Turbine Pilot

Pilot error, or mechanical malfunction?

On September 8, 1994, USAir Flight 427 had just descended to 6,000 feet on its arrival to Pittsburgh International Airport (PIT), when it suddenly and inexplicably rolled left. The Boeing 737-300 aircraft seemed to recover momentarily toward a wings-level condition, then rolled abruptly left again. It entered a dive, plummeting in a near-vertical attitude until striking the ground 28 seconds after the initial upset. Accident investigators could find no immediately apparent reason for the aircraft's departure from controlled flight. Weather at the time was excellent, with mostly clear skies and no reports of turbulence. The crew's communications with ATC prior to the accident were routine. Cockpit voice recorder (CVR) data later revealed that nothing seemed awry until several unexplained thumping sounds occurred just before the upset took place.

The accident had some obvious parallels with an earlier 737 crash that occurred near Colorado Springs in March 1991. That aircraft, a United Airlines 737-200, was also in the approach phase when it rolled sharply to the right and dove in a a near- vertical attitude to impact with the ground. The cause of that accident has still not been determined, nor has a common link with USAir 427 been found. The outward similarities between the two events, however, raised concern that perhaps something that was only just becoming apparent was inherently wrong with the 737 design. As a result, the aircraft was placed under intense scrutiny. Besides the major NTSB investigation of Flight 427, the FAA instituted a critical design review (CDR) of the 737's certification process, and Boeing began its own exhaustive examination, working closely with the FAA and NTSB.

It needs to be stated at the outset that the NTSB investigation — the longest, most expensive in the agency's history — is not yet complete; therefore, no probable cause for the crash of Flight 427 has heretofore been established. Numerous factors have been ruled out as contributory, however — and perhaps more important, some intriguing findings have surfaced in the areas of wake turbulence and pilot response to roll upsets. The CDR was completed, with a finding that there is no 737 safety issue that requires immediate corrective action. The CDR did generate 27 nonbinding recommendations suggesting that certain design improvements, changes in pilot training, and new maintenance procedures might enhance the 737's future safety record.

The 737 design has enjoyed a long and impressive safety record. At the time of Flight 427's demise, nearly 2,800 737s of all model types were in service around the world, making it the most popular jet transport ever built. That figure has since broken the 3,000 mark. The fleet has amassed more than 60 million flight hours. On average, 737 aircraft make 500 takeoffs and landings an hour, 24 hours a day. The latest -300, -400, and -500 series 737s have the highest dispatch reliability rate of any jet transport ever built.

But because there are more 737s flying than any other commercial jet, and because they make more takeoffs and landings than longer haul types, it stands to reason that the 737 fleet has the most exposure to accidents and incidents. Since 1967, when the first 737-100 appeared, there have been a total of 60 hull losses to various causes. While this is a significant number, it still translates to the lowest rate of loss per million flight hours of any comparable jet transport.

So why did Flight 427 fall from the sky? Is this a new kind of accident caused by a previously unknown glitch in the aircraft's design? The final determination of probable cause awaits completion of the NTSB investigation, but certain causes have been ruled out. An in-flight thrust reverser activation was proven not to have occurred. Nor is there any evidence of a major flight control failure, such as an asymmetrical flap or slat extension. An internal fire, an explosion, a decompression, and various broken control cable scenarios have also been eliminated. The engines were operating normally at the time of the upset. In fact, no system malfunctions of any kind have yet been uncovered.

Attention remains focused on several elements known to have contributed to past 737 uncommanded roll upsets. These include wake turbulence encounters, autopilot malfunctions, and "rudder hardovers," a condition in which an abrupt and uncommanded rudder input occurs. Boeing maintains an extensive database of all such incidents reported by customers. The actions taken by the crew of Flight 427 in its attempt to recover control have also been thoroughly scrutinized.

The wake turbulence theory seemed weak at first blush. The nearest aircraft to USAir 427 was a Delta 727, operating 4.2 miles ahead. The scenario was benign enough — typical, in fact, of what occurs daily at most busy air carrier airports. But plotted radar tracks of both aircraft revealed that the 737 did intersect the 727's flight path, at about the same point that the twin-engine jet went out of control.

In order to measure the effects of such a wake encounter more precisely, investigators devised a series of flight tests using a 727 specially equipped with wingtip smoke generators. The smoke generators allowed the normally invisible vortices to be seen. A 737 trailed behind, at distances of 3 to 4 miles. It was rigged with seven video cameras that recorded instrument panel displays, as well as cockpit and exterior flight control movements. Over the course of eight test flights, it intentionally flew into the 727's vortices more than 250 times.

The tests produced some immediately useful results. First of all, investigators believe they have identified the thumping sounds heard on the CVR tape of Flight 427. Nearly identical sounds were recorded when the test airplane hit the 727's wake vortices. The vortices themselves behaved in unexpected fashion. Instead of the gradually expanding horizontal tornadoes often depicted in literature on the subject, they remained tightly wound, 4-foot-diameter spirals, even at distances of 4 miles from the 727. Nor did they descend as predicted, dropping only 100 feet per mile for the first 3 miles, then staying at a more or less constant altitude thereafter. They remained closely spaced, within a distance of about one-third the wingspan of the 727, until dissipating.

The trials demonstrated conclusively that a 727's wake can induce a 737 to roll steeply, depending on where the vortices strike the aircraft. With no initial recovery effort by the test pilot, the wake rolled the aircraft as much as 60 to 75 degrees before subsequent control inputs returned the aircraft to wings level. The tests also demonstrated that the aircraft could be maintained in level flight during such an encounter if the pilot reacted immediately, using as much as full control wheel input opposite to the roll.

Although it now appears highly plausible that Flight 427's initial upset was caused by a wake encounter, what happened next is less clear. The 11-channel digital flight data recorder (DFDR) indicates that the crew's first reaction to the left roll was to command the right aileron to counter it. This nearly stopped the roll, but the amount of correction was not great enough, nor was it held in long enough, to completely recover the aircraft to wings level. As the right aileron was relaxed, the aircraft again rolled sharply to the left.

Two things occurred in rapid succession that sealed the 737's fate. Shortly after the onset of the roll, a full left rudder input occurred, which was sustained until impact. (Rudder position was not one of the items directly recorded by the DFDR, but investigators were able to deduce it by analyzing the aircraft's sideslip angle as recorded by the unit.) Whether this input was commanded by the crew or the result of some malfunction in the rudder system is not yet known, and is still being investigated. However, the left rudder only aggravated the upset. It is characteristic of swept-wing jet transports that such a rudder deflection will cause the aircraft not only to yaw, but also to roll markedly in the same direction. This occurs because the wing on the outside of the turn (the right wing in this case), presents more lifting surface into the relative wind than does the inside wing. The outside wing thus generates more lift, creating the rolling moment.

With the aircraft now diving steeply in a left bank, aggravated by the left rudder deflection, the crew tried a final recovery effort — increasing pitch. The result was a rapid increase to 3.8 Gs, followed by an accelerated stall. Once stalled, the aircraft was unrecoverable. It remained stalled until impact, with the DFDR's last recorded indicated airspeed of 261 knots.

Because of the unexplained rudder deflection, the 737 rudder system has received more attention than almost any other detail in this investigation. The rudder is hydraulically driven by a rudder power control unit (PCU), which is capable of moving the rudder a maximum of 22 degrees in either direction. If this becomes inoperative, the rudder can still be controlled using a backup PCU powered by the aircraft's standby hydraulic system. The likelihood that a failure in either the main or standby systems would cause a full, uncommanded rudder deflection (or hardover) was deemed to be "extremely improbable" under the meaning of the term in the transport aircraft design criteria of FAR Part 25. Therefore, no certification flight tests were required in order to demonstrate how the aircraft would behave if a hardover occurred. (The FAA did point out in its CDR that current certification procedures call for tougher fault analysis standards than those existing when the 737-100 was first certified in 1968. In fact, it and all later 737 variants would require extensive additional testing in order to pass today's certification process.) In Boeing's opinion, however, an uncommanded full rudder hardover remains extremely improbable. No documented cases have taken place in more than 60 million 737 flight hours. There have been two instances of unintentional commanded full rudder deflections, each one involving an incapacitated pilot, and the aircraft in each of those cases was landed safely.

The 737 does employ a full-time yaw damper, which in the 737-300 can automatically command up to 3 degrees of rudder movement in either direction. There have been many documented cases of 737 yaw damper rudder hardovers, in which a malfunctioning yaw damper system abruptly moves the rudder the full 3 degrees of travel. Boeing reports that this statistically occurs in the 737 fleet about once in every 70,000 flight hours. If uncorrected by the pilot, this amount of rudder deflection, depending on aircraft speed and flap configuration, can induce an initial roll of as much as 20 degrees. The aircraft remains easily controllable back to level flight, however, and to prevent further inputs, the yaw damper would simply be turned off by the pilot. The rudder itself would otherwise continue to function normally. There is no evidence to suggest that a failure in the yaw damper system could somehow drive the rudder through much or all of its 22 degrees of travel.

Various other kinds of rudder system anomalies that have occurred in the past continue to be looked at by investigators, too. These include instances in which rudders have jammed and one in which a control reversal took place, causing the rudder to respond in a direction opposite to what was commanded. So far, none of these have been shown to explain Flight 427's full rudder deflection.

But presuming for a moment the worst hypothetical case — a fully extended and jammed rudder resulting from sudden mechanical failure — could the crew have overcome the resulting yaw-induced roll by using aileron alone? That question has focused attention on a previously little understood aspect of 737 aerodynamics, something investigators are calling "crossover speed." Crossover speed, which varies by aircraft weight and flap setting, is a speed below which a rudder-induced roll can no longer be counteracted by using opposite aileron, and above which it can. As G loads increase, crossover speed increases dramatically. At 108,000 pounds and Flaps One, Flight 427 was right at the crossover speed of 190 knots when the upset took place.

In response to these findings, Boeing is recommending that 737 crews avoid flight near minimum maneuvering speeds, which are well below the crossover speed range. Instead, it suggests they adhere to the manufacturer's so-called "canned" speed schedule, which provides a buffer above crossover speed at various flap settings. It has not otherwise announced any aircraft design changes. The Air Line Pilots Association, an official party to the NTSB investigation, has adopted a stronger stance. According to an ALPA source close to the proceedings, it is recommending that 737 operators add an additional 10 knots to Boeing's canned speeds at flap settings of 1, 5, and 10 degrees. Longer term, it is pushing for hardware modifications to the 737 flight control system that would altogether eliminate the problem of crossover speed. This could be accomplished by limiting rudder authority at higher speeds, increasing total aileron authority, or some combination of the two methods.

Meanwhile, the $64,000 question awaiting the NTSB's prognostications remains: What did cause the rudder deflection after the initial upset took place — mechanical failure or an unintentional crew action?

Regardless of the eventual answer, the question itself has already prompted some industry soul-searching about pilot response to this kind of upset, in all kinds of aircraft. As a result, many airlines have begun to institute so-called advanced maneuvers training during pilot simulator training. AMT is training in unusual attitude recovery, something many longtime airline pilots may not have seen since their primary aircraft training days. Is AMT a good idea? One 737 simulator instructor for a major air carrier conducted an informal survey following the crash of Flight 427. Without any forewarning, he placed crews in a similar predicament. A large percentage of pilots were unable to regain control before crashing. Given some practice in unusual attitude recovery, though, the vast majority did recover successfully.

Boeing's more exact simulator recreations of the upset that befell Flight 427 indicate that it was indeed recoverable, but with little margin for error. In order to recover with the least altitude loss, Boeing's simulator test pilots first rolled towards a wings level or shallow bank condition and only then increased pitch to recover from the dive. Doing otherwise inevitably resulted in an accelerated stall from which recovery was not possible within the available altitude. The simulations also presumed that the rudder was repositioned correctly, since — so far, at least — there is no evidence that Flight 427's rudder was jammed in the left position. Even so, 2,000 feet or more was typically lost in the recovery maneuver.

Of course, a simulated re-creation could never duplicate the degree of "startle factor" experienced by a crew in a real life-or-death situation like this. Psychologists know that a little stress produces adrenalin that can help us to deal with trying circumstances. Most pilots going for a checkride, for example, find that the process of mentally pumping up helps them to handle the demands of the experience. But too much stress can cause minds to overload, at which point performance deteriorates. To what degree extreme stress factored into the crash of 427 is anyone's guess, but a well-rehearsed simulation goes only so far in predicting how a crew might handle the real thing.

It bears repeating that the NTSB's investigation is not complete, so judgment on the probable cause of this accident is premature at best. Although no mechanical failures have come to light, it is possible that further probing may yet uncover a smoking gun — a new kind of fault in the rudder system or autopilot, for example. However, it isn't too early to draw some useful conclusions. For one, wake turbulence doesn't always behave the way we expect it to. As these latest vortex tests clearly demonstrate, it remains an insidious danger, even to pilots of large aircraft who might tend to discount its hazards. For another, none of us can predict when we might find our own aircraft suddenly diverging from controlled flight, for any number of reasons. The particular skills needed to set it right side up again are surely worth keeping handy for just such an occasion.