Boeing 737-300 accident at Aliquippa, Pennsylvania, 8 Sept 1994

Accident narrative

On September 8, 1994, about 1903:23 eastern daylight time, USAir flight 427 entered an uncontrolled descent and impacted terrain near Aliquippa, Pennsylvania, about 6 miles northwest of its destination of Pittsburgh International Airport. All 132 people on board were killed, and the Boeing 737-300 was destroyed by impact forces and fire.

### The flight

USAir flight 427 was a scheduled domestic passenger flight from Chicago-O'Hare International Airport to Pittsburgh. The flight departed about 1810 with 2 pilots, 3 flight attendants, and 127 passengers on board.

The captain, age 45, had accumulated approximately 12,000 flight hours, including 3,269 hours as a 737 captain. The first officer, age 38, had 9,119 flight hours, including 3,644 flight hours as a 737 first officer. The cockpit voice recorder (CVR) and air traffic control (ATC) transcripts indicated that the captain was performing the pilot-not-flying duties, including radio communications, and the first officer was performing the pilot-flying duties with the auto-flight system engaged.

### The upset sequence

Approaching Pittsburgh, the flight was cleared to descend to 6,000 feet mean sea level. Delta Air Lines flight 1083, a Boeing 727, was sequenced to precede USAir flight 427 on the approach.

About 1902:22, approach controllers instructed flight 427 to turn left to a heading of 100 degrees and advised the crew of Jetstream traffic at their one to two o'clock position, climbing for 5,000 feet. The pilots acknowledged the transmission and stated they were looking for the traffic. Flight data recorder (FDR) data indicated that about 1902:53, the airplane was rolling out of its left bank as it approached the assigned heading of 100 degrees at 190 knots. About 1902:54, the first officer stated, "oh, ya, I see zuh Jetstream."

About 1902:57, the CVR recorded a sound similar to three thumps in one second. The captain stated "sheeez" and the first officer stated "zuh". Between 1902:57 and 1902:59, the airplane's left bank steepened from slightly less than 8 degrees to slightly more than 20 degrees. About 1902:58, the CVR recorded an additional thump, two "clickety click" sounds, and the sound of the engine noise getting louder. The FDR recorded a brief forward movement of the control column.

About 1902:59, the left roll was arrested, and the airplane began to briefly roll right toward a wings-level attitude. At the same time, the airplane's heading began to move left at a more rapid rate, passing through the 100-degree heading. The captain stated "whoa" and the first officer grunted softly.

Just after 1903:00, the airplane began to roll rapidly back to the left. By 1903:01, the heading was moving left at a rate of at least 5 degrees per second. Between 1903:01 and 1903:04, the CVR recorded the first officer grunting loudly while the airplane continued to roll left. Just before 1903:03, the left bank angle had increased to about 43 degrees, the airplane began to descend, the control column started to move aft, and the airspeed started to decrease.

Less than one second later, the autopilot disconnect horn sounded. During the next 5 seconds, the FDR recorded increasing left roll, aft control column, decreasing altitude, and decreasing airspeed. At 1903:07.5, the CVR recorded a sound similar to the onset of stall buffet, and the captain stated "what the hell is this?" At 1903:08.1, a vibrating sound similar to the stickshaker started and continued to the end of the recording.

About 1903:15, the captain transmitted "four twenty seven emergency." Between 1903:18.1 and 1903:19.7, the captain stated "pull...pull...pull." The CVR stopped recording at 1903:22.8. About 1903:23, the airplane impacted hilly, wooded terrain.

### What the investigation found

The airplane was severely fragmented by ground impact and postcrash fire. Examination of the wreckage revealed no evidence of an in-flight fire, bomb, explosion, or structural failure. The engines were operating normally until impact, and the thrust reversers were found in the stowed position. The Board concluded that a midair collision, bird strike, clear air turbulence, or other atmospheric phenomena were not involved.

Radar and FDR data indicated that flight 427 encountered wake vortices from the preceding Boeing 727. The Safety Board conducted flight tests to examine the effects of 727-generated wake vortices on a 737. The tests showed that wake encounters could result in strong rolling and yawing moments, but the rolling moments tended to self-correct as the airplane passed through the vortex, and the yawing moments were transient and did not result in large sustained heading changes. The Board concluded that, although USAir flight 427 encountered turbulence from Delta flight 1083’s wake vortices, the wake vortex encounter alone would not have caused the continued heading change that occurred after 1903:00.

Computer simulations and kinematic analyses demonstrated that the heading change rates recorded after 1903:00 were consistent with the rudder being deflected to its left aerodynamic blowdown limit (the maximum amount of rudder travel available against the aerodynamic forces acting on it). The Board concluded that about 1903:00, the rudder deflected rapidly to the left and reached its left aerodynamic blowdown limit shortly thereafter.

#### Rudder system testing

The 737 is equipped with a single rudder panel actuated by a single hydraulic main rudder power control unit (PCU). The PCU servo valve, manufactured by Parker Hannifin Corporation, is a dual-concentric tandem valve composed of a primary slide that moves within a secondary slide, which in turn moves within the servo valve housing.

Postaccident testing demonstrated that if the secondary slide was jammed to the servo valve housing and a rapid input was applied opposing the jam, the primary slide could overtravel. This overtravel could result in hydraulic fluid porting in such a way that the rudder moves to its aerodynamic blowdown position in the direction opposite to the rudder input (a rudder reversal).

The Safety Board conducted thermal tests to identify the effects of thermal variations on the PCU. In extreme temperature differential tests, heated hydraulic fluid (170° F) was injected into a cold PCU (-40° F). During these tests, the secondary slide of the USAir flight 427 servo valve jammed to the servo valve housing, and hydraulic fluid flow data indicated that a momentary reversal of the rudder occurred. The USAir flight 427 servo valve had significantly tighter diametrical clearances between the secondary slide and the servo valve housing than a new-production servo valve, which did not jam during the same tests.

Although the USAir flight 427 servo valve jammed repeatedly during the extreme thermal tests, internal examination revealed no evidence of physical marks that would indicate a jam had existed. The Board concluded that it is possible that the servo valve secondary slide could jam to the servo valve housing at a position offset from its neutral position without leaving obvious physical evidence, and that combined with a rudder pedal input, could cause the rudder to move opposite to the direction commanded.

#### Simulation and human performance

The Safety Board evaluated human performance data and concluded that the first officer likely made the first pilot control response to the upset event. The Board considered a scenario proposed by Boeing in which the pilots applied and sustained a full left rudder input. However, the Board concluded that analysis of the human performance data did not support a scenario in which the flight crew applied and held a full left rudder input until ground impact.

Instead, the Board found the data consistent with a rudder reversal. In this scenario, the first officer applied right control wheel to counter the wake vortex's left roll, followed by right rudder pedal pressure to counter the wake's left yaw. Because of the jammed secondary slide, this right rudder input caused the primary slide to overtravel, resulting in a rapid rudder deflection to the left. The first officer's loud grunting sounds recorded on the CVR were consistent with a pilot struggling against a reversed rudder pedal that was pushing back against his foot.

Flight tests revealed that at 187 knots (the crossover airspeed), maximum roll control provided by the control wheel could not counter the roll induced by a fully deflected rudder. As flight 427's airspeed decreased and its vertical G load increased during the upset, the airplane fell below the crossover airspeed, making it impossible for the flight crew to regain roll control without increasing airspeed or decreasing the vertical G load. The Board concluded that the flight crew recognized the initial upset and took immediate action but could not be expected to have assessed the flight control problem and executed the appropriate recovery procedure for a rudder reversal under the circumstances.

#### United flight 585 and Eastwind flight 517

The Safety Board reviewed two other 737 events during the investigation. On March 3, 1991, United Airlines flight 585 crashed while on approach to Colorado Springs, Colorado, killing all 25 people on board. On June 9, 1996, Eastwind Airlines flight 517 experienced a yaw and roll upset near Richmond, Virginia, but the flight crew regained control and landed safely.

During the Eastwind incident, the captain reported feeling a "bump" on the right rudder pedal, followed by a sharp right yaw and roll. He applied left rudder and "stood pretty hard on the pedal," which he reported felt stiffer than normal. The airplane eventually recovered.

The Board conducted computer simulations of both events. The Board concluded that the upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely caused by the movement of the rudder surfaces to their blowdown limits in a direction opposite to that commanded by the pilots. The rudder surfaces most likely moved as a result of jams of the secondary slides to the servo valve housings offset from their neutral position and overtravel of the primary slides.

The Board noted that the 737 is the only air carrier airplane with two wing-mounted engines designed with a single-panel rudder controlled by a single actuator. The Board concluded that the dual-concentric servo valve used in all 737 main rudder PCUs is not reliably redundant, and that a reliably redundant rudder actuation system is needed for the Boeing 737.

### Probable cause

The National Transportation Safety Board determines that the probable cause of the USAir flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.