The Sting in the Boeing 737 tail (from the archives)

OUT OF A CLEAR BLUE SKY

Gerry Byrne

(New Scientist March 4, 2000)

AT 6.57 pm on 8 September 1994, the pilot and co-pilot of USAir flight 427 were swapping recipes for fruit drinks with one of the flight attendants. The aircraft a Boeing 737-300, had just descended from its cruising altitude to 1800 metres as it prepared to land at Pittsburgh’s main airport The evening was calm and clear and conditions were ideal for flying. Less than 10 minutes later they were dead, identifiable only by the DNA in tissue remains. Parts of the aircraft were buried so deep at the impact site 10 kilometres short of the runway that metal detectors had to be brought into find them. All 132 people aboard were killed in the horrific crash.
Flight 427 was every passenger’s worst nightmare: the plane had fallen out of the sky in broad daylight for no apparent reason. And it wasn’t the first time that a Boeing 737 had crashed in mysterious circumstances. Investigators from the National Transportation Safety Board (NTSB), the US government body which investigates aircraft accidents, soon began to compare the crash with another incident three years earlier. In that accident, United Airlines Flight 585, a 737-200, nose-dived into the ground killing all 25 aboard as it was coming in to land at Colorado Springs.
The crashes have remarkable similarities. Both 737s were coming in to land after uneventful flights when something went dramatically wrong. The cockpit voice recorders from both aircraft reveal the sounds of a startled crew struggling to regain control, but give little indication of the problems they were up against. Neither were investigators able to piece together what happened using information from the flight data recorders, the "black boxes" that record basic information such as the aircraft’s height, orientation and speed. In fact, investigators were about to close the file on the Colorado Springs accident without reaching a conclusion, a rare event at the world’s leading air crash investigation agency.
After the second mysterious accident, they decided to combine the investigations into a probe that would turn into the most exhaustive, longest-running inquiry of its type. Last year, after many false leads and dead ends, the NTSB published its findings on the two accidents. While the investigators now think they know what brought down both 737s and how to prevent it happening again, the engineer who led the team that found the fault fears that the resulting changes made to all similar aircraft may not have completely removed the causes of the crash. And a wider-reaching safety investigation initiated by the Federal Aviation Administration (FAA) appears to have found another previously unsuspected problem.
Boeing began work on the 737 in the mid-1960s and the plane entered service in 1968. It has been so successful that Boeing has produced a number of models based on the design, some of which are still being produced. These aircraft, known as Classic 737s, were the type involved in the crashes, In the late 199Os, Boeing came up with a new design called the Next Generation 737.
Flying In circles
The Classic 737 design was somewhat different from similarly sized aircraft of the time, such as the McDonnell Douglas DC-9, which had two engines clamped close to each other towards the rear of the fuselage. Instead, the 737’s engines are attached to the underside of its wings. While this has some significant aerodynamic advantages, there is one major drawback. Should one engine fail, the thrust of the other tends to make the aircraft fly in a circle. To provide a compensating turning force when flying on one engine, the rudder built into the 737’s tail fin has to be much larger than on other aircraft.
In normal flight, 737 pilots rarely use the rudder’s full deflection. They do, however, need to apply large deflections to keep the aircraft on course when landing or taking off in a crosswind, for example. When a plane’s tail swings to one side, a movement known as yawing, the airflow over the wings can become asymmetric, causing the aircraft to roll. If the rudder isn’t returned to its neutral position, the plane will turn onto its side, then upside down, after which it becomes extremely difficult for the pilot to regain control.
Jet aircraft with swept-back wings also have a natural tendency to waggle their tails from side to side, or "fishtail". To combat fishtailing, many aircraft, including the Classic 737, have a device called a yaw damper that senses the waggle and automatically moves the rudder to compensate. These corrections are usually so subtle that they go unnoticed by most passengers.
Within days of the Colorado Springs and Pittsburgh crashes, investigators were confident that they were looking for a rudder problem. From black box data, eyewitness accounts and radar records, they pieced together the aircraft’s flight path. Tom Haueter, an aeronautical engineer who was a principal investigator for the NTSB on both crashes, became convinced that only a full deflection of the rudder could account for it. "Bit by bit we built this enormous jigsaw puzzle and it indicated that the rudder was dearly involved," says John Cox, a former 737 pilot who represented the US Air Line Pilots Association on the investigation.
But the investigators still needed to know what had made the rudder move. "The pilots could have done it or the airplane could have done it. We didn’t have enough data to say which happened," says Haueter. There had been pilots who reported Classic 737 rudders suddenly jamming on one side or the other, forcing the aircraft into a yaw from which they only extricated themselves with difficulty. Could the same thing have happened to flight 427 and flight 585?
In the Colorado Springs investigation, the team suspected that grit or metal shavings might have worked their way into the hydraulic system, causing it to jam. So they examined the mangled remains of this part of the aircraft for the telltale score marks that these particles should have left. There weren’t any, nor were there any in the Pittsburgh-bound plane. As far as investigators could tell, none of the parts in either rudder system appeared to be defective and all the hydraulic components were machined to proper tolerances.
Meanwhile, the investigators explored a number of other avenues, though they all lead nowhere. From the start Boeing was reluctant to accept that its aircraft might be at fault and began to come up with other leads for the team to investigate. "We’re dedicated to safety and if there’s anything we can do to make the airplane safer, we are going to do it", says Eric Dixon, Boeing’s official spokesperson based at the company’s headquarters in Seattle. "We looked at several possibilities in both of these accidents and we didn’t want to rule out anything that could have been the cause. I think that’s sometimes misunderstood."
One of Boeing’s suggestions was that the Colorado Springs crash was caused by a horizontal whirlwind called a "rotor" coming off the nearby Rocky Mountains. Boeing said this could have tipped the aircraft into a dive from which the crew couldn’t recover, However, the NTSB team decided that an experienced pilot would have been able to pull up in time. Next Boeing proposed that the Pittsburgh crash was caused by the vortices created by the wake of a larger aircraft landing 6 kilometres ahead of the doomed plane. The NTSB carried out lengthy tests by flying a Classic 737 through the wake of a larger plane but eventually discounted the idea. Finally, Boeing proposed that the pilots had operated the rudder in error and caused the accident themselves.
Haueter found it hard to accept the idea that experienced pilots would have done this. "It goes beyond comprehension in my opinion, but nonetheless we worked on it for a long time," he says.
By early 1996 the investigators had become stuck in blind alleys and bogged down in the bewildering mountain of data they had generated. To get things moving again, the NTSB chairman Jim Hall decided to break with tradition and appoint a team of outsiders to continue the inquiry. Hall chose Paul Knerr, a Californian hydraulics engineer with a reputation for methodical thouroughness, to chair the new group. To Knerr and his group, the evidence pointed to one thing: the rudder system, and in particular to a complex hydraulic device called the power control unit or PCU.
The PCU controls the flow of hydraulic fluid that pushes the rudder to the left or right in response to commands from the pilot or the yaw damper. The fluid is pumped into a piston chamber from which it can only exit through ports in the chamber wall, The position of the piston in the chamber determines which ports are blocked and which are open. The piston itself is a complex component containing a number of holes through which the hydraulic fluid must pass. Within it is another piston that works like the first: its position determines which pathways are open or blocked. The fluid can flow only when ports in the chamber wall and pathways through the first and second pistons at aligned. As the relative position of the pistons changes according to commands from the pilot or the yaw damper, fluid is routed down one line to move the rudder to the left or down a different line to move it to the right.
The PCU is located inside the tail fin but outside the heated cabin, so the device gets very cold when the aircraft is flying high. The team began to wonder what would happen if warm hydraulic fluid from the aircraft’s interior were pumped
into the freezing PCU. Could the sudden change in temperature cause the outer piston to expand and stick—perhaps without leaving the telltale scratch mark the NTSB had expected to find?
The team’s thermal shock tests produced a real surprise. When the investigators chilled a PCU to —40 C and pumped in fluid at 70 ⁰C, the outer piston jammed tight. However, the inner piston continued to operate, and the team discovered that if it overran its position by less than 0.02 millimetres, hydraulic fluid would be directed down the wrong line. In other words, the rudder would move in the opposite direction to what the pilot intended. "It took us six or seven months to get those tests set up, but once we did, [the temperature difference appears to have been part of the root cause," said Knerr.
This was just the breakthrough the investigation needed. Haueter theorised that on each aircraft, the outer piston had become jammed, just as in Knerr’s tests. Then, in response to rudder commands from the pilots or from the yaw damping system, the inner piston had overrun by a fraction of a millimetre, causing the rudder to deflect fully in the opposite direction to the one intended.
With this new evidence to hand, the NTSB declared itself satisfied and recommended that the PCU be redesigned to prevent the overtravel of the internal piston. All 1139 Classic 737s flying in the US have now been fitted with redesigned units (the PCUs in Next Generation 737s have a different design). Boeing has sent redesigned PCUs to the owners of all other Classic 737s and believes that 95 per cent have been fitted. However, it cannot say for certain whether airlines in all parts of the world have used them.
Knerr, however, is deeply unhappy with this turn of events. He believes his tests may not have revealed the whole story of why the outer piston became jammed. The tests were carried out using hydraulic fluid that was heavily contaminated with silt since this is common in Classic 737s. Knerr argues that the unit might not have jammed if the fluid had been clean. Until the tests are repeated with clean fluid, he says, nobody really knows why the PCU failed. Temperature difference may have been what triggered the jamming, but other factors such as silting could also have had a contributory role, and Knerr wants to know what these factors are. "I don’t understand how you can redesign a [PCU] without knowing where it has malfunctioned in the first place," he says.
Even if Knerr is being overcautious, this may not be the end of the story. Last year, a Classic 737 belonging to Metrojet, a small US regional airline, experienced a full uncommanded deflection of the rudder while at cruising altitude above Baltimore, from which the pilots recovered only with difficulty The jet had been fitted with the new PCU system, and Cox, who was part of the team sent to investigate, is convinced that in this case the PCU was not at fault. He says the rudder movement was much too slow to be explained by a malfunction of the PCU.
But if not the PCU, then what? Could there be some other fundamental design problem with the rudder system? The FAA, which is responsible for all aspects of air safety in the US, cannot rule this out. It turns out that the Classic 737 has a long record of minor problems with its rudder: the NTSB has compiled a list of more than 120 rudder-related incidents, while the corresponding number for similarly sized DC-9 and MD-SO aircraft is just 3. Most problems can be traced to faults with the yaw damper, but others remain unsolved.
These incidents have forced the FAA to re-evaluate the entire design of the rudder system. Hall points out that the system lacks redundancy: if the rudder jams, there is no back-up system that can take over automatically. In contrast other similarly sized aircraft have two-piece rudders so that if one section jams the other section can compensate.
Hall also points out that the rudder systems and other controls in some versions of the Classic 737 have not been subjected to the FAA’s strict approval criteria, but were accepted on the basis that they had proven themselves safe in older versions of the aircraft. The Next Generation 737s, however, have had to meet these criteria. "I expect that 1990s questions are going to bring 1960s technology under a microscope, I have no doubt of that" says Cox.
To meet Hall’s concerns, the FAA has established a special task force based in Seattle, called the 737 Flight Control Engineering Test and Evaluation Board. The group is performing exhaustive tests on the Classic 737 rudder system, both in the air and on the ground, to find out how it might fail. "There’s not going to be any stone left unturned when this is done," says Beth Erickson, the director of the FAA’s Aircraft Certification Service, which is running the tests.
Erickson says the job of wiring up and testing a leased Classic 737 should be completed this year Testing to date has, she says, largely vindicated the design of the Classic 737’s rudder system—with one significant exception. "It’s a potential failure mode," Erickson says, but she won’t discuss any further details.
Boeing declined to comment on the latest tests but it must be worried. There are 2700 Classic 737s in service world-wide. If a new failure mode has been spotted in tests, how long before the same problem crops up on a commercial flight?
Gerry Byrne is based in Ireland and is the winner of an IBM/STI Science and Technology Journalism Award