Metrojet Flight 2710 from Orlando, Fla., to Hartford, Conn., was cruising up the Eastern Seaboard at 33,000 feet one morning last February when something strange occurred:

Suddenly, the plane - a Boeing 737-200 - began inexplicably turning to the right. The co-pilot noticed the right rudder pedal was depressed to the floor, but no one had touched it.

The rudder - the hinged tail-section panel that controls the jet's direction - had deflected on its own. If it stayed that way, Flight 2710 would roll into a high-speed dive.

The captain pushed hard on the left rudder pedal to bring the rudder back into position. But it wouldn't budge.

The crew deactivated the errant rudder only by shutting down the plane's main hydraulic system.

Even that didn't entirely stop the rudder from phantom movements, though. Preparing for an emergency landing at Baltimore, the pilots watched nervously as the pedals moved on their own several times on the approach. The pilots knew a rogue rudder deflection at low altitude could flip the 50-ton jetliner into the ground.

They brought the plane down safely, and no one was hurt. But the incident jolted aviation-safety experts.

The focus of their alarm: The Metrojet plane had recently undergone an upgrade, with installation of a new rudder valve. This improvement was made over the past two years on all 737s registered in the United States and many registered abroad.

Boeing and the Federal Aviation Administration insist the upgrade, and two more to be made over the next year, make a safe airplane even safer.

But the National Transportation Safety Board (NTSB) and independent safety experts strongly disagree. They say that even with the improvements, the 737 rudder, with a 30-year history of malfunctioning, continues to pose a serious hazard.

"The 737 series airplanes . . . remain susceptible to rudder system malfunctions that could be catastrophic," a recently released NTSB report concludes.

That 346-page report, issued this summer, details the board's exhaustive examination of two air disasters: the 1991 crash of United Airlines Flight 585 in Colorado Springs and the 1994 crash of USAir Flight 427 near Pittsburgh. Everyone aboard both planes died, 157 victims all told.

The report reveals previously unreleased evidence supporting the NTSB's finding last March that rudder malfunctions caused both crashes and calls for a redesign of the 737 rudder system.

"Our charge is to investigate these accidents, report fully to the American people and make the best recommendations the staff and board together can produce," NTSB Chairman Jim Hall said in an interview. "We've done our job."

But the NTSB has no authority in the matter. Rather, its recommendations go to the FAA, which has responded by assigning 22 experts to study the 737's rudder problems and to report by next March on whether the rudder should be redesigned.

That panel is co-chaired by John McGraw, a top official from the FAA's Renton branch office, and Dagfinn Gangsaas, a Boeing senior manager. It includes six other Boeing employees, three other FAA officials, two from the National Aeronautics and Space Administration, two from the Department of Defense, three from the Air Line Pilots Association and two from the Air Transport Association, an airline-industry trade group. Also on the panel are a Ford Motor Co. computer simulation expert and a Russian flight-data expert.

"I've dedicated top people to this who have a wide-open view of the issue," said Beth Erickson, the FAA's director of aircraft certification. "This engineering evaluation board is completely independent, not biased, and is taking a clean-sheet approach to really understanding if there is any other action that needs to be taken."

Safety advocates are dubious. Given Boeing's stubborn defense of the rudder - described vividly in the NTSB report - and the makeup of the panel, they question the study panel's objectivity.

"There is no way Boeing is going to come out against its own product," said Gail Dunham, president of the National Air Disaster Alliance & Foundation, a passenger-advocacy group. "I'm quite sure they're going to come out with a report patting themselves on the back."

Boeing declined requests for an interview on the status of the rudder evaluation.

"At this point, we're providing ongoing support to the FAA's engineering evaluation board," said spokesman Russ Young. "We await their findings and recommendations of what, if anything, can be done to improve the rudder system."

The stakes for Boeing are immense. Redesigning the largest moving part on the world's most widely used jet model would:

• Cost Boeing hundreds of millions of dollars and expose the company to potentially crippling product-liability lawsuits, should another rudder-related crash occur before the redesign could be completed.
• Disrupt air travel and be extremely costly to airlines if 737s - the work-horse planes at US Airways, Delta, Southwest, United, Continental, Alaska and America West - need to be pulled from service for rudder work.
• Embarrass the FAA for certifying the 737 rudder system in 1967 based on data provided by Boeing, and then certifying essentially the same rudder system for the so-called "Next Generation" 737-600s, -700s, -800s and -900s in 1997.

The stakes in not redesigning the rudder, the NTSB report unequivocally states, are also immense: more 737 crashes.

737 has most 'rudder events'

It took the longest, most extensive accident investigation in history for aviation authorities to fully grasp the hazards associated with the 737's unique rudder system.

The 737 is the only large commercial jet with a rudder controlled by a single hydraulic valve. The valve works by directing pressurized hydraulic fluid to deflect the rudder. If the valve jams, it can direct fluid to the wrong place at the wrong time, causing rogue deflections.

Other jet models rarely report such unwanted deflections because they have multiple valves working together to control the rudder. If one valve jams, the others compensate.

Pilots have reported a pattern of rogue rudder deflections on 737 flights since the jet entered commercial service in 1968. The NTSB report lists 112 "rudder events" on 737 flights the agency has examined from the past two decades.

Over a comparable period, only three such events were reported on McDonnell Douglas DC-9 or MD-80 flights and just one on an Airbus Industrie A320 flight, the report states.

Since the Colorado Springs crash nine years ago, authorities have slowly come to understand the many ways the 737's rudder valve, a complicated two-piece mechanism, can jam.

For example, one kind of jam can deflect the rudder in a direction opposite of the pilot's command, a phenomenon known as a reversal. That's what the NTSB ruled happened in Colorado Springs and Pittsburgh.

Another kind of jam can cause the rudder to deflect to a more acute angle than called for by the pilot - known as a "hardover" - and remain in that position even after the pilot releases the rudder pedal.

Yet another jam can deflect the rudder with no pilot commands, as happened on the Metrojet flight.

Trouble detected early on

Boeing designed the 737's rudder valve in the late 1960s, then contracted with California-based Bertea Corp., now a division of Parker Hannifin Corp., to mass-produce it.

It didn't take Bertea engineers long to discover a serious weakness in Boeing's design for the part, called a "dual concentric servo valve."

Two U.S. patents spell out that the valve is prone to jamming. The patents, taken out by Bertea in 1969 and 1982 for devices that would address valve jams, surfaced in lawsuits filed by families of people killed in the Pittsburgh crash and were recently obtained by The Seattle Times.

"One failure that can occur in this type of servo valve occurs when the valve becomes stuck or jammed," the 1969 patent warns. "This may be the result of contaminants . . . warpage, thermal expansion or contraction of the elements of the servo valve or numerous other reasons."

The 1982 patent similarly cautions: "One failure that can occur in a servo valve is the sticking or jamming of the movable slide. This may be caused, for example, by contaminant on the slide, warpage, thermal expansion or contraction or numerous other reasons."

The Bertea patents are for devices that automatically detect and negate such jams. Bertea marketed the inventions for a time but never found a customer and the ideas were shelved, said Ray York, retired Bertea engineer who co-authored the 1969 patent and supervised the author of the 1982 patent.

NTSB officials were unaware of the existence of the patents until provided copies by The Times. By then, investigators had already drafted a broad suggestion, now part of the NTSB's report, to redesign the rudder system to include a means for automatically detecting and neutralizing a jammed valve.

Boeing officials won't discuss whether they knew about the Bertea patents, nor respond to criticisms laid out in the NTSB's report.

Some federal investigators were outraged by the time and resources it took to dispel increasingly far-fetched scenarios Boeing offered to explain the crashes in Colorado Springs and Pittsburgh.

For instance, Boeing devised an elaborate computer program to demonstrate how a wind rotor - an unusual horizontal tornado spinning off the Rocky Mountain foothills - had knocked the United plane out of the sky. But to flip the 50-ton jetliner, the rotor would have had to have been much stronger than any on record, and it would have had to have made a bizarre 90-degree turn at the moment it intersected with the 737.

In the Pittsburgh investigation, Boeing blamed the crew, going so far as to submit an elaborate psychological study of unusual cases of pilot error. Company officials intensively lobbied the NTSB to rule that one of the USAir pilots errantly stomped on the left rudder pedal and held it to the floor for 24 seconds as the jet plummeted 6,000 feet.

Investigators instead determined that the pilot depressed the right rudder pedal while properly trying to correct a leftward swerve, only to have the rudder valve jam and reverse the rudder.

Boeing disputes crew's story

Neither the United nor USAir pilots survived to give their versions of the crashes. But Eastwind Airlines chief pilot Brian Bishop encountered a 737 rudder reversal over Richmond, Va., in June 1996 and lived to tell about it.

Bishop told investigators he "stood" on his left rudder pedal trying to compensate for a sudden rightward swerve. But the pedal barely moved.

Using information from the flight data recorder, investigators coordinated the jet's moment-to-moment position with the crew's detailed, first-hand description of what was going on in the cockpit. They concluded the jet's rudder reversed, unbeknownst to the crew. Only a series of quick-thinking maneuvers by Bishop and his co-pilot averted a crash.

But Boeing refused to accept that explanation. The company took the same positioning data, ignored the crew's testimony and insisted the pilots must have made several gross errors both before and during the flight. Boeing blamed the crew for exacerbating what might otherwise have been a minor mechanical glitch not involving the rudder valve.

Boeing's assertion that Bishop reacted in one-quarter of a second to the supposed glitch, then delicately depressed the right rudder pedal exactly 1 inch, is "highly unlikely," the NTSB report concludes.

FAA sides with Boeing

When the FAA certified the single-valve rudder for the original 737-100 in 1967, Boeing assured the agency the valve would not jam.

And even if it did, the company insisted, pilots could easily counter by deploying wing panels, called ailerons.

Both assurances proved wrong.

Pilots began reporting rogue rudder movements in the early 1970s, and continue to do so. But it wasn't until 1995, during testing related to the Pittsburgh crash, that authorities discovered that the 737's comparatively small ailerons lacked the leverage to counteract a rogue rudder deflection at low speeds.

The revelation that the 737 had a "crossover speed" below which nothing could stop a runaway rudder from flipping the plane into a steep dive could not have come at a worse time for Boeing: The company was in the final stages of designing and marketing a new version of the plane, the 737-700.

The 737-700 was to have a new wing, new engines, new cockpit controls and a larger rudder panel - but the rudder would still be controlled by a single valve.

To appease the FAA's concerns over that, Boeing said it would add a device called a pressure limiter to reduce the amount of pressurized hydraulic fluid available to move the rudder as the aircraft gained altitude.

The limiter would thus restrict the rudder's range of motion, making rogue deflections benign above 1,000 feet. But that still left a 60- to 90-second window during takeoffs and landings when the rudder would be fully powered, a time during which pilots have nothing available to counter a rogue deflection.

Boeing made the case that the 737 rudder normally moves no more than 2.5 degrees during a typical flight. If a rogue deflection of that magnitude occurred near the ground, Boeing analysis showed, the pilot could still safely land the plane.

The FAA bought Boeing's argument, ignoring the fact that a jammed valve could deflect the rudder up to 26 degrees, and certified a single-valve rudder for the 737-700 in November 1997.

The NTSB report looks askance at Boeing's analysis, calling it "unrealistic."

"Such a narrow interpretation may well reduce the level of protection that should be provided," the report states.

737's safety record

Boeing has long argued that the 737 is as safe as any jet model flying, crashing on average less than two times for every million departures.

According to statistics from BACK Associates, an aerospace-industry data source, older model 737-100s and -200s have crashed 1.06 times for every million flights. The crash rate for newer model 737-300s, -400s and -500s has been 0.41 per million flights.

The crash rate among passenger jets of all types has been 1.35 per million flights. The competition's closest model, the Airbus A320, has a rate of 0.69 per million but has been in existence only since 1988.

There are more 737s flying - 3,111 - than any other plane.

Since 1996, spurred in part by a Seattle Times investigation, safety critics - and ultimately, the FAA - have focused on problems with the 737 rudder. Each time a 737 crashes, safety advocates and plaintiffs' lawyers wonder whether the rudder could have been the culprit.

The Aug. 31 crash of a 737 in Argentina is still being sorted out, and early indications were that an engine problem might have been the cause. The three most recent 737 crashes before that one remain unsolved:

In December 1997, a newer SilkAir 737-300 dove from 35,000 feet, smashing into an Indonesian river and killing all 104 aboard.

In May 1998, an older 737-200 carrying oil-field workers crashed on approach to landing in a remote jungle airfield in Peru, killing 74 of the 87 people aboard.

In April of this year, a Turkish Airlines 737-400 went down near Adana, Turkey, killing the crew of six.

Although investigators have not implicated the rudder in any of those incidents, safety advocates and lawyers have kept that possibility alive. In each case, investigators are missing a key piece of evidence, the flight data tape.

Boeing's fixes

In an interview last fall, before the Metrojet incident, Boeing's then-chief 737 engineer Mike Denton said the scores of rudder problems reported every year posed no great hazard.

Denton blamed the reports on pilot error, encounters with unexpected turbulence and mechanical glitches that had nothing to do with the rudder valve. He noted the company planned to fix what it believes to be the primary source of such glitches by upgrading a device called the yaw damper on all 737s by August 2000.

The yaw damper automatically makes small rudder adjustments constantly during flight to keep the plane flying straight. Denton acknowledged that a mechanical part that tells the yaw damper when to adjust the rudder had a long history of sending bad signals. It will be replaced with a highly sophisticated digital computer.

"Let's say that the number of yaw damper-type failures was 100 a year. With the new computer we think that number will drop to about one," Denton said.

The other improvement Boeing has undertaken is to install pressure reducers on the worldwide fleet of 737s by August 2000. The device will serve the same function as the pressure limiter now factory-installed on new-version 737s: to make the rudder benign once the aircraft climbs higher than 1,000 feet.

But while the upgraded rudder valve may reduce the chance of reversals, and the new yaw damper and pressure reducer lessen problems when the jet is cruising, none of the changes eliminate the valve's inherent propensity to jam, said hydraulics-parts designer Paul Knerr, who chaired a panel of independent experts invited by the NTSB to examine the Pittsburgh jet's rudder valve.

If the valve jams during the 60- to 90-second window when the aircraft is close to the ground, the rudder fully powered and the ailerons bereft of the leverage needed to offset a rogue deflection, catastrophe is sure to result, said Knerr.

He compared the risk posed by the 737's single-valve rudder to a mountain climber relying on just one safety rope.

"You can braid your rope differently or get a rope made of better material and certainly it might be safer, but in the end, you've still got one rope," said Knerr.

"And if the rope breaks, you're gone."

   And so they had their day in court