You may be trying to access this site from a secured browser on the server. Please enable scripts and reload this page.
Turn on more accessible mode
Turn off more accessible mode
Skip Ribbon Commands
Skip to main content
Top Link Bar
NEWS & EVENTS
Speeches & Testimony
Most Wanted List
The Investigative Process
Data & Stats
General Aviation Safety
Administrative Law Judges
Strategic Plans & Reports
Safety Recommendation Details
The Investigative Process
Data & Stats
General Aviation Safety
On March 3, 1991, at 0944 mountain standard time, United Airlines flight 585, a Boeing 737-291 airplane, crashed during an approach to the Colorado Springs, Colorado, airport. The crew of 5 and the 20 passengers were killed. The airplane was destroyed by the impact and a postcrash fire. The weather was clear with unlimited visibility. There were windshear reports during the day. At the time of the accident the surface winds were reported to be out of the northwest at 20 knots gusting to 28. The safety board has not determined the cause(s) of the accident and an investigation of airframe, operational and weather factors is continuing.
TO THE FEDERAL AVIATION ADMINISTRATION: Require the Boeing Commercial Airplane Group to establish appropriate inspection intervals and a service life-limit for the B-737 rudder power control unit. (Superseded by A-99-20 through A-99-29)
Original recommendation transmittal letter:
Closed - Unacceptable Action/Superseded
COLORADO SPGS, CO, United States
Uncontrolled Descent and Collision with Terrain, United Airlines Flight 585, Boeing 737-200, N999UA, 4 Miles South of Colorado Springs Municipal Airport
Addressee(s) and Addressee Status:
FAA (Closed - Unacceptable Action/Superseded)
Safety Recommendation History
Because of the complexity of the 737 rudder system (and the potential for unforeseen failure mechanisms), its lack of redundancy in the event of a single-point failure or a latent failure, and the continued absence of cues to help alert flight crews to latent failures, the Safety Board concludes that a reliably redundant rudder actuation system is needed for the 737, despite the significant improvements that have been made in the system's design. Accordingly, the Safety Board believes that the FAA should require that all existing and future 737's have a reliably redundant rudder actuation system. This redundancy could be achieved by developing a multiple-panel rudder surface or providing multiple actuators for a single-panel rudder surface. Further, A-96-107, -109, -112, and -113 are classified CLOSED--UNACCEPTABLE ACTION/SUPERSEDED. A-96-112 is superseded by A-99-20 through A-99-29.
THE ISSUES ADDRESSED IN A-96-107, -108, -109, -112, -113, AND -118 AND A-97-18 WILL BE FURTHER ANALYZED AND DISCUSSED IN OUR FINAL REPORT ON THE USAIR FLIGHT 427 ACCIDENT INVESTIGATION, WHICH THE BOARD WILL CONSIDER IN MARCH 1999. THE FAA'S RESPONSES TO THESE RECOMMENDATIONS WILL BE INCORPORATED IN THE BOARD'S ANALYSIS OF THESE ISSUES. THEREFORE, THESE RECOMMENDATIONS REMAIN AS CURRENTLY CLASSIFIED, PENDING ISSUANCE OF OUR FINAL REPORT.
Letter Mail Controlled 5/18/98 3:54:43 PM MC# 980640: The Federal Aviation Administration (FAA), in concert with the Boeing Aircraft Company, has taken several measures to address the intent of these safety recommendations, including the development and certification of modifications of the Boeing 737 main rudder power control unit (PCU) servo valve to prevent the potential for reverse rudder operation. Over the past 3 years, the FAA has taken the following actions to address these safety recommendations: * On December 23, 1996, the FAA issued Airworthiness Directive (AD) 96-26-07 to mandate changes to the Airplane Flight Manual to enable the flightcrew to take appropriate action to maintain control of the airplane during an uncommanded yaw or roll condition. * On June 23, 1997, the FAA issued AD 97-14-03 to mandate design changes to add a rudder limiting device that reduces the rudder authority at flight conditions where full rudder authority is not required and a redesigned, more reliable yaw damper system. The rudder limiter allows the flightcrew to use lateral control to counter any rudder position (commanded or uncommanded). * On June 23, 1997, the FAA issued AD 97-14-04 to mandate design changes to the Boeing 737 main rudder PCU to eliminate all known single servo valve failures, which could cause uncommanded rudder movement. In addition, AD 97-14-04 mandates a periodic inspection to test the main rudder PCU for internal leakage and to ensure that the rudder PCU is producing an acceptable hinge moment. The internal leakage test will detect certain servo valve slide jams. The internal leakage test provides greater safety margins than a hard-time replacement of the main rudder PCU because it ensures the PCU is functioning within acceptable limits at more frequent intervals than a hard-time interval. Any design change to monitor the servo valve slides would increase the complexity of the servo valve and most likely increase the probability of jamming of a slide. At a recent meeting, the Board's staff expressed concern about a rudder reversal resulting from a jammed secondary slide in the main PCU. The Board's staff acknowledged that the redesigned PCU valve eliminated all known rudder reversal modes, but they still expressed concern that there might be unknown failures still in the system. There is no evidence, either from in-service experience or testing, which indicates that this rudder reversal event has actually occurred. The testing conducted as part of the USAir Flight 427 investigation included tests on the main rudder PCU for chip shear, contamination, thermal jam conditions, input linkage jams, and linkage compliance. All testing failed to create a sustained servo valve jam or any other reasonable failure that could cause erroneous rudder movement. In fact, the condition was produced only after Boeing inserted a specially designed tool in the PCU to keep the secondary slide from moving. The FAA believes that the Boeing PCU redesign adequately deals with rudder reversal possibilities. At the meeting, the Board's staff amplified why they thought the detection and indication of a slide jam was necessary. The Board's staff is concerned that with a single slide jam not recognizable by the crew or mechanics, a second slide jam would cause an accident in some airplane configurations and flight conditions. The Board's staff considered this to be a catastrophic condition resulting from a single recognizable failure and not in compliance with FAA regulations. If the initial slide jam is detectable, the Board's staff believes full compliance with the regulations is assured. The Board's staff has misunderstood the FAA regulations with respect to catastrophic failure conditions. A catastrophic failure is one that will always result in an accident. In the case of a dual slide jam in the rudder PCU, this condition will not always result in an accident. The airplane is fully controllable in that configuration throughout much of its flight envelope. Thus, it is not a catastrophic event as defined by FAA regulations and policy. Not being catastrophic, the regulations do not require that the dual slide jam be extremely improbable. Neverless, with the service history and the number of hours of operation on the B-737, the FAA believes a dual slide valve jam has been shown to be extremely improbable and in compliance with the regulations. I have enclosed copies of AD's 96-26-07, 97-14-03, and 97-14-04 for the Board's information. I believe that the FAA has met the full intent of these safety recommendations, and I plan no further action.
THE BOARD IS AWARE THE BOEING & THE FAA ARE IN THE PROCESS OF DEVELOPING & CERTIFYING SEVERAL MODIFICATIONS TO THE B-737 MAIN RUDDER PCU SERVO VALVE THAT WILL PREVENT THE POTENTIAL FOR REVERSE RUDDER OPERATION, INCLUDING A RUDDER DEFLECTION LIMITING SYSTEM. HOWEVER, THE FAA RESPONSE DOES NOT ADDRESS THE DEVELOPMENT OF OPERATIONAL MEASURES & DESIGN CHANGES TO PRECLUDE THE LOSS OF CONTROL FROM AN INADVERTENT RUDDER HARDOVER, THE NEED TO ESTABLISH APPROPRIATE INSPECTION INTERVAL & A SERVICE LIFE FOR THE B-737 MAIN RUDDER PCU, OR METHOD TO DETECT A JAMMED PCU SERVO VALVE SLIDE. THE BOARD BELIEVES THAT DESPITE THE IMPROVEMENTS BEING PROPOSED, OPERATIONAL MEASURES, PERIODIC INSPECTIONS, & THE DETECTION & ANNUNICATION OF A JAMMED SLIDE TO THE FLIGHTCREW ARE NEEDED TO ENSURE FLIGHT SAFETY. THE BOARD IS ENCOURAGED BY THE FAA'S PLANNED ACTIONS, BUT REMAINS CONCERNED THAT THE PROPOSED NEW DESIGN MAY NOT ADDRESS IDENTIFIED RELIABILITY OR LATENT FAILURE ISSUES. PENDING FURTHER CORRESPONDENCE, RECOMMENDATIONS A-96-107, -112, & 113 ARE CLASSIFIED "OPEN--UNACCEPTABLE RESPONSE."
THESE RECOMMENDATIONS DEAL WITH MANDATING POTENTIAL LONG-TERM DESIGN SOLUTIONS FOR BOEING 737 SERIES AIRPLANES. THE FAA HAS DEVELOPED AN APPROACH TO ADDRESS THE INTENT OF THESE RECOMMENDATIONS. THE APPROACH INCLUDES TAKING FINAL ACTION ON THE PROPOSED AIRWORTHINESS DIRECTIVE (AD) ISSUED IN AUGUST 1996 ON THE BOEING 737, AS WELL AS OTHER PROPOSED AD'S THAT WERE ANNOUNCED ON 1/15/97. THE MOST RECENT AD'S WILL REQUIRE THE RETROFIT OF FOUR NEWLY DEVELOPED OR REDESIGNED COMPONENTS INTO THE RUDDER SYTEM OF EXISTING BOEING 737 AIRPLANES. THE FAA WILL PROPOSE A 2-YEAR COMPLIANCE TIME FOR RETROFIT OF THE NEW PCU SLIDE VALVES. THE SAFETY ISSUES ADDRESSED IN THESE RECOMMENDATIONS WILL BE RESOLVED DURING THE TYPE CERTIFICATION OF THE NEW RUDDER POWER CONTROL UNIT (PCU) SLIDE VALVES. I WILL KEEP THE BOARD INFORMED OF THE FAA PROGRESS ON OUR AD'S.
Strategic Plan, Performance & Accountability Reports & More
Directions to Conference Center
Web Policies & Notices
Annual Review of Aircraft