National
Transportation Safety Board
Washington, D.C. 20594
Safety Recommendation
Date:
November 10, 1992
In
reply refer to: A-92-118 through-121
Honorable
Thomas C. Richards
Administrator
Federal Aviation Administration
Washington, D.C. 20591
On
July 16, 1992, during a check of the flight controls in a United
Airlines (UAL) Boeing 737-300, while taxiing to takeoff from
Chicago-O'Hare International Airport, the captain discovered that
the airplane's rudder pedal stopped at around 25-percent left pedal
travel. The airplane returned to the gate and the main rudder power
control unit (PCU) was removed.
The
PCU was tested at UAL's maintenance facilities in San Francisco,
California, on July 20, 1992. During that testing, the PCU operated
in an anomalous manner. Under certain conditions, the actuator
piston would move in a direction opposite to the commanded and
intended input. However, during other demonstrations, the PCU
operated normally.
As
a result of the initial observations, the unit was taken to the
facilities of Parker Hannifin, the valve manufacturer, at Irvine,
California, for further testing by Boeing, Parker Hannifin, and UAL.
Test results showed that the dual concentric servo valve installed
on the main rudder PCU could, under some circumstances, result in
motion opposite to that commanded by the rudder pedals. Boeing and
Parker Hannifin then initiated a design review to better understand
the nature of the reversal, to develop a design change to preclude
the reversal, as well as a plan to implement the design change.
On
July 30, 1992, the Safety Board became aware of the taxi incident at
Chicago and the subsequent investigation of the PCU. Testing and
design change efforts are continuing, and Safety Board specialists
have participated in these efforts.
During
subsequent testing of the rudder PCU, anomalous actions, ranging
from sluggish movement of the actuator piston to full reversal in
the commanded direction of piston travel, were observed when the
input crank was held against the PCU body stops and the yaw damper
piston was in the extend position. High internal fluid leakage
was also noted. The capability of the PCU to produce force to move
the rudder against aerodynamic loads was not measured. The
interaction of the yaw damper and the PCU operation as observed is
not fully understood. In addition, it is unknown whether the yaw
damper was commanding rudder movement at the time that the UAL
captain performed the rudder control check. During the tests, it was
noted that lower hydraulic operating pressures aided in achieving
anomalous actions. Tapping on the dual servo valve body or actuator
summing levers prompted the PCU to return to normal operation.
Releasing the force on the input crank also returned the PCU to
normal operation.
In
normal operation, the pilot applies force to the input crank through
the rudder pedals. If the pilot releases pressure on the pedal when
a direction reversal occurs, the tests show that the PCU should
return to normal operation. However, it is highly unlikely that
pilots would respond to a rudder reversal by releasing pedal
pressure. If, as is for more likely, rudder pressure is held until
the rudder has reversed position, the centering unit may supply
sufficient force to the input crank to sustain the anomalous
condition even though pedal pressure is released.
Analysis
by Boeing and Parker Hannifin shows that the potential for rudder
reversal could exist in all B-737 main rudder PCUs. The internal
stops of the dual concentric servo valve can allow the secondary
slide of some valves to overtravel under some conditions.
Normally, the primary slide moves about 0.045 inch before the
secondary slide moves. If the primary slide is pinned or jammed to
the secondary slide, control inputs resulting in the normal movement
of the primary slide can lead to the overtravel of the secondary
slide. If the overtravel of the secondary slide is sufficient,
hydraulic fluid could be routed through a flow passage located
outside the normal valve travel range that could result in piston
(and rudder) motion in the direction opposite to the input command.
According
to Boeing and Parker Hannifin, the effects of an overtravel
condition of the secondary slide would not be apparent during
approved acceptance tests. Accordingly, one part of the acceptance
test was modified to facilitate the investigation. During this rest,
the primary and secondary slides were pinned together to prevent
relative motion and were moved through an extended range of motion,
as allowed by the internal secondary stops. This range of motion is
greater than the normal range of motion of the secondary slide. As
the overtravel progressed, the valve porting moved out of normal
range, and the pressure and return porting to the respective slides
of the actuator piston were interconnected and eventually reversed.
The initial effect was excessive internal leakage. Full movement of
the slide produced a 3,000 pounds per square inch (psi) reversed
pressure drop across the actuator piston with the leakage slowed.
Boeing
and UAL have developed a field test procedure to verify the proper
operation of the dual servo valve. A total of 212 UAL B-737
airplanes were checked. One main rudder PCU was removed as a result
of "hissing" sounds during part of the test. The source of
these sounds was attributed to minor leakage in the PCU that was not
associated with the dual servo valve. The unit passed acceptance
tests and could have been returned to service. There were no other
indications of abnormally operating PCUs during the fleet-wide
checks. Tests and design analysis indicate that the anomalous
operation will occur only when a unique condition prevents
independent movement of the primary and secondary slides of the
servo valve (a condition that could develop suddenly or occur
intermittently). Thus, a onetime check may not ensure that reversal
will not occur.
The
dual servo valves removed from the B-737s that crashed in Colorado
Springs, Colorado on March 3. 1991, and in the Darien Province of
Panama on June 6, 1992, were also tested. The results show that a 50
percent pressure drop could have developed on the Colorado Springs
unit if a failure mechanism produced an overtravel of the secondary
valve slide. As understood thus far, if such a pressure drop
occurred, the main rudder PCU could only develop 50 percent of the
rudder hinge moment capability, working in the proper direction. The
pressure drop would be similar to losing either A- or B redundant
hydraulic systems. Moreover, the results show that a complete
pressure drop, without reversal, could have developed on the Panama
unit only if a failure mechanism produced an overtravel of the
secondary slide valve. The unit would lose hinge moment capability,
but movement of the rudder in the opposite direction beyond neutral
would not occur.
Boeing
aerodynamic data for the B-737-200 airplane shows that full rudder
deflection (approximately 26 degrees) may be uncontrollable with
full control wheel deflection (approximately 107 degrees) under
certain conditions. Flap position and airspeed are important when
determining controllability during full rudder deflection.
Historical
maintenance data shows that there have been five other incidents
related to the main rudder PCU. It is believed that two of them were
detected in flight.
On July
24, 1974, the flightcrew of a: B-737 reported that the rudder
moved "full right" on touchdown. The investigation
revealed that the primary and secondary control valves were stuck
together by a shot peen ball lodged in the valve.
On October
30, 1975, the flightcrew of a B-737 reported that the rudder
pedals moved to the right "half-way" and then jammed. This
action was repeated three times and then corrected by cycling the
rudder with the standby rudder system. Further examination indicated
that the system was contaminated by metal particles.
Another
report on October 20, 1975, indicated that during a PCU
inspection a jammed control valve was found. 'The data associated
with this report is insufficient to determine the cause of the PCU
removal.
On August
31, 1992, a B-737 reported that the rudder "locked up"
on approach and that the flightcrew initiated a go-around and
activated the standby rudder system. The landing was uneventful. The
examination of the PCU revealed internal contamination and worn
seals. It was suspected that high leakage from the worn seals
resulted in the PCU having a limited capability to generate enough
force to move the rudder.
On November
8. 1990, during an overhaul, a PCU was found to have internal
corrosion. The primary slide was stuck at neutral to the secondary
as a result of corrosion. There were no reports of malfunction prior
to the disassembly.
Boeing
and Parker Hannifin are currently developing design changes to the
dual servo valve that would limit the travel of the secondary slide
to eliminate the potential for pressure and return porting reversal.
The Safety Board understands that the rudder PCUs would most likely
be returned to Parker Hannifin for modification. Newly defined
tolerances would require that parts from the dual servo valve be
selectively fit and/or modified to produce acceptable test results.
Boeing is planning a retrofit program.
More
than 3,000 B-737 main rudder PCUs have been produced. The unit is
not a high replacement item that requires large numbers of spares.
At this time, only one test fixture is known to exist, and only one
facility is prepared to implement the changes. The Safety Board
understands that a significant period of time may be required to
remove, overhaul, and return to service all rudder PCUs in the B-737
fleet.
The
Safety Board recognizes that the B-737-series airplanes have flown
about 50 million flight hours, providing safe transportation to the
public. Only two confirmed airborne incidents have resulted from
rudder operational anomalies, and these did not result in injury to
passengers or damage to the airplanes. Nonetheless, the Safety Board
believes that rudder malfunctions, as described in this letter,
could present significant flight control difficulties under certain
circumstances, for example, sudden, large rudder pedal inputs in
response to an engine failure during initial climb. Therefore, the
Safety Board believes that interim precautionary measures are
warranted, pending completion of the long-term PCU overhaul and
replacement program.
Therefore,
the National Transportation Safety Board recommends that the Federal
Aviation Administration:
Require
that Boeing develop a repetitive maintenance test procedure to be
used by B-737 operators to verify the proper operation of the main
rudder power control unit servo valve until a design change is
implemented that would preclude the possibility of anomalies
attributed to the overtravel of the secondary slide. (Class 11,
Priority Action) (A92-118)
Require
that Boeing develop an approved preflight check of the rudder system
to be used by operators to verify, to the extent possible, the
proper operation of the main rudder power control unit servo valve
until a design change is implemented that would preclude the
possibility of rudder reversals attributed to the overtravel of the
secondary slide. (Class II, Priority Action) (A-92-119)
Require
operators, by airworthiness directive, to incorporate design changes
for the B-737 main rudder power control unit servo valve when these
changes are made available by Boeing. These changes should preclude
the possibility of rudder reversals attributed to the overtravel of
the secondary slide. (Class 11, Priority Action) (A-92-120)
Conduct
a design review of servo valves manufactured by Parker Hannifin
having a design similar to the B-737 rudder power control unit servo
valve that control essential flight control hydraulic power control
units on transport- category airplanes certified by the Federal
Aviation Administration to determine that the design is not
susceptible to inducing flight control malfunctions or reversals due
to overtravel of the servo slides. (Class II, Priority Action)
(A.92-121)
Chairman
VOGT, Vice Chairman COUGHLIN, and Members LAUBER, HART, and
HAMMERSCHMIDT concurred in these recommendations.
By:
Carl W. Vogt
Chairman
