between

the manuals in 1993.

On December 9, 1994, Boeing issued a revision to its 737 Operations Manual that

established a procedure for uncommanded yaw. Page 03.10.08 of the manual stated:

UNCOMMANDED YAW

Accomplish this procedure if uncommanded yaw or rudder oscillations

occur in flight:

YAW DAMPER SWITCH....................................................... OFF

The YAW DAMPER light illuminates when the yaw damper is

disengaged.

1.18.10.2.2 1996 Through 1997—FAA Issuance of Airworthiness 

Directive 96-26-07

On December 23, 1996, the FAA issued AD 96-26-07, effective January 17, 1997.

The AD required revising the FAA-approved AFM for all 737 series airplanes to include

procedures that would enable the flight crew to take “appropriate action to maintain

control of the airplane during an uncommanded yaw or roll condition, and to correct a

jammed or restricted flight control condition.” The FAA stated that the AD had been
Factual Information 201 Aircraft Accident Report

prompted by its determination that such procedures were not adequately defined in the

existing version of the 737 AFM. 

The AD established a “recall” procedure to be performed by flight crews

immediately, from memory, in the event of an uncommanded yaw or roll. The recall

procedure stated, “Maintain control of the airplane with all available flight controls. If roll

is uncontrollable, immediately reduce angle of attack and increase airspeed. Do not

attempt to maintain altitude until control is recovered. If engaged, disconnect autopilot

and autothrottle.” 

The AD further required that the AFM section concerning procedures for jammed

flight controls be modified to include in part the following:

If the rudder pedals will not move to the pilot-commanded position, or if

the pedals are deflected in one direction and jammed, maintain control of

the airplane with all available flight controls. Disengage the autopilot and

autothrottle. Use maximum force (combined effort by both pilots) to

overpower the rudder system. 

After establishing control of the aircraft, check rudder pedal position. If the

rudder pedals have centered, accomplish a normal descent, approach, and

landing. If the rudder pedals remain jammed and are deflected to a degree

that significantly affects the controllability of the airplane, select System B

flight control switch to STBY RUD. If this action clears the jam/deflection,

make a normal approach and landing, noting that rudder control may be

limited. If moving the System B flight control switch to STBY RUD does

not clear the jam, select System A flight control switch to OFF. If pedals do

not center, select System B flight control switch to OFF....

The FAA specified that air carriers could comply with the AD by inserting a copy

of it in the AFM. No flight crew training requirements were established by the FAA for the

procedures that had been introduced or changed by the AD.

On March 3, 1997, the Safety Board provided comments to the FAA about

AD 96-26-07. The Board expressed concern that selecting the hydraulic system B flight

control switch to standby rudder was specified by the FAA as a followup procedure rather

than as an immediate action procedure. The Safety Board noted that, under certain failure

conditions, if rudder system malfunctions were to occur at a relatively low altitude and

airspeed, or if the flight crew’s recovery attempt were to be a delayed by only a few

seconds, the flight crew might not be able to regain control of the airplane from the

resulting extreme aircraft attitude and roll rate without immediately moving the system B

flight control switch to the standby rudder position.

The Safety Board recognized the potential for pilots to have difficulty identifying

the hydraulic system B flight control switch among the several identically shaped and

colored switches located nearby on the 737 overhead instrument panel. The Board noted

the possibility of changing the shape and color of the system B flight control switch to

provide greater conspicuity and distinctness.
Factual Information 202 Aircraft Accident Report

1.18.10.2.3 1997 Through 1998—Information and Changes Disseminated 

by Boeing

On February 17, 1997, Boeing issued Operations Manual Bulletin for USAir, Inc.,

USA-17, “Uncommanded Yaw or Roll; Jammed or Restricted Rudder; Jammed or

Restricted Elevator or Aileron.” This bulletin provided Boeing’s recommendations and

suggestions on how to implement the FAA’s AD 96-26-07.292 With regard to

uncommanded yaw or roll and jammed or restricted rudder, Boeing’s Operations Manual

Bulletin stated the following: 

UNCOMMANDED YAW OR ROLL [bold original to text]

Accomplish this procedure if uncommanded yaw or roll occurs in

flight. 

Maintain control of the airplane with all available flight controls. If roll

is uncontrollable, immediately reduce pitch/angle of attack and

increase airspeed. Do not attempt to maintain altitude until control is

recovered. 

AUTOPILOT (if engaged)........................................DISENGAGE

AUTOTHROTTLE (if engaged) ..............................DISENGAGE

Verify thrust is symmetrical.

If yaw or roll continues:

YAW DAMPER SWITCH....................................................... OFF

If it is confirmed that the autopilot or autothrottle is not the cause of the

uncommanded yaw or roll, the autopilot and autothrottle may be

re-engaged at the pilot’s discretion. 

JAMMED OR RESTRICTED RUDDER [bold original to text]

This procedure is accomplished only after establishing control of the

airplane with all available flight controls and when the rudder pedals

are jammed or deflected in one direction and will not move to the

pilot’s commanded position. 

AUTOPILOT (if engaged)........................................DISENGAGE

AUTOTHROTTLE (if engaged) ..............................DISENGAGE

Verify thrust is symmetrical.

RUDDER PEDALS................................................OVERPOWER

292 According to Boeing, similar bulletins were issued to other operators of the 737.
Factual Information 203 Aircraft Accident Report

Identify rudder pedal position and then use maximum rudder pedal

force, including a combined effort of both pilots on the

corresponding rudder pedal, to free and/or center the rudder. 

If rudder pedals are centered:

Accomplish Normal DESCENT-APPROACH and LANDING

checklists.

Note: Rudder authority may be limited. Crosswind capability may

be reduced. Do not use auto brakes. Landing roll steering may

require differential braking. 

If rudder pedals do not center and are verified to be jammed:

SYSTEM B FLIGHT CONTROL SWITCH...............STBY RUD

Apply pedal force to center the rudder. 

If rudder pedals can be centered:

Accomplish Normal DESCENT-APPROACH and LANDING

Checklists.

Note: Rudder authority may be limited. Crosswind capability

may be reduced. Do not use auto brakes. Landing roll steering

may require differential braking. 

If rudder pedals will not center:

SYSTEM A FLIGHT CONTROL SWITCH .......................... OFF 

If rudder pedals can be centered:

ACCOMPLISH JAMMED OR RESTRICTED RUDDER DESCENTAPPROACH and LANDING Checklists.

If rudder pedals will not center:

SYSTEM B FLIGHT CONTROL SWITCH........................... OFF

DESCENT-APPROACH [bold original to text]

Ailerons and elevator are controlled manually. Rudder is inoperative if

all flight control switches are off. 

Land at the nearest suitable airport.

Use longest runway with minimum crosswind.

Plan a flaps 15 landing.

Set Vref 15 [reference airspeed for approach with flaps 15 setting].

ANTI-ICE ............................................................. AS REQUIRED
Factual Information 204 Aircraft Accident Report

AIR CONDITIONING AND PRESSURIZATION ................ SET

ALTIMETERS & INSTRUMENTS....SET & CROSSCHECKED

N1 AND IAS [indicated airspeed] BUGS ....................CHECKED 

& SET, Vref 15

GND PROX SWITCH (As installed) ........FLAP/GEAR INHIBIT

GO-AROUND PROCEDURE ........................................ REVIEW 

Accomplish normal go-around procedure. Advance thrust to

go-around smoothly and slowly to avoid excessive pitch-up. 

LANDING [bold original to text]

ENGINE START SWITCHES ..................................................ON

RECALL.......................................................................CHECKED

SPEEDBRAKE.....................................ARMED, GREEN LIGHT

LANDING GEAR ............................................DOWN, 3 GREEN

FLAPS ............................................................ 15, GREEN LIGHT

Ground and flight spoilers, nose steering wheel, wheel brakes and

reverse thrust are still operative. Landing roll steering may require

differential braking. Do not use auto brakes. 

Additionally, in July 1997, Boeing published a Flight Operations Review article,

entitled “737 Directional Control.” The article indicated that Boeing continued to receive

questions from pilots about the likelihood of 737 rudder malfunctions, the effect of

potential rudder malfunctions on flightpath control, the meaning of crossover airspeed,

and the benefit of increased flap maneuvering speeds on the crossover airspeed. Boeing

stated that it published the article “to address these issues, to assure pilots that the 737 is

controllable during a yaw and roll event and provide a recovery technique in case an

uncommanded yaw or roll results in an airplane upset.” 

The article addressed likely and unlikely causes of 737 yaw and roll events,

procedural revisions contained in the FAA’s AD 96-26-07, the FAA’s flight and ground

validation testing for the AD-related revisions, procedures for recovery from 737 yaw and/or

roll events, and crossover airspeed. The article stated that: 

...the vast majority [of yaw and/or roll events] were caused by external

sources such as wake vortices, turbulence and wind shear, or internal

airplane sources such as yaw damper, autopilot and autothrottle

malfunctions, asymmetric flaps/slats, and pilot inputs. Additionally,

analysis and testing have shown that it is hypothetically possible, although

highly unlikely, that if one of the following rudder malfunctions occurs,

yaw and then roll would result: 
Factual Information 205 Aircraft Accident Report

1. Rudder Power Control Unit (PCU) valve secondary slide jam offneutral and a rudder pedal input causing full rudder reversal.

2. Jams of both primary and secondary slides in the rudder PCU valve.

3. Standby rudder actuator galling causing a rudder offset.

4. Linkage Jam causing blockage of the feedback loop of the main PCU,

resulting in uncommanded rudder motion.

5. A foreign object (e.g., screwdriver, wrench, nut or bolt) located

somewhere between the rudder pedals and the PCU causing a rudder

system jam.

Note: The rudder pedals will always follow the direction of the rudder

during these conditions. 

Boeing’s article defined crossover airspeed as the speed below which the rolling

moment created by a full lateral control input will not overcome the roll effect from full

rudder displacement. The article stated that “while the airspeed at which this occurs is

variable, cross-over speeds exist on all commercial airplanes. ...the [737] ‘cross-over

speed’ is at or above [Boeing’s recommended] block maneuvering speeds293 at high gross

weights and for flaps up through 10. For flaps 15, 25, 30, or 40, the ‘cross-over speed’

occurs significantly below recommended block maneuvering speeds and is near or below

stick shaker speeds.” 

According to the article, some 737 operators had chosen to increase their

maneuvering speeds for flaps up through flaps 10 configurations by adding 10 knots

above the block maneuvering speeds. Boeing stated that it had no technical objection to

such an increase and acknowledged that a block speed increase would provide a marginal

increase in lateral (roll) control authority relative to directional control authority.

However, the article cautioned operators that the crossover airspeeds “vary as a function

of left and right sideslip, differences in thrust, and differences in trim.” The article also

stated that “relying on speed additives...is simply not as effective” as executing a recovery

procedure in which the angle-of-attack is reduced, airspeed is increased, and full control

inputs are made “expeditiously.”

Boeing’s article stressed prioritizing roll control during recovery from nose-down

bank upsets unless the airplane was in a stall condition; if the airplane was stalled, Boeing

293 Boeing stated that it has published block maneuvering speeds for the 737 since the -100 model began

service. The recommended maneuvering speeds for each flap configuration provided, for all airplane

weights, adequate airspeed for maneuvering in at least a 40° bank without activation of the stickshaker.

“Block” referred to the simplification of the airspeed schedule with regard to airplane’s weight. A single

airspeed was specified for all airplane weights less than 117,000 pounds; thus, airplanes operating at weights

less than 117,000 pounds (including the USAir 427 accident airplane) had a greater maneuvering margin.

Alternative minimum maneuvering speed schedules were used by some air carriers at their option. These

specified a minimum airspeed for each flap configuration and weight (in 10,000-pound increments). For

airplanes operating at weights less than 117,000 pounds, these airspeeds were slower than the block

maneuvering speeds. According to Boeing, even though block maneuvering speeds were recommended, it

calculated and provided alternative minimum maneuvering speed schedules at air carriers’ request. 
Factual Information 206 Aircraft Accident Report

recommended recovering from the stall before recovering from the upset. The article

described the nose-down upset recovery technique as follows: 

• Reduce angle of attack. This unloads the wing, allows the airplane to

accelerate, which reduces rudder deflection and improves lateral control

ability. 

• Roll wings level using all available flight controls. This significantly reduces

the chance of accelerated stall.

• Apply up elevator to recover toward the desired pitch attitude and airspeed.

Always respect the stick shaker, even in a nose low situation. We do not

suggest using asymmetric thrust to recover from a large bank angle upset. 

The article specifically stated that if roll was uncontrollable, the pilot should

immediately reduce the airplane’s pitch attitude/angle-of-attack and increase airspeed;

pilots were cautioned not to attempt to maintain altitude until control was recovered. In

addition, Boeing’s article urged pilots to “use and hold” full lateral control input to counter

the roll (with coordinated rudder for bank angles of 45° or greater). The article further

stated that “under all situations, respect the stick shaker” [underscore original to text].

1.18.10.2.3.1 Implementation of AD 96-26-07 and Boeing 737 Operations 

Manual Revision by U.S. 737 Air Carrier Operators

During July 1998, the Safety Board assessed the implementation of AD 96-26-07

by U.S. 737 air carrier operators. Of the 13 air carriers contacted by the Safety Board, 12

provided the requested information. These 12 air carriers operated a total of 1,070

Boeing 737s.

The assessment results indicated that six of the responding air carriers (accounting

for 88 percent of the airplanes) were providing 737 flight crews with a flight simulator

demonstration of crossover airspeed (the overpowering of roll flight controls by rudder

input.) Four of these six air carriers (accounting for 72 percent of the airplanes) were

providing flight crews a specific demonstration of the crossover airspeed in the flaps 1

configuration. However, six air carriers (accounting for 12 percent of the airplanes) had no

documented simulator training on crossover airspeed.

According to the assessment information, 8 of the 12 responding air carriers

provided simulator training to flight crews on the jammed rudder procedure, but the

remaining 4 (accounting for 20 percent of the airplanes) provided no simulator training on

this procedure. Of the eight air carriers that trained crews on the jammed rudder

procedure, five (accounting for 40 percent of the airplanes) required instructors to

continue the procedure at least to the step of selecting the hydraulic system B flight

control switch to the standby rudder position. The remaining three air carriers that trained

crews on the jammed rudder procedure (accounting for 40 percent of the airplanes) did not

specify the extent to which the procedure was to be performed or terminated the procedure

to respond to a jammed rudder malfunction with disengagement of the yaw damper.
Factual Information 207 Aircraft Accident Report

The assessment results also indicated that 10 of the 12 air carriers had

implemented a minimum maneuvering airspeed for the flaps 1 configuration (110,000-

pound airplane gross weight) of at least 190 knots. Four of these 10 air carriers

(accounting for 66 percent of the airplanes) had increased Boeing’s recommended block

maneuvering speeds by 10 knots and were requiring pilots to use at least 200 knots as the

minimum airspeed for flaps 1. The remaining two air carriers were using slower minimum

maneuvering speeds specified for each 10,000-pound increment of airplane weight. For

flaps 1 and a 110,000-pound airplane gross weight, these two carriers (accounting for a

combined total of 16 of the airplanes) were using minimum block maneuvering speeds of

158 and 164 knots.

Further, the assessment indicated that all responding air carriers had modified the

checklist for “Uncommanded Yaw and Roll” in accordance with AD 96-26-07 and the

February 17, 1997, Boeing Operations Manual Bulletin. These modifications included the

bulletin’s requirement for pilots to recall from memory the procedure to disengage the

yaw damper in the event of an uncommanded yaw or roll.

1.18.10.2.4 Safety Board Recommendations Relating to Unusual Attitude 

Training

During its investigation of the USAir flight 427 accident, the Safety Board issued

Safety Recommendations A-96-118, A-96-120, and A-97-18 regarding unusual attitude

procedures and training. In its February 2, 1999, letter to the FAA, the Safety Board

indicated that Safety Recommendations A-96-118 and A-97-18 were classified “Open—

Unacceptable Response” and that Safety Recommendation A-96-120 was classified

“Open—Acceptable Response.” The letter also stated that the Board would further discuss

and analyze these recommendations in the USAir flight 427 accident report. The histories

of Safety Recommendations A-96-118, A-96-120, and A-97-18 are discussed in sections

1.18.11.5 and 1.18.11.6 and analyzed in section 2.7.

1.18.11 History of Safety Recommendations Resulting From the 

United Flight 585 and USAir Flight 427 Accidents and the 

Eastwind Flight 517 Incident

The Safety Board made 27 safety recommendations as a result of its investigation

of the United flight 585 and USAir flight 427 accidents, the Eastwind flight 517 incident,

and other occurrences involving 737 series airplanes. A listing of these safety

recommendations appears in sections 1.18.11.1 through 1.18.11.6.

1.18.11.1 Galling of Standby Rudder Actuator Bearings—United Flight 585 

Accident (Safety Recommendation A-91-77)

During its investigation of the accident involving United flight 585, the Safety

Board became concerned about galled standby rudder actuator bearings on 737s and 727s.

As a result, the Safety Board issued Safety Recommendation A-91-77 on August 20,

1991.
Factual Information 208 Aircraft Accident Report

Safety Recommendation A-91-77 asked the FAA to 

Issue an airworthiness directive requiring a check on all Boeing 737 and 727

model airplanes with the part number (P/N) 1087-23 input shaft in the

rudder auxiliary actuator unit for the force needed to rotate the input shaft

lever relative to the P/N 1087-22 bearing of the auxiliary actuator unit.

During this check, the bearing should be inspected to determine if it rotates

relative to the housing. All shaft assemblies in which rotation of the bearing

occurs, or in which excessive force is needed to move the input lever, should

be removed from service on an expedited basis, and the assemblies should

be replaced with a P/N 1087-21 shaft assembly that has a reduced diameter

on the unlubricated portion of the shaft in accordance with revision G of the

P/N 1087-23 engineering drawing. All assemblies meeting the force

requirement should be rechecked at appropriate intervals until replaced with

a P/N 1087-21 shaft assembly containing a P/N 1087-23 shaft that has a

reduced diameter on the unlubricated portion of the shaft. 

On January 3, 1992, the FAA issued an NPRM (Docket No. 91-NM-257-AD) in

response to this recommendation. The NPRM proposed to adopt an AD that would require

inspecting the input shaft in the auxiliary (standby) rudder PCU on all 727 series and

certain 737 series airplanes and reporting to the FAA on those units that failed the

inspection test procedure.

In a March 27, 1992, letter, the Safety Board expressed concern that an inspection

of the standby rudder actuator bearings was not included in the NPRM. Because loose

bearings can indicate a galling problem, the Safety Board believed that inspection of the

bearings for rotation in the housing and for the integrity of the safety wire was essential.

The Safety Board was also concerned that the proposed time for compliance for these

inspections (4,000 flight hours) might be excessive. As the FAA indicated in the NPRM,

the tests and inspections would only take about 6 hours. Because of the possibility that the

components affected could cause an uncommanded rudder input, the Safety Board

believed that these inspections should be performed as soon as possible or, at the very

least, at the next available inspection of the airplane.

After the NPRM was issued, the FAA determined that the condition addressed in

the NPRM was not unsafe and did not warrant the issuance of an AD. Consequently, on

April 19, 1993, the FAA issued a notice in the Federal Register to withdraw the NPRM. In

an August 5, 1993, letter to the Safety Board, the FAA indicated that it withdrew the

NPRM based on its reevaluation of the design of the rudder control system on the 727 and

737 series airplanes. The reevaluation determined that a flight crew would be capable of

detecting a galling condition by (1) increased force necessary to move the rudder pedal,

(2) erratic nose gear steering with the yaw damper engaged, (3) rudder yaw damper kick

back or yaw damper back drives on the rudder pedals during flight, and (4) erratic

operation of the rudder yaw damper or erratic rudder oscillations with the yaw damper

engaged. The FAA concluded that none of these indications of galling represented a safety

hazard. 

On November 15, 1993, the Safety Board acknowledged the results of the FAA’s

reevaluation of the design of the rudder control system on 727 and 737 airplanes. The
Factual Information 209 Aircraft Accident Report

Safety Board did express concern, however, that the galling could result in erratic flight

control, distract a flight crew, and be potentially hazardous in certain circumstances.

Because the Board stated that it had no further evidence that galling could result

uncommanded rudder deflections of a significant magnitude, Safety Recommendation

A-91-77 was classified “Closed—Acceptable Alternate Action.”

1.18.11.2 Weather-Related Recommendations—United Flight 585 Accident 

(Safety Recommendations A-92-57 and -58)

As a result of information developed during the accident investigation of United

Airlines flight 585, the Safety Board issued Safety Recommendations A-92-57 and -58 on

July 20, 1992.

Safety Recommendation A-92-57 asked the FAA to 

Develop and implement a meteorological program to observe, document,

and analyze potential meteorological aircraft hazards in the area of

Colorado Springs, Colorado, with a focus on the approach and departure

paths of the Colorado Springs Municipal Airport. This program should be

made operational by the winter of 1992.

Safety Recommendation A-92-58 asked the FAA to

Develop a broader meteorological aircraft hazard program, to include other

airports in or near mountainous terrain, based on the results obtained in the

Colorado Springs, Colorado, area.

On October 8, 1992, the FAA stated that its Research and Development Service

was planning to start a program in fiscal year 1995 to address potential aircraft hazards

resulting from mountain-induced meteorological phenomena. On March 26, 1993, the

FAA indicated that the Research and Development Service was planning to accelerate

program implementation to fiscal year 1994. On June 10, 1993, the Safety Board indicated

that it was pleased with the FAA’s accelerated program because the Board was

investigating four accidents in which mountain-induced meteorological phenomena might

have been a cause or factor. On September 14, 1993, the FAA indicated that it had tasked

NOAA’s Forecast Systems Laboratory to (1) formulate a plan to provide a definitive study

of mountain-induced wind phenomena and their effect on aircraft in flight and (2) develop

initiatives to define and implement a program to alert pilots of these hazards.

On December 14, 1995, the FAA indicated that, in September 1995, the FAA/

NOAA program was redefined in scope because of reduced budget allocations and

expected future funding constraints. As a result, the FAA planned to complete (1) a pilot

training manual on the impact of mountain-induced aeronautical hazards on aircraft

operations; (2) a Colorado Springs data collection and baseline experiment for a terminal

area detection system for mountain-induced turbulence hazards; and (3) a final report with

recommendations from this experiment on the viability of developing a prototype

prediction, detection, and display system for these hazards in the terminal area. The FAA

reported that it had drafted the training manual.
Factual Information 210 Aircraft Accident Report

On March 20, 1996, the Safety Board indicated that the FAA’s draft pilot training

manual was very comprehensive and detailed. However, the Safety Board expressed

concern that funding constraints had reduced the scope, duration, and rigor of the

originally proposed data collection experiment. The Board urged the FAA to increase

funding for the program.

On April 3, 1998, the FAA stated that it had completed several actions to improve

the safety of flying in mountainous areas “by providing pilots, dispatchers, and others in

aviation operations with a series of products that will detect, display, and forecast

hazardous mountain winds.” The letter stated that the FAA had accomplished the

following:

• The FAA, NOAA, and NCAR published AC 00-57, "Hazardous Mountain

Winds and Their Visual Indicators," to provide information on hazardous

mountain winds and their effects on flight operations near mountainous

regions. The primary purpose of the AC is to assist pilots involved in aviation

operations in diagnosing the potential for severe wind events in the vicinity of

mountainous areas and provide information on preflight planning techniques

and in-flight evaluation strategies for avoiding destructive turbulence and loss

of aircraft control.

• NOAA and NCAR personnel collected data on the intensity and direction of

wind flows at the Colorado Springs Airport during January through March

1997, when mountain-induced activity was known to be prevalent. A data set

was developed through the use of one Doppler Light Distancing and Ranging

(LIDAR) unit, three wind profilers with radio acoustic sounding system,

anemometers, an instrumented King Air airplane that traversed the landing and

takeoff flightpaths, six surface meteorological stations, an infrasonic

laboratory, and pilot reports. NOAA and NCAR were expected to complete a

report by September 1998 on a limited analysis of the Colorado Springs data.

The analysis was to assess the turbulence-detection capabilities of the LIDAR

and ground anemometers and determine the strengths of LIDAR-detected wind

turbulence as a function of other factors that were recorded during the

experiment.

On January 20, 1999, the Safety Board stated that the data collected during the

Colorado Springs meteorological program in early 1997 represented an important and

somewhat unique data set that defined mountain-induced wind flows and the associated

hazards. The Board urged the FAA to make every effort to ensure the complete and

detailed analysis of these data and the timely publication of the results. Pending the

issuance of a final report by NOAA and NCAR, Safety Recommendation A-92-57 was

classified “Open—Acceptable Response.” However, the Safety Board still believed that

the FAA should develop a broader meteorological aircraft hazard program to include

airports (other than Colorado Springs) in or near mountainous areas. Pending receipt of

information on such a program, Safety Recommendation A-92-58 was classified “Open—

Unacceptable Response.”
Factual Information 211 Aircraft Accident Report

1.18.11.3 Recommendations Resulting From the July 1992 United Airlines 

Ground Check PCU Anomaly (Safety Recommendations A-92-118 

Through -121)

On July 16, 1992, during a preflight check of the flight controls in a United

Airlines 737-300 that was taxiing to takeoff from ORD, the captain discovered that the

airplane's rudder pedal stopped at around 25 percent left pedal travel. The airplane

returned to the gate, and the main rudder PCU (S/N 2228A) was removed. Subsequent

testing indicated that, when the input crank was fixed against the body stops (to simulate a

jam of the primary slide to the secondary slide) and the yaw damper piston was in the

extend position, the PCU servo valve exhibited anomalous actions, ranging from sluggish

movement of the actuator piston to a full reversal in the direction of piston travel opposite

to the direction being commanded.

As a result of this and other incidents involving anomalies in the 737 rudder

system, the Safety Board issued Safety Recommendations A-92-118 through -121 on

November 10, 1992.

Safety Recommendation A-92-118 asked the FAA to

Require that Boeing develop a repetitive maintenance test procedure to be

used by 737 operators to verify the proper operation of the main rudder

power control unit servo valve until a design change is implemented that

would preclude the possibility of anomalies attributed to overtravel of the

secondary slide.

On January 19, 1993, the FAA stated that Boeing would issue service information

to inspect and retrofit all 737 series airplanes. The FAA also stated that it would issue an

NPRM to mandate compliance with this information. On January 3, 1994, the FAA issued

AD 94-01-07, which became effective on March 3, 1994. The AD required, within 750

flight hours after its effective date, (1) repetitive tests of the main rudder PCU of certain

737 series airplanes, in accordance with Boeing SL 737-SL-27-82-B, to detect excessive

internal leakage of hydraulic fluid, stalling, or reversal and (2) the eventual replacement of

the main rudder PCU with an improved model incorporating a redesigned servo valve. 

In an August 11, 1994, letter to the FAA, the Safety Board stated that, in the

interest of safety, all 737 main rudder PCUs should be modified at the earliest possible

date and that the compliance period in AD 94-01-07 appeared to be founded on reasonable

estimates of equipment availability. Because the AD met the intent of the Safety

Recommendation A-92-118, it was classified “Closed—Acceptable Action.”

Safety Recommendation A-92-119 asked the FAA to 

Require that Boeing develop an approved preflight check of the rudder

system to be used by operators to verify, to the extent possible, the proper

operation of the main rudder power control unit servo valve until a design

change is implemented that would preclude the possibility of rudder

reversals attributed to the overtravel of the secondary slide.
Factual Information 212 Aircraft Accident Report

On January 19, 1993, the FAA responded that it did not agree with this safety

recommendation because it believed that the current preflight check procedures

adequately ensured proper rudder operation. On June 10, 1993, the Safety Board indicated

that rapid rudder pedal inputs were required to induce the lockup that occurred during the

July 16, 1992, preflight check conducted by the captain of the United Airlines 737-300

and that a routine preflight check would not have uncovered the problem. In all test cases

that resulted in the locked-up condition or reversal, the input control was moved at a rate

faster than the rudder actuator could respond, thus forcing the secondary valve into the

overtravel position. The Safety Board further stated that rapid movement of the rudder

pedals on the ground could result in damage to the airplane. 

In a July 14, 1994, letter, the FAA reiterated its position that current preflight

check procedures adequately ensure proper rudder operation. The FAA agreed that rapid

rudder inputs were a factor in uncovering rudder control anomalies and that a rapid rudder

input during every preflight check increased the possibility of structural rudder damage.

The FAA also stated that it would be impossible to conduct this check with any degree of

consistency because of variances among pilots. Finally, the FAA stated that not all rudder

control anomalies resulting from secondary slide overtravel can be detected during

preflight checks.

Instead of incorporating rapid rudder movements in the preflight check, the FAA

included specific requirements in AD 94-01-07 for a periodic (750 flight hours) inspection

of the rudder system until the servo valve was redesigned. The AD required that the rudder

pedals be cycled at the maximum rate and that special instrumentation and additional

observers be available to properly detect any anomaly. According to the FAA, the

requirements of the AD were intended to ensure the detection of high internal leakage

within the main rudder PCU servo valve, which is a symptom of secondary slide

overtravel. The inspection was expected to identify servo valves that performed

marginally by measuring the internal leakage rate. The FAA stated that a servo valve with

marginal performance would not be detected during a preflight check but would have a

reduced hinge moment capability because of excessive internal leakage. This internal

leakage rate cannot be measured during a preflight check.

On August 11, 1994, the Safety Board notified the FAA that the requirement for

repetitive inspections of the main rudder PCU at 750-hour intervals was sufficient.

Because the FAA’s action addressed the intent of Safety Recommendation A-92-119, it

was classified “Closed—Acceptable Alternate Action.”

Safety Recommendation A-92-120 asked the FAA to

Require operators, by airworthiness directive, to incorporate design

changes for the 737 main rudder power control unit servo valve when these

changes are made available by Boeing. These changes should preclude the

possibility of rudder reversals attributed to the overtravel of the secondary

slide.
Factual Information 213 Aircraft Accident Report

On January 3, 1994, the FAA issued AD 94-01-07 (see A-92-118). On August 11,

1994, the Safety Board stated that, because the AD satisfied the intent of Safety

Recommendation A-92-120, it was classified “Closed—Acceptable Action.”

Safety Recommendation A-92-121 asked the FAA to

Conduct a design review of servo valves manufactured by Parker Hannifin

having a design similar to the 737 rudder power control unit servo valve

that control essential flight control hydraulic power control units on

transport-category airplanes certified by the Federal Aviation

Administration to determine that the design is not susceptible to inducing

flight control malfunctions or reversals due to overtravel of the servo

slides.

On January 19, 1993, the FAA stated that a design review of the servo valves

manufactured by Parker Hannifin on all transport-category airplanes was completed. The

problem was found to exist in the main rudder PCU only on 737 airplanes. On June 10,

1993, the Safety Board responded that, because this information met the intent of Safety

Recommendation A-92-121, it was classified “Closed—Acceptable Action.”

1.18.11.4 Flight Data Recorder Recommendations (Safety 

Recommendations A-95-25 Through -27)

The FDRs on the airplanes involved in the United flight 585 and USAir flight 427

accidents recorded very limited amounts of data. The FDR installed on the United airplane

recorded data for five parameters. (For more information, see section 1.16.1.1.) The FDR

installed on the USAir airplane recorded data for 13 parameters.294 (For more information,

see section 1.11.2.) However, neither FDR recorded other parameters that would have

been useful in these accident investigations, including control wheel position, rudder

pedal position, flight control surface (rudder, aileron, and spoiler) positions, or lateral

acceleration. As a result of its concerns about limited-parameter FDRs, the Safety Board

issued Safety Recommendations A-95-25 through -27 on February 22, 1995. 

Safety Recommendation A-95-25, which was designated as urgent, asked the FAA to

Require that each Boeing 737 airplane operated under 14 CFR Parts 121 or

125 be equipped, by December 31, 1995, with a flight data recorder system

that records, at a minimum, the parameters required by current regulations

applicable to that airplane plus the following parameters (recorded at the

sampling rates specified in "Proposed Minimum FDR Parameter

Requirements for Airplanes in Service”): lateral acceleration; flight control

inputs for pitch, roll, and yaw; and primary flight control surface positions

for pitch, roll, and yaw.

294 The existing regulations at the time of the USAir flight 427 accident (14 CFR Section 121.343)

required that airplanes operated under Part 121 have FDRs that record 11 parameters. Title 14 Sections

125.225 and 135.152 contained a similar requirement for airplanes operated under Parts 125 and 135,

respectively.
Factual Information 214 Aircraft Accident Report

Safety Recommendation A-95-26 asked the FAA to

Amend, by December 31 1995, 14 CFR Sections 121.343, 125.225, and

135.152 to require that Boeing 727 airplanes, Lockheed L-1011 airplanes,

and all transport-category airplanes operated under 14 CFR Parts 121, 125,

or 135, whose type certificate applies to airplanes still in production, be

equipped to record on a flight data recorder system, at a minimum, the

parameters listed in "Proposed Minimum FDR Parameter Requirements for

Airplanes in Service" plus any other parameters required by current

regulations applicable to each individual airplane. Specify that the

airplanes be so equipped by January 1, 1998, or by the later date when they

meet Stage 3 noise requirements but, regardless of Stage 3 compliance

status, no later than December 31, 1999.”

Safety Recommendation A-95-27 asked the FAA to

Amend, by December 31, 1995, 14 CFR Sections 121.343, 125.225, and

135.152 to require that all airplanes operated under 14 CFR Parts 121, 125,

or 135 (10 seats or larger), for which an original airworthiness certificate is

received after December 31, 1996, record the parameters listed in

“Proposed FDR Enhancements for Newly Manufactured Airplanes” on a

flight data recorder having at least a 25-hour recording capacity. 

In issuing these safety recommendations, the Safety Board stated that information

from FDRs with additional parameters substantially aided its investigations of two

regional airline accidents. The first accident, on February 1, 1994, involved a dual-engine

power loss in a Saab 340B at New Roads, Louisiana.295 The FDR installed on this airplane

recorded 128 parameters. Because of the expanded FDR data, the Safety Board was able

to rule out early in the investigation an airplane system anomaly as the initiating event and

focus on operational and human performance issues. The second accident, on October 31,

1994, involved an uncommanded roll excursion of an Avions de Transport Regional

Model 72-212 (ATR-72) near Roselawn, Indiana.296 The airplane’s FDR was configured to

record approximately 115 parameters. The volume of data recorded by this enhanced FDR

enabled the Board to narrow the focus of its investigation early on to possible explanations

for aileron control surface movements. As a result, the Safety Board issued, within days of

the accident, urgent safety recommendations to minimize the likelihood of similar

occurrences.

In a February 24, 1995, letter, the FAA stated that it would open a public docket

and seek comments on these recommendations and that it planned to hold a public

meeting to review the recommendations. On March 8, 1995, the Safety Board responded

that these actions could create an unacceptable delay and urged the FAA to establish an

accelerated schedule for adopting Safety Recommendation A-95-25.

295 For more information, see National Transportation Safety Board. 1994. Overspeed and Loss of

Power on Both Engines During Descent and Power-off Emergency Landing, Simmons Airlines, Inc., d.b.a.

American Eagle Flight 3641, N349SB, False River Air Park, New Roads, Louisiana, February 1, 1994.

Aircraft Accident Report NTSB/AAR-94/06. Washington, DC.

296 For more information, see the discussion of Safety Recommendation A-96-120 in section 1.18.11.5.
Factual Information 215 Aircraft Accident Report

On May 16, 1995, the FAA indicated that it agreed with the intent of the

recommendations but that it could not meet the December 31, 1995, retrofit completion

date in Safety Recommendation A-95-25. The FAA characterized the Safety Board’s

timetable as “an extremely aggressive schedule which, if it were physically possible,

would result in substantial airplane groundings and very high associated costs.” On

July 17, 1995, the Safety Board indicated its disappointment that the recommended

compliance date could not be met. The Board believed that the date of compliance for the

recommendation must reflect the urgency associated with retrofitting 737s to record

additional FDR parameters. 

In an April 29, 1996, letter to the FAA, the Safety Board pointed out that more than

1 year had elapsed since it issued urgent Safety Recommendation A-95-25 and that it had

been almost 1 year since the FAA formally responded to this issue. Also, the Board said

that FDR recordings from several other 737s that reported in-flight disturbances similar to

those associated with the United flight 585 and USAir flight 427 accidents did not provide

sufficient data to isolate rudder and pedal movement primarily because the flight control

inputs or control surface positions were not recorded. The Board believed that, if the FAA

and industry had begun to implement Safety Recommendation A-95-25 after it was

issued, most 737s would have been retrofitted with an acceptable, short-term improved

recording capability. The Safety Board concluded that the lack of FAA action was

unacceptable.

In addition, the Safety Board stated that, according to the FAA, the major

impediment to the retrofit of 737s was cost. However, Board staff visited a maintenance

facility to observe the installation of FDR sensors and associated wiring and found that

industry cost estimates apparently did not seek innovative measures that might reduce

cost. For example, in the installation observed, industry assumed that aft lavatories had to

be removed to allow wires to be routed from the airplane’s tail to the FDR. Consultations

with installation experts demonstrated that wiring could be routed through existing access

ports on a lower portion of the aft pressure bulkhead, which could eliminate the need to

remove the aft lavatory and save 150 hours of labor. On the basis of these consultations,

Safety Board staff believed that adding rudder pedal and rudder position sensors to

existing 737s could be accomplished without interrupting normal revenue service. The

Board suggested that the work be performed on approximately four to five overnight visits

or during a C maintenance check without extending the visit.

In a July 1, 1996, letter to the FAA, the Safety Board addressed the Eastwind flight

517 incident that had occurred the previous month. The Board believed that, under slightly

different circumstances, the Eastwind incident could have become the third fatal 737 upset

accident for which there was inadequate FDR information to determine the cause. The

Board also believed that, if the FAA had complied with the intent of Safety

Recommendation A-95-25, the Eastwind airplane would have been fitted with an FDR

that recorded the parameters necessary to better understand the events leading to the upset

and develop corrective actions to prevent a future catastrophic 737 accident. In addition,

the Board expressed its continued strong concern about the failure of the FAA to require

the needed retrofit of the 737. The Board noted that more than 15 months had passed with
Factual Information 216 Aircraft Accident Report

no action taken on this important safety issue. As a result, Safety Recommendation

A-95-25 had been placed on the Safety Board’s Most Wanted Safety Improvements

List.297 The Board once again urged the FAA to take the necessary actions to meet the

intent of this safety recommendation.

On July 9, 1996, the FAA issued an NPRM, “Revisions to Digital Flight Data

Recorder Rules.” The proposed rule would require a 4-year retrofit of FDR systems, with

parameter upgrade requirements based on when the aircraft was manufactured and

whether the aircraft was equipped with a flight data acquisition unit (FDAU).298 The

proposed rule would also mandate increases in the number of required FDR parameters

for newly manufactured aircraft, with the first parameter increase occurring 3 years from

the date of the final rule and the second increase 5 years after the date of the final rule.

 On August 15, 1996, the Safety Board commented on the NPRM. The Board

recognized that the FAA’s proposed revisions attempted to increase the minimum number

of FDR parameters and impose the minimum financial, operational, manufacturing, and

purchase contract burdens on industry. However, the Board strongly disagreed with the

FAA’s proposed compliance dates for newly manufactured and existing aircraft and with

the minimum parameter requirements for existing aircraft. The Board also strongly

disagreed with the FAA's decision not to require more expeditious flight control parameter

upgrades for 737 airplanes. The Board strongly requested that the FAA act on the Board's

comments to the NPRM and expedite issuance of a final rule.

On October 7, 1996, the FAA reiterated the position presented in its May 16, 1995,

letter. On December 12, 1996, the Safety Board stated that, although it had been verbally

informed that the FAA hoped to issue a final rule by the end of December 1996, the

October 7 letter made no mention of an issue date for the final rule. The Board also stated

that, even if a final rule were issued by the end of 1996, all aircraft would not be required

to be upgraded until December 2000, almost 6 years after Safety Recommendations

A-95-25 through -27 were issued. Because of the FAA’s failure to take action to ensure

timely upgrades of the 737 FDR parameters, Safety Recommendation A-95-25 was

classified “Closed—Unacceptable Action.” 

On July 9, 1997, the FAA issued its final rule in response to the safety

recommendations, which required in part that all existing transport-category airplanes

operated under 14 CFR Parts 121, 125, and 135 be equipped with FDRs that record at least

18 parameters, instead of the previously required 11 parameters. Also in its final rule, the

FAA indicated that the retrofit modification to existing airplane’s FDRs should be

accomplished at the earliest practicable time but no later than the airplane’s first heavy

maintenance check after August 18, 1999. In a July 22, 1997, letter, the FAA stated that

297 The Safety Board’s Most Wanted Safety Improvements List contains the agency’s 10 most urgent

safety recommendation issues in the areas of aviation, highway, pipeline and hazardous materials, railroad,

and marine safety. 

298 A FDAU is external to the FDR and collects and digitizes data to be recorded by the FDR. The FDR

on an airplane equipped with a FDAU can record additional parameters as modified.
Factual Information 217 Aircraft Accident Report

the final rule requires all affected existing airplanes to “be equipped to record the

parameters recommended by the Board” by August 19, 2001.299

Further, the FAA stated that the July 9, 1997, final rule also requires all airplanes

operated under 14 CFR Parts 121, 125, or 135 (10 seats or more) for which an original

airworthiness certification is received after December 31, 1996, to record the parameters

listed in “Proposed Flight Data Recorder Enhancements for Newly Manufactured

Airplanes” on an FDR having at least a 25-hour recording capacity. The new FDR rules

call for parameters 1 through 57 to be recorded for airplanes manufactured after

August 18, 2000, and parameters 1 through 88 to be recorded for airplanes manufactured

after August 19, 2002. The FAA considered its action on the safety recommendations to

be completed.

On August 4, 1998, the Safety Board indicated that it was generally pleased that

the FAA issued revised FDR rules because the changes in the FDR parameter

requirements offered a major improvement over the former requirements. For example,

the Safety Board agreed with the FAA’s decision to include flight control surface positions

and flight control inputs as portions of the minimum number of parameters to be recorded

by existing airplanes. However, the Board believed the final rulemaking fell short of the

intent of Safety Recommendations A-95-26 and -27 in two critical areas:

299 The Safety Board is aware that some air carriers have not retrofitted their airplanes with the required

FDR upgrades during scheduled heavy maintenance checks. For example, the Board’s investigation of the

February 23, 1999, Metrojet upset event revealed that, although the incident airplane was scheduled for a

heavy maintenance check in March 1999, it was not scheduled to receive the required FDR upgrade until its

next heavy maintenance check in March 2001. In contrast, the Safety Board is aware of one air carrier

(Southwest Airlines) that is retrofitting the FDRs in its fleet. Southwest’s fleet consisted of 248 Boeing 737s,

100 of which are already equipped with FDAUs and enhanced FDRs and thus do not require the upgrade.

Southwest began to retrofit its remaining 148 Boeing 737s in July 1996 (about the same time that the FAA

issued the NPRM regarding FDR upgrades and 1 year before the resultant final rule was issued). Although

not required by the FAA’s final rule, Southwest also elected to install FDAUs on the 148 airplanes that were

not so equipped (at a cost of $70,000 per airplane) to permit future expansion of FDR parameters. Southwest

expected to have completed the retrofit all of its affected airplanes by December 1999. 
Factual Information 218 Aircraft Accident Report

• Although the new FDR rules would eventually mandate all of the Safety

Board's recommended parameters for new airplanes, the parameter

requirements for existing airplanes were less than those referenced in Safety

Recommendation A-95-26.300 Therefore, the Board disagreed with the FAA's

assertion that the rule required airplanes to "be equipped to record the

parameters recommended by the Board.”

The recommended minimum parameter requirements for existing airplanes

were based on the Safety Board's investigative experience. The Board believed

that all U.S.-registered airplanes should record these parameters. According to

the Board, the FAA's reasoning for not including all the recommended

parameters—that FDR requirements should be determined by the capabilities

of the FDR system fitted to a specific airplane rather than by investigative

requirements—placed far too much emphasis on cost. The Safety Board

recognized that substantial costs would be associated with retrofitting all of the

proposed minimum parameter requirements on existing airplanes not equipped

with a FDAU or a digital data bus. However, all of the 88 parameters

referenced in Safety Recommendation A-95-26 are potentially critical to future

investigations. The Board maintained that the FAA’s final rule should have

included all the recommended parameters for existing airplanes. 

• The compliance dates stated in the final rule for newly manufactured airplanes

extended far beyond the recommended compliance dates, and the Board

believed that the FAA's reasoning for the extended compliance dates was

flawed. Although the final rule included all 88 recommended parameters for

newly manufactured airplanes, the Board was disappointed that the recording

of the 88 parameters would not be accomplished immediately. The new

regulations will mandate an incremental increase in FDR capability, from 29 to

57 and then to 88 parameters. The Board did not believe that this incremental

expansion was necessary and that there was not sufficient justification for

airplanes manufactured between August 18, 2000, and August 19, 2002, to

record only 57 parameters.

According to the Safety Board, the FAA cited the needed development of

control force sensors and availability of 256-word-per-second FDRs as

explanations for the incremental increase of parameters for newly

manufactured airplanes. On the basis of its conversations with airplane

manufacturers, the Board determined that the necessary technology was

already available and that a 5-year development time for all 88 parameters was

unnecessary. In fact, the Board was aware that some operators and

manufacturers had elected to record, or at least to make provisions to record,

all 88 parameters (including the control force parameters) on airplanes

300 For example, the Safety Board recommended that FDRs installed on affected existing airplanes be

upgraded to record pitch trim; thrust reverser position; angle-of-attack; outside and total air temperatures;

and flap, leading edge slat, and ground spoiler positions in addition to the 18 parameters required by the

FAA’s final rule. However, the FAA did not require these additional parameters. 
Factual Information 219 Aircraft Accident Report

manufactured after August 18, 2000, to provide commonality with airplanes

manufactured after August 19, 2002. In addition, FDR manufacturers were

already delivering FDRs that record at the higher data frame rate. Therefore,

the Safety Board urged the FAA to change the 88-parameter compliance date

for newly manufactured airplanes from August 19, 2002, to August 18, 2000.

In addition, the Safety Board was disappointed that the FAA, with the issuance of

its final rule, considered its action on these safety recommendations to be completed. The

Safety Board believed that the FAA did not make every effort to ensure that the maximum

number of parameters would be recorded within an achievable time period. Because all of

the recommended retrofit parameters and the recommended compliance dates were not

included in the FAA’s final rule, Safety Recommendations A-95-26 and -27 were

classified "Closed—Unacceptable Action."

1.18.11.5 October 1996 Recommendations Issued as a Result of 

United Flight 585, USAir Flight 427, and Eastwind Flight 517 (Safety 

Recommendations A-96-107 Through -120)

After the accident involving United Airlines flight 585, the Safety Board was

informed of numerous uncommanded roll and yaw events involving the 737 series. Most

of these incidents did not result in any damage to the airplane or injuries to those on board.

As a result of these occurrences, the accident involving USAir flight 427, and the incident

involving Eastwind flight 517, the Safety Board issued Safety Recommendations

A-96-107 through -120 on October 18, 1996.

Safety Recommendation A-96-107 asked the FAA to

Require the Boeing Commercial Airplane Group, working with other

interested parties, to develop immediate operational measures and longterm design changes for the 737 series airplane to preclude the potential for

loss of control from an inadvertent rudder hardover. Once the operational

measures and design changes have been developed, issue airworthiness

directives to implement these actions.

On January 16, 1997, the FAA stated that it intended to take final action on several

proposed ADs, some of which would require the retrofit of four newly developed or

redesigned components into the rudder system of existing 737 airplanes. The FAA further

stated that the safety issues addressed in this recommendation would be resolved during

the type certification of the new main rudder PCU servo valve and that it would propose a

2-year compliance timeframe for the retrofit of the servo valve.

On July 15, 1997, the Safety Board noted that the FAA’s proposed design changes

did not address (1) the development of operational measures and design changes to

preclude the loss of control from an inadvertent rudder hardover, (2) the need to establish

appropriate inspection intervals and a service life limit for the 737 main rudder PCU

(addressed in Safety Recommendation A-96-112), or (3) a method to detect a jammed

PCU servo valve slide (addressed in Safety Recommendation A-96-113). The Safety

Board believed that operational measures, periodic inspections, and the detection and
Factual Information 220 Aircraft Accident Report

annunciation of a jammed slide to the flight crew were needed to ensure flight safety.

Because the proposed design did not address reliability or latent failure issues, Safety

Recommendation A-96-107 was classified “Open—Unacceptable Response.”

On May 13, 1998, the FAA stated that, along with Boeing, it had taken several

measures to address the intent of this safety recommendation. These actions included the

development and certification of modifications to the 737 main rudder PCU servo valve to

prevent the potential for reverse rudder operation. The FAA cited its issuance of the

following three ADs:

• AD 96-26-07 was issued on December 23, 1996, and became effective on

January 17, 1997. The AD required revising the AFM for all 737 series

airplanes within 30 days to include procedures that would enable the flight

crew to take “appropriate action to maintain control of the airplane during an

uncommanded yaw or roll condition” and “correct a jammed or restricted

flight control condition.” The FAA stated that the AD had been prompted

because such procedures were not defined adequately in the existing 737 AFM.

The AD established a “recall” procedure to be performed by flight crews

immediately, from memory, in the event of an uncommanded yaw or roll and

required that the AFM section concerning procedures for jammed flight

controls be modified. The FAA specified that air carriers could comply with

the AD by inserting a copy of it in the AFM. No flight crew training

requirements were established by the FAA for the procedures that had been

introduced or changed by the AD.

• AD 97-14-03 was issued on June 23, 1997, and became effective on August 1,

1997. The AD mandated design changes to all 737 airplanes by August 1,

2000. The AD required the installation of (1) a hydraulic pressure reducer to

limit the amount of rudder available to the flight crew during certain portions

of flight and (2) a redesigned yaw damper system to improve reliability and

fault monitoring capability.

• AD 97-14-04, which superceded ADs-94-01-07 and 96-23-51, was also issued

on June 23, 1997, and became effective on August 4, 1997. The AD mandated

design changes to the main rudder PCU and servo valve on all 737 airplanes,

within 2 years, to “prevent uncommanded movements of the rudder, and

consequent reduced controllability of the airplane.” In addition, this AD

mandated a periodic inspection to test the main rudder PCU for internal

leakage and ensure that it is producing an acceptable hinge moment. According

to the FAA, the internal leakage test will detect certain servo valve slide jams

and provide greater safety margins than a hard-time replacement of the main

rudder PCU because the test will ensure that the PCU is functioning within

acceptable limits at more frequent intervals than a hard-time interval. The FAA

also said that any design change to monitor the servo valve slides would

increase the complexity of the servo valve and most likely increase the

probability of jamming of a slide.
Factual Information 221 Aircraft Accident Report

The FAA also stated in its May 13, 1998, letter that the Safety Board had

expressed concern that, although the redesigned servo valve eliminated all known rudder

reversal modes, unknown failures might still exist in the system. The FAA concluded that

no evidence, either from in-service experience or testing, indicated that a rudder reversal

event had actually occurred. The FAA noted that the main rudder PCU had been tested to

evaluate chip shear capacity, fluid contamination, thermal jam conditions, input linkage

jams, and linkage compliance. According to the FAA, all of these tests failed to create a

sustained servo valve jam or any other reasonable failure that could cause erroneous

rudder movement. 

In addition, the FAA’s letter included the Safety Board’s position that the detection

and indication of a slide jam were necessary because, if a single slide jam was not

recognized by the flight crew or mechanics, a second slide jam would cause an accident in

some airplane configurations and flight conditions. The Board considered this event to be

a catastrophic failure condition. However, the FAA stated that its regulations and policy

define a catastrophic failure condition as one that will always result in an accident.

According to the FAA, a dual slide jam in the rudder PCU will not always result in an

accident and thus should not be considered a catastrophic condition. The FAA also stated

that an airplane with a dual slide jam in the rudder PCU would be fully controllable in that

configuration throughout much of its flight envelope. Furthermore, the FAA believed that,

on the basis of 737 service history and number of hours of operation, a dual slide servo

valve jam would be extremely improbable. 

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-96-107 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-96-107 remained classified “Open—Unacceptable Response.” The Safety Board’s

evaluation of Safety Recommendation A-96-107 and the recommendation’s current

classification are discussed in section 2.6.

Safety Recommendation A-96-108 asked the FAA to 

Revise 14 CFR Section 25.671 to account for the failure or jamming of any

flight control surface at its design-limited deflection. Following this

revision, reevaluate all transport-category aircraft and ensure compliance

with the revised criteria.

On January 16, 1997, the FAA stated that its aircraft certification offices were

reviewing data from airplane manufacturers to determine which airplanes certified under

14 CFR Part 25 utilize PCU servo valves that could encounter valve jamming problems

resulting from unexpected improper positioning of the servo slides. The FAA stated that it

would take appropriate action based on the results of the review. On July 15, 1997, the

Safety Board responded that, because the FAA had not specified its planned actions,

Safety Recommendation A-96-108 was classified “Open—Await Response.”

On May 13, 1998, the FAA indicated that it decided not to revise 14 CFR Section

25.671. The FAA did not concur with the Safety Board's position that it is necessary to
Factual Information 222 Aircraft Accident Report

account for a jam in any flight control surface at its design-limited deflection. According

to the FAA, a control surface jam at its design-limited deflection during flight would

require an active system failure to cause the control surface to move to the extreme

position and remain there. The FAA indicated that the last sentence of 14 CFR Section

25.671(c)(3) required that such a jam be accounted for unless such a jam can be shown to

be extremely improbable. The FAA stated that an applicant can show compliance with the

regulation by demonstrating, based on a probability analysis, that the runaway and jam

condition is an extremely improbable event or that the condition can be alleviated.

Because a jam condition is more likely to occur in a control position normally

encountered, the FAA’s policy requires the applicant to demonstrate controllability for this

condition. 

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-96-108 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-96-108 remained classified “Open—Await Response.” The Safety Board’s evaluation

of Safety Recommendation A-96-108 and the recommendation’s current classification are

discussed in section 2.6.

Safety Recommendation A-96-109 asked the FAA to

Require the Boeing Commercial Airplane Group to develop and install on

all new-production 737 airplanes a cockpit indicator system that indicates

rudder surface position and movement. For existing 737 airplanes, when

implementing the installation of an enhanced-parameter flight data

recorder, require the installation of a cockpit indicator system that indicates

rudder surface position and movement.

On January 16, 1997, the FAA stated that an additional indicator in the cockpit

would add no practical information to the pilot because all rudder movements on the 737,

except those caused by the yaw damper, are directly apparent to the flight crew through

the movement of the rudder pedals. The FAA further stated that a rudder position indicator

will have very little value during the immediacy of a roll/yaw departure from controlled

flight because such an event would require prompt and aggressive pilot response

depending on the attitude, rate, and acceleration experienced. 

On July 15, 1997, the Safety Board responded that it agreed with the FAA’s

assertion that a rudder position indicator would be of little value in the initial moments of

an upset during which immediate pilot reaction may be needed to prevent a loss of control.

However, the Safety Board disagreed with the FAA’s position that a rudder position

indicator would provide no practical information to the pilot. The Safety Board's

investigation of numerous yaw/roll upset events found that pilots, when trying to

troubleshoot the problem, are often uncertain about the position of the rudder in the

moments after regaining control. The Safety Board noted that recent testing had indicated

the possibility for reverse rudder operation and that the installation of a rudder position

indicator would provide a means for the pilot to understand that a rudder reversal had

occurred. The Safety Board also noted that essentially all new-production 737s and other
Factual Information 223 Aircraft Accident Report

transport-category airplanes are equipped with rudder position indicators. As a result,

Safety Recommendation A-96-109 was classified “Open—Unacceptable Response.” 

On May 13, 1998, the FAA reiterated its position that it is not necessary to require

the installation of a rudder indicator system in 737 airplanes. The FAA repeated that any

rudder movement outside the small movement of the yaw damper system will back-drive

the rudder pedals and be noted by the pilots if their feet are on the pedals. Further, the FAA

believed that ADs 96-26-07, 97-14-03, and 97-14-04 preclude a rudder jam/reversal

scenario and support the conclusion that a rudder surface position indicator should not be

mandated. 

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-96-109 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-96-109 remained classified “Open—Unacceptable Response.” The Safety Board’s

evaluation of Safety Recommendation A-96-109 and the recommendation’s current

classification are discussed in section 2.6.

Safety Recommendation A-96-110 asked the FAA to

Conduct a detailed engineering review of the 737 yaw damper system, and

require the Boeing Commercial Airplane Group to redesign the yaw

damper system, as necessary, to eliminate the potential for sustained

uncommanded yaw damper control events. After the 737 yaw damper

system is redesigned, issue an airworthiness directive to require the

installation of the improved yaw damper system on all 737 series airplanes.

On June 23, 1997, the FAA issued AD 97-14-03. In its May 13, 1998, letter, the

FAA explained that Boeing was developing design changes to the rudder limiter and yaw

damper system to comply with the requirements of the AD. The FAA indicated that the

Manager of the Seattle Aircraft Certification Office was expected to approve the design

changes by July 31, 1998. On February 2, 1999, the Safety Board stated that, pending the

FAA’s certification of the proposed new yaw damper system, Safety Recommendation

96-110 was classified “Open—Acceptable Response.” 

Safety Recommendation A-96-111 asked the FAA to

Require the Boeing Commercial Airplane Group and the operating airlines

to eliminate the procedure for removal and replacement of the main rudder

power control unit rudder position transducer from their respective 737

maintenance manuals unless the manual provides for testing to verify that

the replacement transducer performs its intended function.

According to the FAA’s August 7, 1997, letter, Boeing issued a revision to its 737

MM on November 27, 1996, to eliminate the removal and installation sections for the

main rudder PCU rudder position transducer. This revision was applicable to 737-100

through -500 series airplanes. On November 4, 1997, the Safety Board stated that, because

this revision met the intent of Safety Recommendation A-96-111, it was classified

“Closed—Acceptable Action.” 
Factual Information 224 Aircraft Accident Report

Safety Recommendation A-96-112 asked the FAA to

Require the Boeing Commercial Airplane Group to establish appropriate

inspection intervals and a service life limit for the 737 main rudder power

control unit.

On January 16, 1997, the FAA stated that it intended to take final action on several

proposed ADs, some of which would require the retrofit of four newly developed or

redesigned components into the rudder system of existing 737 airplanes. The FAA stated

that the safety issues addressed in this recommendation would be resolved during the type

certification of the new main rudder PCU servo valve and that it would propose a 2-year

compliance timeframe for the retrofit of the servo valve.

On July 15, 1997, the Safety Board noted that the FAA’s proposed design changes

did not address (1) the development of operational measures and design changes to

preclude the loss of control from an inadvertent rudder hardover (addressed in Safety

Recommendation A-96-107), (2) the need to establish appropriate inspection intervals and

a service life limit for the 737 main rudder PCU, or (3) a method to detect a jammed PCU

servo valve slide (addressed in Safety Recommendation A-96-113). The Safety Board

believed that operational measures, periodic inspections, and the detection and

annunciation of a jammed slide to the flight crew were needed to ensure flight safety.

Because the proposed design did not address reliability or latent failure issues, Safety

Recommendation A-96-112 was classified “Open—Unacceptable Response.”

On May 13, 1998, the FAA stated that, along with Boeing, it had taken several

measures to address the intent of this safety recommendation. These actions included the

development and certification of modifications to the 737 main rudder PCU servo valve to

prevent the potential for reverse rudder operation. Also, the FAA issued ADs 96-26-07,

97-14-03, and 97-14-04. In addition, the FAA’s letter noted the Safety Board’s concerns

that unknown failures might still exist in the redesigned servo valve and that, if a single

slide jam was not recognized by the flight crew or mechanics, a second slide jam would

cause an accident in some airplane configurations and flight conditions. The FAA’s

response included its position on what constitutes a catastrophic failure condition and

whether a dual slide jam would be considered a catastrophic condition.

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-96-112 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-96-112 remained classified “Open—Unacceptable Response.” The Safety Board’s

evaluation of Safety Recommendation A-96-112 and the recommendation’s current

classification are discussed in section 2.6.

Safety Recommendation A-96-113 asked the FAA to

Require the Boeing Commercial Airplane Group to devise a method to

detect a primary or a secondary jammed slide in the 737 main rudder power

control unit servo valve and ensure appropriate communication of the

information to mechanics and pilots.
Factual Information 225 Aircraft Accident Report

On January 16, 1997, the FAA stated that it intended to take final action on several

proposed ADs, some of which would require the retrofit of four newly developed or

redesigned components into the rudder system of existing 737 airplanes. The FAA stated

that the safety issues addressed in this recommendation would be resolved during the type

certification of the new main rudder PCU servo valve and that it would propose a 2-year

compliance timeframe for the retrofit of the servo valve.

On July 15, 1997, the Safety Board noted that the FAA’s proposed design changes

did not address (1) the development of operational measures and design changes to

preclude the loss of control from an inadvertent rudder hardover (addressed in Safety

Recommendation A-96-107), (2) the need to establish appropriate inspection intervals and

a service life limit for the 737 main rudder PCU (addressed in Safety Recommendation

A-96-112), or (3) a method to detect a jammed PCU servo valve slide. The Safety Board

believed that operational measures, periodic inspections, and the detection and

annunciation of a jammed slide to the flight crew were needed to ensure flight safety.

Because the proposed design did not address reliability or latent failure issues, Safety

Recommendation A-96-113 was classified “Open—Unacceptable Response.”

On May 13, 1998, the FAA stated that, along with Boeing, it had taken several

measures to address the intent of this safety recommendation. These actions included the

development and certification of modifications to the 737 main rudder PCU servo valve to

prevent the potential for reverse rudder operation. Also, the FAA issued ADs 96-26-07,

97-14-03, and 97-14-04. In addition, the FAA’s letter noted the Safety Board’s concerns

that unknown failures might still exist in the redesigned servo valve and that, if a single

slide jam was not recognized by the flight crew or mechanics, a second slide jam would

cause an accident in some airplane configurations and flight conditions. The FAA’s

response included its position on what constitutes a catastrophic failure condition and

whether a dual slide jam would be considered a catastrophic condition. (For further

information on the FAA’s response, see A-96-107.)

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-96-113 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-96-113 remained classified “Open—Unacceptable Response.” The Safety Board’s

evaluation of Safety Recommendation A-96-113 and the recommendation’s current

classification are discussed in section 2.6.

Safety Recommendation A-96-114 asked the FAA to

Evaluate the adequacy of the chip shearing capacity for all sliding spool

control valves used in transport-category aircraft flight control systems,

and take appropriate action to correct any problems identified to preclude

the potential for actuator jamming, binding, or failure.

On June 29, 1998, the FAA stated that its aircraft certification offices have

evaluated the adequacy of the chip shearing capacity of sliding spool control valves for
Factual Information 226 Aircraft Accident Report

certain airplanes. The criteria used in this evaluation were recommended by the SAE A-6

Committee and incorporated information from an August 12, 1997, letter by Boeing. 

The FAA concluded that all sliding spool control valves used in the following

transport-category airplanes’ flight control systems met the evaluation criteria:

• Boeing 707 (except the rudder system), 727, 737, 747, 757, 767, and 777; 

• McDonnell Douglas DC-9, DC-10, MD-11, MD-80, and MD-90;

• Lockheed L-1011 and L-382

• Gulfstream V;

• Saab 340 and 2000;

• Dornier DO-328;

• Fokker F.28 (all models);

• Embraer EMB-120 and EMB-145; and

• Cessna, Learjet, Raytheon, and Sabreliner (applicable models).

The FAA planned no further action for these airplanes. However, the FAA was

waiting for data from European and Canadian manufacturers, additional data for the 707

rudder system, and data for the Douglas DC-8 airplanes. These data were expected to be

received by July 1998.

On February 2, 1999, the Safety Board indicated that it would like to review the

FAA’s evaluation criteria for determining the adequacy of the chip shearing capacity of

sliding spool control valves. Pending the Board’s review of the criteria and the FAA’s

completion of the evaluation project, Safety Recommendation A-96-114 was classified

“Open—Acceptable Response.”

Safety Recommendation A-96-115 asked the FAA to

Require the modification of the input rod bearing on the 737 series standby

rudder actuator, by August 1, 1997, to prevent galling and possible

discrepant operation of the rudder system.

The FAA issued AD 97-26-01, which became effective January 20, 1998, to

require repetitive inspections to detect galling on the input shaft and bearing of the

standby rudder PCU and replacement of the standby rudder actuator with a serviceable

actuator, if necessary. The AD also required the installation of a newly designed standby

PCU input shaft bearing within 3 years of the effective date of the AD. On February 2,

1999, the Safety Board stated that, because the FAA’s action complied with the intent of

Safety Recommendation A-96-115, it was classified “Closed—Acceptable Action.” 
Factual Information 227 Aircraft Accident Report

Safety Recommendation A-96-116 asked the FAA to

Define and implement standards for in-service hydraulic fluid cleanliness

requirements and sampling intervals for all transport-category aircraft.

On June 29, 1998, the FAA stated that it had reviewed a study by the SAE A-6

Committee Hydraulic Fluid Contamination Task Force. On the basis of the study’s

findings, the FAA identified NAS 1638 as an industry standard that defines fluid

cleanliness levels; defined NAS 1638 Class 9 as the in-service limit; and verified that

manufacturers already included or are in the process of including this limit in their

maintenance manuals, along with a sampling interval. The FAA added that it was

participating in the development of an Aerospace Recommended Practice document for

sampling and testing techniques. On February 2, 1999, the Safety Board stated that,

because the FAA’s actions met the intent of Safety Recommendation A-96-116, it was

classified “Closed—Acceptable Action.” 

Safety Recommendation A-96-117 asked the FAA to

Conduct a detailed design review of all dual-concentric servo valves that

control essential flight control system actuators on transport-category

airplanes certificated by the Federal Aviation Administration to determine

if the design is susceptible to inducing flight control malfunctions and/or

reversals as a result of unexpected improper positioning of the servo slides.

If the design is determined to be susceptible, mandate appropriate design

changes.

In a July 15, 1997, letter to the FAA, the Safety Board stated that recent tests had

found that the 737 main rudder PCU could possibly cause reverse rudder operation if the

servo valve secondary slide were to jam. This finding had not been indicated by numerous

prior tests and research and was unknown at the time that the Board issued this safety

recommendation. Thus, the Board believed that extra efforts needed to be taken to

determine if any other dual-concentric servo valves are susceptible to flight control

malfunctions as a result of unexpected improper positioning of the servo slides. 

On May 13, 1998, the FAA stated that its detailed design review of dual-concentric

servo valves would address this recommendation. Also on May 13, 1998, and again on

June 29, 1998, the FAA stated that its aircraft certification offices reviewed the data from

airplane manufacturers under their geographic purview and determined that 12

dual-concentric servo valves, used on various transport-category airplane flight control

systems, needed a detailed design review. Ten of these valves are used on Boeing 707,

727, 737, and 747 series airplanes; one is used on McDonnell Douglas DC-10 and MD-11

series airplanes; and one is used on the Lockheed L-1011 series airplane. The FAA further

stated that the valve jam conditions, including those involving the secondary slide, and

evaluation criteria had been identified. 

Also on June 29, 1998, the FAA stated that it had reviewed additional study results

submitted by Boeing, its Douglas Products Division, and Lockheed Martin; however,

Boeing was still reviewing the 707 rudder PCU. The FAA indicated that it would review
Factual Information 228 Aircraft Accident Report

the results of the 707 rudder PCU evaluation as soon as it was completed. In addition, the

FAA stated that it issued ADs for two servo valves and found nine servo valves to be

acceptable. 

On February 2, 1999, the Safety Board noted that airplanes produced by Airbus

were not mentioned as part of the FAA’s evaluation. Pending the Board’s review of the

results of the FAA’s detailed design review, including a review of Airbus flight control

systems, Safety Recommendation A-96-117 was classified “Open—Acceptable

Response.”

Safety Recommendation A-96-118 asked the FAA to 

Require the Boeing Commercial Airplane Group, working with other

interested parties, to develop procedures that require 737 flight crews to

disengage the yaw damper in the event of an uncommanded yaw upset as a

memorized or learned action. Once the procedures are developed, require

operators to implement these procedures.

On January 16, 1997, the FAA stated that Boeing had taken appropriate action to

address this issue. Specifically, Boeing revised its 737 Operations Manual and published

an Operations Manual Bulletin to amend the “Uncommanded Yaw” procedure to

“Uncommanded Yaw and Roll Procedure.” According to the FAA, the revised Operations

Manual Bulletin addressed the three failure modes of the 737 yaw damper system and

provided specific guidance to the flight crew on how to address each of the failure modes.

The FAA stated that it planned no further action on this issue.

On July 15, 1997, the Safety Board responded that the revision to Boeing’s

Operations Manual does not advise flight crews to disengage the yaw damper as a

memorized or learned item in the event of an uncommanded roll. Additionally, the Safety

Board was aware that not all operators had adopted a procedure to disengage the yaw

damper as a memorized or learned item. The Board requested that the FAA reconsider its

position not to take further action on this issue. As a result, Safety Recommendation

A-96-118 was classified “Open—Unacceptable Response.”

 On May 13, 1998, the FAA indicated that Boeing revised its 737 AFM to include

procedures that enable the flight crew to take appropriate action to maintain control of the

airplane during an uncommanded yaw or roll condition and correct a jammed or restricted

flight control condition. 

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-96-118 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-96-118 remained classified “Open—Unacceptable Response.” The Safety Board’s

evaluation of Safety Recommendation A-96-118 and the recommendation’s current

classification are discussed in section 2.7.2.
Factual Information 229 Aircraft Accident Report

Safety Recommendation A-96-119 asked the FAA to

Require the Boeing Commercial Airplane Group to develop operational

procedures for 737 flight crews that effectively deal with a sudden

uncommanded movement of the rudder to the limit of its travel for any

given flight condition in the airplane's operational envelope. Once the

operational procedures have been developed, require 737 operators to

provide this training to their pilots.

On January 16, 1997, the FAA stated that it directed the Seattle Aircraft Evaluation

Group, along with Boeing and the Seattle Aircraft Certification Office, to develop a pilot

operating procedure for recovery techniques of sudden uncommanded movement of the

rudder to its maximum limit. This new procedure would be incorporated into the

737 AFM. The FAA also stated that, once the procedure is developed and the AFM is

revised, it would issue a FSIB directing POIs, whose carriers operate 737 airplanes, to

inform pilots of the new procedure and ensure that they are trained during their next

scheduled recurrent training.

On July 15, 1997, the Safety Board responded that the potential for a rudder

movement opposite from that commanded by pilot input on the rudder pedals was not

included as part of this recommendation. Because Safety Recommendation A-97-18,

which had been issued on February 20, 1997, superceded the earlier recommendation by

addressing this rudder movement situation, Safety Recommendation A-96-119 was

classified “Closed—Acceptable Action.” 

Safety Recommendation A-96-120 asked the FAA to

Require 14 CFR Part 121 and 135 operators to provide training to flight

crews in the recognition of and recovery from unusual attitudes and upset

maneuvers, including upsets that occur while the aircraft is being

controlled by automatic flight control systems, and unusual attitudes that

result from flight control malfunctions and uncommanded flight control

surface movements.

This recommendation expanded on the intent of Safety Recommendation A-96-66,

which was issued on August 15, 1996, as a result of the Safety Board’s investigation into

the accident involving American Eagle flight 4184, an ATR-72, near Roselawn, Indiana,

on October 31, 1994.301 The airplane, which was operated by Simmons Airlines, had been

in a holding pattern and was descending to a newly assigned altitude of 8,000 feet when

the initial uncommanded roll excursion occurred. The airplane entered a rapid descent and

crashed. All 68 people on board were killed, and the airplane was destroyed by impact

forces. Safety Recommendation A-96-66 asked the FAA to amend the FARs to require

operators to provide standardized training that adequately addresses the recovery from

unusual events, including extreme flight attitudes in large transport-category airplanes. 

301 See National Transportation Safety Board. 1996. In-Flight Icing Encounter and Loss of Control,

Simmons Airlines, d.b.a. American Eagle Flight 4184, Avions de Transport Regional (ATR) Model 72-212,

N401AM, Roselawn, Indiana, October 31, 1994. Aircraft Accident Report NTSB/AAR-96/01. Washington,

DC. 
Factual Information 230 Aircraft Accident Report

In issuing Safety Recommendation A-96-120, the Safety Board recognized that

pilots receive unusual attitude training when obtaining their private pilot and commercial

pilot certificates as well as their instrument ratings. However, the Safety Board believed

that the ability of pilots to recognize and recover from an unusual attitude could be

severely diminished without additional or recurrent unusual attitude training. Therefore,

Safety Recommendation A-96-66 was classified “Closed—No Longer Applicable/

Superceded.”

On January 16, 1997, the FAA responded to Safety Recommendation A-96-120.

The FAA stated that it was considering an NPRM proposing to require that air carriers

conduct training that will emphasize recognition, prevention, and recovery from aircraft

attitudes that are not normally associated with air carrier flight operations.

On July 15, 1997, the Safety Board responded that it was not aware of any training

in which the unusual attitude was the result of a control system failure or in which some

flight controls would not be available for, or would be counterproductive to, the recovery.

The Safety Board encouraged the FAA to address the full intent of this recommendation.

Pending the Board’s review of the FAA’s final action, Safety Recommendation A-96-120

was classified “Open—Acceptable Response.” The Safety Board’s review and evaluation

of the FAA’s actions in response to Safety Recommendation A-96-120 and the

recommendation’s current classification are discussed in section 2.7.1.

1.18.11.6 February 1997 Recommendations Issued as a Result of 

United Flight 585, USAir Flight 427, and Eastwind Flight 517 (Safety 

Recommendations A-97-16 Through -18)

As a result of the numerous occurrences of uncommanded roll and yaw events

involving 737 series airplanes, the accidents involving United flight 585 and USAir flight

427, and the incident involving Eastwind flight 517, the Safety Board issued Safety

Recommendations A-97-16 through -18 on February 20, 1997.

Safety Recommendation A-97-16 asked the FAA to

Require the expeditious installation of a redesigned main rudder power

control unit on Boeing 737 series airplanes to preclude reverse operation of

the rudder and ensure that the airplanes comply with the intent of the

certification requirements.

On June 23, 1997, the FAA issued AD 97-14-04, which requires, by August 1999,

the installation of a newly redesigned main rudder PCU on all 737 series airplanes. Boeing

indicated that the new PCU would preclude the rudder reversal scenarios that have been

previously identified or hypothesized. On February 2, 1999, the Safety Board indicated

that, because the FAA’s action complied with the intent of Safety Recommendation

A-97-16, it was classified “Closed—Acceptable Action.”
Factual Information 231 Aircraft Accident Report

Safety Recommendation A-97-17 asked the FAA to

Advise 737 pilots of the potential hazard for a jammed secondary servo

control valve slide in the main rudder power control unit to cause a reverse

rudder response when a full or high-rate input is applied to the rudder

pedals.

On April 18, 1997, the FAA stated that AD 96-26-07, which was issued on

December 23, 1996, and became effective on January 17, 1997, required Boeing to revise

its AFM to include procedures that would enable a flight crew to take appropriate action to

maintain control of the airplane during an uncommanded yaw or roll condition and correct

a jammed or restricted flight control condition. The FAA also stated that it was developing

an FSIB to meet the intent of this recommendation.

On January 29, 1998, the FAA issued FSIB 98-03, “Recognition of and Recovery

From Unusual Attitudes and Upsets Caused by Reverse Rudder Response Involving

Boeing 737s.” The FSIB directs, among other things, that POIs advise their air carriers to

inform pilots of (1) the potential for a jammed servo valve secondary slide in the main

rudder PCU when a full or high-rate input is applied to the rudder and (2) the procedures

training necessary to cope with the hazards.

On February 2, 1999, the Safety Board expressed concern about the amount of

time that elapsed before the FAA issued FSIB 98-03; the FAA had anticipated issuing the

bulletin in July 1997. Nonetheless, because the bulletin met the intent of Safety

Recommendation A-97-17, it was classified “Closed—Acceptable Action.”

Safety Recommendation A-97-18 asked the FAA to

Require the Boeing Commercial Airplane Group to develop operational

procedures for 737 flight crews that effectively deal with a sudden

uncommanded movement of the rudder to the limit of its travel for any

given flight condition in the airplane's operational envelope, including

specific initial and periodic training in the recognition of and recovery

from unusual attitudes and upsets caused by reverse rudder response. Once

the procedures are developed, require 737 operators to provide this training

to their pilots.

On April 18, 1997, the FAA stated that AD 96-26-07, which was issued on

December 23, 1996, and became effective on January 17, 1997, required Boeing to revise

its AFM to include procedures that would enable a flight crew to take appropriate action to

maintain control of the airplane during an uncommanded yaw or roll condition and correct

a jammed or restricted flight control condition. The FAA also stated that it was developing

an FSIB to meet the intent of this recommendation.

On July 15, 1997, the Safety Board stated that issuance of AD 96-26-07 partly

responded to the intent of this recommendation but neglected a critical portion of the

recommendation. Specifically, AD 96-26-07 did not address specific initial and periodic

training in the recognition of and recovery from unusual attitudes and upsets caused by

reverse rudder response or require 737 operators to provide this training to their pilots.
Factual Information 232 Aircraft Accident Report

The Safety Board continued to believe that pilots must receive specific initial and periodic

training if they are expected to recover the airplane if a reverse rudder response results in

an unusual attitude. Therefore, pending further correspondence, Safety Recommendation

was classified “Open—Unacceptable Response.”

On January 29, 1998, the FAA issued FSIB 98-03, “Recognition of and Recovery

From Unusual Attitudes and Upsets Caused by Reverse Rudder Response Involving

Boeing 737s.” The FSIB directs, among other things, that FAA inspectors require 737

operators to amend their training programs to provide initial and recurrent training in the

recognition of and recovery from unusual attitudes and upsets caused by reverse rudder

response.

On February 2, 1999, the Safety Board stated that it would further analyze and

discuss Safety Recommendation A-97-18 in the USAir flight 427 accident report. The

Board indicated that, pending the analysis and discussion, Safety Recommendation

A-97-18 remained classified “Open—Unacceptable Response.” The Safety Board’s

evaluation of Safety Recommendation A-97-18 and the recommendation’s current

classification are discussed in section 2.7.2.

1.18.12 Party Submissions

The Safety Board received party submissions that discussed possible scenarios

and/or causes for the USAir flight 427 accident from the FAA, Boeing, Parker Hannifin,

USAir, and ALPA. 

FAA Submission

The FAA’s September 1997 submission stated: 

While the investigation has produced evidence which support the scenarios

where the rudder moved to a full-left position after an encounter with wake

turbulence, the cause of the movement is still at issue. The FAA upon

review of the evidence, cannot conclude that a failure mode which resulted

in an uncommanded rudder movement on Flight 427 has been identified.

Any causal findings, to be legitimate, must have conclusive evidence to

support findings of a hard over or reversal rudder. Such evidence has yet to

be found. Consequently, a specific causal finding of this nature may not be

appropriate.

The rudder system abnormalities that have been discovered during this

investigation have not been shown to have occurred on USAir flight 427.

There is no evidence of any of these abnormalities being present during the

accident sequence. While the FAA acknowledges the fact that some failure

modes of the main rudder power control unit servo valve have been

discovered during this accident investigation, it has not been substantiated

that any of these failures occurred on the accident aircraft. The FAA also

acknowledges that a secondary slide jam to the housing of the servo valve

or interference with the rudder input link could provide both full rudder

rate and full hinge moment. However, once again there is no direct

evidence that this occurred.
Factual Information 233 Aircraft Accident Report

The Boeing Aircraft Company and the FAA have reacted to the discovered

failure modes with modifications of the rudder system, including some

recommended by the National Transportation Safety Board that are

designed to prevent future events of this type. However, the FAA does not

believe sufficient evidence exists to establish a rudder system failure as the

cause of the accident. 

Boeing Submissions

During the investigation of the USAir flight 427 accident, Boeing provided the

Safety Board with a formal submission and a human factors supplement (dated

September 30, 1997), a supplemental submission (dated August 14, 1998), and numerous

letters containing what might be considered submittal information. Portions of these

submittals relating to Boeing’s proposed accident scenarios for the United flight 585

accident and the Eastwind flight 517 incident and Boeing’s kinematic and simulation

studies are discussed in sections 1.16.1 and 1.16.6, respectively. 

Boeing’s September 30, 1997, submission concluded that the flight crew was

startled by the severity of an unexpected wake encounter, a full rudder deflection

occurred, the pilots applied aft pressure on the control column, and the airplane

subsequently entered a stall and remained stalled for approximately 14 seconds as it

descended to the ground. However, the submission stated that the events that led to the full

rudder deflection were not clear. Boeing’s September 1997 submission stated, “there is no

certain proof of airplane-caused full rudder deflection during the accident sequence. The

previously unknown failure conditions that have been discovered in the 737 rudder PCU

have been shown to not be applicable to Flight 427 or any other conditions experienced in

commercial service.”

Boeing’s September 1997 submission stated the following probable cause of the

USAir flight 427 accident: 

...there is no evidence to support a conclusion that an uncommanded full

rudder deflection occurred. While there is not conclusive evidence of a

crew-commanded, sustained left-rudder input such a possibility is plausible

and must be seriously considered, especially given the lack of evidence of

an airplane-induced rudder deflection.”

Boeing’s September 1997 submission also stated the investigation and the 737

design review identified “areas where the 737 rudder system could be improved. In

addition, extremely unlikely failure modes were identified that could hypothetically result

in unwanted rudder deflections.” The submission stated that, in accordance with the FAA’s

ADs 97-14-03 and 97-14-04, Boeing pursued several rudder system design changes,

including redesigns of the main rudder PCU servo valve and the yaw damper system, new

PCU input rod fasteners, and the design and installation of a hydraulic pressure reducer.

Boeing’s September 1997 submission further stated that the most significant

findings from the investigation included the following:
Factual Information 234 Aircraft Accident Report

• Commercial transport flight crews need to be specifically trained to handle

large upsets. Transport pilot training widely used in the 1994 time frame did

not prepare flight crews for recovery from the highly unusual roll rates and roll

and pitch attitudes encountered by the crew of Flight 427.

• 737 yaw damper reliability enhancements are needed to reduce potential

airplane contribution to upsets.

• Highly unlikely potential 737 failure modes can be eliminated:

• Potential 737 rudder PCU failure modes.

• Potential 737 rudder PCU input rod fastener failure mode.

• We can reduce the impact of either airplane-related or crew-input-related

rudder upsets by limiting 737 rudder control authority.

• Research is needed on better ways to detect and avoid wake vortices.

• Existing 737 flight control anomaly procedures could be improved.

• The flight data recorder information from this accident was inadequate to

prove definitive events.

Additionally, Boeing’s submission recommended that “the appropriate

organizations within the industry take steps to improve industry understanding of possible

flight crew responses to wake vortex encounters and other upset events. Boeing believes

that such an effort would be valuable to training organizations worldwide.”

In its August 14, 1998, supplemental submission, Boeing stated the following

regarding its analysis of the Eastwind flight 517 event: 

• Multiple scenarios have been identified that match at least some of the data and

crew reports from the Eastwind 517 event. None of the scenarios fully match

all the data, kinematic analysis, and crew reports.

• Boeing believes that under the NTSB’s standard for identifying “probable

cause,” there is insufficient data to find a “probable cause” for this event. 

• All parties generally agree that the initiation of the Eastwind event included

some form of activity from the yaw damper system. 

• The most likely explanation for the Eastwind event involves a preexisting yaw

damper fault that subsequently cleared itself. 

• There is no data to indicate that the Eastwind Flight 517 event, the United

Flight 585 accident, and USAir Flight 427 accident were caused by a common

airplane malfunction.

Parker Hannifin Submission

Parker Hannifin’s September 1997 submission stated that the postaccident

examination of the USAir flight 427 PCU revealed no physical evidence of a jam or other

anomaly. Further, the submission stated that “the conclusion reached by Boeing was that
Factual Information 235 Aircraft Accident Report

the accident PCU would not seize if subject to thermal shocks or temperature differential

consistent with those which could be encountered in realistic flight conditions.” 

Parker’s submission concluded 

A significant indication of the reliability of the main rudder PCU from

Flight 427 is a comparison of the performance of the unit at the time of its

original manufacture in 1987 as measured by the acceptance test, its

performance at the time of its testing during removal from service in

September 1992, its performance when tested immediately following the

accident the September 1994, and finally, its performance when tested in

August 1997 after having been subject to numerous tests and conditions

outside the normal flight environment of the unit. In each of these

instances, the PCU consistently operated normally and within

specifications. In sum, after years of one of the most critical examinations

in aviation history, there is no evidence that the main rudder PCU from

Flight 427 malfunctioned or was other than fully operational. 

USAir Submissions

USAir provided the Safety Board with a submission (dated September 30, 1997)

and a supplemental submission (dated August 12, 1998). In its September 30, 1997

submission, USAir stated that “data demonstrates, and all parties seem to agree, that

USAir flight 427’s rudder moved to a full-left position shortly after the aircraft

encountered wake vortices generated by a preceding aircraft. It is also clear that the wake

vortex encounter did not directly cause the accident.” The USAir submission described the

background and experience of the pilots and their actions during the emergency and

concluded the following:

[The pilots] did not apply full-left rudder during the wake vortex encounter,

oppose it with opposite aileron and spoiler, and hold these cross-controlled

positions for 23 seconds as the aircraft spiraled into the ground. The

investigation did, however, reveal several anomalies in the Boeing 737

rudder control system that may have caused the aircraft’s rudder to fully

deflect without crew input or to move opposite to the crew’s input.

The USAir submission concluded that the probable cause of the accident was “an

uncommanded, full rudder deflection or rudder reversal that placed the aircraft in a flight

regime from which recovery was not possible using known recovery procedures. A

contributing cause of this accident was the manufacturer’s failure to advise operators that

there was a speed below which the aircraft’s lateral control authority was insufficient to

counteract a full rudder deflection.”

In its August 12, 1998, supplemental submission, USAir supported the results of

the Safety Board’s simulation studies. USAir’s supplemental submission indicated that “a

mechanical malfunction of USAir flight 427 rudder PCU resulted in a rudder reversal or

uncommanded deflection that caused USAir flight 427 to depart controlled flight and

crash.” USAir also restated its previous conclusions. 
Factual Information 236 Aircraft Accident Report

ALPA Submissions

ALPA provided the Safety Board with a submission (dated September 1997) and a

supplemental submission (dated August 7, 1998) in which it offered its conclusions and

recommendations. ALPA’s September 1997 submission stated that 

...aircraft performance analysis revealed that the maneuver of USAir 427

is consistent with full nose left rudder travel.... There is no evidence to

support the hypothesis that the flightcrew mishandled the flight control

following the upset event, or that this control mishandling led to the

accident. 

As for the B737 rudder control system however, during the course of this

investigation a number of failure modes have been identified which could

result in an uncommanded full rudder input. It was also discovered that at

least one failure mode, secondary valve jam resulting in primary valve

overtravel, would not leave witness marks. In addition, this failure mode

resulted in rudder movement that matched the rudder time history, in both

magnitude and input rate, determined from the aircraft performance studies

necessary to match the maneuver. 

ALPA’s submission concluded that 

...the airplane experienced an uncommanded full rudder deflection. This

deflection was a result of a main rudder power control unit (PCU)

secondary valve jam which resulted in a primary valve overstroke. This

secondary valve jam and primary valve overstroke caused USAir 427 to

roll uncontrollably and dive into the ground. Once the full rudder hardover

occurred, the flight crew was unable to counter the resulting roll with

aileron because the B737 does not have sufficient lateral control authority

to balance a full rudder input in certain areas of the flight envelope.

Additionally, ALPA’s submission offered the following recommendations for the

Safety Board’s consideration:

• Boeing and Parker should work diligently to replace existing B737 rudder

PCUs with improved units as quick as possible without sacrificing quality.

• The FAA should eliminate the current practice of derivative certification.

Newly developed aircraft should be carefully evaluated against FAR criteria in

place at the time of aircraft development.

• For aircraft which were certificated as “Derivative” models, the FAA should

evaluate those aircraft against existing FAR requirements and those aircraft, to

the extent feasible, should be modified in order to be in compliance with the

current FAR regulations.

• The FAA should require all FAA certified repair stations to meet all standards

of the original equipment manufacturer.
Factual Information 237 Aircraft Accident Report

• In order to increase B737 lateral control margin to an acceptable level, the

FAA should mandate the development of additional operational techniques

such as increasing B737 minimum maneuvering speed to Boeing

recommended “Block” speed plus 10 knots.

• The industry should continue with the development and implementation of

“Advanced Maneuver” or “Selected Event” training and that the FAA should

require the inclusion of this training in every airline’s training program.

In the August 7, 1998, supplemental submission, ALPA noted that a comparison of

Boeing’s kinematic analysis and the Safety Board’s computer simulation of the Eastwind

flight 517 event indicated that 

...both scenarios match the same recorded [FDR] data, demonstrating that

it is possible to match the maneuver with different scenarios by varying the

assumption and interpretation of the course data. However, ALPA believes

that the Board is more accurate in their scenario since the rate of the rudder

input required to match the maneuver is the same rate which would result

from a PCU secondary valve jam.

NTSB staff, using [its] simulation, has also been able to match both the

USAir [flight] 427, and [United flight] 585 accident upsets by assuming a

PCU secondary valve jam. In all three cases the rudder input rate needed to

match flight recorder data is consistent with the rudder rate which would

result from a secondary valve jam. It is extremely unlikely that three

different pilots in three different B737s, on three different days would use

the same rudder rate. Yet if the secondary valve were jammed in each case,

it would result in the same rudder input rate.

The supplemental submission concluded that “ALPA believes more strongly than

ever that the cause of the accident was a rudder anomaly.”

1.19 New Investigative Techniques

The extent of the destruction involved the USAir flight 427 accident and the

complexity, depth, and duration of the accident investigation resulted in the use of some

new techniques and practices. After its initial examination of the accident site, the Safety

Board (in cooperation with local public safety officials) determined that the accident site

and the airplane wreckage and components were a potential biological hazard. As a result,

the Board required the use of personal protective equipment (PPE) and the

implementation of safety procedures, as outlined in the Occupational Safety and Health

Administration (OSHA) regulations contained in 29 CFR Part 1910. During the on-scene

investigation, the Safety Board (with assistance from other emergency response

authorities) established formal procedures for the large-scale provision, use, and

disposition of PPE;302 the distribution of Hepatitis B inoculations to all noninoculated

302 The OSHA procedures for this type of environment required all investigative and emergency

response personnel to wear PPE when they accessed those areas of the accident site containing biological

hazards and undergo decontamination procedures after departing the biohazard area. 
Factual Information 238 Aircraft Accident Report

on-scene investigative/emergency response personnel; and the decontamination of every

recovered piece of airplane wreckage. 

The monitoring of and access control to the accident site was initially the

responsibility of the Hopewell Township emergency response personnel, with support

from neighboring jurisdictions, the Beaver County Sheriff’s Office, and the Pennsylvania

State Police. A Unified Command Post (UCP) was subsequently established, and the

responsibility for control and coordination of site access, PPE, decontamination, and other

site logistics came under the purview of UCP authorities. The UCP included

representatives from the Safety Board, the U.S. Air National Guard, the USAF Reserve,

Pennsylvania Emergency Management Agency, Pennsylvania Department of

Environmental Resources, Pennsylvania State Police, Beaver County Sheriff’s and

Coroner’s Offices, and Hopewell Township Fire and Police Departments. Other groups

involved in the UCP were the American Red Cross, the Salvation Army, and a University

of Pittsburgh Critical Incident Stress Debriefing team. 

Because of the catastrophic destruction of the airplane and occupants, the Safety

Board sought assistance from the AFIP in positively identifying the flight crews’ remains.

AFIP personnel used deoxyribonucleic acid (DNA) protocols to identify and differentiate

the muscle tissue samples obtained from the cockpit area of the wreckage. With the use of

DNA protocols and reference specimens from the first officer’s family, AFIP personnel

were able to positively identify one set of tissue samples as the first officer’s remains. The

Safety Board was unable to obtain reference specimens from the captain’s family.

However, the FBI identified footprints from tissue specimens recovered from the cockpit

area, and these footprints matched those of the captain’s USAF footprint records.303 With

the use of the footprints and DNA tests, the captain’s remains were positively identified. 

Because the accident airplane impacted the ground at a high airspeed, the Safety

Board became concerned that important airplane components might have penetrated the

ground and might not be easily located and recovered. To locate any components under

the surface, the U.S. Bureau of Mines provided Safety Board investigators with a GPR

system, metal detectors, and researchers to operate the equipment. A GPR search of the

area was conducted after most of the airplane wreckage had been removed from the

accident site to the hangar at PIT. The GPR equipment detected pieces of wreckage that

had penetrated up to 6 feet deep in the soil; these wreckage components were

subsequently recovered and moved to the hangar. This accident was the first time that a

GPR system was used during a Safety Board investigation; the system was subsequently

used during the Safety Board’s on-scene investigation of the aircraft accident involving

ValuJet flight 592, which occurred in the Everglades, near Miami, Florida, on May 11,

1996.304

303 The USAF documented the captain’s footprints when he was involved in its pilot training program.

304 National Transportation Safety Board. 1997. In-Flight Fire and Impact with Terrain, ValuJet Airlines

Flight 592, DC-9-32, N904VJ, Everglades, Near Miami, Florida, May 11, 1996. Aircraft Accident Report

NTSB/AAR-97/06. Washington, DC. 
Factual Information 239 Aircraft Accident Report

Another practice that the Safety Board used for the first time during an

investigation was the establishment of an independent technical advisory panel (see

section 1.18.2) to review the work performed by the Safety Board’s investigative team and

propose additional tests and scenarios for investigation. This collaborative effort helped

the Safety Board test for and identify the main rudder PCU thermal jam rudder reversal

scenario.
Analysis 240 Aircraft Accident Report

2. Analysis

2.1 General

The USAir flight 427 flight crew was properly certificated and qualified and had

received the training and off-duty time prescribed by Federal regulations. No evidence

indicated any preexisting medical or behavioral conditions that might have adversely

affected the flight crew’s performance during the accident flight. 

The USAir flight 427 accident airplane was equipped, maintained, and operated in

accordance with applicable Federal regulations. The airplane was dispatched in

accordance with FAA- and industry-approved practices. 

On the basis of postaccident examination of the wreckage and identification of all

fuselage doors, door frames, and locking mechanisms, the Safety Board concludes that all

of USAir flight 427’s doors were closed and locked at impact.

The catastrophic impact with terrain, postimpact fire, and subsequent destruction

of the airplane precluded a complete inventory of the airplane’s structure and components.

However, all recovered structural pieces were examined thoroughly by fire and explosion

experts from the Safety Board, FAA, FBI, and the United Kingdom’s Air Accidents

Investigation Branch. Additionally, the Safety Board examined the CVR and FDR

information from the accident airplane and compared it with FDR information obtained

from the investigation into the accident involving Pan Am flight 103 over Lockerbie,

Scotland, and other known in-flight fire, bomb, and explosion events. These examinations

revealed no evidence of an in-flight fire, bomb, or explosion. 

Also, more than 100 witnesses on the ground were interviewed, and all but

1 reported that the airplane appeared to be intact during the accident sequence. The Safety

Board nonetheless conducted a series of postaccident ground and helicopter searches.

Although the search did not reveal any significant airplane components located away from

the main wreckage, light-weight pieces from the airplane (for example, insulation and

paper) were located as far as 2.5 miles downwind from the accident site. On the basis of

witness statements, physical evidence from the wreckage, and the prevailing winds at the

time of the accident, the Safety Board considers it likely that those light-weight airplane

pieces became airborne as a result of the postimpact explosion and fire and then drifted

downwind from the accident site. The extremities of the airplane and all flight control

surfaces were found at the main wreckage site. Further, no evidence indicated that

material fatigue or corrosion contributed to the accident. 

On the basis of the findings discussed in the previous two paragraphs, the Safety

Board concludes that USAir flight 427 did not experience an in-flight fire, bomb,

explosion, or structural failure. 
Analysis 241 Aircraft Accident Report

A review of ATC procedures and radar information revealed that the air traffic

controllers followed applicable air traffic and wake turbulence separation rules and that

the required air traffic separation was maintained during flight 427’s approach to the

Pittsburgh International Airport (PIT). The accident airplane and the Boeing 727 airplane

that preceded it inbound to PIT (Delta flight 1083) were separated by at least 4.1 miles

when they were at the same altitude

The Safety Board considered the possibility that a midair collision with an airplane

or birds was involved in the accident scenario. However, examination of the airplane

wreckage; CVR, FDR, and radar data; and statements from ATC personnel and witnesses

on the ground revealed no evidence that an impact with other air traffic or a bird strike

were involved in the accident. 

The Safety Board also considered the possible role of weather in the accident.

However, weather and FDR information and statements from witnesses on the ground and

the pilots of other airplanes operating in the area indicated that, at the time of the accident

flight’s upset/loss of control, the weather in the Pittsburgh area was clear with light winds.

No evidence indicated that clear air turbulence or other atmospheric phenomena were

involved in the accident. Accordingly, the Safety Board concludes that a midair collision

with other air traffic, a bird strike, clear air turbulence, or other atmospheric phenomena

were not involved in the USAir flight 427 accident.

2.2 USAir Flight 427 Upset 

The accident flight was apparently routine until it neared PIT. FDR data indicated

that, about 1902:54, the accident airplane was rolling out of a left bank to its assigned

heading of 100°, after which it began to yaw and roll; about 1902:59, the airplane’s

heading moved left past 100° at an increasing rate. By 1903:01, the airplane’s heading

was moving left at a rate of at least 5° per second; the airplane’s heading continued to

move left at least at this rate until the stickshaker activated about 1903:08. The airplane’s

left roll angle was also increasing rapidly during this time; about 1903:01 the airplane’s

left roll angle was about 28°, and 5 seconds later (at 1903:06) the airplane’s left roll angle

exceeded 70°. The Safety Board therefore considered various scenarios that could have

resulted in such a heading change, including the following: (1) asymmetric engine thrust

reverser deployment, (2) asymmetrical spoiler/aileron activation, (3) transient electronic

signals causing uncommanded flight control movements, (4) yaw damper malfunctions,

and (5) a rudder cable break or pull. The Safety Board ruled out each of these scenarios as

a possible factor or cause of the left yaw/roll and heading change for the following

reasons: 
Analysis 242 Aircraft Accident Report

• Postaccident examination of the engine thrust reversers, including disassembly

of the thrust reverser actuators, indicated that the engine thrust reversers were

in the stowed position at impact. Further, the investigation revealed that, at the

engine power settings recorded by the FDR during the upset event, a thrust

reverser deployment would not have produced a heading change that would

match the FDR heading data and would have produced longitudinal

acceleration signatures that were not reflected by the FDR longitudinal

acceleration data. 

• Simulator tests indicated that even the most adverse asymmetrical spoiler/

aileron extension condition could not create a heading change rate of the

magnitude that was recorded by the accident airplane’s FDR.

• The Safety Board examined the possibility that transient electronic signals,

possibly caused by blue water contamination of components in the electrical/

electronic compartment (E/E bay),305 high-intensity radiated field (HIRF)

interference, or electromagnetic interference (EMI) could result in an

uncommanded flight control movement. Although the Boeing 737 flight

controls are primarily hydromechanical (not electrical), there are electrical

links to the flight control systems through the autopilot (which interfaces with

the ailerons, spoilers, elevators, and stabilizer trim but not the rudder), the

rudder trim, and the rudder system’s yaw damper. Therefore, EMI and/or

HIRF could theoretically affect the autopilot, rudder trim, and/or yaw damper

systems within the limits of those systems. Further, the autopilot and yaw

damper systems have components located in the E/E bay and therefore could

have been affected by fluid contamination. 

• The Safety Board’s flight tests and review of event histories demonstrated,

however, that pilots could easily override uncommanded movements of the

ailerons, spoilers, or elevators resulting from electronic signals influencing

those flight controls. If such an uncommanded flight control movement

persisted, a pilot could easily disengage the autopilot (as the pilots of USAir

flight 427 ultimately did), thus likely eliminating the electrical/electronic

influence on the flight controls. In addition, postaccident examination of the

rudder trim system components indicated that the rudder trim actuator was in

the neutral position at impact. If the rudder trim actuator were disturbed by a

transient electrical input, it would have remained in its trimmed position until it

was trimmed again by specific pilot action—unlike the rudder PCU, which

would revert to its neutral position when pilot or yaw damper input ceased and

was found in a near-neutral position at the accident site. Further, because the

rudder trim system moves the rudder at a much slower rate than the rudder

system or the yaw damper (0.5° versus 66 and 50° per second, respectively),

305 Although postaccident examination of recovered portions of the forward lavatory/galley and E/E bay

revealed no evidence of blue water contamination, such contamination may have existed on portions of

those structures that were not recovered or identified. 
Analysis 243 Aircraft Accident Report

it could not produce a rudder deflection rate that would result in the rapid

yawing motion and heading change observed in the FDR and computer

simulation data.

• A review of the yaw damper system indicated that it could not produce a

rudder deflection that would result in the yawing motion observed in the FDR

data because the yaw damper system authority is limited to ± 3° (when

properly rigged). Simulator tests confirmed that these limited rudder

deflections could not result in the yawing motion observed in the accident

airplane’s FDR data. Further, pilot statements describing uncommanded yaw

excursions within the yaw damper system’s normal range (± 3°) indicated that

such excursions are typically considered to be merely nuisance events and are

easily controlled by the flight crew. Additionally, as with the autopilot, the

pilots could have easily disengaged the yaw damper system if necessary, thus

eliminating the yaw damper’s effect. 

• The Safety Board considered the possibility of a yaw damper failure in

combination with a jam of the standby rudder PCU input bearing. Tests

showed that such a combination could result in a rudder deflection of about 9°.

However, this rudder deflection could not have produced the heading change

recorded by the accident airplane’s FDR. Further, the Safety Board’s tests also

showed that a pilot input on the rudder pedals could override this combined

failure/jam and neutralize the rudder. 

• Testing examined the possibility that a rudder cable pull or break might have

caused the heading change. However, the tests demonstrated that the effects of

loads up to 250 pounds applied to the rudder cables could produce maximum

rudder deflections of only 2.3° and that rudder cable separations could produce

maximum rudder surface deflections of only 5°. Simulator tests indicated that

such rudder deflections would not create a yawing motion or heading change

of the magnitude that was recorded by the accident airplane’s FDR. In

addition, when the rudder cables were cut during postaccident tests, the CVR

recorded “bang” sounds that had energy distributed throughout the frequency

spectrum, with multiple secondary signals that appeared to be the result of

mechanical “ringing” of the rudder cable system. These sounds and

frequencies did not resemble any of the sounds or frequencies recorded by the

CVR during the upset/loss of control of USAir flight 427. 

Therefore, the Safety Board concludes that asymmetrical engine thrust reverser

deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing

uncommanded flight control movements, yaw damper malfunctions, and a rudder cable

pull or break were not factors in the USAir flight 427 accident. 

The accident investigation revealed that, when the airplane began to yaw and roll

left (as it penetrated the path of the descending wake of Delta flight 1083), the FDR began

to record load factor fluctuations and an increase in airspeed. These airplane motions

were consistent with the performance changes that were observed during the Safety

Board’s wake turbulence flight tests. Further, the “thump” sounds recorded by the
Analysis 244 Aircraft Accident Report

accident airplane’s CVR during the following 6 seconds (while the airplane was still likely

passing through the 727’s wake vortices) were similar to the sounds recorded by the flight

test airplane’s CVR when the wake vortices passed across the test airplane’s fuselage.

(These sounds were described by flight test pilots as “whooshing” noise.)306 

The Safety Board considered the possibility that the wake turbulence encounter

alone resulted in the accident airplane’s heading change and the subsequent upset event

and accident. However, wake turbulence flight test data and flight test pilot statements

indicated that it was not difficult to recover from the wake vortex encounters, although

some encounters resulted in rolling moments that were surprisingly intense (especially

those in which the intercept angle was small and the vortex impacted the airplane’s

fuselage, as most likely occurred with the accident airplane). Further review of the wake

turbulence flight test data did not reveal any instances in which the wake vortex encounter

resulted in a heading change resembling that recorded by the accident airplane’s FDR. In

most of the flight test encounters, the airplane rapidly exited the wake vortex, thus ending

the encounter. In fact, the wake turbulence flight tests indicated that wake vortices

naturally tended to push the airplane out of the wake’s effects. 

Additionally, the Safety Board’s review of wake turbulence-related events in its

accident and incident database307 and in NASA’s Aviation Safety Reporting System

revealed that, although air carrier pilots frequently reported being surprised by the severity

of wake vortex encounters, these encounters typically resulted in upsets that pilots were

easily able to counter. The Safety Board’s database indicated that wake turbulence

encounters were determined to be causal factors in three air carrier accidents. These three

accidents, which occurred between 1964 and 1972, involved airplanes operating at low

altitudes near airports (two airplanes were landing, and one was taking off). After the

1972 accident, ATC airplane separation standards were increased; since that time, no

fatalities aboard air carrier airplanes have involved a wake turbulence encounter. Notably,

no record exists of a catastrophic encounter with wake turbulence by an air carrier airplane

when the airplane was operating at altitudes and/or airspeeds similar to those of USAir

flight 427. 

Evidence of wake vortex-related airplane motions were detected in the accident

airplane’s FDR data by about 1902:55. However, the results of the wake vortex flight tests

and the Safety Board’s computer simulations indicate that the airplane would not have

remained in the wake long enough to have produced the heading change and bank angles

that occurred after 1903:00. On the basis of the results of wake turbulence flight tests and

flight simulator sessions and review of available wake turbulence event information, the

306 Boeing’s flight test pilot reported that, during some of the wake vortex encounters, he heard a

clicking sound that he attributed to the wake vortices causing the windshield wipers to slap against the

windshield. At 1902:58.6, the USAir flight 427 CVR recorded a “clickety click” sound, the source of which

could not be positively identified. Although the Safety Board reviewed the sounds recorded by the CVR on

50 of the 150 wake turbulence flight test conditions, it did not identify a case in which the CVR recorded

such a clickety click sound. Therefore, no direct comparison was possible between the sounds heard on the

flight test airplane and the accident airplane. 

307 The Safety Board’s database contains information regarding aviation accidents beginning in 1962. 
Analysis 245 Aircraft Accident Report

Safety Board concludes that, although USAir flight 427 encountered turbulence from

Delta flight 1083’s wake vortices, the wake vortex encounter alone would not have caused

the continued heading change that occurred after 1903:00. 

Boeing and Safety Board flight and computer simulations (discussed in section

1.16.6.1) have demonstrated, however, that the heading change rates recorded by the FDR

after 1903:00 were consistent with the rudder being deflected to its left aerodynamic

blowdown limit. Accordingly, the Safety Board concludes that, about 1903:00, USAir

flight 427’s rudder deflected rapidly to the left and reached its left aerodynamic blowdown

limit shortly thereafter. This movement of the airplane’s rudder could only have been

caused by a flight crew action or a mechanical rudder system anomaly. 

The potential for such a mechanical rudder anomaly was demonstrated during

postaccident tests in which the secondary slide was intentionally jammed (pinned) to the

servo valve housing and a rapid input was applied in a direction that would oppose the

jam. These tests showed that the primary slide could overtravel,308 resulting in hydraulic

fluid porting in such a way that the rudder moves to its aerodynamic blowdown position in

the direction opposite to the rudder input (rudder reversal).309 

Further, during the most severe postaccident thermal tests (a temperature

difference of about 180° between the heated hydraulic fluid and the servo valve housing of

the USAir flight 427 main rudder PCU), the secondary slide jammed to the servo valve

housing, and hydraulic fluid flow data indicated that a momentary reversal of the rudder

occurred during this jam. Although the USAir flight 427 servo valve jammed repeatedly

during these extreme thermal tests, the new-production servo valve also subjected to these

tests never jammed. Examination of the internal measurements of both servo valves

indicated that the USAir flight 427 servo valve had significantly tighter diametrical

clearances between the secondary slide and the servo valve housing than the newproduction servo valve. The Safety Board considers it likely that the USAir flight 427

servo valve was more susceptible to a jam because of its tighter clearances.

Although the USAir flight 427 main rudder PCU servo valve had been subjected to

impact forces from the accident and extensive postaccident testing (including repeated

thermal jams), internal examination of the servo valve revealed no evidence of physical

marks that would indicate that a jam had existed. Further, the servo valve slides still

moved freely, and the servo valve was still capable of successfully completing Parker

Hannifin’s acceptance test procedure functional tests.

The Safety Board recognizes that the temperature differential to which the accident

PCU servo valve was exposed under the most severe thermal test conditions was greater

than that expected in normal operation; the hydraulic fluid had not been circulating

through the PCU before the tests began and was therefore not continuously warming the

308 This overtravel is the result of elastic deformation of the mechanical input mechanisms that allow the

primary slide to move beyond its intended design limits.

309 Normally, if the secondary slide were to jam to the PCU servo valve housing, the primary slide

would move to oppose the jam, neutralizing hydraulic flow. 
Analysis 246 Aircraft Accident Report

PCU servo valve housing as it would be in flight if the yaw damper were energized.310

Nonetheless, these thermal tests demonstrate that it is possible for the secondary slide of

the servo valve to jam to the valve housing and leave no evidence of physical marks.

These tests also demonstrate that, with the secondary slide thus jammed, it is possible for

the primary slide to overtravel and cause a rudder hardover in the direction opposite to that

commanded without leaving any physical evidence.

2.2.1 USAir Flight 427 Computer Simulation Analysis

Kinematic analysis and workstation-based computer simulations were performed

to determine the control wheel (ailerons and flight spoilers) and rudder inputs that could

produce the motion of the airplane between the time of the initial upset and ground impact.

During its investigation of this accident, the Safety Board evaluated many solutions,

including the kinematic analysis presented by Boeing in its September 30, 1997,

submission to the Board.311

Because the data available from the USAir flight 427 FDR was limited (in both the

number of parameters recorded and the frequency with which the parameters were

recorded)312 and investigators could not positively identify the characteristics of the wake,

multiple control wheel and rudder solutions provided a reasonable match with the

pertinent FDR data: the airplane’s vertical load factor (acceleration), pitch, roll, and (most

importantly) heading.

The Safety Board obtained an excellent match of the USAir flight 427 FDR data

with a computer simulation in which, after a right rudder pedal input about 1903:00, the

rudder reversed as a result of a jam of the secondary slide to the servo valve housing

(about 100 percent off neutral) and moved to its left blowdown limit. This simulation

(subsequently referred to as the Safety Board’s best-match simulation) included an

estimation of the influence of the wake vortex during the upset event and resulted in a

heading output that not only matched the FDR-recorded heading within less than 1° but

also matched the character313 of the FDR-recorded heading data until about 1903:08, at

310 The amount of hydraulic fluid flow through the main rudder PCU directly affects the temperatures

within the PCU (increased hydraulic fluid flow through the PCU results in increased temperatures within the

PCU and vice versa). Although some hydraulic fluid continually flows through the PCU as a result of

leakage around the primary slide permitted by the underlapped metering edge design, additional hydraulic

fluid flow through the PCU occurs as a result of yaw damper activity or rudder pedal usage. Therefore,

normal operations in smooth, calm air, with minimal yaw damper activity or pilot rudder pedal usage would

result in minimal hydraulic fluid flow through the PCU, whereas operations in turbulent air with increased

yaw damper/rudder activity would result in increased hydraulic fluid flow through the PCU. Conditions

were quite calm before the USAir flight 427 upset, so there would have been little yaw damper activity or

rudder usage and thus very little hydraulic fluid flowing through and warming the PCU. However, yaw

damper activity upon encountering the wake vortex would have resulted in increased hydraulic fluid flow

through the PCU.

311 During the Safety Board’s first technical review for the USAir flight 427 accident, which was held on

October 31, 1997, in Pittsburgh, Boeing presented a refined version of the information contained in its

September 30, 1997, submission. 

312 For more information, see section 1.11.2.
Analysis 247 Aircraft Accident Report

which time the stickshaker activated and the FDR data showed the beginning of an

aerodynamic stall.314

In its September 30, 1997, submission to the Safety Board, Boeing presented a

kinematic solution for the USAir flight 427 accident. This solution postulated that the

pilot applied full left rudder about 1902:59, relaxed that rudder pressure momentarily,

applied full left rudder once again beginning about 1903:01, and then sustained this input

until ground contact, about 1903:23.

A comparison of the heading, roll, and vertical acceleration results from the Safety

Board’s best-match simulation with Boeing’s kinematic solution indicates that both

solutions match the FDR data about equally well. The Safety Board then evaluated how

well the rudder and control wheel time histories produced by the Safety Board computer

simulations and Boeing’s kinematic solution comported with the human performance data

obtained during this investigation. 

2.2.2 USAir Flight 427 Human Performance Analysis

A review of CVR, FDR, and ATC information indicated that the accident flight

and flight crew performance were routine before the upset occurred. All required

checklists were completed, communications with ATC and other crewmembers were

appropriate, and the pilots were responsive and displayed no evidence of problems that

would impede working together during an emergency. No evidence indicated any

physiologic or ergonomic reason that either pilot would have been incapable of

manipulating the airplane’s controls throughout their range of motion during the accident

sequence. Although the Safety Board was unable to positively determine which pilot was

manipulating the airplane’s flight controls during the initial upset and the early recovery

attempts,315 the following indications showed that the first officer likely provided flight

control inputs throughout the accident sequence: 

• The first officer was the flying pilot for the flight segment during which the

accident occurred, and the CVR recorded no verbal transfer of command (as

specified in USAir procedures) to indicate that the captain had assumed those

responsibilities.

• The first officer emitted straining and grunting sounds early in the upset

period, which speech and communication experts stated were consistent with

applying substantial physical loads; the CVR did not record any such sounds

on the captain’s microphone channel until just before ground impact. 

313 The “character of the data” is used in this report to refer to the shape of the curve that would be

formed by connecting the FDR data points smoothly.

314 The Safety Board and Boeing were unable to analyze poststall/high sideslip events because the

aerodynamic model of the airplane in that condition is unreliable and inaccurate.

315 Because the FDR did not record aileron and rudder flight control inputs at either pilot position, it was

not possible to determine what flight control inputs were applied by the flight crew or which pilot applied

such controls. The FDR recorded control column position but did not identify which pilot(s) applied control

column pressure.
Analysis 248 Aircraft Accident Report

• The first officer keyed the microphone (apparently inadvertently) on the air-toground radio channel repeatedly while the stickshaker activated between

1903:09.4 and the end of the recording, which would be consistent with

gripping the control wheel and the vibrations of the stickshaker tripping his

finger on and off the radio switch on the back of the yoke.

The captain might have joined the first officer in manipulating the flight controls

during the upset sequence; however, according to speech and communication experts, the

captain’s breathing (rapid and shallow) and speech patterns (for example, “whoa,” “hang

on,” and “what the hell is this”) did not indicate that he was exerting substantial physical

loads during the initial upset. Further, speech experts stated that the captain’s “four twenty

seven emergency” transmission, about 1903:15, was a reasonable attempt to communicate

and an appropriate response for the situation, but the captain’s speech during the

transmission did not indicate that the captain was exerting substantial physical loads.

After about 1903:18 (about 5 seconds before ground impact), that the captain’s breathing

and speech patterns recorded by the CVR indicated that he might have been exerting

strong force on the controls (as he said “pull...pull...pull”). Therefore, the Safety Board

concludes that analysis of the human performance data shows that it is likely that the first

officer made the first pilot control response to the upset event and manipulated the flight

controls during the early stages of the accident sequence; although it is likely that both

pilots manipulated the flight controls later in the accident sequence, it is unlikely that the

pilots simultaneously manipulated the controls (possibly opposing each other) during the

critical period in which the airplane yawed and rolled to the left.

As previously discussed, the accident airplane was returning to level flight under

autopilot control from a shallow left turn to an ATC-assigned heading of 100° when it

penetrated the wake vortex of the preceding 727 airplane (Delta flight 1083). The first

officer was announcing that he had visual contact with the Jetstream traffic (Atlantic Coast

flight 6425), of which ATC had advised the flight crew, when the accident airplane’s FDR

began to record vertical loads consistent with a wake vortex encounter from the 727. The

most severe perturbations resulting from the wake turbulence penetration occurred

between about 1902:55 and about 1903:03. As the airplane’s bank angle (which had been

rolling out of a commanded left bank toward a wings-level position) began accelerating to

the left away from level flight, the turbulence apparently caused the captain to

inadvertently activate the intercom button on his side console316 and caused both the

captain and first officer to voice exclamations of surprise (“sheeez” and “zuh” at

1902:57.5 and 1902:57.6, respectively). 

The results of the Safety Board’s computer simulation and Boeing’s kinematics

analysis showed a significant right control wheel input about 1902:58 in response to the

left roll/yaw effects of the wake vortex. This input was likely the result of the first officer

reacting to the wake turbulence, aggressively inputting right control wheel (initially about

65°, according to the Safety Board’s simulation) to keep the airplane level.317 The speed

316 The captain was likely touching the radio/intercom transmit button on his side console because he

was preparing to advise ATC that he and the first officer had visual contact with the Jetstream traffic. 
Analysis 249 Aircraft Accident Report

of this pilot reaction, about 1 second after his first verbal reaction, suggested a reflexive

action to counter the rolling motions of the wake. The timing of the first officer’s early

control wheel response to the wake turbulence encounter indicated that the first officer

quickly recognized the strength of the wake-induced roll event and acted accordingly. The

Safety Board’s simulation (rudder jam/reversal scenario) and Boeing’s simulation (pilot

input scenario) differ markedly as to what happened after the right control wheel input. 

2.2.2.1 Rudder Jam/Reversal Scenario

According to the Safety Board’s computer simulations, at about 1902:59, as the

airplane responded to the right control wheel input and began rolling back toward level

flight, the control wheel position moved from about 65° right to about 15° right. This

movement indicates that the first officer had relaxed his input force on the control wheel.

However, according to the FDR, between about 1902:58 and about 1903:00, the airplane’s

heading moved quickly past the assigned 100° to about 94°. Both the Safety Board’s

computer simulation and Boeing’s kinematic analysis indicated that this heading change

was likely to have been associated with a significant yawing motion318 that would have

caused a lateral acceleration at the pilots’ seats of more than 0.1 G to the left. The pilots

would have likely felt this acceleration as a sustained, uncomfortable sideforce in the

cockpit and would have observed the ground and sky moving sideways against the fixed

reference of the airplane’s windshield area. 

Beginning with initial flight training and continuing throughout their careers,

pilots are trained to minimize uncoordinated yawing motions and sideforces. At

1902:59.4, the captain stated “whoa” likely in response to the kinesthetic and visual

sensations produced by the airplane’s yawing motion.319 It would have been reasonable

for the first officer to respond to this yawing motion (and possibly to the captain’s

statement) by applying right rudder pedal pressure about 1903:00. This right rudder input,

intended to relieve the sideforce and return the airplane to its assigned heading, was

instead followed by a rapid rudder deflection to the left (rudder reversal) that increased the

left yawing motion and accelerated the airplane’s heading change to the left. 

As the rudder deflected to its initial blowdown position, the rudder pedals would

have moved in a direction opposite to that commanded by the first officer. The first

officer would likely have sensed the right rudder pedal rising underneath his right foot

despite attempts to depress the pedal. During that time (between about 1903:00 and about

317 The control wheel and column inputs would have caused the autopilot to change to its control wheel

steering mode for both the pitch and roll axes; as a result, the first officer’s control inputs would have

positioned the flight controls through the autopilot servos.

318 According to the geometry of USAir flight 427’s wake vortex encounter, this yawing motion likely

resulted from the entry of the airplane’s tail into the vortex field. The Safety Board’s computer simulation of

the event models the wake vortex encounter in this way.

319 At the time of the captain’s statement, the left yawing motion would have been the most significant

of the sensations being experienced in the cockpit. The airplane’s bank angle (19.5° left) and pitch angle

(6.5° nose up) were within the parameters of normal flight. The vertical acceleration was relatively small.

Although the airplane experienced a roll acceleration to the right, it remained in a left bank; thus, the roll

acceleration would have been in the direction desired by the pilots. 
Analysis 250 Aircraft Accident Report

1903:02), the CVR recorded the sounds of grunting on the first officer’s hot microphone

channel. Two speech experts who examined these sounds indicated that they were signs

of significant physical effort, greater than the sounds produced by the normal use of flight

or cockpit controls. One speech expert concluded that the sounds indicated that the first

officer was “struggling unusually hard...for example [as] if he was...experiencing an

unusual resistance in the use of a control.” The Safety Board considers it likely that the

soft grunting sound recorded on the CVR at 1903:00.3, shortly after the start of the rudder

reversal, is a manifestation of an involuntary physical reaction by the first officer to the

beginning of the reversing motion of the rudder pedal. 

Without additional input pressure from the first officer, the right pedal would have

tended to push his foot back from the neutral position. However, if the first officer

resisted the reversal, the right rudder pedal would have yielded somewhat. Force on the

right rudder pedal could have returned that pedal to about the neutral position. However,

as the airplane entered a sideslip (resulting from the rudder deflection), the maximum

rudder deflection at blowdown would have increased; thus, the rudder pedal would have

tended to push the pilot’s foot farther aft. 

The CVR recorded louder grunting sounds by the first officer beginning at

1903:01.5, about 0.6 seconds after the rudder pedals would have reached their maximum

uncommanded displacement. Few, if any, actions in the use of normally functioning 737

flight controls would cause a pilot to strain so hard as to grunt.320 The first officer could

not have been grunting because of control column (pitch) inputs; the FDR shows that the

column was moving freely and not against a stop. The possibility that the two pilots

struggled against each other by making opposing inputs is unlikely because the CVR did

not record any straining sounds or forced breathing from the captain or comments from

the flight crew about conflicting inputs. If the autopilot is engaged in the control wheel

steering (CWS) mode, a pilot might grunt while attempting aggressive control wheel

inputs that exceeded the input rate of the autopilot.321 However, no grunting sounds were

recorded about 1902:58, when the autopilot would have been in CWS mode while the first

officer made his first rapid wheel input to the right. Further, both the Safety Board

computer simulations and the Boeing kinematic studies showed the control wheel moving

back toward neutral during the latter portion of the time that the grunting sounds were

made by the first officer. Movement of the control wheel toward neutral would be

associated with relaxation of the pilot’s input force on the wheel rather than the addition to

or maintenance of input force that might have generated the grunting sound.

320 During the 30 minutes of pilot conversation previously recorded by the CVR, neither pilot had

emitted grunting sounds before this time. 

321 Information provided by Boeing indicated that the forces necessary to move the control wheel under

the CWS mode would increase quickly from about 15 to about 40 pounds or more as a pilot exceeded the

input rate of the autopilot. According to ergonomic research, such control wheel forces would be significant

for many pilots controlling the wheel with one hand, but would not be significant for pilots controlling the

wheel with two hands. See McDaniel, J.W. 1995. “Strength Capabilities for Operating Aircraft Controls.”

SAFE Journal 25 (1), pages 28-34. 
Analysis 251 Aircraft Accident Report

The Safety Board was unable to find an explanation for the first officer’s louder

grunting sounds other than his efforts to overcome a rudder system malfunction in which

he was increasing the pressure on the rudder pedal with no apparent effect. Consequently,

for the purposes of the computer simulation of the rudder jam/reversal scenario, the first

officer’s reaction to the rudder reversal was modeled as the application of increasing force

(400 pounds of force within 1 second of the beginning of the reversal) to the right rudder

pedal to oppose the direction of the airplane’s yaw and roll.322

From a human performance standpoint, a rudder reversal malfunction can explain

how a full rudder deflection could have continued despite efforts by the first officer to

correct the situation. The unexpected rudder pedal reversal, combined with the rapid left

roll and yaw of the airplane, would have undoubtedly confused and alarmed the first

officer. Any pilot pushing on the rudder pedal in this situation would know that the pedal

was not responding normally but would have difficulty comprehending, evaluating, and

correcting the situation. A reversal malfunction runs counter to pilot experience, training,

and knowledge. Depressing a rudder pedal during a reversal malfunction would have an

effect contrary to a pilot’s understanding of the function of the rudder system. Increased

pressure on the rudder pedal would not correct the problem.323 As long as the airplane

continues to depart from controlled flight, a pilot reacting to a rudder reversal would likely

maintain at least some pedal pressure in a continued attempt to oppose the uncommanded

yawing and rolling moments. 

During the few seconds after the left rudder deflection that occurred about

1903:00, the accident airplane’s control wheel position was adjusted several times,

eventually reaching nearly full right control wheel, in response to the airplane’s left rolling

and yawing motions. Any pilot faced with an acceleration away from the desired

flightpath could be expected to make an initial control input (about 65° right control wheel

in this case) to assess the effects of the control input; remove some, or all, of the input

when the airplane began to respond (so as not to overcontrol); and converge on the

appropriate input (almost full right wheel in this case). Thus, the Safety Board considered

that the flight crew’s control wheel inputs in response to the initial wake turbulence

encounter and rudder reversal were reasonable pilot reactions to the evolving situation.

Therefore, the flight control inputs used in the Safety Board’s best-match computer

simulation of the USAir flight 427 upset are consistent with the pilot responses that might

be expected during a rudder reversal. Further, the CVR information from the period of the

initial upset is consistent with rudder reversal.

322 Although the Safety Board’s best-match simulation used 400 pounds of force reducing to 200

pounds, based on ergonomic and other research data (as discussed in section 1.18.8), the Safety Board was

also able to obtain an excellent match using only the minimum pedal force necessary to sustain full rudder

authority (about 70 pounds). 

323 As previously indicated, the Safety Board has investigated aviation accidents that have been caused

by flight control reversals (see section 1.16.5.4.8). The Board notes that such reversals are often fatal

because few pilots (even test pilots) are able to absorb the information, analyze it, and apply inputs to correct

the situation in the moments available before the airplane attains an unrecoverable attitude.
Analysis 252 Aircraft Accident Report

The grunting sounds ended at 1903:02.1, when the CVR also recorded the sound

of the autopilot disengaging. According to the Safety Board’s computer simulation, the

wheel was briefly returned to near neutral at that time. The CVR did not record any more

grunting or straining sounds until a few seconds before ground impact. This evidence is

consistent with the first officer slightly relaxing his control wheel and rudder pedal

inputs—perhaps because he thought that he was contending with a malfunctioning

autopilot, in which case autopilot disengagement would restore normal control.

After disengaging the autopilot, the first officer likely focused his attention on

modulating the control wheel inputs or attempting to raise the airplane’s nose and, in the

quickly changing situation, did not return his attention to overpowering the rudder pedal

anomaly. On the basis of the cessation of grunting sounds and the control wheel inputs

that followed, the Safety Board’s computer simulation of the rudder jam/reversal scenario

incorporated a reduction in the pilot’s right rudder pedal pressure to 200 pounds at that

time. Because the rudder feel and centering unit would combine with the pilot’s foot

pressure in applying force to the PCU during a rudder reversal, the rudder reversal could

have continued with a minimum rudder pedal pressure by the pilot of only about 50

pounds. 

2.2.2.2 Pilot Input Scenario

According to the Boeing kinematic solution, the pilots of USAir flight 427 applied

full right control wheel about 1902:58 in response to the left roll and yaw from the

airplane’s encounter with the wake vortex. Boeing proposed that the pilots then applied

left rudder input from about 1902:58 to about 1903:01 in response to a right roll

acceleration (shown in Boeing’s kinematic analysis from about 1902:58 to about 1902:59)

from the control wheel input, which momentarily reversed the airplane’s left rolling

motion. However, such a right roll acceleration would have helped the pilots stop the left

roll and regain a level bank attitude; thus there would be little reason for the pilots to have

opposed the right roll acceleration. (In fact, Boeing’s scenario indicated that, at the time

of the proposed full left rudder pedal input, the right control wheel input had just stopped

the airplane’s left roll.) Although the right roll acceleration toward level flight might have

prompted the flight crew to remove some, or all, of the existing right control wheel input,

it is unlikely that the flight crew would have responded to this right roll acceleration by

applying full left rudder before using the airplane’s roll control authority to the left.

Moreover, both the Safety Board’s computer simulation and Boeing’s kinematic

analysis of this period indicated that the pilots were experiencing the sideload from a yaw

acceleration to the left (caused by the wake vortex). The sideload would logically have

prompted the pilots to apply right, rather than left, rudder. Therefore, the Safety Board

considers it highly unlikely that the flight crew of USAir flight 427 applied full left rudder,

as specified in the pilot input scenario proposed by Boeing.

Further, Boeing’s pilot input scenario requires the flight crew to have sustained the

full left rudder input for at least 10 seconds. In its September 30, 1997, submission and

Human Factors Supplement Submission, Boeing cited four 737 incidents (in October

1986, April 1993, July 1995, and June 1997) in which the FDR data indicated that flight
Analysis 253 Aircraft Accident Report

crew responses to unexpected upsets resulted in momentary cross-control situations.

However, FDR information also showed that the flight crews maintained control of the

airplane. The airplanes’ flight attitudes never exceeded reasonable levels, and the

airplanes never diverged from controlled flight. The control inputs, bank angles, and

headings all converged on stable values, and all of the flights landed safely. 

During the USAir flight 427 upset, the airplane’s increasingly extreme left bank

attitude would have provided the pilots with a consistent and powerful cue to remove any

left control inputs they may have applied. Further, the Safety Board’s review of available

data from previous accidents and incidents obtained from Boeing, the Board’s database,

and accident investigation authorities worldwide indicated that momentary, incorrect

rudder applications by air carrier pilots have occasionally occurred in response to an

unexpected anomaly during a critical phase of flight. However, those events often

occurred in conditions of reduced external visual cues or during abrupt, rapid aircraft

movements and accelerations. Some pilots reported being startled by the in-flight upset,

but no case was found in which a pilot responded to an in-flight upset involving a

sustained yaw or roll by continuing to hold extreme rudder input in a direction opposite to

that required to recover the airplane.

To further evaluate the possibility of a sustained, inappropriate rudder input, the

Safety Board examined numerous possible explanations for the flight crew to have applied

and sustained a full left rudder input until a loss of control occurred. These possibilities

included pilot incapacitation, deliberate pilot action, disorientation, and unintended rudder

pedal activation. 

The Safety Board reviewed documentation from two incidents in which pilot

(specifically, first officer) incapacitation adversely affected the controllability of a 737. In

both cases, the incapacitation occurred suddenly; the first officers stiffened and applied

pressure to a rudder pedal, resulting in a large rudder deflection as the airplanes descended

during the approach to their destination airports. Although both captains reported that

they were startled by the unexpected event, both responded appropriately and were

capable of compensating for inputs made by the incapacitated first officers. Neither of

these cases resulted in a significant loss of control. Further, a review of the available data

from previous accidents and incidents revealed no evidence of pilot incapacitation that

had resulted in a loss of control in other air carrier airplanes. In the case of USAir flight

427, no evidence indicated that pilot incapacitation was involved in the accident sequence

because 

• neither pilot had a medical history that indicated a risk of incapacitation,

• CVR evidence indicated that both pilots were alert and appropriately

responsive during the accident sequence, and

• CVR evidence indicated that neither pilot was alarmed by the behavior of the

pilot or that any medical emergency was occurring.

The Safety Board considered whether either pilot deliberately applied an incorrect

rudder input. However, the remarks and sounds recorded by the CVR during the initial
Analysis 254 Aircraft Accident Report

upset and loss of control indicated that both pilots were surprised by the event and did not

understand its nature or cause. Further, the Safety Board carefully examined aspects of

the pilots’ personal and professional lives and found both pilots to be stable. Moreover,

analysis of the communications and sounds recorded by the CVR indicated that the pilots

expended extraordinary effort in their attempts to recover from the upset throughout the

accident sequence. Therefore, no evidence supports a deliberate action by either pilot to

apply the rudder incorrectly. 

The Safety Board also considered the possibility that one or both of the pilots

became disoriented during the loss of control and was therefore unable to take actions to

recover control of the airplane. The accident and incident records, expert opinions, and

literature regarding spatial disorientation (a phenomenon that occurs when visual and

kinesthetic/vestibular cues are in conflict) indicate that spatial disorientation resulting in a

loss of airplane control is extremely improbable in air carrier operations when strong

external visual cues exist, even if abrupt, rapid airplane movements and accelerations

occur.

Witnesses on the ground and the pilots of other airplanes in the area reported that

the sky was clear with a visible horizon when the USAir flight 427 accident occurred. The

accident airplane was operating in a cruise flight attitude, and the pilots would have had no

obstructions to visual cues. The horizon would have been visible to both pilots when,

according to Boeing’s proposed scenario, the first officer made and held a left rudder

input. Thus, the pilots of USAir flight 427 had ample visual cues available to maintain an

accurate awareness of the airplane’s orientation. 

To illustrate a vehicle operator’s persistence in making an inappropriate control

input, Boeing’s September 30, 1997, Human Factors Supplement Submission suggested

the phenomenon of “unintended acceleration” from automotive safety literature.324 This

phenomenon refers to evidence from automobile accidents that drivers may inadvertently

press the accelerator pedal when they believe that they are applying the brake pedal, which

can lead to the driver pressing even harder on the accelerator pedal in the belief that this

action will slow the motion of the automobile. However, unlike automobile drivers, pilots

use a different foot to activate each rudder pedal. Further, the 737 cockpit layout locates

the stem of the control column and a large rudder pedal adjustment mechanism between

each pilot’s legs, making it physically difficult or impossible to push a rudder pedal with

the wrong leg. Therefore, the possibility that a pilot would activate the wrong rudder

pedal on a 737 is much less than the possibility that an automobile driver would confuse

the accelerator and brake pedals. 

In addition, an important factor in an automobile driver’s persistence in pressing

down the accelerator pedal in such events is the driver’s perception that the brake is being

applied; hence, the driver believes that the more pedal pressure applied, the better chance

324 Schmidt, R.A. 1989. “Unintended acceleration: A review of human factors contributions.” Human

Factors, 31, pp. 345-64. Also, Reinhart, W. “The effect of countermeasures to reduce the incidence of

unintended acceleration accidents.” Proceedings From the Fourteenth International Technical Conference

on Enhanced Safety of Vehicles, Munich, Germany, 1994.
Analysis 255 Aircraft Accident Report

there is for recovery. In this respect, the phenomenon of unintended acceleration in

automobiles may be more instructive with regard to pilot actions and frame of mind in a

rudder reversal scenario than in a pilot input scenario.

The Safety Board analyzed the CVR for possible indications of a left rudder input

by the pilots. The grunting sounds recorded on the first officer’s hot microphone channel

were not well correlated in time with any of the pilot control actions proposed by Boeing’s

scenario that might have resulted in such sounds. According to Boeing, the grunting

sounds occurred after the first officer made a full right control wheel input and the first of

two postulated left rudder inputs. However, neither of the two postulated rudder inputs

would have required more than 70 pounds of force on a normally operating left rudder

pedal. This relatively mild force should not cause a pilot to grunt. Although a pilot could

exert more than 70 pounds of force in holding a rudder at full deflection, there would be

no reason to do so once full left rudder deflection was achieved. 

Also, it is unreasonable that both pilots would have allowed a sustained incorrect

rudder input to continue in the presence of salient cues without one of them recognizing

the error and commenting and/or attempting to correct the rudder’s position. The CVR

did not record any evidence of one pilot being alarmed or struggling against the control

inputs of the other pilot (as might be expected if a pilot made an abrupt and

counterproductive flight control input). Rather, the CVR recorded sounds indicating that

both pilots were surprised by and did not understand the event as it developed from a wake

turbulence encounter into a more critical situation. 

2.2.2.3 USAir Flight 427 Scenario Summary

No evidence indicates that an air carrier pilot has ever responded to an in-flight

upset by applying and holding full rudder in the incorrect direction to the extent that

control was lost. Also, the circumstances of this accident are inconsistent with the pilots

applying and sustaining a left rudder input because of pilot incapacitation, deliberate pilot

action, unintended rudder pedal activation, or spatial disorientation. Further, CVR

information does not support pilot left rudder pedal input as the explanation for the left

rudder deflection in this accident.325 Consequently, the Safety Board concludes that

analysis of the human performance data (including operational factors), does not support a

scenario in which the flight crew of USAir flight 427 applied and held a full left rudder

input until ground impact more than 20 seconds later. The Safety Board further concludes

that analysis of the CVR, Safety Board computer simulation, and human performance data

(including operational factors) from the USAir flight 427 accident shows that they are

consistent with a rudder reversal most likely caused by a jam of the main rudder PCU

servo valve secondary slide to the servo valve housing offset from its neutral position and

overtravel of the primary slide. 

325 Although the rudder pedal pivot lugs on both the captain’s and first officer’s rudder pedal assemblies

were damaged, (see section 1.16.5.1), this damage provided no useful evidence of pilot rudder pedal

activation during the upset.
Analysis 256 Aircraft Accident Report

2.2.2.4 Likelihood of Recovery From a Rudder Reversal 

FDR data and Safety Board computer simulations indicated that, about 1902:59,

the airplane began to roll to the left and pitch slightly nose down, and the control column

position began to move slightly aft. Although the airplane’s left bank continued to

increase by about 1903:02, the nose-down pitch rate had been temporarily arrested by the

aft control column inputs. The airplane’s motions and the aft control column pressure

resulted in a slight increase in vertical load (to about 1.2 Gs). On the basis of the existing

airspeed and the increase in vertical G load, by about 1903:02 the airplane would have

been below the airspeed at which the roll controls (aileron and spoilers) could counter the

effects of the fully deflected rudder (crossover airspeed). Thus, from that time onward, it

would have been impossible for the flight crew to regain roll control without increasing

airspeed and/or decreasing the airplane’s vertical G load.

After the autopilot was disengaged about 1903:02, the airplane’s left bank angle

continued to increase and the control column position continued to move farther aft. As a

result, by about 1903:03, the vertical load had increased to about 1.55 Gs. At that time, aft

control column input would have been an instinctive pilot reaction to try to prevent the

airplane from pitching nose down in a steep bank and maintain the ATC-assigned (and

pilot-selected) altitude. 

During the early seconds of the upset event, the pilots did not likely suspect that

the event was anything other than a strong, but otherwise routine, wake turbulence

encounter. They had no foreknowledge of a rudder reversal or rudder hardover or of the

crossover airspeed phenomenon. Therefore, it is understandable that the pilots of USAir

flight 427 would have, at least momentarily, attempted to maintain their assigned altitude

by increasing control column back pressure. Further, it is extremely unlikely that the

pilots would have been able to diagnose the relationship between airspeed, vertical G load,

and the loss of control in the few seconds available to them after this back pressure

brought the airplane below the crossover airspeed.326

The accident airplane’s FDR data indicated that the control column position

generally continued to move farther aft as the event continued; the airplane continued to

roll left and pitch farther nose down, decelerated a few knots, and began to lose altitude.

About 1903:08, as the airplane descended through about 5,700 feet msl, the stall warning

stickshaker activated, indicating to the pilots that the aft column input was commanding

an angle-of-attack near stall. However, by that time the airplane had attained an extreme

attitude (about 70° left bank and more than 20° nose down), which would have been well

beyond any attitude that the pilots would have experienced in air carrier operations.

About 3 seconds later, when the control column reached its full aft position, the airplane’s

bank angle had gone beyond vertical (90°), and its pitch attitude had exceeded 50° below

the horizon.

326 Boeing pilots who were evaluating the 737’s handling characteristics during postaccident flight tests

identified a stronger-than-expected relationship between vertical G load and the ability to overpower the roll

induced by a full rudder deflection with full wheel input. The pilots reported that “there is some technique

[required] between the G and the roll.”
Analysis 257 Aircraft Accident Report

The Safety Board notes that pilots are trained to respond to the stickshaker

warning by decreasing pitch (column forward). In some previous air carrier accidents

involving stalls, the Board has cited the flight crew as a causal factor in the accident for

failing to take the necessary actions to recover from the stall.327 However, in a rudder

reversal scenario, the pilots of USAir flight 427 would have been struggling to cope with

the rudder’s anomalous movements (in addition to the airplane’s extreme roll and pitch

attitudes) when they also would have been surprised to discover that full left control wheel

input was ineffective in countering the airplane’s steepening left roll. These factors

combined to produce a flight situation and control problems that the pilots of USAir flight

427 had never before encountered in flight or training, including during stickshaker/stall

recovery training. With this series of problems in the course of a few seconds, it is

understandable that the crew was no longer responding in a manner that might have

allowed recovery.328

During postaccident simulator tests,329 test subjects were able to recover from the

USAir flight 427 upset, or at least stabilize the roll to the point at which a continued loss

of control would most likely not have occurred, when they applied a specific recovery

technique (full right control wheel maintained throughout the duration of the event and

forward control column pressure sufficient to reduce G load and maintain a speed above

the crossover airspeed) promptly when the event began. However, unlike the pilots of

USAir flight 427, the simulator test subjects were aware of the circumstances of the

accident, prepared for and expecting the upset event as it occurred, and coached through

the recovery procedure.

When the simulator test subjects varied their responses from the specific

techniques that they were told to apply (for example, when they modified their control

wheel input in anticipation of the simulator’s responses to their inputs), a successful

recovery from the upset event became much less likely. Further, when the simulator test

subjects tried to maintain altitude at the outset of the event, the simulator’s speed

decreased below the crossover airspeed, and recovery became unlikely. 

Therefore, although it was possible to recover from the upset event during its early

stages, such a recovery would have required the pilots to immediately abandon their

normal pitch control criterion (maintaining altitude) and hold full control wheel inputs

against the roll. These actions may be successful with prior awareness of the effects of a

327 See, for example, National Transportation Safety Board. 1997. Uncontrolled Flight Into Terrain,

ABX Air Inc. (Airborne Express), Douglas DC-8-63, N827AX, Narrows, Virginia, December 22, 1996.

Aircraft Accident Report NTSB/AAR-97/05. Washington, DC. 

328 No reliable aerodynamic model exists for the 737’s flight characteristics in a stall; consequently, the

Safety Board could not evaluate the possibility of recovery after activation of the stickshaker. The Safety

Board notes, however, that if the pilots had reacted to the stickshaker by reducing aft control column

pressure only enough to silence the stickshaker (as air carrier pilots are trained to do in a minimum altitude

loss stall recovery), the airplane would have remained below the crossover airspeed for the existing vertical

G load, and the pilots would not have regained control of the airplane. 

329 These simulator tests were conducted in Boeing’s M-CAB simulator using the accident airplane’s

FDR data and a rudder hardover (induced either manually or electronically) to represent the USAir

flight 427 upset condition. 
Analysis 258 Aircraft Accident Report

rudder reversal and the crossover airspeed, as shown by the simulator tests. The Safety

Board concludes that the flight crew of USAir flight 427 recognized the initial upset in a

timely manner and took immediate action to attempt a recovery but did not successfully

regain control of the airplane. However, because the pilots did not have foreknowledge of

the problem, immediate awareness of its onset, and prior training and experience with the

crossover airspeed phenomenon, the Safety Board concludes that the flight crew of USAir

flight 427 could not be expected to have assessed the flight control problem and then

devised and executed the appropriate recovery procedure for a rudder reversal under the

circumstances of the flight. 

2.3 United Flight 585 Upset 

2.3.1 United Flight 585 Computer Simulation Analysis 

FDR330 and radar data, the accident location, and wreckage orientation were used

as data points in the Safety Board’s computer simulation studies of United flight 585.

Because the FDR did not record roll or sideload information, it was not possible to

positively determine whether the recorded heading changes were the result of a roll or a

sideslip followed by a roll.331 Other variables had to be factored into the simulation

studies. The winds and turbulence encountered by United flight 585 during the approach

undoubtedly acted on the airplane during the upset and descent. Because the exact winds

encountered by the airplane were not known, the winds could be reasonably varied during

the simulations, resulting in a number of possible scenarios that would be consistent with

the radar data and the limited FDR data. Pilot pedal input force was another variable that

was incorporated in the simulations.

The Safety Board employed several computer simulation scenarios in which the

resulting heading data matched the available FDR data. These simulations used rudder

position time histories that assumed jams of the secondary slide to the valve housing at

various positions from the neutral position (100, 71, 50, 40, and 30 percent), and a

concomitant rudder reversal. (Each of the rudder-related solutions required a control

wheel response opposing the roll). 

The Safety Board’s best-match computer simulation was one in which the

secondary slide jammed at 100 percent off its neutral position and, about 0943:32,332 the

rudder reversed in response to the pilot’s attempt to make a left rudder input. In this

simulation, the airplane’s right yaw rate had reached 4.7° per second just before the rudder

reversal because of the effects of a wind gust (a 17-knot decrease in the wind velocity for

3 seconds as the airplane descended on its approach). The Safety Board incorporated this

330 United flight 585 was equipped with a five-parameter FDR, which recorded microphone keying,

airspeed, altitude, and heading at once-per-second intervals and vertical Gs at 8 times per second.

331 Simulations using a control wheel input could produce a scenario involving only a roll, whereas

simulations using a rudder movement could produce a scenario involving a sideslip followed by a roll, both

of which could be consistent with the recorded data.

332 All times in this section and section 2.3.2 are mountain standard time, based on a 24-hour clock.
Analysis 259 Aircraft Accident Report

wind velocity change with decreased altitude into its computer simulation to match the

heading data recorded by the FDR from about 0943:28 to about 0943:31. The heading

output from the Safety Board’s best-match simulation matched the FDR heading data

within 1° or less and matched the character of the data. 

The Safety Board’s computer simulations that used right control wheel input alone

(and no rudder movement) also produced heading results that matched the available FDR

data. However, that solution was not considered to be realistic because it required the

pilots to fly the airplane into the ground when simple wheel corrections could prevent this

occurrence. The Safety Board has no evidence that the pilots of United flight 585 would

have deliberately flown the airplane into the ground.333 

The Safety Board could also match the FDR data by assuming that the increasing

roll was the result of a rotational external wind, such as a mountain rotor. The Safety

Board considered the possibility that a mountain rotor forced the airplane along the

accident flightpath.334 With the weather conditions present in the area on the day of the

accident (strong westerly winds flowing over the mountains located west of the accident

site), rotors could have been generated, rotating in a clockwise direction (from United

flight 585’s perspective on the approach). These rotors would have likely been moving to

the east (pilots’ left to right) with the wind at an unknown altitude; however, it is possible

for a mountain wave to trap a rotor, resulting in a “standing” rotor, which would not move

with the wind. 

In a June 23, 1997, letter to the Safety Board, Boeing indicated that a “rudder

hardover scenario” did not fit the United flight 585 FDR data but that a “new rotor model”

it developed did fit the data. This Boeing model proposed an encounter with a rotor that

followed the flightpath of the accident airplane and increased in strength to about 1.8

radians (103°) per second as the airplane descended to the ground. However, according to

NOAA scientists, the strongest rotors ever documented in the Colorado Springs area had a

strength of about 0.05 radians per second. Further, a NOAA/National Center for

Atmospheric Research (NCAR) report335 indicated that researchers have not documented

rotors that would descend to the ground in increasing strength, such as the one proposed

by Boeing. 

The Safety Board evaluated the accident airplane’s FDR information for signatures

that would be expected if the airplane encountered a rotor. In addition to changes in

333 Reports from other pilots who had flown with the captain (the flying pilot on United flight 585

indicate that he was a very conservative and conscientious pilot. These reports are consistent with the

captain’s conduct on the accident flight, as documented on the CVR.

334 The Safety Board considered several mountain rotor scenarios, including moving rotors above,

below and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s

flightpath; and horizontal rotors that transition to vertical rotors along the airplane’s flightpath.

335 The NOAA/NCAR interim report (prepared in response to Safety Recommendation A-92-57) was

entitled A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs

Area: Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997). The NOAA/NCAR final report

has not been completed; however, the Safety Board has reviewed a draft of the final report and reflected its

content in this analysis. 
Analysis 260 Aircraft Accident Report

heading, the signatures would have included changes in indicated airspeed and altitude

resulting from the effects of the low ambient pressure within the rotor. None of these

expected pressure signatures were found. Although encounters with translating rotors at

certain angles might not produce these pressure signatures, the masking of the FDR

signatures would occur only while an airplane was entering such a rotor. United flight 585

could not have penetrated a rotor’s low pressure core and remained there for 8 seconds

(the time that the airplane would have had to remain in the rotor for the heading output and

the flightpath to match the FDR data) without pressure changes from the rotor producing

changes in airspeed and altitude. Further, none of the sounds that are normally

characteristic of intense rotors were recorded by the accident airplane’s CVR, and

witnesses on the ground did not report such sounds at the time and location of the

accident. 

On the basis of the absence of the signatures of a rotor penetration on the FDR, the

absence of recorded/reported characteristic rotor sounds, and the small likelihood that a

rotor of the necessary strength and orientation would have matched the airplane’s

flightpath to the point of ground contact, the Safety Board concludes that it is very

unlikely that the loss of control in the United flight 585 accident was the result of an

encounter with a mountain rotor. 

2.3.2 United Flight 585 Human Performance Analysis

On the day of the United flight 585 accident, pilots flying in the area of the

Colorado Springs airport had reported moderate to severe turbulence, gusty winds, and

windshear. Information recorded by the CVR and FDR indicated that, as the captain (who

was the flying pilot) maneuvered the airplane in the traffic pattern, the airplane

encountered wind gusts and windshear that resulted in 10-knot airspeed changes. Because

of the turbulence and wind gusts, and because he was preparing for a crosswind landing,

the Safety Board considers it likely that the captain had his feet on the rudder pedals as he

aligned the airplane on its final approach. 

According to the Safety Board’s best-match computer simulation, about 0943:20,

the airplane rolled rapidly (about 10° per second) to the right to a bank angle of about 27°

and returned to approximately a level flight attitude. This bank was entered more rapidly

and was steeper than the bank a pilot would likely have commanded for a heading

adjustment to track the extended centerline of the runway. Consequently, the Safety Board

assumed that the right roll was caused by an eddy or rotational wind component. (The

recovery from this right roll, however, was presumed to have been a result of control

wheel inputs made by the captain beginning about 1 second after the airplane’s roll

accelerated to the right.)

The Safety Board’s review of the CVR, FDR and radar information revealed that,

about 0943:28 (8 seconds after the 27° uncommanded right roll), the airplane was flying at

160 knots with 30° of flaps and the landing gear extended and was nearly aligned on the

final approach for the runway. According to the CVR, at 0943:28.2, the first officer

advised “we’re at a thousand feet [above the ground].” The FDR indicated that, about
Analysis 261 Aircraft Accident Report

0943:30, another right heading change began and continued at a rate of 4.7° per second.

In its computer simulation, the Safety Board matched this heading change by introducing

a crosswind gust component, resulting in right yaw. The yaw rate was sustained for more

than 3 seconds before a rapid right roll developed. This sustained yaw would have been

apparent to the captain as motion of the ground and sky features relative to the fixed

reference of the airplane’s windshield area. This heading change would have been

especially salient to the captain because the runway, with which he was trying to maintain

alignment, would have been visible ahead. 

The Safety Board’s simulation scenario assumed that the captain responded to the

sudden, rapid, and sustained heading change by applying left rudder pedal input about

0943:32. The timing of this input (about 3 seconds after the peak yaw rate was attained)

would be consistent with the time required for the pilot to perceive the yaw, wait a

moment for the effect of the turbulence to subside (to avoid overcontrolling), decide that a

left rudder input was required, and then apply the left rudder pedal input. The Safety

Board’s simulation postulated that this left rudder input initiated a rudder reversal to the

right. According to the Safety Board’s simulation, at 0943:33.5 (about 1.5 seconds after

the rudder reversal began), when the captain signaled his decision to abandon the

approach by stating “fifteen flaps,” the bank angle had not exceeded 20°, and the pitch

angle was 8° nose down (approximately what it had been during the normal descent in the

period leading up to the upset). However, speech analysis indicated that the captain’s

“fifteen flaps” statement displayed a heightened level of speech fundamental frequency

that was consistent with a sense of urgency. This sense of urgency was also indicated by

the captain’s omission of a call-out item in the normal go-around procedure.336 Although

many factors may have precipitated a go-around decision by the captain, a flight control

difficulty, such as that produced by a rudder reversal, would have been consistent with the

captain’s speed and urgency in making this decision.

If the captain applied force to the left rudder pedal, he would have felt the pedal

push strongly back against his foot pressure. Further, the Safety Board assumed that the

captain would have acted to oppose a continuing uncommanded right yaw that was being

sustained by a reversing rudder; thus, the Safety Board’s computer simulation of the event

increased the captain’s force on the left rudder pedal to 300 pounds within 1 second.337

During postaccident simulator exercises, the Safety Board determined that an

immediate full left control wheel response during a right rudder reversal in the airspeed

and flap configuration of United flight 585 could have allowed the flight crew to maintain

control of the airplane. However, during a rudder jam and reversal, the captain of United

flight 585 would have been contending with the distraction of the malfunctioning rudder

and thus would have been devoting his physical effort to overpowering the rudder pedals.

Further, the airplane’s yawing motion and heading changes (derived from the Board’s

336 The captain did not state aloud “go-around thrust,” as specified in United’s go-around procedure.

337 Although the Safety Board’s best-match simulation used 300 pounds of force reducing to 200

pounds, based on ergonomic and other research data (as discussed in section 1.18.8), the Safety Board was

also able to obtain an excellent match with the FDR data using only the minimum pedal force necessary to

sustain full rudder authority (about 70 pounds) and using 500 pounds of force.
Analysis 262 Aircraft Accident Report

computer simulations) would have produced stronger cues than those produced by the

rolling motion during the first few seconds of the upset, so the captain was likely focusing

his attention on the rapid yaw acceleration that he could not control with the rudder. 

These circumstances would have been extremely confusing and distracting and

would have been unknown to the flight crew based on previous experience. Thus, it

would be understandable for the captain to have initially made a partial wheel input while

contending with the powerful physical and mental demands of the problem with the

rudder. The CVR evidence of increasing engine thrust indicated that the captain would

have been using his right hand to advance the thrust levers for an attempted go-around.

Thus, the captain would have had only his left hand available to rotate the wheel to the

left, which would have made it difficult to achieve large left control wheel deflections.

(This motion would have required the captain to pull his left arm down and across his

body while twisting his left wrist.)

Further, at the time of the left rudder input in the Safety Board’s simulation, the

airplane was in about a 5° right bank. According to the Board’s assumption that the

captain applied moderate left wheel (about one-third of the available control wheel) about

2 seconds later, the airplane would have been in a right bank of about 30°. On the basis of

the time required for the captain to perceive the need for and execute his control input

(about 3⁄4 second), the bank angle that the captain would have been responding to with this

moderate control wheel input was about 15°. With this relatively shallow roll angle, it

would be normal for a pilot (especially an air carrier pilot) to first apply a moderate

control input and then gauge the airplane’s response before making an extreme control

input. (The Safety Board considers it likely that the first officer’s statement “Oh God” at

0943:32.6 referred to her concerns about the abrupt, sustained yaw rate and heading

change resulting from the rudder’s reversal movement to its right blowdown limit and not

about the airplane’s roll attitude or rate of change because the roll attitude was not

excessive at that time.) The Safety Board’s computer simulation further indicated that the

captain applied full control wheel to the left about 2 seconds later.

The computer simulation results also indicated that, within 2 seconds of rudder

reversal, the pilots were experiencing as much as 0.44 G of sideforce from the right yaw

acceleration. This sideforce would have made a left wheel input even more difficult for

the captain because his body would have been pulled to the left and away from the control

wheel, causing a tendency to level the wheel unless he quickly returned his right hand to

the controls. 

Therefore, because of the unknown nature of a rudder reversal, the initially

shallow roll angle, and the physical limitations that would have hindered an immediate

full left control wheel input, the Safety Board considers it understandable that the captain

might not have immediately applied a full left control wheel input to counter a reversing

rudder.

The Safety Board’s computer simulation showed that, about 0943:34, the bank

angle of the airplane transitioned suddenly; by about 0943:35, only 3 seconds after the

reversal, the right bank angle had increased to more than 80°. The Safety Board’s
Analysis 263 Aircraft Accident Report

simulation also showed that the captain, at that time, rapidly moved the control wheel

fully to the left. The airplane’s pitch angle had decreased to almost 30° nose down, and

the pilots would have been able to see only the ground through the windshield. The Safety

Board would expect that the captain would no longer be applying as much force to the left

rudder pedal because he was likely focusing on holding a full left wheel input and

attempting a go-around and the left rudder pedal would have forced him to a less efficient

knee angle. Consequently, the Board’s computer simulation of the event moderated the

captain’s force on the left rudder pedal to 200 pounds at that time.

Shortly thereafter (perhaps in response to the loss of attitude reference), the captain

apparently removed some of his left wheel inputs, possibly because he was concentrating

on aft control column pressure in an attempt to raise the airplane’s nose. By about

0943:36, the airplane rolled into an inverted attitude and the captain said “no” very loudly.

Ground impact occurred about 5 seconds later, only 9 seconds after the rudder reversal

began.

The Safety Board concludes that analysis of the CVR, Safety Board computer

simulation, and human performance data (including operational factors) from the United

flight 585 accident shows that they are consistent with a rudder reversal most likely

caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve

housing offset from its neutral position and overtravel of the primary slide. Also, because

the United flight 585 upset occurred when the airplane was less than 1,000 feet above the

ground, the pilots had very little time to react to or recover from the event. Thus, the

Safety Board concludes that the flight crew of United flight 585 recognized the initial

upset in a timely manner and took immediate action to attempt a recovery but did not

successfully regain control of the airplane. The Safety Board further concludes that the

flight crew of United flight 585 could not be expected to have assessed the flight control

problem and then devised and executed the appropriate recovery procedure for a rudder

reversal under the circumstances of the flight. The Safety Board also concludes that the

training and pilot techniques developed as a result of the USAir flight 427 accident show

that it is possible to counteract an uncommanded deflection of the rudder in most regions

of the flight envelope; such training was not yet developed and available to the flight

crews of USAir flight 427 and United flight 585. 

2.4 Eastwind Flight 517 Upset

The logbook records for the Eastwind flight 517 airplane indicated that a series of

flight crew-reported rudder-related anomalies (uncommanded rudder movements and

rudder pedal “bumps”) occurred during the month before the upset event. As a result of

these anomalies, the main rudder PCU was removed and replaced on May 14, 1996, and

the yaw damper transfer valve and yaw damper position transducer were removed and

replaced on June 8, 1996.338 The captain of the incident flight, who had experienced some

of the previous rudder pedal bumps, conducted the postmaintenance flight test on the

338 On June 2, 1996, Eastwind issued a bulletin to all flight crews advising them to report any

“unexplained” yaw events.
Analysis 264 Aircraft Accident Report

morning of the incident flight. The captain noted no rudder system anomalies during the

test flight or the incident flight until the upset event began. 

The Safety Board’s postincident examination of the incident airplane’s rudder

system components revealed several anomalous conditions, including a misadjusted yaw

damper linear variable displacement transducer (LVDT) and chafed wiring between the

yaw damper coupler and the main rudder PCU. Either of these conditions might have

resulted in anomalous rudder behaviors. The misadjusted LVDT would have changed the

yaw damper’s authority over the rudder from the specified 3° left or right of neutral to 1.5°

left of neutral to 4.5° right of neutral with no aerodynamic loads on the rudder. Chafed

wiring could cause a short circuit, which could result in a yaw damper hardover command.

Although the Safety Board was unable to positively identify the source of the rudderrelated anomalies, a short circuit related to the chafed wiring may have caused a yaw

damper hardover during the incident.339

Safety Board simulations and Boeing kinematics studies revealed that the heading

change observed in the Eastwind airplane’s FDR data required a right rudder deflection of

about 6 to 6.5°. This rudder movement is larger than the yaw damper could command

(even allowing for the misrigged LVDT and compliance in the system, the yaw damper

could only command 3.95° of right rudder movement in flight).340 Further, although

examination of the Eastwind flight 517 PCU components revealed a higher-than-normal

hydraulic fluid leakage at the bypass valve (resulting in a reduced hinge moment, which

would result in a reduced blowdown rudder deflection),341 the aerodynamic blowdown

limit for the Eastwind flight 517 incident airplane, assuming normal (unreversed)

operation, far exceeded the 6 to 6.5° rudder deflection that was apparently involved in the

incident.342 

Examination of internal measurements of the Eastwind flight 517 PCU servo valve

revealed that it had relatively tight clearances, similar to those measured in the USAir

flight 427 PCU servo valve. Thus, the Eastwind servo valve (similar to the USAir servo

339 The postincident removal and replacement of all components and wiring associated with the incident

airplane’s yaw damper system apparently eliminated the source of the rudder bumps; since then, there have

been no pilot complaints or maintenance writeups regarding rudder bumps or other anomalous rudder

behavior. 

340 Although the misadjusted LVDT allowed for 4.5° of movement to the left on the ground, the rudder

movement with aerodynamic loads in flight would have been 3.7°. This estimate has an error band of

± 0.25°, yielding an estimated maximum right rudder deflection (caused by the yaw damper) of 3.95°. 

341 Although the bypass valve allowed higher-than-normal leakage, which affected the rudder’s

blowdown deflection, the leakage was not significant enough to prevent the Eastwind PCU from

successfully completing Parker’s acceptance test procedure functional tests at the full PCU level. However,

when the bypass valve was removed from the PCU package and tested independently, it did not successfully

complete the bypass valve functional tests. 

342 According to Boeing, the rudder blowdown limits for the Eastwind flight 517 incident airplane

(including the reduced hinge moment from the PCU’s excessive leakage at the bypass valve) would have

been about 9° when operating at 250 knots under normal (unreversed) pilot command, with the variation

depending on the sideslip value. 
Analysis 265 Aircraft Accident Report

valve) would be more likely to jam than a servo valve with greater clearances (such as the

new-production PCU servo valve also subjected to these tests). 

2.4.1 Eastwind Flight 517 Computer Simulation Analysis

Eastwind flight 517 was equipped with an 11-parameter FDR that included vertical

acceleration, pitch, roll, and heading. Because heading data were recorded only once per

second, several computer simulations resulted in reasonable matches of the FDR heading

data (and vertical acceleration, pitch, and roll data). (FDR heading data sampled at more

frequent intervals would have likely resulted in fewer computer simulations that match the

data reasonably well.) The Safety Board’s best-match simulation assumes that the rudder

surface was trimmed to neutral to compensate for the offset yaw damper. This scenario

also assumes that, about 2210:31, the pilot stepped on the left rudder pedal to counter a

yaw damper hardover of 3.95° to the right that had occurred about 2 seconds earlier; the

yaw damper hardover created a yaw acceleration that peaked at more than 7°/sec2 and a

lateral acceleration in the cockpit above 0.1 G. This scenario further assumes that the

secondary slide was jammed to the servo valve housing about 55 percent off neutral and

that, when the pilot applied force to the left rudder pedal, the rudder moved in a direction

opposite that commanded to about 6.5° right (the blowdown limit with the leaking bypass

valve and the reduced rudder hinge moment from the secondary slide jam at 55 percent

from neutral). 

The Safety Board’s simulation results matched each FDR heading and roll data

point within about 1°. The results also matched well with the FDR recorded vertical

acceleration data. 

Boeing proposed a scenario in which a yaw damper hardover of 3° right (from 1.5°

left because of the misrigged LVDT) occurred during the ground roll. Boeing further

proposed that the pilots added 3° of left rudder trim to compensate for the yaw damper

input.343 According to Boeing’s scenario, the fault that initially moved the yaw damper to

3° right cleared just before 2210:28, and the rudder then moved rapidly 3.7° to the left,

resulting in a left yaw about 2210:28. Boeing’s scenario indicated that the pilot responded

with right rudder pedal, commanding the rudder to about 6° right and causing the airplane

to yaw right. In Boeing’s scenario, the pilot maintained the right rudder pedal input, and

the yaw damper remained active and responded appropriately.344 

Boeing used its kinematic analysis to derive flight control surface position time

histories (particularly the rudder position time history). This effort required Boeing to

curve fit the once-per-second FDR heading data, which Boeing accomplished with a

manual, nonlinear fit of the heading data, as shown in figure 32. To justify a right rudder

343 The Eastwind pilots’ statements indicated that the yaw damper behaved normally during the

maintenance test flight that occurred before the incident flight and was observed in the neutral position

during the ground operations before takeoff of the incident flight.

344 The Boeing scenario was described in its August 14, 1998, Submissions Supplement to the USAir

flight 427 accident investigation. In a document dated February 24, 1999, Boeing provided updated data in

support of its scenario.
Analysis 266 Aircraft Accident Report

input by the pilot about 2210:29, Boeing introduced a left heading change between

2210:28 and 2210:29 (in response to the postulated left rudder movement from the release

of the yaw damper hardover about 2210:28) through its manual nonlinear curve fit of the

FDR heading data, even though the FDR data did not reflect a left heading change.

(Further, both the flight crew and the lead flight attendant recalled a yaw to the right as the

initiating event.). When this manual curve fit of the heading data was used in Boeing’s

kinematic analysis, the results indicated a left rudder movement about 2210:28 that was

consistent with Boeing’s scenario of the release of the yaw damper hardover at that time.

Boeing then used this rudder surface time history (and other control surface time histories)

as input data in its computer simulation to produce airplane motion parameters, including

heading.

Boeing asserted that its analysis demonstrated rudder activity during the event,

which it considered evidence of the yaw damper activity during the event (and therefore

evidence that the rudder was not jammed and did not reverse). However, the basis for this

assertion that the yaw damper was active during the event is the rudder activity resulting

from Boeing’s kinematic analysis, which in turn resulted from Boeing’s manual, nonlinear

curve fit of the FDR heading data. Although the Safety Board cannot prove that the left

heading change introduced into Boeing’s curve fit about 2210:28 did not exist, no

evidence indicates that it did. Further, the heading change does not match the character of

the heading data between about 2210:27 and about 2210:30.

Further, Boeing used the rudder time history resulting from its kinematic analysis

and the concomitant rudder activity to conclude that the yaw damper was active.

However, because of the noise inherent in the curve-fitting process, these results do not

prove that the yaw damper was active but only allow for this possibility. The Safety

Figure 32. Boeing’s curve fit of the FDR heading data from Eastwind flight 517.

22:10:25.00 22:10:30.00 22:10:35.00

233

234

235

236

237

238

239

240

241

Eastwind Event

Boeing Solution

from fig 16 of August 14, 1998 submittal

 FDR data

 Boeing Heading Curve fit

 Boeing Simulator Heading

Heading (deg)

Time (hr:min:sec)
Analysis 267 Aircraft Accident Report

Board’s computer simulations, which assumed that the secondary slide jammed to the

servo valve housing about 55 percent from its neutral position after the pilot input left

rudder (about 2210:30) in response to a right yaw damper hardover (about 2210:28), did

not require yaw damper activity to achieve its match.

Boeing’s computer simulation results and the Safety Board’s results matched the

FDR data well, with the resulting heading data from both simulations matching the FDR

heading data within 1°. Further, within the approximately 12 seconds of significance

(about 2210:28 to about 2210:40), the character of the resulting heading data from both

the Boeing and Safety Board simulations is generally consistent with the character of the

FDR heading, except for the hump in the heading data between 2210:28 to 2210:29

introduced by Boeing’s curve fit for its kinematic analysis. 

Boeing’s simulation, however, suffers from a timing deficiency: its simulation

presumes a right pedal input by the pilot about 1⁄4 second after the postulated clearing of

the yaw damper hardover in reaction to a heading change of less than 0.5° and a peak

heading change rate of only 1.4° per second. Further, Boeing’s simulation results in a 6°

right rudder deflection. However, the blowdown limit for Eastwind flight 517 at that time

(without a reversal scenario)345 would have been about 9°, even with the higher bypass

leakage rate. Thus, the Boeing scenario requires that the pilot only partially depress the

right rudder pedal to move the rudder surface to match the simulation deflection. 

2.4.2 Eastwind Flight 517 Human Performance Analysis

The captain of Eastwind flight 517 had adopted a personal technique of routinely

disengaging the autopilot as his airplane descended through 10,000 feet mean sea level

(msl). Consequently, when Eastwind flight 517 approached Richmond on the night of the

incident, the captain was hand flying the airplane with his feet on the rudder pedals. 

The weather on the night of the incident was reported to be clear with relatively

calm winds. The airplane was descending through 4,300 feet msl when the captain felt a

motion that he later described as a “bump” on the right rudder pedal. The captain reported

that, almost immediately afterward, he felt a sharp yaw to the right followed by a right

roll. The captain stated that the rudder pedals displayed little, if any, displacement. This

report is consistent with the 3.95° nose right yaw damper hardover about 2210:29 in the

Safety Board’s computer simulation scenario. 

In postincident interviews with Safety Board investigators, the captain stated that

he immediately applied “opposite [left] rudder and stood pretty hard on the pedal.” He

said that the “rudder moved, but felt stiffer than normal.” The first officer told

investigators that he observed the captain “fighting, trying to regain control” and

“standing on the left rudder [pedal].” The captain further stated that the rudder pedal

moved but did not depress to the floor. He believed that these actions slowed the event but

that the airplane was still trying to roll. 

345 In a reversal scenario, the leaking bypass valve and the reduced hinge moment caused by a

secondary slide jam would have reduced the blowdown limit to 6.5o.
Analysis 268 Aircraft Accident Report

These pilot statements are consistent with the Safety Board’s computer simulation

scenario in which the main rudder PCU servo valve’s secondary slide jammed and the

rudder moved in the direction opposite to that commanded by the pilot. The Safety

Board’s simulation studies indicated that, after the rudder initially deflected 3.95° to the

right, it increased its deflection to about 6.5° to the right within the next 2 seconds. This

2-second period from yaw damper hardover to reversal of the rudder was adequate time

for the captain to perceive the effects of the yaw damper hardover as a sideload upon his

body and react with left rudder input. The Safety Board’s computer simulation assumed

that this left rudder input initiated a rudder reversal by causing the primary slide of the

servo valve to overtravel. 

Thus, as the captain added left rudder pedal input, under the Safety Board’s rudder

reversal scenario, the rudder would have moved the remainder of the distance to its right

blowdown limit (to about 6.5° right) with little movement of the left rudder pedal back

against the captain’s foot. Under the assumption that the captain continued to apply an

increasing amount of force to the left rudder pedal to counter the right yaw/roll (from the

reversing rudder), the left rudder pedal would have moved slightly forward without

removing the uncommanded right rudder deflection. The rudder pedal motion and force

required to move the pedal are consistent with the captain’s report of rudder pedals that

moved but felt “stiffer than normal.” Further, because both pilots reported that the captain

exerted substantial force on the left rudder pedal (by “standing on” it), the Safety Board’s

computer simulation of the jam/reversal scenario modeled the captain’s rudder pedal force

as an increase to 500 pounds within 1 second.346

The captain stated that, as the event continued, his wheel inputs appeared to stop

the roll but did not correct the condition. The captain increased the right engine’s power,

hoping that differential engine thrust would counter the airplane’s right yaw/roll.

According to the FDR, when the right engine’s thrust increased, the captain’s initial

control inputs had recovered the airplane from its right rolling moment and rolled the

airplane back through level flight to a stable left bank attitude of about 5 to 15°.

The Safety Board’s computer simulation shows the captain relaxing both control

wheel and rudder inputs about 2210:34 as differential engine thrust became effective and

as the captain attempted to restore a level bank attitude. According to the Safety Board’s

scenario and the captain’s recollection, the captain had achieved a stable, though

uncoordinated (cross-controlled), flight condition with only moderate control wheel inputs

required. Given the stability of the situation, particularly with the airplane already in a left

bank, it would have been reasonable for the captain to have relaxed some of his rudder

pedal and control wheel inputs. At this time, the Safety Board’s computer simulation

shows the captain relaxing his rudder pedal force to 250 pounds.

346 Although the Safety Board’s best-match simulation used 500 pounds of force reducing to 250

pounds, based on ergonomic and other research data (as discussed in section 1.18.8), the Safety Board was

also able to obtain excellent matches with the FDR data using only the minimum pedal force necessary to

sustain full rudder authority (about 70 pounds) and using 300 pounds of force.
Analysis 269 Aircraft Accident Report

The captain stated that, when the uncommanded event continued, he reached for

the yaw damper switch (located on the overhead panel above the captain’s head) and

disengaged the yaw damper. Seconds later, the yaw/roll event ended (about 12 seconds

after it began, according to FDR data). The captain stated that he did not believe the end

of the event was directly related to the yaw damper disengagement. However, the Safety

Board considers it possible that the captain may have (unknowingly) eased his pressure on

the left rudder pedal when he reached for the yaw damper switch or afterward as he

assessed the effect that the yaw damper disengagement had on the yaw/roll event. (The

Safety Board modeled this scenario in its computer simulation of the event with a further

reduction in left rudder pedal pressure about 2210:40.) If the captain relaxed his force on

the left rudder pedal to less than about 50 pounds, a rudder reversal resulting from a

secondary slide jam to the servo valve housing might have ended (that is, the primary slide

might have returned to neutral from its overtravel position). 

Unlike United flight 585 and USAir flight 427, Eastwind flight 517 was moving

throughout the event at a speed that remained well above the crossover airspeed. Thus,

the flight crew of Eastwind flight 517 had sufficient roll control authority to overcome the

effects of a full rudder deflection. This roll control authority was clearly a factor in the

ability of the flight crew to recover from the event. 

In addition to the human performance aspects of the Eastwind flight 517 reversal

scenario, the Safety Board reviewed the human performance aspects of the pilot input

scenario proposed by Boeing. As discussed in section 2.4.1, Boeing’s scenario proposed

that a yaw damper hardover, which had occurred while on the ground before departure,

resulted in a constant 3.7° right rudder input at the beginning of the flight. The scenario

further proposed that the pilots then applied an equal and opposite amount of left rudder

trim so that the rudder surface was about neutral with respect to the vertical fin.

During interviews with investigators, the captain of Eastwind flight 517 did not

recall having trimmed the rudder at any time before the beginning of the yaw/roll incident.

Further, the captain indicated that he never used more than 1⁄2 unit of rudder trim during

routine flight operations. Therefore, the need to trim the rudder by more than 3 units (as

indicated in Boeing’s scenario) would most likely have been salient and memorable to the

captain. Further, the pilots of Eastwind flight 517 had been aware of previous rudder

anomalies with the incident airplane, and they had test flown the airplane immediately

before the incident flight to verify the proper function of the rudder system. Therefore, the

pilots would have been more likely to note and recall a requirement for 3 units of rudder

trim if it had occurred. 

Boeing’s pilot input scenario also proposes that the yaw damper hardover released

between 2210:28 and 2210:29 and that the pilots immediately responded to the resulting

left yaw with right rudder input. This scenario postulates that the pilots reacted within less

than 1⁄4 second after the beginning of the rudder’s leftward motion. (The scenario must

include such a rapid pilot response to the postulated release of the yaw damper hardover

because the entire initiating event—release of the yaw damper hardover and pilot right

rudder input—must take place within the 1-second interval between the FDR heading data
Analysis 270 Aircraft Accident Report

points at 2210:28 and 2210:29, or the Boeing simulation heading time history would not

match these FDR heading data.)

According to human factors literature on reaction time,347 it is unlikely that a pilot

could detect an unusual situation, recognize what was happening, decide how to respond,

and make a motor response in a time period as little as 1⁄4 second. At the beginning of the

postulated yaw damper hardover release, no substantial cues would have signaled the

Eastwind pilots to respond with an immediate rudder input. The motion of the rudder

from the yaw damper hardover release would have provided no feedback to the rudder

pedals. Although yaw acceleration (perceived by the pilots as sideload) would have begun

almost immediately after the rudder movement started, it would not have reached 0.05 G

until about 1/3 second after rudder movement began and its peak of approximately 0.1 G

until about 1⁄2 second after rudder movement began.348 Airplane heading, which could

have been apparent to the pilots during the night flight as motion of lights on the ground

relative to the airplane, would have changed less than 1° during the 1⁄4-second period after

the yaw damper hardover release. Consequently, the cues that might have alerted the

flight crew to a yaw damper hardover release would not have developed until most, or all,

of the 1⁄4-second period had elapsed. Finally, the pilot would have been required to make a

foot response, which can be 20 percent slower than a hand response.349 

When the captain of Eastwind flight 517 was subjected to a yaw damper hardover

in the test flight conducted after the event, he took 3/5 second to initiate a rudder pedal

input in response to the hardover. This reaction time is probably less than the captain’s

reaction time would have been during the incident flight because he knew the test flight

would involve a sudden rudder event and he knew exactly how to respond. Therefore, on

the basis of these human reaction time capabilities, the flight crew of Eastwind flight 517

would not have likely been able to react to the cues from an unexpected yaw damper

hardover release in less than 1⁄4 second.

To match the FDR data from the Eastwind flight 517 incident, Boeing’s pilot input

scenario also required the pilots to have applied and held about 6° of right rudder for 10

seconds or more after the postulated yaw damper hardover release.350 However, the

scenario’s requirement for pilot right rudder input is inconsistent with the statements of

the captain and first officer: both recalled that the captain applied left rudder. Further,

both pilots recalled that the captain made a substantial rudder input (describing his actions

347 See Sens, M.J., Cheng, P.H., Wiechel, J.F., and Guenther, D.A. 1989. Perception/reaction time

values for accident reconstruction. Warrendale, Pennsylvania: Society of Automotive Engineers, Paper

890732. Woodson, W.E., and Tillman, B. and P. 1992. Human factors design handbook. 2nd edition. New

York: McGraw-Hill, Inc. Also, Boff, K.R., and Lincoln, J.E. 1988 Engineering data compendium: Human

perception and performance. Wright-Patterson Air Force Base, Ohio: Armstrong Aerospace Medical

Research Laboratory.

348 This finding was based on Safety Board simulations of a 3.7° rudder step input under the existing

flight conditions.

349 Woodson and Tillman, p. 631.

350 Slight variations in the rudder’s position during this time period were proposed by Boeing to indicate

variations in pilot inputs and/or the operation of the yaw damper. See section 2.4.1 for more information. 
Analysis 271 Aircraft Accident Report

as “standing on the left rudder [pedal]” and “push[ing] quite hard”). In contrast, if the

pilots had made an inappropriate right rudder input to a properly functioning rudder

system (as the Boeing scenario proposes) to achieve a 6° right rudder, the captain would

have had to apply only 54 pounds of pressure to the right rudder pedal, depressing the

pedal no more than 1 inch, or about one-quarter of the available pedal travel. 

A forceful full right rudder input with a normally functioning rudder system (based

on postincident testing of the Eastwind flight 517 main rudder PCU without a jam and

reversal) would have resulted in the right rudder pedal depressing to its forward quadrant

stops (about 4.2 inches) and the rudder surface moving to its normal blowdown limit of

about 9° right. However, simulations of the Eastwind flight 517 incident performed by

both the Safety Board and Boeing indicate that a 9° rudder deflection does not match the

FDR data.

The Safety Board considers it highly unlikely that the pilots of Eastwind flight 517

would have forgotten about having trimmed the rudder by more than 3 units before the

incident began, reported applying left rudder when they had actually applied right rudder,

and (perhaps least likely) recalled “standing on the left rudder” when the captain had

actually applied only a light touch on the pedal. The Safety Board also considers it very

unlikely that the pilots could have reacted to the postulated yaw damper hardover release

in less than 1⁄4 second. Therefore, the Safety Board does not consider the scenario

proposed by Boeing for the Eastwind flight 517 incident to be consistent with the

available evidence from the FDR and the flight crew. 

On the basis of the results of its computer simulation (including reduced hinge

moment) and analysis of the human performance data (including postincident flight crew

statements), the Safety Board concludes that, during the Eastwind flight 517 incident, the

rudder reversed, moving to its right blowdown limit when the captain commanded left

rudder, consistent with a jam of the main rudder PCU servo valve secondary slide to the

servo valve housing offset from its neutral position and overtravel of the primary slide. 

2.5 Rudder System Jam Scenarios 

In its examinations of the rudder systems of the USAir flight 427, United flight

585, and Eastwind flight 517 airplanes, the Safety Board was unable to identify any

obvious physical evidence that a jam occurred within the servo valve. Further, the

investigation has not revealed how the secondary slide could jam to the servo valve

housing under conditions that would normally be encountered by an airplane in air carrier

operations and not leave any physical evidence that the jam occurred. However, the

Safety Board demonstrated that, in servo valves with tight clearances,351 the secondary

slide could jam to the servo valve housing and leave no physical evidence of that jam

(albeit under thermal conditions that would not normally be encountered by an airplane in

351 The Safety Board’s dimensional examination of the main rudder PCU servo valves from the USAir

flight 427 and United flight 585 accidents and the Eastwind flight 517 incident revealed that the USAir and

Eastwind servo valves had relatively tight clearances. The United servo valve was damaged so severely that

accurate internal measurements could not be obtained. 
Analysis 272 Aircraft Accident Report

air carrier operations). Further, small particulate matter in the hydraulic fluid could reduce

the already tight clearances in the servo valve, requiring less of a thermal differential for

the valve to jam. In addition, it is possible for a large amount of small particles to provide

the jamming potential of a larger stronger piece of metal without leaving a mark.352

Further, testing showed that, when the secondary slide was jammed to the servo

valve housing and a sufficiently high-rate force was applied on the input crank,

compliance within the rudder system could allow the primary slide to overtravel and result

in a reverse rudder command. Therefore, the Safety Board concludes that it is possible

that, in the main rudder PCUs from the USAir flight 427, United flight 585, and Eastwind

flight 517 airplanes (as a result of some combination of tight clearances within the servo

valve, thermal effects, particulate matter in the hydraulic fluid, or other unknown factors),

the servo valve secondary slide could jam to the servo valve housing at a position offset

from its neutral position without leaving any obvious physical evidence and that,

combined with a rudder pedal input, could have caused the rudder to move opposite to the

direction commanded by a rudder pedal input.

In one or more of the three upset events, the main rudder PCU system could have

malfunctioned in some way other than the rudder reversal scenario previously described

such that the rudder moved uncommanded by a pilot to its aerodynamic blowdown limit,

without leaving any physical evidence, just before the pilot commanded opposite rudder.

However, the Safety Board is unaware of any mechanism by which this possibility could

have occurred. Such a malfunction scenario would need to include an explanation for the

reduction in the rudder hinge moment on Eastwind flight 517 to be consistent with the

rudder movement during that upset event. 

To summarize, the Safety Board’s analysis indicates that the USAir flight 427 and

United flight 585 accidents and the Eastwind flight 517 incident involved rudder

deflections that could have only been the result of inappropriate pilot input or a

malfunction of the rudder system (or possibly a rotor in the case of United flight 585).

The Board and Boeing were able to perform computer simulations and kinematic analyses

involving these explanations that resulted in good matches of the available FDR data.

Further, Safety Board testing showed that the main rudder PCU servo valve could jam,

without leaving a physical mark, in a way that could lead to rudder reversal. Additionally,

in all three upset events, the available human performance data comported well with a

rudder system malfunction but were inconsistent with an inappropriate pilot input (or a

rotor in the case of United flight 585).

The statements of the Eastwind flight 517 flight crew were fully consistent with an

uncommanded rudder input. In addition, the Safety Board’s and Boeing’s computer

simulation and kinematic studies both indicated that, in the Eastwind flight 517 incident,

the rudder moved to a position consistent with rudder reversal but inconsistent with a

normally operating rudder system (given the pilots’ consistent recollections of the captain

applying great force to the rudder pedals). Therefore, the Safety Board concludes that the

352 Safety Board tests found that pieces of high-strength material could jam the servo valve but that they

would leave a mark as a result of the jam.
Analysis 273 Aircraft Accident Report

upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely

caused by the movement of the rudder surfaces to their blowdown limits in a direction

opposite to that commanded by the pilots. The rudder surfaces most likely moved as a

result of jams of the secondary slides to the servo valve housings offset from their neutral

position and overtravel of the primary slides. 

In addition to this reversal potential, the Safety Board’s investigation revealed two

other potential failure mechanisms353 within the 737 rudder control system that could

result in a deflection to the rudder’s blowdown limit. One of these potential failure

mechanisms is a physical jam in the rudder system input linkage (between the PCU’s input

crank and body stop), preventing the main rudder PCU control valve from closing; the

other is a jam of the primary to the secondary slide of the main rudder PCU servo valve

combined with a jam of the secondary slide to the servo valve housing at positions other

than neutral (known as a dual jam). These failure mechanisms probably did not play a role

in the USAir flight 427, United flight 585, and Eastwind 517 upsets.354 Nonetheless, the

failure mechanisms are cause for concern because they further illustrate the vulnerability

of the 737 rudder system to jams that could produce rudder deflections and result in

catastrophic consequences.

2.6 Adequacy of the Boeing 737 Rudder System Design

Boeing has recently made significant design changes in the 737 rudder system,

especially on the 737-NG. (The design changes on the NG series airplanes include a

redesigned main rudder PCU servo valve in which the hydraulic fluid ports are spread,

thus eliminating the reversal mechanism identified in the thermal tests; a redesigned yaw

damper system; a hydraulic pressure limiter; a rudder input force transducer; and a new

standby rudder PCU input bearing.) The 737-100 through -500 series airplanes are being

retrofitted with the redesigned servo valve and a hydraulic pressure reducer designed to

limit the extent to which the airplanes would be vulnerable to the rudder overpowering the

roll authority of the ailerons and spoilers. 

As a result of ADs issued by the FAA, the redesigned main rudder PCU servo

valve should eliminate the possibility of a rudder reversal from the specific circumstances

353 A third potential failure mechanism—a jam of the primary to the secondary slide with overtravel of

the secondary slide—was identified as a result of testing after the July 1992 United Airlines rudder anomaly

that occurred during a ground check. Although the testing determined that this mechanism could cause a

rudder reversal, Boeing indicated that subsequent design changes in the servo valve eliminated this

possibility.

354 The Safety Board’s postaccident examination of the USAir flight 427 rudder components revealed

that the rudder system feedback control loop was probably not jammed during the accident sequence

because there was no evidence of foreign material to cause such a jam and there were no nicks or gouges on

the input linkage to indicate that a jamming material might have been present at impact. Further, the main

rudder PCU’s external input linkage effectively covers (blocks) the opening between the input crank and the

PCU body stop for the left rudder command direction, preventing jamming material from entering the area.

The Safety Board considers that a dual slide jam is a less likely accident scenario than a jam of the secondary

slide to the servo valve housing because the dual jam would require two extremely rare failures to exist in

the servo valve at the same time. 
Analysis 274 Aircraft Accident Report

of a secondary slide jam to the servo valve housing combined with overtravel of the

primary slide. Other ADs issued by the FAA should result in improved operational

procedures and pilot training programs for addressing the more general problem of

uncommanded movement of the rudder, including rudder reversal. The Safety Board

concludes that, when completed, the rudder design changes to the 737 should preclude the

rudder reversal failure mode that most likely occurred in the USAir flight 427 and United

flight 585 accidents and the Eastwind flight 517 incident. 

However, even with these changes, the 737 series airplanes (including the NG)

remain susceptible to rudder system malfunctions that could be catastrophic. In its

October 1997 briefings to the FAA, Boeing acknowledged that a rudder hardover on the

737-NG during the most critical phases of flight—takeoff and/or landing (which Boeing

estimated as 60 to 90 seconds per flight)—would be catastrophic. Although this period of

vulnerability appears limited, the takeoff and landing phases are when the pilot is most

likely to use the rudder, particularly to apply a high-rate rudder input. Pilots can apply

rudder inputs during the takeoff or landing ground roll as they use the rudder pedals for

nosewheel steering; these inputs can occur at low altitude with a loss of engine power or

during a turbulence encounter. Any malfunction resulting in uncommanded rudder

motion during an engine failure or in turbulence at low altitude may be catastrophic

because of the limited time, altitude, and roll control authority to regain control of the

airplane.

The Board is also concerned that the limited period of vulnerability to rudder

malfunction is based on the assumption that a pilot will perform perfectly and that all

airplane systems will perform normally. For example, according to Boeing’s fault tree

analysis for the 737-NG, the combination of a jammed servo valve with a loss of engine

power during takeoff would be catastrophic only during a 7-second window from V1

through liftoff, at which point roll controls could be used to help control the airplane in the

event of a loss of engine power. However, Boeing’s analyses apparently assumed that a

pilot would always react immediately and correctly and that the hydraulic pressure limiter

would not fail. Such assumptions may not be fully warranted. 

The Safety Board recognizes that the potential for the specific rudder malfunction

that was most likely involved in the accidents of USAir flight 427 and United flight 585

and the incident involving Eastwind flight 517 appears to be have been eliminated by the

redesigned servo valve. However, the Board remains concerned that other rudder system

malfunctions might potentially lead to rudder reversal or hardover conditions in the 737.

The 737 has a history of rudder system-related anomalies, including numerous

instances of jamming. Examples of jamming events355 include the following: 

• a shotpeen ball lodged in a servo valve, causing the rudder to move full right

on landing; 

• shotpeen balls found in a servo valve during a PCU examination; 

355 See section 1.18.1.1 for more details about these events.
Analysis 275 Aircraft Accident Report

• contamination of a PCU by metal particles, causing the rudder pedals to jam

during taxi; 

• internal PCU contamination and worn seals, causing the rudder to lock up on

approach; 

• internal PCU corrosion found during a PCU overhaul; 

• a loose servo valve retaining nut, causing rudder binding during a flight check

and reduced rates, stall, and reversals during testing; 

• corrosion of a standby rudder PCU, causing full left rudder deflection during

taxi; 

• installation of an incorrect servo valve spring guide, allowing for rudder

reversal when the primary slide was jammed to the secondary slide and a rapid

rudder input was applied; 

• fluid contamination of a yaw damper coupler, causing rapid full yaw damper

inputs and a severe oscillatory roll; 

• installation of an incorrect fastener in the summing lever bearing, resulting in a

cracked bearing race; and 

• a jammed or restricted input arm, causing full rudder to move to its full

deflection. 

The Safety Board is concerned that the new features of the redesigned main rudder

PCU do not address all of these malfunctions, some of which are related to improper

maintenance, installation, or modification. These malfunctions demonstrate that some

jamming conditions resulted in a loss of rudder control. Other jamming conditions were

fortuitously found during maintenance. However, because the main and standby rudder

actuators receive maintenance only “on condition,” possible jamming conditions could

exist and not be discovered until they result in an in-flight failure.

Further, the Safety Board is concerned that, in three events during the 1980s,

rudder system anomalies occurred in flight but remained unresolved during followup

component testing. These events, two reports of in-flight “rudder lockup” (in 1982) and a

rudder “hardover condition” (in 1984), indicated that potentially serious problems could

exist and cause anomalous behavior without leaving evidence. (These events were first

reported to the Safety Board by Parker in January 1999.) It is significant that the 1984

event involved a PCU that produced an in-flight hardover condition on two different

aircraft within the operator’s fleet. (According to Parker, the PCU was removed and

tested after the first upset event. When no fault was found, the PCU was installed on

another aircraft but subsequently failed another time. Once again, no fault was found

during followup testing.)

The most troubling anomalies are those that could result in reverse rudder

movement. During the investigation of the United flight 585 accident, many technical

experts indicated that it was not possible to jam the main rudder PCU in such a way as to

generate a reversal of the rudder movement. However, since that time, two such failure
Analysis 276 Aircraft Accident Report

modes have been identified in the original servo valve design. The first failure mode was

discovered in tests after the July 1992 main rudder PCU jam during a flight control ground

check. The tests demonstrated that, when the primary slide was jammed to the secondary

slide, a jam/reversal scenario was possible. (The servo valve was subsequently redesigned

to preclude the possibility of this reversal failure mechanism.) The second identified

failure mode was discovered during the USAir flight 427 accident investigation. Thermal

tests revealed the existence of a jam/reversal scenario (which prompted another redesign

of the servo valve to address this potential reversal failure mechanism.) The Safety Board

notes that the two failure modes associated with reversal were identified only after many

years of 737 operation and only after extensive tests and examination during the

investigation of the United flight 585 and USAir flight 427 catastrophic accidents.

The difficulty that was encountered in identifying these two reversal failure modes

is not surprising, given the complexity of the 737 rudder system. The entire rudder system

assembly—the standby rudder actuator, main rudder PCU servo valve, yaw damper, feel

and centering mechanism, rudder trim actuator, torque tube, input rods, cranks, links, and

summing levers—is an extremely complicated design. Further, each main rudder PCU

servo valve must be individually hand-finished to pass the manufacturer’s acceptance test

procedures, so no one valve is exactly the same as another. 

In addition to the failure modes and malfunctions of the 737 rudder system that

have already been identified, the Safety Board is concerned that the causes of certain other

reported 737 anomalies remain unresolved. For example, the Safety Board has reviewed

many reports of 737 pilots feeling “bumps” on the rudder pedals, yet in several cases the

cause has not been determined.

The Safety Board’s concerns about the possibility that additional failures or

malfunctions may result in uncommanded rudder motion are supported by the early

service history of the redesigned servo valve currently being installed in the 737-NG and

retrofitted in all other 737 series airplanes. For example, on February 19, 1999, an

anomalous rudder response was noted during a rudder ground check in Seattle on a United

Airlines 737 equipped with the redesigned servo valve. Both the flight crew and

maintenance personnel found that greater force than usual was necessary to move the right

rudder pedal. Preliminary investigative findings indicate that the anomalous rudder

response was the result of a mispositioned servo valve spring guide. Maintenance records

indicated that, 71 flight hours earlier, the servo valve was tested for indications of cracking

of the secondary slide. (The test for cracking was performed twice on this valve. The

PCU passed the acceptance test procedure after the first test. The acceptance test

procedure was not performed after the second test.)

This event raises concern because it suggests that it is possible to successfully

install a servo valve in a PCU when the spring guide is out of place. Although such a

mispositioning would have been detected if an acceptance test procedure had been

performed after the second cracking test, it is troubling that the mispositioned spring guide

was not detected during postmaintenance systems tests after the PCU was reinstalled on

the airplane. Further, the mispositioned spring guide was not detected during the

numerous flight control checks and flights that occurred before the ground check during
Analysis 277 Aircraft Accident Report

which the anomalous rudder response was noted. Another troubling scenario is the

possibility that the spring guide may only have been partially mispositioned at the time the

PCU was reinstalled and became further mispositioned sometime later while the airplane

was operating in service.

A second incident involving the redesigned servo valve occurred on February 23,

1999. A USAirways Metrojet 737 apparently experienced an unexplained rudder

hardover in flight. The flight crew regained normal rudder control only after it activated

the standby rudder system, as prescribed in USAirways’ “Jammed or Restricted Rudder”

abnormal procedure. The flight crew then made a successful emergency landing at

Baltimore-Washington International Airport. This event could have resulted in an

unrecoverable loss of control if it had occurred at a lower altitude or airspeed.

Preliminary results of kinematic analysis and computer simulations of the Metrojet

incident using FDR data indicate that the rudder traveled slowly to its blowdown limit.

Examination of the rudder system (including the servo valve) to date has found no

evidence of a failure or jam either in the servo valve or outside the servo valve (such as a

blockage in the rudder system feedback loop) that would explain an uncommanded rudder

hardover.

In addition to its concern about these recent in-service events involving the

redesigned servo valve, the Safety Board is also concerned that cracks have been found in

the secondary slide legs of several of the redesigned servo valves and that one slide was

found to be chipped.356 Boeing indicated that metal chips liberated from a crack are not

likely to cause uncommanded rudder motion. However, Boeing’s conclusions are based

on preliminary analyses and testing. Little is known about the initiation or progression of

the cracking or the migration of chips, and there is no long-term operational experience

with the redesigned servo valve to identify with certainty how this cracking is, or will be,

affected by in-service conditions.

The Safety Board recognizes that 737s have flown for over 92 million flight hours

since the 737-100 was certificated in December 1967 and that the airplane’s accident rate

is comparable to that of similar-type airplanes. Nonetheless, the Safety Board concludes

that, rudder design changes to 737-NG series airplanes and the changes currently being

retrofitted on the remainder of the 737 fleet do not eliminate the possibility of other

potential failure modes and malfunctions in the 737 rudder system that could lead to a loss

of control.

Redundancy in critical flight control systems is a basic tenet in the design of

commercial transport aircraft. It serves to reduce, to acceptably low levels, the probability

of catastrophic outcomes from flight control malfunctions. Redundancy is especially

important in the 737 rudder system because of the size and control power of the rudder

(necessitated by the twin wing-mounted engine configuration of the airplane). 

356 The chipped slide was found on a servo valve awaiting installation on an Olympic Airways airplane.

Boeing stated that it believed the chip was caused by a rigging tool that was used to calibrate the servo valve. 
Analysis 278 Aircraft Accident Report

The 737 is the only air carrier airplane with two wing-mounted engines that was

designed with a single-panel rudder controlled by a single actuator, albeit with a dualconcentric servo valve design. Other rudder system designs use multiple rudder surfaces

and/or multiple rudder actuators. For example, the rudder system designs of the Boeing

757 and 767, which were certificated in 1982 (2 years before certification of the 737-300

series), use three actuators and do not rely on dual-concentric servo valves. In the event of

a jammed or failed valve, the three-actuator design permits the failed actuator to be

immediately overpowered, or “broken out,” by pilot input using the other two actuators so

that the jammed or failed PCU no longer controls the movement of the flight control

surface. 

Although Boeing has indicated that three actuators were incorporated in the 757

and 767 design to allow for features such as autopilot control of the rudder during

autolanding and removal or reduction of the mass used to balance the rudder, the multipleactuator design clearly provides an increased level of safety. Because the three actuators

are fully independent (such that a valve jam would not have an adverse effect on another

valve), they provide true redundancy to the 757 and 767 rudder system. It is noteworthy

that the 757 and 767 have not experienced the rudder-related anomalies, incidents, or

accidents that have occurred in the 737 series.

Although dual-concentric servo valves are used in some other aircraft control

systems for activation of ailerons or elevators, the multiple control surfaces and breakout

features in those systems were designed to ensure that a jam of one control surface does

not affect other control surfaces. However, these redundant systems or breakout features

do not exist in the design of the 737 rudder system. 

Further, although the 737 rudder system has a standby rudder PCU that is

independent of the main rudder PCU, that system would have to be manually activated by

the flight crew in the event of a servo valve jam. If a jam were to occur close to the

ground or result in an unusual attitude, the pilots could lose control of the airplane before

they were able to diagnose the problem and engage the standby rudder. Therefore,

redundancy in the current 737 rudder system is limited to the dual-concentric design of the

main rudder PCU servo valve (and the dual load path design of the linkages in the rudder

system).

The October 7, 1993, incident involving a British Airways 747-400, G-BNLY,

illustrates the need for greater redundancy in flight control systems that include a dualconcentric servo valve. Shortly after takeoff, about 100 feet above ground level, the

airplane’s right elevator PCU reversed travel when a hydraulic pressure surge, resulting

from retraction of the landing gear, caused the dual-concentric servo valve secondary slide

to overtravel to the internal retract stop and the primary slide to move to the limit of the

extend linkage stop. The flight crew was able to maintain control because the 747’s

elevators are operated by separate PCUs and are not interconnected. As a result, the flight

crew was able to move the left-side elevators upward to counter the right-side downward

deflection. Given the low altitude of the occurrence, the airplane would likely have

crashed if the 747’s elevators had been a single-control surface, single-actuator design.
Analysis 279 Aircraft Accident Report

The Safety Board’s review of the dual-concentric servo valve design indicates that

redundancy is compromised in the existing 737 main rudder PCU for several reasons.

First, no method may exist by which a pilot can reliably detect the presence of a jammed

primary or secondary slide within the main rudder PCU servo valve that drives the

actuator.357 Second, the dual-concentric servo valve design allows for failure modes in

which one slide can directly affect the operation of the other slide. Third, recent design

changes do not eliminate the possibility that a maintenance error (such as the shotpeen

balls that were discovered in main rudder PCU servo valves) could result in a servo valve

anomaly. Last, although the dual load path is structurally redundant, it does not provide

functional redundancy. The mechanical elements of the main rudder PCU external to the

servo valve may be subject to jams (such as blockage between the input crank and the

external body stops), possibly leading to uncommanded rudder motion that the dualconcentric design of the servo valve cannot overcome. These failure modes markedly

reduce the redundancy that was intended to be provided by the dual-concentric design of

the servo valve and, in effect, could result in a single-point failure in the 737 rudder PCU

actuation system. Because no other full-time actuator could oppose an uncommanded

rudder motion, an airplane operating with such a latent failure would require only a single

additional event, such as a rapid rudder input or an additional jam, to potentially cause a

rudder hardover. 

The Safety Board considers it important that, if a failure/anomaly were to occur

within a critical flight control system (such as the 737 rudder system), the transition to a

backup system should occur automatically and immediately, making the system reliably

redundant. A system in which the transition to a backup system depends on the pilots’

prompt and proper perception of and reaction to the system anomaly is not reliably

redundant. Accordingly, the Safety Board concludes that the dual-concentric servo valve

used in all 737 main rudder PCUs is not reliably redundant. 

During the initial certification of the 737-100 series, FAA certification officials

expressed concern about the airplane’s single-panel, single-actuator rudder system and

recognized the possibility of undetected latent failures in the servo valve, thereby negating

the system’s redundancy. The rudder system’s history of service difficulties (some of

which still remain unresolved), particularly the servo valve’s history of jamming, validates

those concerns.

In October 1996, the Safety Board issued several safety recommendations to

improve the existing 737 rudder system. Specifically, Safety Recommendations

A-96-107, -109, -112, and -113 asked the FAA to

Require the Boeing Commercial Airplane Group, working with other

interested parties, to develop immediate operational measures and longterm design changes for the 737 series airplane to preclude the potential for

loss of control from an inadvertent rudder hardover. Once the operational

357 Although the Safety Board considers it critical that the main rudder PCU be inspected at regular

intervals, such inspections do not guarantee the detection of latent failures within the main rudder system

that occur between inspections.
Analysis 280 Aircraft Accident Report

measures and design changes have been developed, issue respective

airworthiness directives to implement these actions. (A-96-107)

Require the Boeing Commercial Airplane Group to develop and install on

all new-production 737 airplanes a cockpit indicator system that indicates

rudder surface position and movement. For existing 737 airplanes, when

implementing the installation of an enhanced-parameter flight data

recorder, require the installation of a cockpit indicator system that indicates

rudder surface position and movement. (A-96-109)

Require the Boeing Commercial Airplane Group to establish appropriate

inspection intervals and a service life limit for the 737 main rudder power

control unit. (A-96-112)

Require the Boeing Commercial Airplane Group to devise a method to

detect a primary or a secondary jammed slide in the 737 main rudder power

control unit servo valve and ensure appropriate communication of the

information to mechanics and pilots. (A-96-113)

The Safety Board is disappointed that the FAA has taken no action to establish

inspection intervals or a service life limit for the main rudder PCU or a method for

detecting and annunciating a jammed servo valve slide to flight crews. The Board is also

disappointed that the FAA has stated that a rudder position indicator would provide no

practical information to the pilots. On July 15, 1997, Safety Recommendations A-96-107,

-109, -112, and -113 were classified “Open—Unacceptable Response.” (See section

1.18.11 for a full discussion of the FAA’s actions and the Safety Board’s comments on

those actions.) A more direct and fundamental approach to correcting the deficiencies in

the 737 rudder system is necessary.

Because of the complexity of the 737 rudder system (and the potential for

unforeseen failure mechanisms), its lack of redundancy in the event of a single-point

failure or a latent failure, and the continued absence of cues to help alert flight crews to

latent failures, the Safety Board concludes that a reliably redundant rudder actuation

system is needed for the 737, despite the significant improvements that have been made in

the system’s design. Accordingly, the Safety Board believes that the FAA should require

that all existing and future 737s have a reliably redundant rudder actuation system. This

redundancy could be achieved by developing a multiple-panel rudder surface or providing

multiple actuators for a single-panel rudder surface. Further, Safety Recommendations

A-96-107, -109, -112, and -113 are classified “Closed—Unacceptable Action/

Superseded.”

One possible way of incorporating multiple actuators into the 737 without

extensive structural modification would be to modify the standby rudder system so that its

actuator could be used as a second rudder actuator. Under the current 737 design, the

standby rudder actuator powers the rudder by a separate hydraulic system that activates

manually or automatically in the event of a hydraulic system failure. The standby rudder

actuator was not intended to be used as a full-time actuator. However, design

modifications might be possible to make the standby actuator an integral part of the main

rudder control system. Although it is not clear whether the standby rudder system could
Analysis 281 Aircraft Accident Report

be modified to provide a truly redundant rudder system on all 737 series airplanes, it is

possible that such a modification might provide the needed redundancy. 

Another possible way to achieve redundancy in the rudder control system would

be to modify it so that the standby rudder PCU would be automatically activated and the

main rudder PCU would be automatically deactivated if the main rudder PCU actuator

system moves the rudder without a pilot command. This redundancy could be achieved

by monitoring the rudder position and comparing this position with the one being

commanded by the pilot rudder pedal input. Mismatches between the two positions could

then trigger a logic circuit that would command a hydraulic valve unit to automatically

shift hydraulic control of the rudder from the main rudder PCU (that is, depressurize its

hydraulics) to the standby rudder PCU. This action would allow the flight crew to resume

normal control of the rudder using the standby rudder PCU. (The Safety Board recognizes

that additional design issues must be considered so that the main rudder PCU is not

deactivated when it should not be.) 

Further, to gain a better understanding of the potential failure modes in the 737

rudder system, the Safety Board believes that the FAA should convene an engineering test

and evaluation board to conduct a failure analysis to identify potential failure modes, a

component and subsystem test to isolate particular failure modes found during the failure

analysis, and a full-scale integrated systems test of the 737 rudder actuation and control

system to identify potential latent failures and validate operation of the system without

regard to minimum certification standards and requirements in 14 CFR Part 25.

Participants in the engineering test and evaluation board should include the FAA; Safety

Board technical advisors; the Boeing Company; other appropriate manufacturers; and

experts from other government agencies, the aviation industry, and academia. A test plan

should be prepared that includes installation of original and redesigned 737 main rudder

PCUs and related equipment and exercises all potential factors that could initiate

anomalous behavior (such as thermal effects, fluid contamination, maintenance errors,

mechanical failure, system compliance, and structural flexure). The engineering board’s

work should be completed by March 31, 2000, and published by the FAA.

2.6.1 FAA Certification System

In light of the safety concerns about the 737 rudder system design, the Safety

Board is concerned about the FAA’s regulatory process that resulted in the certification of

that system. The Safety Board concludes that, on the basis of the results of this

investigation, the 737 rudder system design certificated by the FAA is not reliably

redundant. Therefore, the Safety Board believes that the FAA should ensure that future

transport-category airplanes certificated by the FAA provide a reliably redundant rudder

actuation system. 

The Safety Board also questions the FAA’s interpretation of the term “normally

encountered” in the context of 14 CFR Section 25.671(c)(3). Section 25.671(c)(3) states

the following:
Analysis 282 Aircraft Accident Report

(c) The airplane must be shown by analysis, tests, or both, to be capable of

continued safe flight and landing after any of the following failures or

jamming in the flight control system and surfaces (including trim, lift, drag,

and feel systems), within the normal flight envelope, without requiring

exceptional piloting skill or strength. Probable malfunctions must have

only minor effects on control system operation and must be capable of

being readily counteracted by the pilot. 

* * *

(3) Any jam in a control position normally encountered during takeoff,

climb, cruise, normal turns, descent, and landing unless the jam is shown to

be extremely improbable, or can be alleviated. A runaway of a flight

control to an adverse position and jam must be accounted for if such

runaway and subsequent jamming is not extremely improbable. 

During certification of the 737-NG series airplanes, the FAA concluded that a

normally encountered control position for the rudder would be a maximum of 2.5°.

However, this interpretation seems unrealistic in light of the rudder’s ability to travel as

much as 26° in either direction and its criticality in countering a loss of engine power or

crosswind gust on takeoff or landing. (It is unclear how a different interpretation would

have affected the outcome of the 737-NG certification process.) Such a narrow

interpretation may well reduce the level of protection that should be provided by a

showing of compliance with this rule. Although the rudder may operate for much of the

time in a narrow range, a jam could become critical during those times when deflections

beyond this narrow range are necessary.

The Safety Board questions whether it is appropriate to define “normally

encountered” so narrowly and even whether it is appropriate to include that phrase in

14 CFR Section 25.671. The Board agrees with the Critical Design Review team’s

position on this issue. The team stated that “if a control position is possible, it is there for

a purpose, and the pilot can use that control authority.” In October 1996, the Safety Board

issued Safety Recommendation A-96-108, which asked the FAA to 

Revise 14 CFR Section 25.671 to account for the failure or jamming of any

flight control surface at its design-limited deflection. Following this

revision, reevaluate all transport-category aircraft and ensure compliance

with the revised criteria.

In response, the FAA indicated that the last sentence of 14 CFR Section

25.671(c)(3) already required that a jam of a flight control surface at its design-limited

deflection be accounted for unless such a jam is extremely improbable. However, the

Safety Board is concerned that the rule does not appear to require any analysis of failure or

jamming of flight controls in positions beyond those normally encountered but short of a

full deflection. For example, the FAA’s finding that the 737-NG series airplanes complied

with this rule was apparently based on Boeing’s assertion that rudder position jams in a

normally encountered position were controllable and that rate jams resulting in a rudder

hardover were extremely improbable. There is no indication that Boeing or the FAA

considered jams in any intermediate position.
Analysis 283 Aircraft Accident Report

The Safety Board concludes that transport-category airplanes should be shown to

be capable of continued safe flight and landing after a jammed flight control in any

position unless the jam can be shown to be extremely improbable. Accordingly, the

Safety Board believes that the FAA should amend 14 CFR Section 25.671(c)(3) to require

that transport-category airplanes be shown to be capable of continued safe flight and

landing after jamming of a flight control at any deflection possible, up to and including its

full deflection, unless such a jam is shown to be extremely improbable. Because the

Safety Board recognizes that the language of Safety Recommendation A-96-108 may not

have adequately expressed this concern, that recommendation is classified “Closed—

Reconsidered/Superseded.”

2.7 Flight Crew Procedures and Training

2.7.1 Unusual Attitude Training for Air Carrier Pilots

Before the USAir flight 427 accident, the Safety Board had issued a series of

safety recommendations over a 24-year period, asking the FAA to require air carriers to

train pilots in recoveries from unusual flight attitudes. Throughout this period, the Safety

Board was generally not satisfied with the FAA’s responses to these recommendations;

specifically, the Board disagreed with the FAA’s responses that cited the inadequacy of

flight simulators as a reason for not providing pilots with the requested training. However,

after the USAir flight 427 accident and the October 31, 1994, ATR-72 accident involving

Simmons Airlines flight 4184 near Roselawn, Indiana,358 the FAA issued guidance to air

carriers, acknowledging the value of flight simulator training in unusual attitude

recoveries and encouraging air carriers to voluntarily provide this training to their pilots.

The voluntary training programs that were implemented by many air carriers (including

USAir) have been excellent. In October 1996, the Safety Board issued Safety

Recommendation A-96-120, asking the FAA to

Require 14 CFR Part 121 and 135 operators to provide training to flight

crews in the recognition of and recovery from unusual attitudes and upset

maneuvers, including upsets that occur while the aircraft is being

controlled by automatic flight control systems, and unusual attitudes that

result from flight control malfunctions and uncommanded flight control

surface movements.

The Safety Board’s concerns about the role of automatic flight control systems in

unusual attitude situations were validated when Comair flight 3272, an Embraer 120RT,

crashed on January 9, 1997, near Monroe, Michigan. The investigation determined that an

engaged autopilot masked the most salient cues to the flight crew of a developing

uncommanded rolling moment.359 Similarly, the challenge posed to pilots by flight

358 For more information on this accident, see the discussion of Safety Recommendation A-96-120 in

section 1.18.11.5.

359 National Transportation Safety Board. 1998. In-Flight Icing Encounter and Uncontrolled Collision

with Terrain, Comair Flight 3272, Embraer EMB-120RT, N265CA, Monroe, Michigan, January 9, 1997.

Aircraft Accident Report NTSB/AAR-98/04. Washington, DC. 
Analysis 284 Aircraft Accident Report

control malfunctions was demonstrated by the circumstances of the accidents involving

USAir flight 427 and United flight 585, the incident involving Eastwind Airlines

flight 517 (which involved uncommanded rudder movement), and the accident involving

Simmons Airlines flight 4184 (which involved uncommanded aileron movement).

The Safety Board recognizes the value of air carrier voluntary unusual attitude

training programs. However, all air carriers may not be implementing such a program.360

Further, the FAA has not addressed flight control malfunctions (such as uncommanded

rudder surface movements) in its guidance material for air carrier unusual attitude training

programs. In addition, the unusual attitude training tool developed in 1998 by industry,

labor unions, and the FAA does not include guidance on flight control malfunctions. 

In January 1997, the FAA informed the Safety Board that it was considering

issuance of a notice of proposed rulemaking (NPRM) to require air carriers to conduct

unusual attitude training. However, as of March 1999, the FAA had not issued the NPRM.

The FAA indicated, in informal correspondence with the Safety Board, that it might

include an unusual attitude training requirement as part of a planned general revision to

the regulations governing air carrier pilot training (14 CFR Part 121, Subparts N and O). 

The Safety Board is concerned that the FAA has not yet taken the necessary

regulatory action to require unusual attitude training for air carrier pilots. The Board is

also concerned that the guidance and programs developed to date do not include scenarios

involving flight control malfunctions. Accordingly, because of the lack of progress

toward requiring for air carrier pilots unusual attitude training that addresses flight control

malfunctions, such as uncommanded flight control surface movements, Safety

Recommendation is classified A-96-120 “Open—Unacceptable Response.” The Safety

Board urges the FAA to take expeditious action to require such unusual attitude training.

2.7.2 Unusual Attitude Training for Boeing 737 Pilots

At the time of the USAir flight 427 accident, no air carrier training programs were

specifically aimed at training 737 pilots to recognize and address a rudder jam or reversal.

The guidance available at that time from Boeing advised pilots, as a first consideration, to

maintain or regain full control of the airplane. Specifically, the guidance advised pilots to

counter unwanted roll tendencies from a malfunctioning rudder with the application of up

to full aileron control inputs. However, the guidance did not advise pilots that, at some

airspeeds, an uncommanded full rudder input could not be successfully opposed by full

wheel (aileron and spoiler) inputs and that a reduction in the airplane’s angle-of-attack

could improve the effectiveness of the roll controls relative to the effectiveness of the

rudder. Boeing’s guidance for relieving a jammed rudder informed pilots only that they

should use maximum force to overpower the jam and specifically warned pilots against

turning off flight control switches “unless the faulty control was positively identified.”

360 According to the FAA’s January 13, 1999, letter to the Safety Board’s Director of the Office of

Aviation Safety, at least 13 U.S.-based air carriers (including USAir) had implemented special events

training (SET) programs by mid-1996. The letter indicated that “other carriers...as well as training center

operators...were initiating SET programs.” 
Analysis 285 Aircraft Accident Report

No additional guidance was provided about the effects of flight control switch selections

on rudder jam conditions. 

The Safety Board recognizes that, even if unusual attitude training specifically

targeted at the rudder reversal situation were provided to pilots on a recurrent basis, a

rudder reversal is such a confusing and distracting event that no training could completely

prepare pilots to diagnose and respond to (in the few seconds that would be available) a

rudder reversal that occurred without warning. Consequently, the Safety Board cannot be

certain that the pilots of USAir flight 427 would have recovered control of the airplane if

they had received such training. However, the Safety Board concludes that pilots would

be more likely to recover successfully from an uncommanded rudder reversal if they were

provided the necessary knowledge, procedures, and training to counter such an event.

In December 1996, the FAA issued AD 96-26-07, requiring that the 737 Airplane

Flight Manual be revised to include procedures for maintaining control of an airplane

during an uncommanded yaw or roll or a jammed or restricted rudder condition. In

response to this AD, Boeing established procedures in February 1997 to provide an

effective means of regaining control of the airplane under most (but not all) flight

conditions.361 The “Uncommanded Yaw or Roll” procedure establishes the actions to be

performed by pilots immediately, from memory, to halt the uncommanded motion of the

airplane. The “Jammed or Restricted Rudder” procedure establishes a means of handling

a variety of rudder malfunctions (including rudder reversal) in a systematic manner.

These procedures were subsequently added to Boeing’s 737 Operations Manual and

adopted by U.S. air carriers. 

The Safety Board recognizes that the hydraulic pressure reducer that is being

retrofitted on earlier series 737 models, and the hydraulic pressure limiter being installed

in the NG models, should provide 737 flight crews with a greater margin of controllability

and additional response time for executing these required procedures. However, the

ability to recover from an uncommanded yaw or roll or a jammed or restricted rudder

(including a rudder reversal), within the time that would be available, requires training and

practice in executing the specific procedures. In October 1996, the Safety Board issued

Safety Recommendation A-96-118, asking the FAA to

Require the Boeing Commercial Airplane Group, working with other

interested parties, to develop procedures that require 737 flight crews to

disengage the yaw damper in the event of an uncommanded yaw upset as a

memorized or learned action. Once the procedures are developed, require

operators to implement these procedures. 

The Safety Board had been concerned that the procedures described in

AD 96-26-07 did not include disengagement of the yaw damper as an action to be

performed immediately from memory. The Board’s concern was based on the relatively

361 During the comment period for AD 96-26-07, the Safety Board expressed its concerns to the FAA

that these procedures might not be adequate if a rudder reversal were to occur at a low altitude, especially

with an engine failure during takeoff. See section 2.5 for a discussion of the flight regimes in which flight

crew action could not prevent an accident in the event of a rudder jam/reversal malfunction.
Analysis 286 Aircraft Accident Report

frequent occurrence (compared with other rudder system malfunctions) of yaw damper

malfunctions in the 737, which might lead pilots to unnecessarily perform the actions in

the “Jammed or Restricted Rudder” procedure. The Safety Board’s review of the

February 1997 changes to Boeing’s 737 Operations Manual, and air carriers’ adoption of

those provisions, indicate that U.S. air carriers are currently providing flight crews with an

immediate action procedure that should effectively handle yaw damper system

malfunctions. Therefore, Safety Recommendation A-96-118 is classified “Closed—

Acceptable Action.” 

The Safety Board is concerned that the “Jammed or Restricted Rudder” procedure

established a pilot’s ability to “center” the rudder pedals (that is, achieve a neutral rudder

pedal position) as the criterion for successful resolution of a rudder malfunction.

Specifically, the Board is concerned that, in a rudder reversal situation, compliance in the

rudder system could allow the rudder pedals to reach the neutral position while the rudder

surface remains deflected to the blowdown limit. As a result, the Safety Board concludes

that a neutral rudder pedal position is not a valid indicator that a rudder reversal in the 737

has been relieved. Therefore, the Safety Board believes that the FAA should revise

AD 96-26-07 so that procedures for addressing a jammed or restricted rudder do not rely

on the pilots’ ability to center the rudder pedals as an indication that the rudder

malfunction has been successfully resolved, and require Boeing and U.S. operators of

737s to amend their Airplane Flight Manuals and Operations Manuals accordingly.

Although the procedures specified by AD 96-26-07 did not establish a requirement

for air carriers to provide training to flight crews, Flight Standards Information Bulletin

(FSIB) 98-03, issued in January 1998, directed the FAA’s principal operations inspectors

to require air carriers to “amend their training programs to provide initial and recurrent

training in the recognition of and recovery from unusual attitudes and upsets caused by

reverse rudder response.” However, neither AD 96-26-07 nor FSIB 98-03 provided

specific guidance on how training for these procedures was to be accomplished. In its

comments on the NPRM for AD 96-26-07, the Safety Board expressed its concerns that

737 pilots needed to be explicitly trained on a regular basis in the execution of the new

procedures. In February 1997, the Safety Board issued Safety Recommendation A-97-18,

asking the FAA to

Require the Boeing Commercial Airplane Group to develop operational

procedures for 737 flight crews that effectively deal with a sudden

uncommanded movement of the rudder to the limit of its travel for any

given flight condition in the airplane’s operational envelope, including

specific initial and periodic training in the recognition of and recovery

from unusual attitudes and upsets caused by reverse rudder response. Once

the procedures are developed, require 737 operators to provide this training

to their pilots.

Although the new procedures are well documented in FAA, Boeing, and air carrier

publications, 3 of 12 U.S. air carrier operators of the 737 contacted by the Safety Board in

July 1998 were not providing any simulator training to their pilots on these procedures.

(These 3 air carriers accounted for about 20 percent of the 1,070 total 737 airplanes

operated by the 12 air carriers). Further, of the nine air carriers that were providing such
Analysis 287 Aircraft Accident Report

training, only five had specified in their training manuals that the procedures should be

performed by students during simulator training at least to the point of selecting the

hydraulic system B flight control switch to the standby rudder position. (These 5 air

carriers accounted for about 40 percent of the total 737 airplanes operated by the air

carriers.) Thus, pilots for more than one-half of U.S. air carrier operators of the 737

airplanes (7 of the 12 air carriers included in the Board’s survey) were not being provided

the opportunity to practice the responses to a jammed or restricted rudder (including a

rudder reversal) that might be most effective in relieving or overcoming the effects of a

jammed main rudder PCU servo valve.

Further, although Boeing has published and disseminated information about the

crossover airspeed phenomenon,362 only one-half of the 12 air carriers contacted by the

Safety Board in July 1998 were providing 737 flight crews with a demonstration of

crossover airspeed in a flight simulator. Moreover, the training materials for only onethird of the 12 air carriers (accounting for about 72 percent of the 737 airplanes) required a

demonstration of the crossover airspeed to pilots in the flaps 1 configuration (in which the

airplane can reach the crossover airspeed before the 1 G stickshaker speed). Thus, pilots

for as many as two-thirds of the U.S. air carrier operators of the 737 were not being

provided experience that demonstrated the inability to control the airplane at some speeds

and configurations by using only the roll controls during a rudder hardover condition. The

Safety Board is also concerned that flight tests conducted as part of the USAir flight 427

investigation showed that the simulator package developed by Boeing and implemented in

the air carriers’ training simulators did not adequately simulate the crossover airspeed

phenomenon. In addition, the Safety Board is concerned that Boeing has not updated its

existing simulator package, even though the data needed to do so is readily available as a

result of these flight tests. 

The Safety Board concludes that the training being provided to many 737 flight

crews on the procedures for recovering from a jammed or restricted rudder (including a

rudder reversal) is inadequate. Therefore, the Safety Board believes that the FAA should

require all 14 CFR Part 121 air carrier operators of the 737 to provide their flight crews

with initial and recurrent flight simulator training in the “Uncommanded Yaw or Roll” and

“Jammed or Restricted Rudder” procedures in Boeing’s 737 Operations Manual. The

training should demonstrate the inability to control the airplane at some speeds and

configurations by using the roll controls (the crossover airspeed phenomenon) and include

performance of both procedures in their entirety. Because of this new safety

recommendation and the FAA’s failure to fully address Safety Recommendation A-97-18,

the earlier recommendation is classified “Closed—Unacceptable Response/Superceded.”

In addition, the Safety Board believes that the FAA should require Boeing to update its

737 simulator package to reflect flight test data on crossover airspeed and then require all

operators of the 737 to incorporate these changes in their simulators used for 737 pilot

training. 

362 Boeing discussed crossover airspeed extensively in the July 1997 Flight Operations Review article

entitled “737 Directional Control.” (See section 1.18.10.2.3.)
Analysis 288 Aircraft Accident Report

Finally, the Safety Board is extremely concerned that, more than 4 years after the

USAir flight 427 accident, two smaller U.S. 737 operators (accounting for 16 of the 1,070

total 737 airplanes operated by the 12 air carriers) were continuing to use minimum

maneuvering speed schedules that permit operation of the 737 in the flaps 1 configuration

at airspeeds (158 and 164 knots) that are as much as 30 knots slower than the 1 G

crossover airspeed. (The FAA had accepted the use of these minimum maneuvering speed

schedules.) In addition, the Board is concerned that the Boeing-recommended block

maneuvering speeds schedule specifies 190 knots, which only slightly exceeds the 1 G

crossover airspeed, as the minimum speed for a 737 operating at a gross weight of 110,000

pounds in the flaps 1 configuration. Only one-third of the 12 U.S. 737 air carrier operators

contacted by the Safety Board in July 1998 (accounting for 66 percent of the 737

airplanes) actively promoted the practice of adding 10 knots to the 737 block maneuvering

speeds (for which Boeing has expressed neither support nor disapproval). 

The Safety Board concludes that the continued use by air carriers of airspeeds

below the existing block maneuvering speed schedule presents an unacceptable hazard

and that the existing block maneuvering speed for the flaps 1 configuration provides an

inadequate margin of controllability in the event of a rudder hardover. Therefore, the

Safety Board believes that the FAA should evaluate the 737’s block maneuvering speed

schedule to ensure the adequacy of airspeed margins above crossover airspeed for each

flap configuration, provide the results of the evaluation to air carrier operators of the 737

and the Safety Board, and require Boeing to revise block maneuvering speeds to ensure a

safe airspeed margin above crossover airspeed.

2.8 Flight Data Recorder Capabilities

The airplanes involved in the United flight 585 and USAir flight 427 accidents

were required by existing regulations (14 CFR Section 121.343) to have FDRs that

recorded 5 and 11 parameters, respectively.363 If these airplanes had been equipped with

FDRs with additional parameters, that information would have undoubtedly allowed quick

identification of critical control surface movements and their sources and other airplane

system conditions that could have been involved in the loss of airplane control. Thus,

investigators would have been able to more quickly rule out certain factors, when

warranted, and focus on other areas. 

The Safety Board has addressed the importance of improving the quality and

amount of data recorded by FDRs in several recent aviation accident reports and safety

recommendations. In February 1995, the Safety Board issued urgent Safety

Recommendation A-95-25, urging the FAA to 

Require that each Boeing 737 airplane operated under 14 CFR Parts 121 or

125 be equipped, by December 31, 1995, with a flight data recorder system

that records, at a minimum, the parameters required by current regulations

363 As previously discussed (see section 1.11.2), although existing regulations required the FDR that

was installed on the USAir flight 427 airplane to record 11 parameters, the accident airplane’s FDR recorded

13 parameters.
Analysis 289 Aircraft Accident Report

applicable to that airplane plus the following parameters (recorded at the

sampling rates specified in "Proposed Minimum FDR Parameter

Requirements for Airplanes in Service”): lateral acceleration; flight control

inputs for pitch, roll, and yaw; and primary flight control surface positions

for pitch, roll, and yaw.364 

The FAA indicated that it agreed with the intent of the Safety Board’s

recommendation. However, the FAA did not meet the recommendation’s proposed

December 31, 1995, retrofit completion date, characterizing it as “an extremely aggressive

schedule.” The Safety Board repeatedly expressed its disappointment with the FAA’s lack

of action and urged the FAA to act promptly because of the criticality of the issue and the

persisting reports of unexplained 737 in-flight disturbances. 

More than 1 year after the FAA’s response to Safety Recommendation A-95-25

(and almost 6 months after the recommended December 31, 1995, FDR retrofit

completion date), the Eastwind flight 517 incident occurred. The Safety Board’s July 1,

1996, letter to the FAA indicated the Board’s belief that the Eastwind incident could have

become the third fatal 737 upset accident for which inadequate FDR information would

have hampered an investigation. Because the FAA had not acted in the time frame

proposed by the Safety Board in its urgent safety recommendation, the FDR recordings

from the Eastwind incident airplane did not provide sufficient data to identify rudder

surface and rudder pedal movements. If this information had been available, investigators

would have been better able to understand the Eastwind incident and, more importantly,

would likely have gained significant additional insight into previous upset events, such as

the USAir flight 427 and United flight 585 accidents. In 1996, Safety Recommendation

A-95-25 was placed on the Safety Board’s list of Most Wanted Safety Improvements. 

In its July 9, 1997, final rule, the FAA required that new and existing transportcategory airplanes “be equipped to record the parameters recommended by the Board”

with final compliance required by August 19, 2002. Although the Safety Board

considered the FAA’s action a major improvement over the former FDR requirements, the

Board disagreed that the FAA’s requirements for retrofitting existing airplanes included all

parameters recommended by the Board in its urgent safety recommendation.365 Further,

the Safety Board was disappointed with the extended time frame and incremental

increases allowed for compliance with the new FDR requirements, especially for 737

airplanes.

In its July 22, 1997, letter to the Safety Board, the FAA stated that the retrofit

modification should be accomplished “at the earliest practicable time” but no later than

the next heavy maintenance check after August 18, 1999. During the Safety Board’s

investigation of the February 23, 1999, Metrojet upset event, the Board learned that the

incident airplane was scheduled for a heavy maintenance check in March 1999 but was

364 See section 1.18.11.4 for more information on previous FDR safety recommendations. 

365 The Safety Board recommended (but the FAA did not require) that airplanes manufactured before

1991 record data for the following parameters: pitch trim; thrust reverser position; flaps, leading edge slats,

and ground spoiler positions; angle-of-attack; and outside and total air temperatures. 
Analysis 290 Aircraft Accident Report

not scheduled to receive the required FDR upgrade until its heavy maintenance check in

March 2001. Therefore, the Safety Board is concerned that some air carriers may have

disregarded the directive to accomplish the upgrade at the earliest practicable time and

may have interpreted the rule to require no action until after August 18, 1999. However,

the Safety Board notes that at least one U.S. 737 operator (Southwest Airlines) has

aggressively pursued the FDR upgrade within its fleet and anticipates having all its

airplanes’ FDRs upgraded by December 1999 (about 11⁄2 years before the modification

completion date mandated by the FAA). 

As previously discussed, several 737 rudder-related events have been associated

with the yaw damper system, which moves the rudder without any corresponding

movement of the flight crew’s rudder pedals. To adequately monitor this system, FDRs

would have to record several parameters that are not required by the FAA’s July 1997 final

rule regarding upgraded FDRs. By documenting the yaw damper’s operation (command

voltage to the rudder and on/off discrete indication) and the resultant rudder surface

movement, a yaw damper event could quickly be distinguished from a flight crew input or

a rudder anomaly. 

Additionally, upgraded FDRs are expected to record the pilots’ flight control

inputs and the flight control surface movements. However, the FAA is not requiring the

FDRs on existing airplanes, including 737s,366 and those manufactured before August

2002 to be upgraded to record the pilots’ flight control input forces. The Safety Board

considers documentation of pilot flight control input forces to be critical in determining

the pilots’ role in a flight control-related event and notes that such documentation appears

especially critical in the case of the 737. If pilot flight control input forces had been

recorded for the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes,

these investigations would have been resolved more promptly, and actions to prevent

future similar events would have been hastened. 

Parameters such as pitch trim, thrust reverser position, and leading and trailing

edge flap positions would also provide potentially valuable information to accident

investigators. The Safety Board issued Safety Recommendations A-95-26 and A-95-27 in

February 1995, stating that FDRs installed on all airplanes operated under 14 CFR Parts

121, 125, or 135 should be upgraded to record these parameters. Although such an

upgrade would be easily accomplished on airplanes equipped with flight data acquisition

units (FDAU), the FAA, to date, has not required that affected airplanes be upgraded

accordingly. 

The Safety Board concludes that the FDR upgrade modifications required by the

FAA for existing airplanes are inadequate because they do not require the FDR to be

modified to record yaw damper command voltage; yaw damper and standby rudder on/off

366 Title 14 CFR Section 25.1459(e) states that “any novel or unique design or operational

characteristics of the aircraft shall be evaluated to determine if any dedicated parameters must be recorded

on flight recorders in addition to or in place of existing requirements.” The Safety Board notes that the 737’s

unique rudder actuation system design and rudder system service history justify the recording of additional

parameters on 737 FDRs. 
Analysis 291 Aircraft Accident Report

discrete indications; pitch trim; thrust reverser position; leading and trailing edge flap

positions; and pilot flight control input forces for control wheel, control column, and

rudder pedals. Further, the Safety Board concludes that, on the basis of the rudder-related

anomalies discussed in this report, FDR documentation of yaw damper command voltage;

yaw damper and standby rudder on/off discrete indications; and pilot flight control input

forces for control wheel, control column, and rudder pedals is especially important in the

case of the 737, and these parameters should be sampled on 737 airplanes at frequent

intervals to provide optimal documentation. 

Therefore, the Safety Board believes that the FAA should require that all 737

airplanes operated under 14 CFR Parts 121 or 125 that currently have a FDAU be

equipped, by July 31, 2000, with an FDR system that records, at a minimum, the

parameters required by FAA Final Rules 121.344 and 125.226, dated July 17, 1997,

applicable to that airplane plus the following parameters: pitch trim; trailing edge and

leading edge flaps; thrust reverser position (each engine); yaw damper command; yaw

damper on/off discrete; standby rudder on/off discrete; and control wheel, control column,

and rudder pedal forces (with yaw damper command; yaw damper on/off discrete; and

control wheel, control column, and rudder pedal forces sampled at a minimum rate of

twice per second). 

Further, the Safety Board believes that the FAA should require that all 737

airplanes operated under 14 CFR Parts 121 or 125 that are not equipped with a FDAU be

equipped, at the earliest time practicable but no later than August 1, 2001, with an FDR

system that records, at a minimum, the parameters required by FAA Final Rules 121.344

and 125.226, dated July 17, 1997, applicable to that airplane plus the following

parameters: pitch trim; trailing edge and leading edge flaps; thrust reverser position (each

engine); yaw damper command; yaw damper on/off discrete; standby rudder on/off

discrete; and control wheel, control column, and rudder pedal forces (with yaw damper

command; yaw damper on/off discrete; and control wheel, control column, and rudder

pedal forces sampled at a minimum rate of twice per second).

The Safety Board notes that 737 flight crews continue to report anomalous rudder

behaviors, and it is possible that another catastrophic 737 upset-related accident could

occur. If such an accident occurs before August 19, 2001, it is likely that the data recorded

by the accident airplane’s FDR will not be sufficient for investigators to readily identify

the events leading to the upset and develop corrective actions to prevent future similar

accidents. Therefore, the Safety Board concludes that the FAA’s failure to require timely

and aggressive action regarding enhanced FDR recording capabilities, especially on 737

airplanes, has significantly hampered the prompt identification of potentially critical

safety-of-flight conditions and the development of safety recommendations to prevent

future catastrophic accidents. 
Conclusions 292 Aircraft Accident Report

3. Conclusions

3.1 Findings

Note: Because the Safety Board’s analysis of the USAir flight 427 accident also

included analysis of the United flight 585 accident and the Eastwind flight 517 incident,

some of the findings pertain to these two events.

1. The USAir flight 427 flight crew was properly certificated and qualified and had

received the training and off-duty time prescribed by Federal regulations. No

evidence indicated any preexisting medical or behavioral conditions that might have

adversely affected the flight crew’s performance during the accident flight. 

2. The USAir flight 427 accident airplane was equipped, maintained, and operated in

accordance with applicable Federal regulations. The airplane was dispatched in

accordance with Federal Aviation Administration- and industry-approved practices. 

3. All of USAir flight 427’s doors were closed and locked at impact.

4. USAir flight 427 did not experience an in-flight fire, bomb, explosion, or structural

failure.

5. A midair collision with other air traffic, a bird strike, clear air turbulence, or other

atmospheric phenomena were not involved in the USAir flight 427 accident.

6. Asymmetrical engine thrust reverser deployment, asymmetrical spoiler/aileron

activation, transient electronic signals causing uncommanded flight control

movements, yaw damper malfunctions, and a rudder cable pull or break were not

factors in the USAir flight 427 accident.

7. Although USAir flight 427 encountered turbulence from Delta flight 1083’s wake

vortices, the wake vortex encounter alone would not have caused the continued

heading change that occurred after 1903:00.

8. About 1903:00, USAir flight 427’s rudder deflected rapidly to the left and reached its

left aerodynamic blowdown limit shortly thereafter.

9. Analysis of the human performance data shows that it is likely that the first officer

made the first pilot control response to the upset event and manipulated the flight

controls during the early stages of the accident sequence; although it is likely that

both pilots manipulated the flight controls later in the accident sequence, it is unlikely

that the pilots simultaneously manipulated the controls (possibly opposing each other)

during the critical period in which the airplane yawed and rolled to the left.
Conclusions 293 Aircraft Accident Report

10. Analysis of the human performance data (including operational factors) does not

support a scenario in which the flight crew of USAir flight 427 applied and held a full

left rudder input until ground impact more than 20 seconds later.

11. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors)

from the USAir flight 427 accident shows that they are consistent with a rudder

reversal most likely caused by a jam of the main rudder power control unit servo

valve secondary slide to the servo valve housing offset from its neutral position and

overtravel of the primary slide. 

12. The flight crew of USAir flight 427 recognized the initial upset in a timely manner

and took immediate action to attempt a recovery but did not successfully regain

control of the airplane.

13. The flight crew of USAir flight 427 could not be expected to have assessed the flight

control problem and then devised and executed the appropriate recovery procedure

for a rudder reversal under the circumstances of the flight.

14. It is very unlikely that the loss of control in the United flight 585 accident was the

result of an encounter with a mountain rotor.

15. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational factors)

from the United Airlines flight 585 accident shows that they are consistent with a

rudder reversal most likely caused by a jam of the main rudder power control unit

servo valve secondary slide to the servo valve housing offset from its neutral position

and overtravel of the primary slide.

16. The flight crew of United flight 585 recognized the initial upset in a timely manner

and took immediate action to attempt a recovery but did not successfully regain

control of the airplane. 

17. The flight crew of United flight 585 could not be expected to have assessed the flight

control problem and then devised and executed the appropriate recovery procedure

for a rudder reversal under the circumstances of the flight. 

18. Training and piloting techniques developed as a result of the USAir flight 427

accident show that it is possible to counteract an uncommanded deflection of the

rudder in most regions of the flight envelope; such training was not yet developed and

available to the flight crews of USAir flight 427 or United flight 585. 

19. During the Eastwind flight 517 incident, the rudder reversed, moving to its right

blowdown limit when the captain commanded left rudder, consistent with a jam of the

main rudder power control unit servo valve secondary slide to the servo valve housing

offset from its neutral position and overtravel of the primary slide.
Conclusions 294 Aircraft Accident Report

20. It is possible that, in the main rudder power control units from the USAir flight 427,

United flight 585, and Eastwind flight 517 airplanes (as a result of some combination

of tight clearances within the servo valve, thermal effects, particulate matter in the

hydraulic fluid, or other unknown factors), the servo valve secondary slide could jam

to the servo valve housing at a position offset from its neutral position without leaving

any obvious physical evidence and that, combined with a rudder pedal input, could

have caused the rudder to move opposite to the direction commanded by a rudder

pedal input.

21. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most

likely caused by the movement of the rudder surfaces to their blowdown limits in a

direction opposite to that commanded by the pilots. The rudder surfaces most likely

moved as a result of jams of the secondary slides to the servo valve housings offset

from their neutral position and overtravel of the primary slides.

22. When completed, the rudder system design changes to the Boeing 737 should

preclude the rudder reversal failure mode that most likely occurred in the USAir flight

427 and United flight 585 accidents and the Eastwind flight 517 incident. 

23. Rudder design changes to Boeing 737-next-generation series airplanes and the

changes currently being retrofitted on the remainder of the Boeing 737 fleet do not

eliminate the possibility of other potential failure modes and malfunctions in the

Boeing 737 rudder system that could lead to a loss of control.

24. The dual-concentric servo valve used in all Boeing 737 main rudder power control

units is not reliably redundant. 

25. A reliably redundant rudder actuation system is needed for the Boeing 737, despite

significant improvements made in the system’s design.

26. The results of this investigation have disclosed that the Boeing 737 rudder system

design certificated by the Federal Aviation Administration is not reliably redundant. 

27. Transport-category airplanes should be shown to be capable of continued safe flight

and landing after a jammed flight control in any position unless the jam can be shown

to be extremely improbable.

28. Pilots would be more likely to recover successfully from an uncommanded rudder

reversal if they were provided the necessary knowledge, procedures, and training to

counter such an event.

29. A neutral rudder pedal position is not a valid indicator that a rudder reversal in the

Boeing 737 has been relieved.

30. The training being provided to many Boeing 737 flight crews on the procedures for

recovering from a jammed or restricted rudder (including a rudder reversal) is

inadequate.
Conclusions 295 Aircraft Accident Report

31. The continued use by air carriers of airspeeds below the existing block maneuvering

speed schedule presents an unacceptable hazard, and the existing block maneuvering

speed for the flaps 1 configuration provides an inadequate margin of controllability in

the event of a rudder hardover. 

32. The flight data recorder (FDR) upgrade modifications required by the Federal

Aviation Administration for existing airplanes are inadequate because they do not

require the FDR to be modified to record yaw damper command voltage; yaw damper

and standby rudder on/off discrete indications; pitch trim; thrust reverser position;

leading and trailing edge flap positions; and pilot flight control input forces for

control wheel, control column, and rudder pedals. 

33. On the basis of the rudder-related anomalies discussed in this report, flight data

recorder documentation of yaw damper command voltage; yaw damper and standby

rudder on/off discrete indications; and pilot flight control input forces for control

wheel, control column, and rudder pedals is especially important in the case of the

737, and these parameters should be sampled on 737 airplanes at frequent intervals to

provide optimal documentation. 

34. The Federal Aviation Administration’s failure to require timely and aggressive action

regarding enhanced flight data recorder recording capabilities, especially on Boeing

737 airplanes, has significantly hampered investigators in the prompt identification of

potentially critical safety-of-flight conditions and in the development of

recommendations to prevent future catastrophic accidents.

3.2 Probable Cause 

The National Transportation Safety Board determines that the probable cause of

the USAir flight 427 accident was a loss of control of the airplane resulting from the

movement of the rudder surface to its blowdown limit. The rudder surface most likely

deflected in a direction opposite to that commanded by the pilots as a result of a jam of the

main rudder power control unit servo valve secondary slide to the servo valve housing

offset from its neutral position and overtravel of the primary slide.
Recommendations 296 Aircraft Accident Report

4. Recommendations

As a result of the investigation of the USAir flight 427 accident, the National

Transportation Safety Board makes the following recommendations to the Federal

Aviation Administration:

Require that all existing and future Boeing 737s have a reliably redundant

rudder actuation system. (A-99-20) 

Convene an engineering test and evaluation board to conduct a failure

analysis to identify potential failure modes, a component and subsystem

test to isolate particular failure modes found during the failure analysis, and

a full-scale integrated systems test of the Boeing 737 rudder actuation and

control system to identify potential latent failures and validate operation of

the system without regard to minimum certification standards and

requirements in 14 Code of Federal Regulations Part 25. Participants in the

engineering test and evaluation board should include the Federal Aviation

Administration (FAA); National Transportation Safety Board technical

advisors; the Boeing Company; other appropriate manufacturers; and

experts from other government agencies, the aviation industry, and

academia. A test plan should be prepared that includes installation of

original and redesigned Boeing 737 main rudder power control units and

related equipment and exercises all potential factors that could initiate

anomalous behavior (such as thermal effects, fluid contamination,

maintenance errors, mechanical failure, system compliance, and structural

flexure). The engineering board’s work should be completed by March 31,

2000, and published by the FAA. (A-99-21)

Ensure that future transport-category airplanes certificated by the Federal

Aviation Administration provide a reliably redundant rudder actuation

system. (A-99-22)

Amend 14 Code of Federal Regulations Section 25.671(c)(3) to require

that transport-category airplanes be shown to be capable of continued safe

flight and landing after jamming of a flight control at any deflection

possible, up to and including its full deflection, unless such a jam is shown

to be extremely improbable. (A-99-23)

Revise Airworthiness Directive 96-26-07 so that procedures for addressing

a jammed or restricted rudder do not rely on the pilots’ ability to center the

rudder pedals as an indication that the rudder malfunction has been

successfully resolved, and require Boeing and U.S. operators of Boeing

737s to amend their Airplane Flight Manuals and Operations Manuals

accordingly. (A-99-24)
Recommendations 297 Aircraft Accident Report

Require all 14 Code of Federal Regulations Part 121 air carrier operators of

the Boeing 737 to provide their flight crews with initial and recurrent flight

simulator training in the “Uncommanded Yaw or Roll” and “Jammed or

Restricted Rudder” procedures in Boeing’s 737 Operations Manual. The

training should demonstrate the inability to control the airplane at some

speeds and configurations by using the roll controls (the crossover airspeed

phenomenon) and include performance of both procedures in their entirety.

(A-99-25)

Require Boeing to update its Boeing 737 simulator package to reflect flight

test data on crossover airspeed and then require all operators of the Boeing

737 to incorporate these changes in their simulators used for Boeing 737

pilot training. (A-99-26)

Evaluate the Boeing 737’s block maneuvering speed schedule to ensure the

adequacy of airspeed margins above crossover airspeed for each flap

configuration, provide the results of the evaluation to air carrier operators

of the Boeing 737 and the National Transportation Safety Board, and

require Boeing to revise block maneuvering speeds to ensure a safe

airspeed margin above crossover airspeed. (A-99-27)

Require that all Boeing 737 airplanes operated under 14 Code of Federal

Regulations Parts 121 or 125 that currently have a flight data acquisition

unit be equipped, by July 31, 2000, with a flight data recorder system that

records, at a minimum, the parameters required by Federal Aviation

Administration Final Rules 121.344 and 125.226, dated July 17, 1997,

applicable to that airplane plus the following parameters: pitch trim;

trailing edge and leading edge flaps; thrust reverser position (each engine);

yaw damper command; yaw damper on/off discrete; standby rudder on/off

discrete; and control wheel, control column, and rudder pedal forces (with

yaw damper command; yaw damper on/off discrete; and control wheel,

control column, and rudder pedal forces sampled at a minimum rate of

twice per second). (A-99-28)

Require that all Boeing 737 airplanes operated under 14 Code of Federal

Regulations Parts 121 or 125 that are not equipped with a flight data

acquisition unit be equipped, at the earliest time practicable but no later

than August 1, 2001, with a flight data recorder system that records, at a

minimum, the parameters required by Federal Aviation Administration

Final Rules 121.344 and 125.226, dated July 17, 1997, applicable to that

airplane plus the following parameters: pitch trim; trailing edge and

leading edge flaps; thrust reverser position (each engine); yaw damper

command; yaw damper on/off discrete; standby rudder on/off discrete; and

control wheel, control column, and rudder pedal forces (with yaw damper

command; yaw damper on/off discrete; and control wheel, control column,

and rudder pedal forces sampled at a minimum rate of twice per second).

(A-99-29)
298 Aircraft Accident Report

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

Member John J. Goglia did not participate.

March 24, 1999

James E. Hall

Chairman

Robert T. Francis

Vice Chairman

John A. Hammerschmidt

Member

George W. Black

Member
Appendixes 299 Aircraft Accident Report

5. Appendixes

Appendix A

Investigation and Hearing

Investigation

The National Transportation Safety Board was initially notified of this accident

about 1920 on September 8, 1994. A full go-team was assembled that evening, but

because of the lack of availability of a Federal Aviation Administration (FAA) airplane or

commercial flights, the team did not depart the Washington, D.C., area until the morning

of September 9, 1994. The team arrived at the accident site about 0730. The following

investigative teams were formed: Operations, Human Performance, Aircraft Structures,

Aircraft Systems, Powerplants, Maintenance Records, Air Traffic Control, Survival

Factors, Aircraft Performance, Meteorology, and Witnesses. Specialists were also

assigned to stand by in the Safety Board laboratories for the cockpit voice recorder and

flight data recorder. Because of the magnitude of the accident, two Safety Board

investigators were assigned to most groups on scene. Accompanying the team were Board

Member Carl Vogt, his special assistant, the Deputy Managing Director, and a

representative of the Safety Board’s Public Affairs office. 

Parties to the investigation included the FAA; Boeing Commercial Airplane

Group; Air Line Pilots Association; USAir, Inc.; National Air Traffic Controllers

Association; CFM International; AVIALL; International Association of Machinists and

Aerospace Workers; Transportation Workers Union No. 545; the Association of Flight

Attendants; Parker Berta Aerospace/Parker Hannifin Corporation; and Monsanto

Company. Assistance was also provided by the Federal Bureau of Investigation, Armed

Forces Institute of Pathology, Hopewell Township, Pennsylvania State Police,

Pennsylvania Emergency Management Agency, the Beaver County Coroner’s Office, and

emergency response personnel from Beaver and Allegheny Counties. 

Additionally, air safety investigators from the aircraft accident investigation

authorities from the United Kingdom, France, Denmark, Australia, and Canada

participated in the investigation as technical observers in accordance with prior

arrangements for such participation. 

Public Hearing

Two sessions of a public hearing were conducted for this accident. The first

session was held on January 23 through 27, 1995. The second session was held on

November 15 through 17, 1995. Parties to the public hearing were the FAA, Boeing, Air

Line Pilots Association, USAir, International Association of Machinists and Aerospace

Workers, Parker Berta Aerospace/Parker Hannifin Corporation, and Monsanto Company.
Appendixes 300 Aircraft Accident Report

Appendix B

Cockpit Voice Recorder Transcript

The following is a transcript of the Fairchild A-100 cockpit voice recorder (CVR)

installed on the Boeing 737-300, N513AU, that crashed while approaching Pittsburgh

International Airport, Pittsburgh, Pennsylvania, on September 8, 1994.

RDO Radio transmission from accident aircraft

CAM Voice or sound source recorded through cockpit area microphone

HOT Voice or sound source recorded through cockpit hot microphone

PA Voice or sound source recorded through public address system

JSAP Voice or sound source recorded through jumpseat audio panel

-1 Voice identified as captain

-2 Voice identified as first officer

-3 Voice identified as female flight attendant

-4 Voice identified as male flight attendant

CTR-? Radio transmission from unidentified Center controller

CLE1 Radio transmission from 1st Cleveland Center controller

CLE2 Radio transmission from 2nd Cleveland Center controller

CLE3 Radio transmission from 3rd Cleveland Center controller

CLE4 Radio transmission from 4th Cleveland Center controller

ATIS Radio transmission from Pittsburgh automatic terminal information service

APR1 Radio transmission from 1st Pittsburgh approach controller

APR2 Radio transmission from 2nd Pittsburgh approach controller

US1417 Radio transmission from USAir flight 1417

US1499 Radio transmission from USAir flight 1499

US1874 Radio transmission from USAir flight 1874

US1462 Radio transmission from USAir flight 1462

US1674 Radio transmission from USAir flight 1674

DL1083 Radio transmission from Delta flight 1083

US374 Radio transmission from USAir flight 374

LEGEND
Appendixes 301 Aircraft Accident Report

285LM Radio transmission from aircraft 285 LM

US309 Radio transmission from USAir flight 309

* Unintelligible word

@ Nonpertinent word

# Expletive

% Break in continuity

( ) Questionable insertion

[ ] Editorial insertion

.... Pause

Note: The CVR transcript reflects the final 30 minutes 56 seconds of the accident 

flight. Times are expressed in eastern daylight time, based on a 24-hour clock.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT START of RECORDING START of TRANSCRIPT 1832:29 CTR-? ... contact Chicago's Cleveland cen

niner seven. 1832:33 RDO-1 twenty six ninety seven, USAir four day. 1833:08 RDO-1 center USAir four twenty seven at 

1833:14 CLE2 USAir four twenty seven, Clevelan1833:32 CLE2 USAir four twenty seven, cleared d

rest of route unchanged give me thairspeed in-trail spacing. 1833:37 RDO-1 direct Akron, best forward, you got USAir. 1835:04 HOT-1 [sound similar to person yawning] 1837:46 CAM [interruption in CVR audio similar to passing of CVR tape splice] 
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1838:00 RDO-1 blocked. 1840:38 CLE2 USAir four twenty seven, contact C

one niner point eight seven. 1840:43 RDO-1 nineteen eighty seven, USAir four tday. 1840:50 RDO-1 Cleveland, USAir four twenty seven 

1840:54 CLE3 USAir four twenty seven Cleveland 

what is the indicated airspeed now

1840:57 RDO-1 uh, we're indicating uh, 'bout uh, th

assigned. 1843:23 CLE3 USAir fourteen seventeen, contact one three three point three seven. 1843:27 US1417 three three three seven, USAir's uhseventeen. good day. 1843:32 HOT-1 had a four and a seven in it. 1843:34 HOT-2 ha ha ha.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1843:37 HOT-1 do you wanta let 'em up for a while? 1843:42 CAM [sound of single chime similar to seat belt switch being moved] 1845:31 CLE3 USAir four twenty seven, descend 

level two four zero. 1845:35 RDO-1 out of two nine oh for two four oh, seven. 1845:55 HOT-2 ah you piece of #. 1845:56 HOT-1 what? 1845:58 HOT-2 I said, aw c'mon, you piece of #, this damn thing is so # slow. 1846:07 HOT-2 there it is. 1847:23 CLE3 USAir four twenty seven contact Ctwo eight point one five. 1847:27 RDO-1 twenty eight fifteen, USAir four twe
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT day. 1847:35 RDO-1 center, USAir four twenty seven de

oh. 1847:38 CLE4 USAir four twenty seven Cleveland 

1850:11 DL1083 and center, Delta ten eighty three's 

seventeen five going down to one o

1850:15 CLE4 Delta ten eighty three Cleveland ce

CUTTA at one zero thousand. Pit aone one. 1850:18 CAM [aural tone similar to altitude alert] 1850:21 DL1083 CUTTA at ten thousand, Delta ten 

1850:56 CLE4 USAir four twenty seven cross CUT

one zero thousand Pit altimeter thr

1851:01 RDO-1 CUTTA at ten, thirty eleven, USAir 

1851:08 HOT-2 ten, CUTTA. 1851:11 HOT-1 it's true.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1851:18 HOT-1 I'm off. 1851:18 HOT-2 alright. 1851:22 ATIS ..Pittsburgh tower arrival informatio

five two Zulu weather. two five thovisibility one five. temperature seveone. wind, two seven zero at one zero one zero. multiple approachetwo and ILS runway two eight right runway two eight right middle marksouth entrance Air Force Reserve Morgantown vortac out of service. contact you have information Yank

1851:54 HOT-1 three two and two eight right. 1851:57 HOT-2 three two and two eight right? 1851:58 HOT-1 yep. 1851:59 HOT-? *. 1852:18 HOT-2 oh why did it *? 1853:15
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT CAM [sound similar to cockpit door being opened and closed] 1853:26 CAM-3 um, they didn't give us connecting flight information or anything. do you know what gate we're coming in on? 1853:29 CAM-1 not yet. 1853:30 CAM-3 any idea *. 1853:31 CAM-1 no. 1853:32 CAM-3 doya' know what I'm thinkin' about? pretzels. 1853:34 HOT-1 pretzels. 1853:37 CAM-3 you guys need drinks here? 1853:38 CAM-1 uh, I could use a glass of somethin', whatever's open. water uh, water, a juice.. 1853:44 CAM-2 I'll splita yeah. a water, a juice, whatever's back there I'll split one with 'im. 1853:48 CAM-3 OKedoky.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1853:51 CAM-3 do you want me to make you my special fruity juice cocktail? (you wanna try it?) 1853:56 CAM-1 how fruity is it? 1853:57 CAM-3 (try it?) 1853:58 HOT-2 alright, I'll be a guinea pig. 1854:02 CAM [sound similar to cockpit door being closed] 1854:07 HOT-1 [sound similar to person taking a deep breath] 1854:19 CLE4 Delta ten eighty three, reduce spee

Pit approach one two one point two 

1854:24 DL1083 twenty one twenty five, good day. 1854:27 CLE4 USAir four twenty seven cross CUT

thousand two five zero knots now. 1854:30 RDO-1 ten two fifty over CUTTA, USAir fou

1854:36 HOT-2 this thing's gonna scream and holler. I can't do that.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1854:42 HOT-1 thirty eleven. 1854:43 HOT-2 thirty eleven set. 1854:44 HOT-1 you can't make it? 1854:45 HOT-2 it's gonna say it can't. 1854:49 HOT-2 because its .... it it uh, it'll do it. I'll make it do it. 1854:53 CAM [sound of unidentified click] 1854:55 HOT-2 see, it's callin' me names like it did you. 1856:16 CLE4 USAir four twenty seven reduce sp

now that's at the request of Pit appspeed first. 1856:22 RDO-1 OK speed back to two ten USAir fouh, we'll do our best to make the re

1856:27 CLE4 don't have to now. just uh, speed f1856:31 RDO-1 you got it.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1856:32 CLE4 USAir four twenty seven, contact P

one point two five. 1856:36 RDO-1 twenty one twenty five, USAir four day. 1856:43 HOT-1 two ten, he said. 1856:45 HOT-2 two ten? oh, I heard two fifty, #. 1856:49 HOT-1 I may have misunderstood him. 1856:52 RDO-1 approach, USAir four twenty seven 

ten. 1856:55 APR Shuttle twenty nine zero eight, turn niner zero. contact approach one five. 1857:05 APR USAir fourteen ninety nine, turn lefzero. contact approach one two fo

1857:07 CAM [sound similar to cockpit door being opened] 1857:08
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT CAM-3 here it is. 1857:09 HOT-1 alright. 1857:09 HOT-2 alright. thank you, thank you. 1857:10 CAM-3 (now ** be fooled) if you don't like, I didn't taste 'em so I don't know if they came out right. 1857:11 US1499 one hundred degrees and twenty fo

fourteen ninety nine. 1857:14 APR USAir eighteen seventy four, descethousand. 1857:14 HOT-1 that's good [simultaneous with previous ATC transmission] 1857:15 CAM-3 *. 1857:16 HOT-2 that is good .. 1857:17 CAM-3 it's good. 1857:17 HOT-2 ..that is different. be real, be real good with some dark 
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT rum in it. 1857:20 CAM-3 yeah right. (can I get you something else?) 1857:23 APR USAir four twenty seven, Pittsburg

one six zero vector ILS runway two approach course. speed two one z

1857:26 HOT-2 what kind of speed? OK. 1857:29 RDO-1 we're, comin' back to two ten and u

down to ten, USAir four twenty sevYankee. 1857:40 HOT-1 what runway did he say? OK. 1857:43 APR USAir fourteen sixty two, Pittsburgzero four zero vector ILS three two course. 1857:43 HOT-2 ***. 1857:45 HOT-1 it tastes like a ** 1857:46 HOT-2 good.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1857:47 HOT-1 there's little grapefruit in it. 1857:49 CAM-3 no. [sound of laughter] 1857:54 APR USAir sixteen seventy four turn left 

zero. contact approach one two fo

1857:54 HOT-2 ** cranberry. 1857:55 CAM-3 yeah. you saw that from the color. 1858:00 US1674 twenty four fifteen and a hundred o

sixteen seventy four. 1858:02 CAM-1 how else is in it? 1858:03 CAM-2 uh, sprite? 1858:03 APR Delta ten eighty three, descend and 

thousand. 1858:04 CAM-3 diet sprite. 1858:06 CAM-2 huh.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1858:07 DL1083 six thousand, ten eighty three. 1858:08 CAM-3 and I guess you could do it with sprite. prob'ly be a little better if you do. 1858:10 CAM-1 yeah, there's more? 1858:11 CAM-3 one more. 1858:13 CAM-2 ah. 1858:13 HOT-2 oh jay? 1858:14 APR USAir three seventy four, turn right 

zero. 1858:14 CAM-3 you got it. 1858:17 HOT-2 huh. 1858:17 CAM-3 cranberry orange and diet sprite. 1858:17 CAM-2 really nice.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1858:18 CAM-3 it's different. could ya keep comin' out aaah, whataya' got different and .. 1858:20 CAM-1 I always mix the cranberry and the grapefruit, I like that. 1858:21 APR USAir eighteen seventy four, reduc

one niner zero then continue the desix thousand. 1858:24 CAM [sound of aural tone similar to altitude alert] 1858:25 CAM-3 ** OK, back to work. 1858:26 CAM-2 OK. 1858:29 CAM [sound similar to cockpit door opening and closing] 1858:29 HOT-2 I suspect we're gonna get the right side. 1858:33 APR USAir four twenty seven, descend 

thousand. 1858:36 RDO-1 cleared to six, USAir four twenty se
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1858:36 HOT-1 [intermittent static sound (heard on captain's channel only) lasting for three seconds] 1858:48 CAM [sound of click similar to approach plate clip being snapped] 1858:50 HOT-2 oh my wife would like that [non-pertinent comment] 1858:56 HOT-1 cranberry orange and sprite. 1858:57 APR USAir sixteen seventy four, contac

four point one five. 1858:58 HOT-2 yeah. 1859:04 HOT-2 I guess we ought to do a preliminary Pete. 1859:06 HOT-1 altimeters and flight instruments thirty eleven? 1859:08 HOT-2 my side. 1859:11 HOT-1 aah, where are we .... landing data is ... 1859:12 285LM Pit, two eight five Lima Mike is thirt
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT Allegheny's Hotel. 1859:14 HOT-2 posted on my side for a hundred and nine. 1859:15 APR November two eight five Lima Mike

approach. direct Montour vector ILfinal approach course. 1859:16 HOT-1 thirty three, forty three an two hundred. 1859:21 285LM Montour on the vectors, Lima Mike

1859:22 HOT-1 shoulder harness? 1859:24 APR USAir fourteen sixty two, descend 

thousand. 1859:25 HOT-2 on. 1859:28 CAM [sound of clicks similar to shoulder harness being fastened] 1859:28 HOT-1 approach brief? 1859:30 APR USAir three seventy four, contact a
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT three point niner five, good day. 1859:31 HOT-2 plan two eight right. two seventy nine inbound, one eleven seven. 1859:36 HOT-2 [sound similar to deep inhale and exhale] 1859:41 APR USAir three zero nine, Pittsburgh a

zero five zero vector ILS runway thapproach course. 1859:54 HOT-1 ah, don't do this to me. 1859:56 HOT-2 [sound of chuckle] froze up did it? 1900:08 APR Delta ten eighty three, turn left heareduce speed to one niner zero. 1900:12 HOT-1 [intermittent static sound (heard on captain's channel only) for seventeen seconds] 1900:12 HOT-1 I hate it when you don't hear the other transmissions. 1900:13 DL1083 one thirty one ninety speed, Delta 

1900:14
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT HOT-2 [chuckle] yeah. 1900:15 APR USAir four twenty seven turn left he

zero, reduce speed to one niner ze

1900:20 RDO-1 OK, one four zero heading and one 

speed, USAir four twenty seven. 1900:24 CAM [sound of three clicks similar to flap handle being moved] 1900:26 CAM [sound of single chime similar to seat belt chime] 1900:26 HOT-2 oops, I didn't kiss 'em 'bye. 1900:28 CAM [clicking sound similar to trim wheel turning at auto-pilot trim speed] 1900:31 HOT-2 what was the temperature, 'member? 1900:33 APR five Lima Mike contact Pittsburgh d

four point seven five. 1900:34 HOT-1 seventy five. 1900:35 HOT-2 seventy five?
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1900:37 CAM [clicking sound similar to trim wheel turning at auto-pilot trim speed] 1900:40 285LM twenty four seventy five, Lima Mike

1900:43 PA-4 ... seatbelts and remain seated for the duration of the flight. 1900:44 PA-2 folks, from the flight deck we should be on the ground in 'bout ten more minutes. uh, sunny skies, little hazy. temperature, temperature's ah, seventy five degrees. wind's out of the west around ten miles per hour. certainly 'preciate you choosing USAir for your travel needs this evening, hope you've enjoyed the flight. hope you come back and travel with us again. this time we'd like to ask our flight attendants please prepare the cabin for arrival. ask you to check the security of your seatbelts. thank you. 1900:46 APR Delta ten eighty three, turn left hea

1900:48 DL1083 one zero zero, ten eighty three. 1901:04 RDO-1 did you say two eight left for USAir 

1901:06 CAM [chime similar to seatbelt chime]
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1901:06 APR uh, USAir four twenty seven, it'll be 

1901:08 RDO-1 two eight right, thank you. 1901:10 HOT-1 two eight right. 1901:11 HOT-2 right, two eight right. that's what we planned on. autobrakes on one for it. 1901:18 APR Delta ten eighty three contact appr

point one five. 1901:22 DL1083 twenty four fifteen, good day. 1901:26 APR USAir fourteen sixty two at six thouto one niner zero. 1901:35 HOT-1 I can't ***. 1901:36 APR USAir three zero niner, descend an

thousand then reduce speed to one 

1901:42 HOT-2 Bravo thirty nine .... that's not too bad that's ...
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1901:47 APR USAir eighteen seventy four turn rig

zero. contact approach one two th

1901:48 HOT-2 .. 'bout half way. 1901:50 CAM [aural tone similar to altitude alert] 1901:51 HOT-2 (then) ... (works) 1901:56 HOT-1 seven for six. 1901:57 APR USAir fourteen sixty two turn right 

zero. 1901:58 HOT-2 seven for six. 1902:06 HOT-1 boy, they always slow you up so bad here. 1902:08 HOT-2 that sun is gonna be just like it was takin' off in Cleveland yesterday too. I'm just gonna close my eyes. [sound of laughter] you holler when it looks like we're close. [sound of laughter] 1902:24 HOT-1 [sound of chuckle] OK.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1902:24 APR USAir four twenty seven, turn left h

zero. traffic will be one to two o'clonorthbound Jetstream, climbing oufive thousand. 1902:32.0 RDO-1 we're looking for the traffic, turning USAir four twenty seven. 1902:32.9 CAM [sound similar to aircraft engines increasing in RPM to a steady value] 1902:34.8 CAM [clicking sound similar to trim wheel turning at auto-pilot trim speed] 1902:54.3 HOT-2 oh ya, I see zuh Jetstream. 1902:57.0 HOT-1 [sound similar to three thumps] 1902:57.3 HOT-1 sheeez. 1902:57.5 HOT-2 zuh. 1902:58.0 CAM [sound of thump]
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1902:58.5 HOT-1 [sound similar to person inhaling/exhaling quickly one time] 1902:58.6 CAM [sound of "clickety click"] 1902:59.1 CAM [sound of thump of less magnitude than the first thump] 1902:59.3 HOT-1 whoa. 1902:59.5 CAM [sound of "clickety click"] 1903:00.3 HOT-2 [sound similar to pilot soft grunting 1903:00.7 CAM [sound of unknown click] 1903:01.1 HOT-1 hang on. 1903:01.1 CAM [sound similar to aircraft engines increasing in RPM] 1903:01.5 HOT-2 [sound similar to pilot loud grunting] 1903:01.9 HOT-1 hang on.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1903:02.1 CAM [sound of click and wailing horn similar to auto-pilot disconnect] 1903:03.6 HOT-1 hang on. 1903:04.4 HOT-2 oh #. 1903:05.2 HOT-1 hang on. 1903:07.5 CAM [sound of increasing amplitude similar to onset of stall buffet] 1903:07.9 CAM [vibrating sound similar to aircraft stick shaker starts and continues to end of recording] 1903:08.0 HOT-1 what the hell is this? 1903:08.3 CAM [sound of aural tone similar to altitude alert] 1903:09.4 JSAP traffic traffic 1903:09.4 CAM traffic traffic 1903:09.6 HOT-1 what the ...
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1903:09.9 HOT-2 oh... 1903:10.6 HOT-1 oh God.. oh God. 1903:13.3 APR USAir.... 1903:15.0 RDO-1 four twenty seven emergency. 1903:17.4 HOT-2 #. 1903:18.1 HOT-1 pull 1903:18.5 HOT-2 oh #. 1903:19.1 HOT-1 pull 1903:19.7 HOT-1 (pull) 1903:20.8 HOT-2 God. 1903:21.1 HOT-1 [sound of screaming] 1903:22.5 HOT-2 no.
INTRA-COCKPIT COMMUNICATION AIR-GROUND COMMUNI

TIME & TIME & SOURCE CONTENT SOURCE CONTENT 1903:22.8 END of RECORDING END of TRANSCRIPT
Appendixes 328 Aircraft Accident Report

Appendix C

History of Federal Aviation Administration Airworthiness 

Directives Related to the Boeing 737 Rudder System 

FAA records indicate that 10 airworthiness directives (AD) related to the Boeing

737 rudder system have been issued since 1980. Each of these ADs is described below and

summarized in the table that follows. 

On April 21, 1980, AD 80-07-02 became effective. It required a test on Boeing

737 airplanes within 3 days to determine if the main rudder power control unit (PCU) and

other flight components could fail. The AD was prompted by a finding that components

manufactured by a company other then Parker were installed in the PCU by a repair

station or operator. 

On March 3, 1994, AD 94-01-07 became effective. It required a test of the main

rudder PCU every 750 flight hours until the PCU was replaced with a PCU incorporating a

redesigned servo valve. This test was used to determine if the PCU servo valve was in

proper operating condition by evaluating rudder system hydraulic flow or internal leakage

within the servo valve resulting from improperly positioned servo valve slides. The

750-hour test requirement was removed when the PCU was replaced with a redesigned

servo valve. The USAir flight 427 aircraft had been tested for compliance with the AD on

March 21, June 18, and August 8, 1994. AD 94-01-07 was superceded by AD 97-14-04

(which became effective on August 4, 1997.

On March 14, 1995, telegraphic AD 95-06-53 was issued regarding certain 737s

that had PCUs serviced by a repair station. The FAA determined that assembly methods

for the PCU servo valve did not guarantee that the servo valve primary and secondary

slides would be properly set, which could result in the servo valve not functioning

properly. The AD required removing or testing of the suspect parts within the next five

flights. This action affected approximately 50 airplanes.

On November 27, 1996, AD 96-23-51 became effective. It required all 737 series

airplanes to be inspected within 10 days and every 250 flight hours afterward. This AD

was the result of findings related to testing of the main rudder PCU during the USAir

flight 427 accident investigation. These findings indicated that a jam of the secondary

slide to the servo valve housing and subsequent rudder input could result in the rudder

moving opposite of its intended direction. The AD required that a full rudder pedal

displacement be made to the travel limit of the rudder and then a sudden full pedal

command be made to the opposing direction. If the pedals moved normally, the test was

successful; if they did not, the rudder PCU was required to be replaced immediately. The

250-hour test requirement was removed when the PCU was replaced with one that

incorporated a redesigned servo valve. AD 96-23-51 was superceded by AD 97-14-04

(which became effective on August 4, 1997).
Appendixes 329 Aircraft Accident Report

On January 17, 1997, AD 96-26-07 became effective. The AD required revising

the airplane flight manual (AFM) for all 737 series airplanes within 30 days to include

procedures that would enable the flight crew to take “appropriate action to maintain

control of the airplane during an uncommanded yaw or roll condition” and “correct a

jammed or restricted flight control condition.” The FAA stated that the AD had been

prompted because such procedures were not defined adequately in the existing version of

the 737 AFM. The AD established a “recall” procedure to be performed by flight crews

immediately, from memory, in the event of an uncommanded yaw or roll. The FAA

specified that air carriers could comply with the AD by inserting a copy of it in the AFM. 

On March 19, 1997, AD 97-05-10 became effective. It required certain 737 main

rudder PCUs to be removed or tested within 90 days to determine if they had been

assembled by a repair station with an incorrect fastener used to retain the summing levers.

This anomaly was discovered when an operator noted cracking of the summing lever

bearing. The FAA found that the fastener installed by the repair station caused the bearing

to crack. This AD affected approximately 200 PCUs. 

On June 9, 1997, AD 97-09-15 became effective. It required an inspection of the

yaw damper engage solenoid. If the solenoid part number was within a specified range,

the solenoid valve was required to be replaced with a redesigned valve. This AD resulted

from Safety Board’s test findings in connection with the investigation of USAir flight 427

accident, which indicated that hydraulic fluid was contaminating the coils of the valve and

causing it to fail. The redesigned valve utilized sealed coils that were impervious to

hydraulic fluid. The AD required that the valves be replaced within 5 years or 15,000

flight hours after the AD’s effective date or the next time the PCU was sent to a repair

facility, whichever was earlier.

On August 1, 1997, AD 97-14-03 became effective. It requires the installation,

within 3 years, of a newly designed rudder surface limiting device that reduces the rudder

authority at flight conditions in which full rudder authority is not required. It also required

the installation of a redesigned yaw damper system with improved reliability and fault

monitoring capabilities. These actions were the result of Safety Recommendations

A-96-107 and -110, which were issued on October 18, 1996, in connection with the USAir

flight 427 accident investigation.

On August 4, 1997, AD 97-14-04 became effective. It required that all actions

included in ADs 94-01-07 and 96-23-51 be implemented and that, within 2 years, all main

rudder PCUs be replaced with a PCU that has a redesigned servo valve. The AD also

required that the PCU’s vernier control rod bolts be replaced with bolts that are less likely

to fail and that a leak test be performed on the PCU within 4,000 to 6,000 flight hours of

the AD’s effective date and at 6,400 hour intervals thereafter. This leak test was designed

to detect latent jams of the servo valve slides. 

On January 20, 1998, AD 97-26-01 became effective. It required an inspection to

detect galling on the standby rudder actuator input bearing and shaft within 18 months or

4,500 flight hours. The shaft and bearing are to be replaced with a redesigned shaft and

bearing within 3 years of the AD’s effective date. This AD, which affected approximately
Appendixes 330 Aircraft Accident Report

2,800 airplanes, was the result of findings related to the investigation of the United

Airlines flight 585 accident and Safety Recommendation A-96-115, issued on October 18,

1996, in connection with the USAir flight 427 accident investigation.

AD 

number Title

Affected 

airplanes 

Effective 

date

Compliance 

deadline Description

80-07-02 Flight 

Control 

Systems

All model 707, 

720, 727, 737, 

and 747 series 

airplanes that 

contain specific 

hydraulic 

components 

manufactured 

by Fortner 

Engineering and 

Manufacturing.

04/21/80 3 days after 

the AD’s 

effective 

date.

Conduct a one-time manual 

input hardover test on the 

flight control systems 

(including the rudder, 

elevators, and ailerons).

94-01-07 Main 

Rudder 

PCU

Model 737 

series airplanes, 

line positions 1 

through 2453 

(inclusive).

03/03/94 Within 750 

flight hours 

after the 

AD’s 

effective 

date.

Perform a test of the main 

rudder PCU to detect 

internal leakage of 

hydraulic fluid. Repeat test 

at 750-hour intervals unless 

replaced with new main 

rudder PCU. Superseded 

by AD 97-14-04.

95-06-53 Rudder 

Actuator 

Piston

All model 737 

series airplanes.

03/14/95 Within 5 

flights after 

the AD’s 

effective 

date.

Compare part and serial 

numbers of the main rudder 

PCU with those on a list of 

suspect parts. If applicable, 

remove and replace PCU 

with serviceable part or 

perform specified testing.

96-23-51 Main 

Rudder 

PCU

All model 737 

series airplanes.

11/27/96 Within 10 

days after 

the AD’s 

effective 

date.

Perform testing of the main 

rudder PCU in accordance 

with Boeing Alert Service 

Bulletin 737-27A1202. 

Repeat test at 250-hour 

intervals unless replaced 

with new main rudder PCU. 

Superseded by 

AD 97-14-04.

96-26-07 737 AFM 

Revision 

All model 737 

series airplanes.

01/17/97 Within 30 

days after 

the AD’s 

effective 

date.

Revise the AFM to include 

procedures that would 

enable the flight crew to 

take appropriate action to 

maintain control of the 

airplane during an 

uncommanded yaw or roll 

and correct a jammed/

restricted flight control 

condition. 
Appendixes 331 Aircraft Accident Report

AD 

number Title

Affected 

airplanes 

Effective 

date

Compliance 

deadline Description

97-05-10 Main 

Rudder 

PCU 

Model 737 

series airplanes 

with a main 

rudder PCU 

identified in 

Boeing Service 

Letter 737-SL27-112-B, dated 

02/06/97.

03/19/97 90 days after 

the AD’s 

effective 

date.

Remove the main rudder 

PCU and replace the 

improper fastener with a 

correct fastener or perform 

specified testing.

97-09-15 Engage 

Solenoid 

Valve 

Inspection

All model 737-

100 through 

-500 series 

airplanes.

06/09/97 5 years or 

15,000 flight 

hours after 

the AD’s 

effective date 

or the next 

time the PCU 

is sent to a 

repair facility.

Perform a one-time 

inspection of the engage 

solenoid valve of the yaw 

damper to determine the 

part number (P/N) of the 

valve. If the valve P/N falls 

within the range specified, 

replace the valve with a 

new one.

97-14-03 Rudder 

Authority 

and Yaw 

Damper 

System

All model 737-

100 through 

-500 series 

airplanes.

08/01/97 Within 

3 years of 

the AD’s 

effective 

date.

Install a newly designed 

rudder limiting device that 

reduces the rudder 

authority during flight 

conditions for which full 

rudder authority is not 

required. Install a newly 

designed yaw damper 

system that improves 

reliability and fault 

monitoring capability.

97-14-04 Main 

Rudder 

PCU

All model 737-

100 through 

-500 series 

airplanes.

08/04/97 Within 

2 years after 

the AD’s 

effective 

date.

Perform all actions required 

by ADs 94-01-07 and 

96-23-51. Replace any 

main rudder PCU having 

Boeing P/N 65-44861 or 

P/N 65C37052 with a new 

main rudder PCU. Replace 

the vernier control rod bolts 

having Boeing P/N 

69-27229 with new bolts. 

Perform a leak test of the 

main rudder PCU within 

4,000 to 6,000 hours of the 

AD’s effective date. Repeat 

the leak tests at 6,400-hour 

intervals.
Appendixes 332 Aircraft Accident Report

AD 

number Title

Affected 

airplanes 

Effective 

date

Compliance 

deadline Description

97-26-01 Standby 

Rudder 

PCU Input 

Shaft and 

Bearing 

Inspection

Model 737-100 

through -500 

series airplanes, 

line numbers 1 

through 2814 

(inclusive).

01/20/98 Within 18 

months or 

4,500 hours 

after the 

AD’s 

effective 

date.

Perform an inspection to 

detect galling on the input 

shaft and bearing of the 

standby rudder PCU within 

18 months or 4,500 hours 

after the AD’s effective 

date, whichever occurs 

later. Replace the input 

bearing of the standby 

rudder PCU with an 

improved bearing within 

3 years after the AD’s 

effective date. 
Appendixes 333 Aircraft Accident Report

Appendix D

Critical Design Review Recommendations and 

Federal Aviation Administration Responses 

Because the USAir flight 427 accident and other 737 accidents and incidents

raised questions regarding the 737’s flight control systems, on October 20, 1994, the FAA

initiated a Critical Design Review (CDR) of the 737 flight control systems with emphasis

on the roll control and directional flight control systems. The CDR team included seven

flight control specialists from the FAA, Transport Canada, and the U.S. Air Force. The

team’s final report, entitled B-737 Flight Control System Critical Design Review, was

issued on May 3, 1995.

The FAA’s responses to the CDR team’s 27 recommendations were presented in an

August 27, 1998, letter to the Safety Board. The CDR team’s recommendations and the

FAA’s responses were described in the FAA’s letter as follows: 

CDR Recommendation 1: Develop national policy and/or rulemaking as

necessary and applicable to transport-category airplanes that defines

“normal” with respect to jams. This definition should include consideration

of a jam of a control surface at any position up to its full deflection as

limited by design.

CDR Recommendation 2: Develop national policy requiring that, when

alternate means for flying an airplane are employed, those means shall not

require exceptional pilot skill and strength and that the pilot can endure the

forces for a sufficient period of time to ensure a safe landing. 

CDR Recommendation 3: Formally establish the transport-category

airplane requirement for redundancy in the directional control system to

maintain control in the event of a rotor burst for the most critical phase of

flight. Determine whether this requirement should be applied to new typecertificate applications, derivative applications, or aircraft in production.

FAA Response to CDR Recommendations 1, 2, and 3: Public meeting on

12/03/96 held to discuss flight control jam “normally encountered”

condition. Issue will go to new working group in ARAC [Aviation

Rulemaking Advisory Committee]. Terms of reference for the

harmonization of requirements has been developed to guide the effort.

Schedule for completion to be determined. 

CDR Recommendation 4: Develop national policy for transport-category

airplanes requiring the determination of critical hydraulic flight control

system and component sensitivity (jam potential and actuator performance)

to contamination, requirements for sampling hydraulic fluid, and

requirements for actuator components to eliminate or pass (shear)

particulate contamination.

FAA Response to CDR Recommendation 4: SAE [Society of

Automotive Engineers] A-6 Committee has made recommendations on
Appendixes 334 Aircraft Accident Report

chip shear requirements; FAA review of requirements to be completed

April 1998. SAE A-6 recommendations made on contamination to be

completed October 1998.

CDR Recommendation 5: Develop and provide additional guidance in AC

[Advisory Circular] 1309-1A confirming that transport-category airplane

failure analysis action items are required flight procedures in response to

the failure condition.

CDR Recommendation 6: Require the action items be practical.

FAA Response to CDR Recommendations 5 and 6: ARAC working

group activity.

CDR Recommendation 7: Establish process in cooperation with AFS [the

FAA’s Flight Standards Service] to require flight crew action items be

implemented or require revision of failure analysis to not require action

item.

FAA Response to CDR Recommendation 7: Process for reviewing

engineering determination of flight crew action following failure is under

review. 

CDR Recommendation 8: Review the adequacy of the 737 aileron transfer

mechanism throughout the airplane operating envelope in the event of a

sustained jam of the ailerons up to their limit deflection. Pilot skill and

strength requirements should be consistent with the results of [CDR]

Recommendation 2. Control margins from this condition should be

sufficient to allow continued safe flight and landing, including necessary

maneuvers such as a crosswind landing or go-around.

CDR Recommendation 9: Ensure that the capability of the 737 lateral [roll]

control system to provide adequate directional control is clearly

demonstrated throughout the airplane operating envelope after these

failures, unless they are shown to be extremely improbable by the most

rigorous methodology available.

FAA Response to CDR Recommendations 8 and 9: Aileron transfer

mechanism data reviewed and approved 11/30/95. AD 96-26-07 addresses

adequacy of lateral [roll] control to provide directional control. No further

action planned.

CDR Recommendation 10: Determine the requirement for and the

feasibility of incorporating additional means to protect these components

[as addressed in Recommendations 8 and] in the main wheel well of the

737 from the effects of environmental debris.

CDR Recommendation 11: Ensure the incorporation of wheels based on

TSO-C26 Revision C or later revision.

FAA Response to CDR Recommendations 10 and 11: AD 97-01-10

issued 08/12/97, and AD 97-18-06 issued 10/08/97. No further action

planned.
Appendixes 335 Aircraft Accident Report

CDR Recommendation 12: Require failure analysis of the 737 yaw damper

identified components and any relevant tests be conducted to identify all

failure modes, malfunctions, and potential jam conditions of these vital

elements. 

CDR Recommendation 13: Require corrective action(s) for those failure

modes or malfunctions [as addressed in Recommendation 12] not shown to

be extremely improbable.

FAA Response to CDR Recommendations 12 and 13: Analysis

completed by the FAA on 11/30/95. No further action planned.

CDR Recommendation 14: Require appropriate action be taken to reduce

the number of 737 yaw damper failure occurrences to an acceptable level.

FAA Response to CDR Recommendation 14: AD 98-02-01 in Federal

Register 02/17/98; AD 97-14-03 issued 06/23/97; AD 97-09-15 issued

04/24/97 (currently being revised—NPRM for revision in Federal Register

11/13/97, docket number 97-NM157AD).

CDR Recommendation 15: Require appropriate action be taken to correct

the referenced galling condition of the standby rudder on the 737.

FAA Response to CDR Recommendation 15: AD 97-26-01 was issued

on 12/08/97; no further action planned. 

CDR Recommendation 16: Review and revise, as appropriate, the 737

inspection tasks associated with the latent failures identified in Tables 3

and 4 in Section 10 [of the final CDR report] in accordance with MSG-3

[Maintenance Steering Group 3].

CDR Recommendation 17: Require that the identified latent failures have

fixed-interval inspection frequencies, as provided by ACs 25.1309-1A and

25-19. Consideration should be given to interval ranges flexible enough to

allow normal inspection schedules.

CDR Recommendation 18: Revise the 737 MRB/MPD [Maintenance

Review Board/Maintenance Planning Document] inspection task

description and interval for the following latent failures:

Latent failure

Recommended 

inspection interval Tasks

Aileron transfer mechanism ≤ 1C

≤ 3C

Operational check

Measure forces at wheel

Aileron spring cartridge ≤ 1C Operational check conducted with the 

transfer mechanism inspection

Standby hydraulic system, 

including rudder function

≤ 1A Operational check
Appendixes 336 Aircraft Accident Report

FAA Response to CDR Recommendations 16, 17, and 18: MRB review

completed, and corrections incorporated.

CDR Recommendation 19: Revise 737 flight crew training programs to

ensure the use of the proper procedures for recovery from flightpath upsets

and flight crew awareness regarding the loss of airplane performance due

to a flight control system malfunction. Consideration should be given to

flight crew action items as a consequence of the failure analysis developed

for the relevant flight control system and the failure conditions/

malfunctions examined in Appendix 5 [of the CDR final report]. (This may

require Airplane Flight Manual or Operations Manual revision.)

FAA Response to CDR Recommendation 19: AD-96-26-07 addresses

issue for the 737.

CDR Recommendation 20: Require that only PC- [production certificate]

or PMA- [parts manufacturing approval] approved replacement parts be

used when overhauling primary elements in the flight control system

(hydraulic servos and bypass valves) of the 737 airplanes. Ensure

replacement parts, as provided by a non-original equipment manufacturer

(OEM) or fabricated under SFAR [Special Federal Aviation Regulation] 36

authority, that are used when overhauling primary elements in the flight

control system have had their designs approved and processed through the

ACO [Aircraft Certification Office] that originally approved the OEM

parts. This means that the replacement parts will have undergone

qualification in terms of design (including material, heat treat, dimensions,

tolerances, and geometric controls), analysis, and tests (qualification and

acceptance) equivalent to the OEM certified part. An analysis is necessary

to verify that the replacement part will mate properly with the next

assembly under all design tolerance conditions.

FAA Response to CDR Recommendation 20: Flight Standards

Information Bulletin dated 02/13/96 provides guidance.

CDR Recommendation 21: Require any issuance of PMA for primary

flight control servo and bypass valves be concurred with the Aircraft

Certification Office that certified the original parts or assembly.

FAA Response to CDR Recommendation 21: Under review.

CDR Recommendation 22: Form a team composed of a systems engineer, a

manufacturing inspector, and an airworthiness maintenance inspector to

assess the repair procedures, process, and tooling used in every repair

station approved by the FAA to overhaul the 737 PCU and its components.

In addition, this team should reassess all 737 PCU PMAs and SFAR 36

data (design, manufacturing, and fabrication) approvals for adequacy in

consideration of [CDR] Recommendations 20 and 21.

FAA Response to CDR Recommendation 22: Flight Standards

Information Bulletin dated 02/13/96 provides guidance.

CDR Recommendation 23: Evaluate the adequacy of the 737 maintenance

manual actions addressing flight control cable inspection, rigging

procedures, and replacement criteria.
Appendixes 337 Aircraft Accident Report

CDR Recommendation 24: Require control cable service life limits unless

acceptable inspection and/or test procedures are developed and utilized to

determine the continuing serviceability of the control cables.

FAA Response to CDR Recommendations 23 and 24: Cable

maintenance practice revised during period of 11/95 through 12/96. Boeing

Maintenance Manuals revised to provide for comprehensive control cable

inspection. These two recommendations are completed.

CDR Recommendation 25: Determine the degree of incorporation of the

following list of Service Bulletins (includes In-Service Activities Report)

in the 737 fleet and, in consideration of the recommendations in Section 15

[of the CDR final report], reassess their safety impact and, as appropriate,

require their incorporation on applicable models of the 737.

737 Service Bulletins

No. Title Date

B737-27-1060 Rudder Pressure Reducer and Relief Valve 

Inspection/Removal

Oct. 3, 1972

B737-27-1033 Improvement of Lateral Control Transfer Mechanism Feb. 13, 1970

B737-27-1081 Inspection of Ground Spoiler Shutoff Valve Control 

Cable Assembly

Dec. 10, 1976

B737-27-1125 Flight Controls, Cable Guard Modification (Pitch) Mar. 8, 1985

B737-27-1134 Flight Controls, Aileron Centering and Trim 

Mechanism Modification

July 11, 1986

B737-27-1152 Flight Controls, Aileron Trim Bracket Replacement May 12,1988;

Dec. 22,1988 

(rev. 2)

B737-27-1154 Flight Controls, Aileron Pulley Bracket Inspection/

Replacement

Aug. 25, 1988

B737-27-1155 Flight Controls, Aileron Centering Spring and Trim 

Mechanism Modification

Oct. 26, 1989

B737-29-1062 Hydraulic Power, Main and Auxiliary, Standby and 

Ground Service Pressure Filter Modification

Feb. 14, 1991

737 In-Service Activities Report

No. Title Date

95-04-2725-10 Rudder Power Control Unit (PCU) Yaw Damper 

Solenoid Valve configuration for use on Rudder PCU 

Spec. No. 10-60881-8 and -13

Feb. 24, 1995
Appendixes 338 Aircraft Accident Report

FAA Response to CDR Recommendation 25: AD 97-01-10 issued

01/03/97; AD 97-03-14 issued 01/29/97; AD 97-04-01 issued 02/04/97. No

further action planned. 

CDR Recommendation 26: Determine the degree of incorporation of the

following list of Service Letters in the 737 fleet and, in consideration of the

recommendations in Section 15 [of the CDR final report], reassess their

safety impact and, as appropriate, require their incorporation on applicable

models of the 737.

FAA Response to CDR Recommendation 26: AD 97-05-09 issued

02/25/97, and AD 97-09-14 issued 04/24/97. No further action planned.

CDR Recommendation 27: Request that the NTSB form a special accident

investigation team to begin a new combined investigation of both the 737

Colorado Springs and the Pittsburgh accidents. The accident investigation

team should include an FAA representative from the CDR team and the

NTSB aviation safety investigator that worked with the CDR team. This

will ensure that all of the data from the CDR is available for review by the

accident investigation team. It is further recommended that NTSB

personnel on the team not be from the original accident investigation teams

and that the NTSB include at least two accident investigators (one each—

airplane systems and flight operation) from another competent aviation

authority of the world who has experience with 737 airplanes.

FAA Response to CDR Recommendation 27: NTSB has formed a special

group of consultants in support of the ongoing accident investigation.

Letter No. Title Date

B737-SL-27-16 Rudder Trim Control Actuator Lubrication Aug. 25, 1980

B737-SL-27-24 Rudder Centering Unit Lubrication June 28, 1983

B737-SL-27-30 Aileron/Elevator and Rudder Power Control Unit 

Cylinder Bore Rework

Apr. 1, 1985

B737-SL-27-57 Rudder Feel and Centering Unit Lubrication Dec. 5, 1989

B737-SL-27-71-A Aileron/Elevator PCU Flow Restrictor Filter 

Screen Contamination

June 19, 1992
Appendixes 339 Aircraft Accident Report

Appendix E

List of Documented Boeing 737 Events

In addition to the USAir flight 427 accident, the Safety Board has investigated

more than 100 events since 1980 involving the Boeing 737. The table below documents

the date and location of these events and provides a brief description for each.

(Abbreviations are defined at the end of the table.) Additional details for some of these

events can be found in the factual information section of this report. This list should not be

considered a complete list of every 737 rudder-related event that has occurred. 

Date Location

737 

series Carrier Comment/event

06/11/80 Cheyenne, Wyoming -200 Frontier First officer incapacitation

09/24/89 LaGuardia Airport, New 

York

-400 USAir Rudder trim mis-set; rejected 

takeoff

02/25/91 N/A -200 United Yaw anomalies on 585 airplane

03/03/91 Colorado Springs, 

Colorado

-200 United Flight 585 accident

07/16/92 Chicago-O'Hare Airport, 

Illinois

-300 United Rudder PCU anomaly during 

ground check

12/14/92 San Diego, California -300 USAir Rudder PCU malfunction

01/04/93 Seattle-Tacoma, 

Washington

-300 United Hydraulic block/binding

04/16/93 Near Auckland, New 

Zealand

-200 Air New 

Zealand

Yaw damper anomaly

04/23/93 Stapleton, Denver, 

Colorado

-500 United Wake vortex encounter with a 

757

06/24/93 Orly Airport, Paris, France -300 Air France Descent rudder deflection

08/20/93 France -300 Air France Takeoff roll rudder deflection

08/22/93 Oklahoma City, Oklahoma -200 Southwest Yaw damper anomaly

08/24/93 France -300 Air France Two rudder deflections in flight

11/02/93 Manila, Philippines -300 Philippine 

Airlines

Yaw damper anomaly

03/08/94 New Delhi, India -200 Sahara 

Airlines

Loss of control during training 

flight

03/29/94 Oakland, California -300 Southwest First officer incapacitation
Appendixes 340 Aircraft Accident Report

Date Location

737 

series Carrier Comment/event

03/31/94 Las Vegas, Nevada -300 America 

West

Yaw damper anomaly

04/12/94 San Pedro Sula, 

Honduras

-300 Continental Yaw damper anomaly

05/23/94 Phoenix, Arizona -200 America 

West

Yaw damper anomaly

08/31/94 London, England -200 British 

Airways

Yaw damper anomaly

09/02/94 Melbourne, Australia -300 Ansett Yaw damper anomaly

09/08/94 Aliquippa, Pennsylvania -300 USAir Flight 427 accident

09/21/94 Los Angeles, California. -200 Canadian 

Air

Possible wake vortex encounter

10/24/94 Phoenix, Arizona -300 Southwest Wake vortex encounter with a 

727

11/24/94 Philadelphia, 

Pennsylvania

-300 USAir Yaw damper anomaly

12/02/94 Sacramento, California -300 Southwest “Pull to left” on takeoff roll

12/20/94 Raleigh-Durham, North 

Carolina

-300 USAir Yaw damper anomaly

12/21/94 Coventry, England -200 Air Algeria CFIT; mis-set instrument

12/29/94 Van, Turkey -400 Turkish 

Airways

CFIT

01/02/95 Houston, Texas N/A Southwest Wake vortex encounter with 

MD-80

01/13/95 Jogjakarta, Indonesia -300 Garuda 

Airlines

Landing, runway overrun

01/17/95 Yogyakarta, Indonesia -200 N/A Runway overrun

01/20/95 Atlanta, Georgia -200 Air South Runway overrun on landing

01/25/95 Albuquerque, New Mexico -300 America 

West

Roll-off on takeoff

02/21/95 Australia -400 Qantas Wake vortex encounter with a 

747

03/29/95 En route ONT to SJC -300 Southwest Yaw damper anomaly
Appendixes 341 Aircraft Accident Report

Date Location

737 

series Carrier Comment/event

04/08/95 Vittoria, Brazil -300 Trans Brasil Off side of runway

04/13/95 Denver International, 

Colorado

-400 Mark Air Hard landing

05/05/95 Dublin, Republic of Ireland -400 Aer Lingus Yaw damper anomaly

06/26/95 National Airport, 

Washington, D.C.

-300 USAir Uncommanded roll

07/18/95 Ormond Beach, Florida -300 USAir Uncommanded roll

07/25/95 Charlotte, North Carolina -300 USAir Uncommanded roll

07/25/95 Richmond, Virginia -400 USAir Uncommanded roll

07/25/95 Mexico City, Mexico -300 Continental Yaw damper anomaly

07/28/95 London-Heathrow, United 

Kingdom

-400 British 

Airways

Rudder on hard landing

07/29/95 Love Field, Dallas, Texas -300 Southwest Ground collision

08/05/95 Charlotte, North Carolina -300 USAir Uncommanded roll

08/09/95 San Salvador, El Salvador -200 AVIATECA CFIT

08/10/95 New Orleans, Louisiana -200 USAir Uncommanded roll

08/17/95 Phoenix, Arizona -400 USAir Rudder after initial touchdown

08/20/95 Toronto, Ontario, Canada -200 Canadian 

Airlines

Yaw damper anomaly

08/25/95 Fort Lauderdale, Florida -300 USAir Uncommanded roll

08/30/95 Cleveland, Ohio -300 Continental Uncommanded roll

09/12/95 Dallas-Fort Worth, Texas -200 USAir Uncommanded pitch-up

09/25/95 Denver International, 

Colorado

-200 United Takeoff roll rudder deflection

09/29/95 Dayton, Ohio -300 USAir Rudder trim runaway

09/29/95 Charlotte, North Carolina -300 USAir Wake vortex encounter with a 

757

10/14/95 Dallas-Fort Worth, Texas -300 Delta Yaw damper anomaly

10/15/95 Boscombe Down, England -200 British 

Airways

Roll oscillations; maintenance 

flight
Appendixes 342 Aircraft Accident Report

Date Location

737 

series Carrier Comment/event

10/22/95 San Francisco, California -500 United Pitch-up during maintenance 

flight

10/22/95 Pittsburgh, Pennsylvania -300 USAir Unexpected roll on approach

10/26/95 Dusseldorf, Germany -300 Deutsche 

BA

Uncommanded roll

10/27/95 Munich, Germany -300 Deutsche 

BA

Uncommanded roll

10/14/95 En route DFW to HSV -300 Delta Uncommanded rudder input

10/29/95 Portland, Maine -300 USAir Bird strike during takeoff

10/30/95 Las Vegas, Nevada -500 Southwest First officer eye struck by laser 

beam

10/31/95 En route PBI to PIT -300 USAir Uncommanded rolls

11/02/95 Charlotte, North Carolina -400 USAir Uncommanded roll

11/06/95 Sydney, Australia -300 Ansett Wake vortex encounter with a 

747

11/13/95 Kaduna, Nigeria -200 Nigerian 

Airlines

Runway overrun

11/25/95 Portland, Oregon N/A United Turbulence on approach

11/29/95 DeGaulle Airport, Paris, 

France

-200 British 

Airways

Gear failure on landing rollout

12/02/95 New Delhi, India -200 Indian 

Airlines

Runway overrun

12/03/95 Douale, Cameroon -200 Cameroon CFIT; landed in a swamp

12/28/95 Toulouse, France -200 Euralair No. 1 engine failure

01/02/96 Honolulu, Hawaii -200 Aloha Uncommanded lateral 

oscillations

01/18/96 Melbourne, Australia -400 Qantas Uncommanded roll

01/29/96 Stavanger, Norway -400 Braathens 

BRT

Rudder failsafe bolt break

02/09/96 Chicago, Illinois -200 United Wake vortex encounter with a 

727

02/22/96 National Airport, 

Washington, D.C.

-100 Continental Runway overrun
Appendixes 343 Aircraft Accident Report

Date Location

737 

series Carrier Comment/event

02/23/96 Colorado Springs, 

Colorado

N/A America 

West

Clear air turbulence on 

approach

03/06/96 Arequipa, Peru -200 Faucett CFIT; impacted hill on final

03/13/96 Philadelphia, 

Pennsylvania

N/A USAir Wake turbulence

04/01/96 Chicago, Illinois -300 Continental Wake vortex encounter with a 

777

04/07/96 Approach to San 

Francisco, California

-300 United Vibration in rudder pedals 

04/28/96 Denver, Colorado -300 United Engine failure after takeoff

05/14/96 Trenton, New Jersey -200 Eastwind Yaw “bumps” on climbout

05/25/96 N/A -500 United Yaw damper transfer valve jam

05/25/96 N/A -300 United Bent pin on yaw damper coupler

05/25/96 N/A -300 United Yaw damper trip/replace A/P 

access

06/09/96 Richmond, Virginia -200 Eastwind Flight 517 incident

06/22/96 Granite, Colorado -200 Frontier Clear air turbulence encounter

06/29/96 Phoenix, Arizona -300 America 

West

Uncommanded roll

07/07/96 Nashville, Tennessee -200 Southwest Aborted takeoff; bird ingestion

07/10/96 Seattle, Washington -300 Southwest Rudder kick on takeoff

07/14/96 El Salvador -200 TACA Lateral oscillations after takeoff

08/29/96 Chattanooga, Tennessee N/A USAir Clear air turbulence encounter

11/16/96 Phoenix, Arizona -300 Southwest Uncommanded yaw

12/12/96 Frankfurt, Germany -400 Lufthansa Rudder oscillations with PCU 

test

01/21/97 Boston, Massachusetts -200 Delta Yaw damper anomaly

03/02/97 Carajas, Brazil -200 Varig Hard landing and runway 

overrun

12/19/97 Palembang, Indonesia -300 SilkAir Loss of control; flight 185 

accident
Appendixes 344 Aircraft Accident Report

Note: CFIT, controlled flight into terrain; A/P, autopilot; ONT, Ontario International Airport, California; SJC, San Jose

International Airport, California; DFW, Dallas-Fort Worth International Airport, Texas; HSV, Huntsville International Airport,

Alabama; PBI, West Palm Beach International Airport, Florida; PIT, Pittsburgh International Airport, Pennsylvania; PHL,

Philadelphia International Airport, Pennsylvania; LAS, Las Vegas International Airport, Nevada; CVG, Cincinnati/Northern

Kentucky International Airport, Covington, Kentucky; and GSO, Piedmont Triad International Airport, Greensboro,

North Carolina.

Date Location

737 

series Carrier Comment/event

03/11/98 Anchorage, Alaska -200 Arco Alaska Yaw damper anomaly

03/11/98 Spokane, Washington -300 Southwest Yaw damper anomaly

07/02/98 Brazil -400 Trans Brasil Yaw damper anomaly 

08/07/98 En route PHL to LAS -300 USAirways Possible wake vortex encounter

08/12/98 En route CVG to GSO -200 Delta Yaw damper anomaly

08/98 N/A -700 Southwest Yaw excursion during takeoff roll

08/14/98 Juneau, Alaska -400 Alaskan Hard landing

11/01/98 Atlanta, Georgia -200 AirTran Hydraulic leak; maintenance 

flight

02/19/99 Seattle, Washington -300 United Anomalous rudder response

02/23/99 Salisbury, Maryland -200 Metrojet Rudder hardover in flight
Appendixes 345 Aircraft Accident Report

Appendix F

Boeing’s “Blue Water” Assessment Team

Since the introduction of the Boeing 737 series airplane, there have been

maintenance reports of fluid in the electrical/electronic compartment (E/E bay).

Occasionally, pilot reports of system problems were later determined to be caused by short

circuiting of electrical components in the E/E bay as a result of the presence of fluids.

Because of these events, Boeing established an assessment team (which included an FAA

engineer) in 1995 to investigate fluid contamination of electrical and electrical boxes and

the interfacing with electrical wiring and connectors within the 737 E/E bay. 

The team reviewed equipment designs, maintenance practices, service data,

operator fleet campaign results, and E/E bay component overhaul data and performed

inspections of in-service airplanes. The team reviewed 653 Boeing 737 operator E/E bay

service reports from January 1984 to February 1996. Fluid contamination was

documented in 111 of these reports. The team also reviewed 13,905 service/repair station

records pertaining to the maintenance of electrical boxes. Fluid-related contamination was

documented in 366 of these reports. The team found that the position of a electrical box

did not necessarily protect it from contamination. The team also found that forward

lavatory waste water was the primary fluid source for E/E bay contamination. The

assessment found that overservicing of the lavatory, cracked toilet tanks, failed gaskets,

and damaged dump valves were the primary source of the leaks. 

The 737 series is equipped with fluid barrier systems that are designed to contain

or prevent fluids from reaching the E/E bay. These barriers include the floor panel

moisture barrier, shrouds, and airstair drip pan. However, the assessment team found that

the barriers can be damaged during service, allowing fluids to enter the E/E bay. The

examination of several airplanes found that some shroud installations were completely

missing; some were damaged, contaminated, or torn; and some were improperly installed. 

The assessment team identified improvements aimed at preventing fluid leakage

and contaminated electrical and electronic equipment. The team reported that it did not

identify any substantial design deficiencies or common problems; however, it found that

operator-specific maintenance and service practices may compromise the effectiveness of

the moisture barrier systems. 

The team’s October 1996 final report indicated that the team did not uncover any

evidence that a specific fluid leakage event would produce a near-term, unexpected,

aircraft flightpath departure. However, the team made several recommendation to reduce

the potential for fluid leakage into the E/E bay in 737 airplanes and noted any pertinent

corrective actions. These recommendations included the following:
Appendixes 346 Aircraft Accident Report

• Installation of a forward waste system flush/fill line shutoff valve and fluid

sensor.

• Installation of an improved airstair drip pan access hatch gasket. (Addressed by

Boeing Service Letter 737-SL-53-23, dated June 28, 1993.)

• Elimination of the E/E rack moisture shroud lack of coverage by verifying that

the shroud is properly installed and incorporating an improved moisture

shroud. (Boeing Service Bulletin 737-25-1317 was released to all operators,

providing information regarding the replacement of the cloth moisture shroud

with one manufactured from aluminum. Boeing determined that an

improvement to the aluminum moisture shroud would increase the protection;

therefore, once the improved moisture shroud parts are available, Service

Bulletin 737-25-1317 will be superceded.)

• Incorporation of an improved floor moisture barrier system. (Boeing Service

Letter 737-SL-53-034-B, dated February 21, 1997, provides for the

modification of airplanes manufactured before January 1996.)

• Periodic inspection of the E/E bay moisture shrouds and drip pans. (Temporary

revisions to sections 25-51-01 of the Boeing Maintenance Manual were

released in July 1998 for 737-300, -400, and -500 series airplanes and in

August 1998 for the -100 and -200 series airplanes. In November 1997, a

revision to the maintenance planning document was released for the 737-300,

-400, and -500 series airplanes, including a task to visually check the moisture

shrouds and drip pans for obvious damage at every “1C” maintenance interval

(MPD item B25-51-00-6A). The document is no longer being revised by

Boeing for the -100 and -200 airplanes; however, operators of these airplanes

were asked to incorporate the intent of the subject task item into their

maintenance programs.

• Periodic inspection of lavatory system for signs of leakage. (Inspection

procedures were added to section 38-32-0 of the Boeing Maintenance Manual.)