Skip Ribbon Commands
Skip to main content
Safety Recommendation Details

Safety Recommendation A-99-020
Details
Synopsis: On 9/8/94, about 1903:23 eastern daylight time, USAir (now US Airways) flight 427, a Boeing 737-3B7 (737-300), N513AU, crashed while maneuvering to land at Pittsburgh Int'l. Airport, Pittsburgh, PA. Flight 427 was operating under the provisions of 14 code of federal regulations (CFR) part 121 as a scheduled domestic passenger flight from Chicago-O'Hare Int'l. Airport, Chicago, Il, to Pittsburgh. The flight departed about 1810, with 2 pilots, 3 flight attendants, and 127 passengers on board. The airplane entered an uncontrolled descent and impacted terrain near Aliquippa, PA. All 132 people on board were killed, and the airplane was destroyed by impact forces and fire. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan.
Recommendation: TO THE FEDERAL AVIATION ADMINISTRATION: Require that all existing and future Boeing 737's have a reliably redundant rudder actuation system. (Supersedes Safety Recommendation A-96-107, A-96-109, A-96-112, and A-96-113)
Original recommendation transmittal letter: PDF
Overall Status: Closed - Acceptable Alternate Action
Mode: Aviation
Location: ALIQUIPPA, PA, United States
Is Reiterated: No
Is Hazmat: No
Is NPRM: No
Accident #: DCA94MA076
Accident Reports: Uncontrolled Descent and Collision With Terrain, USAir Flight 427, Boeing 737-300, N513AU
Report #: AAR-99-01
Accident Date: 9/8/1994
Issue Date: 4/16/1999
Date Closed: 7/31/2003
Addressee(s) and Addressee Status: FAA (Closed - Acceptable Alternate Action)
Keyword(s):

Safety Recommendation History
From: NTSB
To: FAA
Date: 7/31/2003
Response: In the letter that transmitted this recommendation to the FAA, the Safety Board cited the Boeing 757 and Boeing 767 as examples of airplanes that have reliably redundant rudder systems. The Board notes that the 757 and 767 are transport-category aircraft with twin wing-mounted jet engines, as is the 737. In the same letter, the Board noted that the 757 and 767 have three independent rudder actuators. Although the Boeing redesign for the 737 eliminates the dual concentric servo valve that the Safety Board regarded as compromising redundancy, it still uses a single actuator, with a standby rudder power control unit (PCU) that is independent of the main rudder PCU. The 737's rudder design remains unique, and there is no service history to demonstrate that it is reliably redundant. It is noteworthy that the 757 and 767 have not experienced rudder-related anomalies, incidents, or accidents such as those that have occurred in the 737. The redesign identified and addressed failure modes in the rudder system. The Safety Board considers the new system an acceptable alternative method of addressing the recommendation although it is unique and has not established a service history. With issuance of the AD, the FAA has completed work in response to Safety Recommendation A-99-20. Accordingly, it is now classified "Closed--Acceptable Alternate Action."

From: FAA
To: NTSB
Date: 4/8/2003
Response: Letter Mail Controlled 4/21/2003 4:48:23 PM MC# 2030212 On October 30, 2002, the Federal Aviation Administration (FAA) issued Airworthiness Directive (AD) 2002-20-07 Rl to mandate installation of a new rudder control system. The new rudder control system includes new components such as an aft torque tube, hydraulic actuators, and associated control rods, and additional wiring through out the airplane to support failure annunciation of the rudder control system in the flight deck. The AD removes any reference to superseding four of the seven ADS that were previously issued. The requirements of those four ADS will remain in effect until accomplishment of the installation of the new rudder control system and corresponding changes to the adjacent systems to accommodate that new rudder system. A copy of AD 2002-20-07 R1 is enclosed for the Board's information. Boeing has certified a newly designed rudder control system that will increase the redundancy by replacing the dual concentric servo valve in the existing rudder control system with two simplex valves with independent feedback linkages. The new rudder control system will be approved as an acceptable method of complying with AD 2002-20-07 R1. The first Boeing 737-600/-700/-800/-900 series production airplanes to incorporate the new rudder control system were delivered in January 2003. The Boeing service bulletins that.2 provide installation instructions for the new rudder control system in existing airplanes are scheduled to be issued as follows: · Boeing 737-600/-700/-800/-900 series airplanes March 2003. · Boeing 737-300/-400/-500 series airplanes June 2003 · Boeing 737-l00/-200 series airplanes September 2003. I will provide the Board with copies of the bulletins as soon as they are issued.

From: NTSB
To: FAA
Date: 8/6/2002
Response: In its letter dated April 25, 2001, the Safety Board stated that it would like more information regarding the Systems Safety Assessments (SSA) being conducted in support of Boeing's design changes. The FAA states that the information requested will be in the Boeing SSA for the Boeing 737 rudder control system which will be finalized by December 2002. However, due to the proprietary nature of the information contained in the SSA, the FAA cannot provide this information to the Board. The FAA has forwarded the Board's request to Boeing and asked that Boeing respond directly. Although the Board received a detailed briefing from Boeing this past spring on the new design, we have yet to receive the SSA information. The Safety Board believes that by developing the AD and working with Boeing to finalize the implementation of a revised reliably redundant rudder control system, the FAA is responding to this recommendation. The Board notes, however, that 3 years have passed since this recommendation was issued. The Board is concerned that the design revision will not be approved until December 2002, and that several more years will be required to produce and install the revised system in all Boeing 737s. Pending final issuance of the AD, review by the Safety Board of the SSA, and the FAA's evaluation to ensure that the new design will provide a reliably redundant actuator system, Safety Recommendation A-99-20 is classified "Open--Acceptable Response."

From: FAA
To: NTSB
Date: 5/7/2002
Response: Letter Mail Controlled 05/13/2002 12:30:44 PM MC# 2020479 On November 6, 2001, the Federal Aviation Administration (FAA) issued a notice of proposed rulemaking (NPRM) proposing to adopt an airworthiness directive (AD) to require the installation of a redesigned rudder control system on all Boeing Model 737 airplanes. The FAA determined that the need for a unique operational procedure and the inherent failure modes in the existing rudder control system, when considered together, present an unsafe condition. The NPRM, if adopted, should eliminate the unsafe condition. A copy of the NPRM was provided to the Board. On January 8, 2002, the NPRM was revised to extend the comment period. I have enclosed a copy of the revised NPRM for the Board's information. It is anticipated that the final AD will be issued by September 2002. Boeing is in the process of certifying a newly designed rudder control system that will increase the redundancy by replacing the dual concentric servo valve in the existing rudder control system with two simplex valves with independent feedback linkages. Boeing conducted a Critical Design Review for the redesigned rudder control system on December 4, 2001. In its letter dated April 25, 2001, the Board stated that it was unable to determine whether the proposed revisions to the Boeing 737 rudder actuation system would sufficiently address this safety recommendation. The Board stated that it would like more information regarding the Systems Safety Assessments (SSA) being conducted in support of the design changes. The Board stated that it would like to review, for each design, all of the analyses being conducted, including a Failure Modes and Effects Analysis, a Fault Tree Analysis, and a Cause Consequence Analysis. The Board further stated that pending receipt of this information, this safety recommendation will remain in an "open unacceptable" status. The information requested by the Board will be contained in the Boeing SSA for the Boeing 737 rudder control system. The SSA will be finalized (approved) by December 2002. Due to the proprietary nature of the information contained in the SSA, the FAA will forward the Board's request to Boeing and ask that Boeing respond directly to the Board. I will provide the Board with a copy of the final AD as soon as it is issued.

From: FAA
To: NTSB
Date: 1/30/2002
Response: Letter Mail Controlled 02/07/2002 9:47:16 AM MC# 2020125 On November 6, 2001, the Federal Aviation Administration (FAA) issued a notice of proposed rulemaking (NPRM) proposing to adopt an airworthiness directive (AD) to require the installation of a redesigned rudder control system on all Boeing Model 737 airplanes. The FAA determined that the need for a unique operational procedure and the inherent failure modes in the existing rudder control system, when considered together, present an unsafe condition. The NPRM, if adopted, should eliminate the unsafe condition. I have enclosed a copy of the NPRM for the Board's information. I will provide the Board with a copy of the final AD as soon as it is issued.

From: NTSB
To: FAA
Date: 1/14/2002
Response: Notation 7122A: The National Transportation Safety Board has reviewed the Federal Aviation Administration’s (FAA) Notice of Proposed Rulemaking (NPRM), “Airworthiness Directives; Boeing Model 737 Series Airplanes,” which was published in 66 FR 56783 on November 13, 2001. The NPRM proposes to supersede two existing airworthiness directives, applicable to certain Boeing Model 737 series airplanes, to require installation of a new rudder control system and changes to adjacent systems to accommodate the new rudder control system. The actions specified by the proposed rule are intended to prevent an uncommanded rudder hardover event and consequent loss of control of the airplane. The Safety Board notes that this NPRM is in response to Safety Recommendation A 99 20, which asked the FAA to: Require that all existing and future Boeing 737s have a reliably redundant rudder actuation system. On October 23, 2000, the FAA informed the Safety Board that it was planning to propose mandatory action requiring the installation of a redesigned rudder control system on all Boeing Model 737 airplanes. The FAA stated that the Boeing Company was pursuing a rudder system redesign, which increases the redundancy by replacing the dual concentric servo valve with two single slide valves with independent feedback linkages. The Boeing Company had scheduled a critical design review for the redesigned system for July 2001. Following the Boeing critical design review, the FAA stated that it planned to release an NPRM by August 2001, proposing to mandate installation of the redesigned rudder system. On April 25, 2001, the Safety Board responded that although encouraged by the FAA’s statements, the Board was unable to determine whether the proposed revisions to the Boeing 737’s rudder actuation system would sufficiently address this recommendation. The Board stated that it would like to have insight into the Systems Safety Assessments (SSA) being conducted in support of the design changes. As part of this insight, the Board indicated that it would like to review all of the analyses being conducted for each design, including a Failure Modes and Effects Analysis, a Fault Tree Analysis, and a Cause Consequence Analysis. The Board also stated that, to evaluate the reliability benefits of the new design, it would like to examine and compare the analyses used to support the SSA of the current Boeing 737 rudder actuation system design, the new design Boeing is considering, and any other rudder actuation system designs that were considered and rejected (for example, replacing the dual concentric servo valve and single actuator with two single slide valves and two actuators). The Board encouraged the FAA to share any further developments in response to this recommendation. The Safety Board notes that it has not received the information requested in the April 25, 2001, letter. Although the Safety Board fully supports modifications that will increase rudder system redundancy, it remains unable to determine if the proposed revisions to the Boeing 737’s rudder actuation system will sufficiently address Safety Recommendation A-99-20. According to previous briefings of the proposed design, the new design would have two independent servo valves operating one power control unit (PCU). The Board is concerned that the design does not provide full independence for the main PCU. It would appear the true redundancy would require two fully independent PCUs. Additionally, although the standby rudder PCU will be automatically activated in certain conditions, such a design is more complex and, therefore, may increase the number of possible failure modes compared to the installation of a third full-time independent PCU. The Safety Board appreciates the opportunity to comment on this proposed rulemaking.

From: NTSB
To: FAA
Date: 4/25/2001
Response: Although the Safety Board is encouraged by the FAA's statements, the Board is unable at this time to determine whether the proposed revisions to the Boeing 737's rudder actuation system will sufficiently address this recommendation. The Board would like to have insight into the Systems Safety Assessments (SSA) being conducted in support of the design changes. As part of this insight, the Board would like to review for each design all of the analyses being conducted, including a Failure Modes and Effects Analysis, a Fault Tree Analysis, and a Cause Consequence Analysis. In order to evaluate the reliability benefits of the new design, the Board would like to examine and compare the analyses used to support the SSA of the current Boeing 737 rudder actuation system design, of the new design Boeing is considering, and of any other rudder actuation system designs that were considered and rejected (for example, replacing the dual concentric servo valve and single actuator with two single slide valves and two actuators). The Board encourages the FAA to share any further developments in response to this recommendation. Pending receipt of further information from the FAA, and the Board's review of these details, Safety Recommendation A-99-20 remains classified "Open-Unacceptable Response."

From: FAA
To: NTSB
Date: 10/23/2000
Response: Letter Mail Controlled 10/26/2000 4:59:28 PM MC# 2001592 The Federal Aviation Administration (FAA) will propose mandatory action requiring the installation of a redesigned rudder control system on all Boeing Model 737 airplanes. The Boeing Company is pursuing a rudder system redesign, which increases the redundancy by replacing the dual concentric servo valve with two single slide valves with independent feedback linkages. The Boeing Company has scheduled a critical design review for the redesigned system for July 2001. Following the Boeing critical design review, the FAA plans to release a notice of proposed rulemaking by August 2001 proposing to mandate installation of the redesigned rudder system. I will provide the Board with a copy of the NPRM as soon as i is issued.

From: NTSB
To: FAA
Date: 4/12/2000
Response: In response to each of these three Safety Recommendations (A-99-20, A-99-21, and A-99-22), the FAA notes that it has convened an engineering test and evaluation board to conduct an in-depth failure analysis of the 737 rudder system. The FAA states that the engineering board will examine all of the issues specified in A-99-21 and, in addition, will also focus on any malfunction that could affect lateral/directional control. The FAA states that the engineering board consists of representatives from the FAA, Boeing, the Safety Board, the National Aeronautics and Space Administration, the Department of Defense, the Air Line Pilots Association, the Air Transport Association of America, and also includes engineers from the Ford Motor Company and from Iluyshin Aviation Complex (a Russian aircraft manufacturing company). The Safety Board supports the establishment of the engineering board and has been impressed with the results of its work to date. The engineering board has developed a substantial amount of additional information about failure modes in the 737 rudder system that were previously identified by the Safety Board, and has identified numerous additional potential failure modes. The engineering board's identification of these additional potential failure modes confirms the validity of the concern, expressed by the Safety Board in its report on the USAir flight 427 accident, that although two identified failure modes associated with rudder reversal had been eliminated by design changes to the 737 rudder system, additional unidentified failure modes might still exist. Therefore, pending receipt of the engineering board's final report, Safety Recommendation A-99-21 is classified "Open-- Acceptable Response." The engineering board's findings have reinforced the fact that the current 737 rudder system, even with its recent modifications, is not reliably redundant and that design changes are necessary. With regard to Safety Recommendation A-99-20, the FAA states that the engineering board will provide valuable insights, information, and data to determine an appropriate course of action. The Safety Board recognizes that some of the information being developed by the engineering board may be useful in connection with redesigning the 737 rudder system. However, the engineering board was not charged with and has not been, developing a reliably redundant rudder system for the 737 and, therefore, the establishment of the engineering board does not meet the intent of this recommendation. Waiting until the engineering board completes its work and publishes a report will only unnecessarily delay action that has already been demonstrated to be needed and that should have been undertaken as a parallel effort: the provision of a reliably redundant rudder actuation system on 737s. The Safety Board indicated in its report on the USAir flight 427 accident that reliable redundancy could be achieved by developing a multiple-panel rudder surface or providing multiple actuators for a single rudder surface. The Board also suggested two other possible methods by which redundancy might be achieved through use of the standby rudder system. Although the FAA states that it is working closely with Boeing to explore various design options for existing and future 737s, the FAA has not provided any information about progress on the design of a reliably redundant rudder system for the 737. Pending receipt of information about the design options being explored with Boeing and an approximate date when these options could be made available for existing and future 737s, Safety Recommendation A-99-20 is classified "Open--Unacceptable Response." Regarding Safety Recommendation A-99-22, the FAA states that it expects that information developed by the engineering board will determine an appropriate course of action for certification of future transport-category airplanes. However, it is unclear how information about the specific failure modes of the rudder system on the 737 (which is the only transport-category airplane with wing-mounted engines that has a single actuator/single rudder surface design) will assist the FAA in ensuring that transport-category airplanes certificated in the future will provide a reliably redundant rudder actuation system, as specified in Safety Recommendation A-99-22. The establishment of the engineering board does not meet the intent of this recommendation. Therefore, because the FAA has not yet taken action to directly address Safety Recommendation A-99-22, pending further appropriate action, it is classified "Open Unacceptable Response."

From: FAA
To: NTSB
Date: 2/24/2000
Response: Letter Mail Controlled 02/29/2000 11:50:04 AM MC# 2000322:

From: FAA
To: NTSB
Date: 6/25/1999
Response: Letter Mail Controlled 6/30/99 3:02:35 PM MC# 990699: The Federal Aviation Administration (FAA) has established an engineering test and evaluation board to conduct an in depth fault analysis of the rudder system. This group will provide the FAA with valuable insights, information, and data to determine an appropriate course of action. In the meantime, the FAA is working closely with the Boeing Company to explore various design options for existing and future Boeing 737 airplanes. I will keep the Board informed of the FAA's progress on this safety recommendation.