On March 3, 1991, a United Airlines Boeing 737-200 departed from the now-defunct Stapleton International Airport (DEN) in Denver, Colorado, on a routine connection to Colorado Springs, Colorado. United Airlines Flight 585 was a unique connection: it departed from Peoria, Illinois, just outside of Chicago, stopped in Moline, Illinois, and before its final landing in Colorado Springs, it also landed in Denver to make a crew change, according to a National Transportation Safety Board (NTSB) report.
The first three legs of the flight were nothing out of the norm, as pilots reported no issues in the maintenance log of the aircraft. Before the Boeing 737 departed for its last leg, the weather in Colorado Springs was clear, with great visibility, but a bit windy: 23 knots, with gusts up to 33 knots.
Flight 585 departed from Stapleton International (DEN) at 09:23 Local time, with no issues. It was scheduled to arrive in Colorado Springs Airport (COS) at 09:42. The 737-200 carried 20 passengers, including three flight attendants and two pilots on its last leg to the city, dubbed as Olympic City USA.
At 09:41, Air Traffic Control in Colorado Springs told the flight crew on board Flight 585 to “hold short of runway three zero for departing traffic on runway three zero,” with the first officer confirming that United 585 heard the instructions and repeated them to the controller, a standard procedure.
However, that was the last active contact United Airlines Flight 585 had with the controller: shortly after, the Boeing 737 plunged into the ground, just short of Colorado Springs Airport’s runway 35.
What started as an accident in 1991 would eventually end in 2008, when around all Boeing 737s would be eventually retrofitted with a new rudder control system.
From the 727 to the 737
The issue, which crossed the NTSB’s roads for the first time in 1991, could be back-tracked to the 1960s when the commercial aircraft market was much more competitive: while Airbus was still not conceived, in the United States alone, three manufacturers were competing for airlines’ attention: Boeing, McDonnell Douglas and Lockheed.
Lockheed focused on a wide-body, the L-1011 TriStar.
McDonnell Douglas released and enjoyed relative success with the DC-9, a short-haul narrow-body that seats up to 140 passengers in a single-class configuration, while Boeing was busy with the design of the 747. At the end of February 1965, the DC-9 attracted 112 orders.
The same month, Boeing decided to launch their answer to the DC-9: the Boeing 737. Lufthansa (LHAB) (LHA) became the launch customer of the 737, with a firm order of 21 aircraft, signed on February 15, 1965.
The Boeing 727 and the Boeing 737 were eerily similar: except for the fact that the Baby Boeing had two engines placed under the wings, and the aircraft’s horizontal stabilizer was also placed on the aft fuselage, unlike on the 727, which had its horizontal stabilizer on its tail. The tail had another major difference between the two aircraft: while the 727 had a split-rudder, the Boeing 737 emerged from the design sheets with a single-panel rudder.
Theoretically, if one of the rudders on the 727 would encounter an issue, the other could be used to offset the issue, as they were controlled by separate Power-control units (PCU). The same luxury was not available on the 737.
The difference between the 727 and the 737 rudders
Certification of the Boeing 737
During the certification process of the Boeing 737, the manufacturer answered the FAA’s question regarding the changes to the rudder and the fact that it had become a single-panel design: a backup system was provided by the “the dual concentric PCU servo valve and dual load path design,” states an NTSB report. The dual load path design means that if one slide of the PCU were to jam, the other slide would be the redundancy and counteract the jam, allowing the pilots to still control the rudder.
The FAA’s Code of Federal Regulations (CFR) stated that the failure of mechanical parts and the jamming of power cylinders must be considered unless they are extremely remote. NTSB’s report defined the extremely remote possibility as a probability of 1 × 106 or less for each flight hour.
Now, the CFR states that such failures must be considered unless they are extremely improbable: a probability of 1 × 109 or “so unlikely that they are not anticipated to occur during the entire operational life” of an aircraft.
Furthermore, when the Baby Boeing was certified, the manufacturer presented the FAA with a failure analysis of possible issues with the controls of the rudder. The then Seattle-based manufacturer argued that a jammed rudder or a failure of the rudder control system could be counteracted with the use of a “lateral [roll] control system,” as the lateral control system exceeds the authority of the rudder control system.
Previous incidents involving rudder issues
Even before United Airlines Flight 585 crashed near Colorado Springs Airport, five similar incidents had been reported that all involved problems with the rudder’s control unit.
Nevertheless, the NTSB had its hands tied: the board determined that the probable cause of United Airlines Flight 585 fatal crash was a loss of control of the aircraft, which resulted “from the movement of the rudder surface to its blowdown limit.” No constructive conclusion could be reached.
While later on, training and piloting techniques showed that it was possible to navigate out of such a situation, the NTSB reiterated that such training was not available for United Airlines Flight 585 or USAir Flight 427 crews, as the conclusion and training improvements were made after the two accidents.
The board was also adamant that changes to the rudder’s PCU needed to be made. The failures of the control system could “no longer be considered an extremely improbable or an extremely remote event” and therefore raised “serious questions about the validity of the certification of the existing B-737,” reported The New York Times in 1997.
However, before the NTSB could draw such conclusions and Boeing initiated its Rudder System Enhancement Program (RSEP) in 2003, another Boeing 737 suffered a fatal accident, taking 132 lives with it.
A USAir Boeing 737, operating Flight 427 from Pittsburgh International Airport (PIT) to Palm Beach International Airport (PIB) crashed on its approach to PBI on September 8, 1994.
Similarities between three Boeing 737 flights leading to conclusion
What followed the USAir crash was almost a five-year-long investigation into the probable cause of the accident. While the NTSB was still investigating the cause of USAir Flight 427, another Boeing 737 suffered sudden rudder movements. Eastwind Airlines Flight 517 t almost plunged into the ground upon its approach to Richmond International Airport (RIC). Fortunately, the flight crew was able to regain control of the aircraft and land safely at its destination.
And most importantly, the captain and first officer lived to tell the tale of it all, greatly benefiting the NTSB investigation. The captain of the flight participated in a simulation of Flight 517 and an interview with the board, whereupon he explained his actions on how he overturned the unexpected rudder movement.
The conclusions of the investigation, which the board announced in March 1999, were clear:
“The upsets of USAir Flight 427, United Airlines Flight 585, and Eastwind Flight 517 were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides.”
Furthermore, the NTSB concluded that the dual-concentric servo valve on the 737 is not reliably redundant, meaning it is not enough to prevent an accident from happening if the PCU’s slides become jammed.
Recommendations and changes galore
On February 20, 1997, the safety board issued a recommendation following the three incidents that required the FAA to issue an Airworthiness Directive (AD) that instructed the “installation of a redesigned main rudder power control unit on” the 737 to prevent uncontrolled operation of the rudder and ensure that the aircraft comply with certification requirements.
Previously, on January 15, 1997, the FAA issued an announcement that it would propose a design change to the 737’s rudder control system. Boeing publicly responded to the announcement and the company’s statement read:
“Boeing worked closely with the FAA in identifying and developing the changes to the 737 rudder system. We are pleased that our proposals were carefully analyzed and reviewed. The rudder system changes are the culmination of a lengthy process involving the FAA, Boeing and others in the industry. As a result of the FAA’s design review and our own review of data, it was decided that a number of changes could be made to bring the current-model 737s up to levels of performance similar to the Next Generation airplanes.”
However, the final NTSB report in 1999 also concluded that the design changes enacted by Boeing, including on the then-newest 737 Next Generation (NG) “do not eliminate the possibility of other potential failure modes and malfunctions in the” 737’s rudder system, which could result in a loss of control of the aircraft.
The rudder saga was finally laid to rest on November 12, 2002. FAA issued a directive, which required all Boeing 737 operators to retrofit about 4,500 aircraft with a new PCU system. The newly improved control system added two independent valves and dual input arms, which contain spring overrides that allow the pilots to fly the aircraft normally, even if the PCU becomes jammed. Boeing also included hydraulic pressure sensors that activate a standby PCU if abnormal readings are detected.
The compliance time of the AD was set to six years: meaning that by November 12, 2008, the new rudder control systems had to be installed on the 4,500 Boeing 737s. The agency estimated in 2007 that the installation, including work and parts, would cost $182,000 per aircraft.