3
$\begingroup$

As was discovered during the NTSB investigation into the crash of USAir Flight 427, the design of the servo valve inside the main rudder power control unit (PCU) formerly used on 737 Original- and Classic-series aircraft was vulnerable to causing uncommanded rudder reversals if the valve’s secondary slide jammed to the valve housing at a position sufficiently far from neutral (the precise threshold varies depending on the valve and whether the secondary slide jammed in the extend or the retract position).

The valve was designed so that a secondary-slide-to-valve-housing jam would not cause a reversal:

Intended operation of jammed PCU servo valve

(Image source, page 83 of report/page 107 of PDF file)

However, if the pilot applied a sufficiently fast, abrupt rudder input, this would cause the valve’s primary slide to overtravel past the secondary slide, porting hydraulic fluid in the wrong direction and causing the rudder to move in the direction opposite from that commanded, all the way to its blowdown limit:

Actual operation of jammed PCU servo valve given sufficiently rapid rudder input

(Image source, page 84/108)

Given the potential catastrophic results of an unexpected rudder reversal (especially at lower airspeeds), why wasn’t the valve tested to make sure that it would, in fact, react to a jam in the manner in which it was designed to do so, and, if so, why wasn’t this failure mode discovered in testing?

$\endgroup$
  • $\begingroup$ For the same reason that every other part that has failed and caused an accident isn't tested for that situation. Despite the engineers & regulators best efforts not every possible situation can be conceived of in advance, and many that are a considered to rare, to unlikely, to be worth testing for. This is the reason every incident is investigated, lessons are learned, and future regulations are modified from it. $\endgroup$ – FreeMan Feb 4 at 12:46
  • $\begingroup$ @FreeMan: This is not sufficient - complacency was also part of the answer. After all, it took several very similar accidents before the NTSB could be bothered to investigate the issue closely. $\endgroup$ – Peter Kämpf Feb 4 at 18:54
3
$\begingroup$

After the accident the NTSB did very extensive testing on the PCU to determine the cause of the failure. In addition to the flight 427 PCU they tested new units, units that had been removed from other aircraft, and the units from three other crashes (SGR517, UAL585 and SLK185) as well as one selected by Boeing that had minimum tolerances.

They subjected the units to numerous tests. They could not get any of them to fail under any conditions expected during flight. The only test they could get a failure on involved an extreme temperature differential of injecting very hot hydraulic fluid suddenly into a very cold PCU. The report states "The extreme temperature differential produced during this test condition would not be expected during normal flight operations." (NTSB report page 79)

All of the PCUs passed the testing procedures for certification even after the failure testing. The temperatures of the PCU and hydraulic fluid on a 737 during flight were tested by Boeing and did not match those used for the testing.

So the PCU can only be made to fail under specific, fairly unrealistic conditions that would not be expected during flight. There was no evidence that those temperature conditions were even present during any of the flights where PCU failure was suspected. There was no reason for testing the part during design or certification in conditions that would not be expected to occur.

$\endgroup$
  • $\begingroup$ So you say that … the accidents never happened? The PCU failed on four separate occasions in the same way, so there must have been a real-world failure mechanism. $\endgroup$ – Peter Kämpf Feb 4 at 18:57
  • $\begingroup$ @PeterKämpf Not saying that at all. I'm saying that whatever real-world conditions caused the failure were clearly outside any parameters the manufacturers had expected to exist. They knew from the accidents that the part could jam, but had a hard time replicating it. I'm also not opining as to whether they should have thought of those specific conditions, only that they didn't. $\endgroup$ – TomMcW Feb 8 at 20:41
1
$\begingroup$

Because you cannot test for everything. Remember UAL 232? Mother nature always sides with the hidden flaw. We cannot anticipate every failure mode. Not can we test for all of the ones we can anticipate let alone the ones we cannot anticipate. My 30+ years of experience as a pilot and engineer are the basis for my answer. seen too many incredibly stupid things that anyone could have and should have caught but highly paid engineers did not.

Plus remember in aviation you have to follow the testing and certification system of your governing body.

$\endgroup$
  • 1
    $\begingroup$ Hi Jon and welcome. It's better to include details so the post becomes more helpful to the readers, and not just a comment. For example you mention the testing criteria, can you add details on what the FAA required (vs. what is required now) of the rudder servos? $\endgroup$ – ymb1 Feb 3 at 14:22
  • $\begingroup$ FAA testing procedures are extremely detailed lengthy documents that very few readers would understand or read. The test may test the individual component but not the whole assembly (it checks the servo but not the rudder). When you test a component you are testing manufacturing engineering and production processes. You cannot check for mistakes or unknowns in your engineering and therein lies the rub. Remember the problem with metal fatigue caused by square corners in the windows of the British Comet? $\endgroup$ – Jon Caples Feb 4 at 5:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.