During the 1990s, a series of issues affecting the rudder of Boeing 737 passenger aircraft resulted in multiple incidents. In two separate accidents (United Airlines Flight 585 and USAir Flight 427), pilots lost control of their aircraft due to a sudden and unexpected rudder movement, and the resulting crashes killed everyone on board, 157 people in total. [1] Similar rudder issues led to a temporary loss of control on at least one other Boeing 737 flight before the cause of the problem was ultimately identified.
The National Transportation Safety Board determined that the incidents were the result of a design flaw that could result in an uncommanded movement of the aircraft's rudder. [2] : 13 [3] : ix
The issues were resolved after the Federal Aviation Administration ordered modifications for all Boeing 737 aircraft in service. In 2016, former NTSB investigator John Cox stated that time has proven the NTSB correct in its findings because no additional rudder-reversal incidents have occurred since the NTSB forced Boeing to implement redesigned parts. [4]
Unlike other twin-engine large transport aircraft in service at the time, the Boeing 737 was designed with a single rudder panel and single rudder actuator. [2] : 14 The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU). [2] : 13 Inside the PCU is a dual servo valve that, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder. [2] : 19 The PCU for affected Boeing 737 aircraft was designed by Boeing and manufactured by Parker Hannifin. [2] : 20
On March 3, 1991, United Airlines Flight 585, a Boeing 737-200, crashed while attempting to land in Colorado Springs, Colorado. During the airplane's landing approach, the plane rolled to the right and pitched nose-down into a near-vertical dive. [2] : ix The resulting crash destroyed the aircraft and killed all 25 people on board. [2] : ix Although the NTSB investigated the accident, it was unable to conclusively identify the cause of the crash. The rudder PCU from Flight 585 was severely damaged, which prevented operational testing of the PCU. [3] : 47 A review of the flight crew's history determined that Flight 585's captain strictly adhered to operating procedures and had a conservative approach to flying. [3] : 47 A first officer who had previously flown with Flight 585's captain reported that the captain had indicated to him while landing in turbulent weather that the captain had no problem with declaring a go-around if the landing appeared unsafe. [3] : 48 The first officer was considered to be "very competent" by the captain on previous trips they had flown together. [3] : 48 The weather data available to the NTSB indicated that Flight 585 might have encountered a horizontal-axis wind vortex that could have caused the aircraft to roll over, but this could not be shown conclusively to have happened or to have caused the rollover. [3] : 48–49
On December 8, 1992, the NTSB published a report that identified what the NTSB believed at the time to be the two most likely causes of the accident. The first possibility was that the airplane's directional control system had malfunctioned and caused the rudder to move in a manner that caused the accident. The second possibility was a weather disturbance that caused a sudden rudder movement or loss of control. The Board determined that it lacked sufficient evidence to conclude either theory as the probable cause of the accident. [2] : ix [3] : 49 This was only the fourth time in the NTSB's history that it had closed an investigation and published a final aircraft accident report where the probable cause was undetermined. [5]
On September 8, 1994, USAir Flight 427, a Boeing 737-300, crashed near Pittsburgh, Pennsylvania. While on approach to Pittsburgh International Airport, Flight 427 suddenly rolled to the left. Although the pilots were briefly able to roll right and level the plane, it rolled left a second time and the pilots were unable to recover. [3] : 4 The resulting crash killed all 132 people on board. [3] : 9 The NTSB realized early into its investigation that the crash of Flight 427 might have been caused by an unintended or uncommanded rudder movement, similar to the suspected (but not yet established) cause of the Flight 585 crash. [3] : 44 As a result, the NTSB conducted additional testing on United Flight 585's Parker-Hannifin PCU servo during its Flight 427 investigation. [2] : 73
One of the problems facing investigators was the relative lack of precision in the data produced by the flight data recorder (FDR), which only recorded control inputs at periodic intervals with significant time gaps between samples, gaps during which no data was recorded no matter what the pilot did with the controls. This lack of precision led to it being possible for Boeing to interpret the data differently from the way the NTSB did, leading the manufacturer to suspect and insist that the pilot had responded incorrectly to a wake turbulence incident. [6]
At the request of the NTSB, data from the Penny & Giles quick access recorder (QAR) of a British Airways (BA) Boeing 747-400 was supplied to the NTSB by BA. The data was from a London-Bangkok flight in which the aircraft suffered an uncommanded elevator movement and momentary elevator reversal on take-off. The aircraft then landed safely. Operating alongside the FDR system, the QAR on BA's 747-400s, in conjunction with a Data Management Unit, received and recorded more aircraft parametric data, including control input values at a higher rate. [7] This BA data led to renewed suspicion of the similar valve design used on the 737 rudder. As a result of this earlier BA incident, Boeing had, in fact, modified the design of the 747 elevator servo system, and the modified system had been retroactively fitted to all 747-400s in service. [6]
On June 9, 1996, while the NTSB's investigation of Flight 427 was still ongoing, the pilots of Eastwind Airlines Flight 517 briefly lost control of their aircraft, a 737-200, while flying from Trenton, New Jersey, to Richmond, Virginia. [2] : ix The aircraft experienced two episodes of rudder reversal while on approach to land in Richmond. Unlike the two prior incidents, the rudder issues on Flight 517 spontaneously resolved and the pilots were able to safely land the aircraft. One of the 53 people on board was injured. [3] : 51
The NTSB investigated the Eastwind incident, and incorporated information from both United Flight 585 and Eastwind Flight 517 into its ongoing investigation of the Flight 427 crash. [3] : 44
As Eastwind Flight 517 had landed safely and the pilots of Flight 517 had survived, the NTSB was also able to perform tests on a plane that had experienced problems similar to the accident aircraft, was able to interview them, and gain additional information on their experience. The captain told the NTSB in a post-accident interview that they had not encountered any turbulence during the flight, and that, during their landing descent, he felt the rudder "kick" or "bump" even though neither pilot had moved the rudder pedals. [3] : 51 When the plane abruptly rolled to the right, the captain applied left aileron and attempted to move the rudder, but the rudder pedal controls felt stiffer than normal and did not seem to respond to his input; when his flight control inputs did not immediately resolve the roll upset, he also advanced the throttle of the right engine in an effort to compensate. [3] : 51–52
The NTSB and Boeing engineers conducted a series of tests on the PCUs from Flight 517 and Flight 427, as well as PCUs used in other aircraft and a brand-new PCU that had not yet been used in flight (the PCU from Flight 585, although it had been recovered, was too badly damaged to test in this manner). [3] : 71, 81–85 Testing revealed that under certain circumstances, the PCU's dual servo valve could jam and deflect the rudder in the opposite direction of the pilots' input. [3] : 81–85 Thermal shock testing revealed that the uncommanded rudder movement could be replicated by injecting a cold PCU with hot hydraulic fluid. Thermal shock resulted in the servo's secondary slide becoming jammed against the servo housing, and when the secondary slide was jammed the primary slide could move to a position that resulted in rudder movement opposite of the pilot's commands. [2] : 79 [3] : 294 The NTSB concluded that all three rudder incidents (United Flight 585, USAir Flight 427, and Eastwind Flight 517) were most likely due to the PCU secondary slide jamming and excessive travel of the primary slide, resulting in the rudder reversal. [3] : 294
On March 24, 1999, after a four-year investigation, the NTSB issued its probable cause finding for Flight 427. The NTSB concluded that the probable cause of the Flight 427 crash was rudder reversal due to the PCU servo malfunction. [3] : 295 Two years later, the NTSB published an amended accident report for Flight 585 that found the same probable cause for that accident as well.
As a result of the NTSB's findings, the Federal Aviation Administration ordered that the servo valves be replaced on all 737s by November 12, 2002. [8] The FAA also ordered new training protocols for pilots to handle in an unexpected movement of flight controls.
The following Boeing 737 aircraft incidents were also suspected of being caused by a rudder PCU malfunction:
On December 19, 1997, SilkAir Flight 185 crashed in Indonesia, killing 104 people. As the crash involved a Boeing 737-300 rolling and diving toward the ground at a steep angle, investigators considered the possibility of rudder hardover due to PCU servo malfunction. [12] The Indonesian National Transportation Safety Committee, the lead investigating agency, concluded in its December 14, 2000 final report that it had found "no evidence to explain the cause of the accident." [13] : 24 However, on the same day the U.S. NTSB, which also participated in the investigation, issued its own final report that contradicted the Indonesian NTSC findings. [13] : 24–25 The NTSB's report found that there was sufficient evidence to rule out mechanical failure (based on NTSB/Parker-Hannifin's own examinations of the suspected PCU/dual-servo unit recovered from the SilkAir crash), and that the probable cause of the accident was "intentional pilot action," most likely the captain, purposely crashing the aircraft by applying sustained nose-down control pressure. [13] : 24–25 [14]
In 2004, following an independent investigation of the recovered PCU/dual-servo unit, a Los Angeles jury, which was not allowed to hear or consider the NTSB's conclusions about the accident, ruled that the 737's rudder was the cause of the crash, and ordered Parker Hannifin, the PCU/dual-servo component manufacturer, to pay US$44 million to the plaintiff families. [15] Parker Hannifin subsequently appealed the verdict, which resulted in an out-of-court settlement for an undisclosed amount.
The Discovery Channel Canada TV Series Mayday (called Air Crash Investigation or Air Disasters in some markets) dramatized the NTSB's 737 rudder investigation in a 2007 episode titled "Hidden Danger" (broadcast in some countries as "Mystery Crashes"). [5]
Mayday separately dramatized the SilkAir crash investigation and lawsuit, including its connection to the 737 rudder controversy, in a 2012 episode titled "Pushed to the Limit" (broadcast in some countries as "Pilot Under Pressure"). [12]
SilkAir Singapore Private Limited, operating as SilkAir, was a Singaporean regional airline with its head office in Changi, Singapore. It was a wholly owned subsidiary of Singapore Airlines and in 2017, operated scheduled passenger services from Singapore to 54 cities in Southeast Asia, the Indian subcontinent, East Asia, and Northern Australia. As the regional wing of Singapore Airlines, it served the short to medium-haul destinations in the Singapore Airlines Group network.
Parker-Hannifin Corporation, originally Parker Appliance Company, usually referred to as just Parker, is an American corporation specializing in motion and control technologies. Its corporate headquarters are in Mayfield Heights, Ohio, in Greater Cleveland.
SilkAir Flight 185 was a scheduled international passenger flight operated by a Boeing 737-300 from Soekarno–Hatta International Airport in Jakarta, Indonesia to Changi Airport in Singapore that crashed into the Musi River near Palembang, Sumatra, on 19 December 1997, killing all 97 passengers and 7 crew members on board.
United Airlines Flight 585 was a scheduled passenger flight on March 3, 1991, from Denver to Colorado Springs, Colorado, carrying 20 passengers and 5 crew members on board. The plane experienced a rudder hardover while on final approach to runway 35 at Colorado Springs Municipal Airport, causing the plane to roll over and enter an uncontrolled dive. All 25 people on board the Boeing 737 were killed on impact.
Copa Airlines Flight 201 was a regularly scheduled passenger flight from Tocumen International Airport in Panama City, Panama, to Alfonso Bonilla Aragón International Airport in Cali, Colombia. On 6 June 1992, the Boeing 737-204 Advanced operating the route rolled, entered a steep dive, disintegrated in mid-air, and crashed into the jungle of the Darién Gap 29 minutes after takeoff, killing all 47 people on board. The in-flight breakup was caused by faulty instrument readings and several other contributing factors, including incomplete training.
USAir Flight 5050 was a passenger flight that crashed on takeoff from LaGuardia Airport in Queens, New York. As the plane took off from LaGuardia's runway 31, the plane drifted to the left. After hearing a loud bang, the pilots attempted to reject the takeoff, but were unable to stop the plane short of the end of the runway. The plane continued past the end of the runway and plunged into Bowery Bay. Two passengers were killed.
Aircraft upset is an unacceptable condition, in aircraft operations, in which the aircraft flight attitude or airspeed is outside the normally intended limits. This may result in the loss of control (LOC) of the aircraft, and sometimes the total loss of the aircraft itself. Loss of control may be due to excessive altitude for the airplane's weight, turbulent weather, pilot disorientation, or a system failure.
Eastwind Airlines was a start-up airline formed in mid-1995 and headquartered in Trenton, New Jersey, United States, and later in Greensboro, North Carolina.
TWA Flight 841 was a scheduled passenger flight from John F. Kennedy International Airport, New York City, en route to Minneapolis-Saint Paul International Airport in Minneapolis, Minnesota. On the evening of April 4, 1979 while flying over Saginaw, Michigan, the Boeing 727-31 airliner began a sharp, uncommanded roll to the right, and subsequently went into a spiral dive. The pilots were able to regain control of the aircraft and made an emergency landing at Detroit Metropolitan Airport.
On June 9, 1996, while operating a passenger flight from Trenton, New Jersey to Richmond, Virginia, the crew of Eastwind Airlines Flight 517 temporarily lost control of their Boeing 737-200 because of a rudder malfunction. The crew were able to regain control and land the aircraft successfully. All 53 occupants on board the 737-200 survived with no injuries.
Continental Airlines Flight 1404 was a Continental Airlines domestic flight from Denver International Airport in Denver, Colorado, to George Bush Intercontinental Airport in Houston, Texas. On the evening of December 20, 2008, the flight crashed while taking off from Denver, resulting in two critical injuries, 36 noncritical injuries, and a hull loss of the Boeing 737-524 aircraft.
USAir Flight 427 was a scheduled flight from Chicago's O'Hare International Airport to Palm Beach International Airport, Florida, with a stopover at Pittsburgh International Airport. On Thursday, September 8, 1994, the Boeing 737 flying this route crashed in Hopewell Township, Pennsylvania while approaching Runway 28R at Pittsburgh, which was USAir's largest hub at the time.
On 22 December 2009, an American Airlines Boeing 737-800, operating American Airlines Flight 331 and carrying 148 passengers and 6 crew, overran runway 12 on landing at Kingston in poor weather. The plane continued on the ground outside the airport perimeter and broke apart on the beach. Of the 154 people on board, 85 people were injured, including 14 seriously.
Throughout a normal flight, a pilot controls an aircraft through the use of flight controls including maintaining straight and level flight, as well as turns, climbing, and descending. Some controls, such as a "yoke" or "stick" move and adjust the control surfaces which affects the aircraft's attitude in the three axes of pitch, roll, and yaw. Other controls include those for adjusting wing characteristics and those that control the power or thrust of the propulsion systems. The loss of primary control systems in any phase of flight is an emergency. Aircraft are not designed to be flown under such circumstances; however, some pilots faced with such an emergency have had limited success flying and landing aircraft with disabled controls.
In aeronautics, loss of control (LOC) is the unintended departure of an aircraft from controlled flight and is a significant factor in several aviation accidents worldwide. In 2015 it was the leading cause of general aviation accidents. Loss of control may be the result of mechanical failure, external disturbances, aircraft upset conditions, or inappropriate crew actions or responses.
Northwest Airlines Flight 85 was a scheduled international passenger flight from Detroit Metropolitan Wayne County Airport in the United States to Narita International Airport in Japan. On October 9, 2002, while over the Bering Sea, the Boeing 747-400 experienced a lower rudder hardover event, which occurs when an aircraft's rudder deflects to its travel limit without crew input. The 747's hardover gave full left lower rudder, requiring the pilots to use full right upper rudder and right aileron to maintain attitude and course.
Aeroflot Flight 1802 was a commercial flight from Vinnytsia to Moscow that crashed after the rudder deflected sharply and the propellers feathered on 15 May 1976. All 52 passengers and crew aboard the aircraft perished in the crash.
Tatarstan Airlines Flight 363 was a scheduled domestic passenger flight, operated by Tatarstan Airlines on behalf of Ak Bars Aero, from Moscow to Kazan, Russia. On 17 November 2013, at 19:24 local time (UTC+4), the Boeing 737-500 crashed during an aborted landing at Kazan International Airport, killing all 44 passengers and 6 crew members on board.
The Boeing 737 MAX passenger airliner was grounded worldwide between March 2019 and December 2020, and again in 2024, after 346 people died in two similar crashes in less than five months: Lion Air Flight 610 on October 29, 2018, and Ethiopian Airlines Flight 302 on March 10, 2019. The Federal Aviation Administration initially affirmed the MAX's continued airworthiness, claiming to have insufficient evidence of accident similarities. By March 13, the FAA followed behind 51 concerned regulators in deciding to ground the aircraft. All 387 aircraft delivered to airlines were grounded by March 18.