Copyright 1995, The Seattle Times Co.
There is evidence of growing concern that the rudder system in Boeing 737 jetliners can sometimes malfunction and make the airplane dangerously difficult to control.
Late last year The Boeing Co. asked airlines to insert instructions in the 737 operating manual advising pilots to shut off a device called the yaw damper if an aircraft suddenly veered left or right.
At least two airlines - Alaska and USAir - say they are following the yaw-damper request. A USAir 737 crashed near Pittsburgh last September, killing all 132 passengers and crew members. The cause of that crash is under investigation.
Another airline, United, has accelerated replacement of a 737 rudder-system part in which investigators have found defects.
To critics of the U.S. air-safety establishment, the responses to rudder concerns are something that should have happened long ago. Reports of yaw-damper problems go back more than 20 years.
But critics say air-safety regulation suffers from a weak system for gathering information and analyzing it for dangerous patterns. They also say the system gives manufacturers and airlines too much discretion in reporting problems and too much influence in accident investigations.
Boeing has declined comment on 737 rudder-control questions because the rudder system is the subject of product-liability lawsuits.
The 737, manufactured since 1967, is the most widely flown
commercial jetliner in the world. Its low accident rate, according to Boeing's statistics, mark it as one of the safest aircraft ever built. Yet information gathered from pilots, airlines, safety experts, federal records, airline reports and Boeing documents all points to growing concern about long-running difficulties with two rudder-control devices:
-- The yaw damper, an automatic rudder-adjustment mechanism that helps an aircraft fly straight.
-- The rudder's power control unit (PCU), to which the yaw damper and pilots send commands that move the rudder, the large slab in the tail that is one of the principal devices for controlling an airplane's direction.
United Airlines recently began accelerating installation of modified PCUs in its fleet of 737s. The Federal Aviation Administration has ordered that PCU upgrade for all U.S.-flown 737s, but United is moving four years ahead of the FAA's 1999 deadline.
Meanwhile, some pilots have begun conducting crude PCU tests on their own before each flight. Others say they stay constantly alert for yaw-damper control problems when they fly.
"When an airplane does something that nobody taught you it could do, you feel betrayed, like the dog you've owned for 20 years turns around and bites you in the neck," said a Continental Airlines pilot who once found himself in just that situation in a 737.
Incidents never tallied, analyzed
A number of things lie behind the precautionary steps being taken by Boeing, the airlines and some pilots:
-- Eight unsolved 737 crashes around the world in the last five years, including the March 3, 1991, crash of a United Airlines 737 at Colorado Springs and the Sept. 8, 1994, crash of a USAir 737 near Pittsburgh. The two U.S. crashes killed 157 in all.
-- Numerous other incidents, including near-accidents, in which pilots had to fight to regain control of their aircraft after sudden, violent twisting and rolling to the left or right. In several of those incidents, pilots regained control only after intuitively or desperately turning off the yaw damper.
-- A National Transportation Safety Board statement after the Colorado Springs crash. Although it never determined what caused the crash, the safety board said "the interaction of the yaw damper and the observed PCU operation is not fully understood."
Safety experts say ample data exist to define and eliminate recurring 737 rudder-system problems.
A Seattle Times survey of FAA service-difficulty reports, one-page documents that airlines file to report minor problems, found 22 yaw-damper malfunctions and 21 PCU failures reported by U.S. airlines from 1974 to 1994 - incidents that have never been analyzed by safety authorities for similarities.
It is widely known in aviation circles that airlines typically report only a fraction of the problems discovered by pilots and mechanics to the FAA, and that the agency rarely conducts comprehensive analyses of problems that are reported.
Last Thursday, a senior official from the U.S. General Accounting Office, testifying before a Senate committee, criticized the FAA for not being more proactive in promoting aviation safety.
"We found that FAA had not effectively collected and analyzed data that are needed to target its inspection resources to the areas of greatest risk," Kenneth Mead, GAO's director of transportation issues, told the Committee on Commerce, Science and Transportation.
Much of the reporting about 737 rudder and yaw-damper problems is anecdotal. Safety critics say that is part of the problem.
"These problems have been pretty well-known all along," said Leo Janssens, president of Aviation Safety Institute, a Worthington, Ohio, advocacy group. "But the information isn't being passed on."
`Skidding' over North Dakota
An example of the kind of incident only spottily reported occurred on a clear morning over North Dakota more than 20 years ago.
On Aug. 22, 1973, a Frontier Airlines 737 departed from Bismarck for Rapid City, S.D., with R.M. "Mac" Schow in the captain's seat. Shortly after takeoff, Schow noticed the jet flying with its nose "skidding" slightly to the right.
Schow straightened out the airplane by depressing the left rudder pedal. As the jet climbed higher, Schow applied more left rudder to keep the jet on course.
Schow checked to see if both engines were putting out equal thrust and that his fuel tanks were full and even. Instruments showed everything properly balanced.
As he climbed to cruising altitude, Schow dialed a "rudder trim" knob to deflect - and hold - the rudder slightly to the left. The jet then flew straight. Schow turned on the autopilot and settled in.
About seven minutes later, flight attendant Cathy Colombi was approaching the cockpit with coffee for Schow and first officer Don Straus. One second the jet was cruising smoothly at 17,000 feet, the next it rolled violently to the left.
"I hit my head on the galley door and started to fall, but caught myself on the assist handle," Colombi wrote in a company report.
Schow quickly disengaged the autopilot and righted the aircraft, then dialed the rudder-trim knob to zero. He did not switch off the yaw damper. Colombi walked to the rear of the cabin and found other attendants hurt, sprawled on the galley floor.
A Frontier investigation revealed that the violent jet roll was caused by a type of yaw-damper malfunction which Frontier and United Airlines had been trying to eliminate for several years. An almost identical incident had occurred less than a week earlier near Bozeman, Mont., on the same airplane, with the same result: injured cabin attendants.
Higher, faster, but more wobbly
Aviation historians say a singular innovation - the yaw damper - launched the age of jetliners with wings swept back at a sleek angle.
Swept wings made it possible for jets to fly higher, faster and farther, but they also proved to be unstable. When Boeing was developing the B-47 swept-wing bomber in the late 1940s, it discovered that the plane was susceptible to a phenomenon called Dutch roll. Left unchecked, Dutch roll could ultimately cause an airplane to go out of control.
If a bit of turbulence happened to twist, or yaw, one swept wing slightly ahead of the other, the jet began making a series of rolling S-turns, like a Dutch skater curling down a frozen canal. Each set of turns would be more pronounced than the last. If left unchecked, the oscillations would ultimately get out of control.
To correct this tendency, Boeing engineers invented the yaw damper, which uses gyroscopes to constantly sense the aircraft's position. At the first sign of Dutch roll, the yaw damper sends an electrical signal to the rudder PCU, commanding slight rudder deflection that will keep any oscillation from starting.
On an average flight, the yaw damper makes thousands of small rudder adjustments. The pilots feel nothing because the yaw damper's electrical circuits bypass the cockpit rudder controls.
By the time Boeing introduced the 737 in 1967, it had a lot of experience with yaw dampers. In 1958, Boeing discovered that the design of the 707 jetliner was such that the yaw damper didn't halt Dutch roll. Boeing tried to train airline pilots to manually correct it, but after two fatal training crashes, the company redesigned the 707's tail to make the yaw damper work.
In the early 1960s, Boeing found that the radically swept wing of the 727 tri-jet required a special two-section rudder - with two yaw dampers - to ensure the jet's stability.
Compared to the 727, the 737 sported a mildly swept wing. Designed as a stubby short-hauler with a tail relatively close to its wing, the 737 flew like a wobbly dart compared to the arrowlike 727.
"Sometimes we'd turn the yaw damper off and the airplane would slosh all over the place," said retired Frontier Capt. Ace Avarkian. "In the flight deck, we couldn't feel a thing, but the girls (flight attendants) would come up from the rear cabin and complain."
Thus, on 737s, the yaw damper was counted on to make a large number of rudder adjustments on every flight.
`A real sudden, violent swerve'
As early as 1969, Boeing had warned Frontier that stray electrical signals in the area where the yaw damper connects to the PCU could result in uncommanded movement of the rudder. A stray electrical signal could even hold the rudder at a deflected angle for a time. When the signal disappeared, the rudder would be released.
When Frontier mechanics examined Schow's plane, they discovered such a defect. Boeing service letters indicated the problem was caused by defective electrical components supplied by subcontractors. Other Boeing documents suggested problems could be caused by fluids seeping into the electronics-and-equipment bay, just beneath the forward galley, where the yaw damper and other electronics are housed.
Frontier determined that a defective electrical circuit caused Schow's rudder to "creep" 4 degrees to the right, the largest deflection a yaw damper could command on early-model 737s. (A full 737 rudder deflection is 26 degrees.)
Though Schow didn't know the yaw damper was holding his rudder deflected to the right, he compensated by "trimming" the rudder to the left.
As Colombi was bringing Schow coffee, the stray signal disappeared. In a company memo, E.G. McMillan, then Frontier's avionics-engineering manager, described what happened next: "The rudder suddenly returned to the neutral position, now displaced by the amount of trim which had been added. This action caused a sudden yaw in the aircraft."
Boeing addressed the problem highlighted by Schow's flight by recommending that airlines within two years reduce the yaw damper's authority - the extent to which it could adjust the rudder - to 2 degrees from 4 degrees.
Boeing engineers theorized an uncommanded 2-degree deflection would not be enough to disrupt flight.
The FAA did not feel the safety implications of Schow's flight were serious enough to order airlines to make the change in yaw-damper authority. It was left to the airlines' discretion, and the FAA did not track cooperation.
But Frontier didn't wait two years. The airline reduced yaw-damper authority to 2 degrees on its entire fleet within two weeks of receiving the Boeing recommendation, said former Frontier pilot Keith Sleater.
Nevertheless, he said, Frontier pilots continued to report 737s briefly veering out of control, even on airplanes limited to 2 degrees of yaw-damper authority.
"I've never personally had it happen to me, but I knew that it could give you a real sudden, violent swerve and that you'd need some room to recover," Sleater said.
In June 1986, one of the modified Frontier jets - not Schow's airplane - was sold to United Airlines and assigned tail No. N999UA.
No system to analyze incidents
Statistics reveal much that is remarkable about the ubiquitous Boeing 737 twinjet.
With more than 2,500 jets making 17,000 flights each day, a 737 takes off, on average, every five seconds.
According to Boeing, the 737 ranks statistically as one of the safest aircraft in the world: Accidents occur once every 2 million flights, half the industry average.
Statistics are not so helpful in documenting flight-control problems such as those noted by Frontier pilots. Unlike in accidents - any occurrence in which someone is injured or the aircraft is seriously damaged - the aviation-safety community keeps no comprehensive statistics on control problems.
The best data are kept in airline maintenance logs. But that information is not routinely exchanged among airlines, nor offered voluntarily to the FAA, which certifies airplanes as safe, or to the NTSB, which investigates accidents and recommends safety improvements.
The FAA keeps service-difficulty reports and accident-and-incidents reports, and NASA keeps a voluntary Air Safety Reporting System database. However, there is little cross-referencing among them that might highlight recurring problems.
"The U.S. is grossly behind the curve when it comes to predicting accidents," said Michael Hynes, an Oklahoma City-based independent aviation consultant.
The end of N999UA, and 25 lives
On Feb. 25, 1991, N999UA, the airplane United had purchased from Frontier five years earlier, was leveling off at 12,000 feet. It suddenly yawed to the right for a few seconds, then returned to its normal heading. Before landing, the pilots switched off the yaw damper, and, as an extra measure of protection, pulled the yaw-damper circuit-breaker, removing power to the device.
Two days later, on Feb. 27, N999UA was climbing through 10,000 feet when the airplane jerked rapidly several times. The pilots continued to fly the jet past 25,000 feet, then felt a sharp, uncommanded yaw to the right lasting five to 10 seconds. After regaining control, the pilots switched off the yaw damper and pulled its circuit-breaker.
Four days later, on March 3, N999UA took off from Denver as Flight 585 and proceeded to Colorado Springs, where the jet, with Capt. Harold Green and First Officer Patricia Eidson at the controls, made a left turn on final approach to the runway.
Descending at about 500 feet, with its landing gear lowered, N999UA suddenly rolled sharply right. Green and Eidson reacted by revving the engines to full thrust and partially deploying wing panels, called flaps, in attempt to lift the airplane. In less than 10 seconds N999UA crashed, killing all 25 aboard.
The investigation that followed brought in an NTSB-directed committee of experts from Boeing, United, the Air Line Pilots Association and the FAA.
Early in the probe, investigators found a loose wire in an electromagnetic switch, called a solenoid, used to transmit signals between the yaw damper and rudder PCU.
The NTSB cited this loose wire as evidence to explain both the Feb. 25 and Feb. 27 yaw-damper malfunctions on N999UA - incidents handled safely by the pilots at 12,000 and 25,000 feet, respectively - and to rule out the yaw damper as a probable cause in the low-altitude crash.
The NTSB said the loose connection created a stray, intermittent signal that could have caused erratic rudder movement.
But the NTSB agreed with Boeing investigators that such rudder deflections would have had "little or no effect on airplane controllability" since N999UA's yaw-damper authority was limited to 2 degrees.
When the NTSB issued its final report 22 months after the crash, no one pointed out that the same 2-degree yaw-damper deflection might have created what were described as "sudden" and "sharp" yaws in N999UA six and four days before the crash. In one case, the uncommanded yaw lasted 5 to 10 seconds - about the time in which N999UA went out of control and crashed.
Manufacturer checks own work
The safety board spent most of its time exploring two leading theories for the Colorado Springs crash. The first suggested that a freak "rotor" wind tossed N999UA out of control. The second theorized that the crash was caused by a flaw in the PCU - a flaw that came to light on another 737 more than a year after the Colorado accident.
In July 1992, as investigators were still studying the wreckage reports, a United 737 pilot was performing a routine preflight rudder check at Chicago's O'Hare Airport when he noticed he could not depress the left rudder pedal more than a quarter of its normal range.
United removed the rudder PCU and shipped it to its maintenance headquarters in San Francisco. Mechanics discovered a defect in an internal part called the "PCU servo valve." Someone at the airline phoned the NTSB.
The PCU servo directs the flow of hydraulic fluid to move the rudder. United and the NTSB discovered that the servo would sometimes let too much hydraulic fluid flow to the wrong place, or "overport." That could cause the rudder to jam, or in extreme cases, move the opposite direction from that commanded by the pilot.
Overporting would occur if the pilot moved the rudder pedals too rapidly. The problem, according to the NTSB report, was that the servo lever was "manufactured out-of-tolerance."
Following standard practice, the PCU retrieved from the wreckage of N999UA was turned over to Parker Bertea, its manufacturer, which reconstructed the mangled actuator in its Irvine, Calif., labs.
Parker Bertea reported that in lab testing the PCU servo lever worked fine. The NTSB cited that finding as one of the reasons it could not blame the crash on the PCU.
Aviation experts have long debated whether letting manufacturers analyze their own parts is a good way to investigate accidents. Many contend the practice has served aviation safety well. Others say self-interest cannot help but arise.
"The NTSB pretends that conflicts don't exist, but they clearly do," said Chuck Miller, president of System Safety Inc., a Sedona, Ariz., aviation consulting firm. "Often, because of legal concerns on the part of the manufacturers, the NTSB does not get the full story."
The NTSB's final report does not question how the integrity of the PCU-servo lever - and therefore Parker Bertea's lab results - might have been affected by the force of the crash itself. The report makes no conclusion about whether N999UA's PCU was defective or not before the crash.
The investigators did not look at whether yaw-damper problems, which N999UA may have experienced before the crash, could have interacted with a possibly defective PCU.
The yaw damper uses electrical signals to move the PCU servo lever in precisely the same way the rudder pedals move it, with one important difference: While a pilot would almost never rapidly stomp on a rudder pedal during flight, the yaw damper could potentially move the servo lever rapidly at any time. Scores of low-voltage signals travel between the yaw damper and PCU servo each minute, and a loose wire or fluids could theoretically become conduits for a stray high-voltage signal that could move the rudder rapidly.
However, investigators in Colorado never explored the possibility of that happening.
"The PCU servo gets its signals from the rudder pedals, the yaw damper or the trim system," said Dick Schaden, a Boulder, Colo., attorney representing the families of N999UA's crew. "A PCU servo problem can be set off by any one of those things."
The investigative committee also never looked into instances of yaw damper and rudder trim working against each other, such as those that caused Frontier's flight upsets in the mid-1970s, said an NTSB source involved in the investigation.
Though the servo-lever defect was not blamed for the Colorado crash, the NTSB was concerned enough about it to urge the FAA to order airlines to install modified PCUs as soon as possible and regularly inspect 737 PCUs in the meantime.
With those suggestions, the safety board closed its 22-month investigation and ruled the Colorado Springs crash unsolvable, only the fourth time in aviation history the safety board has been stumped, and the first such case involving a modern jetliner.
`Before we drop another one'
Robert Besco, a former commercial pilot and president of Professional Performance Improvement, a Dallas-based aviation consulting firm, believes enough has happened to warrant formally warning all pilots to be alert for 737 control problems and to train them about what to do when it happens.
"It sounds like if you get a problem under 10,000 feet, chances are you're going to lose it," Besco said.
"If there is a possibility of a failure, then let's train pilots to make the failure a non-event, and let's do it right now before we drop another one."
At United Airlines, pilots have developed an impromptu test before they take off: stomp heavily on the rudder pedals several times during the preflight check. If the rudder works normally, the pilots feel confident the PCU won't jam or move the rudder in the opposite direction.
Boeing's recent 737 operations-manual insert, instructing pilots to switch the yaw damper off if uncommanded rudder oscillations occur in flight, is a small step in the right direction, Besco said.
But pilots could easily overlook the insert, and the technique isn't likely to become common practice until airlines are ordered to make it part of ongoing training, he said.
One pilot who fought and won
An incident that generated the kind of working information that pilots say they need - and a case in which that information was not officially disseminated - occurred over Central America in April 1994.
Capt. Ray Miller was flying a 7-year-old Continental 737-300 in clear, calm skies at about 37,000 feet when he heard a muffled boom.
The aircraft suddenly twisted and rolled violently to the right.
Miller disengaged the autopilot and turned the control wheel sharply to the left. Nothing in his training or in his flight manual told Miller he should switch off the yaw damper.
"Fortunately it was a very clear day and smooth. I feel if I had the normal low-level bumpy air I would have possibly gotten behind the control response and lost control of the aircraft," Miller wrote in a special report to NASA.
As Miller battled the plane's insistent pull to the right, the co-pilot realized the already balky jet would become significantly harder to fly when they lowered the landing gear and deployed flaps (drag-inducing wing panels) in preparation for landing.
Through experimentation, Miller, one of Continental's most experienced 737-300 pilots, ascertained that he would have to land the airplane faster than normal, using less flaps, to maintain control.
He landed the jet safely at San Pedro Sula, Honduras, at 160 knots, using 15 degrees flaps. Typically, 737s land at 135 knots and 30 degree flaps.
Continental mechanics immediately removed the yaw damper, PCU, autopilot and other segments of the control system and turned the parts over to Boeing for investigation. The airline alerted the FAA.
The NTSB, which usually investigates jetliner control-system problems, played no formal role in the case.
About a month later, Boeing advised Continental and the FAA that the Honduras incident was caused by a stray signal from the yaw damper/PCU solenoid - the same kind of stray signal that had been theorized to have upset N999UA in earlier flights, though ruled out as causing the Colorado crash.
The Honduras incident occurred just a few weeks after the FAA responded to the NTSB's Colorado Springs recommendations, issued 16 months earlier: The FAA ordered that modified PCUs be installed on all 737s within five years.
FAA spokesman David Duff said Boeing's findings indicated no connection between what caused the Honduras incident and PCU-servo defect, and thus the FAA saw no reason to accelerate the PCU-replacement deadline.
No effort was made to pass along to other 737 pilots information about what Miller did to safely land his barely controllable airplane.
"That's exactly the kind of information, from the standpoint of pilot technique, we can use to keep the airplane flying," said an active 737 pilot.
"It would be tragic if I had a crash because I didn't know what Ray Miller did to keep his airplane up."
Disaster at Pittsburgh: 132 killed
On Sept. 8, 1994, USAir Capt. Peter Germano and First Officer Charles Emmett, both seasoned pilots, were descending over Pittsburgh.
Germano's jet was manufactured at Boeing's Renton factory in 1987, within months of Miller's plane.
Like the Honduras jet, the Pittsburgh airplane had not yet been retrofitted with a modified PCU.
As it descended below 5,000 feet in clear weather, USAir Flight 427 suddenly dropped to the left and accelerated to more than 300 mph. It crashed into a wooded ravine 23 seconds later with an impact that dug a crater several feet deep and killed all 132 on board.
With an investigation now under way, safety agencies and Boeing officially have nothing to say about what might have gone wrong.
However, safety-board sources from time to time have let it be known that no evidence implicating the rudder system has been found.
As was done in the unsolved Colorado Springs case, PCU manufacturer Parker Bertea early on was asked by the NTSB to reconstruct and analyze the USAir jet's rudder actuator; Boeing examined the yaw damper and other parts of the rudder system.
The safety board will wrap up the evidence-gathering phase of its investigation at a public hearing in Pittsburgh next week but isn't expected to rule on a probable cause until late this year.
While the Pittsburgh investigation is pending, Boeing, USAir, the FAA and the NTSB have generally declined to answer specific questions about the 737's control system.
One senior FAA official did respond to a question about why the accelerated PCU upgrade being undertaken by United Airlines has not been mandated for the rest of the 737 fleet.
"The FAA establishes a level of safety that it believes is an acceptable and appropriate level. If anybody desires to go beyond that level, we would certainly say, `That's wonderful,' " said Tom McSweeny, director of aircraft certification.
"We would not require everybody to achieve that higher level of safety just because one person decided to do it," McSweeny said.
FAA and NTSB also say steps taken since the Colorado Springs crash assure that the 737 fleet is very safe.
The agencies and Boeing characterize the Colorado Springs and Pittsburgh disasters as random, isolated events.
"There's nothing that suggests a link between these things, at least at the moment," said Tim Neale, spokesman for the Air Transportation Association, an industry lobbying group.