The USAir flight 427 flight crew was properly certificated and qualified, and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or behavioral conditions that might have adversely affected the flight crew’s performance during the accident flight.
The USAir flight 427 accident airplane was equipped, maintained, and operated in accordance with applicable Federal regulations. The airplane was dispatched in accordance with FAA- and industry-approved practices.
All of USAir flight 427’s doors were closed and locked at impact.
USAir flight 427 did not experience an in-flight fire, bomb, explosion, or structural failure.
Neither a midair collision with other air traffic, a bird strike, clear air turbulence, nor other atmospheric phenomena were involved in the USAir flight 427 accident.
Asymmetrical engine thrust reverser deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing uncommanded flight control movements, yaw damper malfunctions, and a rudder cable pull or break were not factors in the USAir flight 427 accident.
Although USAir flight 427 encountered turbulence from Delta flight 1083’s wake vortices, the wake vortex encounter alone would not have caused the continued heading change that occurred after 1903:00.
About 1903:00, USAir flight 427’s rudder deflected rapidly to the left and reached its left aerodynamic blowdown limit shortly thereafter.
Analysis of the human performance data shows that it is likely that the first officer made the first pilot control response to the upset event and manipulated the flight controls during the early stages of the accident sequence; although it is likely that both pilots manipulated the flight controls later in the accident sequence, it is unlikely that the pilots simultaneously manipulated the controls (possibly opposing each other) during the critical period in which the airplane yawed and rolled to the left.
Analysis of the human performance data (including operational factors) does not support a scenario in which the flight crew of USAir flight 427 applied and held a full left rudder input until ground impact more than 20 seconds later.
Analysis of the CVR, Safety Board computer simulation, and human performance data (including operational factors) from the USAir flight 427 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
The flight crew of USAir flight 427 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.
The flight crew of USAir flight 427 recognized the initial upset in a timely manner and took immediate action to attempt a recovery, but did not successfully regain control of the airplane.
It is very unlikely that the loss of control in the United flight 585 accident was the result of an encounter with a mountain rotor.
Analysis of the CVR, computer simulation, and human performance data (including operational factors) from the United flight 585 accident shows that they are consistent with a rudder reversal most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
The flight crew of United flight 585 recognized the initial upset in a timely manner and took immediate action to attempt a recovery, but did not successfully regain control of the airplane.
The flight crew of United flight 585 could not be expected to have assessed the flight control problem and then devised and executed the appropriate recovery procedure for a rudder reversal under the circumstances of the flight.
Training and piloting techniques developed as a result of the USAir flight 427 accident show that it is possible to counteract an uncommanded deflection of the rudder in most regions of the flight envelope: such training was not yet developed and available to the crews of USAir flight 427 or United flight 585.
During the Eastwind flight 517 incident, the rudder reversed, moving to its right blowdown limit when the captain commanded left rudder, consistent with a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
It is possible that, in the main rudder PCUs from the USAir flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of some combination of tight clearances within the servo valve, thermal effects, particulate matter in the hydraulic fluid or other unknown factors) the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position, without leaving any obvious physical evidence, and combined with a rudder pedal input, could have caused the rudder to move opposite to the direction commanded by a rudder pedal input.
The upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides.
When completed, the rudder system design changes to the Boeing 737 should preclude the rudder reversal failure mode that most likely occurred in the USAir flight 427 and United flight 585 accidents and the Eastwind flight 517 incident.
Rudder design changes to Boeing 737-NG series airplanes and the proposed retrofit of the remainder of the Boeing 737 fleet do not eliminate the possibility of other potential failure modes and malfunctions in the Boeing 737 rudder system that could lead to a loss of control.
The dual-concentric servo valve used in all Boeing 737 main rudder PCUs is not reliably redundant.
A reliably redundant rudder actuation system is needed for the Boeing 737, despite significant improvements made in the system’s design.
The results of this investigation have disclosed that the Boeing 737 rudder system design certificated by the FAA is not reliably redundant.
Transport-category airplanes should be shown to be capable of continued safe flight and landing after a jammed flight control in any position, unless the jam can be shown to be extremely improbable.
Pilots would be more likely to recover successfully from an uncommanded rudder reversal if they were provided the necessary knowledge, procedures, and training to counter such an event.
A neutral rudder pedal position is not a valid indicator that a rudder reversal in the Boeing 737 has been relieved.
The training being provided to many Boeing 737 flight crews on the procedures for recovering from a jammed or restricted rudder (including a rudder reversal) is inadequate.
The continued use by air carriers of airspeeds below the existing block maneuvering speed schedule presents an unacceptable hazard, and the existing block maneuvering speed for the flaps 1 configuration provides an inadequate margin of controllability in the event of a rudder hardover.
The FDR upgrade modifications required by the FAA for existing airplanes are inadequate because they do not require the FDR to be modified to record yaw damper command voltage, yaw damper and standby rudder on/off discrete indications, pitch trim, thrust reverser position, leading and trailing edge flap position, and pilot flight control input forces for control wheel, control column, and rudder pedals.
Based on the rudder-related anomalies discussed in this report, FDR documentation of yaw damper command voltage, yaw damper and standby rudder on/off discrete indications, and pilot flight control input forces for control wheel, control column, and rudder pedals is especially important in the case of the 737, and these parameters should be sampled on 737 airplanes at frequent intervals to provide optimal documentation.
The FAA’s failure to require timely and aggressive action regarding enhanced FDR recording capabilities, especially on Boeing 737 airplanes, has significantly hampered investigators in the prompt identification of potentially critical safety-of-flight conditions and in the development of recommendations to prevent future catastrophic accidents.
is about all ya can do. Of course mechanical controls can fail (and do), but at least there is feedback from the senses to indicate a problem rather than a computer...
)
