United Airlines Flight 585

A short flight south from Denver

United Airlines flight 585 left Denver at 09:23 on 3 March 1991 for Colorado Springs. The Boeing 737-291 Advanced, registered N999UA, carried 20 passengers, two pilots and three flight attendants. The captain flew the aircraft while the first officer handled the radio. The flight had begun in Peoria, Illinois, with stops at Moline and Denver, where a scheduled crew change took place. Its intended arrival in Colorado Springs was 09:46, and an airborne message revised that estimate to 09:42.

N999UA had been manufactured in May 1982 and acquired by United from Frontier Airlines in June 1986. By the accident date it had accumulated 26,050 flight hours and 19,734 cycles. The aircraft had two Pratt & Whitney JT8D-17 engines. The NTSB found that it was properly loaded and its baggage and cargo were secured. The pilots who had flown it to Denver reported no abnormal conditions during those earlier legs.

There had been two reports of uncommanded yaw during the preceding week. After the first, maintenance replaced the yaw damper coupler. After the second, it replaced the rudder transfer valve. No further problems were reported before the accident flight, and the aircraft departed Denver with no open maintenance items. The NTSB later found that the maintenance responses followed the prescribed procedures. Both removed components operated normally during subsequent tests.

Gusts on the approach to runway 35

The weather was clear enough for a visual approach, but strong winds and turbulence affected the Colorado Springs area. At 09:30:37 the crew received airport information that included low level windshear advisories and a warning of northwesterly gusts of 40 knots or more. The broadcast was about 40 minutes old. The crew added 20 knots to its landing reference speed in response to the wind information.

Approach control vectored the aircraft toward runway 35 and cleared successive descents. After the first officer reported the airport in sight, the controller cleared a visual approach and instructed the crew to remain at or above 8,500 feet until on base. The first officer contacted the tower at 09:37:59. The tower cleared flight 585 to land and reported wind from 320 degrees at 16 knots, gusting to 29 knots.

The first officer asked about airspeed losses or gains reported by other aircraft. The controller relayed a preceding 737's experience: a 15 knot loss at 500 feet, followed by gains of 15 knots at 400 feet and 20 knots at 150 feet. The tower later pointed out Cessna traffic and advised that it was passing behind flight 585. At 09:41:23 the tower instructed the crew to hold short of runway 30 after landing. The acknowledgment was the aircraft's last radio transmission.

A rapid right roll and an attempted go around

The aircraft intercepted the extended runway centerline at about 09:42:50 and descended toward the airport. Recorded airspeed and acceleration showed fluctuations consistent with the turbulence. About 40 seconds before impact, engine thrust decreased and the descent rate increased to about 2,200 feet per minute, greater than the rate needed for a standard approach. Thrust then increased again as the crew continued to align with the runway.

At 09:43:28.2 the first officer called that they were at 1,000 feet above the ground. About five seconds later the aircraft began an abrupt heading change to the right and a sudden descent. The captain called for 15 degrees of flaps. The NTSB found that the flap selection, together with increased thrust, was consistent with the beginning of a go around. The aircraft continued rolling right as its nose fell and its airspeed increased beyond 200 knots.

Witnesses described a brief wings level attitude near completion of the turn, followed by a steady right roll toward an inverted, nearly vertical descent. The aircraft struck Widefield Park, 3.47 nautical miles south of the runway and slightly east of its extended centerline. Impact evidence indicated an 80 degree nose low attitude and a continuing right roll. All 25 occupants died. The aircraft was destroyed by impact and the subsequent fire, and the NTSB classified the accident as unsurvivable.

The evidence recovered from the park

Investigators recovered both flight recorders despite severe impact damage. The flight data recorder's tape was crumpled but its data could be extracted. Although the unit could record many parameters, its installation in N999UA recorded only heading, altitude, airspeed, normal acceleration and microphone keying. The cockpit recorder supplied just over 30 minutes of audio, with creases in its tape degrading playback quality.

Wreckage examinations and engine instrument evidence showed that both engines were producing power at impact. Reconstruction of the wings and tail found the structures attached until ground contact. The elevator system remained functional, and investigators found no evidence of an airborne malfunction in the ailerons or spoilers. The flaps had moved symmetrically. The investigation also found that the principal hydraulic systems remained capable of supplying the flight controls.

The main rudder power control unit had sustained extensive damage from impact and fire. Investigators could examine components, but could not perform an operational test of the complete unit. Because rudder position and roll were absent from the recorded data, the NTSB combined the available recorder information with radar, the accident location, wreckage orientation and computer simulations. This reconstruction became particularly important as further rudder evidence emerged in later investigations.

How a jammed valve could reverse the rudder

The 737's main rudder power control unit used pressure from hydraulic systems A and B to move the rudder. Pilot pedal movements and yaw damper commands reached a servo valve through mechanical linkages. Inside that valve, a primary slide moved within a secondary slide, which moved within the housing. Their positions opened the hydraulic passages needed to extend or retract the actuator and turn the rudder.

Further testing during the USAir flight 427 investigation demonstrated a hazardous interaction between a jam and the valve's available travel. When the secondary slide was held away from neutral and a sufficiently rapid command was applied, internal linkages could bend or twist. The primary slide could pass its intended stop. Hydraulic pressure could then command the actuator to move in the direction opposite to the pilot's input.

Thermal tests showed that a slide could jam and later operate normally, leaving no physical marks. The extreme temperature differences used in those tests were outside normal flight conditions. The NTSB also considered tight clearances and particles in hydraulic fluid as possible contributors to a jam. It could not determine how a secondary slide would have jammed under normal airline operating conditions while leaving no physical evidence. The damaged United valve could not be measured accurately enough to establish its original internal clearances.

The resulting rudder motion was limited in flight by the opposing aerodynamic load. The report called the point where the aerodynamic force balanced the actuator force the blowdown limit. A rudder at that limit could generate a substantial yaw and associated roll, even while the pilots attempted to oppose the motion with the other flight controls.

The reconstruction of the final seconds

In its best match simulation, the NTSB introduced a wind change to reproduce the heading movement immediately before the upset. It then modeled a secondary slide jam and a left pedal command at about 09:43:32. In that scenario the rudder reversed to the right. The simulated heading agreed with the recorded heading to within about one degree. The wind, pedal forces and control movements in this reconstruction were modeled variables.

The reconstruction placed the captain in a rapidly developing and unfamiliar control emergency. At first, the yawing motion would have provided stronger cues than the roll. A reversed rudder could push the pedal back against the captain's foot while he tried to correct the heading. Increasing thrust for a go around also left only his left hand available to rotate the control wheel. The modeled sideforce would have pulled his body away from the wheel and made a large opposing input more difficult.

The simulation showed the right bank exceeding 80 degrees about three seconds after the reversal began, with the aircraft already pitching steeply down. Impact followed about nine seconds after the modeled reversal. The NTSB concluded that the crew recognized the upset promptly and tried immediately to recover. With the aircraft below 1,000 feet and the control failure unfamiliar, the pilots could not be expected to diagnose it and devise and carry out the appropriate recovery procedure in the available time.

The amended probable cause

Strong winds over nearby mountains prompted a detailed examination of atmospheric rotors, rotating masses of air that could impose rolling loads on an aircraft. The NTSB evaluated the pressure changes that a rotor of the required strength should produce in recorded altitude and airspeed. Those signatures were absent. Characteristic roaring sounds were also absent from cockpit audio and witness observations. The Board considered a mountain rotor explanation very unlikely.

The original final report, adopted on 8 December 1992, had left the cause undetermined. It identified a directional control malfunction and an unusually severe atmospheric disturbance as the two leading explanations. Evidence developed during the USAir flight 427 investigation, including examination of the Eastwind flight 517 upset, led the Board to reconsider flight 585. It adopted the amended final report on 27 March 2001.

The amended probable cause was loss of control resulting from the rudder moving to its blowdown limit. The Board found that the rudder most likely moved opposite to the pilots' command because the main control unit's secondary slide jammed against the valve housing away from neutral and the primary slide overtraveled. It also found that recovery techniques developed after the later accident could counter an uncommanded rudder deflection in most parts of the flight envelope. Those techniques had not been available to the flight 585 crew.

Tests, design changes and mountain wind research

The report recorded recommendations for repeated maintenance tests of the main rudder valve, a preflight check, incorporation of design changes and a review of similar servo valves in other essential flight controls. The FAA issued airworthiness directive 94-01-07 on 3 January 1994, requiring repeated checks for internal leakage until replacement with units designed to prevent secondary slide overtravel. The NTSB recorded acceptable closures of these recommendations in 1993 and 1994.

Mountain wind research continued as a separate safety issue. In 1998 the FAA reported publication of guidance on hazardous mountain winds and collection of Colorado Springs wind data during early 1997. Funding and research priorities reduced the experiment's original scope, and the project was terminated. In January 1999 the NTSB called for analysis and publication of the collected data and continued to seek a broader program for airports near mountainous terrain. It requested a further progress report from the FAA in March 2000.