USAir Flight 427

An arrival from Chicago

USAir flight 427 left Chicago O'Hare for Pittsburgh on 8 September 1994 with 127 passengers and five crew members. The Boeing 737-3B7, N513AU, became airborne at about 18:10 eastern daylight time. The first officer was flying with the automatic flight system engaged, while the captain handled radio communications and monitoring duties. Earlier that day, the same pilots had flown the airplane from Jacksonville to Charlotte and then to Chicago. Pittsburgh was the next destination in their three day trip sequence.

The approach developed in clear weather. Pittsburgh controllers were sequencing the 737 behind Delta flight 1083, a Boeing 727 arriving from the northwest. Flight 427 received successive descent and speed instructions, eventually reaching an assigned altitude of 6,000 feet and an assigned speed of 190 knots. The pilots completed their preliminary landing checklist and briefed the approach. The first officer made an arrival announcement to the cabin, and the captain confirmed that the intended runway was 28R.

At 19:02:22, approach control instructed Flight 427 to turn left onto a heading of 100 degrees and pointed out a departing Jetstream. The crew acknowledged the instruction. About half a minute later, the 737 was rolling out of its left turn, still at 6,000 feet and close to 190 knots. The first officer reported seeing the other aircraft.

A wake encounter becomes a severe upset

At about 19:02:57, the cockpit voice recorder captured three thumps within a second, followed by short exclamations from the pilots. Over the next two seconds, the left bank increased from slightly less than 8 degrees to slightly more than 20 degrees. Airspeed briefly rose to about 193 knots before settling close to 191. Flight tests and reconstruction later showed that the aircraft had entered the descending wake vortices of the preceding 727.

The first response briefly arrested the roll. Between about 19:02:59 and 19:03:00, the bank reduced to about 15 degrees left. The heading, however, began changing left more quickly and passed through the assigned 100 degrees. Just after 19:03:00 the airplane rolled rapidly left again. By 19:03:01, its heading had passed through about 89 degrees and continued changing at at least 5 degrees per second. The NTSB concluded that the rudder had moved rapidly to the left and reached its aerodynamic blowdown limit.

The investigation found that controllers had maintained the required separation. The two arriving airplanes had remained at least 4.1 miles apart while at the same altitude. Wake encounter tests produced strong rolling motions, but the NTSB found that the wake alone could not explain the sustained heading change after 19:03:00.

The final seconds

Just before 19:03:03, the recorded left bank reached about 43 degrees and the aircraft began descending from 6,000 feet. The control column moved aft and the airspeed began falling below 190 knots. The cockpit recording captured the autopilot disconnect warning. During the following seconds, the left roll increased, the column moved farther aft and the aircraft lost altitude.

The stall warning stickshaker began at 19:03:08.1. By then, the NTSB analysis placed the airplane at about 70 degrees of left bank and more than 20 degrees nose down. Approximately three seconds later, with the control column at its full aft position, the bank had passed 90 degrees and the nose was more than 50 degrees below the horizon. The captain transmitted an emergency declaration at about 19:03:15.

The cockpit recording stopped at 19:03:22.8. At about 19:03:23 the airplane struck a wooded hillside near Aliquippa, approximately 6 miles northwest of Pittsburgh International Airport. Impact forces and a subsequent fire destroyed the aircraft. All 132 occupants died. Emergency responders arrived within minutes, but the impact had destroyed the occupiable cabin space. The NTSB classified the accident as unsurvivable.

Reconstructing a movement the recorder did not measure

Both recorders were recovered from the wreckage. The cockpit recording lasted 30 minutes 56 seconds and was of excellent quality. The flight data recorder yielded usable data despite impact damage. It recorded 13 parameters, including heading, airspeed, altitude, aircraft attitude and control column position. It recorded no flight control surface positions, and it could not identify which pilot had applied a particular control input.

The sampling rates also differed. Heading, altitude and airspeed were recorded once each second. Roll attitude and control column position were recorded twice a second, while vertical acceleration was recorded eight times a second. The cockpit audio supplied a continuous record of speech and sounds. Investigators used those different records together to establish the timing and character of the upset.

Investigators combined the recorded aircraft motion with flight tests, computer simulations, component examinations and analysis of the pilots' speech and effort sounds. A simulation involving rudder reversal after a right pedal input closely matched the recorded heading until the stall began. Boeing also developed a simulation in which a pilot applied and held left rudder. The NTSB compared both possibilities with the cockpit evidence and human performance analysis.

The Board found that the first officer probably made the initial control response. It considered simultaneous opposing inputs by the two pilots unlikely during the critical left yaw and roll. Its analysis rejected sustained full left pedal input by the crew as an explanation consistent with the human performance evidence. The combined evidence supported a reversal within the rudder system.

How the rudder could reverse

The 737-300 used a single rudder panel driven by a main hydraulic power control unit. Inside that unit, a servo valve directed fluid to move the actuator. Its primary and secondary slides fitted concentrically within a housing. The primary slide normally moved first; the secondary slide supplied additional flow when needed for a rapid command. Both slides had some travel beyond their normal operating range.

Testing demonstrated a reversal mechanism. With the secondary slide jammed to the housing away from neutral, a sufficiently rapid opposing input could drive the primary slide beyond its normal range. Fluid would then be routed to move the rudder opposite to the input. The rudder could travel to its aerodynamic limit, where aerodynamic force balanced the available actuator force. That limit depended on the aircraft's flight condition.

Extreme thermal tests caused the accident valve's secondary slide to jam and produced indications of momentary reversal. Its internal clearances were tighter than those of a new production valve tested alongside it, and the NTSB considered it more susceptible to jamming. Those tests also demonstrated that a jam and reversal could leave no physical marks. The recovered valve remained capable of passing functional tests after testing. The Board identified secondary slide jamming with primary slide overtravel as the most likely reversal mechanism in Flight 427.

A shrinking margin for recovery

A fully deflected rudder produced yaw and roll that the ailerons and spoilers could oppose only under some combinations of airspeed, configuration and vertical load. Investigators called the boundary crossover airspeed. By about 19:03:02, the aircraft's speed and rising vertical load had put it below that boundary. Regaining roll control then required increasing airspeed, reducing vertical load, or both.

The aft column movement was consistent with a pilot trying to arrest the nose down motion and maintain assigned altitude. It also increased vertical load and reduced the margin for countering the rudder. The crew had received no prior warning or training about rudder reversal and this relationship between load, speed and roll control. The NTSB concluded that the pilots recognized the initial upset promptly and immediately attempted recovery, but could not be expected to diagnose the fault and devise the necessary technique within the available seconds.

Simulator subjects sometimes recovered or stabilized the roll by promptly holding full right control wheel and applying enough forward column pressure to reduce load and preserve airspeed. They knew what would happen and had been coached in the response. Attempts to maintain altitude made recovery less likely. The NTSB found that knowledge, procedures and training would improve the prospects of recovery.

Design changes and the final recommendations

The NTSB adopted its final report on 24 March 1999. It identified loss of control following movement of the rudder to its blowdown limit as the probable cause. The investigation also examined the wider architecture of the rudder system. The Board found that a jam in one valve slide could affect the other and that the design failed to provide reliable redundancy. Manual intervention to select a backup could take more time than an aircraft close to the ground allowed.

By the time of the report, Boeing had redesigned the servo valve and introduced hydraulic pressure reduction or limiting changes. The NTSB expected completion of those changes to prevent the identified reversal mechanism, while remaining concerned about other possible rudder malfunctions. Recommendation A-99-20 called for a reliably redundant rudder actuation system on existing and future 737s. A-99-21 sought an engineering test and evaluation board to examine potential failures in the complete system.

The final recommendations also addressed procedures, simulator accuracy, airspeed margins and recording. The Board sought complete initial and recurrent practice of the uncommanded yaw or roll and jammed or restricted rudder procedures. It recommended updating simulators with crossover airspeed flight test data and reviewing maneuvering speeds. Further recommendations sought additional recorded system parameters and pilot input forces, which would help investigators distinguish a pilot command from a control system malfunction.

A July 1998 survey showed the training gaps behind those recommendations. Three of twelve United States 737 operators contacted by the NTSB provided no simulator training in the new procedures. Only half demonstrated crossover airspeed, and only a third required that demonstration in the flaps 1 configuration. Flight tests also showed that the simulator package represented crossover airspeed inadequately. The Board called for both improved simulation and opportunities for pilots to practise the complete procedures.