Oct. 27, 1996

Safety at issue: the 737
After crashes, near-crashes and hundreds of lesser incidents, federal officials are pressing for changes in the Boeing 737, the most widely used airliner in the world

by Byron Acohido
Seattle Times aerospace reporter / Copyright 1996, Seattle Times Company

A Boeing 737-200 was approaching Richmond, Va., on the calm night of June 9 this year when its pilot, Brian Bishop, and the 52 others aboard felt a thump.

The twin-engine jet owned by tiny Eastwind Airlines was descending through 4,000 feet at about 288 mph. No other aircraft were about. In the cockpit, Capt. Bishop started to say something to his co-pilot, Spencer Griffin. But he never finished his sentence.

Suddenly, the airplane's nose snapped sharply to the right and its right wing dropped. In the rear of the passenger cabin, lead flight attendant Carole McGee tumbled into a set of exit stairs, bruising her leg.

Uncommanded by the pilots, the 38-ton jet began a roll that jolted its passengers. It seemed headed, in a matter of seconds, into an unstoppable nose dive.

Bishop stomped on his left rudder pedal - "pushing as hard as I could," he said - to swing the nose left and back on course. The pedal would move only an inch.

His next moves were instinctive, the reactions of a seasoned pilot who had learned to fly as a teenager. Bishop spun the control wheel as far as it would go to the left, deploying wing panels, called ailerons, in an attempt to roll the plane left. Then he pushed on the right engine throttle, boosting thrust on the right wing.

For about 15 seconds, the jet flew frozen in a right bank, as though held in check by a mysterious force. Then, whatever was keeping the jet in that position let go. But before Bishop could back off the controls, the problem recurred. The jet swerved and banked to the right again.

After another harrowing 10 to 15 seconds of desperate maneuvering, the unseen force again relented. Bishop and Griffin, at once relieved and terrified, wondered what they would do if the lockup recurred as they continued descending into Richmond. If they began a dive and were unable to recover, Bishop calculated grimly, he might have enough control left to swerve away from where there might be people on the ground.

"I was looking out the window for dark spots in the woods . . ." he recalled. "If it happened again, I didn't want to go through somebody's neighborhood."

But the lockup did not recur, and Bishop put Flight 517 down for a safe landing in Richmond. As he slowed the jetliner to taxi speed, he glanced down. "My knees were literally shaking," he said.

HUNDREDS OF RUDDER INCIDENTS

Government air-safety officials suspect that what happened over Richmond in June was a phenomenon known as a "rudder hardover." That's when an airplane's rudder - the hinged tail panel that controls its left-to-right movement - swings suddenly and forcefully as far as it can go to one side.

It would not be the first instance of a tail rudder moving inadvertently on a Boeing 737, the most widely flown plane in the sky worldwide.

Statistically, the 737 has had a better than average safety record over its nearly three decades of service - 1.21 crashes per million flights for older models and 0.51 crashes per million flights for newer models. The figure for passenger jets of all types is 1.83 crashes per million flights.

The 737 rudder has been singled out before, however. Over the years, pilots around the world have filed hundreds of reports of 737 flights disrupted by uncommanded rudder movements.

Many safety experts believe the most extreme of such movements - an uncommanded hardover - is what caused two highly publicized and unsolved 737 crashes in the U.S. this decade. United Airlines Flight 585 dived from the sky into a park near Colorado Springs on March 3, 1991, killing 25 passengers and crew members. The plunge of USAir Flight 427 near Pittsburgh on Sept. 8, 1994, killed all 132 on board.

Since the Pittsburgh crash, there have been more than 70 reports of 737 flights briefly thrown off course in a manner that suggests rudder malfunctions.

CHANGE IN NEW MODELS ONLY

On Sept. 25 of this year, Boeing acknowledged making a design change in new models of its 737 to limit how far the rudder could move should an in-flight deflection begin. The change would not affect the thousands of 737s in service or the current models in production. Boeing said the change was for "technical," not safety, reasons.

Air-safety officials are familiar with evidence that the 737's rudder can move on its own, throwing the plane fatally out of control when there is too little time for a pilot to recover. Yet despite one safety agency urging changes to protect the flying public, it could be months or years before anything is done - if ever.

The safety agencies and the Seattle-based Boeing Co., builder of the 737, have demonstrated slow, piecemeal and grudging action since rudder questions first arose after the crash in Colorado Springs 512 years ago.

Boeing's resistance to changes in its widely used 737 delayed for 19 months the safety recommendations issued by the National Transportation Safety Board on Oct. 16. The 14 recommendations - now before the Federal Aviation Administration - include design changes to prevent uncommanded rudder hardovers, design changes which Boeing continues to oppose.

Boeing will be taking its case to the FAA, an agency charged with both protecting the safety of airline passengers and with promoting the U.S. airline industry. Historically, it can take the FAA years to adopt proposals opposed by airlines or aircraft manufacturers.

BARRIERS TO SWIFT ACTION

Just getting the 737 rudder-safety recommendations this far has been difficult because:

-- The transitory way the rudder works and the small size of the controlling mechanism make it hard to conclusively identify problems. Because the rudder is continually moving in small ways and returning to position, it is almost impossible for investigators to duplicate a single movement. Absent clear proof of a problem, the federal agencies are reluctant to take action.

-- The government's air-safety agencies rely almost totally on the airplane and parts manufacturers to investigate potential problems in their own products, and the agencies' decision-making historically has been weighted toward the financial interests of U.S. airlines and airplane manufacturers.

-- Boeing has aggressively defended its reputation as a manufacturer - in court, where the families of crash victims turn for redress, and in the accident-investigation process - to protect itself against the tremendous financial liability it could face if a defect were found to exist in the most widely used airplane it sells.

There is no way to gauge precisely how much a finding that the 737's rudder is defective would cost Boeing or the airlines that operate 737s. But aviation experts say proposed fleetwide design changes to limit the rudder's range and give pilots better cockpit instruments, plus proposed flight training to deal with hardovers, could run Boeing into the hundreds of millions of dollars. Airlines could lose many millions more in revenue should planes need to be pulled from service to make the upgrades.

Beyond that, lawyers for the families of victims in Colorado Springs and Pittsburgh are attempting to build a case that Boeing has been aware for some time of dangers posed by the rudder. If they are successful, the company could face hundreds of millions more in punitive damages.

BOEING HAS OTHER THEORIES

Boeing - the world's dominant aircraft builder, with a reputation for careful design - consistently has maintained there is no hard evidence linking a rudder malfunction to any 737 crash. Company engineers have proposed alternative theories for what might have caused the two unsolved 737 crashes.

In the Pittsburgh crash, Boeing has suggested one of the pilots suffered a seizure that locked his foot down on a rudder pedal, throwing the jet out of control. In the Colorado Springs crash, Boeing blames a freak gust of wind.

Although rudder hardovers were at the top of investigators' lists of suspected causes in Colorado Springs and Pittsburgh, analysis of crucial evidence, in almost all cases conducted by Boeing, proved inconclusive.

As a result, the federal investigation of the Colorado Springs crash ended without a finding, the investigation of the crash in Pittsburgh has bogged down badly, and lawsuits arising from both cases have remained stalled for years.

"A big part of the problem is most of the knowledge about how the airplane works resides up in Seattle," said C.O. Miller, a former National Transportation Safety Board investigator and an independent aviation consultant from Sedona, Ariz. "The NTSB allows itself to become fixated on finding a cause, and the FAA readily caves in to political pressures. Meanwhile, Boeing has one eye on litigation and nobody is paying attention to things that should be done to prevent the next accident."

More than 2,700 737s are in service around the world, and tens of thousands of airline passengers fly on them every day. And - though Boeing and the government move slowly and reluctantly - airlines and pilots are increasingly alert for trouble and have begun taking their own steps to prepare for it, including training pilots in how to recover from a tail-rudder deflection.

In this five-part series of articles, The Times examines the technical, regulatory and legal issues associated with the 737 rudder problem. These articles are the result of two years of research involving thousands of pages of federal records, airline reports, Boeing documents, legal briefs filed in accident cases, and interviews with dozens of industry sources.

Boeing and NTSB officials have declined to answer questions from The Seattle Times about issues raised by the 737 rudder-control problems. At times over the past two years, however, individuals from Boeing and the safety board have talked about aspects of the issues raised here; their remarks have been excerpted in these stories.

Still, Boeing has said almost nothing publicly in response to questions about the safety of the 737 or the company's role in crash investigations.

Asked by a shareholder in April whether the 737 is safe to fly, Phil Condit, the chief executive of Boeing, answered: "Absolutely. Positively."

THE CATCH-UP, MODEL

To understand the questions dogging the 737 rudder, it is important to understand the history of the airplane.

Boeing was playing catch-up when it designed the 737. In the early 1960s, the Seattle company was close to overload working on the 747 jumbo jet, Apollo rockets and a supersonic transport. William M. Allen, then Boeing's president, had no enthusiasm for a smaller, short-hop jet.

But rival Douglas Aircraft was enjoying brisk sales of a new 100-seat jet, the DC-9. Boeing's board of directors, over Allen's objections, launched the 737 program in 1965, to go head to head against the Douglas twinjet.

Running two years behind the DC-9, Boeing designers needed a competing airplane fast. They shortened the fuselage of Boeing's three-engine 727 and came up with a prototype for the stubby, twin-engine 737. Borrowed was the 727's basic network of cables, pulleys and hydraulic systems used to control flight.

Where the 737's design departed sharply from the 727 was in its rudder.

The 727 used a rudder split into two sections. The 737 was built with a large, single-panel rudder. It needed such a big, powerful rudder mainly in case one of its two engines suddenly shut down during takeoff.

By moving the large rudder all the way to one side, the pilot could offset the asymmetrical thrust of the one good engine and keep the plane flying straight. Such an extreme movement of the rudder is known as a "hardover."

The problem comes if the rudder somehow swings, uncommanded by the pilot, to a hardover position with both engines operating. Such a rudder movement would swerve the jet sharply and snap it into a roll.

At low speed and low altitude, a rudder hardover could throw a 737 into a nose dive in a matter of seconds. Pilots might have only a few moments to recognize what was happening and make the proper recovery maneuvers.

NO LIMITER OR DOUBLE CONTROLS

Boeing designers considered the possibility of an uncommanded rudder hardover so remote in a 737 that they didn't install the level of safeguards used in other passenger aircraft.

The competing DC-9 also used a single-panel rudder, but Douglas designers equipped it with a device called a limiter, to prevent the rudder from moving more than a few degrees on its own once the plane was fully airborne.

Boeing's 727, which preceded the 737, did not have a rudder limiter. It relied instead on its split rudder: If half the rudder were to swing inadvertently, the other half could be used to counter it.

Later Boeing twinjets - the 757, the 767 and the 777 - employed single-panel rudders like that of the 737. But while the 737 essentially relies on a single control unit, the later Boeing jets use multiple control units that work together to move the rudder. Failure of any single control unit in these planes is offset by the proper operation of the others.

The 737 is the only Boeing plane that doesn't have a split rudder or multiple control units driving a single rudder.

The potential for rudder malfunction was among the many issues addressed by the Federal Aviation Administration as it certified the 737's design as safe for public use. The FAA requires an airplane to be designed so that no single system failure can result in a crash.

Boeing avoided having to meet this test regarding uncommanded rudder hardovers by submitting analysis demonstrating that the odds of such a thing occurring during the service life of a 737 were one in a billion, a virtual impossibility. The agency certified the 737 in 1967, two years after company directors initiated work on the new model.

SIGNS OF TROUBLE AROSE EARLY

But signs of trouble arose almost from the start.

By the late 1960s, pilots had begun reporting rogue movements of the rudder. Mysterious deflections of varying magnitude, uncommanded by pilots, had disrupted several 737 flights. No independent source kept track of the numbers.

Suspicion fell on an automatic rudder-adjustment mechanism, called the yaw damper, designed to track the aircraft's position as it moves through the air and to make small adjustments (hundreds during a typical flight) to "dampen" the plane's tendency to oscillate. The yaw damper receives electrical signals and translates them into movements inside the rudder's hydraulic control system, called the power-control unit, or PCU. See graphic at right.

In a June 18, 1969, service memo to airlines, W.H. Schuling, then Boeing's vice president of maintenance and engineering, cited "several yaw damper problems . . . experienced on 737 airplanes" and blamed them on a faulty electrical connector.

Yaw-damper glitches would endure through the next three decades as Boeing's explanation for hundreds of rogue rudder incidents.

Problems with the yaw damper were not considered a flight-safety issue. Company officials reasoned - and federal authorities agreed - that since the yaw damper was limited to adjusting the rudder only a few degrees in either direction, pilots had plenty of time to safely react to any errant yaw-damper commands.

Yet pilots kept reporting problems that appeared to contradict this reasoning. In 1971, Frontier Airlines reported two flights in which unexpected rudder movements resulted in "serious control problems." The airline advised its pilots to switch off the yaw damper for landings and takeoffs, times when the airplane had little room to maneuver.

In 1973, one Frontier 737 suddenly veered off course and dived from cruising altitude on two separate flights, over North Dakota and South Dakota. In each case, the pilots quickly regained control of the plane but flight attendants were injured. The yaw damper was blamed and improvements made.

FLAWS NOT USUALLY PINPOINTED

But rudder incidents persisted. Over the past three decades, pilots have filed hundreds of reports with their airlines of 737s swerving off course as if the rudder had moved on its own.

Federal records show that the yaw damper frequently was singled out and blamed, even though the standard operating procedure of mechanics didn't call for narrowing the cause of the problem to a specific part. Instead, mechanics typically would replace several components - the main rudder PCU, the autopilot computer and other parts, along with suspect yaw-damper parts - to assure the plane would pass the tests needed to get it back in the air as soon as possible.

But despite the hundreds of pilot reports over the years, there is even today little centralized compiling of such information.

Authorities admit the system for reporting and preventing emerging safety hazards is far from perfect. Addressing an international gathering of aviation safety experts in Seattle last fall, FAA Administrator David Hinson acknowledged that air-safety regulation suffers from a weak system for gathering information and analyzing it for dangerous patterns.

"We do not have access to extensive operations feedback," Hinson told the safety experts. "If you imagine everything that goes on every day . . . and everybody that's involved in the safety equation, we don't know what's going on, and you don't either."

SEVERAL WAYS TO FAIL

A number of things about the 737 rudder have been learned since the 1960s, however. Analyses and lab tests have long confirmed several ways the 737's rudder can deflect on its own, then return to a neutral position, leaving no trace of a malfunction.

Most often, such moves are inconsequential, causing the airplane to swerve briefly off course. But on scores of occasions, such as the Frontier jet's flights over the Dakotas, pilots reporting sudden, sharp rudder swings have had to scramble to regain control of their aircraft.

Still, the numerous rogue rudder incidents 737 pilots reported in the 1970s and 1980s were by and large dismissed as minor nuisances, probably caused by yaw-damper glitches.

No one was yet aware that tiny disorders inside the rudder power-control unit could cause a full range of uncommanded deflections - from the rudder "creeping" slightly, all the way to a hardover.

It would take four spectacular crashes and an alert United pilot catching a PCU defect on the ground to focus concern on malfunctions of the power-control unit.

Background/Related Information

Executive editor's column: World's most flown jet deserves close scrutiny where safety is involved

Glossary

Facts about the 737

The series

Boeing Web Site