A debate over safety has embroiled Boeing's 737. Today, a look at questions about its rudder that grew out of a 1991 disaster, and at the role Boeing takes in investigations.
 

	Power-control unit: the force behind the rudder View graphic

The first real clues that Boeing's 737 might have a dangerous defect in its rudder-control system came from a 1991 crash near Colorado Springs, Colo.

The 737-200, built in Renton in 1982, started out as part of Frontier Airline's fleet. Four years later, Frontier sold the plane to United and it was assigned tail number N999UA.

On a Feb. 25, 1991, flight, N999UA's rudder deflected inexplicably to the right. The problem went away when the pilots switched off the yaw damper, a device that automatically commands small rudder adjustments during flight. Mechanics replaced a part called the yaw-damper coupler and returned the plane to service.

Two days later, a different flight crew reported N999UA's rudder again moving to the right. The new coupler evidently had made no difference. This time mechanics replaced a valve in the yaw damper and returned the plane to service.

Four days later, on the blustery morning of March 3, 1991, Captain Harold Green and First Officer Patricia Eidson were bringing N999UA down for a routine landing in Colorado Springs. At 1,000 feet, the jet suddenly flipped to the right and dived straight down, smashing into a city park and killing all 25 on board.
 

YAW DAMPER A device that automatically smooths the ride by commanding small rudder adjustments during flight. POWER-CONTROL UNIT (PCU) An assembly of hydraulic valves and mechanical linkages that translates a command from the pilot's foot pedal or the yaw damper into movement of the rudder. DUAL SERVO VALVE A mechanism in the power-control unit containing two slide that direct the flow of hydraulic fluid used to move the rudder. ELEVATOR A part on the horizontal tail section used to control the up-and-down movement of an aircraft's nose and tail. HARDOVER The swift and forceful movement of an airplane's rudder as far as it can go to one side.

The pilot of a Cessna flying near the airport called the tower with a bird's-eye account: "We just saw the plane . . . uh just suddenly a complete downward dive."

From the control tower, air-traffic controller Kevin Ford reported from another perspective: "It looked like a dropped pencil going straight down."

It didn't take long for errant rudder movement to surface as a possible cause of the crash. Witness reports and readings from the plane's flight-data recorder confirmed that the 737 had traced a classic aerobatic maneuver, known as a "split-S," into the ground.

A split-S results from radically altering the symmetry of flight. Such a quick or severe change would be consistent with the right engine or right wing falling off, but that had not happened. The pilots could have moved the rudder to the extreme right, but to do so within 1,000 feet of the ground would be suicidal. The other possibility was that the rudder had moved on its own.

Industry's role in probes

Investigators with the National Transportation Safety Board were unfamiliar with the intricacies of the plane's rudder-control system when they arrived in Colorado Springs to comb through N999UA's wreckage.

The NTSB examines 2,100 aviation accidents a year nationwide, as well as trucking, rail, pipeline and marine accidents. Its staff of 90 full-time investigators and 260 support personnel has an annual budget of $35 million. (By comparison, the Seattle Police Department has 1,269 officers and an annual budget of $117 million.)

While safety board investigators pride themselves on objectivity and scientific certainty, they rely almost exclusively on the parties they are investigating — aircraft manufacturers, suppliers and airlines — for the technical expertise needed to solve airplane crashes. The post-crash handling, testing and analysis of complex airplane parts — typically retrieved scorched or crushed _ are routinely assigned to the aircraft builder and its suppliers.

Among the NTSB investigators assigned to the Colorado Springs case was Greg Phillips. His task: to assess what role, if any, the rudder played in the 737's crash. Phillips would work with experts from Boeing and Parker Bertea Aerospace, the Irvine, Calif., company that manufactures all 737 rudder power-control units, as well as representatives from United Airlines and the Air Line Pilots Association.
 

	PCU dual servo valve View graphic

Fluid debris dismissed

The burned and mangled rudder parts were retrieved from what remained of the plane's tail section and taken to United's maintenance center in San Francisco. Phillips was joined there by John Calvin, an engineer from Boeing's quality assurance lab, and Wally Walz, a senior engineer from Parker Bertea, among others.

They examined the yaw damper, but it had been crushed to about one-tenth of its original size by the crash impact and was useless for testing. That left the rudder's power-control unit, or PCU. It was severely burned, its main rod bent, its internal parts frozen.

When they dismantled the PCU, investigators noted a white, powdery substance on the internal components of the yaw damper, and tiny drops of water, bubbles and stringy chips of bronze in PCU cavities.

Then, investigators focused on a mechanism about the size of a soft-drink can which is at the heart of the PCU. Called the dual servo valve, it consists of a cylindrical metal slide about the size of a cigarette, which is positioned inside a slightly larger slide. The servo slides work together to direct the proper flow of pressurized hydraulic fluid used to move the rudder.
 

Worldwide, 737s have made more than 60 million flights. Boeing has been producing seven 737s a month recently, but plans to increase the rate to 17 a month by early 1998. 737s made 20 percent of all landings last year at Seattle-Tacoma International Airport. Collectively, 737s have flown more than 26.6 billion miles, approximately 130 round trips between Earth and the sun.

The investigators found the servo's slides severely jammed and pounded them apart with a hammer.

It is crucial to keep even minute debris out of the servo valve because the spaces separating the slides from each other and from their housing wall are no more than 5 microns, a gap invisible to the human eye.

Contaminants could jam the slides or clog a valve opening, sending hydraulic fluid flowing in the wrong sequence and inadvertently moving the rudder.

However, the investigators didn't think the debris was important because the PCU's filtering system was thought to prevent anything dangerous from getting into the device and because they "hadn't seen any service history" indicating a problem of contaminants in PCUs, the safety board's Phillips said in an interview in August 1995.

As a result, they didn't try to identify the contaminants, determine how they got into the PCU or assess what jamming effect, if any, they might have produced.

"I can't say at the time there was a high level of concern about particulates in the fluid," Phillips said.

Later, there would be.

Three pieces missing

The investigators gathered on the morning of March 21, 1991, at United's San Francisco base to discuss taking the dismantled servo valve to Parker Bertea's plant in Irvine for further testing. That was because United didn't have the equipment to extensively test the servo's slides.
 

	737 incidents in the '90s in which rudder has been suspected View graphic

Walz, of Parker Bertea, was assigned to hand-carry the servo valve to Irvine. John Calvin, the quality-control engineer from Boeing, instructed an assistant to pack up the parts. According to court records, the assistant left the room and returned with a taped package, which he handed to Walz, who carried it on a flight to Southern California.

When Walz opened the package that afternoon at the Parker Bertea plant, he discovered that three servo-valve parts were missing: a spring, spring guide and end cap.

Boeing, citing ongoing litigation, has never explained why those three parts were left out of the package forwarded to Irvine.

Together, the three missing parts play a crucial role in the delicate sequence of channeling just the right amount of pressurized hydraulic fluid, at just the right moment, to move the rudder in the direction and to the degree the pilot or the automatic yaw damper has commanded. When precisely positioned inside the servo-valve housing, the spring, spring guide and end cap serve as an internal stop, preventing the outer slide from moving too far within the housing.

It would be another 18 months before investigators would discover that too much movement of the outer slide could be dangerous.
 

This series of articles examining technical, regulatory and legal issues associated with the 737 rudder problem is the result of two years of research involving thousands of pages of federal records, airline reports, Boeing documents, legal briefs filed in accident cases, and interviews with dozens of industry sources. Boeing and officials of the National Transportation Safety Board have declined to answer questions from The Times about issues raised by the 737 rudder-control problems. At times over the past two years, however, individuals from Boeing and the safety board have talked about aspects of the issues raised here; their remarks have been excerpted in these stories.

Part polished, then tested

As far as Phillips knew at the time, the three parts which John Calvin's helper failed to pack in San Francisco were inconsequential. Phillips concurred with a group decision to proceed with testing of the servo using a new spring, spring guide and end cap taken from Parker Bertea's stockroom.

"We agreed that we could test with other hardware and get valid data," Walz said in a court deposition last year in a lawsuit filed by the families of Colorado Springs victims.

Before reassembling the inner and outer slides, investigators used a power tool to smooth the servo valve's interior housing walls and the exterior of the outer slide, creating like-new surfaces.

This practice — the restoring of damaged parts to working condition before testing them and then absolving them of contributing to a crash — continues to be accepted procedure in National Transportation Safety Board investigations.

The polished inner and outer slides were placed back inside the servo-valve housing, along with the new spring, spring guide and end cap. Phillips and other NTSB investigators then watched as Parker Bertea engineers tested the United jet's servo valve, now reassembled with many new or refurbished parts.

The servo valve failed to transfer fluid and maintain pressure according to specifications, but the investigators agreed it worked well enough to conclude there was no evidence it contributed to the crash.

Boeing's theory: A freak wind

With the PCU now largely absolved of blame, the focus of the probe shifted away from the rudder. Boeing offered the theory that a freak gust of wind, bouncing like a horizontal tornado off the nearby Rocky Mountain foothills, flipped the jetliner into a split-S dive.

Boeing produced reams of data and a computer simulation to show how a sideways-swirling "wind rotor" could have caused the crash.

Some investigators expressed doubt about Boeing's theory, saying it would take incredible strength for wind to pull a 38-ton airplane into a split-S fall. For Boeing's theory to make sense, the rotor would have had to hit the aircraft head on and then turn earthward at just the right moment to drive it into the ground.

Nothing in aviation history suggested such a phenomenon was possible.

As the Colorado Springs probe continued, two developments shifted interest back to the 737's rudder controls.

On June 6, 1992, a Copa Airlines 737 was cruising high over Central America when it suddenly flipped and crashed in a jungle in Panama, killing all 47 on board. At the invitation of Panamanian authorities, Phillips and another NTSB investigator, Tom Haueter, traveled to Panama to lead the investigation.

Haueter and Phillips, assisted by experts from Boeing and its suppliers, deduced that a frayed wire in a cockpit instrument most likely contributed to pilot error causing the crash. But their findings weren't conclusive, and suspicion remained that an errant rudder movement may have caused the plane to flip.

Then, in August 1992, an anonymous caller alerted the NTSB that United had made a troubling discovery while testing a rudder PCU removed from a 737 jetliner in Chicago a month earlier.

On July 16, United Captain Mack Moore hadn't liked the way his 737 rudder pedals were behaving during a routine pre-takeoff systems check at O'Hare International Airport. The right pedal seemed stiffer than usual and Moore could push the left one only about a quarter of the way to the floor.

United removed the PCU from Moore's jet, ferried it to the airline's maintenance center in San Francisco and began experimenting with it. There, sources say, a mechanic discovered that he could trigger a specific kind of rudder malfunction, called a reversal, by putting the spring, spring guide and end cap slightly out of adjustment.

The mechanic established that a PCU could receive a command to move the rudder left — yet move the rudder instead to the extreme right. The reversal happened if the spring, spring guide and end cap were not in the precise alignment needed to prevent the outer slide from moving too far.

Probe is taken to new level

When the safety board's Phillips and his supervisor, Bud Laynor, director of the agency's office of air safety, learned about United's finding, they recalled the Colorado Springs investigation: The Boeing engineer's assistant had failed to pack the spring, spring guide and end cap with the other Colorado Springs PCU parts heading for more tests.

"That's when we got real smart," Phillips said.

The federal investigators called for a summit meeting of everyone involved in the rudder-control investigation. The power-control units from the jets that crashed in Panama and Colorado Springs were to be brought to Boeing's labs in Seattle to be tested alongside the unit pulled from Mack Moore's plane in Chicago.

By then, though, the springs, spring guides and end caps from the United and Copa jets had long since been disassembled and reassembled, eliminating evidence of how the parts were aligned as each crash occurred.

Nonetheless, the safety board's Laynor says he insisted that the original spring, spring guide and end cap from the 737 that crashed in Colorado Springs be found and restored to the PCU for the summit tests. When the parts were presented for testing, Laynor said he recognized the end cap as having burn marks similar to those he remembered seeing in San Francisco, but he couldn't say for sure whether the spring and spring guide were from the Colorado Springs jet.

In a separate interview in August 1995, Boeing spokesman Steve Thieme said Boeing was "absolutely positive" they were all the original parts.

Investigation: unsolved

The summit tests took place in Boeing's Seattle labs in September 1992. The power-control units worked well enough that investigators agreed they could find no conclusive evidence of a rudder reversal as the cause of the Colorado Springs or Panama crash.

Not long after the Seattle tests, the NTSB convened a closed-door meeting at which the investigators made their final arguments for a probable cause in the Colorado Springs crash. The pilots' group and United pointed to the circumstantial evidence that the PCU must have somehow malfunctioned. Boeing urged the board to accept its wind-rotor theory.

In the end, the five-member board ruled it "could not identify conclusive evidence to explain" the crash. It suspended in a quandary what was to that date the most extensive air-crash investigation in its 28-year history.

But it wasn't the end of the safety board's concern raised by the so-called "Mack Moore incident" — when it was discovered that a 737 PCU could produce rudder movement opposite of a command from the pilot or yaw damper.

Acting on a safety board recommendation, the Federal Aviation Administration in March 1994 ordered airlines to replace the spring, spring guide and end cap in all 737 power-control units with parts re-engineered to assure proper alignment and engraved with serial numbers to help keep track of them. Airlines were given until March 1999 to make the changes, as long as they inspected the PCU every few months.

Kenneth Usui, the Boeing manager of airworthiness for the Renton division where the 737 is made, protested. In a letter to the FAA, Usui said that regular inspections were unnecessary and that airlines should be given seven years to make the upgrade.

Boeing maintains that, like the rest of the industry, it took the Mack Moore incident for the company to learn that the PCU could reverse itself. Some investigators, however, were skeptical.

A January 1995 report by the British Air Accidents Investigation Branch buttressed the belief of some investigators that Boeing had known about the rudder-control problem for years.

The agency, the British equivalent of the NTSB, had investigated why an elevator — a part on the horizontal tail section _ had reversed momentarily on a British Airways 747-400 and pitched its nose down as it was climbing out of London.

The British agency blamed the 747 elevator reversal on the jamming of a servo similar to the one used in 737 rudders. Its report notes that, in the course of its investigation, Boeing informed the British agency that it had known about the servo's capacity to reverse since the mid-1970s.

From the Colorado Springs accident through the end of 1993, as safety officials hashed out improvements for the PCU, 11 more 737s crashed around the world. They included the accident in Panama as well as landing-approach crashes in China, Korea and India. The accidents drew scant public attention.

Rudder clues in India crash

Then on March 8, 1994, a Sahara India Airlines 737 flipped onto the runway at New Delhi Airport, killing nine people. Records indicate a rudder malfunction was immediately suspected.

Federal records show an NTSB investigator on the Colorado Springs crash and Boeing and Parker Bertea engineers were asked to examine the New Delhi airplane's rudder systems. Among those from Boeing was John Purvis, the company's director of air-safety investigations.

The accident happened as a veteran Sahara India 737 pilot was supervising touch-and-go landings with three pilot trainees in clear weather. With one of the trainees at the controls, the aircraft touched down, rolled along the runway and took off again, reaching an altitude of 400 feet.

Suddenly, the jet veered left and slammed back to earth near the airport's international terminal. Flaming parts skidded into a nearby Russian jet, setting it on fire. The four Sahara pilots, as well as five ground workers servicing the Russian plane, were killed.

Indian aviation authorities blamed the crash on pilot error. Yet there also was evidence suggesting the airplane's rudder had reversed to the left when the pilot had correctly commanded it to move right. In examining the plane's PCU, the American experts discovered its serial number had been removed and replaced with a number that was not familiar to Boeing or Parker Bertea. The unit evidently had been worked on by an unauthorized repair shop and assigned a bogus number.

Upon disassembling the PCU servo valve and checking the internal components, investigators also found that the spring guide had been machined to the wrong size and was similarly stamped with a bogus part number. Investigators reassembled the PCU with the improperly machined spring guide and ran it through lab tests. They found that, under certain conditions, the PCU reversed both to the left and to the right.

The reversals occurred when the inner slide jammed inside the outer slide as the pilot rapidly depressed a rudder pedal. The lab tests showed the outer slide would then move too far, directing fluid in a sequence that reversed the rudder.

Boeing's stand challenged

Boeing's Purvis took the position that only debris large enough and hard enough to leave marks could jam the servo slides. Since no scratches or nicks were found on the New Delhi jet's slides, he said jamming and rudder reversal couldn't have caused the crash.

But independent hydraulics experts say jamming can take place in servo valves without leaving any marks.

"There are a lot of different ways a valve can jam," said William Needleman, associate director of science and lab services at Pall Corp., a filter manufacturer. Numerous tests in industrial settings show soft particles, such as dirt, can jam valves temporarily. "When you unjam it and open the valve up, a lot of the contaminant washes away," Needleman said.

A month after the New Delhi crash, there was another incident that focused attention on the 737's rudder.

On April 11, 1994, Captain Ray Miller was cruising a 7-year-old Continental Airlines 737-300 in clear, calm skies over Honduras when he heard a muffled thump. In the same instant, Miller felt the aircraft suddenly twist and roll violently to the right.

Miller disengaged the autopilot and turned the control wheel sharply to the left, holding it firm against stiff resistance. This deployed wing panels, called ailerons, to roll the plane left and thus counter the mysterious, insistent pull to the right.

"Our location was still well out over the water. I recognized that there was a very real possibility . . . that we just might lose total control of this thing and end up in the Gulf of Honduras," Miller reported afterward.

For the next 18 minutes, Miller and his co-pilot struggled to keep the jet from rolling over to the right. The pilots guessed that a piece of tail or fuselage had fallen or blown off, creating an unbalanced aircraft.

Whatever was happening, Miller was grateful it began at 37,000 feet. Fighting to control the jet as it descended, Miller had time to run through problem checklists and discuss with his co-pilot the best way to land the aircraft.

Had the problem started at a lower altitude and slower air speed, Miller reported, the flight would have been "non-survivable . . . due to the alarming and violent nature of the event, and the very confusing control responses and clues as to what is happening."

So concerned was Miller that he began broadcasting a description of his situation to any aircraft nearby that might be listening "because if they had to get the recorders out of the water someone needed to know what happened."

Miller and his co-pilot decided they needed to fly the jet much faster than normal to execute a safe landing. A higher landing speed would keep more air flowing over the wings, making the ailerons more effective in controlling the jet's tendency to roll to the right, they deduced.

The strategy worked. Miller brought the jet down safely. Once the 737 came to a stop, Miller hurried outside to inspect the aircraft. To his surprise, he found the plane's exterior parts in perfect order. Continental mechanics immediately removed the flight-data recorder, the yaw damper, the PCU and other parts, handing them over to Boeing for analysis.

Boeing disputes account

Records show Boeing concluded that hydraulic fluid had leaked from the PCU onto the yaw-damper signaling component, creating an open electrical circuit that inadvertently moved the rudder 2.5 degrees to the left. Such a deflection should have caused the jet to veer only slightly off course, something easily controllable by the pilots. Moreover, Boeing said the problem could not have lasted more than 110 seconds.

Those findings contradicted Miller's 9,500-word written statement, which detailed the steps he had to take for 18 minutes to keep the aircraft from veering out of control. Miller had squeezed the control wheel so hard that he injured his left hand.

After reviewing Boeing's findings and the pilot's report, the NTSB and FAA took no action.

Miller filed a follow-up report with his superiors, complaining that authorities didn't seem to be taking him seriously:

"I have been told by my company . . . that the FAA and Boeing (were) aware of the problems with the spurious rudder inputs but considered them to be more of a nuisance problem than a flight safety issue. I was informed, that so far as everyone was concerned, the rudder hardovers were a problem but that the `industry' felt the losses would be in the acceptable range.