Safety at issue: the 737

Second of five parts

by Byron Acohido

Seattle Times aerospace reporter / Copyright, 1996, The Seattle Times Co.

The first real clues that Boeing's 737 might have a dangerous defect in its rudder-control system came from a 1991 crash in Colorado Springs.

The 737-200, built in Renton in 1982, started out as part of Frontier Airline's fleet. Four years later, Frontier sold the plane to United and it was assigned tail number N999UA.

On a Feb. 25, 1991, flight, N999UA's rudder deflected inexplicably to the right. The problem went away when the pilots switched off the yaw damper, a device that automatically commands small rudder adjustments during flight. Mechanics replaced a part called the yaw-damper coupler and returned the plane to service.

Two days later, a different flight crew reported N999UA's rudder again moving to the right. The new coupler evidently had made no difference. This time mechanics replaced a valve in the yaw damper and returned the plane to service.

Four days later, on the blustery morning of March 3, 1991, Captain Harold Green and First Officer Patricia Eidson were bringing N999UA down for a routine landing in Colorado Springs. At 1,000 feet, the jet suddenly flipped to the right and dived straight down, smashing into a city park and killing all 25 on board.

The pilot of a Cessna flying near the airport called the tower with a bird's-eye account: "We just saw the plane . . . uh just suddenly a complete downward dive."

From the control tower, air-traffic controller Kevin Ford reported from another perspective: "It looked like a dropped pencil going straight down."

It didn't take long for errant rudder movement to surface as a possible cause of the crash. Witness reports and readings from the plane's flight-data recorder confirmed that the 737 had traced a classic aerobatic maneuver, known as a "split-S," into the ground. See graphic at left.

A split-S results from radically altering the symmetry of flight. Such a quick or severe change would be consistent with the right engine or right wing falling off, but that had not happened. The pilots could have moved the rudder to the extreme right, but to do so within 1,000 feet of the ground would be suicidal. The other possibility was that the rudder had moved on its own.

Investigators with the National Transportation Safety Board were unfamiliar with the intricacies of the plane's rudder-control system when they arrived in Colorado Springs to comb through N999UA's wreckage.

The NTSB examines 2,100 aviation accidents a year nationwide, as well as trucking, rail, pipeline and marine accidents. Its staff of 90 full-time investigators and 260 support personnel has an annual budget of $35 million. (By comparison, the Seattle Police Department has 1,269 officers and an annual budget of $117 million.)

While safety board investigators pride themselves on objectivity and scientific certainty, they rely almost exclusively on the parties they are investigating - aircraft manufacturers, suppliers and airlines - for the technical expertise needed to solve airplane crashes. The post-crash handling, testing and analysis of complex airplane parts - typically retrieved scorched or crushed - are routinely assigned to the aircraft builder and its suppliers.

Among the NTSB investigators assigned to the Colorado Springs case was Greg Phillips. His task: to assess what role, if any, the rudder played in the 737's crash. Phillips would work with experts from Boeing and Parker Bertea Aerospace, the Irvine, Calif., company that manufactures all 737 rudder power-control units, as well as representatives from United Airlines and the Air Line Pilots Association.

The burned and mangled rudder parts were retrieved from what remained of the plane's tail section and taken to United's maintenance center in San Francisco. Phillips was joined there by John Calvin, an engineer from Boeing's quality assurance lab, and Wally Walz, a senior engineer from Parker Bertea, among others.

They examined the yaw damper, but it had been crushed to about one-tenth of its original size by the crash impact and was useless for testing. That left the rudder's power-control unit, or PCU. It was severely burned, its main rod bent, its internal parts frozen.

When they dismantled the PCU, investigators noted a white, powdery substance on the internal components of the yaw damper, and tiny drops of water, bubbles and stringy chips of bronze in PCU cavities.

Then, investigators focused on a mechanism about the size of a soft-drink can which is at the heart of the PCU. Called the dual servo valve, it consists of a cylindrical metal slide about the size of a cigarette, which is positioned inside a slightly larger slide. The servo slides work together to direct the proper flow of pressurized hydraulic fluid used to move the rudder. See graphics on page at right.

The investigators found the servo's slides severely jammed and pounded them apart with a hammer.

It is crucial to keep even minute debris out of the servo valve because the spaces separating the slides from each other and from their housing wall are no more than 5 microns, a gap invisible to the human eye.

Contaminants could jam the slides or clog a valve opening, sending hydraulic fluid flowing in the wrong sequence and inadvertently moving the rudder.

However, the investigators didn't think the debris was important because the PCU's filtering system was thought to prevent anything dangerous from getting into the device and because they "hadn't seen any service history" indicating a problem of contaminants in PCUs, the safety board's Phillips said in an interview in August 1995.

As a result, they didn't try to identify the contaminants, determine how they got into the PCU or assess what jamming effect, if any, they might have produced.

"I can't say at the time there was a high level of concern about particulates in the fluid," Phillips said.

Later, there would be.

The investigators gathered on the morning of March 21, 1991, at United's San Francisco base to discuss taking the dismantled servo valve to Parker Bertea's plant in Irvine for further testing. That was because United didn't have the equipment to extensively test the servo's slides.

Walz, of Parker Bertea, was assigned to hand-carry the servo valve to Irvine. John Calvin, the quality-control engineer from Boeing, instructed an assistant to pack up the parts. According to court records, the assistant left the room and returned with a taped package, which he handed to Walz, who carried it on a flight to Southern California.

When Walz opened the package that afternoon at the Parker Bertea plant, he discovered that three servo-valve parts were missing: a spring, spring guide and end cap.

Boeing, citing ongoing litigation, has never explained why those three parts were left out of the package forwarded to Irvine.

Together, the three missing parts play a crucial role in the delicate sequence of channeling just the right amount of pressurized hydraulic fluid, at just the right moment, to move the rudder in the direction and to the degree the pilot or the automatic yaw damper has commanded. When precisely positioned inside the servo-valve housing, the spring, spring guide and end cap serve as an internal stop, preventing the outer slide from moving too far within the housing.

It would be another 18 months before investigators would discover that too much movement of the outer slide could be dangerous.

As far as Phillips knew at the time, the three parts which John Calvin's helper failed to pack in San Francisco were inconsequential. Phillips concurred with a group decision to proceed with testing of the servo using a new spring, spring guide and end cap taken from Parker Bertea's stockroom.

"We agreed that we could test with other hardware and get valid data," Walz said in a court deposition last year in a lawsuit filed by the families of Colorado Springs victims.

Before reassembling the inner and outer slides, investigators used a power tool to smooth the servo valve's interior housing walls and the exterior of the outer slide, creating like-new surfaces.

This practice - the restoring of damaged parts to working condition before testing them and then absolving them of contributing to a crash - continues to be accepted procedure in National Transportation Safety Board investigations.

The polished inner and outer slides were placed back inside the servo-valve housing, along with the new spring, spring guide and end cap. Phillips and other NTSB investigators then watched as Parker Bertea engineers tested the United jet's servo valve, now reassembled with many new or refurbished parts.

The servo valve failed to transfer fluid and maintain pressure according to specifications, but the investigators agreed it worked well enough to conclude there was no evidence it contributed to the crash.

With the PCU now largely absolved of blame, the focus of the probe shifted away from the rudder. Boeing offered the theory that a freak gust of wind, bouncing like a horizontal tornado off the nearby Rocky Mountain foothills, flipped the jetliner into a split-S dive.

Boeing produced reams of data and a computer simulation to show how a sideways-swirling "wind rotor" could have caused the crash.

Some investigators expressed doubt about Boeing's theory, saying it would take incredible strength for wind to pull a 38-ton airplane into a split-S fall. For Boeing's theory to make sense, the rotor would have had to hit the aircraft head on and then turn earthward at just the right moment to drive it into the ground.

Nothing in aviation history suggested such a phenomenon was possible.

As the Colorado Springs probe continued, two developments shifted interest back to the 737's rudder controls.

On June 6, 1992, a Copa Airlines 737 was cruising high over Central America when it suddenly flipped and crashed in a jungle in Panama, killing all 47 on board. At the invitation of Panamanian authorities, Phillips and another NTSB investigator, Tom Haueter, traveled to Panama to lead the investigation.

Haueter and Phillips, assisted by experts from Boeing and its suppliers, deduced that a frayed wire in a cockpit instrument most likely contributed to pilot error causing the crash. But their findings weren't conclusive, and suspicion remained that an errant rudder movement may have caused the plane to flip.

Then, in August 1992, an anonymous caller alerted the NTSB that United had made a troubling discovery while testing a rudder PCU removed from a 737 jetliner in Chicago a month earlier.

On July 16, United Captain Mack Moore hadn't liked the way his 737 rudder pedals were behaving during a routine pre-takeoff systems check at O'Hare International Airport. The right pedal seemed stiffer than usual and Moore could push the left one only about a quarter of the way to the floor.

United removed the PCU from Moore's jet, ferried it to the airline's maintenance center in San Francisco and began experimenting with it. There, sources say, a mechanic discovered that he could trigger a specific kind of rudder malfunction, called a reversal, by putting the spring, spring guide and end cap slightly out of adjustment. See graphic at left.

The mechanic established that a PCU could receive a command to move the rudder left - yet move the rudder instead to the extreme right. The reversal happened if the spring, spring guide and end cap were not in the precise alignment needed to prevent the outer slide from moving too far.

When the safety board's Phillips and his supervisor, Bud Laynor, director of the agency's office of air safety, learned about United's finding, they recalled the Colorado Springs investigation: The Boeing engineer's assistant had failed to pack the spring, spring guide and end cap with the other Colorado Springs PCU parts heading for more tests.

"That's when we got real smart," Phillips said.

The federal investigators called for a summit meeting of everyone involved in the rudder-control investigation. The power-control units from the jets that crashed in Panama and Colorado Springs were to be brought to Boeing's labs in Seattle to be tested alongside the unit pulled from Mack Moore's plane in Chicago.

By then, though, the springs, spring guides and end caps from the United and Copa jets had long since been disassembled and reassembled, eliminating evidence of how the parts were aligned as each crash occurred.

Nonetheless, the safety board's Laynor says he insisted that the original spring, spring guide and end cap from the 737 that crashed in Colorado Springs be found and restored to the PCU for the summit tests. When the parts were presented for testing, Laynor said he recognized the end cap as having burn marks similar to those he remembered seeing in San Francisco, but he couldn't say for sure whether the spring and spring guide were from the Colorado Springs jet.

In a separate interview in August 1995, Boeing spokesman Steve Thieme said Boeing was "absolutely positive" they were all the original parts.

Investigation: unsolved

The summit tests took place in Boeing's Seattle labs in September 1992. The power-control units worked well enough that investigators agreed they could find no conclusive evidence of a rudder reversal as the cause of the Colorado Springs or Panama crash.

Not long after the Seattle tests, the NTSB convened a closed-door meeting at which the investigators made their final arguments for a probable cause in the Colorado Springs crash. The pilots' group and United pointed to the circumstantial evidence that the PCU must have somehow malfunctioned. Boeing urged the board to accept its wind-rotor theory.

In the end, the five-member board ruled it "could not identify conclusive evidence to explain" the crash. It suspended in a quandary what was to that date the most extensive air-crash investigation in its 28-year history.

But it wasn't the end of the safety board's concern raised by the so-called "Mack Moore incident" - when it was discovered that a 737 PCU could produce rudder movement opposite of a command from the pilot or yaw damper.

Acting on a safety board recommendation, the Federal Aviation Administration in March 1994 ordered airlines to replace the spring, spring guide and end cap in all 737 power-control units with parts re-engineered to assure proper alignment and engraved with serial numbers to help keep track of them. Airlines were given until March 1999 to make the changes, as long as they inspected the PCU every few months.

Kenneth Usui, the Boeing manager of airworthiness for the Renton division where the 737 is made, protested. In a letter to the FAA, Usui said that regular inspections were unnecessary and that airlines should be given seven years to make the upgrade.

Boeing maintains that, like the rest of the industry, it took the Mack Moore incident for the company to learn that the PCU could reverse itself. Some investigators, however, were skeptical.

A January 1995 report by the British Air Accidents Investigation Branch buttressed the belief of some investigators that Boeing had known about the rudder-control problem for years.

The agency, the British equivalent of the NTSB, had investigated why an elevator - a part on the horizontal tail section - had reversed momentarily on a British Airways 747-400 and pitched its nose down as it was climbing out of London.

The British agency blamed the 747 elevator reversal on the jamming of a servo valve similar to the one used in 737 rudders. Its report notes that, in the course of its investigation, Boeing informed the British agency that it had known about the servo's capacity to reverse since the mid-1970s.

From the Colorado Springs accident through the end of 1993, as safety officials hashed out improvements for the PCU, 11 more 737s crashed around the world. They included the accident in Panama as well as landing-approach crashes in China, Korea and India. The accidents drew scant public attention.

Then on March 8, 1994, a Sahara India Airlines 737 flipped onto the runway at New Delhi Airport, killing nine people. Records indicate a rudder malfunction was immediately suspected.

Federal records show an NTSB investigator on the Colorado Springs crash and Boeing and Parker Bertea engineers were asked to examine the New Delhi airplane's rudder systems. Among those from Boeing was John Purvis, the company's director of air-safety investigations.

The accident happened as a veteran Sahara India 737 pilot was supervising touch-and-go landings with three pilot trainees in clear weather. With one of the trainees at the controls, the aircraft touched down, rolled along the runway and took off again, reaching an altitude of 400 feet.

Suddenly, the jet veered left and slammed back to earth near the airport's international terminal. Flaming parts skidded into a nearby Russian jet, setting it on fire. The four Sahara pilots, as well as five ground workers servicing the Russian plane, were killed.

Indian aviation authorities blamed the crash on pilot error. Yet there also was evidence suggesting the airplane's rudder had reversed to the left when the pilot had correctly commanded it to move right. In examining the plane's PCU, the American experts discovered its serial number had been removed and replaced with a number that was not familiar to Boeing or Parker Bertea. The unit evidently had been worked on by an unauthorized repair shop and assigned a bogus number.

Upon disassembling the PCU servo valve and checking the internal components, investigators also found that the spring guide had been machined to the wrong size and was similarly stamped with a bogus part number. Investigators reassembled the PCU with the improperly machined spring guide and ran it through lab tests. They found that, under certain conditions, the PCU reversed both to the left and to the right.

The reversals occurred when the inner slide jammed inside the outer slide as the pilot rapidly depressed a rudder pedal. The lab tests showed the outer slide would then move too far, directing fluid in a sequence that reversed the rudder.

Boeing's Purvis took the position that only debris large enough and hard enough to leave marks could jam the servo slides. Since no scratches or nicks were found on the New Delhi jet's slides, he said jamming and rudder reversal couldn't have caused the crash.

But independent hydraulics experts say jamming can take place in servo valves without leaving any marks.

"There are a lot of different ways a valve can jam," said William Needleman, associate director of science and lab services at Pall Corp., a filter manufacturer. Numerous tests in industrial settings show soft particles, such as dirt, can jam valves temporarily. "When you unjam it and open the valve up, a lot of the contaminant washes away," Needleman said.

A month after the New Delhi crash, there was another incident that focused attention on the 737's rudder.

On April 11, 1994, Captain Ray Miller was cruising a 7-year-old Continental Airlines 737-300 in clear, calm skies over Honduras when he heard a muffled thump. In the same instant, Miller felt the aircraft suddenly twist and roll violently to the right.

Miller disengaged the autopilot and turned the control wheel sharply to the left, holding it firm against stiff resistance. This deployed wing panels, called ailerons, to roll the plane left and thus counter the mysterious, insistent pull to the right.

"Our location was still well out over the water. I recognized that there was a very real possibility . . . that we just might lose total control of this thing and end up in the Gulf of Honduras," Miller reported afterward.

For the next 18 minutes, Miller and his co-pilot struggled to keep the jet from rolling over to the right. The pilots guessed that a piece of tail or fuselage had fallen or blown off, creating an unbalanced aircraft.

Whatever was happening, Miller was grateful it began at 37,000 feet. Fighting to control the jet as it descended, Miller had time to run through problem checklists and discuss with his co-pilot the best way to land the aircraft.

Had the problem started at a lower altitude and slower air speed, Miller reported, the flight would have been "non-survivable . . . due to the alarming and violent nature of the event, and the very confusing control responses and clues as to what is happening."

So concerned was Miller that he began broadcasting a description of his situation to any aircraft nearby that might be listening "because if they had to get the recorders out of the water someone needed to know what happened."

Miller and his co-pilot decided they needed to fly the jet much faster than normal to execute a safe landing. A higher landing speed would keep more air flowing over the wings, making the ailerons more effective in controlling the jet's tendency to roll to the right, they deduced.

The strategy worked. Miller brought the jet down safely. Once the 737 came to a stop, Miller hurried outside to inspect the aircraft. To his surprise, he found the plane's exterior parts in perfect order. Continental mechanics immediately removed the flight-data recorder, the yaw damper, the PCU and other parts, handing them over to Boeing for analysis.

Records show Boeing concluded that hydraulic fluid had leaked from the PCU onto the yaw-damper signaling component, creating an open electrical circuit that inadvertently moved the rudder 2.5 degrees to the left. Such a deflection should have caused the jet to veer only slightly off course, something easily controllable by the pilots. Moreover, Boeing said the problem could not have lasted more than 110 seconds.

Those findings contradicted Miller's 9,500-word written statement, which detailed the steps he had to take for 18 minutes to keep the aircraft from veering out of control. Miller had squeezed the control wheel so hard that he injured his left hand.

After reviewing Boeing's findings and the pilot's report, the NTSB and FAA took no action.

Miller filed a follow-up report with his superiors, complaining that authorities didn't seem to be taking him seriously:

"I have been told by my company . . . that the FAA and Boeing (were) aware of the problems with the spurious rudder inputs but considered them to be more of a nuisance problem than a flight safety issue. I was informed, that so far as everyone was concerned, the rudder hard"overs were a problem but that the `industry' felt the losses would be in the acceptable range.

byron Acohido

Seattle Times aerospace reporter / Copyright, 1996, The Seattle Times Co.

It was a clear, windless autumn evening as USAir Flight 427 prepared to land in Pittsburgh. The flight, a sellout, had originated in Chicago and was scheduled to travel on to Philadelphia.

At the controls of the 8-year-old Boeing 737-300 on Sept. 8, 1994, were Capt. Peter Germano and First Officer Charles Emmett III. Between them, they had logged more than 6,900 hours flying 737s. Their plane had been regularly serviced, including a maintenance check a month earlier during which its rudder system was inspected.

As the flight attendants prepared the passengers for arrival, Germano and Emmett ran through the landing checklist and took instructions from the control tower. Air-traffic controller Richard Fuga instructed them to descend to 6,000 feet and slow to 190 knots (218.5 mph). Germano complied.

As it continued descending, Flight 427 flew into some air turbulence trailing off the wingtips of a Delta 727 flying four miles ahead. The jostling, reflected by a momentary jump in airspeed, appeared to be routine, posing no threat. But it caught the pilots off guard.

"Sheez," said Germano.

"Zuh," said Emmett.

A series of unidentified sounds were then captured by the cockpit recorder. Thump. Clickety-click. Pssssssst. Thump.

That's the moment investigators believe Flight 427's rudder moved suddenly to its extreme left - a movement known as a "hardover," which is not supposed to happen while a 737 is in the air - and locked in that position.

The next 24 seconds were captured by the cockpit voice recorder.

The jet peeled off to the left, like a fighter plane in a World War II movie. Then it rolled upside down and began falling out of the sky, nose pointed almost straight down.

"Whoa," exclaimed Germano. Clickety click. "Hang on."

The engines whined as the jet accelerated from 190 knots to 260 knots - nearly 300 miles per hour.

Emmett grunted.

"Hang on," Germano said again. A wailing horn warned that the autopilot had disconnected. "Hang on."

"Oh (expletive)," exclaimed Emmett.

"Hang on," Germano shouted. Some investigators believe that, at this point, Germano cranked his control wheel as hard as he could to the right, deploying wing ailerons in an attempt to counter the roll. When that proved fruitless, he exclaimed: "What the hell is this?"

The control yoke began shaking, warning the pilots that the wings were about to lose all lift. An altitude warning tone sounded.

With 12.9 seconds left, the following exchange took place:

Germano: "What the . . ."

Emmett: "Oh."'

Germano: "Oh God, oh God."

Emmett: "(expletive)."

Germano: "Pull."

The pilots yanked back on the control yoke in an attempt to raise the nose.

Emmett: "Oh (expletive)."

Germano: "Pull. Pull."

Emmett: "God."

Germano screamed.

Emmett: "No."

Plummeting at 300 mph, Flight 427 sliced into a wooded ravine and exploded in a huge fireball. In an instant, the gleaming, 50-ton jetliner, carrying 132 people, shattered into hundreds of thousands of smoldering pieces.

The crashes of 737s in Colorado Springs, Panama and New Delhi, and a near-crash in Honduras, had given experts from the National Transportation Safety Board and from Boeing a chance to increase their understanding of the ways a737 rudder could misbehave.

Many of these same investigators arrived in Pittsburgh the morning after the Sept. 8, 1994, crash. They were led by Tom Haueter and Greg Phillips, the safety board investigators who worked together on the 737 crashes in Panama and Colorado Springs.

In the Pittsburgh crash, there was no reason to suspect weather as a factor. That left the pilots and the airplane. Each would undergo intense scrutiny. First would be the plane.

Because eyewitness accounts, supported by radar data, depicted the jet twisting, then dropping straight down, a rudder hardover was immediately suspected.

Records show Phillips made it clear right from the start that he would impose stricter evidence-handling rules than he had during the futile probe of the 1991 Colorado Springs crash. He directed the meticulous removal of the rudder's control mechanism (called a power-control unit, or PCU) from the wreckage, making sure its hydraulic lines were capped to preserve the general positioning of key parts, as well as its fluid.

The PCU was stored for several days at a USAir hangar in Pittsburgh before being shipped to Boeing labs in Seattle. Because key parts had disappeared during the shipment of the PCU recovered from the Colorado Springs crash, Phillips insisted on chain-of-custody procedures documenting the handling of all the PCU parts. He even carried two small parts by hand to Seattle.

On Sept. 19, Phillips convened 20 investigators at Boeing's lab in Seattle, safety board records show. Half of them were Boeing engineers, and the rest represented Parker Bertea (the PCU's manufacturer), USAir, the Federal Aviation Administration and the Air Line Pilots Association.

Among the first things they found was that USAir had not yet upgraded the PCU servo valve's spring, spring guide and end cap on the ill-fated jet. Months earlier, in March, the FAA had ordered airlines to upgrade those parts to help prevent 737 rudders from reversing a routine command. USAir still had more than four years to meet the FAA's deadline.

The improved parts were designed to ensure the spring, spring guide and end cap always stayed in precise alignment. Investigators found the USAir jet's parts, though not yet upgraded, were adjusted "within acceptable limits."

The PCU then was shipped to Parker Bertea's lab in Irvine, Calif., where the investigators reconvened Sept. 21 for further analysis. This time all the parts showed up.

The hydraulic fluid filters were removed and drained and the PCU hung upside down to drain the rest of the fluid from the main cavity. The bent piston rod was removed and the cavity examined. No signs of abnormal wear were found inside the PCU.

A cover plate was then removed. Floating in the remaining hydraulic fluid and easily visible to the naked eye were small, shiny, metallic particles - flakes of aluminum-nickel-bronze, a material commonly used in bearings. Samples were taken, first with a syringe and then by pouring out the last of the contaminated fluid into a container.

The investigators determined there was no way to test the PCU because all of the part's external levers, nuts and bolts were mangled. So, along with the bent piston, all the external parts were removed and replaced with new parts. The PCU was cleaned and injected with fresh hydraulic fluid. Only then was the unit tested.

Next, Boeing and Parker engineers ran a test to see if they could make the PCU reverse. They could not.

On Sept. 23, two weeks after the crash, Phillips signed a report concluding the Irvine tests had "validated" that the PCU was "capable of performing its intended functions" and was "incapable of rudder reversal or movement."

Phillips' finding was a victory for Boeing. If it held up, it could clear the airplane of responsibility for the crash and greatly lessen or eliminate any financial liability for Boeing.

But Phillips would go a few steps further than he did following the crash in Colorado Springs, where evidence of dirty fluid was largely ignored. He asked hydraulic fluid maker Monsanto Corp. to measure the contamination level of the small amounts of hydraulic fluid recovered from the Pittsburgh jet. And he directed Boeing to account for the metallic particles recovered from the PCU cavity.

Monsanto's measurements found the Pittsburgh jet's fluid to be 16 times more contaminated than hydraulic parts manufacturers recommend for aircraft systems.

Some investigators speculated that Flight 427's rudder could have swung hard over in response to a command from the yaw damper issued when the plane bumped into the wake of the 727. One way this could have occurred is if debris in the hydraulic fluid jammed the PCU servo valve's two internal slides just as the yaw damper was trying to make a quick rudder adjustment. See graphic at right.

To address the question of whether the slides may have jammed, investigators relied on logic which Boeing's air-safety chief, John Purvis, had developed to rule out rudder reversal in a New Delhi 737 crash earlier that year.

Engineers at Boeing's quality-assurance lab in Renton took a chip of high-strength steel and positioned it partially inside a tiny opening in the wall of one of the slides. The chip, indeed, caused one slide to jam against the other, one of the conditions necessary for a hardover but in doing so it etched a mark on the slide surface.

Since no similar marks were found in the Pittsburgh jet's servo valve, Boeing concluded, as it did in New Delhi, that dirty hydraulic fluid could not have caused the rudder to swing all the way to one side.

The NTSB's Phillips accepted Boeing's rationale despite a hydraulics industry axiom that jams tend to come and go, varying in severity and most often leaving no trace in the PCU.

Numerous studies show, for instance, that when debris jams a hydraulic valve, then breaks free, the valve is restored to perfect working order, said Leonard Bensch, corporate vice president of Pall Corp., a manufacturer of hydraulic-system filters.

"When the (debris) goes away, the valve works like brand new; put the (debris) back in and it doesn't work again," said Bensch, who is also an engineer.

Boeing conducted another test to discount the possibility that dirty hydraulic fluid was a factor in the Pittsburgh crash. John Carulla, a Boeing engineer, took a PCU like the one used on Flight 427 and set it up so that a powerful hydraulic actuator constantly pumped the slides back and forth. This created a vigorous flushing action, something that would never occur in flight.

Carulla then continuously added debris to the fluid until it was several times dirtier than the samples taken from the Pittsburgh jet. Although the hydraulic-fluid pumps failed several times and had to be replaced during the test, the PCU servo valve's slides never jammed.

Referring to Boeing's tests, Phillips, the safety board's top rudder expert, said in an August 1995 interview: "I honestly believe that we've proven that contamination wasn't a factor."

Despite his public statements indicating a lack of evidence of any specific rudder-control problem having caused the Pittsburgh crash, Phillips remained concerned. In March 1995, Phillips drafted a detailed list of proposed 737 rudder-related safety measures.

Phillips called for pilots to be alerted to the possibility of rudder hardovers and trained in special recovery maneuvers. He advocated redesigning the 737 rudder to drastically limit its range of movement during most phases of flight.

Phillips' proposals became the focus of heated debate between Boeing and the NTSB for the next 19 months. The debate took place outside the public view.

Phillips' list eventually grew to include mandatory, periodic hydraulic fluid sampling and a limit on the number of flights a PCU could be used before it had to be replaced or overhauled. He also suggested far-reaching improvements for the yaw damper and called for fitting all 737 cockpits with an instrument that would tell pilots the position of the rudder at all times.

Meanwhile, Boeing had begun a campaign to blame the Pittsburgh accident on pilots Germano and Emmett. At a March 1995 NTSB meeting in Washington, D.C., Boeing presented a thick packet of documents loosely linking cases of pilot error over several decades to the Pittsburgh crash. The material included excerpts from dozens of psychological case studies about why pilots make mistakes.

At Boeing's request, the safety board created a special "human performance" committee to focus on the possibility that Germano or Emmett caused the crash. The committee was chaired by Dr. Malcolm Brenner, the National Transportation Safety Board's psychologist, and included a Boeing test pilot, Michael Carriker; a Boeing psychologist, Dr. Curtis Graeber; three USAir pilots and two representatives from the FAA.

In a series of meetings over several months, a debate unfolded as Carriker and Graeber made the case that one of the pilots must have stepped on the left rudder pedal and kept it depressed until it was too late to recover.

Graeber cited the case of a helicopter pilot who occasionally made the mistake of depressing his left foot pedal, instead of the right pedal, to turn right. Graeber said that was because, under stress, the pilot reverted to a familiar childhood memory: snow sledding. As a boy, he had steered his favorite snow sled by pushing his left leg forward to veer to the right.

Perhaps, Graeber argued, one of the USAir pilots made a similar mistake while trying to adjust for what should have been a routine encounter with wingtip turbulence from a jet flying well ahead.

Carriker and Graeber also suggested that one of the pilots may have depressed the rudder pedal as the result of a seizure, pointing to a 1980 incident involving a Frontier Airlines 737. In that instance, a co-pilot suffered a seizure, shoved the rudder pedal to the floor and nearly caused the plane to crash during landing.

The USAir pilots vehemently disputed Boeing's assertions.

In late January 1996, Carriker and Graeber distributed a 25-page position paper to the other panel members laying out Boeing's argument for why the airplane couldn't be blamed and why the pilots probably caused the Pittsburgh crash.

"They tried to attach it to the human factors group's factual report, but everybody raised so much hell, they withdrew it. It was so outrageous," said a source close to the special panel.

A week after distributing the report, Boeing asked the panel members to return or destroy all copies, sources said. The safety board denied a Seattle Times Freedom of Information Act request for that document on grounds it was preliminary, deliberative material not required to be released publicly.

Not surprisingly, word that Boeing was trying to persuade the NTSB to blame the crew did not sit well with many pilots. And it infuriated Chris Germano, the widow of Flight 427's pilot.

"My husband was a very careful, very meticulous pilot. He paid a lot of attention to his skills and he was physically ready to do his job," she said. "I have to deal with the fact that my husband's trust was violated. He walked on that airplane knowing that he was capable of doing his job and his plane wasn't up to it."

The NTSB committee so far has issued no finding on the role of the pilots.

With Boeing trying to blame the pilots and Phillips pushing to make 737s safer, two attorneys representing families of some Colorado Springs crash victims produced testimony that increased concern about the jets' rudder-control system.

The testimony came in depositions of Steve Weik and Shihyung Sheng, two of the Parker Bertea engineers involved in the investigations of the Colorado Springs and Pittsburgh crashes.

Weik and Sheng each unequivocally confirmed that any command to move the rudder slightly could result in a hardover in the direction commanded if both the PCU servo valve's inner and outer slides happened to jam simultaneously. Weik testified that this design characteristic was known "from day one" by both Boeing, which designed the PCU, and Parker Bertea, which built it.

Hydraulics experts consider such a dual jam to be highly unlikely. Nevertheless, Weik's and Sheng's disclosure meant an inadvertent rudder hardover theoretically was possible anytime a pilot depressed a rudder pedal or the yaw damper issued a signal to adjust the rudder - a command issued almost moment-to-moment on an average flight.

It also meant that a servo valve modified according to the FAA's upgrade order to prevent rudder reversals could still be dangerous. A properly adjusted spring, spring guide and end cap could prevent a rudder reversal - but could do nothing to stop hardovers in the direction commanded, caused by a dual jam. See graphic on previous page.

In May 1995, the FAA completed a seven-month special review of the 737's control system and underscored the concern over dual-jam hardovers. The FAA's study pointed out that since the outer slide is rarely asked to move, it theoretically could jam - and remain stuck for some time - without pilots or mechanics noticing.

Under that circumstance, the 737 would be a single failure away from disaster: If the inner slide jammed with the outer slide already stuck, the result would be a sustained rudder hardover.

The FAA asked Boeing to assess the probability of such a thing happening in flight. Boeing produced not one but three reports, which the company submitted to the FAA sometime before August 1996.

According to Tom McSweeny, the FAA director of aircraft certification, the Boeing reports reconfirm what the company has asserted all along: that most rudder problems are controllable by the pilot and that rudder hardovers are "extremely improbable."

However, McSweeny refused a Seattle Times request for a copy of Boeing's reports, saying they contained proprietary business information. McSweeny also said "the fact of the matter is, the average public isn't able to understand" the material. "That's why the FAA was created," he said, "to step in and do something."

"We have completed our review," McSweeny said. "And we concur with (Boeing's) analysis."