A debate over safety surrounds Boeing's 737. Today, the road to one federal agency's decision to recommend changes in the plane.
 

	JIMI LOTT / THE SEATTLE TIMES
	Tom Haueter, investigator in charge of the Pittsburgh crash probe, reads aloud the NTSB's recommended changes to the 737. He is seen on a meeting-room monitor at the session two weeks ago.

A fire drill disrupted the start of the Oct. 16 meeting of the National Transportation Safety Board, delaying for a few more minutes something Boeing had been trying for years to fend off: a call for safety improvements to its biggest-selling airplane, the 737.

Among those who filed into the safety board's auditorium that Wednesday morning in Washington, D.C., were people who for years had studied the 737 with interests ranging from coolly professional to personally obsessive.

Gail Dunham came with notepad and pen in hand, ready to add to the boxes of material she had amassed in the 512 years since her ex-husband, Capt. Harold Green, died along with 24 others in the sudden plunge of a United Airlines 737 in Colorado Springs.

Greg Phillips, the NTSB's aircraft systems expert, took his place behind a microphone at the witness table. It had been Phillips who was assigned to figure out if a malfunctioning rudder caused the March 1991 crash in Colorado Springs.
 

How a 737 rudder could move on its own View graphic

He drew the same assignment after a USAir 737 nose-dived outside Pittsburgh in September 1994, killing all 132 people on board.

Phillips and other NTSB investigators hadn't found conclusive evidence that rudder malfunctions caused either crash. But they had amassed extensive evidence of potential 737 rudder-control problems, and they had prepared a list of recommendations they believed would make 737s safer.

Also in attendance was Tom McSweeny, director of aircraft certification for the Federal Aviation Administration. McSweeny would be the one responsible for fielding the NTSB recommendations and deciding whether or when to make them mandatory.

Filling out the room were representatives of the Air Line Pilots Association and USAir. They were joined by reporters from network TV and the big East Coast daily newspapers, drawn to the story after the dramatic Pittsburgh crash two years earlier.

One person was conspicuous by his absence: John Purvis, Boeing's director of air-safety investigations. Purvis, accompanied by other Boeing representatives, normally attended any safety board action that concerned the 737. Boeing sent just one person to the Oct. 16 meeting: Tim Neale, a newly hired public-relations employee, and authorized him to issue only a formal "no comment" from the company.
 

		HARDOVER The swift and forceful movement of an airplane's rudder as far as it can go to one side. YAW DAMPER A device that automatically smooths the ride by commanding small rudder adjustments during flight. POWER-CONTROL UNIT (PCU) An assembly of hydraulic valves and mechanical linkages that translates a command from the pilot's foot pedal or the yaw damper into movement of the rudder. DUAL SERVO VALVE A mechanism in the power-control unit containing two slides that direct the flow of hydraulic fluid used to move the rudder. AILERONS Panels at the outer, rear part of the wing which deflect to control the rolling movement of an airplane.

Boeing's 737 is an extraordinarily popular jet. More than 2,700 737s are in service around the world, and tens of thousands of airline passengers fly on them every day. The 737 is the backbone of fleets at United, Southwest, America West, Delta, Continental, USAir and many foreign carriers.

Whenever you travel by air, especially on shorter flights such as Seattle to San Francisco, the odds are great that you will be flying on a 737. The airplane long has enjoyed a reputation for safety, and statistically its safety record is better than average.

The 1991 crash in Colorado Springs first raised the possibility that the 737's rudder — the vertical part of the tail which controls the plane's movement left and right — could suddenly swing to one side, uncommanded by the pilot, and snap the jet into a sudden roll.

Such a rudder swing, called a "hardover" by engineers, could quickly throw a 737 into a nose dive. At low speed and low altitude, pilots might have only a few moments to recognize what was happening and make the proper recovery maneuvers.

United Flight 585 was about to land when it suddenly flipped into a dive and crashed near Colorado Springs in 1991. USAir Flight 427 was on approach to landing when it crashed just outside Pittsburgh 312 years later. In between, a dozen other 737s crashed around the world, including two others in which errant rudder movements were suspected.

Because of eyewitness descriptions of how the United jet suddenly flipped into a dive, NTSB investigators immediately suspected an errant rudder movement had caused the crash.

But proving there was a problem with the jet's rudder controls was difficult because of the transitory way the rudder works and the small size of its controlling mechanism. Because a jet's rudder is continually moving in small ways and returning to position, it is almost impossible for investigators to duplicate a single movement, much less prove conclusively that an errant movement caused a crash.

USAir crash renewed focus

The Colorado Springs investigation ended without the cause of the crash being determined. Then came the USAir crash.
 

JIMI LOTT / THE SEATTLE TIMES
Moments after the NTSB's recommended 737 changes were announced, Tom McSweeny, director of aircraft certification for the Federal Aviation Administration, meets a news-media crowd at the Washington, D.C., session.

This time the focus on possible rudder problems became more intense. Investigators began discovering multiple ways the 737's rudder controls could produce uncommanded hardovers. They still couldn't determine conclusively that a rudder-control problem caused the Pittsburgh crash. But they began formulating recommendations, including possible redesign of the rudder controls, to lessen the chance of future 737 crashes.

Boeing officials argued that their jet was safe and opposed any redesign of the rudder controls.

But by Oct. 16 this year, the safety board was ready to vote.

New tests had bolstered earlier evidence that the 737 rudder could swing hard over, uncommanded by a pilot.

A test Boeing hoped would point Pittsburgh investigators away from rudder concerns had backfired.

And a 737 nearly crashed in Virginia in an unsettlingly familiar way.
 

		Tom McSweeny is the FAA official responsible for deciding whether or when to make the NTSB's 14 recommendations mandatory.

Tests show advice was wrong

Boeing and the rudder-control system's manufacturer, Parker Bertea, had conducted many of the investigative tests after the Colorado and Pittsburgh crashes. While conducting the rudder-system test, Boeing engineers had offered other theories to explain the crashes.

In Colorado Springs, Boeing argued that a freak wind rotor, similar to a sideways-swirling tornado, had bounced off the nearby Rocky Mountains and hit the United jet, tossing it into the ground.

In Pittsburgh, Boeing said it believed one of the USAir pilots had overreacted when their airplane was jostled by turbulence swirling off the wingtips of a Delta 727 flying about four miles ahead. The pilots could have inadvertently slammed the rudder hard over in a mistaken attempt to compensate for the turbulence, Boeing suggested.

To prove its theory, Boeing persuaded the NTSB to conduct a series of flight tests: A 737 would position itself behind a 727, as the USAir 737 had been when approaching Pittsburgh, to show how the turbulence could shove the 737 into what Boeing called a "sustained yaw" that might cause it to crash. (A yaw is a swing to the left or right.)

The tests were conducted one year after the Pittsburgh crash. Ironically, they not only failed to support Boeing's theory, they proved something else entirely. They showed that Boeing's long-held assumptions about how to safely handle an uncommanded rudder hardover at lower speeds were wrong.
 

BENJAMIN BENSCHNEIDER / THE SEATTLE TIMES
NTSB Chairman Jim Hall, second from left, at the microphone, announces the appointment in February 1996 of a special panel to review investigative work on the Colorado Springs and Pittsburgh crashes of 737s. Behind him at the Museum of Flight in Seattle are, from left, NTSB investigators Greg Phillips and Tom Haueter, and Bernard Loeb, the NTSB's aviation safety chief.

The tests revealed that if a rogue signal swung the rudder to one side, with a 737 flying at 190 knots (218 mph) or less, it was NOT possible to stabilize the aircraft by simply turning the control wheel in the opposite direction.

Turning the wheel deploys wing panels, called ailerons, to roll the plane back to a level position. But the tests showed the ailerons' ability to counter a rudder hardover actually diminished quite rapidly as the plane slowed down — and vanished at a "crossover" speed of about 190 knots, the USAir jet's speed when it flipped over.

For all the nearly 30 years it had been making 737s, Boeing had advised pilots and aviation authorities that rudder hardovers could be easily corrected at speeds as slow as 160 knots (184 mph) if the pilot would simply turn the control wheel in the opposite direction.

That incorrect assumption had also been programmed into flight simulators used to train 737 pilots.

Boeing, in fact, had invited representatives from USAir, the NTSB and the FAA to fly its simulator a few months after the Pittsburgh crash. Flying as slow as 160 knots, even nonpilots such as Jim Hall, the safety board's chairman, and Bernard Loeb, its aviation safety chief, were able to recover easily from a rudder hardover.

At the time, their flight-simulator experience seemed to support Boeing's assertion that the USAir pilots should have been able to handle whatever rudder movement occurred as their 737 approached Pittsburgh. The later flight test concluded otherwise.

The hydraulic-fluid issue

In the months before the safety board convened Oct. 16, airlines continued reporting incidents of rudders moving inadvertently on 737 flights. The incidents occurred, on average, about once every 10 days.
 

	JIMI LOTT / THE SEATTLE TIMES
	While debate continues over the 737 and proposed changes, 500 of them take off every hour, worldwide.

Two of the incidents involved uncommanded rudder movements on an America West 737 already equipped with an upgraded rudder power-control unit. The FAA had ordered airlines to install these new parts by March 1999, after problems were discovered with the unit in the course of the Colorado Springs investigation.

The FAA order was believed at the time to be the definitive way to eliminate rudder problems. Instead, the America West incidents suggested the upgrade might only reduce the chances of a specific failure, a reverse movement of the rudder. By then, federal investigators and others were discovering other ways a 737's rudder could move on its own.

The safety board had become concerned that contaminants in the hydraulic fluid of the control systems could cause momentary valve jams, which could produce uncommanded rudder movements. As a result, it ordered a random sampling of hydraulic fluid in 737s.

The survey indicated that more than 20 percent of the 737 fleet of 2,700 jets might be flying with hydraulic fluid 16 times dirtier than the industry standard for passenger jets.

The Society of Automotive Engineers, an organization which establishes hydraulic-fluid cleanliness standards for auto, factory, aircraft, weapons and space systems, took note of the findings. It began discussions about requiring aircraft manufacturers to use state-of-the-art filters capable of keeping fluid vastly cleaner than existing 737 filters can.

Factories, farm machinery, even flight simulators use modern, high-efficiency hydraulic filters, but the 737, like most large passenger jets, continues to use a class of filters designed 30 years ago, said Leonard Bensch, vice president of Pall Corp. and a member of an SAE task force reviewing aviation standards. "We do know for a fact that (contaminants) can cause troubles," Bensch said. "If you can reduce the amount of (contaminants) and cause less trouble, then why not do it?"

By the end of 1995, USAir had become concerned enough about the potential for rudder hardovers that it began requiring its pilots to fly 737s slightly faster as they descend toward landing. This keeps more air flowing over the ailerons, giving them more power to offset rudder hardovers.

With USAir taking action on its own, the FAA last January convened a closed meeting of more than 50 representatives of airlines operating large fleets of 737s. Among those attending the meeting at FAA headquarters in Washington, D.C., were Hall, the NTSB chairman, and Phillips, his rudder investigator. Boeing sent a group led by Jean McGrew, then its 737 chief project engineer; Mike Carriker, a 737 test pilot; and Charlie Higgins, vice president for airplane safety and performance.

The Air Line Pilots Association requested that other airlines follow USAir's lead and fly 737s faster on descent. The group also called for flight crews to be trained to quickly recognize and recover from rudder hardovers. Boeing did not oppose those suggestions. The pilots and airline representatives also discussed the possibility of installing a mechanism to limit rudder movement during flight.

Neither the FAA nor NTSB took any action as a result of the meeting, though some airlines voluntarily began following the pilot group's advice.

A pilot's desperate fight

Months later, on a calm night early this June, Capt. Brian Bishop fought off two hard, inadvertent rudder swings, narrowly avoiding a crash as he prepared to land his Eastwind Airlines 737-200 at Richmond, Va.

Boeing found the yaw damper — an automatic rudder-adjusting device — had been misrigged, and theorized that it had surprised Bishop by deflecting the rudder slightly farther to the right than it should have.

To test this theory, Boeing test pilot Michael Hewett accompanied Bishop on a flight on the same Eastwind jet. Boeing rigged the cockpit so a technician could make the yaw-damper order a series of right deflections.

Bishop, however, easily kept the plane under control by depressing his left rudder pedal.

Hewett suggested that Bishop probably overreacted to a similar rogue yaw-damper signal the night of the incident. But Bishop insisted a much stronger force had nearly twisted his jet into a fatal dive, and he noted that his rudder pedal had locked up, also.

"This wasn't anything like that night," Bishop recalled. "I was trying to tell (Hewett) the rudder didn't feel this way. It didn't have any effect at all that night.

"But he (Hewett) says, 'It was dark and you weren't expecting anything.' Well, true, but either way this was about a tenth of what I felt. In my opinion, what I felt that night was ten times as severe as any yaw-damper input."

Friction between FAA, NTSB

The Eastwind incident agitated NTSB Chairman Hall and exposed the sometimes edgy relationship between the safety board, which can only recommend safety measures, and the FAA, which can order improvements but often is slow to do so — in part because one of its missions is to promote the U.S. airline industry.

Sixteen months earlier, the safety board had recommended that the FAA order the installation of state-of-the-art flight-data recorders on all 737s by the end of 1995. It wasn't the first time the NTSB had made the recommendation. Several times over the prior decades the FAA had ignored similar recommendations.

Flight-data recorders on most U.S.-registered 737s track the aircraft's speed and general direction of flight. Newer recorders can also track the position of the rudder or other wing and tail panels, information the NTSB feels would help it better understand possible rudder problems and what happens before an airplane crashes.

While sophisticated recorders are widely used by many European and Asian carriers, U.S. airlines have resisted making the upgrade.

As investigators tried futilely to solve the Eastwind incident, Hall lambasted FAA Administrator David Hinson for failing to heed the board's latest flight-recorder recommendation.

"Under slightly different circumstances, the Eastwind incident could have become the third fatal B-737 upset accident for which there was inadequate flight-data recorder information to determine the cause," Hall wrote to Hinson.

Ten days later, the FAA proposed a rule to require airlines to upgrade flight-data recorders over four years. Hall responded that he was disappointed the FAA did not have a "greater sense of urgency regarding the importance of these recorders in investigating aviation incidents and accidents."

Hot-cold tests jam PCU

Jim Hall's frustration over the Eastwind incident surfaced not long after he had taken an unprecedented step: forming a panel of independent experts to review all investigative work from both the Colorado Springs and Pittsburgh accidents.

Through the summer of 1996, the panel helped design a new round of tests focusing on how dirty hydraulic fluid might cause errant rudder movements. One of its tests revealed yet another set of conditions under which a rudder-control system could malfunction.

In late August, in a lab in Valencia, Calif., a power-control unit containing the Pittsburgh jet's servo valve was set up to record simulated rudder movements on a computer. The tests were overseen by representatives of Boeing and Parker Bertea, among others.

Each night during the three-day run of tests, Phillips removed the PCU from the test rig and took it to his hotel room.

In the tests, the PCU was operated with dirty fluid over a range of temperatures designed to mimic various conditions during flight. Some investigators theorized that a PCU could remain very cold as it descended from 30,000 feet. Hydraulic fluid, constantly pumped at high pressure throughout the airplane, is hot. If very hot hydraulic fluid was suddenly channeled into a cold PCU, its valve parts might expand at different rates and stick.

On the final day, hot, dirty fluid was injected into the servo valve, which had been chilled to minus-40 degrees Fahrenheit, the lowest temperature at which the PCU must operate during certification testing.

The external rod pushing and pulling on the PCU servo valve hesitated, then stuck. Some investigators believed this was because the valve's internal slides had expanded and jammed. But Boeing asserted that imprecise chilling had probably caused the PCU's external linkages to freeze, or the hydraulic fluid to coagulate. Phillips agreed to let the company repeat the test with its own equipment in Seattle.
 

The NTSB's proposals for the 737 1. Change the design of the Boeing 737 to prevent loss of control from uncommanded rudder hardovers. 2. Condition FAA certification of flight controls on their ability to withstand jamming or other failures that could lead to uncommanded hardovers. 3. Install on new 737s a cockpit indicator to track rudder position and movement. Install cockpit indicator on existing 737s when installing upgraded flight data recorder. 4. Redesign the 737 yaw damper to eliminate the potential for erroneous commands. Install improved yaw dampers on all 737s. 5. Change maintenance manuals to ensure the correct setting of a 737 yaw-damper mechanism that governs the yaw damper's range of movement. 6. Set a service life limit and inspection intervals for the 737 rudder power-control unit. 7. Create a procedure for mechanics and pilots to recognize when parts in the rudder's dual servo valve have been sticking. 8. Modify aircraft power-control units to better flush out hydraulic fluid contaminants. 9. Modify the 737's standby rudder power-control unit by Aug. 1, 1997, to prevent binding of an external part that can result in the rudder moving when it shouldn't. 10. Set standards and sampling intervals for hydraulic fluid cleanliness. 11. Review dual servo valves in aircraft flight controls to determine if their design makes them susceptible to uncommanded hardovers. Mandate design changes. 12. Require 737 pilots to learn to disengage yaw damper as a first step in the event of a sudden and swift uncommanded movement of the rudder. 13. Train 737 pilots how to counter uncommanded rudder hardovers in all phases of flight. 14. Train airline pilots how to recognize and recover from any control malfunctions that disrupt flights.

On Oct. 11, Boeing conducted the same test at its Systems Integration Lab in Seattle and the PCU rod again hesitated and stuck. This time, Boeing argued that the PCU would never get that cold in actual service.

NTSB airs its proposals

But Boeing's retesting and objections already were lagging behind a new push the NTSB staff had begun weeks before. Shortly after the independent test was completed, Tom Haueter, chief investigator in the Pittsburgh crash, revived a series of 737 safety recommendations that Phillips had begun formulating a year and a half earlier. At an Oct. 1 meeting, Phillips unveiled his recommendations for public discussion by the five-member safety board.

Among other things, the recommendations called for:

Redesigning the airplane to preclude the possibility of an uncommanded hardover causing a crash.

Establishing standards for the cleanliness of hydraulic fluid, with periodic sampling to make sure the fluid is clean.

Installing cockpit indicators to tell pilots the position of the rudder.

Requiring special training for 737 pilots to prepare them in case of uncommanded rudder hardovers during flight.

Creating a procedure for 737 mechanics and pilots to recognize when parts in the rudder's dual servo valve have begun sticking.

"It is no secret that we have yet to identify a probable cause for either the Colorado Springs or (Pittsburgh) accidents," Hall said as he opened the discussion. "That, of course, is troublesome to the staff and to the board."

After a three-hour review, Hall scheduled a vote on the recommendations for the board meeting two weeks later.

On the morning of Oct. 16, the NTSB went about its business with little discussion. In no more time than it took for those assembled to file out of the building for the fire drill and return, board members unanimously approved Phillips' recommendations and sent them on to the FAA. Said Hall: "The recommendations speak for themselves."

For Gail Dunham, whose former husband died at the controls of the United jet in Colorado Springs, the NTSB action was reason to rejoice.

"Finally, I think these are major, major recommendations that are long overdue," she said. "If (Flight) 585 had been properly investigated, if we had had a hearing after Colorado Springs, perhaps these recommendations would have come forth much sooner."

With the NTSB's approval of the recommendations, the focus shifts to the Federal Aviation Administration, an agency governed by two potentially competing missions: to protect the flying public's safety and to promote the U.S. aviation industry.

The rise of competition from the European aircraft consortium Airbus Industrie has made the FAA increasingly concerned with its responsibility to promote U.S. interests, notably Boeing's.

In addition, the agency has shown reluctance to issue safety mandates that would impose high costs on U.S. airlines or airplane manufacturers, or which might damage the reputation of U.S.-made airplanes.

In considering rules for airplane makers and airlines, the FAA takes proposals through many rounds of comment and revision, usually with heavy involvement by the airlines and manufacturers themselves, before the agency acts — if it does act.

For instance, the FAA has spent 30 years pondering rules for flame-proofing airplanes. It has deliberated over requirements for improved flight-data recorders for 40 years, as some planes continue to operate with data recorders based on technology from the 1960s. It delayed requiring upgrades of cargo doors, jet-engine fuse pins and thrust reversers until long after they were recognized as significant problems.

In the end, according to safety board data, the FAA accepts NTSB air-safety recommendations about 80 percent of the time; when it doesn't, the reason usually is cost.

"We're not promiscuous in our introduction of new rules and regulations," Hinson said in an interview last year. "While they all sound great in the name of safety, they make it so damned expensive you can't fly. Clearly it is that tension that is one that requires a lot of attention."

Next move is up to FAA

Hinson's philosophy was evident when Tom McSweeny, the FAA official responsible for deciding whether or when to make the NTSB recommendations mandatory, met with reporters shortly after the safety board's vote on Oct. 16. McSweeny noted that the safety board's proposals were "within the scope of things we're looking at right now."

But too much tinkering with the airplane could be counterproductive, he warned. Experts needed to make sure any rudder changes his agency might order wouldn't cause other kinds of accidents.

Even so, U.S. Rep. Peter DeFazio, an Oregon Democrat and longtime FAA critic, said he expects the FAA will act quickly on the safety board's 737 recommendations.

"The FAA's normal reaction, when confronted with anything that costs the manufacturers or airlines money . . . has been to drag their feet as long as they can and then to implement them minimally," said DeFazio, a member of the House aviation subcommittee who favors less emphasis on the agency's mandate to promote the industry.

"I would expect this time they will act a little more aggressively and hopefully not brush off the NTSB as readily as they have in the past," he said.

Boeing so far has said nothing publicly about the NTSB recommendations. In the hall outside the safety board's meeting room, Tim Neale, Boeing's newly hired spokesman and only representative at the meeting, told reporters the company would have no comment until after the FAA acts.