Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-96-117
Details
Synopsis: On March 3, 1991, at 0944 mountain standard time, United Airlines flight 585, a Boeing 737-291 airplane, crashed during an approach to the Colorado Springs, Colorado, airport. The crew of 5 and the 20 passengers were killed. The airplane was destroyed by the impact and a postcrash fire. The weather was clear with unlimited visibility. There were windshear reports during the day. At the time of the accident the surface winds were reported to be out of the northwest at 20 knots gusting to 28. The safety board has not determined the cause(s) of the accident and an investigation of airframe, operational and weather factors is continuing.
Recommendation: TO THE FEDERAL AVIATION ADMINISTRATION: Conduct a detailed design review of all dual concentric servo valves that control essential flight control system acuators on transport-category airplanes certificated by the FAA to determine if the design is susceptible to inducing flight control malfunctions and/or reversal as a result of unexpected improper positioning of the servo slides. If the design is determined to be susceptible, mandate appropriate design changes.
Original recommendation transmittal letter: PDF
Overall Status: Closed - Unacceptable Action
Mode: Aviation
Location: COLORADO SPGS, CO, United States
Is Reiterated: No
Is Hazmat: No
Is NPRM: No
Accident #: DCA91MA023
Accident Reports: Uncontrolled Descent and Collision with Terrain, United Airlines Flight 585, Boeing 737-200, N999UA, 4 Miles South of Colorado Springs Municipal Airport
Report #: AAR-92-06
Accident Date: 3/3/1991
Issue Date: 10/18/1996
Date Closed: 8/16/2001
Addressee(s) and Addressee Status: FAA (Closed - Unacceptable Action)
Keyword(s):

Safety Recommendation History
From: NTSB
To: FAA
Date: 8/16/2001
Response: In response to the Safety Board's first concern, the FAA's March 20, 2001, letter stated that the anomalous valve behavior inherent in the Boeing 737 and 747 airplanes was caused by specific design details and, in some cases, design errors, such as errors in tolerance specifications and valve slide compliance. The FAA stated that it did not find the design issues on the Boeing 737 and 747 airplanes on the other airplane designs, and therefore, believed it was not appropriate to use the service failure rate data of one airplane model to try to infer the failure rate data of another. The FAA further stated that it was not certain that all of the power control unit (PCU) problems cited were caused by a dual concentric control valve malfunction or jam. The FAA noted that for each case cited, the PCU functioned acceptably in laboratory tests and airplane tests when airplane resources were available. The FAA stated that the data presented in the Safety Board meeting pertaining to the Boeing 737 Metrojet investigation indicated that the cause was not a dual concentric control valve malfunction. The FAA also stated its belief that the "numerous maintenance reports" discussed in the USAir 427 accident report all involved inadequately controlled processes or incorrect PCU assembly. The FAA noted that only one of these cases resulted in in?flight uncommanded motion, which was safely controlled. Finally, the FAA stated its belief that the high number of flight hours accumulated on Boeing 707, 727, 737, and 747 airplanes provided further evidence that dual concentric control valve anomalies and jams, coupled with critical flight conditions, are extremely improbable. In response to the Safety Board's second concern about the amount of rudder displacement considered when evaluating the consequences of a jam, the FAA stated that it continues to believe that a jam of the secondary slide at full displacement is the most critical condition for all the rudder PCUs that were evaluated (other than the Boeing 737 PCU). The FAA also stated that the probability of a secondary valve jam off-neutral at lesser displacements is on the order of 10-8 and, coupled with a critical flight condition, is considered by the FAA to be extremely improbable. The Safety Board is concerned that the jamming of one of the valves on the Boeing 737 main rudder PCU has the potential for catastrophic consequences, and the Board does not agree with the FAA that such an event is extremely improbable. The history of the dual concentric servo valve on the Boeing 737 main rudder PCU supports this conclusion. This history includes the United Airlines flight 585 and USAir flight 427 accidents, the Eastwind flight 517 and Metrojet flight 2710 incidents, the February 19, 1999, discovery of an improperly assembled servo valve on a United 737 in Seattle, and numerous other reports of uncommanded rudder behavior. The numerous potential failure modes discovered by the FAA's ETEB team resulted in a redesign of the 737 series rudder system. In addition to the facts cited above, the Safety Board has found no evidence to suggest that what the FAA believes are "tolerance specifications" and "inadequately controlled process or incorrect PCU assembly" errors do not exist in the PCUs of other aircraft. Without a detailed analysis similar to that conducted by the ETEB, the Safety Board cannot be assured that other dual concentric servo valve designs will not fail. In addition, the Safety Board does not understand the FAA's belief that a jam of a secondary valve at full displacement is the most critical condition. Numerous tests conducted by the Board as part of the USAir flight 427 investigation, as well as tests conducted by the ETEB, demonstrated that movement of the primary valve could nullify a jam of the secondary valve at full displacement. However, a jam of the secondary valve at less than full displacement would result in a rudder reversal. Clearly, a flight crew would have more control over an airplane's neutral rudder and would be more likely to react in a correct and timely manner than if they had to recognize that they needed to react to a rudder reversal. Given that the FAA states it has completed its analysis and plans no further action, Safety Recommendation A-96-117 is classified "Closed--Unacceptable Action."

From: FAA
To: NTSB
Date: 3/20/2001
Response: Letter Mail Controlled 03/26/2001 8:50:41 PM MC# 2010264: The Board raised two concerns in its letter dated August 16, 2000. First, the Board questioned the validity of the FAA's conclusion that anomalous dual concentric control valve behavior is extremely improbable in light of the accidents involving USAir flight 427 and United Airlines flight 585, the incidents involving Eastwind flight 517 and Metrojet flight 2710, the British Airways 747 elevator reversal incident, and the numerous maintenance reports concerning jammed or malfunctioning control valves. Secondly, the Board questioned the validity of the FAA's assertion that anomalous valve behavior of dual concentric control valves requires the secondary slide to be fully displaced in light of the Board's and the Engineering Test and Evaluation Board's tests showing that reversal may occur with the secondary slide jams at displacements less than full travel. The Boeing 737 rudder control system is currently undergoing a complete redesign. The FAA's plans to address the Boeing 737 rudder control system are discussed in its response to Safety Recommendation A-99-20. The Boeing 737 elevator and aileron control system architectures permit continued safe flight and landing after any dual concentric control valve anomaly or jam. The DC-10 spoiler boost power control unit (PCU) is controllable after a single slide jam. Therefore, these airplanes are considered to have satisfactory control system designs. Additionally, the analyses show that each PCU remains controllable after a primary slide jam for all dual concentric control valves that were evaluated. Therefore, primary jams are not considered to be an unsafe condition. In response to the Board's first concern, the root cause of anomalous valve behavior inherent in the Boeing 737 and 747 airplanes were specific design details and, in some cases, design errors such as tolerance specifications and valve slide compliance. The design issues found on the Boeing 737 and 747 airplanes were not found on the other airplane designs. Consequently, it is not appropriate to use the service failure rate data of one airplane model to try to infer the failure rate data of another. Each airplane model dual concentric control valve has its own design characteristics and service history. The respective data were used to evaluate each airplane/PCU for a potential unsafe condition. Furthermore, it is not certain that all of the PCU problems cited were caused by a dual concentric control valve malfunction or jam. For each case cited, the PCU functioned acceptably in laboratory tests and also airplane tests when airplane resources were available. The data presented in the last Board meeting regarding the Boeing 737 Metrojet investigation indicated that the cause was not a dual concentric control valve malfunction. The "numerous maintenance reports" discussed in the USAir 427 accident report all involved inadequately controlled processes or incorrect PCU assembly. Only one of these cases resulted in in-flight uncommanded motion, which was safely controlled. This fact, along with the high number of flight hours accumulated on Boeing 707, 727, 737, and 747 airplanes, provides further evidence that dual concentric control valve anomalies and jams, coupled with critical flight conditions, are extremely improbable. The FAA finds that a Boeing 707, 727, or 747 dual concentric control valve anomaly or jam coupled with a critical flight condition is extremely improbable. In response to the Board's second concern, the jam of secondary slide at full displacement is considered to be the most critical condition for all the rudder PCU's that were evaluated (other than the Boeing 737 PCU). However, the probability of a secondary valve jam off-neutral at lesser displacements is still considered to be on the order of 10-8 and, coupled with a critical flight condition, is considered extremely improbable. The Engineering Test and Evaluation Board completed its final report on October 23, 2000, and the Board has received a copy. I believe that the FM has addressed the full intent of this safety recommendation, and I consider the FAA's action to be completed.

From: NTSB
To: FAA
Date: 8/16/2000
Response: THE SAFETY BOARD NOTES THAT THE FAA'S ANALYSIS IS BASED ON THE SECONDARY VALVE BEING FULLY DISPLACED. THE BOARD'S TESTS FOUND THAT A FULLY DISPLACED SECONDARY VALVE WOULD SET UP HIGH CROSS FLOW BUT WOULD NOT RESULT IN LOSS OF CONTROL OF AN AIRPLANE. HOWEVER, THE SAFETY BOARD'S TESTS CONDUCTED ON DUAL CONCENTRIC RUDDER SERVO VALVES FOR THE BOEING 737 FOUND RUDDER REVERSALS WHEN THE SECONDARY VALVE WAS DEFLECTED LESS THAN 50 PERCENT FROM NEUTRAL. IN ADDITION, PREVIOUS TESTS HAVE FOUND THAT JAMS OF THE PRIMARY VALVE COULD RESULT IN ANOMALOUS RUDDER RESPONSE. THE FAA HAS NOTED THAT THE ETEB WILL BE CONDUCTING MORE IN-DEPTH ANALYSIS, AND THE SAFETY BOARD REQUESTS THAT THE TEST RESULTS DISCUSSED BE INCLUDED IN THE ETEB'S ANALYSIS. PENDING THE RESULTS OF THE ETEB, A-96-117 IS CLASSIFIED "OPEN--UNACCEPTABLE RESPONSE."

From: FAA
To: NTSB
Date: 1/14/2000
Response: Letter Mail Controlled 01/20/2000 1:02:33 PM MC# 2000093 THE FAA HAS COMPLETED ITS EVALUATION OF THE BOEING 707 RUDDER POWER CONTROL UNIT, THE BOEING 727 ELEVATOR CONTROL, THE BOEING 737 RUDDER AND AILERON/ELEVATOR CONTROL, THE BOEING 747 (CLASSIC) INBOARD ELEVATOR, AND THE DC-10 SPOILER CONTROL SYSTEM VALVES. EACH MODEL'S SERVICE HISTORY AND SPECIFIC DESIGN CHARACTERISTICS WERE INVESTIGATED TO DETERMINE IF AN UNSAFE CONDITION EXISTS TO WARRANT CORRECTIVE ACTION. WHILE IT CANNOT BE SHOWN THAT JAMMING WOULD NEVER OCCUR ON THESE DESIGNS, IT CAN BE SHOWN THAT THE COMBINATION OF A VALVE JAM AND A FLIGHT CONDITION, WHICH RESULTS IN AN UNCONTROLLED AIRPLANE, IS EXTREMELY IMPROBABLE. THIS DETERMINATION IS BASED ON THE PROBABILITY OF BEING IN A SITUATION WHEN THE SECONDARY VALVE IS FULLY DISPLACED (HIGH RATE COMMANDED), THE SECONDARY VALVE JAMS AT THE INSTANT IT IS IN THE FULLY DISPLACED POSITION, AND THE AIRPLANE IS IN A FLIGHT CONDITION WHERE THE AIRPLANE CANNOT BE CONTROLLED WITH THIS FAILURE. THESE DESIGN ASSESSMENTS ARE SUPPORTED BY THE EXTENSIVE SERVICE HISTORIES OF THESE AIRPLANES AND ARE THE BASIS UPON WHICH THE FAA CONCLUDES, AT THIS TIME, THAT AN UNSAFE CONDITION DOES NOT EXIST ON THESE MODELS. IN ADDITION, THE FAA IS IN THE PROCESS OF CONVENING AN ENGINEERING TEST AND EVALUATION BOARD IN RESPONSE TO A-99-21. THE RESULTS OF THIS STUDY WILL PROVIDE THE FAA WITH FURTHER DATA. THE BOARD EXPRESSED CONCERN IN ITS LETTER DATED 2/2/99, THAT THE FAA DID NOT INCLUDE AIRBUS AIRPLANES IN ITS EVALUATION. IN RESPONSE, THE FAA DID NOT INCLUDE TRANSPORT-CATEGORY AIRPLANES PRODUCED BY AIRBUS IN ITS EVALUATION BECAUSE THESE AIRPLANES DO NOT HAVE DUAL CONCENTRIC SERVO VALVES. I BELIEVE THAT THE FAA HAS ADDRESSED THE FULL INTENT OF THIS RECOMMENDATION. I CONSIDER THE FAA'S ACTION TO BE COMPLETED, AND I PLAN NO FURTHER ACTION.

From: NTSB
To: FAA
Date: 2/2/1999
Response: THE FAA STATED THAT IT NEEDED TO COMPLETE ITS EVALUATION OF THE 707 RUDDER PCU TO COMPLETE THIS DETAILED DESIGN REVIEW. HOWEVER, THE BOARD NOTES THAT JET TRANSPORT-CATEGORY AIRPLANES PRODUCED BY AIRBUS WERE NOT MENTIONED AS PART OF THE EVALUATION. PENDING THE BOARD'S REVIEW OF THE RESULTS OF THE FAA'S DETAILED DESIGN REVIEW, INCLUDING A REVIEW OF AIRBUS FLIGHT CONTROL SYSTEMS, A-96-117 IS CLASSIFIED "OPEN--ACCEPTABLE RESPONSE."

From: FAA
To: NTSB
Date: 6/29/1998
Response: Letter Mail Controlled 7/7/98 3:54:45 PM MC# 980844: As outlined in our letter dated May 13, 1998, aircraft certification offices reviewed data from airplane manufacturers under their geographic purview and determined that there are 12 dual concentric servo valves used on various transport-category airplane flight control systems that need a detailed design review. Ten of these valves were used on Boeing 707, 727, 737, and 747 airplanes; one was used on McDonnell Douglas DC-10 and MD-11 airplanes and one was used on the Lockheed L-1011 airplane. The valve jam conditions, including the secondary slide jams, and evaluation criteria have been identified. The FAA has reviewed additional study results submitted by The Boeing Commercial Airplane Group, including its Douglas Products Division, and The Lockheed Martin Company. Boeing is still reviewing the Boeing 707 rudder power control unit and will submit its results to the FAA upon completion. The status of the review of each dual concentric servo valve is shown in the enclosed table. In summary, airworthiness directives have been issued for two valves, and nine valves have been found acceptable. The FAA will review the results of the Boeing 707 rudder power control unit as soon as the evaluation is completed. I will keep the Board informed of the FAA's progress on this safety recommendation.

From: FAA
To: NTSB
Date: 5/13/1998
Response: Letter Mail Controlled 5/18/98 3:54:43 PM MC# 980640 THE FAA'S AIRCRAFT CERTIFICATION OFFICES ARE REVIEWING DATA FROM THE AIRPLANE MANUFACTURERS THAT USE PCU SERVO VALVES.

From: NTSB
To: FAA
Date: 7/15/1997
Response: A-96-117 ASKED THE FAA TO CONDUCT A DETAILED DESIGN REVIEW OF ALL DUAL CONCENTRIC SERVO VALVES THAT CONTROL ESSENTIAL FLIGHT CONTROL SYSTEM ACTUATORS ON TRANSPORT CATEGORY AIRPLANES CERTIFICATED BY THE FAA TO DETERMINE IF THE DESIGN IS SUSCEPTIBLE TO INDUCING FLIGHT CONTROL MALFUNCTIONS &/OR REVERSALS AS A RESULT OF UNEXPECTED IMPROPER POSITIONING OF THE SERVO SLIDES. IF THE DESIGN IS DETERMINED TO BE SUSCEPTIBLE, MANDATE APPROPRIATE DESIGN CHANGES. PENDING FURTHER CORRESPONDENCE, A-96-117 IS CLASSIFIED "OPEN--ACCEPTABLE RESPONSE."

From: FAA
To: NTSB
Date: 1/16/1997
Response: THE FAA'S AIRCRAFT CERTIFICATION OFFICES ARE REVIEWING THE NECESSARY DATA FROM AIRPLANE MANUFACTURERS UNDER THEIR GEOGRAPHIC PURVIEW TO DETERMINE WHICH AIRPLANES CERTIFIED UNDER 14 CFR PART 25 UTILIZE PCU SERVO VALVES WHICH COULD ENCOUNTER VALVE JAMMING PROBLEMS RESULTING FROM UNEXPECTED IMPROPER POSITIONING OF THE SERVO SLIDES. THE FAA WILL TAKE APPROPRIATE ACTION TO ADDRESS THIS RECOMMENDATION BASED ON THE RESULTS OF THE REVIEW. I WILL KEEP THE BOARD ADVISED OF OUR PROGRESS ON THIS EVALUATION.