Uncontrolled Descent and Collision with Terrain, United Airlines 585, March 3, 1991

NATIONAL

TRANSPORTATION

SAFETY BOARD

WASHINGTON, D.C. 20594

AIRCRAFT ACCIDENT REPORT

PB2001-910401

NTSB/AAR-01/01

DCA91MA023

Uncontrolled Descent and Collision With Terrain

United Airlines Flight 585

Boeing 737-200, N999UA

4 Miles South of Colorado Springs

Municipal Airport

Colorado Springs, Colorado

March 3, 1991

5498C

this page intentionally left blank

Aircraft Accident Report

Uncontrolled Descent and Collision With Terrain

United Airlines Flight 585

Boeing 737-200, N999UA

4 Miles South of Colorado Springs

Municipal Airport

Colorado Springs, Colorado

March 3, 1991

NTSB/AAR-01/01

PB2001-910401 National Transportation Safety Board

Notation 5498C 490 L’Enfant Plaza, S.W.

Adopted March 27, 2001 Washington, D.C. 20594

National Transportation Safety Board. 2001. Uncontrolled Descent and Collision With Terrain,

United Airlines Flight 585, Boeing 737-200, N999UA, 4 Miles South of Colorado Springs Municipal

Airport, Colorado, Springs, Colorado, March 3, 1991. Aircraft Accident Report NTSB/AAR-01/01.

Washington, DC.

Abstract: This amended report explains the accident involving United Airlines flight 585, a

Boeing 737-200, which entered an uncontrolled descent and impacted terrain 4 miles south of Colorado

Springs Municipal Airport, Colorado Springs, Colorado, on March 3, 1991. Safety issues discussed in the

report are the potential meterological hazards to airplanes in the area of Colorado Springs; 737 rudder

malfunctions, including rudder reversals; and the design of the main rudder power control unit servo valve.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine,

pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board

Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study

transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board

makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and

statistical reviews.

Recent publications are available in their entirety on the Web at <http://www.ntsb.gov>. Other information about available publications also

may be obtained from the Web site or by contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 L'Enfant Plaza, S.W.

Washington, D.C. 20594

(800) 877-6799 or (202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To

purchase this publication, order report number PB2001-910401 from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(800) 553-6847 or (703) 605-6000

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports

related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

iii Aircraft Accident Report

Contents

Introduction to Amended Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv

1. Factual Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.1 History of Flight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.2 Injuries to Persons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.3 Damage to Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.4 Other Damage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.5 Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.5.1 The Captain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.5.2 The First Officer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1.5.3 Flight Crew Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1.5.4 Air Traffic Control Personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.6 Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.6.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.6.2 Maintenance History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.6.3 Boeing 737 Hydraulic System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.6.4 Boeing 737 Flight Control Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.6.4.1 Rudder Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.6.4.1.1 Main Rudder PCU and Servo Valve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

1.7 Meteorological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

1.7.1 Observations and Forecasts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

1.7.2 Topics from Meteorological Meeting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

1.7.3 Witness Information and Satellite Data on Vortices . . . . . . . . . . . . . . . . . . . . . . . . 34

1.7.4 Previous Accidents/Incidents Attributed to Vortices. . . . . . . . . . . . . . . . . . . . . . . . 35

1.7.5 Review of Information Obtained from A.J. Bedard, Jr., NOAA. . . . . . . . . . . . . . . 36

1.8 Aids To Navigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

1.9 Communications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

1.10 Aerodrome Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

1.10.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

1.10.2 Weather Related Accidents/Incident Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

1.11 Flight Recorders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

1.12 Wreckage and Impact Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

1.12.1 Engine Mount Examinations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

1.12.2 Examination of Roll and Pitch Flight Controls Components

and Other Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

1.12.2.1 Hydraulic System A and B Pressure Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . 45

1.12.2.2 Roll Control Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

1.12.2.3 Pitch Control Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

1.12.3 Examination of Yaw Control Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

1.12.3.1 System Main Rudder Power Control Unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Contents iv Aircraft Accident Report

1.12.3.2 Standby Rudder Actuator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

1.13 Medical And Pathological Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

1.14 Fire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

1.15 Survival Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

1.16 Tests and Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

1.16.1 Recorded Radar Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

1.16.2 Modeling and Simulations of Atmospheric Disturbances

and Airplane Flight Dynamics Conducted During the Initial

Investigation (1991/1992). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

1.16.2.1 Modeling of Atmospheric Disturbances (1991/1992): NCAR

Weather Study. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

1.16.2.2 Safety Board Simulations (1991/1992) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

1.16.2.3 Boeing Simulations (1991/1992). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

1.16.3 Detail Examination and Tests of Standby Rudder Actuator

Input Shaft and Bearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

1.16.3.1 Additional Standby System Actuator Binding/Jam Tests . . . . . . . . . . . . . . . . . . 66

1.16.4 Other Documented Rudder Control Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

1.16.5 Additional Examination and Testing of 737 Flight Control

Systems/Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

1.16.5.1 Detailed Examinations of Main Rudder PCU Servo Valves . . . . . . . . . . . . . . . . 72

1.16.5.2 PCU Servo Valve Chip Shear Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

1.16.5.3 PCU Thermal Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

1.16.5.3.1 Baseline Test Condition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

1.16.5.3.2 Simulated Hydraulic System Failure Condition . . . . . . . . . . . . . . . . . . . . . . 76

1.16.5.3.3 Extreme Temperature Differential Test Condition . . . . . . . . . . . . . . . . . . . . 76

1.16.5.3.4 Additional Testing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

1.16.5.4 Rudder Actuator Reversals During Servo Valve

Secondary Slide Jams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

1.16.5.5 Ground Demonstration of Rudder PCU Servo Valve Jam. . . . . . . . . . . . . . . . . . 83

1.16.6 Flight Performance Simulation Studies Conducted During

the USAir Flight 427 Investigation (1994-1999) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

1.16.6.1 United Flight 585 Simulation Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

1.17 Organizational and Management Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

1.17.1 United Airlines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

1.17.1.1 United Airlines Office of Flight Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

1.17.1.2 United Airlines Windshear and Irregular Procedures . . . . . . . . . . . . . . . . . . . . 104

1.18 Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

1.18.1 Study of Pilots’ (USAir Flight 427 and United Flight 585)

Speech, Breathing, and Other CVR-recorded Sounds . . . . . . . . . . . . . . . . . . . . . . . . . . 105

1.18.2 Comparison of Engine Sound Signatures From the United

Flight 585 CVR and a CVR From 737-200 Flight Tests . . . . . . . . . . . . . . . . . . . . . . . . 107

1.18.3 Ergonomics—Study of Maximum Pilot Rudder Pedal Force . . . . . . . . . . . . . . . . 108

1.18.3.1 United Flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

1.18.4 Conclusions Adopted in the USAir Flight 427 Report . . . . . . . . . . . . . . . . . . . . . 110

1.18.4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

1.18.4.2 Probable Cause. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

2. Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

2.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

2.2 Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Contents v Aircraft Accident Report

2.3 Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

2.4 Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

2.4.1 Hydraulic Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

2.4.2 Flight Control Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

2.5 Environmental Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

2.5.1 General Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

2.5.2 Characteristics of Horizontal Axis Vortex (Rotor) . . . . . . . . . . . . . . . . . . . . . . . . 125

2.5.3 Flight Simulations with Atmospheric Disturbances . . . . . . . . . . . . . . . . . . . . . . . 128

2.6 United Flight 585 Upset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

2.6.1 Computer Simulation Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

2.6.2 Human Performance Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

2.7 Rudder System Jam Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

2.8 Flight Data Recorder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

3. Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

3.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

3.2 Probable Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

4. Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

5. Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

A: Investigation and Hearing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

B: Personnel Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

C: Airplane Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

D: Cockpit Voice Recorder Transcript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

E: NCAR Weather Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

F: Review of Literature and Correspondence Related to Severe

Weather Phenomena . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

G: LLWAS Sensors and Plots of Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

vi Aircraft Accident Report

Figures

1. Boeing 737-200 hydraulic system panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

2. Three axes of motion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3. Boeing 737 flight control surface locations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4. Boeing 737 rudder system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

4a. Detailed view of 737 aft rudder system controls and linkages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

5. Boeing 737 main rudder PCU.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

6. Boeing 737 main rudder PCU schematic and installation.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

7. Boeing 737 main rudder PCU servo valve. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

8. Types of airflow over ridges: (a) laminar streaming; (b) standing

eddy streaming; (c) wave streaming; and (d and e) rotor streaming.

Dashed line on left indicates vertical profile of horizontal wind speed.. . . . . . . . . . . . . . . . . . . . . . . 30

9. Ground track with selected CVR data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

10. Profile view of flightpath with selected CVR data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

11. Standby rudder actuator.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

12. Normal operation of the 737 PCU servo valve with slides in the

neutral position (no jam). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

13. Normal operation of the 737 PCU servo valve with slides in the

extend command position (no jam). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

14. PCU servo valve intended operation with the secondary slide

jammed to the servo valve housing and primary slide opposing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

15. PCU servo valve with the secondary slide jammed to the servo

valve housing and the primary slide in the overtravel condition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

16. Pilot rudder pedal force positions for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

16a. Rudder surface positions for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

16b. Control wheel positions for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

16c. Heading data for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Figures vii Aircraft Accident Report

16d. Normal load factor data for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

16e. Pitch angle data for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

16f. Bank angle data for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

16g. Roll rate for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

16h. Yaw rate for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

16i. Wind direction for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

16j. Horizontal windspeeds for United flight 585. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

16k. Vertical windspeeds for United flight 585.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

17. Rudder surface positions for United flight 585 assuming a

sustained equivalent control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

17a. Control wheel surface positions for United flight 585 assuming

a sustained equivalent control wheel input. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

17b. Heading data for United flight 585 assuming a sustained equivalent

control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

17c. Normal load factor for United flight 585 assuming a sustained equivalent

control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

17d. Calibrated airspeed for United flight 585 assuming a sustained equivalent

control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

17e. Pitch angle data for United flight 585 assuming a sustained equivalent

control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

17f. Bank angle data for United flight 585 assuming a sustained equivalent

control wheel input.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

18. United flight 585 rudder surface positions according to Boeing’s new

rotor model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

18a. Rotational windshear encountered by United flight 585 according to

Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

18b. United flight 585 control wheel positions according to Boeing’s new

rotor model.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

18c. United flight 585 heading data according to Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . . . 101

Figures viii Aircraft Accident Report

18d. United flight 585 bank angle data according to Boeing’s new rotor model. . . . . . . . . . . . . . . . . . . 102

18e. United flight 585 normal load factor data according to Boeing’s new rotor model. . . . . . . . . . . . . 102

18f. United flight 585 pitch angle according to Boeing’s new rotor model.. . . . . . . . . . . . . . . . . . . . . . 103

ix Aircraft Accident Report

Introduction to Amended Report

On March 3, 1991, about 0944 mountain standard time, United Airlines flight 585,

a Boeing 737-291 (737-200), N999UA, crashed while maneuvering to land on runway 35

at Colorado Springs Municipal Airport, Colorado Springs, Colorado. Flight 585 was

operating under the provisions of 14 Code of Federal Regulations Part 121 as a scheduled

domestic passenger flight from Denver, Colorado, to Colorado Springs. Numerous

witnesses reported that, shortly after completing its turn onto the final approach course,

the airplane rolled steadily to the right and pitched nose down until it reached a nearly

vertical attitude before hitting the ground. The 2 flight crewmembers, 3 flight attendants,

and 20 passengers aboard were killed, and the airplane was destroyed by impact forces

and fire.

On December 8, 1992, the National Transportation Safety Board adopted a final

report on the accident. The Safety Board concluded that it “could not identify conclusive

evidence to explain the loss of United Airlines flight 585.”

In its probable cause

statement, the Board indicated that it considered the two most likely explanations for the

sudden uncontrollable upset to be a malfunction of the airplane’s directional control

system or an encounter with an unusually severe atmospheric disturbance. The Board

further indicated in its probable cause statement that, although anomalies had been

identified in the accident airplane’s rudder control system, it was unable to identify a

condition under which any such anomaly would have produced a rudder movement that

the pilots could not have easily countered by the airplane's roll controls. Additionally, the

Board concluded that weather conditions in the Colorado Springs area at the time of the

accident were conducive to the formation of a horizontal axis vortex (rotor) and that some

witness observations supported the existence of a rotor at or near the time and place of the

accident. However, the Board determined that too little was known about the

characteristics of rotors to conclude whether a rotor was a factor in the accident.

Additional rudder- and weather-related information pertinent to the United

flight 585 accident was developed after the Safety Board’s adoption of its December 1992

final report. This information was developed in the course of the Board’s investigation of

the September 8, 1994, USAir flight 427 accident, which included an investigation of the

June 9, 1996, incident involving Eastwind Airlines flight 517

and a reexamination of

certain aspects of the United flight 585 accident. In its final report on the USAir flight 427

National Transportation Safety Board. 1992. Uncontrolled Collision With Terrain for Undetermined

Reasons, United Airlines Flight 585, Boeing 737-291, N999UA, 4 Miles South of Colorado Springs,

Colorado, March 3, 1991. Aircraft Accident Report NTSB/AAR-92/06. Washington, DC.

The Eastwind flight 517 incident was a yaw/roll upset that occurred near Richmond, Virginia. The

pilots of Eastwind flight 517 were able to regain control of the airplane and land without further incident.

Introduction to Amended Report x Aircraft Accident Report

accident,

the Safety Board adopted several conclusions that supplement and, in some

cases, contradict those that the Board adopted in its December 1992 final report on the

United flight 585 accident. Accordingly, the Safety Board has determined that the original

United flight 585 report should be amended to reflect the information and conclusions

contained in the USAir flight 427 report.

In this amended report, new or revised text that was added as a result of

information developed during the USAir flight 427 accident investigation is shown with a

change bar along the outside of the page. Although some additional corrections and

revisions have been made, the remainder of the report is substantially the same as the

December 1992 report.

National Transportation Safety Board. 1999. Uncontrolled Descent and Collision With Terrain,

USAir Flight 427, Boeing 737-300, N513AU, Near Aliquippa, Pennsylvania, September 8, 1994. Aircraft

Accident Report NTSB/AAR-99/01. Washington, DC.

xi Aircraft Accident Report

Abbreviations

A/P autopilot

ACARS aircraft communications addressing and reporting system

AD airworthiness directive

AFF Air Force Academy

agl above ground level

AMA area minimum altitude

AMIS aircraft maintenance information system

ANR airplane nose right

APU auxiliary power unit

ARTCC air route traffic control center

ATA Air Transport Association

ATC air traffic control

ATI S automated terminal information service

ATP airline transport pilot

AWS Air Weather Service

BAC British Aerospace Corporation

CAT clear air turbulence

CFR Code of Federal Regulations

Cg center of gravity

COS Colorado Springs Municipal Airport

CSD constant speed drive

CVR cockpit voice recorder

CWA center weather advisory

Abbreviations xii Aircraft Accident Report

CWSU center weather service unit

DEN Denver Stapleton International Airport

EDP engine-driven hydraulic pump

EPR engine pressure ratio

F Fahrenheit

FA area forecast

FAA Federal Aviation Administration

FAR Federal Aviation Regulations

FDR flight data recorder

FL flight level

FT terminal forecast

GOES Geostationary Operational Environmental Satellite

gpm gallons per minute

Hg Mercury

HPT high pressure turbine

HRC Hardness Rockwell C (scale)

Hz Hertz

IFR instrument flight rules

ILS instrument landing system

KCAS knots calibrated airspeed

KIAS knots indicated airspeed

Abbreviations xiii Aircraft Accident Report

LIDAR Light Distancing and Ranging

LLWAS low level windshear alert system

LLWS low level wind shear

LPT low pressure turbine

LVDT linear variable displacement transducer

LWD left wing down

MAC mean aerodynamic chord

McIDAS Man Computer Interactive Data Access System

MEL minimum equipment list

MPCU main power control unit

MSA minimum sector altitude

msl mean sea level

MST mountain standard time

N1 engine fan speed

N2 engine compressor speed

NASA National Aeronautics and Space Administration

NCAR National Center for Atmospheric Research

NIDA National Institute of Drug Abuse

NOAA National Oceanic and Atmospheric Administration

nmi nautical mile

NOTAM notice to airmen

NPRM notice of proposed rulemaking

NTSB National Transportation Safety Board

NWS National Weather Service

OTS Officer Training School

Abbreviations xiv Aircraft Accident Report

P/N part number

PAPI precision approach path indicator

PCU power control unit

PIREP pilot report

psi pounds per square inch

PST Pacific standard time

RRWDS radar remote weather display system

RWD right wing down

SEM scanning electron microscope

SIGMET significant meteorological information

TRACON terminal radar approach control

UAL United Airlines

USAF U.S. Air Force

VFR visual flight rules

VMC visual meteorological conditions

VORTAC very high frequency omnidirectional radio range/ultra high

frequency tactical air navigation aid

ZDV Denver Center

xv Aircraft Accident Report

Executive Summary

On March 3, 1991, a United Airlines Boeing 737, registration number N999UA,

operating as flight 585, was on a scheduled passenger flight from Denver, Colorado, to

Colorado Springs, Colorado. Visual meteorological conditions prevailed at the time, and

the flight was on an instrument flight rules flight plan. Numerous witnesses reported that

shortly after completing its turn onto the final approach course to runway 35 at Colorado

Springs Municipal Airport, about 0944 mountain standard time, the airplane rolled

steadily to the right and pitched nose down until it reached a nearly vertical attitude before

hitting the ground in an area known as Widefield Park. The airplane was destroyed, and

the 2 flight crewmembers, 3 flight attendants, and 20 passengers aboard were fatally

injured.

The National Transportation Safety Board determines that the probable cause of

the United Airlines flight 585 accident was a loss of control of the airplane resulting from

the movement of the rudder surface to its blowdown limit. The rudder surface most likely

deflected in a direction opposite to that commanded by the pilots as a result of a jam of the

main rudder power control unit servo valve secondary slide to the servo valve housing

offset from its neutral position and overtravel of the primary slide.

this page intentionally left blank

1 Aircraft Accident Report

1. Factual Information

1.1 History of Flight

On March 3, 1991, a United Airlines (UAL) Boeing 737, registration number

N999UA, operating as flight 585, was on a scheduled passenger flight from Denver,

Colorado, to Colorado Springs, Colorado. Visual meteorological conditions (VMC)

prevailed at the time, and the flight was on an instrument flight rules (IFR) flight plan.

Numerous witnesses reported that shortly after completing its turn onto the final approach

course to runway 35 at Colorado Springs Municipal Airport (COS), about 0944 Mountain

Standard Time, the airplane rolled steadily to the right and pitched nose down until it

reached a nearly vertical attitude before hitting the ground in an area known as Widefield

Park. The airplane was destroyed, and the 2 flight crewmembers, 3 flight attendants, and

20 passengers aboard were fatally injured.

Flight 585 originated in Peoria, Illinois, and the intended destination was Colorado

Springs, Colorado, at 0946.

It had intermediate stops in Moline, Illinois, and Denver,

Colorado. The flight was conducted under the requirements of 14 Code of Federal

Regulations (CFR) Part 121. The airplane departed Peoria on schedule at 0500 and arrived

in Moline 6 minutes behind schedule at 0532. It departed Moline on schedule at 0600 and

arrived at the Denver Stapleton International Airport (DEN) at 0800, 13 minutes ahead of

schedule.

The pilots for the Peoria to Moline to Denver segments of the flight reported that

there were no open maintenance writeups or deferred minimum equipment list (MEL)

items in the airplane's maintenance log. The pilots reported no abnormal situations related

to the airplane during the flight to Denver. A scheduled crew change took place in Denver.

The cargo manifests for the flight indicated that no hazardous material was on

board. The cargo bay areas contained passenger baggage, spindle assemblies, a casket, and

printed papers. Loading personnel reported that all of the cargo was properly restrained by

the pit cargo net/stanchions installed in the cargo bins.

The weather briefing message that the flightcrew received before departing Denver

included the 0750 Aviation Surface Weather Observation for Colorado Springs, as

follows:

Clear, visibility 100 miles, temperature 49 degrees F, dew point 9 degrees F, winds

330 degrees at 23 knots, gusts to 33 knots, altimeter setting 30.03 inches of Hg, cumulus

over the mountains northwest.

All times are Mountain Standard Time (MST) based on the 24-hour clock, unless otherwise

indicated.

Factual Information 2 Aircraft Accident Report

The UAL mechanic who was responsible for receipt and dispatch of the flight

reported that during his routine exterior inspection of the airplane, he found that the latch

on the electronics and equipment (E and E) door was not in its normal flush stowed

position. He checked the security of the door and stowed the latch. He stated that, “other

than that [stowage of the latch], the aircraft departed normally.”

Flight 585 departed Denver at 0923. The captain was flying the airplane and the

first officer was making the radio transmissions. The airplane was scheduled to arrive in

Colorado Springs at 0946. While en route to Colorado Springs, the flightcrew sent an

aircraft communications addressing and reporting system (ACARS) message updating its

estimated arrival time to 0942.

The cockpit voice recorder (CVR) tape revealed that at 0930:37, the flightcrew

received automated terminal information service (ATIS) information, version “Lima,” that

was about 40 minutes old. ATIS “Lima” stated, in part:

Wind three one zero at one three gust three five; low level wind shear advisories

are in effect; local aviation wind warning in effect calling for winds out of the northwest

gusts to forty knots and above.

According to the CVR and flight data recorder (FDR), the flightcrew added

20 knots to the approach landing reference target airspeed based on the ATIS information.

The full CVR transcript is contained in appendix D.

At 0932:35, the first officer reported their altitude to Colorado Springs Approach

Control as 11,000 feet, saying that they had received ATIS information “Lima.” Approach

Control then told the flight to depart the “Springs” VORTAC (very high frequency

omnidirectional radio range/ultra high frequency tactical air navigation aid) heading

165 degrees for a vector to runway 35 for a visual approach. Wind information was issued

as 320 degrees at 13 knots, gusting to 23 knots. At 0934:06, a descent was issued to

10,000 feet, at the pilot's discretion, and a further descent to 8,500 feet was issued about

3 minutes later. The first officer then reported the airport in sight, and approach control

instructed them to maintain “at or above 8,500 until on base, runway 35, cleared visual

approach, contact tower 119.9." She repeated the instructions and contacted the tower.

At 0937:59, the first officer reported to the tower, “...cleared for a visual to 35."

The local controller then cleared the flight to land and issued the wind as 320 degrees at

16 knots with gusts to 29 knots. The first officer then confirmed that they were cleared to

land on runway 35, and asked whether there were any reports of a loss or gain of airspeed

from other airplanes. The local controller replied that the last report was the one reported

by a Boeing 737. The first officer then asked the controller, “could you repeat it please?”

At 0938:29, the local controller replied that a Boeing 737 reported a 15-knot loss at

500 feet, at 400 feet “plus 15 knots,” and at 150 feet, “plus 20 knots.” The first officer

replied, “sounds adventurous, uh, United five eighty five, thank you.”

Airport traffic was issued to the flight by the tower controller at 0940:07,

“...eleven o'clock five miles northwest bound straight in for runway three zero.” The first

Factual Information 3 Aircraft Accident Report

officer replied that they would look for him and then asked how many miles the traffic

was from them. The local controller replied, “eleven to ten o'clock and five miles for

United five eighty five.” The first officer replied, “five eighty five, roger.” At 0940:44, the

first officer asked the controller the whereabouts of the traffic. The local controller

transmitted, “United 585, the Cessna traffic is ten to nine o'clock now as you're in your

turn, passing behind you, no factor.”

At 0941:23, the local controller directed the flight, “after landing, hold short of

runway three zero for departing traffic on runway three zero.” The first officer replied

“we'll hold short of three zero United five eighty five.” This transmission was the last one

received from flight 585.

More than 60 witnesses were interviewed during the initial field phase of the

investigation and more than 100 other witnesses came forward during a followup visit to

the accident site area about a year later. The majority of the witnesses who observed the

flight of the airplane on March 3, 1991, indicated that although the airplane was flying at

an altitude that was lower than what they were accustomed to seeing, it appeared to be

operating normally until it suddenly rolled to the right and descended into the ground.

Many witnesses reported that the airplane rolled wings level momentarily (as it

lined up with the runway) and that it rolled to the right until it was inverted with the nose

nearly straight down. Some of them saw the nose rise during the initiation of the right roll.

One elderly couple, who was reportedly walking through Widefield Park at the

time of the accident, stated to another witness that a liquid substance from the airplane fell

onto their clothing which “smelled very bad.” Repeated efforts to find and interview this

couple have been unsuccessful. These efforts included a door-to-door search of the houses

in close proximity to the park, a circulated composite picture of the male, as well as local

radio and television news coverage.

One witness, who was about 6 miles west of the accident site, reported seeing

several rotor clouds

in the area of the accident, 10 to 15 minutes before the crash. That

witness said that the rotor clouds were accompanied by thin wispy condensation. Another

person, who passed west of the accident site between 0830 and 0900, reported seeing

“torn wispy clouds” in the area of the accident.

Some witnesses reported seeing a white mist in the area of the right wing about the

time that the airplane began its rapid roll to the right. No other witnesses in the park, or

along the flightpath, reported liquid falling from the airplane.

In the final minute of the flight, evidence from the recorded radar data, the CVR,

and the FDR indicates that the normal acceleration varied between 0.6 and 1.3 G. The

airspeed was at about 155 knots with 2 to 10 knot excursions. At 0937:32, the flight had

Rotor: A vortex of air generated about a horizontal axis by high winds over irregular terrain.

Characteristics are similar to but less severe than a tornado. Rotors are sometimes evident by a cloud that

appears in the form of a stationary roll usually on the leeward side of a ridge. When viewed from the air, a

rotor cloud looks like a line of cumulus clouds.

Factual Information 4 Aircraft Accident Report

been cleared for a visual approach to runway 35 at Colorado Springs and the airplane was

approaching the extended runway centerline at 300 degrees, consistent with a 45 degree

intercept of the final approach path to the airport. The indicated altitude was 8,000 feet

and a descent was just commencing. Ten seconds later, the heading began to change about

0.5 degrees per second until the heading was 320 degrees. The thrust of each engine was

reduced from about 6,000 pounds to about 2,000 pounds approximately 40 seconds before

the crash. At that time, the airplane began descending at about 2,200 feet per minute, a

rate greater than required to remain on a standard approach to the airport. Several seconds

later the thrust was increased to about 3,000 pounds per engine.

About 20 seconds prior to the crash, the rate of heading change increased,

consistent with a 20-degree bank angle and a turn for alignment with the runway. Sixteen

seconds prior to the crash, the thrust was increased to about 6,000 pounds per engine. As

the thrust was increasing, the first officer made the “1,000 feet” call. Within the next

4 seconds, and about 9 seconds prior to the crash, the heading rate increased to about

5-degrees per second to the right, nearly twice that of a standard rate turn. The first officer

said “Oh God,” followed by the captain, in the last 8 seconds, calling for 15 degrees of

flaps. This selection of 15-degrees flaps, in combination with increased thrust, is

consistent with the initiation of a go-around. The altitude decreased rapidly, the indicated

airspeed increased to over 200 knots, and the normal acceleration increased to over 4 G.

The airplane impacted relatively flat terrain 3.47 nautical miles south of the south

end of runway 35 and .17 nautical miles to the east of the extended centerline of runway

35 at the Colorado Springs Municipal Airport. All of the occupants on board the flight

received fatal injuries. The airplane was destroyed by impact forces and postcrash fire.

The accident site coordinates were 38 degrees, 44 minutes and 09.4 seconds north

latitude, and 104 degrees, 42 minutes and 42.4 seconds west longitude at an elevation of

5,704 feet above sea level. The accident occurred during daylight hours.

1.2 Injuries to Persons

Injuries Crew Passengers Others Total

Fatal

5 20 0 25

Serious

0 0 0 0

Minor/None

0 0 -- 0

Total

5 20 0 25

Factual Information 5 Aircraft Accident Report

1.3 Damage to Aircraft

The airplane was destroyed by ground impact and postcrash fire. The value of the

airplane was estimated by UAL to be $14,200,000.

1.4 Other Damage

There was no damage to structures on the ground. Trees adjacent to the impact

crater were damaged by flying debris and soot, and nearby patches of grass north and

northeast of the crater were scorched. The size of the impact crater measured

approximately 39 feet by 24 feet and was about 15 feet deep.

1.5 Personnel Information

The flightcrew consisted of the captain, first officer, and three flight attendants.

(See appendix B).

1.5.1 The Captain

The captain, age 52, was hired by United Airlines on May 15, 1969. He possessed

a current Airline Transport Pilot (ATP) certificate and a current first class medical

certificate. He had accrued a total flight time of 9,902 hours, of which 1,732 hours were in

the B-737-200 that included 891 hours as captain.

This landing was the captain's first at COS as the pilot-in-command. However, it is

likely that the captain had landed many times at COS in the 16 years he had worked for

UAL as a flight crewmember. During the accident flight, he commented to the first officer

that he had “never driven to Colorado Springs and not gotten sick” (0927:31), signifying

that this was probably not his first landing or first experience with turbulence on the

segment to COS. He had conducted 14 flights into and out of Denver during the 90 days

before the accident.

First officers who had flown recently with the captain described his strict

adherence to standard operating procedures and his conservative approach to flying. They

indicated that the captain briefed all approaches even in visual conditions, always reported

equipment malfunctions, and discussed deferred maintenance items with the first officer.

The first officers also reported that, if the captain had not previously flown with a first

officer, he would observe that first officer perform pilot-flying duties during the first leg

of a trip sequence. Further, a first officer who had previously flown with the captain in

gusty, turbulent weather reported during a postaccident interview that the captain had

advised him to conduct a go-around if windshear was encountered. The first officer stated

that the captain had indicated that he had no problem with an early go-around and had

encouraged the first officer to conduct a go-around if he thought the approach was unsafe.

Factual Information 6 Aircraft Accident Report

1.5.2 The First Officer

The first officer, age 42, was hired by UAL on November 21, 1988, held a current

ATP certificate and a current first class medical certificate. She had accrued a total flight

time of 3,903 hours, including 1,077 hours as first officer in the B-737. This landing was

her second at COS.

The captain of United flight 585 had flown a 3-day trip sequence with the United

flight 585 first officer a few weeks before the accident and had described her to a friend as

“very competent.”

1.5.3 Flight Crew Activities

According to UAL records, the captain and the first officer were paired together

on a 3-day trip beginning on February 22, 1991 (that ended 6 days before the accident

trip).

The captain was off duty on February 25 and 26, and then flew a 3-day trip

beginning on February 27. The last day of the trip began with a departure from Seattle,

Washington, at 0726 Pacific standard time (PST) and ended with an arrival at San

Francisco, California, at 1330 PST. This trip was followed by a 2-day trip beginning on

March 2 (the accident trip), which was the captain's last scheduled trip before a 2-week

vacation. From March 23 through 25, the captain was scheduled to perform his annual

proficiency check.

The first officer flew a 3-day trip beginning on February 25, and she was off duty

on February 28 and March 1. The accident trip was not scheduled, but she volunteered for

it the previous night. According to the scheduler, she did not know the identity of the

captain when she accepted the trip.

The accident trip began with a reporting time of 0545 PST at Oakland, California,

on March 2, and a departure at 0735 PST. The first day consisted of landings at Los

Angeles, California, and Sacramento, California, and ended at 1828 MST with a landing

at Denver. After flying, the crew checked into the hotel at Denver at 1915, according to

hotel records. A UAL pilot, who was acquainted with the first officer, said he spoke with

both crewmembers when they arrived at the hotel. He said that the first officer invited him

to join her and the captain for dinner at a nearby restaurant, but since he had already eaten,

he declined the invitation.

The next day the crew checked out of the hotel at 0721 and took the 0730 courtesy

bus to the airport. The UAL pilot, who was taking a different bus, said he spoke again

briefly to the first officer. He said that she appeared alert and that she asked him about

what she could expect on a trip to Colorado Springs since it would be her first flight to

that airport. The pilot advised her to check the weather ahead since it could be a short

flight, and the first officer indicated she was familiar with short flight segments. A

member of the UAL training staff said that he greeted the captain around 0815 outside the

Factual Information 7 Aircraft Accident Report

Denver Operations/Dispatch area and that the captain seemed fine and “didn't look

unrested.” The Denver Customer Service Agent, who handled the departure of the

accident flight, said that the captain commented “we'll be back in a few minutes” as the

agent was closing the door (referring to the fact that the flight was scheduled to return to

Denver after landing at Colorado Springs). He described the captain as a “real

confident-type guy” and “very nice fellow” who appeared to be in exceptionally good

spirits. He described the first officer as a quiet person who “had her mind on what she

needed to get done.” He indicated that both crewmembers appeared rested and seemed to

get along well.

A check of Federal Aviation Administration (FAA) records showed that neither

the captain nor the first officer had any prior accidents, incidents, or violations.

1.5.4 Air Traffic Control Personnel

The local air traffic controller who was working the No. 1 position in the Colorado

Springs tower at the time of the accident became a full performance level controller at that

facility on August 11, 1990. The controller who was working the ground control/flight

data position in the tower at the time of the accident became a full performance level

controller at Colorado Springs on September 13, 1990.

The radar south controller position at the Denver terminal radar approach control

(TRACON) at the time of the accident was staffed by a full performance level controller

who had been certified on March 20, 1990.

1.6 Airplane Information

1.6.1 General

The airplane, a Boeing 737-291 Advanced, serial number 22742, was

manufactured in May 1982. (See appendix C). It was powered by two Pratt & Whitney

JT8D-17 engines. The airplane was owned and operated by UAL. It had been acquired by

UAL from Frontier Airlines on June 6, 1986.

By the accident date, the airplane had accumulated 26,050 hours and

19,734 cycles. Its most recent “C” check and Heavy Maintenance Check-4 was

accomplished by UAL on May 27, 1990. At that time the airplane had accumulated

24,004 hours and 18,298 cycles.

Weight and balance information was computer generated by UAL's load planning

function. The computerized model used input from passenger service, fueling, and ramp

cargo functions to provide closeout information to the flightcrew through ACARS.

Flight 585 departed Denver at a takeoff gross weight of 77,859 pounds. The center of

gravity (CG) at the time of takeoff was 25.3 percent of mean aerodynamic chord (MAC).

The forward and aft CG limits at the takeoff weight were 5 and 31.4 percent MAC,

Factual Information 8 Aircraft Accident Report

respectively. The weight at the time of the accident was 76,059 pounds, and the CG was

25.7 percent. This was based upon an estimated fuel burn of 1,800 pounds which was

generated from UAL's historical fuel burn records for the airplane.

1.6.2 Maintenance History

All UAL Aircraft Maintenance Information System (AMIS) entries for N999UA

from December 15, 1990, to March 2, 1991, were reviewed by the Safety Board, as well

as all nonroutine items from the last Heavy Maintenance Check-4 and “C” check. All

AMIS entries listed by the Air Transport Association (ATA) Specification 100, chapters

22 (Autopilot), 27 (Flight Controls), and 29 (Hydraulic Systems) for February 1988

through January 1991 were also reviewed.

The records review revealed that there had been five writeups from January 30,

1991, to February 6, 1991, stating that the No. 1 engine pressure ratio (EPR) was sluggish

and slow to respond. The final corrective action was recorded as: “Replaced transmitters,

replaced indicators, checked lines and fittings for leaks, finally flushed manifold and

probes.”

On February 14, 1991, the flightcrew reported that the CAT II coupled approach

was unsatisfactory. They said that the airplane “tried to land to left of [the] runway.” The

corrective action was signed off as: “Accomplished full ground CAT II system check, OK.

Returned aircraft to CAT II status.” On February 15, 1991, the flightcrew reported: “Last

two coupled approaches have been excellent. Autopilot checks good per maintenance

manual.”

On February 25, 1991, the flightcrew reported: “On departure got an abnormal

input to [the] rudder that went away. Pulled yaw damper circuit breaker.” The corrective

action was signed off as: “Replaced yaw damper coupler and tested per [the] maintenance

manual.” Interviews with the flightcrew of that flight indicated that, at the time of the

event, the airplane was between 10,000 feet and 12,000 feet mean sea level (msl) at an

indicated airspeed of 280 knots, in smooth air with the landing gear and flaps up. The first

officer was flying the airplane with the autopilot off. The flight had just leveled off, and

the first officer was in the process of retarding the power levers to the cruise setting when

there was an uncommanded yaw. He estimated that the yaw was to the right 5 to

10 degrees. In the time that it took him to close the throttles, everything returned to

normal. The first officer did not recall any uncommanded movement of the rudder pedals.

The yaw damper was turned off and its circuit breaker was pulled before landing.

On February 27, 1991, a writeup by the flightcrew stated “Yaw damper abruptly

moves [the] rudder occasionally for no apparent reason on [the] “B” actuators. Problem

most likely [is] in [the] yaw damper coupler...unintended rudder input on climbout at FL

[flight level] 250. A/P [auto-pilot] not in use, turned yaw damper switch off and pulled

[the] circuit breaker. Two inputs, one rather large deflection....” The corrective action was

signed off as: “Replaced rudder transfer valve and [the] system checks OK.” Interviews

with the flightcrew of the flight revealed that the first officer was flying the airplane and

Factual Information 9 Aircraft Accident Report

indicated that he believed that his feet were on the rudder pedals at the time of the event.

While climbing through 10,000 feet, he said he experienced several rapid “jerks” that he

could not identify. The flight encountered light turbulence at the time. While continuing

the climb between 25,000 feet and 28,000 feet, he said he felt a significant right rudder

input which lasted between 5 and 10 seconds. The airplane was still in light turbulence

and at 280 knots. Although he was not sure if his feet were on the rudder pedals during

this later occurrence, he reacted by centering the ball with left rudder input and normal

flight was resumed. Both crewmembers looked up at the overhead panel and saw the

No. 1 constant speed drive (CSD) low oil pressure light illuminated. The yaw damper was

turned off and its circuit breaker was pulled. The CSD light went out, then came back on

about 5 minutes later. The CSD was disconnected, and no further anomalies were

experienced during the remainder of the flight or subsequent flights.

There were no open maintenance items when the airplane departed Denver on

March 3, 1991. No other maintenance items were found in the AMIS review that appeared

related to the accident circumstances.

All applicable Airworthiness Directives (ADs) had been complied with. Required

actions that were not yet accomplished were within the time limits specified in the AD.

The hydraulic rudder actuator, standby actuator, transfer valve, and yaw damper

coupler are “on condition”

items in the United Airlines maintenance program.

Subsequent to the records review, the history of the standby rudder actuator was

reviewed in detail because of discrepancies found during the actuator's disassembly (see

section 1.12.3.2 of this report.) The actuator was manufactured on October 3, 1981, by

Hydraulic Units, Inc.—now Dowty Aerospace. It had been installed on N999UA by

Boeing during manufacture of the airplane. It had not been removed from the airplane by

either Frontier Airlines or by UAL. It was identified by the manufacturer's part

number 1U1150-1 and Boeing part number BAC10-60797-4, serial number 0953.

1.6.3 Boeing 737 Hydraulic System Information

Hydraulic power on the 737-200 is provided by three independent hydraulic

systems, each of which is capable of operating pressures of about 2,950 pounds per square

inch (psi). The systems are designated as hydraulic system A, hydraulic system B, and the

standby hydraulic system. Hydraulic systems A and B have independent hydraulic

reservoirs and two hydraulic pumps each. Although hydraulic systems A and B normally

operate together to provide dual hydraulic power for primary flight controls (ailerons,

elevators, and rudder), either system is capable of powering the flight controls alone if the

other system fails. Further, if one of the hydraulic pumps in either the A or B systems

were to fail, the remaining pump has sufficient capacity to provide full flight control

authority for its respective system operation. If needed, the ailerons and elevators can also

“On condition” means that maintenance is performed only after a defect is noted during inspection,

rather than on a time or cycle basis.

Factual Information 10 Aircraft Accident Report

be operated manually, without hydraulic power, and the rudder may be operated with the

standby hydraulic system.

The 737-200 hydraulic system A is powered by two engine-driven hydraulic

pumps (one driven by each engine). The 737 hydraulic system A provides power for flight

controls, landing gear, nose gear steering, alternate brakes, inboard flight spoilers, engine

thrust reversers, and ground spoilers. The landing gear may be lowered hydraulically with

hydraulic system A power or released to a free fall manually.

The 737-200 hydraulic system B is powered by two electric motor-driven

hydraulic pumps (one driven by each engine). Hydraulic system B provides power for

flight controls, normal brakes, trailing edge flaps, leading edge flaps and slats, and

outboard flight spoilers.

The 737-200 standby hydraulic system is unpressurized during normal operations.

This system is powered by an electric pump and can be activated manually by the pilots

by arming “ALTERNATE FLAPS” or selecting the hydraulic system A or B flight control

switch to “STBY RUD” (standby rudder) on the overhead panel in the cockpit.

This

standby hydraulic system powers the standby rudder system, provides an alternate source

of power for both engine thrust reversers, and extends the leading edge flaps and slats in

the ALTERNATE FLAPS mode.

Two flight control hydraulic modules (one each for hydraulic systems A and B)

are installed. Each hydraulic module is a manifold assembly containing a spoiler shutoff

valve, flight control shutoff valve, low-pressure warning switch, and compensator

cartridge. The compensator cartridge maintains return fluid from the aileron, rudder, and

elevator power control units (PCU) after hydraulic system shutdown. This fluid is used to

compensate for volume changes in the hydraulic system because of temperature changes

or fluid loss. Motor-operated shutoff valves within the module are commanded to their

operating positions by the flight control system switches in the cockpit. Figure 1

illustrates the hydraulic system panel.

During normal operation, the hydraulic system A and B flight control switches would be in the ON

position and the ALTERNATE FLAPS switch would be in the OFF position.

Factual Information 11 Aircraft Accident Report

Figure 1. Boeing 737-200 hydraulic system panel.

1.6.4 Boeing 737 Flight Control Systems

The flight controls on the 737 are the ailerons, flight spoilers, elevators, horizontal

stabilizer, rudder, flaps, and slats. Flight control about the longitudinal (roll) axis of the

airplane is provided by an aileron on each wing assisted by two flight spoilers. Flight

OVERHEAT

LOW

PRESSURE

LOW

PRESSURE

LOW

PRESSURE

LOW

PRESSURE

YAW

DAMPER

MACH TRIM

FAIL

B LOW

QUANTITY

FEEL

DIFF PRESS

LOW

PRESSURE

STANDBY

HYD

LOW

QUANTITY

FLT CONTROL

SPOILER

YAW DAMPER

MACH TRIM

ALTERNATE FLAPS

LOW

PRESSURE

LOW

PRESSURE

1 ENG 2

1 ELEC 2

OFF

CLOSE OPEN

OFF

HYD PUMPS

GRD INTERCONNECT

A B

STDBY

RUD

OFF

A ON

STDBY

RUD

OFF

B ON

OFF

ARM

OFF

TEST

OFF

DOWN

OFF

Factual Information 12 Aircraft Accident Report

control about the lateral (pitch) axis is provided by the horizontal stabilizer and two

elevators. Flight control about the vertical or directional (yaw) axis is provided by the

single-panel rudder.

The ailerons and flight spoilers (roll control) are operated by moving

the control wheel clockwise or counter-clockwise,

the elevator (pitch control) is operated

by moving the control column forward or aft, and the rudder (directional/yaw control) is

operated by moving either the right or left rudder pedal forward or aft. Figure 2 depicts

the three axes of motion, and figure 3 shows the flight control surface locations.

Figure 2. Three axes of motion.

For more information about the rudder design, see section 1.6.4.1.

A clockwise control wheel input commands roll in a right-wing-down (RWD) direction, whereas a

counter-clockwise control wheel input commands roll in a left-wing-down (LWD) direction. In this report,

clockwise and counter-clockwise control wheel inputs will be described as right and left control wheel

inputs, respectively.

Factual Information 13 Aircraft Accident Report

Figure 3. Boeing 737 flight control surface locations.

Boeing stated that the 737 roll and yaw control systems were designed to be

capable of countering the effects of failures (such as loss of power on one engine, flap

and/or slat asymmetries, and hydraulic system failure) and achieve the desired crosswind

control capability. According to Boeing, the 737 is aerodynamically cross-coupled (as are

most airplanes); that is, motions about the roll and the yaw axes constantly interact and

affect each other in flight. Thus, any yawing motion (sideslip) would cause the airplane to

roll unless countered by the control wheel.

1.6.4.1 Rudder Control System

The 737-200 has a single rudder panel actuated by a single hydraulic rudder PCU.

A standby rudder actuator is available to move the rudder if hydraulic systems A and/or B

fail. According to a Safety Board review of large transport-category airplanes (including

Boeing, McDonnell Douglas, Airbus, and Lockheed models), the 737 is the only twin

wing-mounted engine, large transport-category airplane designed with a single rudder

panel and single rudder actuator. All other large transport-category airplanes with twin

wing-mounted engines were designed with a split rudder panel, multiple hydraulic

actuators, or a mechanical/manual/trim tab rudder actuation system.

Pilot control of the 737-200 rudder is transmitted in a closed-loop system from the

pilots’ rudder pedals in the cockpit through a single cable system to the airplane’s tail

section and then through linkages to the main rudder PCU and a standby rudder PCU in

the aft portion of the vertical stabilizer. The rudder pedals at each pilot position are located

on either side of the control column stem, which is protected within a housing (commonly

Angle of Airflow Sensors

Leading Edge Flaps

Leading Edge Slats

Flight Spoilers

Trailing Edge Flaps

Ailerons

Stabilizer

Balance Tabs

Elevator

Rudder

Ground Spoilers

Factual Information 14 Aircraft Accident Report

termed the “doghouse” by 737 flight crews) that is located between each pilots’ lower legs

at the pilot positions. Figures 4 and 4a show the 737 rudder system.

According to Boeing personnel, because of the engine placements on the wings,

the 737 rudder has to be sufficiently powerful to effectively counter the effects of a loss of

engine power on one side during a maximum gross weight takeoff at low airspeeds,

especially in crosswind conditions. A loss of engine power on one side of the airplane

would result in a large yawing moment, in the direction of the inoperative engine,

produced by thrust from the operating engine. The loss of engine power can be countered

by a rudder input in the opposite direction (for example, left pedal input to counter loss of

power on the right engine).

Figure 4. Boeing 737 rudder system.

The rudders on airplanes with fuselage-mounted engines are typically less powerful than the rudders

on airplanes with wing-mounted engines. The rudders for fuselage-mounted engine airplanes do not have to

be designed to counter as significant an asymmetrical thrust effect in the event of a loss of power on one

engine. Because the rudder on airplanes with fuselage-mounted engines is less powerful, the consequences

of a rudder hardover are less serious; thus, the Safety Board’s investigation did not consider this type of

airplane.

Standby Rudder PCU

Captain’s Rudder Pedals

Switch and Indicator

Rudder Control Cables

Aft Torque Tube

Feel and

Centering Unit

Left Rudder Motion

Electric Rudder Trim Actuator

Rudder Hinge

Line

Aft Rudder Power

Control Unit Input Rod

Rudder Main PCU

Factual Information 15 Aircraft Accident Report

Figure 4a. Detailed view of 737 aft rudder system controls and linkages.

When properly installed and rigged, the 737-200 main rudder PCU can command

a maximum deflection of 26° to the right and the left of the rudder’s neutral position

(under no aerodynamic load conditions); the rudder can travel to those limits at a

maximum rate of 66° per second. (The 737 main rudder PCU is capable of producing

about 5,900 pounds of output force to move the rudder when both hydraulic systems are

operating at their normal operating pressure—2,950 psi each.) The rudder pedals move

about 1 inch (from their neutral position) for every 6.5° of rudder surface travel (under no

aerodynamic load conditions) until the rudder pedals reach their maximum travel of about

4 inches (backward and forward) from the neutral position. The rudder pedal stops at the

pilots’ forward rudder control quadrant are set to provide a mechanical stop at 28° of

rudder travel (exceeding the rudder’s travel authority) because compliance in the cable

system (cable stretch) may require rudder pedal travel beyond the 4-inch limit to achieve

the full travel rudder movement of 26°. With the aerodynamic loads encountered in flight,

the available amount of rudder surface travel is reduced. The maximum amount of rudder

Upper Crank

Standby Power

Unit Input Rod

Aft Torque Tube

Center Crank

Lower Crank

(Bell Crank)

Rudder Power

Control Unit

Input Rod

Aft Rudder Control

Quadrant Input

Rod

Trim and

Feel Rod

Cable RB

Cable RA

AFT Quadrant

Factual Information 16 Aircraft Accident Report

travel available for an airplane at a given flight condition/configuration is referred to as

the rudder’s “blowdown” limit.

The rudder feel and centering unit is attached to the aft rudder torque tube in the

vertical fin, forward of the main rudder PCU (see figure 4). This unit holds the rudder at

the neutral (or trimmed) position when no rudder pedal force is applied. It also provides a

feedback force to the rudder pedals that increases as the rudder pedals are depressed. The

pilot rudder pedal force required for full rudder deflection is about 70 pounds; however,

the rudder trim system allows the pilots to maintain a rudder deflection without having to

maintain a rudder pedal force.

During normal and abnormal operations, the rudder can be moved beyond the

movement commanded by the hydraulic actuator through a pilot’s application of force on

the rudder pedals. (Normal operation of the rudder refers to the rudder’s motion, or lack

thereof, resulting from normal PCU servo valve operation. Abnormal operation refers to

the rudder’s motion that results from a PCU servo valve that is functioning abnormally,

for example, because of a rudder jam and/or reversal.

Both types of operation can

include rudder movement within the range of the rudder authority on the ground and/or to

the rudder’s in-flight blowdown limit.)

During normal rudder operation, if a pilot applies a sufficiently rapid rudder pedal

input (the rudder pedal must move faster than the PCU’s ability to respond to the input),

the PCU input crank would contact the PCU external body stop (manifold stop),

transmitting force from the rudder pedal input to the rudder surface through the main

rudder PCU and the rudder system's linkages. Also, the additional force applied by the

pilot would increase the rudder PCU output force, moving the rudder farther in the

intended direction of travel. The rudder feel and centering unit would oppose the rudder

pedal force (decrease the force applied by the pilot’s foot)

with about 9 to 70 pounds of

force, depending on how far the rudder is away from its centered position.

During normal operation of the rudder in flight, if a pilot applied between 9 and

70 pounds of force to a rudder pedal, the rudder would move in response until it reached

its blowdown limit (when the aerodynamic forces acting on the rudder surface equal the

hydraulic actuator force). According to Boeing engineers, if the pilot were to then apply

additional force to the rudder pedal, the pedal would move about 1 inch farther, with no

corresponding movement of the rudder, as the slack in the rudder linkage system is

removed and the external input crank contacts the external stop. Any additional pilot

application of force to the rudder pedal would result in rudder pedal movement of about

Rudder blowdown is the maximum rudder angle resulting from a pilot-commanded full rudder input

under the existing flight conditions. It represents a balance between the aerodynamic forces acting on the

rudder and the mechanical forces produced by the PCU. The maximum rudder angle can be increased

beyond that produced by the hydraulic force if the pilot exerts sufficient force on the rudder pedals.

Rudder reversals are discussed in sections 1.16.5.3, 1.16.5.4, and 1.16.5.5.

U.S. Air Force (USAF) ergonomic studies indicate that the maximum rudder pedal force pilots can

exert on the rudder pedals is about 500 pounds. For additional information regarding pilot rudder pedal

force, see section 1.18.3 of this revised report.

Factual Information 17 Aircraft Accident Report

1 inch for each 300 pounds of rudder pedal force, which in turn would move the rudder

surface slightly beyond the maximum deflection possible from the hydraulic actuator

force.

During a servo valve jam/rudder reversal, the rudder pedal force from a pilot

resisting the jam would cause the rudder to move in the direction opposite the jam (toward

the rudder’s neutral position). The feel and centering unit would add to the rudder pedal

force. As a pilot applied force to a rudder pedal in opposition to the jam/reversal, the first

inch of movement of the pedal would cause the PCU input crank to move to the PCU

manifold body stop. After the PCU input crank contacts the manifold body stop,

approximately 300 additional pounds of pilot rudder pedal force would be required to

move the rudder pedal each additional 1 inch of travel until the rudder pedal contacts the

forward quadrant stops. Pilot rudder pedal force in opposition to a jammed/reversing

rudder malfunction would reduce the deflection of the rudder.

The 737 rudder trim system allows the pilots to command a steady rudder input

without maintaining foot pressure on the rudder pedals. The primary purpose for rudder

trim is to compensate for the sustained large yawing moments generated by asymmetric

thrust in an engine-out situation. Pilots also sometimes use a small amount of rudder trim

during normal flight to compensate for slight yawing moment asymmetries such as those

caused by flight control and engine rigging imperfections. To trim the rudder on the

737-100 and -200, the flight crew turns a knob on the flight deck center pedestal that is

mechanically connected to the rudder trim actuator at the feel and centering unit. The

rudder trim actuator (located near the aft control torque tube in the vertical fin) rotates the

feel and centering unit, thus changing the neutral, or zero, position of the rudder. The

rudder trim moves within its maximum authority of ± 16°.

The 737 yaw damper system improves ride comfort by sensing turbulence- or

airplane-generated yaw motion and countering the yaw with rudder surface movement.

The system is initially activated by the yaw damper switch on the overhead panel in the

cockpit and is continuously engaged during normal operations; all inputs are automatic

and require no pilot action. The yaw damper system comprises the yaw damper control

switch and a yaw damper coupler, which includes a rate gyro that senses airplane motion

about the yaw axis and converts the motion to an electrical signal that is sent to the main

rudder PCU. An electrohydraulic servo valve (or transfer valve) converts the electrical

signal from the yaw damper coupler to PCU motion by directing hydraulic fluid from

hydraulic system B to move the rudder left or right. The yaw damper system also includes

a cockpit indicator of yaw damper activity.

Factual Information 18 Aircraft Accident Report

In the 737-200 series, the yaw damper can command up to 2° of rudder surface

deflection in either direction at a rate of 50° per second (when correctly

assembled/rigged).

Rudder movements that result from yaw damper system inputs do

not move the rudder pedals.

Figure 5 shows the main rudder PCU. Figure 6 shows the main rudder PCU

schematic and installation.

Figure 5. Boeing 737 main rudder PCU.

The 737-100 and -200 series airplanes’ yaw dampers were designed to command either ± 2 or ± 4° of

rudder authority. The 737-300 yaw damper was subsequently designed with ± 3° of rudder authority. Boeing

indicated that units permitting ± 2, 3, or 4° of rudder deflection may be used interchangeably on 737-100

and -200 series airplanes, and units permitting ± 2 or ± 3° of rudder deflection may be used interchangeably

on 737s in the -300, -400, and -500 series.

Servo Control Valve

Yaw Damper LVDT

Note: LVDT, linear variable displacement transducer

Factual Information 19 Aircraft Accident Report

Figure 6. Boeing 737 main rudder PCU schematic and installation.

1.6.4.1.1 Main Rudder PCU and Servo Valve

The main rudder PCU is powered by hydraulic systems A and B, each of which

provides about 3,000 pounds of output force to move the rudder, for a total output force of

about 6,000 pounds. The main rudder PCU operates by converting either a mechanical

input from the rudder pedals or an electrical signal from the yaw damper system into

motion of the rudder by means of mechanical linkages (summing levers, input cranks, and

shafts) and a servo valve that directs hydraulic fluid either to extend or retract the PCU

actuator rod that moves the hinged rudder surface.

Primary

Summing

Lever

Yaw Damper

Actuator

Compensator

Secondary

Summing

Lever

Compensator

Spring

Electrical

Connector

Yaw Damper

Position

Transmitter

Transfer Valve

Caging

Spring

Yaw Damper

Shutoff Valve

Primary

Valve

Secondary

Valve

Input

Shaft

Internal

Input

Crank

Dual

Concentric

Servo Valve

To Vertical Fin

A System - Off

B System - On

To Rudder

Tander

Actuator

Bypass

Valve

Power

Unit

Torque

Tube

System A

Input

Return

System B

Input

Rudder

Hinge Line

External

Summing

Lever

Input

Crank

(External)

Forward

Factual Information 20 Aircraft Accident Report

The body of the main rudder PCU is attached to the airplane vertical fin structure,

and the actuating rod is attached to the rudder. The PCU moves the rudder right or left

when actuated by rudder pedal or trim input or signals from the yaw damper. Rudder

pedal and trim input are transmitted to the PCU’s external input crank through an external

summing lever and linkage. The external input crank is also moved by feedback from

motion of the rudder, which comes from a mechanical system linkage (see figure 6). The

input shaft rotates, actuating the internal summing levers and moving the primary and

secondary slides of the servo valve.

The 737 main PCU servo valve was designed by Boeing and is manufactured to

Boeing specifications by Parker Hannifin Corporation. It is a dual-concentric tandem

valve composed of a primary slide that moves within a secondary slide that, in turn,

moves within the servo valve housing. The primary and secondary concentric slides are

moved by primary and secondary internal summing levers, which translate inputs from

the yaw damper

and/or the external input crank (which moves when a pilot steps on the

rudder pedals) into axial movement of the slides. Figure 7 shows an expanded view of the

servo valve.

Figure 7. Boeing 737 main rudder PCU servo valve.

When the yaw damper solenoid control valve is energized, 3,000 psi of hydraulic pressure is applied

to the transfer valve, which proportionally converts electrical signals from the yaw damper coupler into

hydraulic flow and control pressure. The control pressure moves the yaw damper actuator assembly piston

(mod piston), which moves the pivot point of the internal summing levers. The internal summing levers

move the primary and secondary slides of the servo valve from neutral, which causes movement of the

pistons in the actuator assembly. Movement of the yaw damper actuator piston generates a balancing signal

by the linear variable displacement transducer (LVDT), which assists in returning the transfer valve to the

neutral position. Feedback, provided through the external summing lever and linkage, returns the slides of

the servo valve to near neutral, which maintains hydraulic pressure to hold the actuator position against the

air load while not commanding further motion.

Primary

slide

Secondary

slide

Servo valve

housing

Factual Information 21 Aircraft Accident Report

When rudder motion is commanded (by the yaw damper, rudder pedal input,

and/or rudder trim), the internal input shaft moves the servo valve slides through the

internal summing levers to connect hydraulic pressure and return circuits from hydraulic

systems A and B so that hydraulic pressure is ported to the appropriate sides of the

dual-tandem actuator piston to extend or retract

the main rudder PCU piston rod. At the

same time, fluid is directed from the other side of the piston to the hydraulic return

system. As the rudder reaches the commanded deflection, external linkages reposition the

servo valve’s internal summing levers to nullify the initial command signal and arrest

further motion.

During normal operation, the primary summing lever applies force to move the

primary slide, and the secondary summing lever applies force to move the secondary slide

as needed. The primary slide is normally displaced first, and the secondary slide is

displaced only when the primary slide does not provide enough hydraulic flow to keep up

with the input commanded by the pilots or the yaw damper (that is, when the movement of

only the primary slide is not sufficient to move the rudder at the commanded rate). The

normal maximum axial movement from the neutral positions to the extreme travel

positions in either the extend or retract directions is about 0.045 inch for both the primary

and secondary slides, for a combined distance of about 0.090 inch. Both the primary and

secondary slides are designed so that they can move about 0.018 inch axially beyond their

normal operating range (overtravel capability).

The two slides are designed to provide approximately equal flow. Thus, the

primary slide alone can provide a rudder rate of about 33° per second, and the primary and

secondary slides together can provide a rudder rate of about 66° per second (under zero

aerodynamic load conditions).

The outside diameter surfaces of the primary and secondary slides are composed

of Nitralloy 135 that, in its prefinished form (slightly larger in diameter than its finished

form), is nitrided

to a depth from 0.005 to 0.008 inch to a surface hardness of 55 to 58 on

the Hardness Rockwell C (HRC) scale. The inside surfaces of the secondary slide and the

servo valve housing are made of 52100 hardened steel (surface hardness 57 to 62 on the

HRC scale). The outside diameter surfaces of the primary slide are very close to the inside

diameter surfaces of the secondary slide, and the outside diameter surfaces of the

secondary slide are very close to the inside diameter surfaces of the servo valve housing.

In a March 18, 1999, letter, Parker advised the Safety Board that two engineering

documents from 1966,

which were produced during prototype testing of the servo valve,

revealed that dimensional changes were made to the prototype because of conditions and

performance results observed during the initial testing. According to the letter, a

When the actuator moves in the extend direction, it commands left rudder; when it moves in the

retract direction, it commands right rudder.

Nitriding is a process in which the surface of the part is impregnated with nitrogen to increase

hardness.

These documents were located by Parker in response to requests made in the context of litigation

resulting from the USAir flight 427 accident.

Factual Information 22 Aircraft Accident Report

March 11, 1966, Parker engineering order modified certain dimensions in the servo valve

slightly to “insure accumulated tolerances will not cause reverse flow.” Additionally, the

letter stated that a December 9, 1966, Parker engineering order indicated that other

modifications were made “to preclude bottoming of [the] secondary slide at the detent at

the max[imum] tolerance stackup.” According to the letter, after the dimensional changes

were incorporated into the prototype servo valve’s design, it passed the acceptance test

procedure, and no further flow problems were noted. Parker personnel stated that no servo

valves with the original prototype dimensions were provided to customers. The letter

further stated, “as we can best determine, ‘reverse flow’ was used to refer to cross-flow or

higher internal leakage in the servo valve than is desirable…but had nothing to do with

reversal in the dual concentric servo valve” and indicated that “the reversal phenomenon

in the servo valve…was first seen in the 1992 examination of the…United Airlines

Boeing 737 rudder power control unit [which resulted from a July 16, 1992, anomaly

found during a ground check, as discussed later in this section and in more detail in

section 1.16.4]—rudder or servo valve reversal was not an issue recognized at the time of

the 1966 Engineering Orders.”

Before 1989, the servo valve assembly engineering drawings did not specify

diametrical clearances between the primary and secondary slides or between the

secondary slide and servo valve housing. However, “shop travelers” (manufacturing

documents that include instructions for specific tasks) used before 1989 indicated that the

minimum and maximum clearances were 0.00010 and 0.00015 inch, respectively. On

March 14, 1989, Parker released an engineering order that amended the servo valve

assembly drawings to specify minimum and maximum diametrical clearances of 0.00015

and 0.00020 inch, respectively, between the outside diameter of the secondary slide and

the inside diameter of the servo valve housing assembly and between the outside diameter

of the primary slide and the inner diameter of the secondary slide assembly.

According to Parker, the engineering drawing clearances normally allow the servo

valve assembly to pass the functional testing that is part of the acceptance test procedure,

and the servo valve components may then be individually polished based on functional

test results to obtain the proper ease of movement. Because of the variability in

dimensions of individual servo valve primary and secondary slides and the tight

clearances required by the design, the servo valve components are assembled, installed,

and maintained as matched sets.

Before 1992, the acceptance test procedure for the servo valve assembly was

based on compliance with performance standards. (According to Parker, each valve was

to be “trimmed”

until the desired functional performance was obtained.) Actual travel

(or overtravel) capability of the primary and secondary slides had not been measured. In

1992, as a result of findings from the main rudder PCU anomaly found during a July 1992

United Airlines ground check, Boeing established maximum axial distances between

metering edges for both the primary and secondary slides, and Parker instituted a

Trimming is the machine grinding of the outside diameter/groove interface that forms the metering

edges for the primary and secondary slides. Trimming moves the metering edges to new longitudinal

positions to better align the metering edges with the metering ports to meet functional test requirements.

Factual Information 23 Aircraft Accident Report

functional test. In addition, the FAA issued AD 94-01-07, effective March 3, 1994, which

required operators to test 737 main rudder PCUs at 750-hour intervals for internal

hydraulic fluid leakage until they are replaced with new PCUs containing servo valves

designed to prevent secondary slide overtravel.

In addition to the functional testing performed on each individual main rudder

PCU servo valve, one valve was subjected to qualification testing at the time of the 737’s

initial certification.

The purpose of this qualification testing was to ensure that the servo

valve would be able to withstand the operational and environmental stresses expected

during its life.

1.7 Meteorological Information

1.7.1 Observations and Forecasts

The 0850 and 0950 surface weather observations for March 3, 1991, made by

certified weather observers of the National Weather Service (NWS) at Colorado Springs

were, in part, as follows:

0850: Record, clear, visibility 100 miles, temperature 49 degrees F, dew point

9 degrees F, winds 330 degrees at 23 knots, gusts 33 knots, altimeter setting 30.03 inches

of Hg, cumulus over the mountains northwest.

0950: Record special, clear, visibility 100 miles, temperature 53 degrees F, dew

point 8 degrees F, winds 320 degrees at 20 knots, gusts 28 knots, altimeter setting

30.02 inches of Hg, altocumulus over mountains northwest.

The NWS office is located on the west side of the Colorado Springs airport. The

maximum wind speed determined from the NWS Wind Gust Recorder Record from 0930

to 0950 was 29 knots. The minimum wind speed from 0930 to 0950 was 7 knots. The

NWS wind sensor is located near the center of the airport about 10 meters above ground

level (agl).

The Low Level Windshear Alert System (LLWAS) at Colorado Springs was

operational on the day of the accident. It consisted of six sensors located around the

airport, each approximately 20 feet agl. Based on data from the LLWAS sensors, at

0932:43, the radar south controller in the Denver TRACON issued wind information to

the flightcrew as “320 at 13, gusts 23." About 0933:06, the LLWAS readout indicated

centerfield winds of 320 degrees, 13 knots, with gusts to 23 knots. These were the last

The qualification testing involved functional and environmental testing (including pressure,

vibration, and thermal testing) under conditions that replicated assumed operating conditions (based on

Boeing’s analyses). The redesigned servo valve being retrofitted on 737-100 through -500 series airplanes

and installed on the 737 next-generation (-600 through -900) series airplanes also underwent qualification

testing, and those tests included conditions that exceeded the assumed operating conditions (including

thermal conditions that simulated an overheated hydraulic system) to evaluate the component’s functional

limits.

Factual Information 24 Aircraft Accident Report

recorded gusts on the LLWAS readout before the accident. The printout of the data lasted

until about 0957.

Winds broadcast by the local controllers in the Colorado Springs tower just prior

to the accident were as follows:

• 0938:07: 320 degrees at 16 knots, gusts 29 knots.

• 0942:44: 300 degrees at 20 knots, gusts 30 knots.

• 0943:20: 300 degrees at 22 knots, gusts 30 knots.

These wind values were not consistent with the recorded LLWAS wind values.

Although the direction was consistent with the recorded data, the recorded wind speeds

were significantly lower than those broadcast by the controller. In an effort to try to

understand these inconsistencies, Safety Board investigators visited the FAA's

Aeronautical Center in Oklahoma City, Oklahoma, on April 30, 1991, and the LLWAS

data printout of wind values and approximate times were verified. The local controller, in

a subsequent interview, stated that the LLWAS was the only instrument in the tower cab

that indicated wind direction and speed. He stated that he had referred to the LLWAS

indicator for wind information when the airplane was on the local control frequency.

The Safety Board was unable to determine the reason for the discrepancy between

the recorded and broadcast LLWAS winds. The locations and plots of data from the

LLWAS sensors are contained in Appendix G.

A locally operated air quality network of meteorological sensors existed in the

COS area. Data from these sensors were obtained by the Safety Board. Some of the

pertinent data from the Pinello site, 2.7 miles northwest of the accident site, are listed

below:

Time WD

a. WD: Wind direction in degrees true

b. WS: Wind speed in miles per hour

c. T: Temperature in degrees C

0920 327.5 21.8 11.9

0930 314.2 20.8 12.1

0940 280.0 10.4 12.6

0950 327.2 6.4 13.4

1000 314.9 8.5 14.3

1010 ----- ----- ----

1020 193.8 11.1 13.1

Factual Information 25 Aircraft Accident Report

Wind direction and wind speed are 10-minute averages. The height of the wind

sensor is 10 meters agl. A continuous recording of wind direction for the Pinello site

showed a wind shift (northwest to southwest) about the time of the accident. The

maximum wind speed recorded did not exceed 16 mph during the period of 0940 to 0950.

The continuous recording of wind speed was not available because the recording pen ran

out of ink.

Acoustic Doppler radar data were obtained from the same network for the times

from 0930 to 1000 at the Nixon Base located 6.2 miles south of the accident.

A plot of the data of the Air Quality Network provided to the Safety Board by a

Certified Consulting Meteorologist of Greystone Development Consultants, Inc., showed

a wind shift line at 0940 and 0950 in the area of the accident. At 0940, winds north of the

wind shift line were from the northwest about 10 miles per hour and south of the line

southeast about 6 miles per hour. At 0950, winds north of the line were from the northwest

about 6 miles per hour and south of the line from the southeast about 5 miles per hour.

The Safety Board's Man Computer Interactive Data Access System (McIDAS)

was used to examine the wind data from the LLWAS and air quality network. The Safety

Board's examination of the data showed significant wind convergence and vertical axis

Height (Meters agl) WD

a. WD: Wind direction in degrees true.

b. WS: Wind speed in meters per second.

60 165 2.1

90 158 2.3

120 143 2.5

150 144 2.2

180 146 2.4

210 144 2.7

240 142 2.9

270 142 2.9

300 136 3.2

60 165 2.1

Interactive Meteorological Analysis and data management computer system. McIDAS is developed

and administered by the Space Science and Engineering Center at the University of Wisconsin, Madison,

Wisconsin.

Factual Information 26 Aircraft Accident Report

vorticity (rotation) in the area just south of the accident site around the time of the

accident.

The Safety Board calculated altimeter settings from station pressure values

obtained from stations in the Colorado Springs Air Quality Network and station pressures

obtained from the Air Force Academy (AFF). The Colorado Springs altimeter setting was

from the Colorado Springs surface weather observation for 0950.

All times for the altimeter settings listed below are for 0950.

Upper Air Data

Upper air wind data for 0700 for the AFF

is as follows:

Location

Altimeter Setting at 0950

(inches of Hg)

Distance/Bearing from Accident Site

AFF 30.03 14 miles N-NW

Chipita Park 30.07 17 miles NW

Woodmen Valley 30.06 11 miles N-NW

COS 30.02 4 miles N

Nixon Base 29.98 6.2 miles S

Nixon North 30.08 5.7 miles S

Height in feet agl Wind Direction (Degrees True) Speed (Knots)

500 295 9

1,000 290 10

1,500 290 16

2,000 290 21

2,500 295 25

3,000 295 28

4,000 305 35

5,000 310 43

6,000 325 51

AFF field elevation is 6,572 feet.

Factual Information 27 Aircraft Accident Report

Data from the Chatfield Profiler

(53 miles north-northwest of the accident site)

showed a wind speed of 39 knots from the northwest at 6,600 feet increasing to a wind

speed of 142 knots from the northwest at about 14,900 feet. The Profiler data were

centered around a time of 0830.

The following relevant Pilot Reports (PIREPs) were made the day of the accident:

At 0615, a B-747 at FL370, 10 nautical miles south of Denver reported moderate

turbulence and a moderate mountain wave.

• While over Colorado Springs at 0628 during a descent, a B-737 encountered

+20-to -30-knots on final approach to runway 35.

• At 0732, a B-737 encountered severe turbulence at FL200 approximately

46 nautical miles south southwest of Denver. It lost about 400 feet during the

encounter.

• At 0755, a B-727, at FL310, encountered a moderate mountain wave

of +/ -40 knots approximately 48 nautical miles northwest of Denver.

• At 0815, a Beech 36 at FL200, 30 nautical miles southwest of Denver, reported

“500 to 1,500 feet (per minute) downdrafts...unable to maintain altitude.”

• Over the Colorado Springs, Pueblo area, at 0850, a Cessna 172 reported

moderate to extreme turbulence between 7,000 and 8,000 feet.

• At 0900, a B-737 at FL350, 55 nautical miles west southwest of Denver,

encountered moderate chop in mountain waves.

• Over the Colorado Springs, Pueblo area, at 0916, at 9,000 feet, several aircraft

reported moderate to severe turbulence at or below 9,000 feet.

• At 0920, a B-737 at 500 feet, while on final approach to runway 35 at

Colorado Springs, reported low level wind shear of -15 knots at 500 feet,

+15 knots at 400 feet, and +20 knots at 150 feet.

• The captain of Continental flight 166, a B-737-200, who departed runway 35

at COS, about 4 minutes after the accident, reported gusty winds but no wild

gyrations. He said it was a normal Colorado windy day.

• The pilot of a Cessna airplane who was located about 4 miles northeast of the

accident at the time of the accident, reported slight, occasional, moderate chop

at 7,000 feet. Also noted were indicated airspeed fluctuations between 65 and

105 knots with vertical speed indications of approximately 500 feet per

minute.

• The captain of UAL flight 714, a Boeing 737-300, who departed runway 30,

COS, at 0905, reported light chop with one “good sinker.”

Vertically pointed radar that is used to measure winds in the atmosphere.

A wave in the atmosphere which is caused by and is therefore stationary with respect to the

mountain.

Factual Information 28 Aircraft Accident Report

The following in-flight weather advisory was pertinent to the time and area of the

accident:

• SIGMET (significant meteorological information) Juliet 1, valid from 0915 to

1315 local, called for mountains

(sic) occasional severe turbulence

18,000 feet to 38,000 feet reported by 737 and 727.

Information pertinent to the accident contained in the Area Forecast (FA), issued

by the National Aviation Weather Advisory Unit in Kansas City, Missouri, at 0445 on

March 3, and valid until 1000 on March 3, was as follows:

• Flight precautions: Turbulence.

• Light occasional moderate turbulence below 20,000 feet with local strong up

and downdrafts over and near the mountains.

The Terminal Forecast (FT), issued by the NWS Forecast Office in Denver,

Colorado, for COS, in effect for the time of the accident is as follows:

• COS FT...0728 to 1000...Clear, winds 340 degrees at 20 knots gusts 35 knots.

An Aviation High Wind Advisory issued by the NWS at COS, valid from 0800 to

1400, was in effect for COS. It called for northwest winds 25 knots with possible

occasional gusts to 40 knots, especially in the foothills.

The NWS observer on duty at the time of the accident was certified to make

surface weather observations. He had been at COS since May 1990, and worked the 0800

to 1600 shift, which he characterized as routine. He said that from 0900 to 1000 the winds

were gusty and the wind direction varied about 20 to 30 degrees.

The Denver Air Route Traffic Control Center Weather Service Unit (CWSU)

meteorologist who was on duty at the time of accident worked the 0600 to 1400 shift. He

had been at the Denver CWSU since November 1990. About 0705, he provided an area

briefing (Area 3, which included the COS area) to the area manager in charge. A copy of

the briefing was provided to the supervisor. The briefing forecast was for light to

moderate turbulence below 40,000 feet with isolated severe turbulence at and below

18,000 feet. He was aware of moderate and severe turbulence reports pertinent to

Denver's airspace, including some severe turbulence reports below 20,000 feet. He did not

issue a Center Weather Advisory (CWA) for severe turbulence because he believed the

requirements for issuance were not met. Requirements for a CWA are to supplement or

enhance SIGMETs. He stated that the Radar Remote Weather Display System (RRWDS)

was not showing any precipitation echoes in the area of COS at the time of the accident.

The RRWDS was set to the Limon, Colorado, NWS weather radar.

The forecaster at the National Aviation Weather Advisory Unit in Kansas City,

Missouri, stated that he did not issue a SIGMET for low level turbulence for the area of

About 1030, “mountains” in Juliet 1 was corrected to “moderate.” The SIGMET and corrected

SIGMET were issued by the National Aviation Weather Advisory Unit in Kansas City, Missouri.

Factual Information 29 Aircraft Accident Report

COS because most pilot reports were of moderate intensity and were local in nature. In

addition, light to moderate turbulence below 20,000 feet was forecast in the FA.

The Aviation Forecaster at the NWS Forecast Office at Denver did not append a

low level wind shear (LLWS) remark to the COS FT. The forecaster stated that analyses of

the continuously available profiler data (wind speed and direction) at Denver indicated

that the remark was not necessary. In addition, the forecaster never saw the 0920 pilot

report that indicated a 20-knot gain of airspeed by a B-737. NWS forecasters do routinely

look at pilot reports; however, the forecaster stated that this might have been an oversight.

Weather observations from the AFF indicated that there were rotor clouds to the

west between 0700 to 0900. Rotor clouds were not reported on the next observation.

According to weather personnel at Peterson Air Force Base, collocated with COS, rotor

clouds have been observed previously in the area of the airport in COS but that such an

occurrence is uncommon. The weather radar at Peterson did not detect any weather

echoes at 0950. Due to strong gusty surface winds, there was an LLWS Advisory in effect.

The Safety Board was informed by A. J. Bedard, Jr.,

National Oceanic and

Atmospheric Administration (NOAA), that atmospheric rotors can occur in the area

where the accident occurred. He stated that atmospheric rotors can occur some distance

downwind from the front range of the mountains and can be quite strong.

A sailplane pilot, who flies in the area north of COS, was interviewed by Safety

Board investigators and stated that he thought the existence of a mountain wave and

atmospheric rotor in the area of the accident was possible. He added, however, that he

believed the rotor would be farther south than usual. He said that he had flown in many

rotors and that, on occasion, he had nearly lost control of his sailplane. He said that it was

possible for a rotor to come close to the ground. He mentioned that he had seen tow planes

penetrate rotors, a situation that resulted in bank angles of 90 degrees.

Another sailplane pilot, who had 15 years experience in mountain wave flying in

the COS area, stated that he was at Meadow Lake (14 miles northeast of the accident)

planning to fly on the morning of the accident. After talking to a pilot who terminated his

flying because of “turbulent, squirrely conditions,” he decided not to fly. He commented

that it is “not uncommon” for rotor clouds to touch the ground at the AFF and the

monument area north of COS. He also said that the rotor clouds did occur south of COS,

although they were rare.

According to the World Meteorological Organization, the base of rotor clouds is

generally near or below ridge lines, yet the tops may be considerably higher than ridge

lines and may merge with the lenticular clouds [lens-shaped] directly above. Unlike the

lenticular clouds, rotor clouds show evidence of strong and occasionally violent

turbulence. They are constantly forming on the windward side and dissipating on the

leeward side and appear to rotate--the upper portion moves forward while the lower

portion moves backward towards the mountain. A succession of rotor clouds may appear

Supervisory physicist for the Wave Propagation Laboratory, Boulder, Colorado.

Factual Information 30 Aircraft Accident Report

at regular intervals downwind from the mountain ridge. Rotor clouds develop in standing

eddies that form in the lower layers under the crests of the mountain wave. Lenticular

clouds may be visible above these clouds. However, rotor clouds often provide the only

visible evidence of the mountain wave. Clouds may or may not occur with rotors,

depending on the moisture profile of the atmosphere. Therefore, rotors may be invisible to

the eye. (See figure 8).

Figure 8. Types of airflow over ridges: (a) laminar streaming; (b) standing eddy

streaming; (c) wave streaming; and (d and e) rotor streaming. Dashed line on left

indicates vertical profile of horizontal wind speed.

A glider instructor, who had been in the COS area for more than 25 years, was

interviewed. He stated that around 1200 on the day of the accident, he observed a rotor hit

Factual Information 31 Aircraft Accident Report

the ground with estimated wind speeds of 70 to 80 miles per hour. He was inside a

building at a wrecking yard when he heard the roar of the wind. He then went outside and

saw a rotor impacting the ground in the yard, which he said was about 1/2 mile east and

5 miles north of the extended centerline of runway 35 at COS. Tree limbs were blown off

and car hoods were damaged. He believed that the rotor was part of a line of rotors

extending north to south which would most likely have extended to the area where the

accident occurred. He stated that the year's weather activity had been highly unusual with

many days of strong downslope winds and rotors. He said that he had experienced vertical

velocities of 5,000 to 6,000 feet per minute in rotors and that rotors can be as small as a

“gymnasium” or many miles long. He added that the force of rotors impacting the ground

has severely damaged houses, railroad cars, and trucks.

In a subsequent written statement, the instructor told the Safety Board that the

wrecking yard was about 12 statute miles north of COS and 1 statute mile east of the

extended centerline of its runway 17-35 and that the elevation was 7,300 feet. He stated

that on the morning of March 3, 1991, he observed a rotor system on a line parallel to the

Front Range, passing over the wrecking yard and other points north and south, especially

south because of the angle of Pikes Peak, Mt. Rosa, and Cheyenne Mountain with the

northwest prefrontal wind. He said that on the morning of the accident, there was an

unusually strong prefrontal weather system and a sky full of rotor clouds. He added that

he had flown gliders into vertical velocities of more than 5,000 feet per minute in and

around rotor/wave systems and that pitch changes of 60 degrees and roll changes of 180

degrees (inverted) are not uncommon.

A Continental Airlines pilot, who had flown in the COS area since 1965, stated

that during strong mountain wave conditions, rotors have occurred over the approach to

runway 35. He said that he has flown in rotors in the COS area in T-37, T-38, and B-727

airplanes, but that any roll activity was countered by aileron application without difficulty.

He has seen airplanes roll to 45 degrees in rotors. On the day and approximate time of the

accident, he observed a lenticular cloud over Pikes Peak. He stated that given the right

conditions, rotors can exist along the route from Denver to COS. The rotors are

accompanied by moderate to severe turbulence. He said that he has heard from many

pilots that the area south of COS is extremely rough to fly. He added that during suitable

conditions, a primary wave is located over Manitou Springs (16 miles northwest of the

accident site), a secondary wave is just north of the AFF, and a “tertiary” wave extends

over COS.

The Weather Briefing Message, printed March 3, at 0808, for the Denver (DEN) to

COS segment, provided to the crew of flight 585 by UAL consisted of map features,

origin, destination, and alternate weather, destination area weather; PIREPs, and en route

NOTAMs. The map features section was valid from March 3 mountain standard time to

March 4 mountain standard time. It was a description of the maximum wind speed and

location, the 0200 surface pressure center, frontal position, and VFR conditions predicted

for the Rockies.

The DEN weather included surface observations for 0551, 0652, and 0750; the

DEN NWS FT valid from March 3 to March 4, and the UAL DEN FT and DEN

Factual Information 32 Aircraft Accident Report

NOTAMs. The observations indicated clear skies, 70 miles visibility, and northwest winds

with gusts to 19 knots. Both the NWS and UAL Terminal Forecasts were similar and

called for VFR conditions.

The COS weather included the 0551, 0650, and 0750 surface observations, the

COS NWS FT Amendment 2, and the COS NOTAMs. The surface observations indicated

clear skies, unlimited visibility, and northwest winds gusting 31 to 37 knots. The FT

called for VFR conditions with winds 340 degrees at 20 knots, gusting to 35 knots. No

weather was included for an alternate airport, nor was any required.

UAL meteorologists issue routine forecasts for clear air turbulence (CAT) and

mountain waves over the United States. In addition, forecasts for nonconvective LLWS

were issued for only major hubs and COS was not covered.

At 0825, on March 3, UAL issued a CAT mountain wave forecast covering

Montana, Wyoming, and Colorado, for FL200 to 390, valid 0825 to 2000.

1.7.2 Topics from Meteorological Meeting

The Safety Board's Meteorology Group convened a meeting in Boulder, Colorado,

on March 27, 1991, with scientists from NOAA, the National Center for Atmospheric

Research (NCAR) and the University of Wyoming to discuss orographically generated

weather phenomena that might be pertinent to the accident. The topics raised were

historical in nature and were not present on March 3, 1991, except as noted. The following

are points raised during the meeting that the participants agreed upon:

• The parameters of a representative atmospheric rotor are as follows: a radius of

500 meters; a linear increase of tangential velocity from the center to

500 meters. Velocity at a radius of 500 meters is 30 meters per second. The

change in velocity is 30 meters per second per 500 meters. Outside a radius of

500 meters, the tangential velocity decreases as 1/radius. The rotational rate of

the core mass would be 0.06 radians per second or 3.5 degrees per second.

This information was obtained from 2 measurements of Doppler Lidar and

FM/CW Doppler Radar, conferences with other scientists, and time lapse

movies.

• Surface pressure drops of as much as 10 millibars can be expected in strong

eddies.

• Observations were made in the Boulder area of trash cans flying up the streets

at high speed and then flying back down the streets at high speed.

• A documentary film demonstrated that vertical axis rotation of lenticular

clouds can reach speeds of 10 meters per second and heights of 3 to

4kilometers.

Factual Information 33 Aircraft Accident Report

• Important accepted meteorological parameters in obstacle flows are wind

speed strength, variation of wind speed with height, variability of wind

(gusts/surges), angle relative to obstacle, obstacle shape and height, relative

position of obstacles, stability of the atmosphere (temperature variation with

height), and humidity.

• The numerical modeling of leeward waves is complicated. There is a strong

interaction of leeward waves with the surface.

• Caution must be used in applying surface data to determine conditions aloft.

• There are not many measurements of atmospheric rotors. Rotors can form in

lines several hundred kilometers long. The front of the rotor has the most

severe turbulence.

• In the past, horizontal gusts have existed at high altitude (40,000 feet), 60 to

80 miles per hour over mountainous terrain. Moreover, a 16-G load is

estimated to have occurred based on the damage sustained to a sailplane during

similar high altitude winds.

• Acceleration of the flow of air above 10,000 feet to more than 60 knots

occurred over Denver about 0700 on March 3.

• From the Chatfield Profiler data, a change of horizontal wind speeds in the

vertical of 50 meters per second per kilometer coincided with a period of

accelerated winds over the continental divide.

• Rotors can descend and interact with the ground and produce strong surface

winds.

• Airflow over the mountains excites gravity waves, sometimes resulting in a

large amount of horizontal vorticity tilting to vertical vorticity downward.

• Horizontal vorticity that is parallel to the mountains, when tilted to vertical,

results in gusts.

• Numerical modeling in January 1989 showed vertical axis vorticity in the COS

area. Meteorological conditions were similar to the day of the accident.

• The maximum speed that can be generated in vortices is unknown.

• Vorticities generated by the numerical model were about 1/10 the vorticity of a

tornado.

• A University of Wyoming instrumented King Air 200 flew approaches into

COS the day after the accident. The general weather condition, such as

occurred on March 3 in the COS area, occurs 10 to 15 days a year. When the

King Air flew on March 4, the weather conditions were similar to those on

March 3. Its data showed a wind shadow east of Pikes Peak below 11,000 feet.

During the flight test, the wind shadow extended from about 10 kilometers

south of COS to 5 to 10 kilometers north of COS. There were lighter winds

and a wind reversal in the shadow. Vortices and turbulence were present at the

Factual Information 34 Aircraft Accident Report

interface between strong winds and light winds in the shadow. Above the

ground, waves were producing vertical roll; 800 to 1,000 feet per minute

vertical velocities were recorded during the King Air flights.

• Wave activity over the mountains is a function of atmospheric stability and

wind speed. Small differences in these parameters produce large differences in

the atmospheric response.

• Isolated phenomena (horizontal and vertical axis vortices) caused by Pikes

Peak are probably more significant than typical mountain wave phenomena.

• On March 3, according to Geostationary Operational Environmental Satellite

(GOES) data, there was no evidence of rotors in the COS area at the time of

the accident. A weak cap cloud was seen in imagery near Pikes Peak through

GOES data. GOES BAND-10 data showed a trough of a mountain wave near

the Colorado Rockies front range (area of warm temperatures).

1.7.3 Witness Information and Satellite Data on Vortices

The following information supports evidence of a strong horizontal axis vortex at

the time and in the area of the accident:

• A witness report of a brief 90 mile per hour or stronger (132 feet per second or

stronger) gust from the west about 2 miles east (downstream of the accident

site) and a witness report of a 50 to 70 knot gust about 1.25 miles east of

accident site. Gusts occurred about the time of aircraft impact. Another witness

reported a possible strong gust a few blocks west northwest of the accident site

about the time of the accident. Most witnesses near the accident site reported

light winds. Mean upper flow had a westerly component.

• GOES visible satellite imagery examined on McIDAS showed an upper air

cloud feature whose southward extended axis is moving across the accident

location about the time of the accident. Analysis of satellite imagery showed

the feature to be moving southeast about 45 meters per second. This feature

may have been an area of upward vertical motion containing vortices. There

seems to be support in the witness statements for the feature seen in the

satellite imagery. In addition to the two witnesses noted above, a witness at a

golf course northwest of the accident site reported a brief strong gust, swirling

winds, and downdrafts about 5 to 7 minutes prior to the accident. He estimated

wind speeds at 50 to 60 miles per hour. At about 0940, a motorist southeast of

that location (about 3 miles northwest of the accident site) reported a brief gust

that almost blew his car off the road. A person in a Chevrolet S-10 Blazer

reported a brief strong wind about the time of the crash. He was located a few

blocks west northwest of the crash site.

Factual Information 35 Aircraft Accident Report

Evidence of the existence of vortices in the area of the accident:

• King Air flights on the day after the accident measured turbulence and vertical

velocities of 800 to 1,000 feet per minute in the area where the accident

occurred. Atmospheric conditions were similar to the day of the accident.

• The Super King Air pilot ran into “terrible shear” in the area of the crash. At

7,500 feet AGL the airplane lost 20 knots of airspeed, and 100 feet of altitude.

He described it as a very hard hit. He departed from Fort Carson at 0800 MST

on the day of the accident.

• Examination on McIDAS of wind data from the Colorado Springs Air Quality

Network and LLWAS at the approximate time of the accident showed a

discontinuity in the wind field oriented west to east in the area of the accident.

The flow was converging in this area, and along this discontinuity, vortices

could form.

Observations of horizontal axis vortices (rotors) on the day of the accident:

• Rotors were reported southwest of the AFF prior to the accident.

• Three distinct rotor clouds at 11,000 feet to 12,000 feet moving east-southeast

were observed by an airline captain at about 0845 in the Palmer Lake area

(15 miles north-northwest of COS).

• A rotor was observed hitting the ground around noon about 12 miles north of

COS with estimated wind speeds of 70 plus miles per hour. Calm returned

after 30 seconds.

One person located about 6 miles west of the accident site observed several rotor

clouds near Widefield within 10 to 15 minutes of the accident. He estimated the rotor

clouds to be at 7,000 feet but was unsure of their intensity. However, he also observed

rotor clouds over his home rotating very fast. He said that the rotors were accompanied by

very thin wisps of condensation.

1.7.4 Previous Accidents/Incidents Attributed to Vortices

A review of accidents/incidents involving horizontal axis vortices (not including

vortices generated by aircraft) for the past 30 years includes the following:

• A B-52 lost about 75 percent of its vertical stabilizer and rudder while flying at

350 knots indicated airspeed (KIAS) at a pressure altitude of 14,300 feet msl

5.4 miles east of Spanish Peak in Colorado, on January 10, 1964. The ground

elevation was about 8,500 feet. The mountain top level was 13,500 feet.

Boeing calculates the angular velocity at .66 radians per second for this event.

Maximum gusts exceeded 140 feet per second.

• A BOAC 707 experienced structural failure while flying between 320 and

370 KIAS at 4,900 meters msl, 6 kilometers east of the summit of Mr. Fuji,

Japan, on March 5, 1966. There was a strong mountain wave system leeward

Factual Information 36 Aircraft Accident Report

of Mt. Fuji. The breakdown of waves resulted in small-scale turbulence with

an intensity that might have become severe or extreme in a short period of

time. The aircraft suddenly encountered abnormally severe gust loads

exceeding the design limit and disintegrated in the air in a very short period of

time. At the summit of Mt. Fuji (3,776 meters), the wind was north/west at 60

to 70 knots.

• A BAC-111 experienced structural failure between 2,000 and 3,000 feet near

Falls City, Nebraska, on August 6, 1966. Ground witnesses observed the

aircraft fly into or over a roll cloud preceding a thunderstorm and shortly

thereafter saw an explosion in the sky followed by a fireball falling out of the

cloud. Vortices were associated with the outflow of cold air from an

approaching squall line. The forces and accelerations produced by this

encounter caused the fin and right tailplane to reach their ultimate loads with

near simultaneous failures resulting.

• A Fairchild F-27B, flying about 11,500 feet around 220 KIAS, experienced an

in-flight structural failure resulting from an encounter with severe to extreme

turbulence on December 2, 1968, at Pedro Bay, Alaska. A consultant

calculated the existence of an intense low-level mountain wave about 5 miles

downwind from the ridge of Knutson Mountain (approximately 6 miles

northwest of Pedro Bay). A rotor region of mountain wave would have existed

between 2,000 feet and 3,000 feet over the northern tip of Pedro Bay. The gust

loads in the rotor were beyond the ultimate design limits of a

transport-category airplane. The investigation showed that the right outer

wing, the empennage, portions of the left wing, and other components of the

aircraft structure had separated from the aircraft in flight.

1.7.5 Review of Information Obtained from A.J. Bedard, Jr.,

NOAA:

• Summary of hazard potential for March 3. There was a moderate potential for

a steady-state horizontal roll vortex associated with a lee wave. There was a

moderate to high potential for a nonsteady horizontal roll vortex associated

with a wind surge and moving downstream. The potential was high for a

steady state 3-D twin vortex pattern with sporadic instabilities rolling up into

vertical axis vortices. The potential was high for Von Karman vortex shedding.

The highest potential was for a strong vertical axis vortex associated with a

wind surge.

• A significant pressure drop (in some cases over 21 millibars) will occur in the

core of a strong horizontal axis vortex that is stationary or is moving with the

medium. A pressure drop will also occur along the edge of the core (about 1/2

that of the core pressure drop). If the vortex is moving relative to the medium,

the pressure distribution becomes more complicated even though the rotational

flow is the same. In a strong vortex moving relative to the medium (translating

vortex), the pressure distribution is strongly dependent on a position in the

Factual Information 37 Aircraft Accident Report

vortex. A pressure decrease still occurs in the core. However, there are regions

above the core where the pressure change is small and pressure increases can

occur. In addition, very strong pressure decreases of as much as 50 millibars

may occur just below the core of a strong, moving vortex.

• Strong rotors would be accompanied by an audible “roaring” sound. The

intensity of the sound increases rapidly as the tangential speed increases.

Appendix F contains excerpts from relevant literature and correspondence

pertaining to rotors and mountain waves and other terrain-induced atmospheric

phenomena.

1.8 Aids To Navigation

Not applicable.

1.9 Communications

There were no radiotelephone transmissions received by any ground station

indicating trouble with N999UA. No discrepancies were noted on any communications

equipment that potentially could have affected flight 585.

1.10 Aerodrome Information

1.10.1 General

The Colorado Springs Municipal Airport is a public-use airport owned and

operated by the City of Colorado Springs. It is controlled by an FAA tower that is attended

24 hours a day and has been classified as a Federal Aviation Regulation (FAR) 139

index C airport since May 1973. The elevation of the airport is 6,172 feet. The airport has

two runways, runway 12/30 (8,511 feet by 150 feet) and runway 17/35 (11,021 feet by

150 feet). Runway 35 has a 1,000-foot paved stopway, a precision approach path indicator

(PAPI), and a full instrument landing system (ILS). The glideslope is 3 degrees. For the

12 months ending September 27, 1990, takeoff and landing operations totaled

176,880 movements, of which 18,912 were air carriers.

There are extensive areas of high terrain in the COS area. Minimum sector

altitudes (MSAs) of 9,000 feet exist within 25 nmi from the north northwest, clockwise

through south of the airport. Higher elevations with area minimum altitudes (AMAs)

above 16,000 feet lie to the west within 15 nmi of the airport.

COS is not categorized as a special airport by the FAA or UAL. There are some

specific airports where the FAA has determined that special qualifications are required for

Factual Information 38 Aircraft Accident Report

pilots to land, as provided in FAR section 121.445 and Advisory Circular

number 121.445-1D. UAL has similar procedures for certain airports.

1.10.2 Weather Related Accidents/Incident Data

The National Transportation Safety Board's accident data files were reviewed for

accidents that occurred within the State of Colorado in which windshear or mountain

wave activity were cited as causal or contributory to the mishap. The data reviewed

covered the period from December 24, 1974 to September 2, 1990. Of the 31 accidents

reviewed, only one was listed as having occurred in proximity to Colorado Springs,

Colorado. This nonfatal accident, which took place on December 1, 1983, occurred when

a sailplane encountered a mountain wave near the Black Forest Glider Port while on

approach to land.

1.11 Flight Recorders

The Boeing 737 Cockpit Voice Recorder (CVR) and Digital Flight Data Recorder

(FDR) are located in the airplane fuselage, aft left side, within the pressurized area of the

airplane. Both recorders from flight 585 were recovered from the accident site and sent to

the Safety Board's laboratories in Washington, D.C., for readout.

The FDR was a Fairchild Model F800, serial number 4016. The recorder has the

capability to record many parameters; however, it was installed in N999UA to record only

5 parameters: heading; altitude; airspeed; normal acceleration (G loads)

; and

microphone keying. All parameters were sampled and recorded once per second except

vertical acceleration, which was sampled 8 times per second.

The FDR sustained extensive impact damage to its external dust cover sleeve and

internal electronic components. The dust cover sleeve was cut away from the protective

casings to remove the internal tape assembly. Once the tape assembly was opened, the

tape cover was found broken and the tape medium was partially dislodged and crumpled;

however, the tape was not torn or mangled, and the data were extractable.

Figure 9 shows the ground track with selected CVR data. Figure 10 is a profile

view of the flightpath with selected CVR data.

G-load is a unit of acceleration equal to the acceleration of the Earth's gravity, used to measure the

force on a body undergoing acceleration, and expressed as a multiple of the Earth's acceleration.

Factual Information 39 Aircraft Accident Report

Figure 9. Ground track with selected CVR data

Figure 10. Profile view of flightpath with selected CVR data

Factual Information 40 Aircraft Accident Report

The CVR was a Sunstrand Model V557, serial number unknown. It sustained

some structural damage, but the crash case maintained the overall integrity of the

recording tape. Due to the severity of the impact and the nature of the tape cartridge

employed in this CVR, the tape had several creases which degraded the audio quality on

playback. Also, due to the ejection of the CVR from the airplane into a nearby shallow

creek, the CVR sustained minor water contamination that had no apparent contribution to

the relatively poor playback quality of the tape. The CVR had no fire or smoke damage.

The playback time of the tape was 30 minutes and 14 seconds. An acoustic

spectral study was performed on the CVR tape to determine the rotational frequencies of

the engines prior to the accident. It was also used to attempt to determine whether the

airplane's stabilizer trim actuations during the final stages of the approach were the result

of pilot trim switch actuations or autopilot trim inputs.

The rotational frequencies of the engines from approximately 2 minutes and

14 seconds prior to impact showed normal operation except that continuous frequencies

during the final 10 seconds of tape were not attainable because of strong foreground

noises in the cockpit. The study of comparative spectral data of the trim acoustic

signatures heard on the CVR tape and that of manual trim switch actuation heard on a

reference test tape showed that the trim rates were pilot inputs rather than from the

autopilot. Sounds consistent with abnormal events, such as bird strikes, structural failure,

or catastrophic engine failures, were not found.

1.12 Wreckage and Impact Information

The wreckage site was located about 3.47 nmi south of the south end of runway 35

at COS and .17 nmi to the east of the extended centerline of the runway. The elevation of

the crash site was about 5,704 feet above msl. Measurements of the wing tip debris, the

engine shafts, and the tree strikes indicated an impact heading of 205 degrees, an

80-degree nose-low attitude, a 4-degree nose-right yaw, and a right rolling motion. The

flightpath direction was about 020 degrees magnetic, and the flightpath angle was about

80 degrees down. The wreckage debris found outside the crater were mostly to the

northeast, although the airplane heading was aligned to the southwest (nearly vertical,

nose down) at ground contact.

The normal acceleration just prior to ground contact was about 4 G, requiring a

16-degree angle of attack at 212 knots. Witnesses reported continuous smooth rolling and

pitching from normal flight attitudes all the way to ground contact. The airplane flightpath

and attitude at ground contact can be described as follows:

With the airplane pointed northeast, aligned with the wreckage scatter, roll the

airplane inverted, and pitch the airplane down 84 degrees to establish the flightpath. Then

continue the pitching of the nose 16 additional degrees (angle of attack) to 100 degrees

(10 degrees past vertical) to establish the pitch attitude of the airplane. In this attitude, the

airplane is then nose down 80 degrees, upright, and pointed to the southwest while still

moving towards the northeast.

Factual Information 41 Aircraft Accident Report

Witnesses saw no pieces of the structure fall from the airplane prior to the impact.

An aerial search along the flightpath found no debris that had separated from the airplane

before ground impact. There was no evidence of fire south of the principal impact crater.

The airplane's fuselage had severe accordion-like fore and aft crushing throughout its

entire length with overstress breaks. Except for two aft fuselage sections of skin and small

debris, the entire fuselage was contained within the impact crater.

Wreckage examinations were conducted on site, at a local storage facility, and at

the facilities of various manufacturers. Fuselage examination revealed no evidence of any

preimpact failures or malfunctions. The windshield was severely cracked from overload

consistent with terrain impact at a high vertical speed. The severity of the impact and

postcrash fire precluded documentation of the relative positions of the cockpit seats and

rudder pedals. No damage was found that could be associated with preimpact strikes with

birds or other objects.

Parts of the door assemblies were examined. The evidence is consistent with all

doors being locked, and no evidence of preimpact failures was found.

The left wing was partially in the crater at the crash site. The entire length was

broken into pieces, and the portion of the wing in the crater was burned and partially

consumed by fire. The leading edge devices, although severely crushed, revealed

evidence of having been in an extended position. All of the leading edge devices, spoilers

and aileron actuators were in and around the crater. The slat actuator in the number one

position was still attached to the wing structure. Wing structures, containing the fuel cells,

were concave, ruptured and burned. The left aileron, flaps and slats were found at the

wreckage site. The No. 3 slat actuator was found in the mid-position, and the No. 2

leading edge flap actuator was found approximately 1/2 inch from full extension. No

control system parts were missing.

The right wing was partially in the crater. The entire wing, from the engine attach

points outboard, was severely crushed. The outer 35 feet of the wing was located outside

the crater and was embedded in the ground with the leading edge down and the chord of

the wing perpendicular to the ground. The leading edge devices, although severely

crushed, were in an extended position. The outer 6 feet of the wing had broken off and had

marks and damage consistent with tree strikes. The wing was near a tree that had marks

consistent with wing impact. The wing panels were split open and bowed in a convex

manner consistent with hydraulic (fuel tank) overpressure. The inboard portions of both

wings from the engine attach points to the fuselage were in numerous pieces. Some

portion of the lighter structure had melted. The wing flaps were separated from their

tracks and were recovered at the crash site. Measurements of the flap jack screw positions

corresponded to symmetrical flaps on the left and right side. According to Boeing

technical data, the measurements indicated 10-degree outboard and 12-degree inboard

flap positions corresponding to FLAPS 10 position of the flap handle. The right aileron

was separated from its wing and recovered about 25 feet north of the wing.

The vertical stabilizer and rudder were in the impact crater, damaged severely by

impact and fire. Remnants of the vertical stabilizer and rudder were removed from the

Factual Information 42 Aircraft Accident Report

crater and examined for preimpact abnormalities. The vertical stabilizer fin cap was

damaged but complete. The lower vertical stabilizer front spar structure was in the crater

and was severely damaged by impact. The attach fittings and bolts were complete and

included portions of rib structure and stabilizer skin. Approximately 4 feet of the lower

rear and false vertical stabilizer spar assemblies were found attached to their respective

fittings. The rudder attach points were found with the hinges, bolts and a 4-foot section of

the rudder still attached. Both rudder control systems were damaged but found connected

to the lower portion of the rudder at their respective attach points. The two counterweights

were in the crater, detached from their respective attach points. Several sections of burned

and damaged rudder were found that included inspection ports and attachment fittings.

The horizontal stabilizer was in the crater, in pieces and severely burned. The

horizontal stabilizer parts were located at the top of the pile of destroyed airplane debris.

The star section (front and rear horizontal spar to fuselage attach structure) was separated

into three major pieces. A 5-foot section of the right-hand horizontal stabilizer front spar

was attached to the center section of the star section with the spar attachment bolts and

fittings intact. A small section of the left-hand horizontal stabilizer front spar was attached

to the center section of the star section with the spar attachment bolts and fittings intact. A

5-foot section of the right-hand horizontal stabilizer rear spar was attached to the center

section of the star section with all three attachment bolts and fittings intact. A 4-foot

section of the left-hand horizontal rear spar was attached to the center section of the star

section with all three attachment bolts and fittings intact. Both the left and right horizontal

stabilizer hinge fittings and bolts were examined for security and preimpact malfunctions.

No abnormalities were noted. The center section jackscrew and jackscrew system were

examined, and no abnormalities were noted.

The left and right elevators were destroyed during the impact and postcrash fire;

however, parts of the elevators from the tips to the center were found and examined. Both

the left and right elevator balance hinges (three on each side) were found and examined.

All six balance hinges had structural damage indicative of overstress and all had hinge

pins and attachment hardware that were complete. Both of the outboard elevator

counterweights were in the crater. Both left and right inboard elevator hinge points were

intact with portions of the respective elevator balance tab push rods (two on each side).

The landing gear assemblies were in the crater in the extended position. There was

some fire and extensive impact damage to all three landing gear assemblies. The tires

located in the crater were severely burned. The right main gear outboard tire was about

200 feet northeast of the crater. The right main gear outboard rim half was about 175 feet

northeast of the crater. All of the landing gear actuating cylinders were in the extended

position. Both main landing gear over-center locking arms were in the locked position. No

evidence of preimpact malfunction was found with the actuating cylinders.

The left engine was buried about 10 feet nose down in the ground under the left

wing at about a 75-degree impact angle. The nose cowl and the inlet cases were destroyed.

The first and second stage compressor disk modules were about three feet ahead of the

outer fan case. The fracture surfaces on these parts revealed characteristics of tensile

overload. All first stage fan blades were broken off just above the platform. Most second

Factual Information 43 Aircraft Accident Report

stage fan blades were broken off, but those remaining were bent opposite to the direction

of rotation of the compressor.

The left engine thrust reverser had separated from the engine and was located

about 150 feet northeast of the impact crater. It was impact damaged, but its track and

actuating mechanism were intact and in the stowed position.

The left engine separated in sections during its removal from the impact crater.

The inspection of it disclosed no mechanical problems that would have precluded normal

operation prior to impact.

The forward portion of the right engine was buried about 7 feet in the ground

under the right wing at an angle of about 50 degrees. The portion aft of the combustion

section of the right engine was separated, and some parts were located about 25 feet north

of the impact crater. The combustion chambers were exposed from the aft end and did not

exhibit any distress or metalization. The right thrust reverser was located about 140 feet

north of the impact crater, in line with other parts that had exited the engine. The thrust

reverser was in the stowed position. The high pressure turbine (HPT) rotor from the right

engine (minus the shaft) was located 553 feet north of the impact crater.

The first and second stage compressor fan disk modules were located about 1 foot

forward of the outer fan case. The first stage fan blades were separated from their disk and

were in the impact crater. The remaining fan blades were pushed back and bent opposite

to the direction of rotation of the low pressure compressor. Most of the second stage fan

blades were broken off at their platforms. The remaining blades were bent opposite to the

direction of rotation of the compressor.

Examination of the right engine during its removal from the ground revealed that

it was twisted clockwise, as if the front was stationary and the aft end was rotated

clockwise. The turbine disks and blades for the first through the fourth stages of the

compressor, the low pressure turbine (LPT) and HPT shafts, and various vane airfoil and

shroud fragments were removed and examined at the UAL Maintenance Operation Center

at San Francisco, California. The inspection of the right engine and its associated

components did not reveal any mechanical problems that would have precluded normal

operation prior to impact.

Damage to the cockpit area of the airplane precluded meaningful examination of

most of the cockpit equipment and indicating systems. The engine indicating

instrumentation was recovered in a condition which permitted meaningful examination.

Examination of the engine indicating instrumentation indicated that, at impact, the N1

speeds for left and right engines were 86 percent and 84 percent, respectively. EPRs were

1.97 for both engines. N2 speeds were found at 93 percent for the left engine and in the

range of 86-88 percent for the right engine. These indications are sufficient to show that

both engines were producing nearly symmetric thrust at impact.

The pilot's and copilot's glareshield annunciator panels were also recovered and

examined. Light bulb filament analysis of the captain's annunciator panel indicated that

Factual Information 44 Aircraft Accident Report

the FLT CONT, FUEL, and OVHT DET indicators may have been illuminated at impact

or as a result of the accident events. The copilot's annunciator panel indicated the potential

for illumination of the HYD, OVERHEAT, AIR COND, and an unused segment of the

annunciator panel. A heated filament in the bulbs of the unused segment of the

annunciator panel is unexplainable except for the possibility that the press to test circuit

was activated during the impact sequence.

1.12.1 Engine Mount Examinations

The three engine mount cone bolts from both the left and right engines were

located and sent to the Safety Board's Materials Laboratory for examination. All six bolts

were found mechanically damaged and separated at the undercut radius between the

threaded end and conical portions of the bolts. Examination of the bolts revealed fracture

features and deformation consistent with overstress separations. There was no evidence of

fatigue cracking or other types of preexisting defects.

1.12.2 Examination of Roll and Pitch Flight Controls

Components and Other Systems

A total of 46 components were removed from the airplane and functionally tested

or examined at the UAL Maintenance Operations Center in San Francisco, California,

under the supervision of the Safety Board. Each component was unpackaged, documented

in the position found, photographed, cleaned as necessary, and x-rayed when possible.

They were then disassembled and tested when possible. Parts were substituted if the

testing necessitated a substitution. Certain examinations required the destruction of part or

all of some components. A few components required metallurgical examinations.

The 46 components examined included engine indicating instruments, yaw

damper electronics, primary flight controls, including the rudder, ailerons, and elevator,

secondary flight controls and spoilers, leading edge devices, the flap control module, and

the trailing edge flap control valve. In addition, the yaw damper coupler and the rudder

power control unit transfer valve, both of which had been removed from the airplane

before the accident flight, were bench checked.

Additional functional testing and/or teardown inspections of components removed

from the airplane took place at the Boeing facilities in Seattle, Washington. These

components included the “A” and “B” and standby hydraulic system pressure modules,

the “A” and “B” system flight control modules, the landing gear maintenance valve, the

standby rudder actuator, the rudder main power control unit (MPCU), the elevator feel

and centering mechanism, the aileron force limiter, and the autopilot and flight director

mode control panels. The elevator feel computer, which had been tested earlier at the

UAL Maintenance Operations Center, was further tested.

Factual Information 45 Aircraft Accident Report

Of the components tested at UAL and Boeing, 10 were found with anomalies. The

condition of these components, along with their respective abnormalities and potential

systems effects, where applicable, was as follows:

1.12.2.1 Hydraulic System A and B Pressure Modules

“A” Hydraulic System Pressure Module:

The hydraulic system pressure

modules located downstream of the hydraulic pumps provide a means to simplify fluid

handling and reduce the number of fittings in the hydraulic system. The module consists

of two pressure filters, two check valves, two pressure switches, and a pressure relief

valve. The entire module can be replaced on the airplane. A failure within the module,

such as a crack or jam of a moving part or major internal or external leakage, could impair

the “A” hydraulic system function.

One of two filter elements was darker than the other element. A discolored deposit

was found in the pressure port. A metallic particle was in the check valve installed in

port 6, causing it to stick to the open position.

System effects:

To test the effects of the discolored filter on the hydraulic system

performance, both filters from the “A” module were flow checked. Both filters passed

Boeing's required flow rate for acceptable performance. Therefore, it was determined that

the discoloration of the filter had no effect on the operation of the hydraulic or flight

control systems.

The effect of the metallic particle in the port number 6 check valve of the module

was considered. The check valve is installed to prevent flow from the “B” hydraulic

system to the “A” system if the ground interconnect valve is open. Operation (opening) of

the ground interconnect valve requires 28 VDC power from the battery bus to be

available, the parking brake to be set, and the ground interconnect switch to be “OPEN.”

It was determined that in the absence of other multiple system failures that were

not observed in the components examined, the open check valve in port number 6 would

not affect the operation of the airplane's hydraulic or flight control system because the

ground interconnect valve was not open and no hydraulic fluid or pressure was available

to flow through the check valve.

“B” Hydraulic System Pressure Module: Corrosion was observed on the filter

bowl area outside of the filter element, on the port 4 and port 5 side. Epoxy particles were

also in the filter bowl on the port 1 and port 2 side. Two sheared backup rings were on the

pressure switch cavity. A green-colored deposit was found in the check valve cavity.

System effects:

The anomalies in the “B” hydraulic system pressure module were

determined to have no effect on the operation of the hydraulic system or flight control

systems. The surface corrosion on the filter bowl area would not effect the system.

Chemical and infrared-spectrographic examination of the epoxy particles indicated that

they were epoxy of the DGEBA type. This epoxy is used as an adhesive in the

manufacture of the filter. The green-colored deposit removed from the check valve cavity

Factual Information 46 Aircraft Accident Report

was identified as aluminum phosphate. The source was not identified. Its presence in the

cavity had no effect on the operation of the check valve or the systems that were

associated with the check valve.

The portions of sheared backup rings in the pressure switch cavity on port 1 and

port 2 were determined to have been debris from a previous disassembly of the module

and were not portions of the backup rings installed with the pressure switch in the module.

The examination indicated that all backup rings associated with the cavity and pressure

switch were intact. The presence of the portions of the backup rings would not have

affected the operation of the hydraulic or flight control systems.

Standby Hydraulic System Pressure Module:

Examination of the standby

hydraulic system module indicated that both motor-operated shutoff valves were in the

“OFF” position. Additional testing of the unit confirmed the hydraulic integrity of the unit

to a point that it could be determined that the standby unit was off and would have been

capable of operation, if needed.

The valve cavity on port 2 and port 4 contained a section of a sheared backup ring.

The pressure relief valve was in the open position.

System effects:

The sheared Teflon backup ring in valve cavity port 2 and port 4

was determined to have no effect on the operation of the hydraulics or flight control

systems.

Port 2 and port 4 are the pressure and return circuits, respectively, for the operation

of the airplane's rudder system. The ports are connected internally within the standby

hydraulic system pressure module by the hydraulic standby system rudder shutoff valve.

With pressure applied to port 1, leakage was observed from port 2, port 3, and port 4.

Visual examination of the shutoff valve indicated that it was closed; therefore, none of the

ports should have had hydraulic fluid flow. Further testing of the standby module with a

new rudder shutoff valve installed indicated that leakage occurred from port 2, port 3 and

port 4 when pressure was applied to port 1.

Disassembly of the module revealed that a portion of a sheared backup ring from

the second land

of the standby rudder shutoff valve was in the valve cavity. All other

backup rings and O-rings were intact. There was no evidence of O-ring extrusion or

failure.

Further examination of the module indicated that the leakage between ports

occurred because of free flow through the pressure relief port on the valve. X-ray

examination and subsequent disassembly of the relief valve gave no positive indication of

the reason for failure of the valve. During disassembly, a particle too small for

identification or collection was observed in the fluid in the valve. After cleaning, the

valve's components were reassembled and the valve did not leak.

Grooved area on component normally used to contain O-ring assembly.

Factual Information 47 Aircraft Accident Report

The function of the relief valve within the module is to provide a means for

pressure to be relieved to the return side of the hydraulic system in the event of blockage

or obstruction of the downstream side of the module. The valve is a ball and spring-type

check valve.

Failure of the relief valve would have no effect on the normal operation of the

airplane's hydraulic or flight control systems. The valve would not see hydraulic pressure

or flow unless the standby hydraulic system was activated. There is no indication that the

system was activated in this accident.

System “A” and “B” Flight Control Modules:

The flight control modules (one

each for “A” and “B” flight control systems) contain shutoff valves and a flow

compensating device in a modular package. The motor-operated shutoff valves within the

module are commanded to their operating positions by the flight control system switches

in the cockpit.

Examination of the flight control (“A” and “B” systems) modules revealed that all

shutoff valves were open (the normal position for flight). All pressure sensing switches

were tested and found to be operating normally. During the examination, sheared backup

rings and a “nibbled” O-ring were found in the valve cavities. O-rings showed signs of

discoloration and/or extrusion. The damage to the O-rings could allow leakage between

the pressure and return hydraulic ports of the module. It was determined that excess

leakage between the ports could allow flow to the flight control system actuators.

It was determined that additional testing was necessary to determine the effects of

leakage on the flight control system. On May 21, 1991, under the supervision of the

Safety Board, testing was performed at Boeing. A new flight control module was used for

the tests.

In an attempt to duplicate the worst case condition for the tests, one O-ring and

both backup rings were removed from the shutoff valve of the test unit. After these tests,

the damaged O-ring from the accident airplane (flight control module, serial number

1870) was installed in the module, and leakage was measured. The O-ring was then

repositioned, and leakage readings were retaken. The maximum leakage obtained with the

damaged O-ring was 0.06 gallons per minute (gpm). The rate of leakage decreased as

pressure was increased from 1,000 psi to 2,000 psi to 3,000 psi. The tests and subsequent

evaluation showed that the leakage of 0.06 gpm would have no noticeable effect on the

operation of the airplane.

1.12.2.2 Roll Control Components

General:

The left and right aileron bus cables, which connect the two cockpit

control columns, were removed from the aileron bus drum and examined. Metallurgical

examination of the cable ends indicated a one-time tensile overload failure of the cables.

The aileron bus drum rivets were found sheared which allowed the drum to rotate

approximately 90 degrees. This damage occurred as a result of impact and did not exist

prior to impact.

Factual Information 48 Aircraft Accident Report

X-ray examination of the spoiler mixer and subsequent disassembly indicated that

the flight spoiler position at impact was approximately 4 degrees left wing down at

impact. The x-ray also indicated that the ground spoilers were down at impact.

The aileron spring cartridge (pogo) was found bent upward by external impact

forces, and the aileron spring was extended 1.12 inches. Although the cartridge was bent

and the spring extended, the length from one end to the other was nearly the same as if the

cartridge was properly installed and the spring was not extended. In normal operation, the

aileron spring cartridge is not extended or compressed. It would be extended or

compressed as a result of control system jamming in the roll axis, or as a result of the

noted crash induced deformation.

An analysis of the deformation of the aileron spring cartridge indicated that with

the extension found, the copilot's control wheel would have been deflected about

79 degrees counterclockwise, which would have resulted in spoilers No. 2 and 3 deflected

24 degrees. This deflection would have required approximately 85 pounds of force by the

copilot to deform the aileron spring cartridge. Another correlation of spoiler mixer impact

position and aileron spring cartridge deformation indicates that spoilers No. 2 and 3 could

have been at approximately 4 degrees at impact and the copilot's control wheel would

have been deflected counterclockwise 31 degrees. The aileron MPCUs were consistent

with a zero aileron position. Actual impact control wheel positions could not be

determined by examining the control wheels for the captain or copilot. The ground spoiler

control valve was recovered and examined. Grime present on the exposed portion of the

slide indicated that the spoilers were down at impact.

The four aluminum alloy shear rivets at the attach point between the spring

cartridge and the control quadrant input crank were found sheared. Analysis of the metal

smears in the shear faces indicate that the clevis attach arm connected to the aileron spring

cartridge was forced in the opposite relative direction of rotation at the time of failure.

This would indicate the integrity of the control system inputs from the copilot's column to

the spoiler mixer at impact.

No. 6 Flight Spoiler Actuator:

Metal slivers were in the input side of the filter.

System effects:

The metal slivers on the input side of the filter were from a source

upstream of the actuator. The filter was in good condition. The next component upstream

of the actuator (and possible source of the slivers) is the system “A” flight control module.

The No. 6 flight spoiler's piston head seals were split and torn. The No. 6 flight spoiler is

the closest inboard flight spoiler and, along with spoiler No. 3, did not exhibit metal

slivers in the filter. The metal slivers would not have affected the operation of the airplane.

No. 7 Flight Spoiler Actuator: Metal slivers were found in the input side of the

actuator's filter. A small metal chip was found in the thermal relief valve cavity.

System effects:

Metal slivers found on the input side of the actuator's filter would

have originated upstream from the unit. The piston head seals were also split and torn

similar to the No. 6 flight spoiler actuator. The No. 7 actuator is paired hydraulically with

Factual Information 49 Aircraft Accident Report

the No. 2 actuator on the left wing. There were no anomalies found with the No. 2

actuator. The metal slivers would not affect the operation of the airplane.

1.12.2.3 Pitch Control Components

General:

Both elevator tab lock actuators were removed from the airplane

wreckage and examined. Evidence to determine the position of the elevator tab lockout

piston was inconclusive. Examination of the horizontal stabilizer jackscrew indicated that

the horizontal stabilizer was positioned at 0.75 degrees leading edge down at impact.

Elevator Feel Computer:

A small metal chip was in the “A” system filter

element.

System effects:

The metal chip found in the “A” system side filter unit showed that

the filter was performing its intended function of cleaning (filtering) the system's

hydraulic fluid and did not indicate a system failure. Other damage noted in the feel

computer was attributed to the airplane's impact with the ground.

1.12.3 Examination of Yaw Control Components

1.12.3.1 System Main Rudder Power Control Unit

The accident airplane’s main rudder PCU was substantially damaged by external

impact, fire, and smoke; thus, operational testing of the complete PCU was not possible.

Examination of the PCU servo valve revealed six semicircular discolorations (consistent

with exposure to heat) on the lands. The six discolored areas were aligned with the porting

holes on the inside bore of the secondary slide, establishing the relative positions of the

primary and secondary slides at the time of the fire. The relative position of the secondary

slide was near neutral.

The hydraulic system A bypass valve, located upstream of the rudder actuator

piston, was stuck in the unpressurized bypass condition apparently as a result of

heat-deteriorated hydraulic fluid. Residue of overheated hydraulic fluid was located

within the actuator, primarily on the hydraulic system A (forward) side.

The hydraulic system B side of the main rudder PCU exhibited less evidence of

thermal distress than the hydraulic system A side. A small amount of water was located in

the hydraulic system B filter cavity. The center portion of the rudder actuator cylinder

bore and piston exhibited slight wetness and no evidence of heat-deteriorated hydraulic

fluid. The hydraulic system B (aft) side of the actuator piston was relatively clean and dry.

The input pushrod that connects a torque tube to the MPCU input crank was

broken and the fracture was attributed to exposure to the fire.

System effects:

The rudder system was evaluated to determine if a local fluid leak

could deplete the hydraulic fluid in the rudder system. It was determined that loss of fluid

in the rudder MPCU, if it occurred in flight, would also indicate a loss of hydraulic system

Factual Information 50 Aircraft Accident Report

fluid in the system reservoir which would result in a loss of system pressure that could be

detected by the crew. The evidence in the rudder MPCU indicated that the fluid was

released from the MPCU during the impact sequence and not prior to impact. It also is

believed that the water entered the system after impact and that the system was open at

that time because of impact forces.

1.12.3.2 Standby Rudder Actuator

Standby Rudder Actuator:

The bypass valve in the standby rudder actuator was

examined and found damaged by heat. Melted O-rings and backup rings were found along

with burned hydraulic fluid. There was no evidence of preimpact physical damage in the

bypass valve. X-rays of the package show that the bypass valve was in the unpressurized

“bypass” position and the piston was extended 1/16 inch from the center.

Examination of the control valve indicated that there was no preimpact physical

damage. Etching (believed to be a result of burnt hydraulic fluid) within the valve

indicated that the valve was in the neutral position during the fire. This was determined by

lining up etchings with known port positions.

The fracture on the input push rod that connects a torque tube to the actuator valve

input lever was determined to have occurred prior to the fire and was due to side loads

with out significant compression loads. The input lever was about 1/16 inch from neutral

when found at the accident site. The lever was in the dead band (null) area. The stops on

the actuator housing were not damaged and the input lever was not damaged at the point

of contact with the stops.

During the initial disassembly of the standby rudder actuator, it was noted that the

bearing through which the shaft connecting the input crank to the control valve slide

passes was difficult to remove. Subsequent examination revealed evidence of galling on

the bearing surface of the input shaft (P/N 1087-23) and mating bearing nut

(P/N 1087-22). Normally, the standby actuator is not used and the input lever arm is free

to rotate as required to accommodate the relative motion between the rudder and torque

tube. The shaft extends through the bearing which is threaded into the body of the standby

rudder actuator. The bearing is torqued and safety wired into position. A 6.72-inch input

lever is attached to the end of the shaft. According to the manufacturer, the maximum

force to move the input lever should not exceed 0.5 pound. The input shaft and bearing are

manufactured and installed as a matched pair because of the tight tolerances between the

two components and the requirements for ease of operation of the standby rudder actuator.

The presence of galling could cause the input shaft to bind. See section 1.16.3 for

information regarding more detailed tests and examinations of the standby rudder actuator

and input shaft and bearing.

1.13 Medical And Pathological Information

The captain held a valid first class airman medical certificate dated December 7,

1990. The Safety Board and UAL reviewed the captain's company medical records,

Factual Information 51 Aircraft Accident Report

including records of annual physical examinations and medical claims made by the

captain to the insurance carrier employed by UAL. There was no record of hospitalization

or major medical claims. Family members and coworkers said that the captain exercised

regularly and appeared fit, and that he did not smoke or drink alcohol. Based on the

medical examination on October 24, 1990, the captain's overall cardiac risk factor was

assessed as “below average.” On his FAA medical records of December 7, 1990, the

captain's height was listed as 5 feet 7 inches, and his weight was listed as 145 pounds.

The first officer held a valid first class airman medical certificate dated August 21,

1990. The Safety Board and UAL reviewed the first officer's medical records and medical

claims made by the first officer to the insurance carrier employed by UAL. They indicated

that she had no hospitalizations or major medical claims. Family members and coworkers

said that the first officer exercised regularly, did not smoke, and was an occasional

drinker. Based on the medical examination of August 21, 1990, the first officer's cardiac

risk factor was assessed as “low.” Her height was listed as 5 feet 4 inches, and her weight

was listed as 130 pounds.

According to Boeing, in compliance with Federal regulations, the seat of the

B-737 is designed to be adjustable to provide full flight control authority to pilots having a

minimum height of 5 feet 2 inches. The actual position of crewmember seat settings could

not be determined from the wreckage. However, the captain cautioned the first officer to

“watch your feet here comes the rudder” during his control check (0914:20), suggesting

that he was positioned to use full rudder authority. Boeing has also indicated that

80 pounds of leg pushing force is necessary to achieve full rudder authority under normal

operation. An aeromedical official who reviewed the medical records of the captain and

first officer said that either crewmember should have been capable of providing this leg

pushing force.

The cause of death for the 20 passengers and 5 crewmembers was determined to

be blunt force trauma.

Toxicological testing on tissue samples obtained posthumously from the captain

and first officer was completed by the Coroner's Office of El Paso County, Colorado. The

samples tested negative for alcohol, major drugs of abuse, and prescription and

over-the-counter medications.

A panel of medical authorities reviewed all available autopsy evidence, including

x-ray records of the feet and flight boots of both crewmembers, to determine injuries that

might have been caused by hand or feet contact with control wheel and pedals. In the case

of the captain, the panel noted minimal deformation of the left foot and less deformation

of the right foot. In the case of the first officer, the panel noted symmetrically pronounced

deformations of both feet.

In accordance with its drug testing program, the FAA obtained urine samples from

four controllers at the COS tower: the ground controller/CIC; local controller; arrival

controller; and supervisor. The samples, obtained between 2200 and 2320 on March 3,

1991, were tested for the five drugs specified in the protocol of the National Institute of

Factual Information 52 Aircraft Accident Report

Drug Abuse (NIDA): marijuana, cocaine, amphetamines, PCP, and opiates. No positive

results were reported to the Safety Board, as required by Federal statute if positive results

are found. The four controllers declined to provide blood and urine samples for testing by

the Safety Board.

Blood and urine samples were provided voluntarily to the Safety Board by the

departure controller at the Denver terminal radar approach control (TRACON) facility.

No testing was conducted on these samples because of an absence of evidence that this

controller's actions were involved in the accident sequence.

1.14 Fire

An intense ground fire melted localized sections of the airplane structure and

scorched nearby trees and the ground surrounding the crash site. There was no indication

of any fire prior to the impact with the ground.

Fire fighting equipment arrived at the accident site within minutes of the crash and

proceeded to extinguish the fire.

1.15 Survival Aspects

The accident was not survivable.

1.16 Tests and Research

1.16.1 Recorded Radar Data

The Safety Board obtained and reviewed recorded radar data from the Denver Air

Route Traffic Control Center (ARTCC). The data covered the period from initial contact

with flight 585 at 0923 hours during climbout from Denver until the loss of radar contact

about 4 miles south of the approach end of runway 35 at COS around 0944 hours. This

information showed a normal flight until the airplane turned onto final for runway 35. The

last radar data point was recorded about 16 seconds prior to the crash.

The radar data show that the airplane was approaching the airport from the

southeast at an altitude of about 7,900 feet. The course was consistent with a 45-degree

intercept angle to the final approach course with the intercept 4 to 5 miles south of the

runway. While the airplane was about 1 nmi east of the final approach course, it started

descending at a rate consistent with that required to maintain a flightpath aligned with the

3-degree glideslope. About 20 seconds later, the descent rate increased, resulting in a new

7.5-degree flightpath, or 2,200 feet per minute down, and the airplane descended below

the glideslope. The airplane crashed about 37 seconds after the initial departure from the

glideslope.

Factual Information 53 Aircraft Accident Report

1.16.2 Modeling and Simulations of Atmospheric Disturbances

and Airplane Flight Dynamics Conducted During the Initial

Investigation (1991/1992)

Three simulations were conducted during the initial investigation:

1) NCAR

used sophisticated atmospheric numerical computer modeling of air movements in the

Rocky Mountains near COS to define potential flow fields that might have been present;

2) a specialized computer simulation was used to define possible roll angle and sideslip

angle time histories that would produce flightpaths consistent with recorded radar data,

FDR data, crash site location, and crash attitudes; and 3) Boeing used its engineering

simulator to examine the effects of various atmospheric disturbances and/or flight control

malfunctions on the flightpath of a B-737-200 Advanced airplane.

1.16.2.1 Modeling of Atmospheric Disturbances (1991/1992): NCAR

Weather Study

Personnel from the Mesoscale and Microscale Meteorology Division of NCAR

were contacted by the Safety Board. A contract was awarded to NCAR to use known

environmental data to simulate a downslope windstorm event similar to the conditions

that may have existed at COS on March 3, 1991 in order to determine whether it might

have contributed to the crash of the airplane. The accident airplane case was more

complex to model than had originally been expected because of current modeling

techniques related to wind, temperature, and humidity upstream of the mountains. Current

modeling is based on the assumption that the flow approaching the mountain is

horizontally uniform and, therefore, a single sounding is used to describe those

conditions.

The conditions on the day of the accident were complicated by a trough that was

over the Rocky Mountains at the time of the accident. The use of a single sounding to

describe the basic flow over the Colorado region on that day was therefore not

appropriate. Other soundings used in the model for the studies gave different results, and

none of the cases studied indicated a severe windstorm event. Due to the extensive

horizontal variations over Colorado that day, the study indicated that no single sounding

existed that could be used to initialize the model that would be representative of the flow

over the front range at the time of the windstorm.

Observations indicated that there was a severe windstorm over the front range of

the Rockies at the time of the crash. The study indicated that severe windstorms over the

Rockies have consistent characteristics because they are caused by low-level stable air

flowing over the orography, exciting highly nonlinear breaking gravity waves. Waves

result in the generation of severe turbulence, rotors and hydraulic jumps. The jumps are

regions where the flow rebounds in the vertical to its original level of equilibrium, after

Since the adoption of the original report in December 1992, additional weather- and rudder-related

computer simulations and modeling studies have been conducted. These simulations and studies are

discussed in section 1.16.6.

Factual Information 54 Aircraft Accident Report

passing over the mountain range, and they can produce updrafts exceeding 40 m/second.

The NCAR study indicated that the horizontal widths of these jumps are believed to be

quite narrow, producing regions of extreme horizontal variations in the updrafts.

Hydraulic jumps may be found with mountain wave activity.

The study referenced a windstorm that occurred on the front range on January 9,

1989, when conditions were similar to those existing at the time of the accident. NCAR

personnel completed a series of simulations of this windstorm that covered a large portion

of Colorado and showed a strong concentrated region of upward motion (jump) with

upward velocities exceeding 40 m/second traveling up and down the foothills of the

Rockies in the Boulder region.

In the COS area, the jumps exhibited much more variability than along the

Boulder region front range. The orography is highly structured in the COS area and

dominated by the presence of Pikes Peak and the Palmer divide. The horizontal shears

associated with these jumps were limited by resolution (the shear was forced by the model

to be spread out over about 4 kilometers (km)) and were therefore about 10 m/second per

km. It could be anticipated that the higher resolution simulations would show much larger

shear values because a model selects the narrowest scales it can resolve for its largest

gradients, and the peak gradients are usually larger when using higher resolutions.

Some idealized two-dimensional simulations were performed on the January 9,

1989, case which showed that at higher resolutions, small-scale eddies were generated

within the high-wind regions on the mountain slope. These eddies, which contained very

high velocities both in the horizontal and vertical that varied sharply over short distances,

traveled down the lee slope and out onto the plains.

The orientation of the jumps observed in the January 9, 1989, simulations was

typically parallel to the front range. It could be expected, therefore, that the traveling

updrafts associated with these jumps would pass over the north-south COS runway with

an orientation more or less parallel to the runway. If an airplane were approaching the

runway from either north or south, it would experience a rapid increase in upward motion

as the jump approached, and the upward motion on the west-facing wing would be higher

than that on the east side. The report stated that runway 35 has the worst possible

orientation in terms of airplane safety in the presence of downslope windstorm events.

The report indicated that it was impossible to determine from modeling whether a

traveling jump actually occurred on March 3, 1991, in the COS area. Models, even at high

resolution and properly initialized, can only suggest the structure of the storm and cannot

indicate precisely where the various features within it were located at a particular time.

Only observations of wind and vertical motion near the accident site could determine

whether a jump was at that location at the time of the accident. Modeling can only

determine whether such an event was possible. Based on the study and the opinions of

NCAR personnel, who are familiar with observations in the area, such an event was

possible on March 3, 1991.

Factual Information 55 Aircraft Accident Report

Two recommendations were generated by the study with respect to airplane safety

in severe downslope windstorms in the COS area. First, there should be several surface

observing stations in the valleys on either side of Pikes Peak to provide warnings about

the development of strong winds associated with mountain windstorms. These stations

would be able to detect any extremely strong winds that could exist in these valleys

without any winds noticeable in the region of the airport. Such observations could alert

the tower that gusts or strong updrafts might begin traveling out over the plains. Further,

there is a strong need for an improved and more advanced level of airline transport and

commercial pilot training regarding mountain windstorms. Based on FAA commercial

pilot exam listings that are categorized by subject, the FAA requirements for commercial

pilot understanding of orographically induced strong downslope winds are almost

nonexistent; also, the FAA manuals contain minimal information on this topic.

As a result of the information developed during the investigation and gained

during this study, on July 20, 1992, the Safety Board issued two safety recommendations

to the FAA:

Develop and implement a meteorological program to observe, document, and

analyze potential meteorological aircraft hazards in the area of Colorado Springs,

Colorado, with a focus on the approach and departure paths of the Colorado Springs

Municipal Airport. This program should be made operational by the winter of 1992.

(Class II, Priority Action) (A-92-57)

Develop a broader meteorological aircraft hazard program to include other airports

in or near mountainous terrain, based on the results obtained in the Colorado Springs,

Colorado, area. (Class II, Priority Action) (A-92-58)

In response to Safety Recommendation A-92-57, NOAA and NCAR collected

weather and wind data in the Colorado Springs area between February and April 1997.

The June 1998 NOAA/NCAR interim report

indicated that numerous mountain-induced

weather phenomena were observed, including low-altitude windflow reversals,

windshears, and horizontal axis vortices (rotors). The Safety Board’s review of the

NOAA/NCAR data revealed that, in several cases, the upper wind directions were similar

to, but weaker than, those that existed in the Colorado Springs area when the United

flight 585 accident occurred.

The data from these cases showed that mountain rotors

were present. Some of the weaker rotors measured by NOAA/NCAR were located

between the surface and about 3,000 feet agl, whereas other (stronger) rotors were

observed at altitudes exceeding 4,000 feet agl.

The rotors observed during the NOAA/NCAR data gathering program had a

maximum rotational rate of 0.05 radians per second, which is less than the rotational rate

A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs

Area: Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997), NOAA/NCAR, June 1998. As of

March 1999, a final report had not been issued.

The Safety Board’s review of the data indicated that the upper winds present at the time of the United

flight 585 accident were about two to three times stronger than those observed in the NOAA/NCAR data.

Factual Information 56 Aircraft Accident Report

of 0.6 radians per second that was demonstrated during the investigation of the United

flight 585 accident to be necessary to produce extreme control difficulties in a 737

airplane. According to NOAA scientists, stronger upper windspeeds produce

proportionally stronger rotors. Therefore, if the upper windspeeds encountered by United

flight 585 were three times stronger than those measured by NOAA/NCAR, the rotor

rotational rate could be three times stronger. (For example, a rotor three times stronger

than the maximum observed by NOAA/NCAR would have a maximum rotational rate of

0.15 radians per second.)

Section 4 contains the status of the FAA action on these recommendations.

1.16.2.2 Safety Board Simulations (1991/1992)

The Safety Board used a specialized computer simulation to define possible roll

angle and sideslip angle time histories that would produce flightpaths consistent with

recorded radar data, FDR data, crash site location, and crash attitudes. Initial conditions

that affected the calculated flightpaths were ground track angle, ground speed, starting

positions, starting altitudes, flightpath angle, weight, thrust, and aerodynamic coefficients

related to lift, drag, and side force. Time-dependent variables that affected the calculated

flightpaths were roll angle, sideslip angle, normal acceleration, wind direction and

velocity, and airplane configuration. The initial conditions and time-dependent variables

were varied to achieve matches between calculated parameters and recorded data. The

calculated ground track was compared with the radar data. Calculated airspeeds, altitudes,

and headings were compared with FDR data. Calculated impact attitudes were compared

with those derived from crash site data.

In general, roll angle, sideslip angle, and wind time histories were varied, while

the time histories of normal acceleration and airplane configuration remained constant. In

addition, the initial ground speed and ground track were modified with wind conditions to

achieve a match with initial heading and indicated airspeed data.

Modeling was started about 36 seconds prior to the crash and was continued to

impact. The starting time was consistent with the third from the last radar data point at

0931:10. Reasonable matches of altitude, airspeed, heading, and impact position were

obtained in some cases.

The modeling showed that large, rapid rudder inputs initiated near the time of the

upset would have resulted in heading angles different from the recorded heading data. The

best matches of recorded data and impact conditions were obtained with roll rates of about

11 degrees per second from wings level to 80 degrees and 22 degrees per second from

80 degrees to 180 degrees of roll while the sideslip angle was 0.

Initial roll rates greater

than 20 degrees per second generated calculated values different than the values of

recorded data.

Factual Information 57 Aircraft Accident Report

1.16.2.3 Boeing Simulations (1991/1992)

The Safety Board and parties to the investigation met on May 10, July 17, and

August 1, 1991, and April 28, 1992, at Boeing to examine the effects of various

atmospheric disturbances and/or flight control malfunctions on the flightpath of a

B-737-200 airplane. Boeing developed simulator models of the atmospheric disturbances

and could demonstrate various control malfunctions.

The simulator was flown by a Boeing pilot and pilots from the investigation team

operations group who attempted to maintain control of the airplane while encountering

atmospheric disturbances or control malfunctions. The pilots attempted to follow the

flightpath of the accident airplane, as determined by radar data. The visual scene showed

the rotor, airport, crash site, terrain features, and lead-in poles representing an

approximate flightpath of the accident airplane. The rotor portion of the visualization was

disabled on selected runs. About 250 simulator runs were completed.

Stationary and translating rotors were modeled. They could be modified by

varying the core radius, tangential velocity, position and orientation (azimuth and

elevation angles).

The rotational nature of rotors may produce rapidly changing air flow fields

relative to an airplane encountering such a rotor. The changing flow fields produce

changes in angle of attack, sideslip angle, and lift distribution across the wing. The

resulting lateral or directional imbalances contribute to uncommanded airplane motions.

NOAA estimated that a typical rotor on the day of the accident could have a rotational

velocity of .06 radians per second (3.4 degrees per second) with a radius of 1,640 feet and

a tangential velocity at the core edge of 100 feet per second.

Simulations showed that the .06 radian per second rotor had little effect on

airplane control except that performance problems could develop if the airplane remained

in the down-flow field of the rotor. In a sustained downflow, the airplane would either

have to lose altitude or airspeed, similar to the outcome of entering the downflow field of

a microburst. Performance calculations have shown that the accident airplane could have

been in a downflow field of about 80 feet per second for about 30 seconds, possibly

induced by a rotor's downflow field or some other atmospheric disturbance. The airplane

The roll rates described in this paragraph represent the solutions examined by the Safety Board using

the data and computer simulations that were available during the initial United flight 585 investigation.

Since that time, additional 737 flight test data have become available, and more sophisticated computer

simulation programs have been developed. During later computer simulation studies (1998/1999), the

Board produced good matches with simulations of many accident scenarios, including main rudder PCU

servo valve jams (secondary slide to servo valve housing at various locations) resulting in rudder deflections

to the blowdown limit and equivalent control wheel inputs. For additional information, see sections 1.16.6

and 2.7 of this revised report.

The weather- and rudder-related simulations described in this section represent the simulations

conducted by Boeing using the data and computer simulations that were available during the initial United

flight 585 investigation. Similar to the Safety Board, Boeing subsequently conducted additional computer

simulations examining the United flight 585 accident scenario. This later work (1998/1999) is discussed in

sections 1.16.6 and 2.7 of this revised report.

Factual Information 58 Aircraft Accident Report

did lose altitude at a higher than normal rate, but the airspeed remained constant at the

flaps reference speed plus 20 knots for the approach to landing.

In a sequence of simulations, the severity of the rotor was increased until

encounters produced extreme control difficulties. The engineering group, with the Boeing

pilot, determined that rotors with rotation rates of 0.6 radians per second (34 degrees per

second) with a 250 feet core radius (150 feet per second tangential velocity) generated

extreme control difficulties. Control problems were especially notable at the edge of the

core. The airplane tends to roll into the core when positioned just outside of the core and

tends to roll out of the core when positioned just inside the core. Operationally, pilots

found that a more moderate rotor with 0.4 radian per second rotation and a 250 feet core

radius (100 feet per second tangential velocity) produced significant control problems and

even loss of control if recovery procedures were not promptly implemented. A “loss of

control,” as defined by the pilot group, did not necessarily result in a crash but in the loss

of precise operating control of the airplane, such as inability to maintain a desired heading

or roll angle for short periods of time.

Encounters with strong stationary atmospheric rotors are expected to produce

significant errors in the indicated altitude and airspeed recorded on the FDR. Rotors result

in low pressure near the core, similar to tornadoes. A low pressure area will result in an

increase in indicated altitude while the actual altitude remains constant. Data extracted

from the FDR from UAL 585 failed to show the existence of an error in recorded

indicated altitude. An anomaly in recorded indicated altitude was identified in the FDR

data of an L-1011 that traversed a microburst-induced horizontal axis vortex.

addition, data supplied by NASA (Wingrove correspondence to Safety Board

investigators, dated April 16, 1992) showed significant increases in indicated altitude

when airplanes have encountered vortices at high altitude.

A strong flow field passed through the COS area at or near the time of the crash

and, according to NOAA and NCAR scientists, the flow field could have produced a large

upflow (hydraulic jump) which, in turn, could have produced a series of translating rotors.

The rotors could have been small but severe. Rotors with a 0.6 radian per second

(34 degrees per second) rotational rate, a 250 foot radius, and a 150 feet per second

tangential velocity were possible, according to NOAA and NCAR. Based on a review of

visible and infrared satellite imagery on the Safety Board's McIDAS, the air mass was

moving about 100 feet per second to the east.

According to NOAA, translating rotors are similar to stationary rotors except that

they move and create a localized flow field, in addition to the rotational flow field. One

unique aspect of a translating rotor compared with a stationary rotor is that a discernible

pressure gradient may not be present in certain regions of the translating rotor, although

According to Boeing’s later (1998/1999) simulations, a vortex strength of 1.8 radians per second

would be required to result in the airplane’s flightpath. See sections 1.16.6 and 2.7 for additional

information.

Aircraft Accident Report, Delta Air Lines flight 191, Dallas/Fort Worth International Airport, Texas,

August 2, 1985 (NTSB/AAR-86/05).

Factual Information 59 Aircraft Accident Report

the rotational effect remains the same. Further, when simulating an encounter with a

translating rotor, the localized flow field produced by the rotor translation was assumed to

be a straight wind, west to east. The wind was vectorially added to the tangential

velocities of the rotational flow field. The velocity of the localized flow field was set at

100 feet per second within the core of the rotor and was decreased as the distance from the

core increased (by a factor of core radius divided by the distance from the center of the

core). For example, at the eastern edge of the core, two velocity components would be

present. The tangential velocity associated with a 0.6 radian per second, 250 feet diameter

clockwise rotating rotor would be 150 feet per second down. The localized flow field

would produce a 100 feet per second velocity to the east. At 500 feet to the east of the

center of the core (2 times the radius), the tangential velocity would be 75 feet per second

and the west-to-east velocity would be 50 feet per second.

In addition, the rotor and localized flow field could be moved in unison and

translated at velocities up to 100 feet per second. The rotor could also be moved up or

down, tracking the airplane, to ensure that the airplane intercepted the rotor at a

predetermined point.

Simulator runs were made with 0.3, 0.4, and 0.6 radian per second translating

rotors. Many crashes occurred during encounters with a 0.6 radian per second translating

rotor. A few crashes occurred during encounters with a 0.4 radian per second translating

rotor, and no crashes occurred during encounters with a 0.3 radian per second rotor.

The following observations were made: 1) the addition of the translating rotor

increases the difficulty in maintaining control; 2) an encounter with a 0.4 radian per

second translating rotor was approximately equivalent in severity to an encounter with a

stationary 0.6 rotor; 3) an encounter with a 0.4 radian per second translating rotor was

very difficult to control, requiring an appropriate, aggressive response using the flight

control (some aggressive flight control applications resulted in more severe control

problems); 4) an encounter with the 0.4 radian per second translating rotor occasionally

resulted in a crash; 5) an encounter with a 0.6 radian per second translating rotor was

frequently uncontrollable and often unrecoverable, resulting in a crash; 6) airspeed was a

factor, and extra speed increased the airplane's controllability and decreased the effect of

atmospheric disturbances; 7) any hesitation in arresting uncommanded rolls resulted in

extreme roll attitudes; and 8) in several cases, the airplane rapidly moved east to west

through the rotor with little control difficulty.

The Safety Board requested that two B-737 crewmember pairs, who were

unfamiliar with rotor simulations, attempt to fly the simulator while encountering

translating rotors. The visual portion of the rotor was disabled, although the remainder of

the visual scene was present, minus the last lead-in pole and the crash site identification

pole. Observers noted that the element of surprise subsided after the first encounter and

that the crew performances during the encounters with translating rotors were similar to

the performances of pilots with prior experience in flying through translating rotors.

The possibility was considered that a strong, west-to-east, windshear or gust front

may have accounted for the upset. Boeing designed a model to simulate the west wind

Factual Information 60 Aircraft Accident Report

increasing from 0 to 200 knots in 4 to 40 seconds while the airplane was moving north.

The simulated lateral windshear produced rapidly changing air flow fields with the

potential for loss of control. As the airplane penetrated the shear, large side slips

developed with predictable airplane responses. Lateral windshears that were severe

enough to produce control difficulties also produced flight responses that were clearly

different than those recorded from the accident airplane. Lateral windshears produced

1) large changes in heading into the wind; 2) large increases in airspeed; and 3) rapid

rolling away from the wind if not controlled by the pilot. As the roll angle increased, the

wind-induced side slip angle transitioned into wind-induced angle of attack with marked

increases in normal acceleration (G-load).

The Safety Board and Boeing conducted separate studies to determine possible

local wind conditions. Each study used FDR data and radar data. In addition, Boeing used

a National Aeronautics and Space Administration (NASA) program that uses known

airplane performance data to calculate vertical wind. The calculations show large

reversals of wind at various positions. Strong vertical velocities were derived in the

Boeing study, peaking at 40 to 80 feet per second down, depending on whether the radar

data was smoothed or unsmoothed, respectively.

The wind calculations were used as input data in the airplane simulations. The

large wind excursions in the simulation resulted in large airspeed excursions and did not

match the airspeed data recovered from the FDR. Thus, the simulations showed that wind

excursions alone did not result in the United flight 585 upset and loss of control.

The Safety Board requested data from Boeing concerning the effect of rudder

hardover failures on the flight dynamics and controllability of B-737-200 airplanes.

Boeing responded with a series of letters describing the modeling of rudder hardovers on

the B-737-200 flight simulation. In all cases, high rates of rudder deflection resulted in

large, rapid heading excursions. Although roll angles could reach large values, prompt

wheel and elevator input resulted in regaining roll control rather than contacting the

ground. An uncommanded rudder deflection to 7.5 degrees (consistent with one theory of

uncommanded rudder deflection) was easily controllable with control wheel

(aileron/spoiler) deflection. Delaying recovery for 25 seconds resulted in ground contact.

Failure of the B hydraulic system would limit the lateral control response. An immediate

response to a rudder hardover (full rudder deflection) would have been required if a

B hydraulic system failure occurred simultaneously.

Boeing provided data showing that a rudder hardover to the mechanical limits

(approximately 26 degrees) could result in large yaw and lateral excursions even if full

wheel control was used (approximately 107 degrees).

Flap position and airspeed are

important when determining controllability during a rudder hardover condition. With the

During its investigation of the USAir flight 427 accident, the Safety Board became aware that, in the

flaps 1 configuration and at certain airspeeds, the 737 roll authority (using spoilers and ailerons) was not

sufficient to completely counter the roll effects of a rudder deflected to its blowdown limit. The airspeed at

which the maximum roll control (full roll authority provided by control wheel input) could no longer

counter the yaw/roll effects of a rudder deflected to its blowdown limit was referred to by the test group

participants as the “crossover airspeed.”

Factual Information 61 Aircraft Accident Report

rudder at about 25 degrees airplane nose right (ANR), the following conditions would

exist at 150 to 160 knots calibrated airspeed (KCAS). Bank angles are noted as left or

right wing down (LWD, RWD) and provide constant heading trim solution (no turns),

except for the last case.

At 10 and 15 degrees of flap setting, heading cannot be maintained with full

rudder deflection. If full right rudder is achieved with a 10-degree flap setting, for

example, heading control is lost and, according to Boeing, a steady 40-degree

right-wing-down trim solution is attained that results in turning flight to the right even

with full left wheel deflection. Immediate, full control wheel deflections would be

required to prevent a lateral upset in the presence of a rudder hardover.

The Safety Board evaluated the flight dynamics associated with other potential

system failures. Various mechanical failures were simulated as follows: 1) leading edge

slat failed to extend; 2) leading edge Krueger flap failed to extend; 3) yaw damper

malfunction (2 degrees); 4) flight spoiler float; 5) a rudder control system malfunction

that would cause 8 degrees of rudder deflection; 6) combined spoiler float and B hydraulic

system out; 7) asymmetric thrust with 8 degrees of rudder; 8) inadvertent flight spoiler

deployment; and 9) rudder hardover while at flaps 30.

Simulations showed that the various mechanical failures failed to produce

significant control difficulties. Most of the mechanical failures were described as

“nonevents” (not a control problem). In the presence of turbulence, the simulations

indicated that the leading edge slat and Krueger flap failures would probably go

unnoticed. A yaw damper hardover (2-degree rudder deflection) required 20 degrees of

wheel, and a floating spoiler required 25 degrees of wheel deflection. Rudder deflections

of 10.5 degrees attributed to galling

were controllable with 40-degree wheel deflections.

Asymmetric thrust with 8 degrees of rudder deflection required 30 degrees of wheel

deflection.

Rudder Angle Flaps Side Slip Angle Wheel Angle Bank Angle

25 ANR 40 14 ANR 35 LWD 18 LWD

25 ANR 30 15 ANR 44 LWD 17 LWD

25 ANR 25 15 ANR 68 LWD 16 LWD

23 ANR* 15 17 ANR 107 LWD 23 LWD

21 ANR* 10 16 ANR 107 LWD 19 LWD

25 ANR** 10 13 ANR 107 LWD 40 RWD

* Less than full rudder allowed to maintain directional control.

** Loss of directional control.

A condition whereby contact forces between mating surfaces produce localized welding, transfer of

material, and roughening of each surface.

Factual Information 62 Aircraft Accident Report

1.16.3 Detail Examination and Tests of Standby Rudder Actuator

Input Shaft and Bearing

A review of the design of the B-737 rudder control system revealed that binding of

the input shaft to the bearing that is threaded in the actuator body could potentially cause

flight control problems even though the standby rudder hydraulic system is not

pressurized. In the rudder control system, the pilot pedal movement is applied through a

mechanical control system to a lever arm to rotate a torque tube in the empennage. Other

lever arms attached to the torque tube transmit linear motion to the ends of the input

cranks for both the MPCU and the standby rudder actuator. (See figure 11).

Figure 11. Standby rudder actuator.

In normal operation, the input cranks to both the MPCU and standby rudder

actuator will rotate to provide the servo valve command to the units, and the rudder will

be hydraulically moved by the MPCU. The rudder movement is in turn fed back

mechanically to both the MPCU and standby actuator systems so that when the rudder

surface deflects to the position commanded by the pilot, the input cranks on both of the

units will be returned to their null positions. Thus, there is a geometric relationship

between the rudder position, the input crank of the MPCU, the torque tube, and the input

Factual Information 63 Aircraft Accident Report

crank of the standby rudder actuator that is retained during normal operation. If, however,

the input crank on the standby rudder actuator is not free to rotate with respect to the

actuator housing because of galling between the shaft and bearing, the actuator housing,

input crank, and control rod will act as a rigid link between the rudder and the torque tube.

The inability to change the length of this link by rotation of the standby rudder actuator

input crank within the actuator housing will affect the feedback mechanism between the

rudder position and the MPCU input crank. This condition can result in problems ranging

from high pilot control force necessary to move the rudder to uncommanded rudder

deflections.

The worst case condition would be one in which a pilot applies a rapid rudder

pedal movement that is transmitted through the torque tube to move the input crank on the

MPCU to its mechanical stops before the rudder begins to catch up to the commanded

pedal position. Concurrently, the input crank on the standby rudder actuator would be

rotated about 4 degrees from its null position. If the input crank were bound to the actuator

housing in this position, the geometric relationship to null the MPCU would not be

achieved. Theoretically, the MPCU will continue to move the rudder hydraulically, and

the rudder movement will be transmitted through the rigid link created by the bound crank

in the standby actuator to produce continued rotation of the torque tube so that the input

command to the MPCU is perpetuated until the rudder reaches its full deflection

mechanical stop in the direction originally commanded. If this should occur, the continued

rotation of the torque tube will move the pilots' pedals and will react against a

proportionally greater restoring moment provided by the rudder centering unit.

Three factors could ameliorate the effect of a bound input shaft and bearing. The

first is the elasticity of the control system linkage that, against a definable load, will

permit sufficient deformation of the otherwise rigid link feedback loop to null the MPCU

servo valve. The second factor is the application of a load sufficient to break loose the

binding between the input shaft and bearing. The third factor is a loss of torque of the

bearing in the standby rudder actuator housing to permit the rotation of the bearing and

shaft together within the housing to compensate for the bound shaft.

Because a rudder control system problem appeared to be a possible explanation for

the loss of control, the Safety Board conducted a detailed examination of the input shaft

and bearing and required tests to be conducted to determine the maximum rudder

deflection that would result from binding between the shaft and bearing.

Examination of the shaft and bearing from the standby rudder actuator at the

Safety Board's Materials Laboratory revealed that some of the softer bearing material had

transferred onto the surface of the harder shaft. A similar type of problem had reportedly

caused operational problems in B-737 airplanes on at least three previous occasions,

according to an article in Boeing's In Service Activities, Report 86-05, May 8, 1986.

The bearing and the shaft are manufactured and installed as a matched pair. On

September 3, 1986, as a result of the three previous incidents of galling between the input

shaft and bearing, a design change was made by Boeing that increased the clearance

between the two parts in the galled area by reducing the diameter of a portion of the shaft.

Factual Information 64 Aircraft Accident Report

New and reworked actuators are identified by suffix letter “A” added to the unit serial

number. Measurements showed that the diameter of the standby rudder actuator shaft

from the accident airplane had not been reworked or manufactured to the dimensions for

the increased clearance. Maintenance records of the airplane indicate that the standby

rudder actuator had been installed on the airplane since new.

During installation, the required installation torque on the bearing is 500 to

600 inch-pounds. The bearing is secured in its installed position with a safety wire and a

mechanics seal. One end of the wire is pulled through two holes in the hexagonal head of

the bearing, and the other end is connected to the body of the actuator. A safety wire,

without the mechanic's seal, was present prior to the examination.

Visual inspection of the parts revealed soot accumulations and discolored

hydraulic fluid residue on the underside of the bearing flange and on the surface of the

housing boss, indicating that these surfaces had not been mated together during the fire.

During the examination, the bearing was reassembled into the actuator body so

that the fire witness marks on the actuator surface and the bearing flange matched and the

bearing was situated as close as possible to the actuator's housing surface. In this position,

it was noted that an additional 30-degree rotation was required in order for the bearing

flange to mate against the actuator boss. Comparison of the reassembled bearing to an

x-ray radiograph made prior to disassembly showed that the bearing, as found after the

accident, had been backed off (unscrewed) about 30 degrees of rotation from its fully

seated position. However, the galled part of the bearing and shaft could be aligned only

when the bearing was fully seated, and the standby rudder actuator input lever was in the

neutral position.

Boeing specifies that the maximum force required to move the standby rudder

actuator input lever positioned at the end of the lever should not exceed 0.5 pound. Testing

was performed by Boeing, under the direction of the Safety Board, in order to estimate the

force required at the end of the lever arm to produce visible deformation on the hexagonal

attachment hole flats. Testing indicated that the minimum force to produce the

deformation was 220 pounds. No deformation or damage was noted on the flats of the

attachment hole in the lever arm of the unit.

Additional calculations and testing showed that when the shaft and bearing are

galled and bound together, a force at the end of the lever can untorque the bearing from its

seated position. If the bearing tightening torque is within the specified range of 500 to

600 inch-pounds and the shaft is frozen to the bearing, calculations show that the force

required at the end of the input lever to untorque the bearing is between 70 and 80 pounds.

Tests were conducted at the Boeing facility in Renton, Washington, under Safety

Board direction in order to estimate a binding force produced by the galling found on the

accident airplane's components. The shaft and bearing were custom manufactured with a

known clearance between the parts. In order to produce binding, the clearance between

the test parts was much less than that specified for production parts. Four sets of

specimens, each comprised of one shaft and one bearing, were tested using simulated

Factual Information 65 Aircraft Accident Report

flight cycling profiles. The testing of each pair was discontinued when the lever force

reached a target value. After each test, the parts were disassembled, the galling pattern on

each specimen part was examined, and the surface area of the gall was measured using a

binocular microscope. The binding force versus the estimated galled area in the shaft and

the bearing for each test specimen were plotted and compared to the measured area of the

gall in the accident shaft and bearing. The binding forces were estimated to equate to 68

and 78 pounds at the end of the input crank, based on the areas of the galling on the shaft

and bearing from the accident airplane.

During the postaccident disassembly of the unit, the bearing nut was removed

from the actuator housing. The torque applied to the bearing during this removal process

was not recorded. However, during the process, the torque to rotate the bearing around the

shaft was reacted by a ball machined on and protruding from the shaft that was seated into

a mating socket in the servo valve slide. Calculations showed that the maximum torque

that could be reacted by the shaft ball before fracture equated to about 76 pounds at the

end of the lever. The shaft and ball were intact after disassembly.

Thus, the effect on rudder control was examined, assuming that a force of about

80 pounds applied at the end of the standby rudder actuator input lever was necessary to

rotate the shaft with respect to the actuator housing; the rotation could be effected by

untorquing the bearing (in one direction only) or overcoming the galling force. As the

rudder moves, the load applied to the torque tube will be reacted by the restoring moment

of the centering spring and any added restoring force applied to the pilots' pedals. As this

load is applied, the resulting deformation of the control linkages between the point of

application at the torque tube to the standby rudder actuator attachment at the

rudder--torsional windup of the torque tube, bending of the input lever, and any looseness

in linkage connections--will offset the effect on the MPCU direct feedback so that the

MPCU input crank will be moved toward the null position. If the standby rudder actuator

input lever is bound in an angular position near to null, the pilot may be able to control the

rudder position with relatively low pedal force.

If the standby rudder actuator input lever is bound with an angular displacement

from null greater than about 1.4 degrees, the load necessary to null the MPCU servo valve

through deformation equals or exceeds the 80-pound load at the end of the standby rudder

actuator crank necessary to overcome the binding or untorque the bearing. According to

Boeing, the centering spring restoring moment will reach this load with a rudder

deflection of 3 to 5.5 degrees depending upon tolerances. A force applied at the pilot's

rudder pedal would be additive to the centering spring load to reduce rudder deflection. A

pedal force of 47 pounds or greater could even achieve some opposite direction rudder.

A maximum yaw damper deflection of 2 degrees at the rudder would produce a

1.34-degree displacement at the lever, and would require 75 pounds of load at the lever to

overcome. Pilot pedal forces of 35 pounds would be sufficient to bend the standby rudder

actuator input crank sufficiently to regain control of the rudder.

During a routine UAL airplane maintenance inspection, the bearing was found

loose (unscrewed), and the safety wire was broken on the standby rudder actuator from

Factual Information 66 Aircraft Accident Report

another B-737. The standby rudder actuator was removed and shipped to the Safety

Board's Materials Laboratory for examination.

Examination of the unit disclosed that the bearing and the shaft were galled. The

area of galling on the shaft and bearing from this unit was about the same, or slightly

larger than that found on the shaft and bearing from the accident airplane.

Three in-service witness marks were observed on the surface of the housing boss.

One of the marks appeared to be a dirt mark and coincided with the edge of the bearing

flat when the bearing was rotationally tightened in the actuator body using hand force.

The other two marks appeared to be rub marks. The rub marks corresponded to the

bearing hex nut flat, as if the bearing was backed off 5.5 degrees and 17.8 degrees, from

its tightened position.

1.16.3.1 Additional Standby System Actuator Binding/Jam Tests

During the investigation of the USAir flight 427 accident, Safety Board

investigators conducted additional tests on the rudder system of a 737 to examine the

effects of variable input shaft binding forces and input shaft binding at different positions,

with and without yaw damper input and various hydraulic system failures. Before testing,

the investigators verified that the airplane’s rudder system rigging and main and standby

rudder PCU installations met in-service standards; the investigators also cycled the rudder

systems to verify instrumentation and operational limits and establish a baseline. The

standby rudder actuator was removed from the test airplane and replaced with a standby

rudder actuator that was selected for the testing because it exhibited input shaft and

bearing galling similar to the unit that was installed on the USAir flight 427 accident

airplane.

The following rudder commands were input with the main and standby rudder

PCUs pressurized:

full rudder pedal inputs in both directions with the yaw damper

disengaged, full rudder pedal inputs in both directions with the yaw damper engaged, and

full yaw damper commands in both directions. In all of these tests, the rudder system

functioned normally, and higher-than-normal pilot rudder pedal forces were not

required.

After these tests, the standby rudder actuator was replaced with one that had an

input shaft that could be adjusted to various levels of binding (intended to simulate

galling). The replacement actuator was used to determine the effects of binding of the

standby rudder input shaft and bearing and the various levels of force that would be

required to overcome such binding. Tests were conducted with the actuator adjusted so

that 60 to 70 and 100 pounds of force were required to move the actuator input arm. The

tests also measured the effects of left, right, and no yaw damper commands.

The standby and main rudder PCU input rods move together regardless of which PCU is pressurized.

According to Boeing, normal input force is about 0.5 pounds.

Factual Information 67 Aircraft Accident Report

The tests showed that, with 60 to 70 pounds of standby rudder binding force, the

rudder could travel 7° to the left with a full left yaw damper command and 8° to the right

with a full right yaw damper command. With 100 pounds of standby rudder binding force,

the rudder could travel 8° to the left and right with full left and right yaw damper

commands, respectively.

Test conditions that simulated hydraulic system failures, along

with binding of the standby actuator, did not significantly affect the rudder system’s

operation. Ergonomic research indicates that pilots should have no difficulty applying 80

to 100 pounds of leg-pushing force against the rudder pedal, thus overriding the effect of

such standby rudder actuator binding. (For additional information regarding ergonomic

research on pilot rudder pedal forces, see section 1.18.3.)

Tests were also conducted to determine the effects of a hard jam (not just binding)

of the standby rudder actuator input shaft and bearing at the neutral, 3° (simulating left

and right yaw damper inputs), and maximum standby rudder actuator positions (limited

by the main rudder PCU external manifold stop). The tests showed that, with the standby

rudder actuator input shaft jammed at the neutral position, the rudder could travel 6° to the

left and 4° to the right with respective full yaw damper commands. A force of 45 pounds

on the left rudder pedal or 55 pounds on the right rudder pedal would return the rudder to

the neutral position; when the yaw damper command was turned off, the rudder remained

at neutral.

When the standby rudder actuator input shaft was jammed at the 3° left position,

the rudder could travel 10° to the left with a full left yaw damper command and 3° to the

right with a full right yaw damper command. With the yaw damper at its full deflection, a

force of 95 pounds or 25 pounds on the appropriate rudder pedal, respectively, would

return the rudder to the neutral position. When the yaw damper was turned off, the rudder

was positioned 2° left of the neutral position.

When the standby rudder actuator input shaft was jammed at the 3° right position,

the rudder could travel 2° to the left with a full left yaw damper command and 13° to the

right with a full right yaw damper command. With the yaw damper at its full deflection, a

force of 30 or 110 pounds on the appropriate rudder pedal, respectively, would restore the

rudder to the neutral position. When the yaw damper was turned off, the rudder was

positioned 4° to the right of the neutral position.

With the standby rudder actuator input shaft jammed at a position required for a

full maximum rate left rudder input (limited by the main rudder PCU external manifold

stop), the rudder traveled 19° to the left of the neutral position. Under this test condition,

65 pounds of force applied to the right rudder pedal returned the rudder to the neutral

position. The 65-pound force to the right rudder pedal would create a 140-pound force on

the standby PCU input arm.

The 737-300 yaw damper still commanded ± 3° of motion. Therefore, if the standby actuator

jammed when the rudder was positioned 3° left of its neutral position, the yaw damper could command

rudder movement 3° in either direction, resulting in left rudder movement to 6° of left or right deflection

back to neutral. If the rudder was at 6°

° left when the standby actuator binding occurred, the yaw damper

could command rudder movement that would result in between 3 and 9° of left rudder deflection.

Factual Information 68 Aircraft Accident Report

Regardless of whether the standby rudder actuator input shaft was jammed at

3° left or 3° right of the neutral position or at the main rudder PCU body stop in either

direction, the rudder moved to an off-neutral position when the hydraulic system was

powered. With the standby rudder actuator input shaft and bearing jammed at the neutral

position, no initial offset to the rudder occurred. In every case, the rudder could be

centered by applying rudder pedal force to oppose the offset.

The replacement standby actuator contained an input shaft and bearing that

displayed galling similar to the unit that was installed in the United flight 585 airplane.

Subsequent testing indicated that a full 3° yaw damper command would result in a

5° rudder movement to the left and a 6° rudder movement to the right. Another galled

input shaft and bearing were installed in the standby rudder actuator, and subsequent tests

indicated that full 3° yaw damper commands to the left and right resulted in 6° of rudder

movement in the respective directions.

1.16.4 Other Documented Rudder Control Incidents

Boeing stated that, at the time of the United flight 585 accident, 737-series

airplanes had flown about 50 million hours and that there had been five previous incidents

involving anomalies in the main rudder PCU.

• On July 24, 1974, the flight crew of a 737 reported that a rudder moved “full

right” upon touchdown. The investigation revealed that the primary and

secondary slides were stuck together by a shotpeen ball lodged in the servo

valve.

• On October 30, 1975, during a main rudder PCU inspection, shotpeen balls

were found in a servo valve that had undergone chrome plating.

• On August 26, 1977, the flight crew of a 737 reported that, during taxi, the

right rudder pedals moved in “half way” and then jammed. This event

happened three times and was corrected each time by cycling the rudder with

the standby rudder system. Further examination indicated that the main rudder

system was contaminated by metal particles.

• On August 31, 1982, the flight crew of a 737 reported that the rudder “locked

up” on approach and that the flight crew initiated a go-around and activated

the standby rudder system. The subsequent landing was uneventful. The

examination of the PCU revealed internal contamination and worn seals,

which resulted in the PCU having a limited capability to generate enough force

to move the rudder.

For information about additional anomalies and events potentially involving the 737 rudder system

and/or main rudder PCU, see section 1.18 of the final report on the USAir flight 427 accident.

Factual Information 69 Aircraft Accident Report

• On November 8, 1990, during an overhaul, a main rudder PCU was found to

have internal corrosion. The primary slide was stuck to the secondary slide at

the neutral position as a result of the corrosion. No malfunctions were reported

before disassembly.

In addition, during the initial investigation of the United flight 585 accident,

another rudder-related anomaly was reported. On July 16, 1992, during a preflight rudder

control ground check at O’Hare International Airport, Chicago, Illinois, the captain of a

United Airlines 737-300 noted that the left rudder pedal stopped and jammed near

25-percent pedal travel. The captain reported that he was moving the rudder pedals more

rapidly than usual when the jam occurred. He further stated that the rudder pedals returned

to their neutral position after he removed foot pressure from the left rudder pedal. The

airplane returned to the gate, and the main rudder PCU was removed for further

examination.

The main rudder PCU was tested and examined at United Airlines’ facility in San

Francisco, California, and Parker’s facility in Irvine, California. The testing revealed that

the PCU exhibited anomalous behavior, ranging from sluggish movement of the actuator

piston to a full reversal in the direction of piston travel opposite to the direction being

commanded, when the input crank was fixed against the PCU body stops (to move the

primary and secondary slides throughout their full travel) and the yaw damper piston was

in the extend position. The testing also revealed high internal fluid leakage. When

investigators tapped on the dual servo valve housing or the summing levers or released the

force on the input crank, the PCU returned to normal operation.

Further examination of the servo valve components showed that the secondary

slide could move axially beyond its designed operating position (overtravel), resulting in

abnormal porting of hydraulic fluid. When the secondary slide overtraveled to its

mechanical stop (internal stop) in the servo valve housing, the abnormal flow could

produce full pressure opposite to that intended at the actuator piston. Thus, the rudder

would move in a direction opposite to the commanded direction; for example, rudder

input intended to command left rudder could result in the rudder moving right.

The Safety Board’s examination of this servo valve revealed that overtravel of the

secondary slide occurred when the rudder pedals were moved rapidly to command a

maximum rate of rudder travel or when the pedal was fully depressed to command full

deflection of the rudder. During subsequent tests, the overtravel of the secondary slide was

determined to be the result of the failure of the secondary summing lever to maintain

contact with its respective external stop. Examination of the summing levers revealed that

the secondary summing lever did not meet design specifications in that the chamfer

the summing lever was 50°, rather than the specified 45°, at the point where it contacted

the external stop. This anomaly allowed the secondary summing lever to move beyond its

external stop; thus, the secondary slide and summing lever could continue to move

A chamfer is an oblique face located at a corner (a beveled edge).

Factual Information 70 Aircraft Accident Report

beyond the normal range of travel until the secondary slide bottomed out at its internal

stop in the servo valve housing.

As a result of its investigation of this incident, the Safety Board became concerned

about the potential for rudder reversal in all 737 main rudder PCUs, specifically, that the

internal stops of the dual-concentric servo valve could allow sufficient movement to route

hydraulic fluid through a flow passage located outside the normal valve operating range,

resulting in movement in the direction opposite to the control input. On November 10,

1992, the Board issued Safety Recommendations A-92-120 and -121.

Safety Recommendation A-92-120 asked the FAA to

Issue an airworthiness directive mandating design changes for main rudder PCU

servo valves that would preclude the possibility of rudder reversal attributed to

the overtravel of the secondary slide.

Safety Recommendation A-92-121 asked the FAA to

Conduct a design review of servo valves manufactured by Parker Hannifin that

have a design similar to the 737 rudder power control unit servo valve that control

essential flight control hydraulic power control units on transport-category

airplanes certificated by the Federal Aviation Administration to determine that the

design is not susceptible to inducing flight control malfunctions or reversals due

to overtravel of the servo slides.

Section 4 contains the history and status of these recommendations.

Because of the nature of the United flight 585 accident, the PCU servo valve from

N999UA, the accident airplane, was also subjected to tests involving abnormal movement

of the concentric primary and secondary slides. It was found that the tolerances of this unit

were such that maximum travel of the secondary slide, irrespective of the relative position

of the primary slide, would not result in a reversal of pressure differential across the

actuator pistons. In the worst case, with the secondary slide against its internal stop, an

internal leakage was produced with a resultant 66-percent drop in maximum pressure

differential across the pistons. This condition would limit the rate of rudder movement

and the maximum deflection that could be achieved against aerodynamic loads. In

addition, the secondary summing lever was making full contact with its respective stop,

which would eliminate one condition that could lead to an overtravel of the secondary

slide.

The servo valve was designed to prevent abnormal flow if the secondary slide bottomed out at its

internal stop; however, during the investigation of this incident, it was discovered that parts built within

tolerances could be assembled with a resulting tolerance buildup that would allow the abnormal flow to

occur if the secondary slide moved to its internal stop. Thus, in addition to the potential for overtravel

because of the incorrect chamfer, it became evident that the secondary slide could also be forced into the

overtravel range if it became jammed to the primary slide. Normal movement of the primary slide could

produce a rudder reversal if a primary to secondary slide jam existed.

Factual Information 71 Aircraft Accident Report

1.16.5 Additional Examination and Testing of 737 Flight Control

Systems/Components

During its investigation of the USAir flight 427 accident, the Safety Board

conducted numerous additional tests and examinations of the 737 rudder actuator system

components. Several of these tests are described next. For more information about these

and other tests conducted in connection with the USAir flight 427 accident investigation,

see the Board’s final report for that accident.

Tests were conducted to determine the effects on the rudder system of the presence

of a foreign object or blockage between the main rudder PCU external input crank and

one of the PCU external manifold stops. The tests indicated that a blockage between the

rudder’s external input crank and one of the external manifold stops could result in a

significant rudder movement. However, the main rudder PCU linkage is positioned so that

it prevents a foreign object from dropping into the space between the aft stop and the

crank arm. The PCU’s orientation also makes it difficult for a foreign object to lodge

between the forward stop and input link. The external summing lever effectively covers

the gap in the PCU retract direction (left rudder command).

The Safety Board conducted a series of tests to examine the effects of dynamic

external loads (such as those that the United flight 585 airplane might have experienced

during its approach in turbulent weather and the USAir flight 427 airplane might have

experienced during the wake turbulence encounter) applied axially to the main rudder

PCU actuator rod.

The tested PCUs responded normally throughout all tests without any

abnormal motions.

In the tests to determine the effects of silting,

the flight 427 PCU was rigged to

allow silting to occur and then was freed to operate normally. A force of 4 pounds was

required to move the external input crank. Normal input crank operation requires about

1.5 pounds of force.

To determine the effects that air in the hydraulic fluid would have on the main

rudder PCU operation, the Safety Board conducted operational tests of the USAir

flight 427 PCU. The PCU responded normally (the output command matched the input

command).

These tests were conducted on a new-production PCU and the flight 427 PCU; the PCU from United

flight 585 was too badly damaged to test.

The term “silting” refers to the accumulation of particles of contaminants in hydraulic fluid in a

hydraulic component. The particles are smaller than the filter on the inlet side of the component and tend to

settle at various edges and corners of valves and stay there unless washed away by higher flow rates. In

other words, when the servo valve is in the hydraulically neutral position, the flow of hydraulic fluid is

restricted, and the servo valve can function as a filter by catching some of the particles. These particles tend

to accumulate at the upstream side of edges and corners of narrow orifices (such as the servo valve ports);

however, movement of the servo valve from the hydraulically neutral position results in increased hydraulic

fluid flow, which tends to flush any accumulated particles through the servo valve.

Factual Information 72 Aircraft Accident Report

Also during its investigation of the USAir flight 427 accident, the Safety Board

conducted detailed examinations of main rudder PCU servo valves, PCU servo valve chip

shear tests, PCU thermal tests, tests to determine the effects of rudder actuator reversals

during servo valve secondary slide jams, and ground demonstrations of rudder PCU servo

valve jam/reversal. These tests are discussed in sections 1.16.5.1 through 1.16.5.5,

respectively.

1.16.5.1 Detailed Examinations of Main Rudder PCU Servo Valves

Several times during the USAir flight 427 investigation, the Safety Board

subjected the flight 427 PCU

to Parker’s postproduction acceptance test procedure

(which is a performance-based test only and does not require the measurement of

diametrical clearances). The acceptance tests did not reveal any disqualifying anomalies.

It was not possible to measure the diametrical clearances that existed within the

PCU servo valve from United flight 585 because the valve was damaged by the

postaccident fire and attempts to remove the PCU from the wreckage. However, the

Safety Board measured the clearances between the primary and secondary slides and

between the secondary slide and the servo valve housing on three PCU servo valves—a

new-production PCU servo valve and the servo valves from the USAir flight 427 and

Eastwind flight 517 airplanes. These measurements indicated that a wide variability

existed among servo valves that passed Parker’s acceptance tests. The primary and

secondary slides and the servo valve housing of each PCU were measured in three

places—at the input lever end, midpoint, and spring end. Table 1 lists the minimum

diametrical clearances (in inches) measured for each PCU at each position.

Table 1. Diametrical clearance measurements (in inches) for three PCUs.

Postaccident tests and examinations were performed on the USAir flight 427 main rudder PCU servo

valve and the primary and secondary slides in their condition as recovered. The PCU actuator rod and

external input linkage, however, exhibited impact damage that precluded normal operation; thus, these

components (and their associated hardware) were replaced to facilitate testing.

Measurement

position

427 PCU

slide to

housing

427 PCU

slide to

slide

517 PCU

slide to

housing

517 PCU

slide to

slide

New PCU

slide to

housing

New PCU

slide to

slide

Input lever end 0.000130 0.000170 0.000190 0.000200 0.000195 0.000190

Midpoint 0.000140 0.000140 0.000170 0.000180 0.000215 0.000200

Spring end 0.000170 0.000150 0.000180 0.000190 0.000190 0.000210

Factual Information 73 Aircraft Accident Report

As part of its USAir flight 427 investigation, the Safety Board conducted further

detailed examination and testing of the main rudder PCU servo valves from USAir

flight 427, Eastwind flight 517, and United flight 585. The Board also examined a

“minimum tolerance” servo valve that was used by Boeing during thermal shock testing

(see section 1.16.5.3);

new-production servo valves; the servo valve from the

December 19, 1997, Silk Air flight 185 (737-300) accident in Palembang, Indonesia; and

five servo valves supplied by Parker that had been removed from service and had varying

hours of operation (referred to as exemplar valves). The Board’s materials laboratory

examined the primary and secondary slides and housing from each of these main rudder

PCU servo valves

using a specially designed borescope and video recording system.

Each segment of the primary and secondary slides’ outside diameter surfaces, the

metering ports,

and the inside diameters of the secondary slide and the servo valve

housing were examined with a 90° borescope at magnifications up to 130 times. The

outside diameter surfaces of the primary and secondary slides were also examined with a

binocular microscope.

A few small chipped areas were noted on the metering edges of the primary slide

of each of the units examined; the locations of the chipped areas did not correspond

circumferentially to the metering port areas. Examination with a scanning electron

microscope (SEM) revealed that the dimensions of the largest chipped area on the USAir

flight 427 primary slide was 0.006 inch in circumference by 0.002 inch in length. The

other primary slides examined (including the new-production servo valve primary slide)

had chipped areas of similar or larger size yet still met specifications.

The metering ports for the secondary slide and the servo valve housing inside

diameter surfaces were also examined using a 15° borescope so that the metering port

edges could be better viewed. No evidence of deformation or distress was noted on any of

the metering ports on any of the secondary slides and servo valve housings.

In addition, small deposits of material that appeared to have the same composition

as the secondary slide were observed on the slide’s outside diameter surface adjacent to

the metering edge. To identify the origin of these material smears, the Safety Board

reviewed Parker’s manufacturing procedures. This review found that, during manufacture,

the servo valve slides are trimmed (or cut) at the metering edges, burr-wiped (or

polished), and functionally tested in matched assemblies. The Board obtained from Parker

This servo valve was specifically selected from existing stock because it had the tightest tolerances

between the primary and secondary slides and the secondary slide and the servo valve housing that would

pass the PCU acceptance test friction requirements. According to Boeing, the diametric clearance between

the secondary slide and the servo valve housing was 0.000070 inch. (The same clearance in the USAir

flight 427 valve was 0.000130 inch.)

The main rudder PCU from the Silk Air accident airplane was examined by Safety Board

investigators under the supervision of a representative from the Indonesian government. The examination

did not reveal any evidence of a preimpact jam or failure.

Metering ports are rectangular holes in the servo valve housing and secondary slide through which

hydraulic fluid flows to cause actuation of the unit. Metering edges are the sides of grooves that are cut into

the outside diameter surface of the primary and secondary slides. Flow of hydraulic fluid is controlled by

positioning the metering edges relative to the metering ports.

Factual Information 74 Aircraft Accident Report

two primary slides in an intermediate manufacturing condition to microscopically observe

the trimmed and trimmed/burr-wiped conditions. SEM examination of the trimmed-only

primary slide revealed numerous pieces of folded-over metal curled over the metering

edge at the trimmed edge of the slide. SEM examination of the trimmed and burr-wiped

primary slide showed areas on the slide’s outside diameter adjacent to the trimmed edge

that appeared to be flattened down and smoothed over, similar to that observed on the

USAir flight 427 primary slide.

1.16.5.2 PCU Servo Valve Chip Shear Tests

The Safety Board conducted two series of tests during the USAir flight 427

investigation to determine if a chip of material could lodge between the PCU servo valve

primary and secondary slides or between the secondary slide and the valve housing and

result in a jammed servo valve. The first series of tests were conducted at Boeing’s

Equipment Quality Analysis Laboratory in January 1995 with chips of various materials

that could be found in an airplane system. These materials included rubber, Teflon, steel

wire, aluminum alloys, hardened and stainless steels, lockwire, aluminum-nickel-bronze,

and chrome plating. The chip sizes were manufactured so they would be large enough to

fill as much as possible of the 0.015- by 0.045-inch primary metering ports. Chips were

inserted into these metering ports at the interface of the primary and secondary slides of a

servo valve slide assembly. The primary slide was then moved to close off the metering

port.

The tests demonstrated that, when forces of up to 44 pounds were applied

move the primary slide to close off the secondary slide metering ports, all but one type of

chip sheared. The chip that did not shear was a hardened-steel chip that jammed the

primary slide to the secondary slide and did not shear with the maximum force of

44 pounds applied.

When investigators examined the servo valve after the primary slide

jammed on the hardened-steel chip, they noted a physical mark on the surface of the

primary slide where the chip was inserted. The physical mark had the approximate size

and shape of the hardened-steel chip.

A second series of chip shear tests was conducted at Boeing’s facility in Everett,

Washington, in February 1997. These chip shear tests were similar to the January 1995

tests except that (1) the February 1997 test chips were inserted in the secondary metering

ports at the interface of the secondary slide to the servo valve housing, (2) different sizes

of hardened-steel chips were used, and (3) forces of up to 140 pounds were applied. In the

February 1997 tests, all of the chips were successfully sheared, and each shearing event

created a mark on the secondary slide that was approximately the shape of the chip. The

maximum shear force needed was 140 pounds for a 0.042-inch wide by 0.014-inch thick

chip. The minimum shear force for the same material was 23 pounds for a 0.011-inch

wide by 0.013-inch thick chip.

According to Boeing, the PCU design allows a maximum input force of about 50 pounds to the

primary slide and 200 pounds to the secondary slide.

This chip was 0.032 to 0.058 inch wide by 0.012 to 0.016 inch thick.

Factual Information 75 Aircraft Accident Report

1.16.5.3 PCU Thermal Testing

A hydraulic system thermal analysis by Boeing engineers conducted during the

USAir flight 427 investigation indicated that the failure of one of the 737 airplane’s

engine-driven hydraulic pumps (EDP) could result in the overheating of the fluid in one of

the hydraulic systems. Further, in response to recommendations made by an independent

technical advisory panel,

the Safety Board conducted two series of thermal tests (in

August and October 1996)

to identify the effects of thermal variations on the operation

of the main rudder PCU. The hydraulic fluid used in the Safety Board’s silting tests was

used for both series of thermal tests.

During the August 1996 thermal tests, a total of 12 tests were conducted: 4 on a

new-production PCU and 8 on the USAir flight 427 PCU. During the October 1996

thermal tests, a total of 19 tests were conducted: 8 on the new-production PCU and 11 on

the USAir flight 427 PCU. The tests for both series were conducted first on the

new-production PCU (to verify setup and methodology) and then on the USAir flight 427

PCU. Testing under all of the thermal test conditions was accomplished by pushing or

pulling the external PCU input crank with a rod (simulating a left or right input command)

and using sufficient force to move the secondary slide. (In the absence of jamming or

binding, the secondary slide moves when about 12 pounds of force is applied at the input

crank.)

The results of three thermal test conditions (performed on both PCUs during both

the August and October 1996 test series) are discussed in this report section. Two of these

test conditions were included in this section because the tests and their results were

representative of all other thermal tests that were conducted under conditions believed at

the time to approximate those that a 737 airplane might encounter during normal

operation (baseline and with a hydraulic system failure). The third test condition, which

used hot hydraulic fluid injected directly into a cold PCU to explore the effects of extreme

temperature differentials on the main rudder PCU’s operation, was selected for inclusion

in this section because the USAir flight 427 PCU exhibited anomalous behavior during

this test condition.

For these three thermal test conditions, the exterior temperature of the PCU servo

valve housing was allowed to reach and stabilize at a temperature believed, at the time the

tests were conducted, to be representative of the vertical stabilizer cavity (where the

rudder PCU is located) of the accident airplane just before the upset (-27 to -40° F).

These temperatures were achieved before each test without hydraulic fluid circulating

The independent technical advisory panel was created by the Safety Board in January 1996 to review

the work of the Board’s Systems Group for the flight 427 investigation.

The October 1996 tests used improved temperature control and data recording capabilities.

The temperatures used during these tests (-27 to -40° F) were based on the results of Boeing’s thermal

analyses. In October and December 1996, Boeing conducted flight tests to measure the operating

temperatures of the 737 hydraulic system and main rudder PCU in a normal operating environment. The

December 1996 tests indicated that the PCU servo valve housing operating temperature was greater than

-27° F, as discussed at the end of this section.

Factual Information 76 Aircraft Accident Report

through the PCU. Also, the PCU servo valve housing continued to be cooled by the cold

ambient air inside the test chamber and was warmed to varying degrees and at varying

rates by the introduction of hydraulic fluid into the servo valve.

1.16.5.3.1 Baseline Test Condition

This test condition approximated the system operating temperatures that

investigators initially hypothesized for the USAir flight 427 accident airplane if both

hydraulic systems A and B were operating normally (PCU temperatures of about 10 to

20° F and hydraulic fluid temperatures of about 70° F at the PCU inlet). Test results for

this condition indicated that the difference in the servo valve exterior surface temperature

and the hydraulic fluid temperature at the PCU was approximately 50 to 60° F. Both the

new-production PCU and the accident airplane’s PCU responded normally during all tests

under this condition.

1.16.5.3.2 Simulated Hydraulic System Failure Condition

In this test condition, the temperature of the hydraulic fluid entering the PCU was

raised to simulate a malfunction of one of the EDPs. Boeing could not provide flight test

data for the temperature of the hydraulic fluid at the PCU. Therefore, at the Safety Board’s

request, Boeing performed a thermal analysis, which indicated that a failed EDP could

raise the temperature of the hydraulic system reservoir associated with the pump failure to

180 to 207° F. (The 737 incorporates a hydraulic fluid temperature sensor near the EDPs

that provides a cockpit indication of an overheat condition when the hydraulic fluid

reaches or exceeds 220° F. The accident airplane’s CVR recorded no flight crew comment

regarding hydraulic system overheating.) Boeing’s thermal analysis also indicated that, if

the hydraulic fluid were to overheat to a point just below the threshold of the overheat

detector, the hydraulic fluid would cool to about 170° F as it passed from the hydraulic

pumps to the end of the pressurized section of the fuselage. The fluid would then pass

through about 15 feet of 3/8-inch diameter steel tube before it would reach the hydraulic

fluid inlet point on the main rudder PCU.

The tests for this condition were conducted with the hydraulic fluid temperature

raised to about 170° F at the point that the fluid entered the thermal test chamber. The

fluid was then cooled by the ambient conditions in the chamber (temperatures in the

chamber were between -27 and -40° F) as the fluid passed through the steel tubing into the

main rudder PCU. Testing was conducted with both hydraulic systems A and B

overheated and with only system A overheated (system B was at about 60° F). Test results

for these conditions indicated that the difference in the servo valve exterior surface

temperature and the hydraulic fluid temperature at the PCU inlet was approximately

100° F. Both the new-production PCU and the accident airplane’s PCU responded

normally during all tests under this condition.

1.16.5.3.3 Extreme Temperature Differential Test Condition

This test condition examined the effects of subjecting the PCU to a relatively

extreme differential between the hydraulic fluid temperature at the PCU inlet and the

Factual Information 77 Aircraft Accident Report

servo valve exterior surface temperature. The extreme temperature differential produced

during this test condition would not be expected during normal flight operations. For this

test condition, the PCU was cooled to about –40° F while both hydraulic systems were

depressurized (no hydraulic fluid passing through the PCU). At the beginning of these

tests, heated hydraulic fluid only from system A (at a temperature of 170° F) was inserted

directly into the PCU. The maximum temperature differential between the inlet hydraulic

fluid and the servo valve housing of 180° F was attained 25 seconds after insertion of the

heated hydraulic fluid.

The new-production PCU responded normally under the extreme temperature

differential test condition. However, the USAir flight 427 PCU exhibited anomalous

behavior during these tests. During the August 1996 extreme temperature differential

tests, the accident airplane’s PCU responded normally for the initial three external input

crank commands, but the external input crank stuck in the full left rudder position for

about 5 seconds at the end of the fourth input command. Afterward, the movement of the

external input crank was normal, except for a hesitation in motion as the crank was pushed

and pulled on each input command in both the rudder left and rudder right directions.

The anomalous operation of the USAir flight 427 PCU was verified by a repeat

test. During this repeat test, the PCU responded normally for one input command.

However, during the next two input command cycles, the external input crank moved

slower than normal for the left rudder command. At the end of the fourth left rudder

command cycle, the external input crank stuck in the full left rudder position for about

1 second, after which the movement of the external input crank returned to normal.

To further examine the extreme temperature differential test condition, the PCU

temperature was once again lowered to about -40° F and stabilized, and the test was

repeated again. During this repeat test, the PCU responded normally for the first three

input commands. During the next three input commands, however, the external input

crank moved slower than normal during the left rudder command. At the end of each of

these left rudder command inputs, the force required to return the input crank to neutral

increased to about 124 pounds for about 1 second. Afterward, the external input crank

returned to its neutral position with the application of less than 5 pounds of force.

The October 1996 tests under the extreme temperature differential test condition,

which utilized improved temperature control and data collection systems, yielded similar

results for the USAir flight 427 PCU. Examination of the hydraulic fluid flow data

revealed that momentary, anomalous increases in hydraulic system fluid return flow

occurred during the jamming/binding. Further examination of the data indicated that the

servo valve secondary slide momentarily jammed to the servo valve housing and that the

subsequent overtravel of the primary slide resulted in an increase in system return flow

that could cause a rudder actuator reversal (travel in the direction opposite to that

commanded). Although reversal of the PCU actuator was not noted by any of the

participants or observers during the tests, the periods of anomalous hydraulic system fluid

flow observed in the data were consistent with the misporting of the hydraulic fluid from

the effects of the jammed secondary slide and overtravel of the primary slide, resulting in

a momentary output command opposite to the input command.

Factual Information 78 Aircraft Accident Report

1.16.5.3.4 Additional Testing

The USAir flight 427 PCU was disassembled and examined at Parker after both of

the August and October 1996 test series were completed. The primary slide, secondary

slide, and interior of the servo valve housing showed no evidence of damage or physical

marks from jamming or binding during the thermal testing. The PCU also passed the

functional acceptance test procedure used by Parker for validating PCU performance.

On October 4, 1996, at the Safety Board’s request, Boeing conducted a flight test

to measure the operating temperatures of the 737 hydraulic system and main rudder PCU

in a normal operating environment. A test airplane was flown for about 2 hours at an

altitude of up to 30,000 feet. Measurements included static air temperature outside the

airplane (-40° F), temperature on PCU body (20° F), and temperature of the hydraulic

fluid exiting the EDP (100° F).

Additional temperature data was obtained during a flight test on

December 6, 1996, that was conducted by Boeing (at the request of the Safety Board) with

additional instrumentation. During this flight test, a test airplane was flown for about

2 hours at an altitude of up to 35,000 feet, and then the airplane descended to 20,000 feet

for 1 hour. Data from this flight test indicated the following temperatures at 35,000 feet:

static air outside the airplane, -58° F; hydraulic system A fluid at the outlet of the EDP,

58° F; hydraulic system A fluid at the PCU inlet, 22° F; hydraulic system B fluid at the

PCU inlet, 34° F; PCU servo valve housing, 35° F; and ambient air around the PCU

(inside the vertical stabilizer), -15° F.

Data from this flight test indicated the following temperatures at 20,000 feet: static

air outside the airplane, -36° F; hydraulic system A fluid at the outlet of the EDP, 65° F;

hydraulic system A fluid at the PCU inlet, 35° F; hydraulic system B fluid at the PCU

inlet, 35° F; PCU servo valve housing, 38° F; and ambient air around the PCU (inside the

vertical stabilizer), 0° F.

In February 1997, Boeing independently conducted a third series of thermal tests.

These tests were conducted on a main rudder PCU that was specifically selected by

Boeing because it had the tightest diametrical clearances (between the primary and

secondary slides and between the secondary slide and servo valve housing) that would

pass the Parker functional acceptance test procedure frictional requirements.

Boeing reported that this minimum tolerance PCU servo valve operated normally

for each test condition designed to simulate a hydraulic system overheat, with one or both

hydraulic systems circulating fluid through the servo valve before insertion of the heated

fluid and at Boeing’s estimated normal operating temperatures within the vertical fin

(conditions similar to those used in the Safety Board’s simulated hydraulic system failure

tests). Boeing conducted additional tests in which hot hydraulic fluid was injected directly

As noted in section 1.16.5.1, the diametrical clearance of the minimum tolerance servo valve

(secondary slide to servo valve housing) was 0.000070 inch. (The same clearance in the USAir flight 427

main rudder PCU servo valve was 0.000130 inch.)

Factual Information 79 Aircraft Accident Report

into the minimum tolerance servo valve. Hydraulic fluid was not circulated through the

servo valve before insertion of the heated hydraulic fluid (conditions similar to those used

in the Board’s extreme temperature differential tests). In some tests under these two

conditions, the minimum tolerance servo valve’s secondary slide jammed to the servo

valve housing (and remained jammed as long as the force on the input crank was

maintained). The smallest temperature differential between the inlet hydraulic fluid and

the servo valve housing at which the minimum tolerance PCU jammed was 145° F.

1.16.5.4 Rudder Actuator Reversals During Servo Valve Secondary

Slide Jams

After the Safety Board’s October 1996 thermal tests, Boeing engineers began an

independent detailed examination of the test data. Their review of the data indicated that

the PCU servo valve responded slowly and erratically to the input commands when the

secondary slide was jammed to the housing by the thermal shock and an input was applied

to the external input arm. Boeing subsequently conducted tests using a new-production

PCU that had been modified to simulate a jam of the secondary slide to the servo valve

housing at various positions and then to simulate the application of a full rudder input to

the PCU. These tests revealed that, when the secondary slide was jammed to the servo

valve housing at certain positions, the primary slide could travel beyond its intended stop

position because of bending or twisting of the PCU’s internal input linkages (compliance).

This deflection allowed the primary slide to move to a position at which the PCU

commanded the rudder in the direction opposite of the intended command (reversal).

Specifically, the tests revealed that, when the secondary slide was jammed at positions

greater than 50 percent off neutral toward the extend or retract position and a full-rate

command was applied to the PCU, the rudder would move opposite to the commanded

position.

Figures 12 and 13 show normal operation of the servo valve. Figure 14 shows the

servo valve with a secondary slide jam (normal operation). Figure 15 shows the servo

valve with a secondary slide jam and primary slide in the overtravel condition.

The Safety Board has investigated several fatal aviation accidents that have involved flight control

reversals. In some cases, improper maintenance resulted in an airplane’s aileron controls being connected

backward so that a pilot control wheel input intended to command a right turn resulted in a left turn. See the

following National Transportation Safety Board accident reports: ANC94LA101 (August 3, 1994),

FTW92FA218 (August 25, 1992), ATL88LA149 (June 4, 1990), ANC88FA062 (May 20, 1988),

LAX85LA104 (January 10, 1985), MIA84FA040 (December 4, 1983), and MKC83FA090 (April 15, 1983).

Also, see National Transportation Safety Board Briefs of Accident 1469 (August 20, 1982) and 3-1496

(June 9, 1976).

Factual Information 80 Aircraft Accident Report

Figure 12. Normal operation of the 737 PCU servo valve with slides in the neutral

position (no jam).

Figure 13. Normal operation of the 737 PCU servo valve with slides in the extend

command position (no jam).

R Left P Right R

Primary Slide

Primary and Secondary Slides at Neutral

Rudder Rate = 0

Neutral

Secondary Slide

Valve Body

Normal Full Rate Command-

Primary & Secondary Slides Full Open

Rudder Rate TEL

R Left P Right R

Primary Slide

Neutral

Secondary Slide

Valve Body

Factual Information 81 Aircraft Accident Report

Figure 14. PCU servo valve intended operation with the secondary slide jammed to the

servo valve housing and primary slide opposing.

Figure 15. PCU servo valve with the secondary slide jammed to the servo valve housing

and the primary slide in the overtravel condition.

After studying the thermal test conditions in which the USAir flight 427 main

rudder PCU jammed, the Safety Board attempted to determine the combined effects of

PCU servo valve secondary slide jamming and input linkage deflections (compliance) to

determine if the USAir flight 427 PCU was more susceptible to reversal than other servo

valves. These tests were conducted in November 1996 on three PCUs: a new-production

Intended Operation:

Secondary Slide Jammed Full Open, Primary Slide Opposing

(Full Cross Flow)

Rudder Rate = 0

Secondary Slide - Jammed To Valve Body

R Left P Right R

Primary Slide

Neutral

Valve Body

Secondary Slide - Jammed To Valve Body

Newly Discovered Failure Effect:

Secondary Slide Jammed Full Open, Primary Slide Over-Stroked

In Opposing Direction

Rudder Rate TEL

R Left P Right R

Primary Slide

Neutral

Valve Body

Factual Information 82 Aircraft Accident Report

PCU, the USAir flight 427 PCU, and the Eastwind flight 517 PCU. For this series of tests,

a tool was used to mechanically jam the secondary slides of all three PCUs to their

respective servo valve housings. Manual inputs were then applied to the PCUs with the

yaw damper energized and deenergized (no yaw damper command was applied in both

cases). When inputs at a less-than-maximum rate were made to the PCU, all three PCUs

operated normally. However, if the external input crank rate exceeded the capability of the

PCU to respond at its maximum rate, the input caused deflection of the internal linkages

(that is, caused them to bend or twist), resulting in overtravel of the primary slide and a

reverse rudder response (that is, a response opposite to that commanded).

To identify the threshold for reversal, the Safety Board conducted tests on the

three PCUs to determine the distance that the secondary slides had to be placed away from

the neutral (“no rudder command”) position to result in rudder actuator reversal when an

input force was applied to the PCU. The tests indicated that each of the three PCUs would

stall (stop movement) or reverse when the secondary slide was jammed at or beyond the

following positions (expressed as a percentage of full secondary slide travel from the

neutral position):

• New-production PCU: 38 percent in the extend direction, 54 percent in the

retract direction.

• USAir flight 427 PCU: 12 percent in the extend direction, 41 percent in the

retract direction.

• Eastwind flight 517 PCU: 17 percent in the extend direction, 30 percent in the

retract direction.

On August 20, 1997, the Safety Board conducted additional tests on the USAir

flight 427 and Eastwind flight 517 PCUs to determine the effects of a jammed secondary

slide on the force and rate of rudder movement. For these tests, each PCU was installed in

a test fixture at Parker that simulated the airplane installation, and the servo valve

secondary slide was jammed with the jamming tool. Table 2 shows the test results, which

indicated that the position of the secondary slide jam affected the rudder’s output (force

and rate).

Table 2. Test results on the effects of a jammed secondary slide on the force and rate of

rudder movement.

PCU

Position (percent

off neutral)

Force (percent of full

PCU output

capability)

Rate (degrees per

second)

USAir 427 0 100 31.7

USAir 427 12 50 3.9

USAir 427 22 76 9.5

USAir 427 50 88 17.8

Factual Information 83 Aircraft Accident Report

1.16.5.5 Ground Demonstration of Rudder PCU Servo Valve Jam

In connection with the investigation of the USAir flight 427 accident, the Safety

Board participated in June 1997 in a ground demonstration conducted by Boeing at its

facility in Seattle, Washington.

The demonstration was intended to identify and

document the cockpit characteristics of a rudder PCU servo valve secondary slide jam.

The demonstration was accomplished in a newly manufactured 737-300 airplane that was

fitted with a special tool to simulate a rudder PCU servo valve secondary slide jam at

three different positions (about 0 percent, about 25 percent, and about 50 percent of travel

from the neutral position). The demonstration was conducted while the airplane was

parked on the ground with both engines off and with hydraulic systems powered by an

external source of power.

Before the demonstration began, the participants sat in the pilot seats of another

newly manufactured 737-300 and manipulated the rudder pedals to become familiar with

the feel of a normally functioning 737 rudder system on the ground. The participants then

moved to the airplane that was fitted with the special jamming tool, and each participant

USAir 427 71 93 26.6

USAir 427 100

~ 100 ~ 33

Eastwind 517 0 100 31.7

Eastwind 517 22 34 4.8

Eastwind 517 50 79 14.3

Eastwind 517 71 89 25.4

Eastwind 517 100

~ 100 ~ 33

USAir 427 0 100 31.7

a. Full PCU output capability is 5,800 pounds.

b. Rudder motion was in the opposite direction from that commanded.

c. The 100-percent secondary slide jam position was not tested for either PCU because of test equipment limitations.

Force and rate values for both 100-percent positions are estimated by Boeing.

Representatives of the interested parties who were members of the Human Performance Group for

the flight 427 investigation were notified of the demonstration but declined to participate. However, party

members of the Systems Group for the flight 427 investigation and a representative from the expert

technical panel were present during the testing and participated informally in the tests.

PCU

Position (percent

off neutral)

Force (percent of full

PCU output

capability)

Rate (degrees per

second)

Factual Information 84 Aircraft Accident Report

manipulated the rudder pedals under the three simulated rudder jam conditions. One

Safety Board participant described the demonstration as follows:

All demonstrations were conducted in the cockpit, with Boeing test pilot…sitting

in one of the pilot seats to coordinate the procedure…When I was the active

participant, I sat in the right seat wearing the seat belt.

The first demonstration in the test airplane represented a jam of the secondary

slide about 25 percent off [its] neutral position. I pushed the respective rudder

pedals slowly to their full down positions as though I were performing a slow

rudder system check. The right rudder pedal seemed easier to push down than the

left pedal, although the difference seemed subtle. I then performed about 7 tests in

which I [applied] hard left rudder. With one or two exceptions, this input triggered

a rudder reversal on the pedals. Immediately after my input, the left rudder pedal

began moving outwards until it reached the upper stop. The motion was slightly

slower than an input I would expect from a human. The motion was steady and

continued without pause no matter how hard I pushed to counter it (“unrelenting”

was a description that, at the time, seemed to capture my impression)…. [When]

I…“stopped fighting” the motion, [the] action of the rudder system ended almost

immediately and the rudder pedals returned to the neutral position. On subsequent

trials, I “stopped fighting” the rudder motion earlier, before the left pedal had

reached the upper stop. Again, the rudder motion stopped almost immediately as

soon as I stopped applying pressure, no matter where the pedal was located, and

the pedals returned to neutral.

The second demonstration represented a jam of the secondary slide about

0 percent off [its] neutral position. I pushed each respective rudder pedal slowly

to the lower stop as though performing a rudder system check. The right pedal

again seemed easier to push than the left pedal, although the difference was small.

I also pushed the rudder pedals aggressively and abruptly, but this did not produce

a rudder reversal situation.

The third demonstration represented a jam of the secondary slide about 50 percent

off [its] neutral position. I performed about 9 trials. When I moved the pedals

slowly and steadily [as though performing a rudder system check], I was

generally able to move the pedals to their stops without starting a reversal.

Sometimes, however, even a slow input initiated a rudder reversal situation (this

time with the right pedal moving to the upper stop). Any abrupt motion on the

pedals initiated an immediate rudder reversal situation. The rudder reversal

motion was faster than was the case with a jam in [the] 25 percent position,

perhaps similar to a relaxed or slow input speed by a human operator. Again, it

was impossible to stop the motion by physically pushing against the rudder pedal.

On several trials, I tried relaxing my input momentarily before the rudder pedal

reached the upper stop. I found that the rudder reversal motion continued. This

[was not true in the jam at the approximate 25 percent position], when the

relaxation of pressure seemed to automatically stop the reversal motion. This

motion was faster, easier to initiate, and more difficult to stop.

Factual Information 85 Aircraft Accident Report

Other participants reported similar experiences during the demonstrations. They

described the rudder back pressure during the reversal as “machine-like,” “startling,” and

“relentless.”

Another Safety Board employee who participated in the demonstrations stated that

he switched the hydraulic system B flight control switch to “standby rudder” during the

simulation of a secondary slide jam near the 50-percent position, which eliminated the

rudder reversal and allowed the rudder to be centered by rudder pedal inputs in the normal

direction. He reported that the centering was slow and required more rudder pedal

pressure than in the absence of a jam but that there was no need to release the rudder pedal

pressure and reapply it to eliminate the reversal. During subsequent rudder sweeps with

the standby rudder system engaged, the rudder did not reverse. This Board employee (who

is 5 feet 8 inches tall) further stated that he was able to reach the hydraulic system A and B

flight control switches in the overhead panel without difficulty from either the left or right

pilot seats.

1.16.6 Flight Performance Simulation Studies Conducted During

the USAir Flight 427 Investigation (1994-1999)

During the investigation of the USAir flight 427 accident (and the Eastwind

flight 517 incident), Boeing applied a “kinematics analysis,” that is, a technique

developed from prior flight test activities to derive from available FDR data the position

of the flight control surfaces that were not among the parameters recorded by the FDR.

(Use of the kinematics process was not possible for the United flight 585 event because of

the limited number of FDR parameters.) The Safety Board reviewed Boeing’s kinematics

process early in the investigation and then developed its own kinematics programs that

ran on the Board’s computer workstation. The Safety Board developed the programs to

validate the kinematics solutions being developed by Boeing for the USAir flight 427

investigation and now has the technique available for use in future aviation investigations.

The Safety Board’s kinematic results for the USAir flight 427 accident were

compared with Boeing’s kinematic results for the same inputs. Because the review of the

kinematic results indicated that more frequent heading samples were needed to effectively

perform the kinematic calculations, the Safety Board and Boeing used interpolation

techniques to curve fit the FDR’s magnetic heading data and thereby provide data between

the FDR data points. (The accident airplane’s FDR recorded magnetic heading data at a

once-per-second rate.) The FDR’s once-per-second magnetic heading data could be

matched by different interpolation techniques, each resulting in different rudder surface

Boeing’s kinematics process involves fitting curves through available FDR data (such as heading,

pitch, and roll), obtaining time histories of rates from these curves, and obtaining accelerations from these

rates. Forces, moments, and aerodynamic coefficients are then obtained from these accelerations using

Newton’s laws of physics. Boeing uses its aerodynamic models to derive flight control time histories from

the aerodynamic coefficients.

Factual Information 86 Aircraft Accident Report

time histories. Further, kinematics techniques magnified the noise

that was inherent in

the accident airplane’s FDR data, so smoothing techniques were needed to reduce this

noise and minimize the potential for erratic signatures in the extracted control surface time

histories.

Safety Board investigators used the Board’s workstation-based flight simulation

computer program

for the 737-200 and -300 to perform simulations of the flights of

USAir flight 427, United flight 585, and Eastwind flight 517.

The flight simulation

process was used by the Safety Board, rather than the kinematics process, because it

eliminated the uncertainties introduced into the kinematics process through the data

interpolation and smoothing techniques (required because of the limited number of FDR

parameters recorded and the limited sampling of the data). The Safety Board initially used

assumed flight control (control wheel [aileron and spoilers], rudder, and control column

[elevator]) positions (based on earlier Boeing and Safety Board kinematic solutions and

FDR-recorded column position when available) as inputs into its computer simulations

and then compared the output of the simulations—such as altitude, airspeed, and

heading—with the available FDR data. Safety Board investigators then modified the

control input, reran the simulations, and continued this process (known as iteration) until a

good match with the FDR data was obtained.

Various factors affect the extent to which the derived control surface positions

reflect the actual control surface positions. For example, the accuracy of the simulations is

affected by the fidelity of the aerodynamic modeling of the airplane in the flight

conditions at the time of the upsets. The aerodynamic models used in the simulations are

validated by flight tests, but this validation process is limited by safety factors, such as the

structural load limits for which flight tests can be safely conducted, and the number of

flight tests to be conducted.

In addition, the computer simulations generally assume calm air conditions. The

United flight 585 airplane most likely encountered significant winds and turbulence; thus,

the computer simulations were adjusted to account for such winds. However, because the

actual turbulence conditions were not known, the respective contributions of the flight

control surfaces and winds to the motion of the airplane are uncertain. For example, if a

large rolling moment resulting from a wind gust was quickly countered by the flight crew

According to page 60 of Boeing’s “Submission to the National Transportation Safety Board for the

USAir 427 Investigation,” dated September 30, 1997, “when the heading data is sampled at less than twice a

second, the rudder position derived using kinematics becomes contaminated with an overlying ‘noise’

signal that shows up as an oscillation in derived rudder…. Proper interpolation can reduce the ‘noise’

providing more reliable information on rudder movement.”

The Safety Board’s flight simulation computer program is a Windows™-based executive program

that uses Boeing-developed flight control, aerodynamics, and engine models to derive force and moment

time histories of the airplane. Safety Board-developed equations of motion convert these forces and

moments into airplane motion.

The Safety Board’s workstation-based flight simulations used computer software that describes the

physics of the motion of an airplane in flight and various computer subroutines, including those that use data

and equations from Boeing, to describe the 737 aerodynamic characteristics and engine thrust.

Boeing also performed similar flight simulations on its own computer workstation.

Factual Information 87 Aircraft Accident Report

through a large control wheel movement, the resulting roll recorded by the FDR would be

relatively small. If the wind gust effect introduced into the simulation was less than the

actual wind gust experienced by the flight crew, the control wheel movements derived

through the simulations would be less than the movements that actually occurred.

Other factors affecting the accuracy of the simulation studies include

instrumentation calibration errors and time lags in data recording. In addition, the

directional gyroscopes that provided heading information to the FDR in the United

flight 585 airplane could have introduced errors in the recording of the heading data when

the airplanes were operating in certain flight attitudes. The Safety Board accounted for

part of the potential heading gyro gimbal errors by using a computer program especially

developed for that purpose.

Because a pilot exerting considerable force on the rudder pedals could alter the

rudder blowdown limit that would result from the hydraulic actuator alone,

the

simulations also had to account for the estimated pilot rudder pedal force time history.

This estimation was accomplished for the United flight 585 accident based on the physical

characteristics of the flying pilot, available human performance research data, and CVR

information. (See section 1.18.3 for further information.)

All parties to the USAir flight 427 investigation had the opportunity to submit

proposed accident scenarios. However, only Boeing submitted detailed simulations or

studies. The Safety Board notes that Boeing may be one of the few entities in the world

with the technological ability and knowledge of the 737 airplane to conduct the complex

and sophisticated simulations that were used during this investigation to evaluate potential

accident scenarios. Accordingly, the Safety Board assumed that the alternative scenarios

provided by Boeing were the best alternatives that could be developed. The Safety Board

therefore gave serious consideration to the scenarios submitted by Boeing for the USAir

flight 427, United flight 585, and Eastwind flight 517 upset events. The results of the

Safety Board’s best-match solution

from the simulation studies for United flight 585 are

discussed in section 1.16.6.1.

1.16.6.1 United Flight 585 Simulation Studies

United flight 585 was flying in turbulent air while making a right turn to the final

approach to Colorado Springs Municipal Airport. Strong winds aloft created complex

airflow patterns that moved from west to east across the mountains located west of the

airplane’s flightpath; these airflow patterns likely included strong turbulence, eddies,

A heading gyro consists of a rotating gyro mounted inside two gimbals, and heading data is subject

to gyro gimbal error. Heading is determined by the angle of the outer gimbal to the airplane body.

Combinations of pitch, roll, and gyro rotor alignment introduce angle errors into the outer gimbal and

produce predictable heading errors that can be quantified and corrected.

During normal rudder operation, a considerable pilot force on the rudder pedals can result in the

rudder moving beyond its blowdown limit based on hydraulic actuator force alone. However, in a rudder

reversal situation, a considerable pilot force on the rudder pedals can reduce the blowdown limit.

The Safety Board’s best-match solution is the derived flight control surface position time histories

that best match the recorded FDR data, radar data, and human performance information.

Factual Information 88 Aircraft Accident Report

rotational flow fields, and crosswind shear. The FDR data showed that, as the airplane was

descending through an altitude of about 1,000 feet agl and was about on track to approach

the airport from the south (about 0943:32), its heading changed to the right. The airplane

impacted the ground about 9 seconds later. The airplane’s orientation and flightpath angle

at impact were near vertical. The airplane was aligned approximately 205° magnetic

heading, and the ground track (as defined by the debris field) was about 020° magnetic

heading.

The Safety Board’s workstation-based simulator for a 737-200 airplane was used

to simulate the event. The simulation process used available FDR data, radar data, and

information on the accident location and airplane orientation at impact. Input to the

simulation for engine thrust was based on engine sounds recorded on the CVR. The flight

control surface position time histories needed for the simulation were not among the

parameters recorded by the FDR and thus had to be estimated or derived. The control

wheel (aileron and spoilers), rudder surface, and elevator position time histories used in

each simulation were derived by iteration.

The simulations assumed that the airplane encountered turbulence with a

crosswind gust (perhaps associated with a mountain rotor).

In the Safety Board’s

best-match simulation that involved a rudder movement for this event, these winds

produced a heading change and yaw rate to which the pilot was assumed to have

responded (about 0943:32) with left rudder pedal input.

This scenario further assumed

that this input occurred while the main rudder PCU servo valve secondary slide was

jammed to the servo valve housing, resulting in a rudder reversal to the right.

The general wind field was derived by comparing the ground track from the radar

data with the airspeed and heading data from the FDR. An approximation of a vertical

gust profile was developed from the vertical load factor data. Crosswind gust components

were also used in this best-match simulation.

In this simulation, at 0943:21, when the airplane was nearly aligned with the

landing runway, the airplane began to experience a significant heading change to the right.

The simulation indicated that a right bank angle of about 30° was required to produce this

heading change. The Safety Board determined that the heading change and the rolling

moment that occurred after 0943:21 were likely the result of turbulence, and these data

became the baseline for the turbulence models used in some of the Board’s simulations.

The heading and ground track were about 180° opposed because of the near-vertical flightpath angle.

The Safety Board considered several rotor scenarios in its studies, including moving rotors above,

below, and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s

flightpath; and horizontal rotors that transitioned to vertical rotors along the airplane’s flightpath.

The complete data sets for this and other scenarios can be found in the Safety Board’s “United

Flight 585 Simulation Study,” dated October 19, 1998, and the Board’s “Addendum to Simulation Study,”

dated February 23, 1999.

Factual Information 89 Aircraft Accident Report

Rudder position time histories were developed for jams of the secondary slide to

the servo valve housing at 100, 71, 50, 40, and 30 percent from the neutral position.

The rudder position, once reversed, was assumed to remain at the blowdown limit

corresponding to a servo valve jam at the 100-percent position (blowdown limit is partly

dependent on jam position, airspeed, and sideslip angle) for the duration of the reversal.

The timing of the rudder inputs was modified by iteration until the simulation produced

heading time histories consistent with the FDR data.

The heading data that resulted from the simulation with the secondary slide

jammed to the housing at 100 percent produced the Safety Board’s best-match with the

FDR heading data.

The pilot rudder pedal force, rudder surface, and control wheel time

histories for the 100-percent jam are presented in figures 16 through 16b, respectively.

The resultant heading, normal load factor, pitch angle, and bank angle data for the Safety

Board’s 100-percent jam solution compared with the FDR data are presented in figures

16c through 16f, respectively. Roll and yaw rate, two parameters pertinent to human

performance, are presented in figures 16g and 16h, respectively, for the 100-percent

rudder secondary jam case. CVR data are presented on figures 16e, 16f, and 16h to

correlate verbal responses of the pilots to simulated pitch angle, bank angle, and yaw rate,

respectively. Wind direction and horizontal and vertical wind speeds used in the Safety

Board’s best-match are presented in figures 16i through 16k.

The 100-percent jam scenario does not include the rotational eddy from the turbulence model; the

30-percent jam (which is not presented in this report) does include the eddy.

Because of fire damage to the United flight 585 PCU, the Safety Board was unable to perform

laboratory tests to determine the rudder deflection rate and the hinge moment capability of the PCU with the

secondary slide jammed at various positions from neutral. Therefore, data from the USAir flight 427 PCU

servo valve tests in which the secondary slide was jammed at 71, 50, and 22 percent from neutral were used.

Data from the Eastwind flight 517 PCU servo valve tests were not used because that servo valve had a leaky

bypass valve.

Because of the reduced hydraulic pressure ported to the actuator in the overtravel situation, this

100-percent jam would result in the rudder moving at a reduced rate of about 32° per second to the reduced

blowdown limit.

The Safety Board’s best-match simulation used 300 pounds of force reducing to 200 pounds, based

on ergonomic and other research data (see section 1.18.3). The Safety Board was also able to match the

United flight 585 FDR data using only the minimum pedal force necessary to sustain full rudder authority

(about 70 pounds).

Factual Information 90 Aircraft Accident Report

Figure 16. Pilot rudder pedal force positions for United flight 585.

Figure 16a. Rudder surface positions for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-500

-450

-400

-350

-300

-250

-200

-150

-100

-50

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Input

Left

Right

Pedal Force (lbs)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-30

-25

-20

-15

-10

-5

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Input

Nose Left

Nose Right

Equivalent Rudder (deg)

Time (hr:min:sec)

Factual Information 91 Aircraft Accident Report

Figure 16b. Control wheel positions for United flight 585.

Figure 16c. Heading data for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-100

-80

-60

-40

-20

100

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Input

Left

Right

Equivalent Wheel (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

300

310

320

330

340

350

360

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

FDR points

Simulation

Heading (deg)

Time (hr:min:sec)

Factual Information 92 Aircraft Accident Report

Figure 16d. Normal load factor data for United flight 585.

Figure 16e. Pitch angle data for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

FDR data

Simulation

Normal Load Factor (G's)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-90

-80

-70

-60

-50

-40

-30

-20

-10

CAM_2-wow

CAM-2_We're_at_a_thousan

CAM-2_Oh_God_(flip)

CAM-1_fifteen_flaps

CAM1- Oh(exclaimed loudl

Sound_of_impact

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Pitch Angle (deg)

Time (hr:min:sec)

Factual Information 93 Aircraft Accident Report

Figure 16f. Bank angle data for United flight 585.

Figure 16g. Roll rate for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-180

-160

-140

-120

-100

-80

-60

-40

-20

100

120

140

160

180

CAM_2-wow

CAM-2_We're_at_a_thousan

CAM-2_Oh_God_(flip)

CAM-1_fifteen_flaps

CAM1- Oh(exclaimed loudl

Sound_of_impact

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Left

Right

Bank Angle (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-10

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Body Axis Roll Rate - p

(deg/sec)

Time (hr:min:sec)

Factual Information 94 Aircraft Accident Report

Figure 16h. Yaw rate for United flight 585.

Figure 16i. Wind direction for United flight 585.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-15

-10

-5

CAM_2-wow

CAM-2_We're_at_a_thousan

CAM-2_Oh_God_(flip)

CAM-1_fifteen_flaps

CAM1- Oh(exclaimed loudl

Sound_of_impact

UAL 585

Simulator Study

100% Secondary Slide Jam

Simulation Response

Body Axis Yaw Rate - r

(deg/sec)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

220

230

240

250

260

270

280

290

300

310

320

UAL 585

Simulator Study

100% Secondary Slide Jam

Wind Direction (deg)

Time (hr:min:sec)

Factual Information 95 Aircraft Accident Report

Figure 16j. Horizontal windspeeds for United flight 585.

Figure 16k. Vertical windspeeds for United flight 585.

One of the Safety Board simulation scenarios that produced a good match with the

FDR data and other physical evidence assumed a sustained equivalent control wheel input

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

UAL 585

Simulator Study

100% Secondary Slide Jam

Wind Speed (kts)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-15

-10

-5

UAL 585

Simulator Study

100% Secondary Slide Jam

Vertical Wind Speed (kts - positive down)

Time (hr:min:sec)

Factual Information 96 Aircraft Accident Report

to the right with no rudder input. The equivalent control wheel input could represent a

pilot command, a rotational wind, or a combination of the two. Figures 17 through 17f

show the resultant data for rudder surface and control wheel postions and heading, normal

load factor, calibrated airspeed, pitch angle, and bank angle data, respectively. Figures 17e

and 17f also show CVR data.

Figure 17. Rudder surface positions for United flight 585 assuming a sustained

equivalent control wheel input.

Figure 17a. Control wheel surface positions for United flight 585 assuming a sustained

equivalent control wheel input.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-25

-20

-15

-10

-5

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Input

Nose Left

Nose Right

Equivalent Rudder (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-100

-80

-60

-40

-20

100

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Input

Left

Right

Equivalent Wheel (deg)

Time (hr:min:sec)

Factual Information 97 Aircraft Accident Report

Figure 17b. Heading data for United flight 585 assuming a sustained equivalent control

wheel input.

Figure 17c. Normal load factor for United flight 585 assuming a sustained equivalent

control wheel input.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-20

-15

-10

-5

UAL 585

Simulator Study

100% Secondary Slide Jam

Vertical Wind Speed (kts - positive down)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

FDR data

Simulation

Normal Load Factor (G's)

Time (hr:min:sec)

Factual Information 98 Aircraft Accident Report

Figure 17d. Calibrated airspeed for United flight 585 assuming a sustained equivalent

control wheel input.

Figure 17e. Pitch angle data for United flight 585 assuming a sustained equivalent

control wheel input.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

140

160

180

200

220

240

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

FDR data

Simulation

Vcas (Kts)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-90

-80

-70

-60

-50

-40

-30

-20

-10

CAM_2-wow

CAM-2_We're_at_a_thousan

CAM-2_Oh_God_(flip)

CAM-1_fifteen_flaps

CAM1- Oh(exclaimed loudl

Sound_of_impact

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

Pitch Angle (deg)

Time (hr:min:sec)

Factual Information 99 Aircraft Accident Report

Figure 17f. Bank angle data for United flight 585 assuming a sustained equivalent

control wheel input.

In a June 23, 1997, letter to the Safety Board, Boeing provided its analysis of the

United flight 585 accident.

Boeing’s analysis concluded that a rudder hardover scenario

did not fit the FDR data and that a “new rotor model” did match the data.

Further,

Boeing derived this new rotor model to match the available data and introduced a

rotational effect of near zero just before 0943:28, which increased linearly to about

0.4 radians per second just before 0943:29 and then increased linearly to about 1.8 radians

per second about the time the airplane impacted the ground (just before 0943:42).

Boeing’s simulation using the new rotor model produced the data shown in

figures 18 through 18f for rudder surface positions, windshear, control wheel positions,

heading, bank angle, normal load factor, and pitch angle, respectively. As shown in

figure 18b, Boeing’s simulation assumed a left control wheel input by the flight crew just

after 0943:30.

Boeing’s analysis was resubmitted to the Safety Board in a September 14, 1998, letter.

According to Boeing, “the new rotor model is significantly different from that evaluated during the

original [United flight] 585 investigation. The original [rotor] model was a solid rotating core of air with a

distinct boundary. This meant that the air at the outside edge of the core was at a very high velocity for large

cores with high rotational velocity. [Boeing’s new rotor] model is not a solid rotating body, but has a

velocity profile which varies significantly as the distance from the center core increases. The model was

developed based on a simulation of the weather conditions that existed in the Colorado Springs area on the

day of the accident.”

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-160

-140

-120

-100

-80

-60

-40

-20

100

120

140

160

CAM_2-wow

CAM-2_We're_at_a_thousan

CAM-2_Oh_God_(flip)

CAM-1_fifteen_flaps

CAM1- Oh(exclaimed loudl

Sound_of_impact

UAL 585

Simulator Study

Equivalent Wheel Solution

Simulation Response

Left

Right

Bank Angle (deg)

Time (hr:min:sec)

Factual Information 100 Aircraft Accident Report

Figure 18. United flight 585 rudder surface positions according to Boeing’s new rotor

model.

Figure 18a. Rotational windshear encountered by United flight 585 according to

Boeing’s new rotor model.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-25

-20

-15

-10

-5

Boeing Simulation Match UAL585

Rudder (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

Boeing Simulation UAL585

P Shear (rad/sec)

Time (hr:min:sec)

Factual Information 101 Aircraft Accident Report

Figure 18b. United flight 585 control wheel positions according to Boeing’s new rotor

model.

Figure 18c. United flight 585 heading data according to Boeing’s new rotor model.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-120

-100

-80

-60

-40

-20

100

120

Boeing Simulation Match UAL585

Wheel (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

300

310

320

330

340

350

360

Boeing Simulation Match UAL585

Simulation

FDR Points

Heading (deg mag)

Time (hr:min:sec)

Factual Information 102 Aircraft Accident Report

Figure 18d. United flight 585 bank angle data according to Boeing’s new rotor model.

Figure 18e. United flight 585 normal load factor data according to Boeing’s new rotor

model.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-180

-160

-140

-120

-100

-80

-60

-40

-20

100

120

140

160

180

Boeing Simulation Match UAL585

Bank Angle (deg)

Time (hr:min:sec)

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Boeing Simulation Match UAL585

Simulation

FDR Data

Normal Load Factor (G's)

Time (hr:min:sec)

Factual Information 103 Aircraft Accident Report

Figure 18f. United flight 585 pitch angle according to Boeing’s new rotor model.

1.17 Organizational and Management Information

1.17.1 United Airlines

At the time of the accident, United Airlines employed approximately

75,105 people, including 7,251 pilots, and operated a fleet of 465 airplanes, including 74

Boeing 737-200 airplanes. United maintained major hub operations in Chicago, Illinois;

Denver, Colorado; and San Francisco, California.

1.17.1.1 United Airlines Office of Flight Safety

United personnel indicated that, at the time of the accident, the airline’s Office of

Flight Safety directed the development and implementation of the company’s

philosophies, policies, plans, goals, procedures, and standards regarding flight and cabin

safety and airplane security. Additionally, personnel from United’s Office of Flight Safety

represented the airline to outside agencies and industry associations in safety-related

matters, including accident and incident investigations. At the time of the accident, the

Director of the Office of Flight Safety reported directly to the Senior Vice President of

Flight Operations.

09:43: 0.00 09:43:10.00 09:43:20.00 09:43:30.00 09:43:40.00 09:43:50.00

-90

-80

-70

-60

-50

-40

-30

-20

-10

Boeing Simulation Match UAL585

Pitch Angle (deg)

Time (hr:min:sec)

Factual Information 104 Aircraft Accident Report

1.17.1.2 United Airlines Windshear and Irregular Procedures

According to United personnel, the company advised its 737 flight crews to avoid

areas of known windshear

whenever possible. Pilots were trained to enter a holding

pattern until conditions improved if windshear was indicated during an approach; pilots

were instructed to initiate a go-around if windshear was encountered unexpectedly during

an approach. According to United flight training personnel, flight crews received training

on windshear procedures during initial, transition, and annual recurrent training. Further,

these personnel indicated that United’s pilots frequently received handouts and videotapes

containing additional information regarding windshear.

The irregular procedures section of the United 737-200 Flight Handbook that was

in effect at the time of the flight 585 accident (revision 12, dated February 13, 1991)

contained guidance for irregular flight control and hydraulic system conditions, including

asymmetrical or no trailing edge flaps, asymmetrical or no leading edge devices, jammed

or runaway stabilizer, loss of hydraulic system A or B quantity or pressure, and jammed

flight controls. According to United personnel, irregular procedures are referenced actions

accomplished when necessary by the flight crew with the use of a checklist.

The guidance for jammed flight controls contained in the handbook was specified

for use when a flight crew experienced jammed or restricted movement of roll, pitch, or

yaw flight controls. The handbook indicated that the pilots should overpower the jammed

system, using maximum force (including the combined force of both pilots) if necessary.

The handbook also indicated that the flight crew should use the operative flight controls,

trim, and engine thrust, as needed, for airplane control if the faulty system could not be

overpowered.

1.18 Additional Information

For additional information about the history of Boeing 737 potential rudder system

and/or PCU-related anomalies/events, the independent technical advisory panel (created

to review the work of the Systems Group during the USAir flight 427 accident

investigation), 737 certification requirements and information, the FAA’s critical design

review team (created to review the 737 flight control systems), 737 rudder system design

improvements, human performance considerations, wake turbulence/upset event

information, unusual attitude information and training, procedural information available

to 737 flight crews, and the history of safety recommendations resulting from the United

585 and USAir flight 427 accidents and the Eastwind flight 517 incident, see the Safety

Board’s final report on the USAir flight 427 accident. For information on a study of pilots’

speech, breathing, and other CVR-recorded sounds; a comparison of engine sound

signatures form the United flight 585 CVR and a CVR from 737-200 flight tests;

ergonomics; and the conclusions adopted in the USAir flight 427 report, see

sections 1.18.1 through 1.18.4, respectively, of this revised report.

United’s 737-200 Flight Manual defines windshear as any rapid change in wind direction or velocity.

Factual Information 105 Aircraft Accident Report

1.18.1 Study of Pilots’ (USAir Flight 427 and United Flight 585)

Speech, Breathing, and Other CVR-recorded Sounds

As part of its investigation of the USAir flight 427 accident, the Safety Board

examined the USAir flight 427 and United flight 585 pilots’ speech (voice fundamental

frequency, or pitch; amplitude, or loudness; speaking rate; and content) and breathing

(inhaling, exhaling, and grunting) patterns recorded by the CVRs during the routine

portions of the flights, the initial upsets, and the uncontrolled descents. Investigators

extracted several acoustical measures of speech (fundamental frequency, amplitude, and

speaking rate) from pilot statements on the CVR recording to understand the actions and

emotional states of the pilots during the accident sequence.

According to scientific literature,

fundamental frequency, amplitude, and

speaking rate tend to increase in response to increased psychological stress. The Safety

Board’s review of the USAir flight 427 captain’s speech during the accident flight, as

recorded by the CVR, indicated that his speech fundamental frequency and amplitude

increased as the emergency situation developed. Review of the first officer’s speech

during the accident flight revealed that he did not speak enough during the emergency

period to provide a basis for meaningful analysis.

The Safety Board conducted a similar laboratory speech analysis examination of

the speech and other sounds recorded by the United flight 585 CVR. The only measurable

data obtained during this examination was for speech fundamental frequency.

The

captain’s speech fundamental frequency when he spoke the word “flaps” during routine

and emergency radio transmissions provided a basis for direct comparison. When the

captain said “flaps” during routine flight operations, his speech exhibited an average

fundamental frequency of 131 Hz. However, when the captain stated “flaps” at 0943:33.5

during the upset event, the fundamental frequency of his speech had increased 77 percent,

to 233 Hz.

The laboratory results and CVR tape and transcript were provided to three

independent specialists from the Interstate Aviation Committee, Moscow, Russia;

the

U.S. Naval Aerospace Medical Research Laboratory, Pensacola, Florida;

and NASA’s

See “Speech Examination Factual Report, May 5, 1997” from the USAir flight 427 investigation for

details on the extraction procedures, which employed computer analysis.

See Ruiz, R., Legros, C., and Guell, A. 1990. “Voice analysis to predict the psychological or physical

state of a speaker.” Aviation, Space, and Environmental Medicine, 61, 266-71. Also, see Brenner, M.,

Doherty, E.T., and Shipp, T. 1994. “Speech measures indicating workload demand.” Aviation, Space, and

Environmental Medicine, 65, 21-6.

Amplitude could not be measured because of the automatic gain control feature on the microphone.

Speech rate could not be measured because of the limited amount of speaking by either crewmember during

the emergency period.

This specialist is the Chief of the Acoustical Laboratory at the Interstate Aviation Committee. He has

a medical degree and graduate level training in psychology. He has participated in more than 250 aviation

accident investigations and specializes in medical and psychological aspects, especially the psychological

analysis of speech.

Factual Information 106 Aircraft Accident Report

Ames Research Center, Moffett Field, California.

Their areas of specialization were

general speech analysis (focusing on issues of psychological stress and physical effort),

breathing physiology, and communication information, respectively.

The specialist from Moscow’s Interstate Aviation Committee observed that both

USAir flight 427 pilots showed symptoms of psychological stress (increased amplitude

and fundamental frequency of speech, increased frequency of breathing, and reduced

information within a statement) beginning almost immediately after the initial upset and

that these symptoms increased throughout the accident sequence. However, the specialist

believed that the increased psychological stress did not necessarily interfere with the

pilots’ ability to respond to the emergency situation. The specialist’s report stated that

stress can be viewed as having the following three increasing stages,

which reflect

typical changes in performance:

Psychological stress, at low levels, can improve a person’s performance by

providing a constructive mobilization of attention and resources (first stage). As

the person’s stress increases, the performance often displays hasty or premature

actions [such as the omission of words or checklist items]. However, they can still

accomplish their task (second stage). It is only at the highest levels of stress (third

stage, or “panic”), that the person cannot think or perform clearly.

The Safety Board applied the specialist’s guidelines and criteria to the speech and

other sounds recorded by the United flight 585 CVR. When the captain spoke the word

“flaps” during the accident sequence (at 0943:33.5), his speech fundamental frequency

was 77 percent higher than when he spoke the same word during routine flight operations.

In addition, the captain’s statement “fifteen flaps” (at 0943:33.5) signified a go-around

decision but occurred without the captain first stating “go-around thrust,” as specified in

the procedures section of the company flight manual at the time of the accident.

According to the specialist’s guidelines, the captain’s responses (high fundamental

frequency value and omission of a standard procedure item while communicating and

responding appropriately to the situation) indicated that he was likely operating at the

second stage of stress at 0943:33.5. He had not reached a panic but was displaying

characteristics of a high level of stress within about 1½ seconds of the onset of the

emergency period. The Safety Board’s examination of the remaining 8 seconds of CVR

This specialist is a Research Physiologist in the Aviation and Operational Medicine Department of

the U.S. Naval Aerospace Medical Research Laboratory. He has a doctorate degree in exercise physiology,

and his research includes work on the effects of physical fitness on normal load factor tolerance and the

development of anthropometric standards for naval aviators.

This specialist is a Research Psychologist at the NASA Ames Research Center. She has a doctorate

degree in behavioral sciences, and her research addresses aerospace human factors, focusing on crew

communication, coordination, and performance issues.

As a guideline, the specialist from the Interstate Aviation Committee indicated that stage 1 speech is

characterized by an intra-individual increase in fundamental frequency of about 30 percent compared with

that individual’s speech in a relaxed condition, stage 2 speech is characterized by an increase in fundamental

frequency of 50 to 150 percent, and stage 3 speech is characterized by an increase of 100 to 200 percent.

These guidelines are advisory and considered with other speech factors in characterizing the speaker’s level

of stress.

Factual Information 107 Aircraft Accident Report

information indicated that the pilots likely reached the third stage of stress—panic—

before the airplane crashed.

1.18.2 Comparison of Engine Sound Signatures From the United

Flight 585 CVR and a CVR From 737-200 Flight Tests

Because of the Safety Board’s findings during the USAir flight 427 investigation

that certain sideslip and yaw maneuvers in a 737-300 could result in changes in engine

sound signatures, investigators attempted to determine whether such maneuvers in a

737-200 would result in similar changes in engine sound signatures and, if so, whether

any such changes could be discerned on the United flight 585 CVR. According to Boeing,

the overall geometry and proportions of the 737-200 and -300 series fuselages are very

similar; however, the airplanes are equipped with significantly different engines. The

737-200’s engines are equipped with inlet vanes or diffusers that intentionally make the

inlet airflow turbulent.

Therefore, investigators recognized the possibility that

maneuvers causing the inlet airflow to be slightly more turbulent might not produce

significant change in the engine’s noise-producing characteristics.

On June 3, 1996, the Safety Board conducted an engine perturbation flight test

using a United Airlines 737-200 at the United Airlines Maintenance Operations facility in

Indianapolis, Indiana. The flight test consisted of sideslip and yaw conditions similar to

those present during 737-300 flight control characteristics testing in September 1995 (as

part of the USAir flight 427 investigation). The CVR recordings of the 737-200 flight test

revealed engine sound signature changes similar to those heard in the 737-300 flight test

CVR recordings for the same conditions.

The CVR recording from United flight 585 was compared with the CVR recording

from the 737-200 flight test. However, analysis of the engine sounds on the United

flight 585 CVR was hampered by two factors: the recording was of poor quality with

obscuring background noise, and the pilots of United flight 585 were changing the engine

power settings—and therefore varying the revolutions per minute frequency—almost

constantly during the approach to land. Investigators attempted to compensate for these

factors when possible and then extracted and plotted the resulting engine sounds. Further,

investigators plotted the FDR data (heading, altitude, vertical Gs, and indicated airspeed)

along with the CVR data. No changes in engine sound volume were detected on the

United flight 585 CVR.

According to the engine manufacturer, the engines installed on the 737-200 series airplane were

designed when controlling/reducing inlet noise was not a critical issue for manufacturers. Because of the

differences in engine inlet design, the engines installed on the 737-200 series airplanes produced more noise

than the engines installed on the 737-300 series airplanes.

Factual Information 108 Aircraft Accident Report

1.18.3 Ergonomics—Study of Maximum Pilot Rudder

Pedal Force

As previously discussed, one of the variables in the Safety Board’s computer

simulations was pilot rudder pedal force. Because pilot rudder pedal force was not

recorded by the FDRs in the USAir flight 427, United flight 585, and Eastwind flight 517

airplanes, the Safety Board conducted a study during its investigation of the USAir

flight 427 accident to estimate, using ergonomic research and other data, the rudder pedal

forces that the pilots might have applied during the upset events.

A researcher at the U.S. Air Force’s (USAF) Armstrong Laboratory studied

strength capability for operating aircraft controls in a study often used as a standard for

aircraft design.

The data reported in this study represent the maximum isometric

strength demonstrated by USAF subjects operating the aircraft controls of a laboratory

simulator. Subjects were healthy volunteers, either from the AFF or Officer’s Training

School (OTS), who were instructed to push forward on the rudder pedal with as much

force as they could exert and hold that force for 5 seconds.

Among 199 of the subjects (male AFF students between 19 and 25 years old),

median strength output of the left leg against the left rudder pedal was 624 pounds, and

median strength output of the right leg against the right rudder pedal was 623 pounds.

Among 249 other subjects (male OTS students between 21 and 34 years old), median

strength output of the right and left legs was 510 pounds each. These results were some of

the highest leg force outputs obtained in a laboratory setting and cited in the available

ergonomic literature,

even when the results were compared with other studies using

USAF subjects.

The results from the USAF study involving OTS subjects were considered to be

more representative of the airline pilot population for two reasons: the OTS subjects

(although physically fit) were not subject to the rigorous physical selection and exercise

requirements that were applied to the AFF students, and the OTS students, on average,

were older than the AFF subjects. Therefore, the Safety Board used the results of the

USAF studies involving OTS subjects as a baseline for its ergonomic study; an output of

510 pounds, sustained for a short period of time, was deemed a reasonable estimate for the

maximum leg force output of an airline transport pilot.

In evaluating the leg force that could have been applied during the three upset

events, the Safety Board also considered the effect that seat position and knee angle would

have on that force. Ergonomic studies indicate that an individual’s maximum potential leg

thrust varies dramatically with knee angle, with an optimal knee angle range of between

McDaniel, J.W. 1995. “Strength capability for operating aircraft controls.” SAFE Journal, 25,

pp. 28-34.

Weimer, J. 1993. Handbook of Ergonomic and Human Factors Tables. Englewood Cliffs, New

Jersey: Prentice Hall, pp. 90- 91.

Hertzberg, H.T.E., and Burke, F E. 1971. “Foot forces exerted at various aircraft brake-pedal

angles.” Human Factors, 13, pp. 445-56.

Factual Information 109 Aircraft Accident Report

140 and 160° (180° corresponds to a straight leg).

(The knee angles of the subjects in the

USAF studies were between 130 and 140° for a neutral pedal position, which provided for

adequate leg extension to obtain a full rudder input with the most effective knee angles.)

The Safety Board also considered the effect that age might have on a pilot’s ability

to exert leg forces approaching those demonstrated in the USAF studies. Research

indicates a loss of strength in leg extension forces among subjects older than those in the

USAF studies (about a 6-percent reduction in strength per decade in individuals older than

30 years old).

However, studies also indicate that general muscle loss can be prevented

or reversed as a result of regular exercise.

Further, the Safety Board researched the correlation between physical size (such as

height) and leg strength and found that the correlation between the two was low. In other

words, the research showed that a shorter person may be extremely strong, whereas a

taller person may be comparatively weak.

The Safety Board recognizes that a pilot’s leg force output in a real cockpit

emergency (such as those that occurred on USAir flight 427, United flight 585, and

Eastwind flight 517) may also depend on the motivation and perception of the pilots about

their situation. Thus, laboratory results may not necessarily replicate actual flight

situations.

Therefore, in estimating the maximum rudder pedal force applied by the flying

pilots in the USAir flight 427 and the United flight 585 accidents and the Eastwind

flight 517 incident, the Safety Board used available ergonomic and other data, including

the leg strength results from the USAF OTS subject study, the pilot’s knee angle, age,

physical fitness, physical size, motivation, and perception of the situation.

1.18.3.1 United Flight 585

The captain of United flight 585 was 5 feet 7 inches tall, which permitted him to

make seat adjustments that could have obtained an optimum knee angle for exerting force

on the rudder pedals. The captain was assumed to have selected a seat and rudder pedal

adjustment that resulted in the optimal (130 to 140°) knee angle with the rudder pedals in

the neutral position and allowed for leg extension to command full rudder. (The CVR

Woodson, W.E., Tillman, B., and Tillman, P. 1993. Human Factors Design Handbook. New York:

McGraw Hill. Kroemer, K.H.E., Kroemer, H.B., and Kroemer-Elbert, K.E. 1994. Ergonomics: how to

design for ease and efficiency. Englewood Cliffs, New Jersey: Prentice Hall, p. 379.

Hortob’agyi, T.; Zheng, D.; Weidner, M.; Lambert, N.J.; Westbrook, S.; and Houmard, J.A. 1995.

“The influence of aging on muscle strength and muscle fiber characteristics with special reference to

eccentric strength.” Journal of Gerontology: Biological Sciences, 50, B399-406. Bemben, M.G.; Massey,

B.H.; Bemben, D.A.; Misner, J.E.; and Boileau, R.A. 1996. “Isometric intermittent endurance of four

muscle groups in men aged 20-74 yr.” Medicine and Science in Sports and Exercise, 28 (1), pp. 145-54.

Borges, O. 1989. “Isometric and isokinetic knee extension and flexion torque in men and women aged

20-70.” Scandinavian Journal of Rehabilitation Medicine, 21 (1), pp. 45-53. Sanders, M.S., and

McCormick, E.J. 1993. Human Factors in Engineering and Design. New York: McGraw Hill, p. 251.

Yukitoshi, A., and Shephard, R.J. 1992. “Aging and muscle function.” Sports Medicine, 14 (6),

pp. 376-96; Sanders and McCormick, p. 251.

Factual Information 110 Aircraft Accident Report

transcript indicates that the captain performed a rudder check before takeoff,

which

would have required the captain to adjust his seat position to allow for the full range of

motion on the rudder pedals.) Although the captain’s age (52 years) might have resulted in

some degradation in maximum leg force,

postaccident interviews indicated that the

captain was in excellent health and followed a rigorous exercise regimen.

Because the captain’s personal health characteristics might have countered the

normal age-related loss of strength, the Safety Board did not reduce its estimate of the

captain’s leg force from the USAF norms based on his age. However, the United flight

585 circumstances indicated that, in a rudder reversal situation, the left rudder pedal could

move as much as 3 inches aft (toward the captain) during the rudder’s movement to its

blowdown limit (and within about 1 additional second as sideslip allowed the rudder to

deflect more). This rudder pedal movement would have forced the captain to use a less

effective knee angle than that of the USAF OTS subjects, which would have reduced his

rudder pedal input force.

Further, because of the suddenness of the United flight 585 upset and the

airplane’s rapid departure from controlled flight, it is possible that the captain never

reached his personal maximum leg force effort. In the short time available to recover from

the upset, the captain may have pushed hard on the left rudder pedal only long enough to

realize that there was a serious problem in the flight control and then shifted his focus to

attempt a go-around and stop the yaw/roll with control wheel inputs. Therefore, on the

basis of the available information, the Safety Board’s simulation studies assumed that the

captain applied a force of about 300 pounds during the brief period between pedal input

and the go-around decision/control wheel input and that he subsequently reduced his

rudder pedal force to about 200 pounds.

1.18.4 Conclusions Adopted in the USAir Flight 427 Report

On March 24, 1999, the Safety Board adopted 34 findings and a probable cause

statement for the USAir flight 427 accident.

1.18.4.1 Findings

Note: Because the Safety Board’s analysis of the USAir flight 427 accident also

included analysis of the United flight 585 accident and the Eastwind flight 517 incident,

some of the findings pertain to these two events.

The CVR transcript indicates that, at 0914:20, before taxiing for takeoff, the captain warned the first

officer to “watch your feet here comes the rudder.”

Research indicated that a loss of about 15 percent in pilot rudder pedal force might be expected in an

individual the same age as the captain.

This model of pilot rudder pedal force was considered the most appropriate, but a second model also

provided a good fit of the data. In this second model, the captain was assumed to have initially input a

rudder pedal force of about 500 pounds and then reduced this input force to 250 pounds.

Factual Information 111 Aircraft Accident Report

1. The USAir flight 427 flight crew was properly certificated and qualified and

had received the training and off-duty time prescribed by Federal regulations.

No evidence indicated any preexisting medical or behavioral conditions that

might have adversely affected the flight crew’s performance during the

accident flight.

2. The USAir flight 427 accident airplane was equipped, maintained, and

operated in accordance with applicable Federal regulations. The airplane was

dispatched in accordance with Federal Aviation Administration- and

industry-approved practices.

3. All of USAir flight 427’s doors were closed and locked at impact.

4. USAir flight 427 did not experience an in-flight fire, bomb, explosion, or

structural failure.

5. A midair collision with other air traffic, a bird strike, clear air turbulence, or

other atmospheric phenomena were not involved in the USAir flight 427

accident.

6. Asymmetrical engine thrust reverser deployment, asymmetrical

spoiler/aileron activation, transient electronic signals causing uncommanded

flight control movements, yaw damper malfunctions, and a rudder cable pull

or break were not factors in the USAir flight 427 accident.

7. Although USAir flight 427 encountered turbulence from Delta flight 1083’s

wake vortices, the wake vortex encounter alone would not have caused the

continued heading change that occurred after 1903:00.

8. About 1903:00, USAir flight 427’s rudder deflected rapidly to the left and

reached its left aerodynamic blowdown limit shortly thereafter.

9. Analysis of the human performance data shows that it is likely that the first

officer made the first pilot control response to the upset event and

manipulated the flight controls during the early stages of the accident

sequence; although it is likely that both pilots manipulated the flight controls

later in the accident sequence, it is unlikely that the pilots simultaneously

manipulated the controls (possibly opposing each other) during the critical

period in which the airplane yawed and rolled to the left.

10. Analysis of the human performance data (including operational factors) does

not support a scenario in which the flight crew of USAir flight 427 applied

and held a full left rudder input until ground impact more than 20 seconds

later.

11. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational

factors) from the USAir flight 427 accident shows that they are consistent

with a rudder reversal most likely caused by a jam of the main rudder power

control unit servo valve secondary slide to the servo valve housing offset

from its neutral position and overtravel of the primary slide.

Factual Information 112 Aircraft Accident Report

12. The flight crew of USAir flight 427 recognized the initial upset in a timely

manner and took immediate action to attempt a recovery but did not

successfully regain control of the airplane.

13. The flight crew of USAir flight 427 could not be expected to have assessed

the flight control problem and then devised and executed the appropriate

recovery procedure for a rudder reversal under the circumstances of the

flight.

14. It is very unlikely that the loss of control in the United flight 585 accident

was the result of an encounter with a mountain rotor.

15. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational

factors) from the United Airlines flight 585 accident shows that they are

consistent with a rudder reversal most likely caused by a jam of the main

rudder power control unit servo valve secondary slide to the servo valve

housing offset from its neutral position and overtravel of the primary slide.

16. The flight crew of United flight 585 recognized the initial upset in a timely

manner and took immediate action to attempt a recovery but did not

successfully regain control of the airplane.

17. The flight crew of United flight 585 could not be expected to have assessed

the flight control problem and then devised and executed the appropriate

recovery procedure for a rudder reversal under the circumstances of the

flight.

18. Training and piloting techniques developed as a result of the USAir flight 427

accident show that it is possible to counteract an uncommanded deflection of

the rudder in most regions of the flight envelope; such training was not yet

developed and available to the flight crews of USAir flight 427 or United

flight 585.

19. During the Eastwind flight 517 incident, the rudder reversed, moving to its

right blowdown limit when the captain commanded left rudder, consistent

with a jam of the main rudder power control unit servo valve secondary slide

to the servo valve housing offset from its neutral position and overtravel of

the primary slide.

20. It is possible that, in the main rudder power control units from the USAir

flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of

some combination of tight clearances within the servo valve, thermal effects,

particulate matter in the hydraulic fluid, or other unknown factors), the servo

valve secondary slide could jam to the servo valve housing at a position offset

from its neutral position without leaving any obvious physical evidence and

that, combined with a rudder pedal input, could have caused the rudder to

move opposite to the direction commanded by a rudder pedal input.

Factual Information 113 Aircraft Accident Report

21. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517

were most likely caused by the movement of the rudder surfaces to their

blowdown limits in a direction opposite to that commanded by the pilots. The

rudder surfaces most likely moved as a result of jams of the secondary slides

to the servo valve housings offset from their neutral position and overtravel

of the primary slides.

22. When completed, the rudder system design changes to the Boeing 737 should

preclude the rudder reversal failure mode that most likely occurred in the

USAir flight 427 and United flight 585 accidents and the Eastwind flight 517

incident.

23. Rudder design changes to Boeing 737-next-generation series airplanes and

the changes currently being retrofitted on the remainder of the Boeing 737

fleet do not eliminate the possibility of other potential failure modes and

malfunctions in the Boeing 737 rudder system that could lead to a loss of

control.

24. The dual-concentric servo valve used in all Boeing 737 main rudder power

control units is not reliably redundant.

25. A reliably redundant rudder actuation system is needed for the Boeing 737,

despite significant improvements made in the system’s design.

26. The results of this investigation have disclosed that the Boeing 737 rudder

system design certificated by the Federal Aviation Administration is not

reliably redundant.

27. Transport-category airplanes should be shown to be capable of continued safe

flight and landing after a jammed flight control in any position unless the jam

can be shown to be extremely improbable.

28. Pilots would be more likely to recover successfully from an uncommanded

rudder reversal if they were provided the necessary knowledge, procedures,

and training to counter such an event.

29. A neutral rudder pedal position is not a valid indicator that a rudder reversal

in the Boeing 737 has been relieved.

30. The training being provided to many Boeing 737 flight crews on the

procedures for recovering from a jammed or restricted rudder (including a

rudder reversal) is inadequate.

31. The continued use by air carriers of airspeeds below the existing block

maneuvering speed schedule presents an unacceptable hazard, and the

existing block maneuvering speed for the flaps 1 configuration provides an

inadequate margin of controllability in the event of a rudder hardover.

Factual Information 114 Aircraft Accident Report

32. The flight data recorder (FDR) upgrade modifications required by the Federal

Aviation Administration for existing airplanes are inadequate because they do

not require the FDR to be modified to record yaw damper command voltage;

yaw damper and standby rudder on/off discrete indications; pitch trim; thrust

reverser position; leading and trailing edge flap positions; and pilot flight

control input forces for control wheel, control column, and rudder pedals.

33. On the basis of the rudder-related anomalies discussed in this report, flight

data recorder documentation of yaw damper command voltage; yaw damper

and standby rudder on/off discrete indications; and pilot flight control input

forces for control wheel, control column, and rudder pedals is especially

important in the case of the 737, and these parameters should be sampled on

737 airplanes at frequent intervals to provide optimal documentation.

34. The Federal Aviation Administration’s failure to require timely and

aggressive action regarding enhanced flight data recorder recording

capabilities, especially on Boeing 737 airplanes, has significantly hampered

investigators in the prompt identification of potentially critical

safety-of-flight conditions and in the development of recommendations to

prevent future catastrophic accidents.

1.18.4.2 Probable Cause

The Safety Board determined that the probable cause of the USAir flight 427

accident was a loss of control of the airplane resulting from the movement of the rudder

surface to its blowdown limit. The rudder surface most likely deflected in a direction

opposite to that commanded by the pilots as a result of a jam of the main rudder power

control unit servo valve secondary slide to the servo valve housing offset from its neutral

position and overtravel of the primary slide.

115 Aircraft Accident Report

2. Analysis

2.1 General

The flightcrew of flight 585 were trained and qualified in accordance with

applicable Federal regulations and UAL company standards and requirements.

Background evidence on both pilots was unremarkable. There was no evidence of relevant

human performance issues for either pilot. Injuries to the pilots were consistent with the

comments contained on the CVR that the captain was attempting to prevent the accident.

Autopsy, CVR, ATC information, and review of medical records revealed no evidence of

physical or psychological factors that were causal to the accident.

The airplane was certificated, equipped, and operated according to applicable

regulations. The UAL operating procedures for the Boeing 737 were in conformance with

the established requirements of Boeing and the FAA. The airplane was properly loaded

and the cargo and baggage were properly secured.

There were no ATC factors found that contributed to the cause of the accident.

Analysis of ATC and FDR data showed that the airplane intercepted the extended

centerline during its approach to runway 35 about 0942:50 and began to descend on the

visual approach. Although CVR evidence showed that the pilots were encountering

airspeed fluctuations and turbulence, the first officer’s voice showed no concern when she

stated “we’re at a thousand feet” at 0943:28.2. However, CVR and FDR data indicated

that, about 0943:33, United flight 585 began an abrupt heading change to the right and a

sudden descent. Evidence from the CVR indicated that the pilots were caught by surprise

by a rapidly developing event during which control of the airplane was lost.

Witness observations confirmed that the airplane was banked right, while turning

from the 45-degree intercept to final approach alignment with the runway. As the airplane

neared the end of the turn (nearly aligned with the runway), it momentarily rolled wings

level and then commenced to roll to the right at a steady rate. The roll continued until the

airplane was inverted with the nose nearly straight down. At about the time the airplane

was rolling wings level, and started the final rolling maneuver to the right, witnesses

reported that the nose was rising. However, the FDR shows that the airplane continued to

descend and the accelerometer data does not indicate an increase in the airplane's load

factor that would be consistent with the nose rising (increase in the angle of attack) during

the initial phase of the upset. The load factor started to increase when the airplane was

banked to about 90 degrees and the flightpath had fallen to over 20 degrees below the

horizon and reached about 4 G prior to ground contact.

Comments on the CVR indicate that the pilots were alert and aggressive

throughout the final 9 seconds. The Safety Board assumes that the crew responded rapidly

with control wheel rotation to counteract the roll of the airplane. The focus of the

116 Aircraft Accident Report

investigation and analysis therefore centers on events that might have produced rolling

moments greater than those that can be countered by the B-737's lateral control system. If

control countermeasures were applied in a rapid manner, only large sideslip angles, severe

atmospheric disturbances, control system anomalies or structural failures could produce

rolling moments greater than the restoring capacity of the airplane's lateral control system.

In addition, if the crew used rudder control to either reduce a potential sideslip or create a

sideslip angle aiding in roll recovery control, then the upsetting event had to be even more

severe than that which could be corrected by control wheel alone.

The Safety Board attempted to determine an identifiable reason for the loss of

control of flight 585 and the inability of the flightcrew to prevent the accident. During the

course of the investigation and analysis of the available data, several possible scenarios

were considered. These scenarios included loss of directional control (uncommanded

rudder deflection); loss of lateral control (failure in the lateral control systems—flaps,

slats, spoilers, and ailerons); atmospheric disturbances (windshears or rotors); or a

combination of airplane malfunctions, atmospheric disturbances, structural failures,

engine failures, or flightcrew performance.

2.2 Engines

The Safety Board considered the possibility that one or both of the engines

malfunctioned during the final portion of the flight and initiated a loss of control or

prevented the flightcrew from maintaining control. This analysis included examination of

the evidence from the wreckage, the CVR spectral signatures, and aerodynamic

simulation.

The postcrash examination of the engines, as well as the indications on the engine

pressure ratio (EPR) gauges and transmitters, showed that the engines were developing

power at the time of impact. The evidence was conclusive and the indications of power

were similar in both engines. Nonetheless, there is some evidence to support a theory that

one or both engines had flamed out in flight, caused control difficulties, and then

recovered to normal operation before impact.

The CVR spectral analyses show two separate signatures consistent with engine

characteristic frequencies, just prior to the comment “Oh God.” The frequencies indicate

the engines were developing nearly equal thrust at that time. The signatures disappear in

the foreground noise at the “Oh God” comment and are not seen for several seconds

thereafter. Four or five seconds prior to impact, two signatures were noted that are

consistent with two engines accelerating with one engine leading the other by 2 seconds.

However, the gaps in the spectral traces preclude firm conclusions that the observed traces

were from the engines.

Also, some witnesses reported hearing popping or cracking sounds coming from

the airplane when it was about 1/2 mile from the crash site. Witnesses also reported

observing a “mist” trailing the airplane's right wing. Both the sounds and the mist could

Analysis 117 Aircraft Accident Report

have been associated with engine surges (compressor stalls) that could have accompanied

an attempted relight and acceleration of engines in the presence of turbulent air.

However, engine thrust variations alone, even with a total flameout, cannot

explain the loss of lateral control. Simulator tests showed that the asymmetrical thrust

differences produced by a failure of one engine or a 5-second split in engine acceleration

were easily handled with flight controls assuming all hydraulics systems were operational.

The simulator tests showed that thrust differentials consistent with the signatures from the

CVR would produce some yawing and rolling moments. However, at the airspeeds

recorded on the FDR, the effects of asymmetric thrust would have been minimal and well

within the capability of the airplane's lateral and directional control systems.

The Safety Board also considered the effects that a failure of one or both engines

would have on the airplane's hydraulic systems. In the B-737, the A hydraulic system is

maintaining the system operating pressure while delivering 22 gallons per minute flow. At

engine windmilling speed, the flow capability of the pumps drops to 4 or 5 gallons per

minute. However, even with maximum utilization of the flight controls, including a

simultaneous flap retraction, the flow requirement would be about 4 gallons per minute.

Thus, even with a complete flameout of both engines, there should be adequate hydraulic

power available to the A hydraulic system to provide for flight control. Also, as an engine

accelerates from windmilling speed, the flow capacity of the engine-driven pump

increases immediately. Further evidence of normal hydraulic capability on the A system

was provided by the elapsed time for flap retraction. The time from the sound of flap

handle movement recorded on the CVR to impact was consistent with the normal flap

retraction speed from the 30-degree position to the 10-degree position as found after the

crash.

The B hydraulic system is powered by two electrical motor-driven hydraulic

pumps, each of which is capable of maintaining system pressure while producing

6 gallons per minute flow. It is possible that, at engine windmilling speed, the constant

speed drive would not maintain the electrical generator frequency and the associated

electrical buss would drop off line. However, if this had occurred, the FDR and CVR,

which are powered by the same busses, would have ceased to operate. Since there is no

evidence of an interruption of electrical power to either of the recorders, the Safety Board

concludes that the electrical busses and the respective electrical motor-driven hydraulic

pumps remained powered throughout the flight.

With both the A and B hydraulic systems operating, it can be assumed that, absent

some other unidentified failure, there was sufficient control capability to cope with any

combination of engine thrust variations. Thus, while the Safety Board cannot rule out the

possibility of engine surges or a momentary asymmetric thrust condition, the Board

concludes that these factors, if they did occur, should not have resulted in the loss of

control evident in this accident.

Analysis 118 Aircraft Accident Report

2.3 Structures

All of the airplane's flight control structure was found and examined, except for a

portion of the rudder and vertical stabilizer. The wreckage was localized, and there was no

wreckage found along the flightpath. The portion of rudder and vertical stabilizer not

examined consisted of composite material located in the middle of the surfaces.

Fragments of charred composite fabric were found with the extremities of the surfaces

indicating that they were present at impact and burned during the postcrash fire.

Reconstruction of the wing structure indicated that all of the parts were attached

until impact. Examination of fractures of the wings indicate that the failure modes were

consistent with impact overload failures. Examination of the wing flaps showed that the

flaps were attached to the wing structure and there were no mechanical failures prior to

impact with the terrain. The positions of all of the flap jack screws indicated that there was

not a split flap condition and the flaps were at the 10-degree position at impact. This

position was further confirmed by metallurgical analysis of the detent track from the flap

handle module. Examination of the ailerons indicated that they were attached to the wings

until impact. The continuity of the flight control cables throughout the wings indicated

that the aileron cables did not malfunction in the wing areas. The attach points for the

spoilers indicated that they were attached to the wing structure until impact. Crushing of

the leading edge devices (slats) in the extended position indicated that all of the slats were

properly extended at impact.

Reconstruction of the empennage revealed that all parts were attached to the

structure until impact. The recovery of the rudder top cap and the balance weights at the

crash site indicated that the rudder was present and intact at impact. The recovery of the

elevator end balance weights and the elevator hinges at the crash site indicated that the

elevators were present and intact at impact. Examination of the elevator control

mechanisms indicated that there was no elevator malfunction prior to impact.

Examination of the horizontal stabilizer indicated that there was no preimpact malfunction

or failure of the horizontal stabilizer.

Numerous examinations of the wreckage failed to produce evidence of preimpact

structural problems. Engine mount separation points showed evidence of impact overload.

All doors were closed and latched.

The Safety Board considered the possibility that the “mist” trailing the wing

observed by witnesses was produced by fuel or hydraulic fluid resulting from a structural

failure of some nature. However, the investigation disclosed no evidence of a structural

failure that would have allowed fuel or hydraulic fluid to escape.

2.4 Systems

From the flightcrew conversations recorded on the CVR and the flightpath

described by FDR data, it is evident that the loss of control occurred suddenly and that the

Analysis 119 Aircraft Accident Report

crew were not aware of any prior problems with the airplane's systems. However, the

lateral upset and the flightpath of the airplane during the final 9 seconds of flight could

have resulted from a flight control system malfunction. Thus, the Safety Board's

investigation focused on an examination of the wreckage and all recovered components of

the airplane's hydraulic and flight control systems in an effort to identify any anomalies

that could have produced the loss of control.

The onset of the loss of control occurred nearly 30 seconds after the flaps were

extended to 30 degrees. The trailing edge flaps and leading edge devices would have

began extending immediately and would have reached the command position before the

first officer's comment, “we're at a thousand feet,” which was made in a tone of voice that

did not express unusual alarm. Thus, the Safety Board concludes that the flap operation

was symmetrical and normal.

2.4.1 Hydraulic Power

The primary flight controls of the B-737 are powered by the independent A and B

hydraulic systems previously discussed in section 2.2. A loss of fluid or pressure from

either of these systems would result in a loss or degradation of some flight control

functions. However, the Safety Board found no indications that the systems had

malfunctioned, except for a stretched bulb filament in the HYD indicating light on the

first officer's annunciator panel. Because several other light bulb filaments were stretched,

some of which would normally illuminate only in a press-to-test check, the Board does

not view this evidence as meaningful.

The evidence also shows that the motor-operated shutoff valves in both the system

A and System B flight control modules were open and that the motor-operated shutoff

valves in the standby hydraulic system module were off or closed. Because impact loads

do not usually affect the position of motor-operated valves, it is assumed that the systems

were operated in this normal configuration before impact. Had the flightcrew been aware

of an A or B hydraulic system problem, it would be expected that they would have talked

about it and perhaps selected the standby system. Thus, the Safety Board believes that the

A and B systems were pressurized and capable of delivering hydraulic power to the flight

controls.

The teardown examination of the hydraulic components showed considerable

evidence of contamination in the A, B, and standby systems. Most of the contaminants

were portions of “O” rings or backup rings that had migrated through the system and were

trapped in filter housings. In those cases where contaminants were found to potentially

affect the function of relief or check valves, it was determined that there would have been

no effect on essential flight control components. While the level of contamination in the

hydraulic systems of this airplane seemed excessive, the Safety Board did not determine

whether the level was atypical to that which would be found on other airplanes of

comparable vintage.

Analysis 120 Aircraft Accident Report

2.4.2 Flight Control Systems

From the FDR data, it is apparent that the airplane's departure from controlled

flight began with a sudden heading change to the right. A lateral or directional flight

control problem could produce such a maneuver whereas a longitudinal control system

malfunction would produce a pitching maneuver evident by a sudden change in the

airplane's load factor. A pitch change was not evident in the FDR data.

There were no anomalies found in the longitudinal flight control components that

were available for examination. The elevators were recovered at the accident site and the

horizontal stabilizer was trimmed in a normal range. During the attempted recovery from

the upset, the airplane's load factor increased to about 4 G--a maneuver that would have

required a pilot-commanded elevator deflection. The Safety Board thus concludes that the

elevator control system was functional until impact.

The lateral control system consists of ailerons and flight spoilers controllable by

the captain's and first officer's control wheels. The aileron power control units provided

evidence that the ailerons were at or near neutral at impact. There were no anomalies

noted in the actuators that could account for an uncommanded movement. Although there

was some conflicting evidence regarding flight spoiler position, all of the damage was

consistent with impact-applied loads. The aileron spring cartridge, which is installed to

permit independent operation of the left or right ailerons in the event that the opposite side

of the aileron system becomes jammed, was bent and extended. This damage also was

readily explainable by impact loading and is not viewed by the Safety Board as evidence

of an in-flight problem. Thus, there was no evidence that a lateral control system

malfunction occurred in flight.

There is also no evidence that a ground spoiler deployed to cause the lateral upset.

The condition of the ground spoiler control valve slide was consistent with a retracted

spoiler position. Further, had either the flight or ground spoilers been extended in flight,

the airplane would not have been able to achieve a 4-G load factor at 212 KIAS without

activating the stall warning stick shaker. The sound of the stick shaker was not heard on

the CVR.

The simulation conducted during the investigation determined that a 20-degree or

greater deflection of the rudder to the right could induce extreme control difficulties and

could lead to a rolling moment consistent with that observed by witnesses and determined

during flightpath analysis of this accident. The Safety Board was therefore concerned

about the previous maintenance discrepancies relating to rudder operation on the accident

airplane.

Previous discrepancies:

The first evidence of a potential rudder control problem on

N999UA occurred on February 25, six days before the accident flight, when the

flightcrew on that day experienced a transient uncommanded yaw to the right. The crew

turned off the yaw damper and no further uncommanded yaws were observed during the

flight. Following that flight, UAL maintenance replaced the yaw damper coupler.

However, on February 27, another crew experienced an uncommanded yaw to the right,

Analysis 121 Aircraft Accident Report

and they, too, turned off the yaw damper to eliminate a recurrence of the problem. The

UAL maintenance personnel then replaced the yaw damper transfer valve in the rudder

MPCU. No further problems were encountered prior to the accident flight.

The Safety Board believes that the UAL maintenance efforts to troubleshoot the

system were in accord with normal practices. However, it is doubtful that these actions

corrected the problem since subsequent tests of both of the removed components showed

that they operated normally. During the examination of the MPCU recovered from the

wreckage, it was noted that one of the electrical wires to the solenoid was loose and circuit

continuity was intermittent. The Safety Board believes that this intermittent circuit could

have been the cause of the uncommanded yaws experienced on the earlier flights. If this

were the case, the effect of the discrepancy would be erratic deflections of the rudder

when the yaw damper was in use. However, by design, the authority of the yaw damper is

limited to 2 degrees of rudder travel. While uncommanded rudder movements of

2 degrees or less could produce noticeable side loads, they would have little or no effect

on airplane controllability.

Standby rudder actuator input crank shaft galling:

The Safety Board believes that

the binding of the input shaft to the bearing that is threaded in the standby actuator body

could also have produced the two transient uncommanded yaws experienced during

previous flights. As discussed in section 1.16.3, a rudder movement initiated by the yaw

damper will produce a small angular movement of the standby actuator input crank. If the

crank is not free to move relative to the actuator body, the feedback loop to the MPCU

servo valve will be affected so that a rudder deflection command signal may be applied to

the MPCU through rotation of the torque tube. The rudder could then move beyond

normal yaw damper limits until an opposing load sufficient to overcome the binding force

between the standby actuator input shaft and bearing applied by the centering spring is

reached. At this point, the MPCU servo valve null can be restored. The resultant

deflection could be as much as 5.5 degrees. The simulation tests showed that this rudder

movement could be easily countered by the airplane's lateral controls. Although the

airplane would be in a sideslip with some resultant performance penalties, a loss of

control is unlikely.

Moreover, the Safety Board believes that the finding that the bearing nut was

rotationally backed off about 30 degrees from the standby actuator body when the unit

was examined following the accident is significant to this analysis. It was evident from the

soot pattern on the actuator body that the bearing was in this position, rather than the

position that would correspond to a properly torqued nut, before the unit was exposed to

the postcrash fire. The Safety Board does not believe that the loss of torque and rotation

can be attributed to impact loads. The postaccident examination also showed that, after

cleaning the threads, the bearing nut rotated freely in the body. Given this condition, the

potential binding between the input crank shaft and the bearing nut would have no longer

provided the rigid link between the rudder attachment and the torque tube that is

necessary to produce uncommanded rudder deflections.

The Safety Board considered the possibility that the bearing nut was backed off

from the housing during flight by a ratcheting motion wherein the binding caused by

Analysis 122 Aircraft Accident Report

galling was dependent upon the direction of rotation of the shaft within the bearing.

However, in order for the input shaft to move relative to the bearing nut, the bearing nut

must be held in position relative to the actuator or housing. A 4-degree misalignment is

the maximum that can occur with a properly connected system and without the bearing

nut moving. Once the bearing nut moves within the housing, the torque is broken and

further movement between the input shaft and bearing nut is unlikely unless a resistance

to bearing nut motion is reestablished. A series of at least eight such excursions would

have to take place before the nut could be moved 30 degrees. The Safety Board discounts

this theory as extremely unlikely.

The Safety Board believes it more likely that the nut was backed off during

maintenance in which the MPCU was removed from the airplane. With the MPCU

removed from the control system, movement of the rudder surface from side to side would

be resisted only by the standby actuator and torque tube. The centering spring would resist

torque tube rotation so that the rudder movement would normally result in a rotation of

the standby actuator input crank within the bearing. The standby actuator input crank

could have been moved to its mechanical stops with the input shaft rotating in the bearing

nut against the galling resistance. When the system was reconnected, the rudder would

have been repositioned and the lever returned to its normally neutral position while

backing off the bearing nut rather than repositioning the shaft in the nut. The final position

of the lever would be neutral, and the bearing nut would be backed off, up to 30 degrees.

Such rotation of the nut would probably break the safety wire, which might not be noticed

if the standby actuator is not the focus of the maintenance.

Boeing tests have shown that a bearing nut that has backed off 30 degrees and is

frozen to the input shaft is free to rotate about the nut threads without interfering with the

rudder system operation.

The Safety Board concludes that the bearing nut was backed off prior to the

accident and that the galling was not contributory to rudder control problems at the time

of the accident.

Although the FAA has not required such inspections, UAL inspected other B-737s

to determine whether other examples of standby actuator input shaft to bearing galling

existed. One B-737-200 airplane was found to have a galled bearing nut and input shaft.

The safety wire to the bearing nut was missing, with only a small fragment in the hole on

the bearing nut. The nut was backed off about 20 degrees. This airplane had received

maintenance writeups for rudder problems several years ago. Several components were

changed, and no additional complaints had been received. Safety Board metallurgists

characterized the galling as worse than that found on the accident airplane. The airplane

that the galled actuator was removed from had apparently been operating for some time

with the galled actuator. There were no indications that the galled actuator had ever been

detected by flight or maintenance crews within the preceding several years. It is believed

that galling occurs shortly after the unit begins operation because the condition that causes

galling is the lack of clearance between parts. After the bearing nut backs off, galling

ceases to be a problem.

Analysis 123 Aircraft Accident Report

As a result of its concern about galled standby rudder actuator bearings on other

B-737s and B-727s, the Safety Board issued Safety Recommendation A-91-77 to the FAA

on August 20, 1991 (See section 4).

MPCU secondary slide overtravel:

After the July 16, 1992, incident in which an

abnormal rudder operation was observed by a pilot during a preflight controls check, it

was discovered that the tolerances in the MPCU servo valve input lever mechanism, valve

housing, and slides could result in a degradation of MPCU force capability or piston travel

opposite to the commanded direction. The extensive tests and analyses that were

conducted disclosed that several concurrent conditions must exist to produce this aberrant

operation of the MPCU.

First, the dimensional buildup of the secondary slide relative to the valve body has

to permit hydraulic fluid flow outside the normal passage in the event that the secondary

slide moves beyond its normal range of motions and attains an overtravel condition.

Hydraulic flow outside the normal passage would have to be severe enough to produce

hydraulic pressure drops or pressure reversals resulting in the loss of hinge moment

capacity or, in extreme cases, a rudder motion in the direction opposite the input

command. Second, a mechanism must exist to produce the overtravel, for example, the

secondary slide sticking to the primary slide. Motion of the primary slide could then push

the secondary slide into the overtravel condition. Third, input commands through the

pedals have to induce large rudder MPCU input crank deflections, normally to the valve

body stops of the input crank.

When the MPCU servo valve module from N999UA was examined, it was found

that the tolerances were such that maximum travel of the secondary slide irrespective of

the relative position of the primary slide would not result in a reversal of pressure

differential across the actuator pistons. In the worst case, an internal leakage was

produced with a 66-percent drop in maximum pressure differential. This condition would

limit the rate of rudder movement and the maximum deflection that could be achieved

against aerodynamic loads.

Nonetheless, the Safety Board is concerned that this condition could cause

significant flight control difficulties under certain circumstances—for example, if sudden,

large rudder pedal inputs are needed in response to an engine failure during takeoff or

initial climb. Thus, the Safety Board believes that the positive measures that were

communicated to the FAA on November 10, 1992, in Safety Recommendations A-92-118

through A-92-121 are warranted. (See section 4).

The Safety Board is also concerned that the potential for this aberrant operation of

the B-737 rudder MPCU was not found during the unit's initial design acceptance tests or

during the postproduction functional tests of individual units. The Board has been advised

by Boeing that the test procedures have been modified so that a unit's susceptibility to

abnormal operation under unique conditions will be identified.

Analysis 124 Aircraft Accident Report

2.5 Environmental Factors

2.5.1 General Conditions

The accident occurred in visual meteorological conditions (VMC). The sun was at

an elevation of 33.2 degrees at an azimuth of 134.9 degrees. Clear skies and a visibility of

100 miles was reported at COS at 0850 and 0950. Most of the witnesses to the accident

reported clear skies. During the approach to COS and prior to the right roll, flight 585

encountered moderate turbulence below 9,000 feet.

According to the National Weather Service (NWS) Operations Manual, moderate

turbulence occurs with peak acceleration greater than .5 to 1.0 g. Air Weather Service

(AWS) CAT Forecasting Techniques notes that a 15- to 25-knot variation in airspeed can

result from moderate turbulence. In addition, several pilots in the immediate COS area

reported turbulence of moderate intensity.

Based on other pilot reports of low altitude severe turbulence, a SIGMET for

severe turbulence and a Center Weather Advisory for severe turbulence should have been

issued by the NWS. It should be noted that the possibility of isolated severe turbulence

below 18,000 feet was included by the Denver Center (ZDV) Meteorologist in his Area

Forecast for the ZDV area. In addition, a low altitude turbulence (CAT) advisory should

have been issued by the UAL Meteorology Department. However, these omissions are not

factors in the accident. The crew anticipated turbulent conditions along the route from

DEN to COS. They also encountered turbulence during the entire flight from DEN until

the initiation of the uncontrollable right roll. The Safety Board believes that immediately

before the loss of control, the turbulence encountered by flight 585 was moderate.

Moderate turbulence was forecast by the NWS in the Area Forecast.

The FDR information shows that flight 585 was encountering no greater than

+/-10 knot airspeed fluctuations and moderate vertical acceleration excursions prior to the

onset of the lateral upset. A pilot report for COS at 0920 stated that a B-737

(Continental 166) approaching runway 35 encountered an airspeed loss of 15 knots at

500 feet agl, an airspeed gain of 15 knots at 400 feet agl, and an airspeed gain of 20 knots

at 150 feet agl. Another aircraft located in the area of the accident reported that its

airspeed fluctuated between 65 to 105 knots while trying to maintain 80 knots airspeed.

While the changes in airspeed of flight 585, Continental 166, and the other aircraft in the

area are not indicative of a microburst or convective windshear, the rapid positive and

negative changes in airspeed are consistent with an environment characterized by gusty

winds.

Based on the Pilot Report of Continental 166 (20 knot airspeed gain) the COS

terminal forecast (COS FT AMD 2 031410) should have been amended by the NWS

Forecast Office in Denver to include a nonconvective LLWS advisory. However, other

aspects of the COS FT were substantially correct. An LLWS potential statement should

also have been included in the Area Forecast issued at 1145Z (SLC FA 031145).

Analysis 125 Aircraft Accident Report

While this omission by the NWS was not a factor in the accident, the Safety Board

is concerned that information on LLWS pertinent to aviation safety was not included in

the Terminal and Area Forecasts.

2.5.2 Characteristics of Horizontal Axis Vortex (Rotor)

The Safety Board investigated the pressure distribution in a horizontal axis vortex

to determine whether a corresponding pressure differential was evident in the air speed

and altitude data recorded at the time of the accident.

Equations provided by NOAA to calculate the pressure drop in a vortex showed

about a 21.5 millibar pressure decrease in the core of a vortex of strength omega equals

.6 radians per second.

At the core edge (radius equals 250 feet), the decrease was about

10.7 millibars. At a radius of 600 feet, the decrease was about 1.9 millibars. Since

1 millibar equals .03 inches of Hg., the above pressure decreases would amount to altitude

increases of about 645 feet, 321 feet, and 57 feet, respectively. In a .4 radian per second

vortex the pressure decrease in a core with a radius of 250 feet would amount to about

9.2 millibars. At the core edge, the decrease would have been about 4.6 millibars and at a

radius of 600 feet, the decrease would have been about .8 millibars. These pressure

decreases amount to altitude increases of about 276 feet, 138 feet, and 24 feet,

respectively. The equations used to calculate the pressure drop in a vortex show that the

pressure drop in the core is a function of the density and the tangential speed but not a

function of the core radius. The pressure drop at the core boundary is equal to about 1/2

the pressure drop in the core.

Therefore, given a tangential speed of 100 feet per second, the pressure drop in the

core is the same regardless of the core radius (tangential speed and density the same).

However, the pressure gradient would increase as the core radius decreases given the

same tangential speed and density. According to NOAA personnel, these values of

pressure decrease are valid only if the vortex is stationary or if the vortex is moving with

the medium. If the vortex is moving on the edge of a wind surge or if the vortex is moving

relative to the medium, the situation regarding the pressure decrease is more complicated.

NOAA calculated the pressure distribution associated with a vortex with an

angular velocity of .4 and .6 radians per second (clockwise rotation) moving relative to

the medium with a translation speed of 100 feet per second (west to east). The calculation

showed that pressure increases can occur above the core center. At around 200 feet above

the core center, near the core edge, in a .4 radians per second translating vortex, a pressure

increase of about 5 millibars occurs (corresponding to an indicated altitude decrease of

about 150 feet). A pressure increase of about 2 millibars occurs about 200 feet above the

core center (corresponding to an indicated altitude decrease of about 60 feet). About

200 feet below the core center near the core edge, a pressure decrease of about

14 millibars occurs (corresponding to an indicated altitude increase of about 420 feet).

According to Boeing’s later (1998/1999) simulations, a vortex strength of 1.8 radians per second

would be required for the United flight 585 accident scenario (see section 2.7).

Analysis 126 Aircraft Accident Report

About 200 feet below the core center, a pressure decrease of about 30 millibars is seen

(corresponding to an indicated altitude increase of about 900 feet). In the core center, the

pressure decrease is about 6 millibars (corresponding to an indicated altitude increase of

about 180 feet). In a .6 radians per second translating vortex, a pressure increase of about

5 millibars is seen about 200 feet above the core center near the core edge. At 200 feet

above the core center, the increase in pressure amounts to about 1 millibar (corresponding

to an indicated altitude decrease of about 30 feet). About 200 feet below the core center

near the core edge, a pressure decrease of about 25 millibars (corresponding to an

indicated altitude increase of about 750 feet) is seen. At 200 feet below the core center, a

decrease of about 50 millibars (corresponding to an indicated altitude increase of about

1500 feet) is seen. In the core center, the pressure decrease is about 20 millibars

(corresponding to an indicated altitude increase of about 600 feet). It can be seen from

these results that there are regions in a strong translating vortex where the pressure change

is small and positive, resulting in small decreases in the indicated altitude.

Whereas in

other regions of the vortex the pressure change is large and negative, resulting in large

increases in the indicated altitude.

A review of the accident report on Delta Air Lines flight 191, which is cited in the

factual section of this report, showed that the airplane penetrated horizontal axis vortices

in the thunderstorm outflow. Penetration of these vortices resulted in an increase (spike)

of about 100 feet in the altitude, as seen on the FDR. If a vertical tangential flow of 49 feet

per second occurred, as noted in the report of that accident, the NOAA equations show

about an 80-foot increase in indicated altitude. The calculations thus show good

correlation with flight recorded data. Therefore, the pressure decrease can be calculated

using the equations supplied by NOAA for a vortex moving with the medium.

In addition, data supplied by NASA personnel showed significant recorded

altitude increases (pressure decreases) experienced by aircraft penetrating vortices at high

altitude. These increases were on the order of 150 to 300 feet (Wingrove Report dated

April 16, 1992). Therefore, this report also showed that the altitude increases (pressure

decreases) seen are consistent with those expected using the equation supplied by NOAA.

Other data show that a vortex moving relative to the medium or on the edge of a

wind surge would still have a significant pressure decrease at and below the core.

However, above the core a small pressure decrease or a positive pressure increase may

occur. According to NOAA, if a vortex existed at the time and location of the accident it

would have likely been moving on the edge of a wind surge. However, in this case, the

associated pressure changes as a function of distance from the core would be very

complex, and further study is needed to accurately define them.

Boeing’s and the Safety Board’s later (1998/1999) computer simulations indicated that United

flight 585 would have had to remain in the vortex core for the duration of the accident sequence. These

simulations indicated that the rotor would have had to translate from a horizontal to a vertical orientation

while increasing in strength as the airplane descended to the ground with a large change in indicated altitude

(see section 2.7).

Analysis 127 Aircraft Accident Report

The NCAR atmospheric simulation for the COS area for March 3 was

inconclusive. NCAR scientists had insufficient data to initialize the model. However, a

January 9, 1989, windstorm showed the existence of concentrated regions of upward

motion (or jumps) in the Boulder and COS areas. There are similarities between

windstorm events on a case-by-case basis. However, the regions of upward motion

generated by the model for the January 9 case were not of sufficient strength to cause

controllability problems in a B-737. Shear values (change in the vertical velocity with

horizontal distance) were much too small; about 10 meters per second per kilometer (.01

per second). Boeing used this data in a simulation involving a B-737 and found that it was

essentially a nonevent. Shear values in the rotor simulation were on the order of .4 to .6

per second, 40 to 60 times greater than those of the January 9 case. Larger shear values

may exist in these regions although there is no direct evidence of such values.

There is evidence of the existence of a horizontal axis vortex at the time and in the

area of the accident. The strongest evidence regarding the existence of a vortex of the

strength Boeing calculated as necessary to cause airplane controllability problems are the

witness reports east of the accident site of a 90 mile per hour gust and gusts of 50 to

70 knots. The 90 mile per hour gust was estimated based on a previous 70 mile per hour

recorded gust that did not shake the house of the witness. The gust encountered about the

time of the accident did shake his house. Another witness who was approximately

1.25 miles east of the accident site reported gusts of 50 to 70 knots. However, these two

witness reports were not from a direct measurement of wind speed. In addition, these

gusts could have been straight line gusts rather than the result of a horizontal axis vortex

hitting the ground.

Normally, intense rotors produce a distinctive “roaring” sound. A person 12 miles

north of COS reported a rotor hitting the ground about noon. He was inside a building and

went outside to observed the rotor after hearing what he described as a roaring sound.

However, there were no reports from witnesses to this accident regarding such sounds.

Further, because a horizontal axis vortex strong enough to cause airplane control

problems would have a core pressure several tenths of an inch of Hg. lower than the

ambient pressure, a transient increase in altitude of several hundred feet should have been

noted on the FDR if flight 585 had penetrated the core of a vortex. Transients in altitude

were seen in the FDR data of Delta Air Lines flight 191 and other aircraft that penetrated

vortices. Such an altitude spike was not seen in the FDR data.

Most of the weather investigation focused on the possibility of a rotor as a cause or

a factor in this accident. However, another atmospheric phenomenon was considered as

possibly occurring at the time. This phenomenon is a concentrated region of upward

vertical motion (or jump). Based on data supplied by NCAR, Boeing simulated the

aircraft response to a jump. Boeing found it to be a nonevent. Shear values needed to be

about 40 to 60 times greater to present problems to the airplane. Although no direct

evidence exists, scientists at NCAR believe that atmosphere jumps can have much greater

shear values. These values may be strong enough to cause airplane controllability

problems.

Analysis 128 Aircraft Accident Report

While approaching COS, flight 585 probably encountered orographically induced

atmospheric phenomena, such as updrafts and downdrafts, gusts, and vertical and

horizontal axis vortices. The most likely phenomenon that would cause the airplane to roll

was a horizontal axis vortex. As discussed in section 2.6, the Safety Board does not

consider it likely that flight 585 encountered a strong horizontal axis vortex that induced a

rolling moment which exceeded the airplane's control capabilities, and the FDR data is not

consistent with such an encounter.

2.5.3 Flight Simulations with Atmospheric Disturbances

The airplane simulator was “flown” through various atmospheric rotors and

windshears. The changing flow fields relative to an airplane encountering such a rotor

produce changes in angle of attack, sideslip angle, or lift distribution across the wing. The

resulting lateral or directional imbalances contribute to uncommanded airplane motions.

The rotor size and strength were varied as was the orientation of the rotor's longitudinal

axis. The elevation angle of the rotor was varied from horizontal to vertical. The azimuth

angle was generally north-south, but varied +/- 30 degrees. The approach path of the

airplane was varied to intercept the rotor from many angles.

NOAA originally estimated, and NOAA research work has confirmed, that a

typical rotor on the day of the accident could have a rotational velocity of

0.06 radians/second (3.4 degrees per second) with a radius of 1,640 feet. The tangential

velocity at the core radius would have been 100 feet per second. Simulations showed that

such a rotor had little effect on airplane control except that performance problems could

develop if the airplane remained in the downflow field of the rotor. In a sustained

downflow, the airplane would either have to lose altitude or airspeed, similar to the

outcome of entering the downflow field of a microburst. Performance calculations have

shown that the accident airplane could have been in a downflow field of about

80 feet/second for about 30 seconds, possibly induced by a rotor's downflow field or some

other atmospheric disturbance. The airplane did lose altitude at a higher than normal rate,

but the airspeed remained constant at the flaps reference speed plus 20 knots for the

approach to landing.

In a sequence of simulations, the severity of the rotor was increased until

encounters produced extreme control difficulties. It was determined that rotors with

rotation rates of 0.6 radians/second (34 degrees per second) with a 250 feet core radius

(150 feet/second tangential velocity) generated extreme control difficulties. A more

moderate rotor with 0.4 radian/second rotation and a 250 feet core radius (100 feet/second

tangential velocity) produced significant control problems and even loss of control if

recovery procedures were not promptly implemented. A “loss of control” as defined by

the pilot group did not necessarily result in a crash, but in the loss of precise operating

control of the airplane, such as the inability to maintain a desired heading or roll angle for

short periods of time.

Gust fronts (wind gusts that impact the side of the airplane) can produce large

sideslip angles with the potential for loss of control. However, once through the

Analysis 129 Aircraft Accident Report

disturbance, the sideslip angles quickly return to near zero unless other factors, such as

rudder deflection, remain. Simulations show that as an airplane penetrates a shear, large

side slips develop with predictable airplane responses. Windshears or gust fronts severe

enough to produce control difficulties also produced flight responses that were clearly

different than those recorded by the accident airplane’s FDR. Gust fronts produced large

changes in heading into the wind, large increases in airspeed, and rapid rolling away from

the wind if not controlled by the pilot. As the roll angle increased, the wind-induced

sideslip angle transitioned into wind-induced angle of attack with marked increases in

normal acceleration (G-load). Heading data from the FDR was clearly not consistent with

data recorded during simulation efforts. Although United flight 585 was obviously

affected in varying degrees by windshears and gusts during its approach to Colorado

Springs, the Safety Board does not consider it likely that large sideslip angles resulting

from atmospheric disturbances directly resulted in the loss of control of the airplane.

2.6 United Flight 585 Upset

2.6.1 Computer Simulation Analysis

As part of its investigation of the USAir flight 427 accident, the Safety Board

conducted computer simulation studies of the United flight 585 upset. FDR

and radar

data, the accident location, and wreckage orientation were used as data points. Because

the FDR did not record roll or sideload information, it was not possible to positively

determine whether the recorded heading changes were the result of a roll or a sideslip

followed by a roll.

Other variables had to be factored into the simulation studies. The

winds and turbulence encountered by United flight 585 during the approach undoubtedly

acted on the airplane during the upset and descent. Because the exact winds encountered

by the airplane were not known, the winds could be reasonably varied during the

simulations, resulting in a number of possible scenarios that would be consistent with the

radar data and the limited FDR data. Pilot pedal input force was another variable that was

incorporated in the simulations.

The Safety Board employed several computer simulation scenarios in which the

resulting heading data matched the available FDR data. These simulations used rudder

position time histories that assumed jams of the secondary slide to the valve housing at

various positions from the neutral position (100, 71, 50, 40, and 30 percent) and a

concomitant rudder reversal. (Each of the rudder-related solutions required a control

wheel response opposing the roll.)

United flight 585 was equipped with a five-parameter FDR, which recorded microphone keying,

airspeed, altitude, and heading at once-per-second intervals and vertical Gs eight times per second.

Simulations using a control wheel input could produce a scenario involving only a roll, whereas

simulations using a rudder movement could produce a scenario involving a sideslip followed by a roll, both

of which could be consistent with the recorded data.

Analysis 130 Aircraft Accident Report

The Safety Board’s best-match computer simulation was one in which the

secondary slide jammed at 100 percent off its neutral position and, about 0943:32, the

rudder reversed in response to the pilot’s attempt to make a left rudder input. In this

simulation, the airplane’s right yaw rate had reached 4.7° per second just before the rudder

reversal because of the effects of a wind gust (a 17-knot decrease in the wind velocity for

3 seconds as the airplane descended on its approach). The Safety Board incorporated this

wind velocity change with decreased altitude into its computer simulation to match the

heading data recorded by the FDR from about 0943:28 to about 0943:31. The heading

output from the Safety Board’s best-match simulation matched the FDR heading data

within 1° or less and matched the character of the data.

The Safety Board’s computer simulations that used right control wheel input alone

(and no rudder movement) also produced heading results that matched the available FDR

data. However, that solution was not considered to be realistic because it required the

pilots to fly the airplane into the ground when simple wheel corrections could prevent this

occurrence. The Safety Board has no evidence that the pilots of United flight 585 would

have deliberately flown the airplane into the ground.

The Safety Board could also match the FDR data by assuming that the increasing

roll was the result of a rotational external wind, such as a mountain rotor.

The Safety

Board considered the possibility that a mountain rotor forced the airplane along the

accident flightpath.

With the weather conditions present in the area on the day of the

accident (strong westerly winds flowing over the mountains located west of the accident

site), rotors could have been generated, rotating in a clockwise direction (from United

flight 585’s perspective on the approach). These rotors would have likely been moving to

the east (pilots’ left to right) with the wind at an unknown altitude; however, it is possible

for a mountain wave to trap a rotor, resulting in a “standing” rotor, which would not move

with the wind.

In a June 23, 1997, letter to the Safety Board, Boeing indicated that a “rudder

hardover scenario” did not fit the United flight 585 FDR data but that a “new rotor model”

it developed did fit the data. This Boeing model proposed an encounter with a rotor that

followed the flightpath of the accident airplane and increased in strength to about

1.8 radians (103°) per second as the airplane descended to the ground. However,

according to NOAA scientists, the strongest rotors ever documented in the Colorado

Springs area had a strength of about 0.05 radians per second. Further, a NOAA/NCAR

Reports from other pilots who had flown with the captain (the flying pilot) indicate that he was a

very conservative and conscientious pilot. These reports are consistent with the captain’s conduct on the

accident flight, as documented on the CVR.

A rotor is an atmospheric disturbance produced by high winds, often in combination with

mountainous terrain, and expressed by a rotation rate (in radians per second), a core radius (in feet), and a

tangential speed (in feet per second). Rotation can occur around a horizontal or vertical axis.

The Safety Board considered several mountain rotor scenarios, including moving rotors above,

below, and at the airplane’s altitude; standing rotors located left, right, and directly along the airplane’s

flightpath; and horizontal rotors that transition to vertical rotors along the airplane’s flightpath.

Analysis 131 Aircraft Accident Report

report

100

indicated that researchers have not documented rotors that would descend to the

ground in increasing strength, such as the one proposed by Boeing.

The Safety Board evaluated the accident airplane’s FDR information for

signatures that would be expected if the airplane encountered a rotor. In addition to

changes in heading, the signatures would have included changes in indicated airspeed and

altitude resulting from the effects of the low ambient pressure within the rotor. None of

these expected pressure signatures were found. Although encounters with translating

rotors at certain angles might not produce these pressure signatures, the masking of the

FDR signatures would occur only while an airplane was entering such a rotor. United

flight 585 could not have penetrated a rotor’s low pressure core and remained there for

8 seconds (the time that the airplane would have had to remain in the rotor for the heading

output and the flightpath to match the FDR data) without pressure changes from the rotor

producing changes in airspeed and altitude. Further, none of the sounds that are normally

characteristic of intense rotors were recorded by the accident airplane’s CVR, and

witnesses on the ground did not report such sounds at the time and location of the

accident.

On the basis of the absence of the signatures of a rotor penetration on the FDR, the

absence of recorded/reported characteristic rotor sounds, and the small likelihood that a

rotor of the necessary strength and orientation would have matched the airplane’s

flightpath to the point of ground contact, the Safety Board concludes that it is very

unlikely that the loss of control in the United flight 585 accident was the result of an

encounter with a mountain rotor.

2.6.2 Human Performance Analysis

On the day of the United flight 585 accident, pilots flying in the area of the

Colorado Springs airport had reported moderate to severe turbulence, gusty winds, and

windshear. Information recorded by the CVR and FDR indicated that, as the captain (who

was the flying pilot) maneuvered the airplane in the traffic pattern, the airplane

encountered wind gusts and windshear that resulted in 10-knot airspeed changes. Because

of the turbulence and wind gusts, and because he was preparing for a crosswind landing,

the Safety Board considers it likely that the captain had his feet on the rudder pedals as he

aligned the airplane on its final approach.

According to the Safety Board’s best-match computer simulation, about 0943:20,

the airplane rolled rapidly (about 10° per second) to the right to a bank angle of about 27°

and returned to approximately a level flight attitude. This bank was entered more rapidly

and was steeper than the bank a pilot would likely have commanded for a heading

adjustment to track the extended centerline of the runway. Consequently, the Safety Board

100

The NOAA/NCAR interim report (prepared in response to Safety Recommendation A-92-57) was

titled “A Pilot Experiment to Define Mountain-Induced Aeronautical Hazards in the Colorado Springs Area:

Project MCAT97 (Mountain-Induced Clear Air Turbulence 1997).” As of March 1999, the NOAA/NCAR

final report had not been completed; however, the Safety Board has reviewed a draft of the final report and

reflected its content in this analysis.

Analysis 132 Aircraft Accident Report

assumed that the right roll was caused by an eddy or rotational wind component. (The

recovery from this right roll, however, was presumed to have been a result of control

wheel inputs made by the captain beginning about 1 second after the airplane’s roll

accelerated to the right.)

The Safety Board’s review of the CVR, FDR, and radar information revealed that,

about 0943:28 (8 seconds after the 27° uncommanded right roll), the airplane was flying

at 160 knots with 30° of flaps and the landing gear extended and was nearly aligned on the

final approach for the runway. According to the CVR, at 0943:28.2, the first officer

advised “we’re at a thousand feet [above the ground].” The FDR indicated that, about

0943:30, another right heading change began and continued at a rate of 4.7° per second. In

its computer simulation, the Safety Board matched this heading change by introducing a

crosswind gust component, resulting in right yaw. The yaw rate was sustained for more

than 3 seconds before a rapid right roll developed. This sustained yaw would have been

apparent to the captain as motion of the ground and sky features relative to the fixed

reference of the airplane’s windshield area. This heading change would have been

especially salient to the captain because the runway, with which he was trying to maintain

alignment, would have been visible ahead.

The Safety Board’s simulation scenario assumed that the captain responded to the

sudden, rapid, and sustained heading change by applying left rudder pedal input about

0943:32. The timing of this input (about 3 seconds after the peak yaw rate was attained)

would be consistent with the time required for the pilot to perceive the yaw, wait a

moment for the effect of the turbulence to subside (to avoid overcontrolling), decide that a

left rudder input was required, and then apply the left rudder pedal input. The Safety

Board’s simulation postulated that this left rudder input initiated a rudder reversal to the

right. According to the Safety Board’s simulation, at 0943:33.5 (about 1.5 seconds after

the rudder reversal began), when the captain signaled his decision to abandon the

approach by stating “fifteen flaps,” the bank angle had not exceeded 20°, and the pitch

angle was 8° nose down (approximately what it had been during the normal descent in the

period leading up to the upset). However, speech analysis indicated that the captain’s

“fifteen flaps” statement displayed a heightened level of speech fundamental frequency

that was consistent with a sense of urgency. This sense of urgency was also indicated by

the captain’s omission of a call-out item in the normal go-around procedure.

101

Although

many factors may have precipitated a go-around decision by the captain, a flight control

difficulty, such as that produced by a rudder reversal, would have been consistent with the

captain’s speed and urgency in making this decision.

If the captain applied force to the left rudder pedal, he would have felt the pedal

push strongly back against his foot pressure. Further, the Safety Board assumed that the

captain would have acted to oppose a continuing uncommanded right yaw that was being

101

The captain did not state aloud “go-around thrust,” as specified in United’s go-around procedure.

Analysis 133 Aircraft Accident Report

sustained by a reversing rudder; thus, the Safety Board’s computer simulation of the event

increased the captain’s force on the left rudder pedal to 300 pounds within 1 second.

102

During postaccident simulator exercises, the Safety Board determined that an

immediate full left control wheel response during a right rudder reversal in the airspeed

and flap configuration of United flight 585 could have allowed the flight crew to maintain

control of the airplane. However, during a rudder jam and reversal, the captain of United

flight 585 would have been contending with the distraction of the malfunctioning rudder

and thus would have been devoting his physical effort to overpowering the rudder pedals.

Further, the airplane’s yawing motion and heading changes (derived from the Board’s

computer simulations) would have produced stronger cues than those produced by the

rolling motion during the first few seconds of the upset, so the captain was likely focusing

his attention on the rapid yaw acceleration that he could not control with the rudder.

These circumstances would have been extremely confusing and distracting and

would have been unknown to the flight crew based on previous experience. Thus, it would

be understandable for the captain to have initially made a partial wheel input while

contending with the powerful physical and mental demands of the problem with the

rudder. The CVR evidence of increasing engine thrust indicated that the captain would

have been using his right hand to advance the thrust levers for an attempted go-around.

Thus, the captain would have had only his left hand available to rotate the wheel to the

left, which would have made it difficult to achieve large left control wheel deflections.

(This motion would have required the captain to pull his left arm down and across his

body while twisting his left wrist.)

Further, at the time of the left rudder input in the Safety Board’s simulation, the

airplane was in about a 5° right bank. According to the Board’s assumption that the

captain applied moderate left wheel (about one-third of the available control wheel) about

2 seconds later, the airplane would have been in a right bank of about 30°. On the basis of

the time required for the captain to perceive the need for and execute his control input

(about ¾ second), the bank angle that the captain would have been responding to with this

moderate control wheel input was about 15°. With this relatively shallow roll angle, it

would be normal for a pilot (especially an air carrier pilot) to first apply a moderate

control input and then gauge the airplane’s response before making an extreme control

input. (The Safety Board considers it likely that the first officer’s statement “Oh God” at

0943:32.6 referred to her concerns about the abrupt, sustained yaw rate and heading

change resulting from the rudder’s reversal movement to its right blowdown limit and not

about the airplane’s roll attitude or rate of change because the roll attitude was not

excessive at that time.) The Safety Board’s computer simulation further indicated that the

captain applied full control wheel to the left about 2 seconds later.

102

Although the Safety Board’s best-match simulation used 300 pounds of force reducing to

200 pounds, based on ergonomic and other research data (as discussed in section 1.18.3), the Safety Board

was also able to obtain an excellent match with the FDR data using only the minimum pedal force necessary

to sustain full rudder authority (about 70 pounds) and using 500 pounds of force.

Analysis 134 Aircraft Accident Report

The computer simulation results also indicated that, within 2 seconds of rudder

reversal, the pilots were experiencing as much as 0.44 G of sideforce from the right yaw

acceleration. This sideforce would have made a left wheel input even more difficult for

the captain because his body would have been pulled to the left and away from the control

wheel, causing a tendency to level the wheel unless he quickly returned his right hand to

the controls.

Therefore, because of the unknown nature of a rudder reversal, the initially

shallow roll angle, and the physical limitations that would have hindered an immediate

full left control wheel input, the Safety Board considers it understandable that the captain

might not have immediately applied a full left control wheel input to counter a reversing

rudder.

The Safety Board’s computer simulation showed that, about 0943:34, the bank

angle of the airplane transitioned suddenly; by about 0943:35, only 3 seconds after the

reversal, the right bank angle had increased to more than 80°. The Safety Board’s

computer simulation also showed that the captain, at that time, rapidly moved the control

wheel fully to the left. The airplane’s pitch angle had decreased to almost 30° nose down,

and the pilots would have been able to see only the ground through the windshield. The

Safety Board would expect that the captain would no longer be applying as much force to

the left rudder pedal because he was likely focusing on holding a full left wheel input and

attempting a go-around and the left rudder pedal would have forced him to a less efficient

knee angle. Consequently, the Board’s computer simulation of the event moderated the

captain’s force on the left rudder pedal to 200 pounds at that time.

Shortly thereafter (perhaps in response to the loss of attitude reference), the

captain apparently removed some of his left wheel inputs, perhaps because he was

concentrating on aft control column pressure in an attempt to raise the airplane’s nose. By

about 0943:36, the airplane rolled into an inverted attitude and the captain said “no” very

loudly. Ground impact occurred about 5 seconds later, only 9 seconds after the rudder

reversal began.

The Safety Board concludes that analysis of the CVR, Safety Board computer

simulation, and human performance data (including operational factors) from the United

flight 585 accident shows that they are consistent with a rudder reversal most likely

caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve

housing offset from its neutral position and overtravel of the primary slide. Also, because

the United flight 585 upset occurred when the airplane was less than 1,000 feet above the

ground, the pilots had very little time to react to or recover from the event. Thus, the

Safety Board concludes that the flight crew of United flight 585 recognized the initial

upset in a timely manner and took immediate action to attempt a recovery but did not

successfully regain control of the airplane. The Safety Board further concludes that the

flight crew of United flight 585 could not be expected to have assessed the flight control

problem and then devised and executed the appropriate recovery procedure for a rudder

reversal under the circumstances of the flight. The Safety Board also concludes that the

training and pilot techniques developed as a result of the USAir flight 427 accident show

that it is possible to counteract an uncommanded deflection of the rudder in most regions

Analysis 135 Aircraft Accident Report

of the flight envelope; such training was not yet developed and available to the flight

crews of United flight 585 and USAir flight 427.

103

2.7 Rudder System Jam Scenarios

During the investigation of the USAir flight 427 accident, the Safety Board

examined the rudder systems of the USAir flight 427, United flight 585, and Eastwind

flight 517 airplanes and was unable to identify any obvious physical evidence that a jam

occurred within the servo valves. Further, the investigation had not revealed how the

secondary slide could jam to the servo valve housing under conditions that would

normally be encountered by an airplane in air carrier operations and not leave any

physical evidence that the jam occurred. However, the Safety Board demonstrated that, in

servo valves with tight clearances,

104

the secondary slide could jam to the servo valve

housing and leave no physical evidence of that jam (albeit under thermal conditions that

would not normally be encountered by an airplane in air carrier operations). Further, small

particulate matter in the hydraulic fluid could reduce the already tight clearances in the

servo valve, requiring less of a thermal differential for the valve to jam. In addition, it is

possible for a large amount of small particles to provide the jamming potential of a larger,

stronger piece of metal without leaving a mark.

105

Further, testing showed that, when the secondary slide was jammed to the servo

valve housing and a sufficiently high-rate force was applied on the input crank,

compliance within the rudder system could allow the primary slide to overtravel and

result in a reverse rudder command. Therefore, the Safety Board concludes that it is

possible that, in the main rudder PCUs from the USAir flight 427, United flight 585, and

Eastwind flight 517 airplanes (as a result of some combination of tight clearances within

the servo valve, thermal effects, particulate matter in the hydraulic fluid, or other

unknown factors), the servo valve secondary slide could jam to the servo valve housing at

a position offset from its neutral position without leaving any obvious physical evidence

and that, combined with a rudder pedal input, could have caused the rudder to move

opposite to the direction commanded by a rudder pedal input.

106

In one or more of the three upset events, the main rudder PCU system could have

malfunctioned in some way other than the rudder reversal scenario described such that the

rudder moved uncommanded by a pilot to its aerodynamic blowdown limit, without

103

For more information about these training and piloting techniques, see the Board’s final report on the

USAir flight 427 accident.

104

The Safety Board’s dimensional examination of the main rudder PCU servo valves from the USAir

flight 427 and United flight 585 accidents and the Eastwind flight 517 incident revealed that the USAir and

Eastwind servo valves had relatively tight clearances. The United servo valve was damaged so severely that

accurate internal measurements could not be obtained.

105

Safety Board tests found that pieces of high-strength material could jam the servo valve but that they

would leave a mark as a result of the jam.

106

For the Safety Board’s complete analysis of the USAir flight 427 accident and the Eastwind

flight 517 incident, see the Board’s final report of the USAir flight 427 accident.

Analysis 136 Aircraft Accident Report

leaving any physical evidence, just before the pilot commanded opposite rudder.

However, the Safety Board is unaware of any mechanism by which this possibility could

have occurred. Such a malfunction scenario would need to include an explanation for the

reduction in the rudder hinge moment on Eastwind flight 517 to be consistent with the

rudder movement on that upset event.

107

To summarize, the Safety Board’s analysis indicates that the USAir flight 427 and

United flight 585 accidents and the Eastwind flight 517 incident involved rudder

deflections that could have only been the result of inappropriate pilot input or a

malfunction of the rudder system (or possibly a rotor in the case of United flight 585). The

Board and Boeing were able to perform computer simulations and kinematic analyses

involving these explanations that resulted in good matches of the available FDR data.

Further, Safety Board testing showed that the main rudder PCU servo valve could jam,

without leaving a physical mark, in a way that could lead to rudder reversal. Additionally,

in all three upset events, the available human performance data comported well with a

rudder system malfunction but were inconsistent with an inappropriate pilot input (or a

rotor in the case of United flight 585).

The statements of the Eastwind flight 517 flight crew were fully consistent with an

uncommanded rudder input. In addition, the Safety Board’s and Boeing’s computer

simulation and kinematic studies both indicated that, in the Eastwind flight 517 incident,

the rudder moved to a position consistent with rudder reversal but inconsistent with a

normally operating rudder system (given the pilots’ consistent recollections of the captain

applying great force to the rudder pedals). Therefore, the Safety Board concludes that the

upsets of USAir flight 427, United flight 585, and Eastwind flight 517 were most likely

caused by the movement of the rudder surfaces to their blowdown limits in a direction

opposite to that commanded by the pilots. The rudder surfaces most likely moved as a

result of jams of the secondary slides to the servo valve housings offset from their neutral

position and overtravel of the primary slides.

In addition to this reversal potential, the Safety Board’s investigation revealed two

other potential failure mechanisms

108

within the 737 rudder control system that could

result in a deflection to the rudder’s blowdown limit. One of these potential failure

mechanisms is a physical jam in the rudder system input linkage (between the PCU’s

input crank and body stop), preventing the main rudder PCU control valve from closing;

107

The aerodynamic blowdown limit for the Eastwind flight 517 incident airplane, assuming normal

(unreversed) operation, far exceeded the 6 to 6.5° rudder deflection that was apparently involved in the

incident. According to Boeing, the rudder blowdown limits for the incident airplane (including the reduced

hinge moment from the PCU’s excessive leakage at the bypass valve) would have been about 9° when

operating at 250 knots under normal (unreversed) pilot command, with the variation depending on the

sideslip value. Given the airplane’s leaking bypass valve and the reduced rudder hinge moment from a

secondary slide jam at 55 percent from neutral), the aerodynamic blowdown limit would have been about

6.5°.

108

A third potential failure mechanism—a jam of the primary to the secondary slide with overtravel of

the secondary slide—was identified as a result of testing after the July 1992 United Airlines rudder anomaly

that occurred during a ground check. Although the testing determined that this mechanism could cause a

rudder reversal, Boeing indicated that subsequent design changes in the servo valve eliminated this

possibility.

Analysis 137 Aircraft Accident Report

the other is a jam of the primary to the secondary slide of the main rudder PCU servo

valve combined with a jam of the secondary slide to the servo valve housing at positions

other than neutral (known as a dual jam). These failure mechanisms probably did not play

a role in the USAir flight 427, United flight 585, and Eastwind 517 upsets.

109

Nonetheless,

the failure mechanisms are cause for concern because they further illustrate the

vulnerability of the 737 rudder system to jams that could produce rudder deflections and

result in catastrophic consequences.

2.8 Flight Data Recorder

For updated information about FDR capabilities, see the Safety Board’s final

report of the USAir flight 427 accident.

109

The Safety Board considers that a dual slide jam is a less likely accident scenario than a jam of the

secondary slide to the servo valve housing because the dual jam would require two extremely rare failures to

exist in the servo valve at the same time.

138 Aircraft Accident Report

3. Conclusions

Note: Because the Safety Board’s analysis of the United flight 585 accident also

included analysis of the USAir flight 427 accident and the Eastwind flight 517 incident,

some of the findings pertain to these two events.

3.1 Findings

1. The flightcrew was certificated and qualified for the flight.

2. The airplane was properly certificated and maintained in accordance with

existing regulations. Maintenance actions to correct the previous

discrepancies related to uncommanded rudder inputs were proper and in

accordance with maintenance manual procedures.

3. The airplane was dispatched in accordance with company procedures and

Federal regulations. Dispatch of the airplane with an inoperative APU

generator was not a factor in the accident.

4. There was no evidence that the performance of the flightcrew was affected by

illness or incapacitation, fatigue or problems associated with personal or

professional backgrounds. Procedures and callouts were made in accordance

with UAL procedures.

5. There were no air traffic control factors in the cause of the accident.

6. There was no evidence of any preimpact failure or malfunction of the

structure of the airplane or of the airplane's electrical, instrument, or

navigation systems.

7. Both engines were operating and developing power at the time of impact.

8. The crew did not report any malfunction or difficulties.

9. Galling found on the input shaft and bearing from the standby rudder actuator

power control unit could not cause sufficient rudder deflection to render the

airplane uncontrollable.

10. It is very unlikely that the loss of control in the United flight 585 accident was

the result of an encounter with a mountain rotor.

11. Analysis of the cockpit voice recorder, National Transportation Safety Board

computer simulation, and human performance data (including operational

factors) from the United Airlines flight 585 accident shows that they are

consistent with a rudder reversal most likely caused by a jam of the main

rudder power control unit servo valve secondary slide to the servo valve

housing offset from its neutral position and overtravel of the primary slide.

Conclusions 139 Aircraft Accident Report

12. The flight crew of United flight 585 recognized the initial upset in a timely

manner and took immediate action to attempt a recovery but did not

successfully regain control of the airplane.

13. The flight crew of United flight 585 could not be expected to have assessed

the flight control problem and then devised and executed the appropriate

recovery procedure for a rudder reversal under the circumstances of the

flight.

14. Training and piloting techniques developed as a result of the USAir flight 427

accident show that it is possible to counteract an uncommanded deflection of

the rudder in most regions of the flight envelope; such training was not yet

developed and available to the flight crews of USAir flight 427 or United

flight 585.

15. It is possible that, in the main rudder power control units from the USAir

flight 427, United flight 585, and Eastwind flight 517 airplanes (as a result of

some combination of tight clearances within the servo valve, thermal effects,

particulate matter in the hydraulic fluid, or other unknown factors), the servo

valve secondary slide could jam to the servo valve housing at a position offset

from its neutral position without leaving any obvious physical evidence and

that, combined with a rudder pedal input, could have caused the rudder to

move opposite to the direction commanded by a rudder pedal input.

16. The upsets of USAir flight 427, United flight 585, and Eastwind flight 517

were most likely caused by the movement of the rudder surfaces to their

blowdown limits in a direction opposite to that commanded by the pilots. The

rudder surfaces most likely moved as a result of jams of the secondary slides

to the servo valve housings offset from their neutral position and overtravel

of the primary slides.

3.2 Probable Cause

The National Transportation Safety Board determines that the probable cause of

the United Airlines flight 585 accident was a loss of control of the airplane resulting from

the movement of the rudder surface to its blowdown limit. The rudder surface most likely

deflected in a direction opposite to that commanded by the pilots as a result of a jam of the

main rudder power control unit servo valve secondary slide to the servo valve housing

offset from its neutral position and overtravel of the primary slide.

140 Aircraft Accident Report

4. Recommendations

Following incidents that involved anomalies in the B-737 rudder system, on

November 10, 1992, the National Transportation Safety Board made the following

recommendations to the Federal Aviation Administration:

A-92-118

Require that Boeing develop a repetitive maintenance test procedure to be used by

B-737 operators to verify the proper operation of the main rudder power control

unit servo valve until a design change is implemented that would preclude the

possibility of anomalies attributed to the overtravel of the secondary slide.

A-92-119

Require that Boeing develop an approved preflight check of the rudder system to

be used by operators to verify, to the extent possible, the proper operation of the

main rudder power control unit servo valve until a design change is implemented

that would preclude the possibility of rudder reversals attributed to the overtravel

of the secondary slide.

A-92-120

Require the operators, by airworthiness directive, to incorporate design changes

for the B-737 main rudder power control unit servo valve when these changes are

made available by Boeing. These changes should preclude the possibility of

rudder reversals attributed to the overtravel of the secondary slide.

A-92-121

Conduct a design review of servo valves manufactured by Parker Hannifin having

a design similar to the B-737 rudder power control unit servo valve that control

essential flight control hydraulic power control units on transport-category

airplanes certified by the Federal Aviation Administration to determine that the

design is not susceptible to inducing flight control malfunctions or reversals due

to overtravel of the servo slides.

On January 3, 1994, the FAA issued AD 94-01-07, which required repetitive tests

of 737 main rudder PCUs to detect internal hydraulic fluid leakage until they are replaced

with new PCUs containing servo valves designed to prevent secondary slide overtravel.

On the basis of this AD, the Safety Board classified A-92-118 and –120 “Closed—

Acceptable Action” in a letter dated August 11, 1994, and classified A-92-119 “Closed—

Acceptable Alternate Action” in a letter dated August 14, 1994. With respect to A-92-121,

on June 10, 1993, the Safety Board classified this recommendation “Closed—Acceptable

Action” on the basis of the FAA’s review of servo valves manufactured by Parker Hannifin

Recommendations 141 Aircraft Accident Report

on all transport-category airplanes and its determination that a problem existed only in

737 airplanes.

Because of its concern about galled standby rudder actuator bearings on other

B-737s and B-727s, on August 20, 1991, the Safety Board issued the following Safety

Recommendation to the FAA:

A-91-77

Issue an Airworthiness Directive requiring a check on all Boeing 737 and 727

model airplanes with the P/N 1087-23 input shaft in the rudder auxiliary actuator

unit for the force needed to rotate the input shaft lever relative to the P/N 1087-22

bearing of the auxiliary actuator unit. During this check, the bearing should be

inspected to determine if it rotates relative to the housing. All shaft assemblies in

which rotation of the bearing occurs, or in which excessive force is needed to

move the input lever, should be removed from service on an expedited basis and

the assemblies should be replaced with a P/N 1087-21 shaft assembly that has a

reduced diameter on the unlubricated portion of the shaft in accordance with

revision G of the P/N 1087-23 engineering drawing. All assemblies meeting the

force requirement should be rechecked at appropriate intervals until replaced with

a P/N 1087-21 shaft assembly containing a P/N 1087-23 shaft that has a reduced

diameter on the unlubricated portion of the shaft.

The FAA's response to this recommendation, dated October 9, 1991, stated that it

agreed with the intent of the safety recommendation and that it was considering the

issuance of a notice of proposed rulemaking (NPRM) to address the problem.

On November 21, 1991, the Safety Board responded to the FAA's letter, indicating

that it was pleased with this response. Pending notification of progress on the NPRM, the

Safety Board classified Safety Recommendation A-91-77 as “Open—Acceptable

Response.”

On January 3, 1992, the FAA issued an NPRM (Docket No. 91-NM-257-AD)

proposing to adopt an airworthiness directive (AD) applicable to all Boeing Model

727-series airplanes and certain Model 737-series airplanes. This NPRM proposed to

require inspection of the input shaft in the auxiliary (standby) rudder power control unit

and to require reporting to the FAA on units that fail the inspection test procedure.

In a letter dated March 27, 1992, the Safety Board expressed its concern to the

FAA that the second part of the Safety Board's recommendation regarding inspection of

the bearing was not included in the NPRM. The Safety Board believes that inspection of

the bearing for rotation in the housing and for the integrity of the safety wire is an

essential part of the entire inspection. Further, the Safety Board advised the FAA that it

believed the proposed time frame for compliance with the inspection (4,000 flight hours)

might be excessive. The letter stated that the proposed AD, if it included the modifications

described above, would fulfill the intent of Safety Recommendation A-91-77. Pending

notification of progress on the NPRM, the Safety Board classified A-91-77 as “Open—

Acceptable Response.”

Recommendations 142 Aircraft Accident Report

In its December 8, 1992, report on this accident, the Safety Board stated that

because there had been no further action taken by the FAA on its proposed rulemaking

and because another airline had found galled bearings during an inspection, it reiterated

Safety Recommendation A-91-77 and urged the FAA to expedite action on its AD. In that

report, the Safety Board classified A-91-77 as “Open—Unacceptable Action.”

On April 19, 1993, the FAA issued a notice in the Federal Register to withdraw the

NPRM. In an August 5, 1993, letter to the Safety Board, the FAA explained that it had

reevaluated the design of the rudder control system on 727 and 737 airplanes and

determined that fighters would be capable of detecting a galled condition by (1) increased

force necessary to move the rudder pedal; (2) erratic nose gear steering with the yaw

damper engaged; (3) rudder yaw damper kick back or yaw damper back drives on the

rudder pedals during flight; and (4) erratic operation of the rudder yaw damper or erratic

rudder oscillations with the yaw damper engaged. On November 15, 1993, the Safety

Board noted it had no further evidence that galling could result in uncommanded rudder

deflections of a significant magnitude and classified Safety Recommendation A-91-77

“Closed—Acceptable Alternate Action.”

In addition, as a result of information developed during the course of this

investigation, in its December 8, 1992, report on this accident the Safety Board reiterated

the following two safety recommendations that it issued on July 20, 1992 to the Federal

Aviation Administration:

A-92-57

Develop and implement a meteorological program to observe, document, and

analyze potential meteorological aircraft hazards in the area of Colorado Springs,

Colorado, with a focus on the approach and departure paths of the Colorado

Springs Municipal Airport. This program should be made operational by the

winter of 1992.

A-92-58

Develop a broader meteorological aircraft hazard program to include other

airports in or near mountainous terrain, based on the results obtained in the

Colorado Springs, Colorado, area.

The FAA's response to these recommendations, dated October 8, 1992, stated that

it agreed with the intent of these safety recommendations. The FAA anticipated, based on

budget constraints and program priorities, that the work on these projects could start in

fiscal year 1995.

In its December 8, 1992, report on this accident, the Safety Board noted that the

FAA agreed with the intent of these safety recommendations and that it planned to address

their intent through an interagency program with the National Oceanic and Atmospheric

Administration/Forecast Systems Laboratory or the National Science

Foundation/National Center for Atmospheric Research. However, in that report the Safety

Recommendations 143 Aircraft Accident Report

Board expressed its concern that the FAA believed that due to budget constraints and

program priorities, these projects could not be started until fiscal year 1995. The Safety

Board stated it understood the difficulty in funding these projects in fiscal year 1993, but

believed that the FAA should reevaluate its priorities to include them in 1993. Pending

further information concerning fiscal year 1993 funding, the Safety Board classified

Safety Recommendations A-92-57 and A-92-58 as “Open—Unacceptable Response.”

In a letter dated April 3, 1998, the FAA stated that it had completed several actions

to improve the safety of flying in mountainous areas by providing pilots, dispatchers, and

others in aviation operations with a series of products that will detect, display, and forecast

hazardous mountain winds. Specifically, the FAA noted that, in conjunction with NOAA

and NCAR, it had published Advisory Circular 00-57, “Hazardous Mountain Winds and

Their Visual Indicators,” to assist pilots in diagnosing the potential for severe wind events

in the vicinity of mountainous areas and to provide information on preflight planning

techniques and inflight evaluation strategies for avoiding destructive turbulence and loss

of aircraft control. In addition, the FAA noted that NOAA and NCAR personnel had

collected data on the intensity and direction of wind flows at the Colorado Springs Airport

during the period January through March 1997, when mountain-induced activity was

known to be prevalent. The FAA stated that the original scope of the experiment at

Colorado Springs that had been anticipated in response to Safety Recommendations

A-92-57 and –58 had been reduced because of funding constraints and the overall

assessments of the priority of safety-related research and, as a result, the project had been

terminated.

In a letter dated January 20, 1999, the Safety Board stated that it recognized the

large amount of meteorological data collected during the Colorado Springs

meteorological program in 1997 and urged the FAA to make every effort to ensure the

complete and detailed analysis of these data and the timely publication of the results. On

the basis of the results, and pending the issuance of a final report by NOAA and NCAR,

Safety Recommendation A-92-57 was classified “Open—Acceptable Response.”

Regarding Safety Recommendation A-92-58, the Safety Board stated its belief that the

FAA should develop a broader meteorological aircraft hazard program to include other

airports in or near mountainous areas. Pending the receipt of further information from the

FAA about such a program, Safety Recommendation A-92-58 was classified “Open—

Unacceptable Response.”

Recommendations 144 Aircraft Accident Report

On March 2, 2000, the Safety Board requested that the FAA provide a progress

report on the actions taken in response to Safety Recommendations A-92-57 and –58.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

CAROL J. CARMODY

Acting Chairman

JOHN A. HAMMERSCHMIDT

Member

JOHN J. GOGLIA

Member

GEORGE W. BLACK, JR.

Member

Adopted: March 27, 2001

145 Aircraft Accident Report

5. Appendixes

Appendix A

Investigation and Hearing

Investigation

The National Transportation Safety Board was notified of the accident about

1200 hours Eastern Standard Time, on March 3, 1991. An investigation team was

dispatched from Washington, D.C. late that afternoon and was met at the Colorado

Springs Airport by personnel from the Safety Board's Fort Worth Regional office. After a

brief visit to the accident site, an organizational meeting was held, during which on-scene

investigative groups were formed for operations, structures, systems, weather,

powerplants, survival factors and air traffic control. Later, groups were formed for aircraft

performance, CVR, FDR, sound spectrum, human performance, maintenance records, and

metallurgical examinations.

Parties to the investigation were the FAA, United Airlines, Boeing Commercial

Airplane Group, United Technologies-Pratt and Whitney, the National Air Traffic

Controller Association, the International Association of Machinists and Aerospace

Workers, and the Air Line Pilots Association.

Public Hearing

The Safety Board did not hold a public hearing on this accident.

146 Aircraft Accident Report

Appendix B

Personnel Information

The captain, age 52, possessed an Airline Transport Pilot (ATP) certificate No.

1573331 dated September 19, 1989, which carried the following ratings: airplane

multiengine land; B-737/A; commercial privileges for airplane single engine land. His

current first class airman medical certificate, dated December 7, 1990, contained the

restriction that he possess correcting glasses for near vision while exercising the privileges

of his airman certificate. He had experience as a copilot (first officer) on UAL's B-727 and

B-737 airplanes, as well as flight engineer experience (second officer) on the DC-8 and

B-727. He had accrued a total flight time of 9,902 hours while employed with UAL, of

which 1,732 was in the B-737-200. His pilot-in-command time in the B-737-200 was

891 hours and 31 minutes. His block to block time during the previous 24 hours, 72 hours,

30 days, and 90 days were 4 hours 15 minutes; 14 hours 27 minutes; 68 hours 20 minutes;

and 195 hours 49 minutes, respectively.

The first officer, age 42, held an ATP certificate No. 429961904 with the following

ratings and limitations: airplane multiengine land; commercial privileges airplane single

engine land. Her first class airman medical certificate, dated August 21, 1990, contained

no limitations. She had accrued a total flight time of 3,903 hours of which 1,303 were with

UAL. Her flight time in the B-737-200, all with UAL, was 1,077 hours. Her flight time the

previous 24 hours, 72 hours, 30 days, and 90 days were 4 hours 15 minutes; 5 hours

24 minutes; 67 hours 42 minutes; and 189 hours 48 minutes. This was her second landing

at Colorado Springs. She had conducted a total of 3 flights into and out of Denver during

the 90-day period prior to the accident.

147 Aircraft Accident Report

Appendix C

Airplane Information

The airplane was powered by two Pratt & Whitney JT8D-17 engines; serial

number 702691 on the left, and serial number 708831 on the right. Engine records indicate

that the left engine was installed on December 9, 1989, and had 26,659 hours and

20,627 cycles of operation. The right engine was installed on January 17, 1989, with

22,303 hours and 18,831 cycles of operation.

148 Aircraft Accident Report

Appendix D

Cockpit Voice Recorder Transcript

Legend of communication descriptions, abbreviations, acronyms and symbols

used in the attached CVR transcript:

CAM Cockpit area microphone voice or sound source

RDO Radio transmission from the accident aircraft

COM Radio transmission to the accident aircraft (other than live

ATC )

NAV Navigational radio transmission to the accident aircraft

PA Aircraft public address system

–1 Voice (or position) identified as Captain

–2 Voice (or position) identified as First Officer

–? Unidentifiable voice

DENTWR Denver Local Controller (tower)

DENDEP Denver Departure Controller

COSAPP Colorado Springs Approach Controller

COSTWR Colorado Springs Local Controller (tower)

* Unintelligible word

# Expletive deleted

… Pause

( ) Questionable text

[ ] Editorial insertion

– Break in continuity

Appendix D 149 Aircraft Accident Report

150 Aircraft Accident Report

Appendix D 151 Aircraft Accident Report

Appendix D 152 Aircraft Accident Report

Appendix D 153 Aircraft Accident Report

154 Aircraft Accident Report

Appendix D 155 Aircraft Accident Report

Appendix D 156 Aircraft Accident Report

Appendix D 157 Aircraft Accident Report

Appendix D 158 Aircraft Accident Report

Appendix D 159 Aircraft Accident Report

Appendix D 160 Aircraft Accident Report

Appendix D 161 Aircraft Accident Report

Appendix D 162 Aircraft Accident Report

Appendix D 163 Aircraft Accident Report

Appendix D 164 Aircraft Accident Report

Appendix D 165 Aircraft Accident Report

Appendix D 166 Aircraft Accident Report

Appendix D 167 Aircraft Accident Report

Appendix D 168 Aircraft Accident Report

Appendix D 169 Aircraft Accident Report

Appendix D 170 Aircraft Accident Report

Appendix D 171 Aircraft Accident Report

Appendix D 172 Aircraft Accident Report

Appendix D 173 Aircraft Accident Report

Appendix D 174 Aircraft Accident Report

Appendix D 175 Aircraft Accident Report

Appendix D 176 Aircraft Accident Report

Appendix D 177 Aircraft Accident Report

Appendix D 178 Aircraft Accident Report

179 Aircraft Accident Report

Appendix E

NCAR Weather Study

Appendix E 180 Aircraft Accident Report

Appendix E 181 Aircraft Accident Report

Appendix E 182 Aircraft Accident Report

Appendix E 183 Aircraft Accident Report

Appendix E 184 Aircraft Accident Report

Appendix E 185 Aircraft Accident Report

Appendix E 186 Aircraft Accident Report

Appendix E 187 Aircraft Accident Report

Appendix E 188 Aircraft Accident Report

Appendix E 189 Aircraft Accident Report

190 Aircraft Accident Report

Appendix F

Review of Literature and Correspondence Related to

Severe Weather Phenomena

The following are excerpts from literature and correspondence dealing with

orographically induced weather phenomena:

From "Aviation Aspects of Mountain Waves" World Meteorological Organization

(WMO - No. 68. TP. 26):

• By far the most common and most important seat of turbulence in mountain

waves is the area of the rotor clouds. These clouds form in standing eddies

under the wave crests at an altitude which is comparable with the height of the

mountain that produces the wave. Measurements made in standing eddies

downwind from the Montagne de Lure in France (height 1,400 meters above

surrounding terrain) have revealed that the strong variations in the wind speed

ranging from 10 to 25 meters per second (m/sec) occur inside these eddies and

that the vertical speeds can vary from +8 m/sec to -5 m/sec in 2 or 3 seconds.

This is equivalent to a vertical acceleration of 2 to 4 G.

• Rotor turbulence is much more intense in waves generated by the larger

mountains. Violent sharp-edged gusts exceeding 12 m/sec have been measured

in some Sierra waves, and experienced pilots have reported complete loss of

control of their aircraft for short periods while flying in the rotor areas.

• The danger of rotor turbulence to aviation is accentuated by the fact that the

downdraft in the lee of the rotor and the updraft on the other side of it can drag

the aircraft into the rotor cloud.

• The most dangerous situation occurs when lack of moisture prevents rotor

cloud formation. In this case, no prior visual warning is given.

• Mountain wave formation requires a marked degree of atmospheric stability in

the lower layers.

• Vertical variation of the wind is also important; and wind normal to the

mountain ridge and the wind direction is almost constant with height.

• Wave streaming occurs in the lower layers with strong winds that increase with

height; in the lower levels stationary vortices form with reversed flow at

ground level.

• Rotor streaming occurs when a very strong wind extends to a limited height

not to exceed 1.5 times the height of the ridge, and is capped by a layer of

appreciably weaker wind. The disturbed part of the air flow is in the form of a

system of quasi-stationary vortices rotating in opposite directions.

Appendix F 191 Aircraft Accident Report

• Winds need to be within 30 degrees of the direction normal to the mountain

ridge.

• The presence of a jet stream with its high wind speeds and strong vertical

windshear is an important factor in the occurrence of powerful waves

particularly in the lee of large mountains such as the Rockies.

• The turbulence within a system of standing lee-waves is most frequent and

most severe in the standing eddies under the wave crests at mountain top level.

From "Atmospheric Turbulence," John C. Houbolt, April 1973, AIAA Journal:

• Wind flow over mountains often exhibits four characteristics: turbulence on

the immediate lee side; a stratified gravity wave pattern, extending for great

distances on the lee side; shear-induced rotors under the crests of the gravity

waves; and lenticular like clouds at altitude in the wave crests. The lee side

turbulence and turbulence associated with the rotors can be especially severe.

• Generation by shear of severe rotors by a moving cold front is believed to be

the cause of the crash of a BAC-111 airplane in Nebraska in August 1966.

From "Synoptic Features of the Mountain Wave at Denver, Colorado," United Air

Lines Meteorology Circular No. 41, October 1, 1956:

• Requirements for mountain wave formation: wind flow normal to the range,

with a wind speed of 25 knots or more at mountain top level; a wind profile

which shows an increase in wind speed with altitude near mountain top level

and a strong steady flow at higher levels to the tropopause; an inversion or

stable layer somewhere below 600 millibars.

From Aerospace Safety, April 1964, "B-52 Incident at Sangre de Cristo Mountains,

Colorado":

• We elected, since we were going to overfly the low level course at this

intermediate altitude, to run through the 350 knot condition at 14,000 feet

altitude. From this relatively smooth air, we hit what I would term near

catastrophic turbulence. The encounter was very sudden and lasted about 10

seconds. During the first part of the encounter, the airplane appeared to be

stable in that it wasn't moving in roll nor particularly in yaw, and there wasn't

anything on the instruments that would indicate anything more than normal

excursions. As the encounter progressed, we received a very sharp-edged blow

which was followed by many more. As the first sharp-edged encounter started

bleeding off, we developed an almost instantaneous rate of roll at fairly high

rate. The roll was to the far left and the nose was swinging up and to the right at

a rapid rate. During the second portion of the encounter, the airplane motions

actually seemed to be negating my control inputs. I had the rudder to the

firewall, the column in my lap, and full wheel, and I wasn't having any luck

righting the airplane.

Appendix F 192 Aircraft Accident Report

• The aircraft was struck by severe clear air turbulence of mountain wave origin.

The winds about the time of the incident were 65 knots out of the west and 27

knots out of the south (resultant vector magnitude 70 knots).

Additional information regarding the above incident:

From Boeing memorandum on January 28, 1964:

• Turbulence in the lee of a peak due to high winds can be expected to cause

some sharp-edged gusts which may excite structural modes.

• The airplane is believed to have flown through an area containing the

combined effects of a rotor associated with a mountain wave and lateral shear

due to airflow around a large peak.

• The gust initially built up from the right to a maximum of about 45 feet per

second (TAS) [true airspeed], then reversed to a maximum of 36 feet per

second (TAS) from the left, before swinging to a straight downdraft of 85 feet

per second (TAS). Next, there was a build-up to a maximum of about 147 feet

per second (TAS) from the left, followed by a return to 31 feet per second

(TAS).

• This pattern of variation of gust velocity and intensity is believed to be

consistent with the probable occurrence of mountain waves in the area. Its

character is essentially that which is associated with the rotor or roll cloud,

which stands in the lee of a ridge at approximately the same altitude.

From "Turbulent Kinetic Energy Budgets Over Mountainous Terrain," Theodore

S. Karcostas and John D. Marwitz, Journal of Applied Meteorology, February 1980:

• Airflow around Elk Mountain in Wyoming. The streamlines diverge on the

windward side of the mountain and converge behind it, causing the air to flow

up the lee slope. A flow separation occurred due to a contribution of factors,

including the adverse pressure gradient, the friction and the shape of the

mountain. A reverse eddy-type flow occupied the space between the separated

streamlines and the mountain. The separated area was characterized by

generally high mixing rates, lower wind speed and regions of systematic

reverse flow. This reversal was accompanied by the formation of a large

semipermanent eddy. The wind speed increased along either side of the

mountain. Due to the flow separation, two high speed jets of 18 meters per

second were present on each side of the mountain.

• A rather interesting phenomenon was observed downwind of Elk. A buoyant

eddy of less than 1 kilometer in size was detected by aircraft.

From “Mesoscale Meteorology and Forecasting,” American Meteorological

Society, 1986:

• Strong mountain waves are likely to develop when mountain barrier has a

steep lee slope; upstream temperature profile exhibits an inversion or a layer of

strong stability near mountain top height with weaker stability at higher levels.

Appendix F 193 Aircraft Accident Report

• The strongest Colorado Chinooks occur during wave events when there is a

large region of high pressure upstream of the mountains to the west, and a

rapidly developing lee-side trough or low pressure center in the high plains to

the east or northeast.

From "Mesoscale Atmospheric Circulations," B.W. Atkinson, 1981:

• Beneath a well-established mountain wave lay a rotor in which the air at the

base generally moves toward the mountain front. This is now a well-

established phenomenon of lee-wave situations, particularly when the latter are

well developed. Owing to the large vertical shear in the rotor, the characteristic

roll cloud which often forms has the appearance of rotating about a horizontal

axis. The low level winds beneath rotors are much lighter than elsewhere, but

violent turbulence frequently occurs in the vicinity of rotor clouds.

From “A Review of the Evidence for Strong, Small-Scale Vortical Flows During

Downslope Windstorms,” A.J. Bedard, Jr.,1990:

• Paper presents evidence for the existence of vortical flows and other small-

scale features associated with downslope windstorms.

• Some of these obstacle-induced circulations appear directly related to

mountain lee waves producing near-surface effects. Hallet (1969) described an

observation of a rotor-induced dust devil, and Bergen (1976) reviewed

evidence for the occurrence of “mountainadoes” as a significant source of

damage in the Boulder, Colorado, region.

• One interpretation of these observations of damage is that a concentrated jet of

air approached the surface. If it is associated with a lee wave segment

interacting with an upstream obstacle, or gap between obstacles, such a jet

could have strong vertical axis vorticity on its periphery.

• From the tree damage pattern, a radius of 30 meters seems reasonable for an

eddy core size. For a mean wind speed of 30 meters per second, a maximum

tangential speed of the eddy of greater than 75 meters per second is obtained.

From "Front Range Windstorms Revisited," Edward J. Zipser and Alfred J.

Bedard, Jr., Weatherwise, April 1982:

• The sporadic high wind events at Boulder took place in a limited easterly flow

region, in a pattern aloft that could be attributed to a rather large rotor at low

levels.

194 Aircraft Accident Report

Appendix G

LLWAS Sensors and Plots of Data

Appendix G 195 Aircraft Accident Report

Appendix G 196 Aircraft Accident Report