快猫短视频

AT 6.57 pm on 8 September 1994, the pilot and co-pilot of USAir flight 427
were swapping recipes for fruit drinks with one of the flight attendants. The
aircraft, a Boeing 737-300, had just descended from its cruising altitude to
1800 metres as it prepared to land at Pittsburgh鈥檚 main airport. The evening was
calm and clear, and conditions were ideal for flying. Less than 10 minutes later
they were dead, identifiable only by the DNA in tissue remains. Parts of the
aircraft were buried so deep at the impact site 10 kilometres short of the
runway that metal detectors had to be brought in to find them. All 132 people
aboard were killed in the horrific crash.

Flight 427 was every passenger鈥檚 worst nightmare: the plane had fallen out of
the sky in broad daylight for no apparent reason. And it wasn鈥檛 the first time
that a Boeing 737 had crashed in mysterious circumstances. Investigators from
the National Transportation Safety Board (NTSB), the US government body which
investigates aircraft accidents, soon began to compare the crash with another
incident three years earlier. In that accident, United Airlines flight 585, a
737-200, nose-dived into the ground killing all 25 aboard as it was coming in to
land at Colorado Springs.

The crashes have remarkable similarities. Both 737s were coming in to land
after uneventful flights when something went dramatically wrong. The cockpit
voice recorders from both aircraft reveal the sounds of a startled crew
struggling to regain control, but give little indication of the problems they
were up against. Neither were investigators able to piece together what happened
using information from the flight data recorders, the 鈥渂lack boxes鈥� that record
basic information such as the aircraft鈥檚 height, orientation and speed. In fact,
investigators were about to close the file on the Colorado Springs accident
without reaching a conclusion, a rare event at the world鈥檚 leading air crash
investigation agency.

After the second mysterious accident, they decided to combine the
investigations into a probe that would turn into the most exhaustive,
longest-running inquiry of its type. Last year, after many false leads and dead
ends, the NTSB published its findings on the two accidents. While the
investigators now think they know what brought down both 737s and how to prevent
it happening again, the engineer who led the team that found the fault fears
that the resulting changes made to all similar aircraft may not have
completely removed the causes of the crash. And a wider-reaching safety
investigation initiated by the Federal Aviation Administration (FAA) appears to
have found another previously unsuspected problem.

Boeing began work on the 737 in the mid-1960s and the plane entered service
in 1968. It has been so successful that Boeing has produced a number of models
based on the design, some of which are still being produced. These aircraft,
known as Classic 737s, were the type involved in the crashes. In the late-1990s,
Boeing came up with a new design called the Next Generation 737.

Flying in circles

The Classic 737 design was somewhat different from similarly sized aircraft
of the time, such as the McDonnell Douglas DC-9, which had two engines clamped
close to each other towards the rear of the fuselage. Instead, the 737鈥檚 engines
are attached to the underside of its wings. While this has some significant
aerodynamic advantages, there is one major drawback. Should one engine fail, the
thrust of the other tends to make the aircraft fly in a circle. To provide a
compensating turning force when flying on one engine, the rudder built into the
737鈥檚 tail fin has to be much larger than on other aircraft.

In normal flight, 737 pilots rarely use the rudder鈥檚 full deflection. They
do, however, need to apply large deflections to keep the aircraft on course when
landing or taking off in a crosswind, for example. When a plane鈥檚 tail swings to
one side, a movement known as yawing, the airflow over the wings can become
asymmetric, causing the aircraft to roll. If the rudder isn鈥檛 returned to its
neutral position, the plane will turn onto its side, then upside down, after
which it becomes extremely difficult for the pilot to regain control.

Jet aircraft with swept-back wings also have a natural tendency to waggle
their tails from side to side, or 鈥渇ishtail鈥�. To combat fishtailing, many
aircraft, including the Classic 737, have a device called a yaw damper that
senses the waggle and automatically moves the rudder to compensate. These
corrections are usually so subtle that they go unnoticed by most passengers.

Within days of the Colorado Springs and Pittsburgh crashes, investigators
were confident that they were looking for a rudder problem. From black box data,
eyewitness accounts and radar records, they pieced together the aircraft鈥檚
flight path. Tom Haueter, an aeronautical engineer who was a principal
investigator for the NTSB on both crashes, became convinced that only a full
deflection of the rudder could account for it. 鈥淏it by bit we built this
enormous jigsaw puzzle and it indicated that the rudder was clearly
involved,鈥� says John Cox, a former 737 pilot who represented the US Air Line
Pilots Association on the investigation.

But the investigators still needed to know what had made the rudder move.
鈥淭he pilots could have done it or the airplane could have done it. We didn鈥檛
have enough data to say which happened,鈥� says Haueter. There had been pilots who
reported Classic 737 rudders suddenly jamming on one side or the other, forcing
the aircraft into a yaw from which they only extricated themselves with
difficulty. Could the same thing have happened to flight 427 and flight 585?

In the Colorado Springs investigation, the team suspected that grit or metal
shavings might have worked their way into the hydraulic system, causing it to
jam. So they examined the mangled remains of this part of the aircraft for the
telltale score marks that these particles should have left. There weren鈥檛 any,
nor were there any in the Pittsburgh-bound plane. As far as investigators could
tell, none of the parts in either rudder system appeared to be defective and all
the hydraulic components were machined to proper tolerances.

Meanwhile, the investigators explored a number of other avenues, though they
all lead nowhere. From the start, Boeing was reluctant to accept that its
aircraft might be at fault and began to come up with other leads for the team to
investigate. 鈥淲e鈥檙e dedicated to safety and if there鈥檚 anything we can do to
make the airplane safer, we are going to do it,鈥� says Eric Dixon, Boeing鈥檚
official spokesperson based at the company鈥檚 headquarters in Seattle. 鈥淲e looked
at several possibilities in both of these accidents and didn鈥檛 want to rule out
anything that could have been the cause. I think that鈥檚 sometimes
尘颈蝉耻苍诲别谤蝉迟辞辞诲.鈥�

One of Boeing鈥檚 suggestions was that the Colorado Springs crash was caused by
a horizontal whirlwind called a 鈥渞otor鈥� coming off the nearby Rocky Mountains.
Boeing said this could have tipped the aircraft into a dive from which the crew
couldn鈥檛 recover. However, the NTSB team decided that an experienced pilot would
have been able to pull up in time.

Next, Boeing proposed that the Pittsburgh crash was caused by the vortices
created by the wake of a larger aircraft landing 6 kilometres ahead of the
doomed plane. The NTSB carried out lengthy tests by flying a Classic 737 through
the wake of a larger plane but eventually discounted the idea. Finally, Boeing
proposed that the pilots had operated the rudder in error and caused the
accident themselves. Haueter found it hard to accept the idea that experienced
pilots would have done this. 鈥淚t goes beyond comprehension in my opinion, but
nonetheless we worked on it for a long time,鈥� he says. By early 1996, the
investigators had become stuck in these blind alleys and bogged down in the
bewildering mountain of data they generated.

To get things moving again, the NTSB chairman Jim Hall decided to break with
tradition and appoint a team of outsiders to continue the inquiry. Hall chose
Paul Knerr, a Californian hydraulics engineer with a reputation for methodical
thoroughness, to chair the new group. To Knerr and his group, the evidence
pointed to one thing: the rudder system, and in particular to a complex
hydraulic device called the power control unit or PCU.

The PCU controls the flow of hydraulic fluid that pushes the rudder to the
left or right in response to commands from the pilot or the yaw damper. The
fluid is pumped into a piston chamber from which it can only exit through ports
in the chamber wall. The position of the piston in the chamber determines which
ports are blocked and which are open.

The piston itself is a complex component containing a number of holes through
which the hydraulic fluid must pass. Within it is another piston that works like
the first: its position determines which pathways are open or blocked. The fluid
can flow only when the ports in the chamber wall and pathways through the first
and second pistons are all aligned. As the relative position of the two pistons
changes according to commands from the pilot or the yaw damper, the fluid is
routed down one line to move the rudder to the left, or down a different line to
move it to the right.

The PCU is located inside the tail fin but outside the heated cabin, so the
device gets very cold when the aircraft is flying high. The team began to wonder
what would happen if warm hydraulic fluid from the aircraft鈥檚 interior were
pumped into the freezing PCU. Could the sudden change in temperature cause the
outer piston to expand and stick鈥攑erhaps without leaving the telltale
scratch marks that the NTSB had expected to find?

The team鈥檚 thermal shock tests produced a real surprise. When the
investigators chilled a PCU to 鈥�40 掳C and pumped in fluid at 70
掳C, the outer piston jammed tight. However, the inner piston continued to
operate, and the team discovered that if it overran its position by less than
0.02 millimetres, hydraulic fluid would be directed down the wrong line. In
other words, the rudder would move in the opposite direction to what the pilot
intended. 鈥淚t took us six or seven months to get those tests set up, but once we
did, [the temperature difference] appears to have been part of the root cause,鈥�
said Knerr.

Jammed piston

This was just the breakthrough the investigation needed. Haueter theorised
that on each aircraft, the outer piston had become jammed, just as in Knerr鈥檚
tests. Then, in response to rudder commands from the pilots or from the yaw
damping system, the inner piston had overrun by a fraction of a millimetre,
causing the rudder to deflect fully in the opposite direction to the one
intended.

With this new evidence to hand, the NTSB declared itself satisfied and
recommended that the PCU be redesigned to prevent the overtravel of the internal
piston. All 1139 Classic 737s flying in the US have now been fitted with
redesigned units (the PCUs in Next Generation 737s have a different design).
Boeing has sent redesigned PCUs to the owners of all other Classic 737s and
believes that 95 per cent have been fitted. However, it cannot say for certain
whether airlines in all parts of the world have used them.

Knerr, however, is deeply unhappy with this turn of events. He believes his
tests may not have revealed the whole story of why the outer piston became
jammed. The tests were carried out using hydraulic fluid that was heavily
contaminated with silt, since this is common in Classic 737s. Knerr argues that
the unit might not have jammed if the fluid had been clean. Until the tests are
repeated with clean fluid, he says, nobody really knows why the PCU failed.
Temperature difference may have been what triggered the jamming, but other
factors such as silting could also have had a contributory role, and Knerr wants
to know what these factors are. 鈥淚 don鈥檛 understand how you can redesign a [PCU]
without knowing where it has malfunctioned in the first place,鈥� he says.

Even if Knerr is being overcautious, this may not be the end of the story.
Last year, a Classic 737 belonging to Metrojet, a small US regional airline,
experienced a full uncommanded deflection of the rudder while at cruising
altitude above Baltimore, from which the pilots recovered only with difficulty.
The jet had been fitted with the new PCU system, and Cox, who was part of the
team sent to investigate, is convinced that in this case the PCU was not at
fault. He says the rudder movement was much too slow to be explained by a
malfunction of the PCU.

But if not the PCU, then what? Could there be some other fundamental design
problem with the rudder system? The FAA, which is responsible for all aspects of
air safety in the US, cannot rule this out. It turns out that the Classic 737
has a long record of minor problems with its rudder: the NTSB has compiled a
list of more than 120 rudder-related incidents, while the corresponding number
for similarly sized DC-9 and MD-80 aircraft is just 3. Most problems can be
traced to faults with the yaw damper, but others remain unsolved.

These incidents have forced the FAA to re-evaluate the entire design of the
rudder system. Hall points out that the system lacks redundancy: if the rudder
jams, there is no back-up system that can take over automatically. In contrast,
other similarly sized aircraft have two-piece rudders so that if one section
jams the other section can compensate.

Hall also points out that the rudder systems and other controls in some
versions of the Classic 737 have not been subjected to the FAA鈥檚 strict approval
criteria, but were accepted on the basis that they had proven themselves safe in
older versions of the aircraft. The Next Generation 737s, however, have had to
meet these criteria. 鈥淚 expect that 1990s questions are going to bring 1960s
technology under a microscope, I have no doubt of that,鈥� says Cox.

To meet Hall鈥檚 concerns, the FAA has established a special task force based
in Seattle, called the 737 Flight Control Engineering Test and Evaluation Board.
The group is performing exhaustive tests on the Classic 737 rudder system, both
in the air and on the ground, to find out how it might fail. 鈥淭here鈥檚 not going
to be any stone left unturned when this is done,鈥� says Beth Erickson, the
director of the FAA鈥檚 Aircraft Certification Service, which is running the
tests.

Erickson says the job of wiring up and testing a leased Classic 737 should be
completed this year. Testing to date has, she says, largely vindicated the
design of the Classic 737鈥檚 rudder system鈥攚ith one significant exception.
鈥淚t鈥檚 a potential failure mode,鈥� Erickson says, but she won鈥檛 discuss any
further details.

Boeing declined to comment on the latest tests but it must be worried. There
are 2700 Classic 737s in service worldwide. If a new failure mode has been
spotted in tests, how long before the same problem crops up on a commercial
flight?