The Seattle Times, by Byron Acohido

By Byron Acohido

Last month's crash of an American Airlines Boeing 757 in Colombia has sparked an intense debate among pilots and aviation-safety experts over perceived shortcomings in airline equipment, training and air-traffic-control standards.

While initial reports suggest pilot error in the crash of Flight 965, airline critics are asking whether the apparent missteps of Capt. Nick Tafuri and First Officer Don Williams can be tied in part to an impetus to cut costs and a general deterioration of pilot-navigation skills among many U.S. carriers.

Many of those weighing in on computer-bulletin boards think U.S.-trained pilots have become too reliant on air-traffic controllers guiding them to the quickest possible landing with the help of powerful airport radar.

Moreover, the Air Line Pilots Association has stepped up a long-running campaign to urge the Federal Aviation Administration (FAA) to expand terse descriptions of nonradar landing procedures and techniques in the basic pilot manual.

Officials from the FAA, the pilot's association and American Airlines decline to discuss the burgeoning debate within the aviation community, citing the ongoing Cali crash investigation.

But some insiders, who requested anonymity, hope the Cali disaster reverses what they perceive to be a trend toward airlines hastily expanding foreign routes without fully understanding potentially dangerous factors unique to flying abroad.

"What we have more and more is an operator going in and getting exposed to a different environment they know little about, and (airline) marketing won't allow them to follow anything except the minimum standards," said a source involved in discussions about upgrading the pilot manual.

Little is being done to establish special procedures reflecting the difference between flying to and from radar-equipped airports, found mostly in the United States and Western Europe, and the hundreds of other airports throughout the rest of the world that have no radar, aviation sources said.

Al Prest, vice president of operations for the Air Transport Association, a Washington D.C.-based airline-trade group, disputes that view. Prest contends better technology, improved understanding of human behavior and diligent training make for very skilled pilots and very safe flying.

"The skill level today is higher than it has ever been since this industry took off as a commercial entity in 1914 with its first paying passenger," Prest said. "And I think the data will support that."

The debate focuses on the actions of the pilots on the ill-fated American flight Dec. 20.

On a calm, moonless night, with no airport radar to guide them, Tafuri and Williams made a wide S-shaped turn while descending into a narrow canyon rimmed by treacherous mountain peaks on their approach to Cali, Colombia.

The pilots were trying to complete the turn and climb out over the canyon floor when their jetliner smashed, nose up, into the summit of a 9,000-foot mountain about 38 miles north of Cali. Of the 167 people on board American Airlines Flight 965, four passengers, along with a dog, survived.

In many countries, as well as at remote airports in some states, there is no airport radar. Pilots perform "instrument landings," navigating a descent by sequentially flying over a series of radio beacons on the ground.

Instrument landings typically take several minutes longer than radar-guided descents, and arguably require more pilot skill. Yet U.S. carriers increasingly emphasize radar-assisted landings in training, reflecting a priority given to squeezing as many flights as possible into busy hub airports, as well as saving fuel and staying on schedule.

With the evidence released thus far by Colombian officials pointing to a botched instrument-landing attempt in Cali, pilots and safety experts have exchanged hundreds of messages on aviation-related computer-bulletin boards questioning the underlying causes of the disaster.

Among the questions: Were communications between the Colombian air-traffic controllers and American pilots as clear as they could have been? Did the pilots rely too heavily on computers, compounding what should have been a series of inconsequential missteps?

A 'needless crash?'

"It was such a needless crash, and that's what has everybody so upset," said Mike Hynes, an independent crash investigator and aviation consultant from Oklahoma City. "Each error was so small, but the cumulative effect was so terrible."

Some observers believe shortcomings outside the cockpit predisposed the crew to make mistakes. These critics are calling for airlines to do more to catalog risks at airports ringed by mountains or man-made obstructions. They want to see regulators write stricter rules and mandate recurrent training for instrument-landing procedures.

In November, more than 400 aviation officials from around the world convened in Seattle for a weeklong seminar on managing safety at which many of the same issues raised by the Cali crash were discussed.

"Every single one of the hazards that existed in this case has been widely recognized," noted C.O. Miller, an aviation consultant from Sedona, Calif., who attended the conference. "These kinds of things have been getting a lot of attention in recent months and years. It makes me wonder if some of the stuff going on has been window-dressing."

Whether the crash of Flight 965 prompts safety improvements remains to be seen. An official cause isn't expected to be determined for months. Still, portions of transcripts from the airplane's cockpit voice recorder and flight data recorder provide an approximation of how the crash unfolded.

The flight departed Miami with its flight-management computer already programmed to execute an instrument-landing that would take the jet safely down the center of the canyon and beyond Cali, where it would circle back and land to the north.

As the plane crossed over Colombia, Tafuri and Williams held an extensive conversation about flight-attendant work hours. Some observers believe the pilots should have been reviewing charts of the canyon they soon would be traversing and watching for a ground beacon at a site called Tulua.

As Flight 965 descended through 20,000 feet, Tafuri began talking to the air-traffic controller in Cali. The controller noted the weather was calm and asked if Tafuri might want to fly directly to a southbound runway.

"Ah, yes, sir," Tafuri said. "We'll need a lower altitude right away, though."

The controller cleared Flight 965 to land to the south, as long as Tafuri reported his initial approach position at Tulua, 43 miles north of Cali. But the standard landing approach programmed into the flight computers in Miami did not include a check-in at Tulua.

As the pilots began looking for Tulua on their charts, Tafuri asked the tower to approve a rapid descent to a beacon near the south-facing runway.

Extension of 'spoilers'

The controller affirmed that approach but again reminded Tafuri to report the plane's position as it crossed over Tulua.

The pilots then extended wing panels, called spoilers, to make the jet descend faster.

But unbeknownst to the crew, the jet had by this time passed Tulua. When the pilots finally found the code for Tulua and dialed it into the flight computers, the autopilot began a gentle, wide turn to the left, circling back to Tulua.

The pilots let the turn continue for 90 seconds before realizing they were heading off course to the east; they then dialed in a heading to Cali. The autopilot broke off the left turn and banked slowly to the right, to the southwest. With its spoilers extended, the jet continued a rapid descent on a collision course with the summit.

With just nine seconds to impact, the ground-warning computer sounded a voice alarm: TERRAIN!, then PULLUP! PULLUP! PULLUP!

The pilots reacted within two seconds, revving the engines to maximum thrust and pulling the nose up, but the spoilers, still extended, restricted the jet's ability to climb fast.

Three seconds is considered a quick response to an unexpected cockpit event. Some observers speculate that Tafuri and Williams reacted so quickly because, by this time, they sensed they were in a dangerous area.

Flight 965 skidded, nose up, into treetops, then slammed into the mountain a few hundred feet from the summit.

Capt. Bud Leppard, who flies McDonnell Douglas MD-11s for World Airways, contends Flight 965 never would have gotten into trouble had the pilots been flying an old-style jetliner with less-sophisticated computers and a flight engineer on board to help keep track of the airplane's systems. Computers have replaced the flight engineer on late-model jets.

"The FAA and manufacturers want you to believe the glass cockpit is a great time-saver and reduces the workload, but nothing could be further from the truth," Leppard said.

"Computers are wonderful to have, but they increase your workload tremendously, especially if you deviate from the programmed flight plan."

Pilots used to calculate course changes by hand and "go fly it," he said. On high-tech jets, altering the pre-programmed course requires giving a host of commands on multiple computer screens in the proper sequence.

"The problem is when you're reprogramming the computer, you're not looking out the (cockpit) window," Leppard said.

Some pilots and safety experts believe the jet might have safely cleared the summit had Tafuri and Williams been given more than nine seconds warning, or had their jet been equipped with spoilers that retract automatically any time the engines are revved to high thrust. Auto-retract spoilers are used on several models of Airbus jets.

Some safety experts believe airlines should be required to upgrade the current generation of ground-warning computers, which monitor a jet's position relative to the ground directly below, with units that keep track of obstructions ahead of the plane.

All agree that Flight 965 never would have gotten into trouble if it had stayed on the standard approach path programmed in Miami, or if the pilots had kept better track of the Tulua ground beacon.

"The big issue is they should have never got to the point to where the spoilers needed to be retracted on a timely basis," said one veteran airline pilot.

The Federal Aviation Administration has begun a review of American Airlines' operating procedures and training "to see whether changes would build an even greater margin of safety," said FAA Administrator David Hinson.

But some in the aviation community contend the agency itself is part of the problem.

For more than three years, the pilots association has been lobbying the FAA to publish detailed instrument-landing procedures in the Aeronautical Information Manual. Some in the industry believe that is an important first step toward requiring special training for crews assigned to fly into mountainous airports lacking radar.

© 1996, The Seattle Times

By Byron Acohido

The Boeing 747-100 jetliner that crashed off Long Island was operated by TWA for all but one of its nearly 25 years in service. For exactly 365 days in the mid-1970s, the plane belonged to the Imperial Iranian Air Force.

No connection has been established between that fact and the fiery midair explosion that knocked the plane out of the sky last week, killing all 230 on board.

But it was during the jet's 12-month stint in the Iranian military that another TWA 747 owned by Iran was destroyed near Madrid in a midair explosion much like the one that destroyed Flight 800 off Long Island last week. It was the only other time a 747 has burst into flames in midair.

No cause was determined in the Madrid crash, but officials believe that either an unusual blast of wind tore the left wing off or a stray electrical spark from a fuel-system pump, perhaps triggered by lightning, ignited jet fuel fumes inside the left wing.

As a result, the Federal Aviation Administration in 1976 ordered 747 wings checked for fuel leaks, and Boeing subsequently took steps to make the fuel system safer.

But it's not known whether those safeguards were taken on the 747 that burst into flames off Long Island. At the time, the plane was exempt from civil-aviation rules and directives because it was in military service.

Boeing spokesman Doug Webb said he could not say whether the fuel-system upgrades were made once the jet was repurchased by TWA in December 1976.

The jet had been continuously operated by TWA since then, according to a records review conducted for The Times by Kolbenschlag Aviation Services of Falls City, Ore.

TWA spokesman Don Morrison said he could not say specifically why the Long Island jet was sold to Iran and repurchased but said the transaction occurred during a time when airlines were adjusting the size of their fleets in reaction to market conditions.

Yesterday, investigators announced the results of preliminary analysis of Long Island 747's cockpit and flight data recorders. The voice recorder showed no signs of a crisis among the cockpit crew, and some analysts are citing that as evidence that the crash was not caused by a mechanical failure. However, the NTSB report on the Madrid explosion noted that the voice recorder also provided few clues in that crash.

NTSB Vice Chairman Robert Francis did say yesterday that one of the TWA pilots noted an "erratic fuel-flow gauge" two minutes before the recording ends but didn't mention the problem again.

The record of the Madrid investigation provides authorities with an extensive analysis of how a catastrophic mechanical failure can detonate a 747 jumbo jet. NTSB records obtained by The Seattle Times describe a 30-month investigation by a team of U.S. experts.

Boeing had bought the Madrid jet from TWA, converted it to a freighter and sold it to the Iranian air force in March 1976. A few months later, four Boeing trainers were on board with 13 Iranian military personnel as the aircraft left Teheran on a military logistics flight. It was descending into Madrid for a refueling stop in a thunderstorm when witnesses reported an in-flight explosion and fire at about 6,000 feet.

The explosion scattered debris over a wide area, with the jet's fuselage, right wing, four engines, tail and inboard stub of the left wing forming the main wreckage site. Parts of the left wing, including the wing tip, landed in the same area, five miles from the main site, with the rest of the left wing landing about a mile from the fuselage.

So far, authorities trying to solve the Long Island crash haven't released specific information about where major groups of wreckage lie 120 feet beneath the surface of the Atlantic. As of yesterday only two of the jet's four engines had been located by sonar equipment and dive teams.

In the Madrid crash, the focus quickly turned to the left wing, which was taken to a Federal Aviation Administration lab in the United States for analysis.

Most of the NTSB's report, as well as supporting documents obtained by The Times, speaks to the possibility of a stray electrical spark, perhaps from a pump that moves fuel between tanks, detonating the left wing.

Forensic experts from the FBI and Boeing analyzed eight samples of residue from the left-wing fuel tanks and a sealed empty compartment, called the dry bay, near the left outboard engine. They found no evidence of explosives or residue of explosives.

Yet the fiberglass lead edge above the engine was severely burned by fire blasting forward into the slip stream. Metallurgists established that the upper left-wing skin tore off, releasing some 54,000 gallons of jet fuel, after the fiery blast was touched off near the left outboard engine.

In June 1976, before those findings were complete, the FAA issued an airworthiness directive, ordering 747 operators to inspect for fuel leaks in the dry bay. Most found leaks.

As investigators continued to puzzle over the Long Island crash yesterday, declining to zero in on a bomb, missile or mechanical failure as the cause of the TWA crash, FAA Administrator David Hinson met in Seattle with Boeing chairman Phil Condit.

The visit was unscheduled and concerned "routine business matters between the FAA and Boeing," said company spokesman Peter Conte. "TWA was not part of the discussion and not part of the visit."

Seattle Times business reporter Richard Buck contributed to this report.

© 1996, The Seattle Times

By Byron Acohido

Washington -- The loud noise at the end of Trans World Airlines Flight 800's cockpit voice recorder is more consistent with a fuel explosion than with the sharp sound caused by the bomb that brought down Pan American Flight 103 over Lockerbie, Scotland, in 1988, sources close to the investigation said yesterday.

But specialists who analyzed the recording have reluctantly concluded it probably will not tell them why the Boeing 747 plunged into the ocean off Long Island last month, killing all 230 people aboard. The sound could have been a fuel-tank explosion, but it also could have been a bomb that was different from the Pan Am blast. It even could have been a rapid structural breakup, the sources said.

A comparison with numerous other voice recorders from past airplane bombings, fuel-tank explosions and structural disasters did not find an exact matching sound. And although the sound has the characteristics of a "fuel-air mixture" explosion, at least one other bombing has produced a somewhat similar sound, officials said.

Complicating the investigation further, a sound-spectrum analysis of the recording has failed to pinpoint the location of an explosion or to detect the characteristic signature of a "wave pulse" - or shock wave - from a bomb.

The wave pulses buried in the recording are too poorly defined, perhaps because of acoustics of the airplane's structure or the location of the explosion, the sources said.

When the so-called "black boxes" with the voice recorders were discovered in the weeks following the July 17 crash, it was hoped they might allow investigators to determine whether the crash was an accident or sabotage. Instead, the analysis, along with other findings, has left some perplexed, deepening the mystery of what happened aboard Flight 800.

The recording didn't tell us what we needed to know," one senior law-enforcement official said. "This is very frustrating."

Like other evidence, the recording adds to a wealth of knowledge of what did and did not happen to the 747, but not how.

The FBI also has failed to find any explosive residue on aircraft parts, and metallurgical tests so far confirm a major explosion but not whether it was caused by a bomb or some cataclysmic mechanical failure.

Sound-spectrum analysis of cockpit voice recorders has proved to be one of the most effective means for spotting and describing explosive damage.

The Pan Am 103 bombing over Lockerbie left such a detailed explosive signature that the recording alone was evidence of a bomb.

Investigators compared the TWA voice recording with those from the Pan Am bombing and several other crashes that involved bombings, fuel-tank explosions and structural breakups. In addition, they compared it with explosive tests conducted by British aviation-safety authorities.

Even though the sound lasted only a short time before the doomed aircraft's electricity was cut off, specialists were able to determine how rapidly it grew, its intensity and other characteristics.

Unlike the rapid onset of the Lockerbie bombing sound, the TWA sound grew in intensity at a slower rate and lasted longer, officials said.

The sound was "not terribly inconsistent" with a center fuel tank explosion that destroyed a Philippine Boeing 737 in 1990, the officials said.

In that case, the source of ignition was never determined, but investigators suspected wiring had been installed inside the tank and perhaps caused a spark.

The TWA tape was also compared with recordings recovered from the bombings of an Air India plane in 1988, a French UTA DC-10 1989, an Avianca Colombian Boeing 727 in 1989 and a TWA 707 in 1974.

Investigators also used for comparison the explosive decompression of a United Airlines 747 when a cargo door blew off in 1989.

© 1996, The Seattle Times

By Byron Acohido

Federal aviation and Boeing service records contain extensive documentation about where the wing and belly tanks on 747s are susceptible to leaks that can cause fire.

NTSB Vice Chairman Robert Francis, who is heading the investigation into the crash of TWA Flight 800, has declined to compare how much credence investigators are giving to the bomb vs. leaky fuel theories.

But investigators have been piecing together the section of the plane they believe will provide them with the most clues on what caused the belly and right wing tanks to rupture and burn, a sequence that most likely began about a half a minute after things began to go wrong shortly after it departed New York's John F. Kennedy Airport bound for Paris.

The center section, between rows 17 and 28, is where the blast is believed to have originated, a source said. Those seats are near where the central fuel tank is located and where the wings are attached to the plane.

An explosive device precisely placed in the passenger cabin above the belly tank or in a cavity adjoining the belly or wing tank would punch a crippling hole in the airplane's most vulnerable, volatile area.

Another way things could have gotten started is if fuel or fuel vapors leaking from the belly or wing tanks accidentally ignited in an adjacent cavity.

It may have been a two-staged event," said Mike Hynes, an independent crash investigator from Frederick, Okla. "You could've had a malfunction of some kind . . . followed by a big splash of fuel going off."

Federal avaiation and Boeing service records on the 747 show several ways that the wing and belly tanks on 747s are susceptible to leaks that can cause fire.

-- Fuel and fuel vapors can seep past each of the thousands of fasteners used to form the front wall of the belly tank. To account for this design characteristic, Boeing applied a rubber-like sealant, called CAT-A-LAC, on the heads of each fastener. As an extra measure of protection against leaks, Boeing also called for application of the sealant on the other end of all the fasteners.

But in 1989 Boeing sent a service document to 747 operators warning that "the secondary fuel barrier may not have been properly applied to some areas . . . An inspection of an airplane in production revealed that the back side of fasteners and brackets may not have been coated as these areas were shielded from the spray. This coating is required to prevent fuel or fuel vapors from entering the cargo and passenger compartments in the event of a failure of a primary fuel seal or a crack in the center section structure."

In 1991, the FAA gave airlines 30 months to inspect for this production oversight and apply the secondary barrier.

TWA officials have said that the Flight 800 jet complied with this and other federal directives.

-- Another FAA directive, last updated in 1994, instructs 747 operators to repeatedly inspect hundreds of fasteners in a 10 foot length of the wing tanks above each of the inboard engines - an area in close proximity to the fractured and scorched parts of Flight 800's right wing. Fastener holes on jets with more than 13,000 flights are prone to begin cracking and leaking near the inboard engines and into cavities where electrical pumps and wiring are housed.

-- Most recently, an airline discovered that when electrical insulation on a 747's fuel pump failed (the plane was on the ground at the time), electricity burned a hole in the pump's case, letting fuel leak and then igniting it.

On Aug. 7, in a move officials said was not related to Flight 800, the FAA proposed a directive requiring regular testing and possible replacement of 747 fuel pumps. Following a 90-day comment period, the FAA will decide whether to issue the order.

An extensive account of how a small fire or explosion near the 747's fuel system during flight can escalate in disaster was detailed in the late 1970s when the safety board concluded a 30-month investigation into the 1976 fire and explosion of an Iranian air force 747-100 near Madrid.

In that case, investigators believe lightning struck a wing, causing a fuel sensor to emit an electrical spark that ignited fuel vapors inside the wing.

An initial flash fire and explosion breached the wing skin above the engine and sent flames licking forward in the slip stream to consume a small section of the wing's front fiberglass edge.

Once breached, the Madrid jet's wing skin began peeling back, causing the wing frame to twist and bend. The buckling of the wing caused the outboard engine to begin oscillating wildly from side to side.

The engine snapped off leaving its fuse pins - fasteners designed to break if the aircraft pitched up or down too drastically - intact.

Flight 800's two right engines were found separated from the right wing, with the fuse pins from both engines still in tact on the right wing. The left engines were also recovered separated from the wing.

As the Madrid jet's wing disintegrated, thousands of gallons of jet fuel spilled into the air, creating a highly combustible cloud of fuel vapor, which fed and multiplied the original small explosion.

Officials have declined to say whether they are discussing the possibility of something akin to the Madrid disaster in the TWA 800 crash.

© 1996, The Seattle Times

By Byron Acohido

Nine rules proposed by the Federal Aviation Administration to make the flight controls of Boeing 737 jets safer do not include a key change sought by some pilots and federal safety-board officials.

That change would involve restricting the amount the rudder could move once the plane was airborne. It would eliminate the possibility of a sudden, acute rudder swing believed to have caused a United Airlines jet to twist into a fatal nosedive in Colorado Springs on March 3, 1991.

The similar crash of a USAir 737 descending routinely into Pittsburgh on Sept. 8, 1994, also involved a sudden, acute rudder deflection, investigators have said.

The rudder is the large, hinged panel on the 737's vertical tail, which controls the aircraft's left-to-right direction of travel.

Concerns about the rudders were raised in both crashes, although a final cause was never pinpointed.

The two crashes killed 157 people.

Last fall, pilots' representatives began discussing with National Transportation Safety Board investigators what it would take to require Boeing to restrict the rudder's range of motion, which would involve installing a mechanism called a limiter on the rudder's main power-control unit.

Then last January, NTSB investigator Greg Phillips drafted a lengthy proposal calling for a wide range of 737 safety measures, including installation of a rudder limiter on all 737s, said sources close to the Pittsburgh investigation.

Normally the safety board recommends measures to the FAA, which then drafts and enforces specific regulations. But the safety board has declined to issue Phillips' proposal as a formal safety recommendation.

Boeing opposes limiter

Boeing opposes installing a limiter on the 737's rudder, said Jean McGrew, Boeing's chief project engineer for the 737.

Even so, industry sources say FAA officials are now discussing the possibility of requiring Boeing to include a rudder limiter on the new series of 737-600s, 737-700s and 737-800s Boeing will begin delivering next year.

"We have studied that, along with other things as we go through the accident investigation. At this point, we do not see a need for that," McGrew said, noting that Boeing has been unable to find evidence that a rudder malfunction caused the Pittsburgh crash.

The FAA yesterday began calling for repetitive inspection and eventual upgrading of the 737's standby rudder power-control unit, long known to be prone to malfunctions. The agency proposed mandatory inspections for the standby PCU once before but withdrew the directive in 1994 after airlines protested.

The FAA also proposed ongoing inspection and eventual upgrading of a device called the yaw damper, which makes hundreds of small rudder adjustments during flight - and sometimes commands slight rudder deflections when none are needed.

The standby PCU and the yaw-damper directives are intended to fix malfunctions that can cause a 737 to swerve briefly off course, an occurrence pilots are trained to safely deal with, safety officials said.

A half-dozen of the FAA's directives involve making mandatory relatively minor systems changes Boeing has been recommending for years - upgrades which airlines voluntarily carry out.

Tom McSweeny, FAA director of aircraft-certification service, characterized the rule changes as "improvements to a system that we believe is a very good system. Many are fairly insignificant changes, but ones we think are prudent having looked at the airplane."

Boeing spokesman Russ Young said the company viewed the FAA's proposed directives as "product improvements." Boeing often challenges FAA directives, but in this case will make no objections during a 60-day comment period.

Some of the new requirements affect just 737-100s and 737-200s, while others cover newer 737-300s, 737-400s and 737-500s as well. There are 1,037 U.S.-registered 737s, which represents about a third of the worldwide fleet of 2,830 737s. Foreign regulators are expected to adopt the FAA directives.

$10,000-$5 million price tag

Estimated costs range from $10,000 to $5 million to accomplish the directives on the U.S. fleet, with deadlines ranging from 90 days to 18 months. USAir spokesman Paul Turk, said the airline, which operates 203 737s, "would comply fully and promptly" with any directives adapted by the FAA. Airlines typically request to extend or remove FAA-imposed deadlines made in connection with such directives.

The FAA's action is the latest government response to the crashes in Pittsburgh and Colorado Springs.

After the Colorado Springs crash, NTSB investigators gave serious consideration to a Boeing theory that a freak gust of wind caused the United 737-200 to flip nearly upside down and straight down into a city park from 1,000 feet.

As part of the Pittsburgh crash probe, investigators conducted a special $1 million fight test to explore a Boeing theory that wingtip turbulence from a jet flying 4.2 miles ahead of the USAir jet caused the 8-year-old 737-300 to flip over and careen 6,000 feet into a wooded ravine.

Since the Pittsburgh accident, pilots have reported more than 50 incidents of 737s swerving briefly off course because of rudder malfunctions, including a series of incidents last May and June on an Eastwind Airline 737 that led to a 22-day grounding of the jet.

© 1996, The Seattle Times

By Byron Acohido

The battery of far-reaching safety improvements for the Boeing 737 rudder unveiled yesterday by the National Transportation Safety Board was first drafted by safety officials in March 1995.

But the proposed safety measures did not surface publicly until 19 months later because Boeing argued they were unjustified, according to sources close to the safety board. If implemented, the measures could cost the company hundreds of millions of dollars.

Boeing continues to oppose many of the measures the board is considering to prevent inadvertent rudder movements from throwing a 737 out of control.

NTSB Chairman Jim Hall said the board will revise the safety measures, following the first public discussion of them yesterday. It will vote in two weeks on whether to ask the Federal Aviation Administration to make the changes mandatory.

If, in the end, the FAA does not approve such changes, the airlines and Boeing won't be required to make modifications.

Boeing spokesman Russ Young contended no safety concerns have emerged in the lengthy investigations into two as-yet unsolved 737 crashes or in a seven-month review of the 737's rudder completed by the FAA last year.

"We've seen nothing in the accident investigations, in the design review conducted by the FAA, or in the service history of the aircraft that would require anything this far-reaching," Young said.

Meanwhile, Boeing officials are expected to take protests directly to to safety-board members that they have been making to board investigators since the 1994 Pittsburgh crash, said sources close to the board.

Boeing chief 737 engineer Jean McGrew said the company will await the final recommendations on proposed rudder system upgrades. "We're not quite clear what the recommendations are going to look like, once the board is finished with them," McGrew said.

The safety board yesterday discussed calling for:

• Extensively redesigning rudder-system components to make them less prone to sudden, hard twists of the rudder, the vertical tail piece that controls the jet's left-to-right heading. Upgrades would be retrofitted on the entire fleet of 2,800 jets.

• Limiting the useful life of a crucial hydraulic part called the rudder power control unit (PCU). Dirty hydraulic fluid can jam the unit, resulting in hard rudder twists. The PCU was originally limited to 12,000 flights, but FAA rules were changed to allow "on condition" replacement, meaning airlines can use the unit indefinitely.

• Establishing new procedures and installing new cockpit instruments to alert pilots to sudden rudder swings.

• Training pilots how to right a plane suddenly thrown out of control by a hard rudder swing, especially at low altitudes when they may have only a few seconds to make precisely the right maneuvers.

• Tightening FAA criteria for certifying 737 rudders as safe.

The primary author of the NTSN's recommendations is Greg Phillips, the safety board's top rudder expert. Phillips has spent thousands of hours examining, testing and retesting rudder parts from the 1991 crash of a United Airlines 737 in Colorado Springs and a similar crash of a USAir 737 in Pittsburgh on Sept. 8, 1994.

Sources who work with Phillips, speaking on the condition of anonymity, said he began circulating and promoting much the same set of recommendations six months after the Pittsburgh crash, in March 1995.

A couple of months later, in May 1995, the FAA completed its special review of the 737's control system, underscoring many of the concerns about the rudder raised by Phillips.

Yesterday, Phillips said "ample time" had passed since the completion of the FAA study. "We need to spur those on and get these actions accomplished," Phillips told board member John Goglia.

The draft recommendations received support from relatives of some crash victims.

"Finally, I think these are major recommendations that are long, long overdue," said Gail Dunham, whose former husband, Capt. Hal Green, was killed in the Colorado Springs crash.

Dunham protested the safety board's August 1991 decision not to hold a public hearing on that crash and has tracked 737 rudder issues ever since. She flew from her home in Chicago to be in the audience yesterday.

Recent developments have added urgency to the proposed rudder upgrades.

Pilots are continuing to report 737 flights disrupted by unexpected rudder movements. Boeing's McGrew said Boeing has received reports of more than 20 such cases so far in 1996, continuing a trend of some 50 such cases reported between the Pittsburgh crash and the end of 1995.

Boeing contends most of these reports involve glitches in an automatic rudder control device, called the yaw damper, which can move the rudder only a few degrees.

But records show some jets have recurring problems that routine yaw-damper fixes don't eliminate. That was the case with the jet that crashed in Colorado Springs.

Then, last spring, an Eastwind Airline 737 had at least two mildly disrupted flights in the weeks prior to nearly crashing on June 9 near Richmond, Va. The pilot, Brian Bishop, saved the plane by instinctively using the kind of recovery maneuvers safety officials want to see mandated as training for 737 pilots.

Also pushing the need for rudder upgrades are the results of a recent testing of the PCU removed from the USAir jet that crashed in Pittsburgh. The tests were conducted in an independent lab by a panel of independent experts requested by the safety board's Hall. The results revealed the USAir jet's PCU could jam and cause a hard rudder swing to one side operating with dirty fluid under certain temperature conditions.

Boeing has challenged the expert panel's findings and will be allowed to retest the USAir jet's PCU, with Phillips' watching, at its laboratory in Renton next week.

"If we get different results, then we will have to understand why the results are different," said Boeing's McGrew, adding that additional testing could follow.

McGrew said a proposal is being considered to run the PCU removed from the Eastwind jet after it nearly crashed through Boeing's version of the dirty fluid/temperature test, as well.

© 1996, The Seattle Times

By Byron Acohido

A Boeing 737-200 was approaching Richmond, Va., on the calm night of June 9 this year when its pilot, Brian Bishop, and the 52 others aboard felt a thump.

The twin-engine jet owned by tiny Eastwind Airlines was descending through 4,000 feet at about 288 mph. No other aircraft were about. In the cockpit, Capt. Bishop started to say something to his co-pilot, Spencer Griffin. But he never finished his sentence.

Suddenly, the airplane's nose snapped sharply to the right and its right wing dropped. In the rear of the passenger cabin, lead flight attendant Carole McGee tumbled into a set of exit stairs, bruising her leg.

Uncommanded by the pilots, the 38-ton jet began a roll that jolted its passengers. It seemed headed, in a matter of seconds, into an unstoppable nose dive.

Bishop stomped on his left rudder pedal - "pushing as hard as I could," he said - to swing the nose left and back on course. The pedal would move only an inch.

His next moves were instinctive, the reactions of a seasoned pilot who had learned to fly as a teenager. Bishop spun the control wheel as far as it would go to the left, deploying wing panels, called ailerons, in an attempt to roll the plane left. Then he pushed on the right engine throttle, boosting thrust on the right wing.

For about 15 seconds, the jet flew frozen in a right bank, as though held in check by a mysterious force. Then, whatever was keeping the jet in that position let go. But before Bishop could back off the controls, the problem recurred. The jet swerved and banked to the right again.

After another harrowing 10 to 15 seconds of desperate maneuvering, the unseen force again relented. Bishop and Griffin, at once relieved and terrified, wondered what they would do if the lockup recurred as they continued descending into Richmond. If they began a dive and were unable to recover, Bishop calculated grimly, he might have enough control left to swerve away from where there might be people on the ground.

"I was looking out the window for dark spots in the woods..." he recalled. "If it happened again, I didn't want to go through somebody's neighborhood."

But the lockup did not recur, and Bishop put Flight 517 down for a safe landing in Richmond. As he slowed the jetliner to taxi speed, he glanced down. "My knees were literally shaking," he said.

HUNDREDS OF RUDDER INCIDENTS

Government air-safety officials suspect that what happened over Richmond in June was a phenomenon known as a "rudder hardover." That's when an airplane's rudder - the hinged tail panel that controls its left-to-right movement - swings suddenly and forcefully as far as it can go to one side.

It would not be the first instance of a tail rudder moving inadvertently on a Boeing 737, the most widely flown plane in the sky worldwide.

Statistically, the 737 has had a better than average safety record over its nearly three decades of service - 1.21 crashes per million flights for older models and 0.51 crashes per million flights for newer models. The figure for passenger jets of all types is 1.83 crashes per million flights.

The 737 rudder has been singled out before, however. Over the years, pilots around the world have filed hundreds of reports of 737 flights disrupted by uncommanded rudder movements.

Many safety experts believe the most extreme of such movements - an uncommanded hardover - is what caused two highly publicized and unsolved 737 crashes in the U.S. this decade. United Airlines Flight 585 dived from the sky into a park near Colorado Springs on March 3, 1991, killing 25 passengers and crew members. The plunge of USAir Flight 427 near Pittsburgh on Sept. 8, 1994, killed all 132 on board.

Since the Pittsburgh crash, there have been more than 70 reports of 737 flights briefly thrown off course in a manner that suggests rudder malfunctions.

CHANGE IN NEW MODELS ONLY

On Sept. 25 of this year, Boeing acknowledged making a design change in new models of its 737 to limit how far the rudder could move should an in-flight deflection begin. The change would not affect the thousands of 737s in service or the current models in production. Boeing said the change was for "technical," not safety, reasons.

Air-safety officials are familiar with evidence that the 737's rudder can move on its own, throwing the plane fatally out of control when there is too little time for a pilot to recover. Yet despite one safety agency urging changes to protect the flying public, it could be months or years before anything is done - if ever.

The safety agencies and the Seattle-based Boeing Co., builder of the 737, have demonstrated slow, piecemeal and grudging action since rudder questions first arose after the crash in Colorado Springs 512 years ago.

Boeing's resistance to changes in its widely used 737 delayed for 19 months the safety recommendations issued by the National Transportation Safety Board on Oct. 16. The 14 recommendations - now before the Federal Aviation Administration - include design changes to prevent uncommanded rudder hardovers, design changes which Boeing continues to oppose.

Boeing will be taking its case to the FAA, an agency charged with both protecting the safety of airline passengers and with promoting the U.S. airline industry. Historically, it can take the FAA years to adopt proposals opposed by airlines or aircraft manufacturers.

BARRIERS TO SWIFT ACTION

Just getting the 737 rudder-safety recommendations this far has been difficult because:

The transitory way the rudder works and the small size of the controlling mechanism make it hard to conclusively identify problems. Because the rudder is continually moving in small ways and returning to position, it is almost impossible for investigators to duplicate a single movement. Absent clear proof of a problem, the federal agencies are reluctant to take action.

The government's air-safety agencies rely almost totally on the airplane and parts manufacturers to investigate potential problems in their own products, and the agencies' decision-making historically has been weighted toward the financial interests of U.S. airlines and airplane manufacturers.

Boeing has aggressively defended its reputation as a manufacturer - in court, where the families of crash victims turn for redress, and in the accident-investigation process - to protect itself against the tremendous financial liability it could face if a defect were found to exist in the most widely used airplane it sells.

There is no way to gauge precisely how much a finding that the 737's rudder is defective would cost Boeing or the airlines that operate 737s. But aviation experts say proposed fleetwide design changes to limit the rudder's range and give pilots better cockpit instruments, plus proposed flight training to deal with hardovers, could run Boeing into the hundreds of millions of dollars. Airlines could lose many millions more in revenue should planes need to be pulled from service to make the upgrades.

Beyond that, lawyers for the families of victims in Colorado Springs and Pittsburgh are attempting to build a case that Boeing has been aware for some time of dangers posed by the rudder. If they are successful, the company could face hundreds of millions more in punitive damages.

BOEING HAS OTHER THEORIES

Boeing - the world's dominant aircraft builder, with a reputation for careful design - consistently has maintained there is no hard evidence linking a rudder malfunction to any 737 crash. Company engineers have proposed alternative theories for what might have caused the two unsolved 737 crashes.

In the Pittsburgh crash, Boeing has suggested one of the pilots suffered a seizure that locked his foot down on a rudder pedal, throwing the jet out of control. In the Colorado Springs crash, Boeing blames a freak gust of wind.

Although rudder hardovers were at the top of investigators' lists of suspected causes in Colorado Springs and Pittsburgh, analysis of crucial evidence, in almost all cases conducted by Boeing, proved inconclusive.

As a result, the federal investigation of the Colorado Springs crash ended without a finding, the investigation of the crash in Pittsburgh has bogged down badly, and lawsuits arising from both cases have remained stalled for years.

"A big part of the problem is most of the knowledge about how the airplane works resides up in Seattle," said C.O. Miller, a former National Transportation Safety Board investigator and an independent aviation consultant from Sedona, Ariz. "The NTSB allows itself to become fixated on finding a cause, and the FAA readily caves in to political pressures. Meanwhile, Boeing has one eye on litigation and nobody is paying attention to things that should be done to prevent the next accident."

More than 2,700 737s are in service around the world, and tens of thousands of airline passengers fly on them every day. And - though Boeing and the government move slowly and reluctantly - airlines and pilots are increasingly alert for trouble and have begun taking their own steps to prepare for it, including training pilots in how to recover from a tail-rudder deflection.

In this five-part series of articles, The Times examines the technical, regulatory and legal issues associated with the 737 rudder problem. These articles are the result of two years of research involving thousands of pages of federal records, airline reports, Boeing documents, legal briefs filed in accident cases, and interviews with dozens of industry sources.

Boeing and NTSB officials have declined to answer questions from The Seattle Times about issues raised by the 737 rudder-control problems. At times over the past two years, however, individuals from Boeing and the safety board have talked about aspects of the issues raised here; their remarks have been excerpted in these stories.

Still, Boeing has said almost nothing publicly in response to questions about the safety of the 737 or the company's role in crash investigations.

Asked by a shareholder in April whether the 737 is safe to fly, Phil Condit, the chief executive of Boeing, answered: "Absolutely. Positively."

THE CATCH-UP MODEL

To understand the questions dogging the 737 rudder, it is important to understand the history of the airplane.

Boeing was playing catch-up when it designed the 737. In the early 1960s, the Seattle company was close to overload working on the 747 jumbo jet, Apollo rockets and a supersonic transport. William M. Allen, then Boeing's president, had no enthusiasm for a smaller, short-hop jet.

But rival Douglas Aircraft was enjoying brisk sales of a new 100-seat jet, the DC-9. Boeing's board of directors, over Allen's objections, launched the 737 program in 1965, to go head to head against the Douglas twinjet.

Running two years behind the DC-9, Boeing designers needed a competing airplane fast. They shortened the fuselage of Boeing's three-engine 727 and came up with a prototype for the stubby, twin-engine 737. Borrowed was the 727's basic network of cables, pulleys and hydraulic systems used to control flight.

Where the 737's design departed sharply from the 727 was in its rudder.

The 727 used a rudder split into two sections. The 737 was built with a large, single-panel rudder. It needed such a big, powerful rudder mainly in case one of its two engines suddenly shut down during takeoff.

By moving the large rudder all the way to one side, the pilot could offset the asymmetrical thrust of the one good engine and keep the plane flying straight. Such an extreme movement of the rudder is known as a "hardover."

The problem comes if the rudder somehow swings, uncommanded by the pilot, to a hardover position with both engines operating. Such a rudder movement would swerve the jet sharply and snap it into a roll.

At low speed and low altitude, a rudder hardover could throw a 737 into a nose dive in a matter of seconds. Pilots might have only a few moments to recognize what was happening and make the proper recovery maneuvers.

NO LIMITER OR DOUBLE CONTROLS

Boeing designers considered the possibility of an uncommanded rudder hardover so remote in a 737 that they didn't install the level of safeguards used in other passenger aircraft.

The competing DC-9 also used a single-panel rudder, but Douglas designers equipped it with a device called a limiter, to prevent the rudder from moving more than a few degrees on its own once the plane was fully airborne.

Boeing's 727, which preceded the 737, did not have a rudder limiter. It relied instead on its split rudder: If half the rudder were to swing inadvertently, the other half could be used to counter it.

Later Boeing twinjets - the 757, the 767 and the 777 - employed single-panel rudders like that of the 737. But while the 737 essentially relies on a single control unit, the later Boeing jets use multiple control units that work together to move the rudder. Failure of any single control unit in these planes is offset by the proper operation of the others.

The 737 is the only Boeing plane that doesn't have a split rudder or multiple control units driving a single rudder.

The potential for rudder malfunction was among the many issues addressed by the Federal Aviation Administration as it certified the 737's design as safe for public use. The FAA requires an airplane to be designed so that no single system failure can result in a crash.

Boeing avoided having to meet this test regarding uncommanded rudder hardovers by submitting analysis demonstrating that the odds of such a thing occurring during the service life of a 737 were one in a billion, a virtual impossibility. The agency certified the 737 in 1967, two years after company directors initiated work on the new model.

SIGNS OF TROUBLE AROSE EARLY

But signs of trouble arose almost from the start.

By the late 1960s, pilots had begun reporting rogue movements of the rudder. Mysterious deflections of varying magnitude, uncommanded by pilots, had disrupted several 737 flights. No independent source kept track of the numbers.

In a 737 simulator, a pilot demonstrates an uncommanded rudder hardover to the left, during approach to a runway. On the screen, the runway is sideways: The jet is flying with its left wing pointing almost straight down. Attempting to recover control, the pilot has turned the control wheel right to shift wing-control surfaces, has depressed the right rudder pedal and has increased the thrust to his left engine.

Suspicion fell on an automatic rudder-adjustment mechanism, called the yaw damper, designed to track the aircraft's position as it moves through the air and to make small adjustments (hundreds during a typical flight) to "dampen" the plane's tendency to oscillate. The yaw damper receives electrical signals and translates them into movements inside the rudder's hydraulic control system, called the power-control unit, or PCU. See graphic at right.

In a June 18, 1969, service memo to airlines, W.H. Schuling, then Boeing's vice president of maintenance and engineering, cited "several yaw damper problems .... experienced on 737 airplanes" and blamed them on a faulty electrical connector.

Yaw-damper glitches would endure through the next three decades as Boeing's explanation for hundreds of rogue rudder incidents.

Problems with the yaw damper were not considered a flight-safety issue. Company officials reasoned - and federal authorities agreed - that since the yaw damper was limited to adjusting the rudder only a few degrees in either direction, pilots had plenty of time to safely react to any errant yaw-damper commands.

Yet pilots kept reporting problems that appeared to contradict this reasoning. In 1971, Frontier Airlines reported two flights in which unexpected rudder movements resulted in "serious control problems." The airline advised its pilots to switch off the yaw damper for landings and takeoffs, times when the airplane had little room to maneuver.

In 1973, one Frontier 737 suddenly veered off course and dived from cruising altitude on two separate flights, over North Dakota and South Dakota. In each case, the pilots quickly regained control of the plane but flight attendants were injured. The yaw damper was blamed and improvements made.

FLAWS NOT USUALLY PINPOINTED

But rudder incidents persisted. Over the past three decades, pilots have filed hundreds of reports with their airlines of 737s swerving off course as if the rudder had moved on its own.

Federal records show that the yaw damper frequently was singled out and blamed, even though the standard operating procedure of mechanics didn't call for narrowing the cause of the problem to a specific part. Instead, mechanics typically would replace several components - the main rudder PCU, the autopilot computer and other parts, along with suspect yaw-damper parts - to assure the plane would pass the tests needed to get it back in the air as soon as possible.

But despite the hundreds of pilot reports over the years, there is even today little centralized compiling of such information.

Authorities admit the system for reporting and preventing emerging safety hazards is far from perfect. Addressing an international gathering of aviation safety experts in Seattle last fall, FAA Administrator David Hinson acknowledged that air-safety regulation suffers from a weak system for gathering information and analyzing it for dangerous patterns.

"We do not have access to extensive operations feedback," Hinson told the safety experts. "If you imagine everything that goes on every day .... and everybody that's involved in the safety equation, we don't know what's going on, and you don't either."

SEVERAL WAYS TO FAIL

A number of things about the 737 rudder have been learned since the 1960s, however. Analyses and lab tests have long confirmed several ways the 737's rudder can deflect on its own, then return to a neutral position, leaving no trace of a malfunction.

Most often, such moves are inconsequential, causing the airplane to swerve briefly off course. But on scores of occasions, such as the Frontier jet's flights over the Dakotas, pilots reporting sudden, sharp rudder swings have had to scramble to regain control of their aircraft.

Still, the numerous rogue rudder incidents 737 pilots reported in the 1970s and 1980s were by and large dismissed as minor nuisances, probably caused by yaw-damper glitches.

No one was yet aware that tiny disorders inside the rudder power-control unit could cause a full range of uncommanded deflections - from the rudder "creeping" slightly, all the way to a hardover.

It would take four spectacular crashes and an alert United pilot catching a PCU defect on the ground to focus concern on malfunctions of the power-control unit.

© 1996, The Seattle Times

By Byron Acohido

The first real clues that Boeing's 737 might have a dangerous defect in its rudder-control system came from a 1991 crash in Colorado Springs.

The 737-200, built in Renton in 1982, started out as part of Frontier Airline's fleet. Four years later, Frontier sold the plane to United and it was assigned tail number N999UA.

On a Feb. 25, 1991, flight, N999UA's rudder deflected inexplicably to the right. The problem went away when the pilots switched off the yaw damper, a device that automatically commands small rudder adjustments during flight. Mechanics replaced a part called the yaw-damper coupler and returned the plane to service.

Two days later, a different flight crew reported N999UA's rudder again moving to the right. The new coupler evidently had made no difference. This time mechanics replaced a valve in the yaw damper and returned the plane to service.

Four days later, on the blustery morning of March 3, 1991, Captain Harold Green and First Officer Patricia Eidson were bringing N999UA down for a routine landing in Colorado Springs. At 1,000 feet, the jet suddenly flipped to the right and dived straight down, smashing into a city park and killing all 25 on board.

The pilot of a Cessna flying near the airport called the tower with a bird's-eye account: "We just saw the plane .... uh just suddenly a complete downward dive."

From the control tower, air-traffic controller Kevin Ford reported from another perspective: "It looked like a dropped pencil going straight down."

It didn't take long for errant rudder movement to surface as a possible cause of the crash. Witness reports and readings from the plane's flight-data recorder confirmed that the 737 had traced a classic aerobatic maneuver, known as a "split-S," into the ground. See graphic at left.

A split-S results from radically altering the symmetry of flight. Such a quick or severe change would be consistent with the right engine or right wing falling off, but that had not happened. The pilots could have moved the rudder to the extreme right, but to do so within 1,000 feet of the ground would be suicidal. The other possibility was that the rudder had moved on its own.

Investigators with the National Transportation Safety Board were unfamiliar with the intricacies of the plane's rudder-control system when they arrived in Colorado Springs to comb through N999UA's wreckage.

The NTSB examines 2,100 aviation accidents a year nationwide, as well as trucking, rail, pipeline and marine accidents. Its staff of 90 full-time investigators and 260 support personnel has an annual budget of $35 million. (By comparison, the Seattle Police Department has 1,269 officers and an annual budget of $117 million.)

While safety board investigators pride themselves on objectivity and scientific certainty, they rely almost exclusively on the parties they are investigating - aircraft manufacturers, suppliers and airlines - for the technical expertise needed to solve airplane crashes. The post-crash handling, testing and analysis of complex airplane parts - typically retrieved scorched or crushed - are routinely assigned to the aircraft builder and its suppliers.

Among the NTSB investigators assigned to the Colorado Springs case was Greg Phillips. His task: to assess what role, if any, the rudder played in the 737's crash. Phillips would work with experts from Boeing and Parker Bertea Aerospace, the Irvine, Calif., company that manufactures all 737 rudder power-control units, as well as representatives from United Airlines and the Air Line Pilots Association.

The burned and mangled rudder parts were retrieved from what remained of the plane's tail section and taken to United's maintenance center in San Francisco. Phillips was joined there by John Calvin, an engineer from Boeing's quality assurance lab, and Wally Walz, a senior engineer from Parker Bertea, among others.

They examined the yaw damper, but it had been crushed to about one-tenth of its original size by the crash impact and was useless for testing. That left the rudder's power-control unit, or PCU. It was severely burned, its main rod bent, its internal parts frozen.

When they dismantled the PCU, investigators noted a white, powdery substance on the internal components of the yaw damper, and tiny drops of water, bubbles and stringy chips of bronze in PCU cavities.

Then, investigators focused on a mechanism about the size of a soft-drink can which is at the heart of the PCU. Called the dual servo valve, it consists of a cylindrical metal slide about the size of a cigarette, which is positioned inside a slightly larger slide. The servo slides work together to direct the proper flow of pressurized hydraulic fluid used to move the rudder. See graphics on page at right.

The investigators found the servo's slides severely jammed and pounded them apart with a hammer.

It is crucial to keep even minute debris out of the servo valve because the spaces separating the slides from each other and from their housing wall are no more than 5 microns, a gap invisible to the human eye.

Contaminants could jam the slides or clog a valve opening, sending hydraulic fluid flowing in the wrong sequence and inadvertently moving the rudder.

However, the investigators didn't think the debris was important because the PCU's filtering system was thought to prevent anything dangerous from getting into the device and because they "hadn't seen any service history" indicating a problem of contaminants in PCUs, the safety board's Phillips said in an interview in August 1995.

As a result, they didn't try to identify the contaminants, determine how they got into the PCU or assess what jamming effect, if any, they might have produced.

"I can't say at the time there was a high level of concern about particulates in the fluid," Phillips said.

Later, there would be.

The investigators gathered on the morning of March 21, 1991, at United's San Francisco base to discuss taking the dismantled servo valve to Parker Bertea's plant in Irvine for further testing. That was because United didn't have the equipment to extensively test the servo's slides.

Walz, of Parker Bertea, was assigned to hand-carry the servo valve to Irvine. John Calvin, the quality-control engineer from Boeing, instructed an assistant to pack up the parts. According to court records, the assistant left the room and returned with a taped package, which he handed to Walz, who carried it on a flight to Southern California.

When Walz opened the package that afternoon at the Parker Bertea plant, he discovered that three servo-valve parts were missing: a spring, spring guide and end cap.

Boeing, citing ongoing litigation, has never explained why those three parts were left out of the package forwarded to Irvine.

Together, the three missing parts play a crucial role in the delicate sequence of channeling just the right amount of pressurized hydraulic fluid, at just the right moment, to move the rudder in the direction and to the degree the pilot or the automatic yaw damper has commanded. When precisely positioned inside the servo-valve housing, the spring, spring guide and end cap serve as an internal stop, preventing the outer slide from moving too far within the housing.

It would be another 18 months before investigators would discover that too much movement of the outer slide could be dangerous.

Part polished, then tested

As far as Phillips knew at the time, the three parts which John Calvin's helper failed to pack in San Francisco were inconsequential. Phillips concurred with a group decision to proceed with testing of the servo using a new spring, spring guide and end cap taken from Parker Bertea's stockroom.

"We agreed that we could test with other hardware and get valid data," Walz said in a court deposition last year in a lawsuit filed by the families of Colorado Springs victims.

Before reassembling the inner and outer slides, investigators used a power tool to smooth the servo valve's interior housing walls and the exterior of the outer slide, creating like-new surfaces.

This practice - the restoring of damaged parts to working condition before testing them and then absolving them of contributing to a crash - continues to be accepted procedure in National Transportation Safety Board investigations.

The polished inner and outer slides were placed back inside the servo-valve housing, along with the new spring, spring guide and end cap. Phillips and other NTSB investigators then watched as Parker Bertea engineers tested the United jet's servo valve, now reassembled with many new or refurbished parts.

The servo valve failed to transfer fluid and maintain pressure according to specifications, but the investigators agreed it worked well enough to conclude there was no evidence it contributed to the crash.

Boeing's theory: A freak wind

With the PCU now largely absolved of blame, the focus of the probe shifted away from the rudder. Boeing offered the theory that a freak gust of wind, bouncing like a horizontal tornado off the nearby Rocky Mountain foothills, flipped the jetliner into a split-S dive.

Boeing produced reams of data and a computer simulation to show how a sideways-swirling "wind rotor" could have caused the crash.

Some investigators expressed doubt about Boeing's theory, saying it would take incredible strength for wind to pull a 38-ton airplane into a split-S fall. For Boeing's theory to make sense, the rotor would have had to hit the aircraft head on and then turn earthward at just the right moment to drive it into the ground.

Nothing in aviation history suggested such a phenomenon was possible.

A crash in Panama, an alert pilot in Chicago

As the Colorado Springs probe continued, two developments shifted interest back to the 737's rudder controls.

On June 6, 1992, a Copa Airlines 737 was cruising high over Central America when it suddenly flipped and crashed in a jungle in Panama, killing all 47 on board. At the invitation of Panamanian authorities, Phillips and another NTSB investigator, Tom Haueter, traveled to Panama to lead the investigation.

Haueter and Phillips, assisted by experts from Boeing and its suppliers, deduced that a frayed wire in a cockpit instrument most likely contributed to pilot error causing the crash. But their findings weren't conclusive, and suspicion remained that an errant rudder movement may have caused the plane to flip.

Then, in August 1992, an anonymous caller alerted the NTSB that United had made a troubling discovery while testing a rudder PCU removed from a 737 jetliner in Chicago a month earlier.

On July 16, United Captain Mack Moore hadn't liked the way his 737 rudder pedals were behaving during a routine pre-takeoff systems check at O'Hare International Airport. The right pedal seemed stiffer than usual and Moore could push the left one only about a quarter of the way to the floor.

United removed the PCU from Moore's jet, ferried it to the airline's maintenance center in San Francisco and began experimenting with it. There, sources say, a mechanic discovered that he could trigger a specific kind of rudder malfunction, called a reversal, by putting the spring, spring guide and end cap slightly out of adjustment. See graphic at left.

The mechanic established that a PCU could receive a command to move the rudder left - yet move the rudder instead to the extreme right. The reversal happened if the spring, spring guide and end cap were not in the precise alignment needed to prevent the outer slide from moving too far.

Probe is taken to new level

When the safety board's Phillips and his supervisor, Bud Laynor, director of the agency's office of air safety, learned about United's finding, they recalled the Colorado Springs investigation: The Boeing engineer's assistant had failed to pack the spring, spring guide and end cap with the other Colorado Springs PCU parts heading for more tests.

"That's when we got real smart," Phillips said.

The federal investigators called for a summit meeting of everyone involved in the rudder-control investigation. The power-control units from the jets that crashed in Panama and Colorado Springs were to be brought to Boeing's labs in Seattle to be tested alongside the unit pulled from Mack Moore's plane in Chicago.

By then, though, the springs, spring guides and end caps from the United and Copa jets had long since been disassembled and reassembled, eliminating evidence of how the parts were aligned as each crash occurred.

Nonetheless, the safety board's Laynor says he insisted that the original spring, spring guide and end cap from the 737 that crashed in Colorado Springs be found and restored to the PCU for the summit tests. When the parts were presented for testing, Laynor said he recognized the end cap as having burn marks similar to those he remembered seeing in San Francisco, but he couldn't say for sure whether the spring and spring guide were from the Colorado Springs jet.

In a separate interview in August 1995, Boeing spokesman Steve Thieme said Boeing was "absolutely positive" they were all the original parts.

Investigation: unsolved

The summit tests took place in Boeing's Seattle labs in September 1992. The power-control units worked well enough that investigators agreed they could find no conclusive evidence of a rudder reversal as the cause of the Colorado Springs or Panama crash.

Not long after the Seattle tests, the NTSB convened a closed-door meeting at which the investigators made their final arguments for a probable cause in the Colorado Springs crash. The pilots' group and United pointed to the circumstantial evidence that the PCU must have somehow malfunctioned. Boeing urged the board to accept its wind-rotor theory.

In the end, the five-member board ruled it "could not identify conclusive evidence to explain" the crash. It suspended in a quandary what was to that date the most extensive air-crash investigation in its 28-year history.

But it wasn't the end of the safety board's concern raised by the so-called "Mack Moore incident" - when it was discovered that a 737 PCU could produce rudder movement opposite of a command from the pilot or yaw damper.

Acting on a safety board recommendation, the Federal Aviation Administration in March 1994 ordered airlines to replace the spring, spring guide and end cap in all 737 power-control units with parts re-engineered to assure proper alignment and engraved with serial numbers to help keep track of them. Airlines were given until March 1999 to make the changes, as long as they inspected the PCU every few months.

Kenneth Usui, the Boeing manager of airworthiness for the Renton division where the 737 is made, protested. In a letter to the FAA, Usui said that regular inspections were unnecessary and that airlines should be given seven years to make the upgrade.

British agency says Boeing knew of servo problem

Boeing maintains that, like the rest of the industry, it took the Mack Moore incident for the company to learn that the PCU could reverse itself. Some investigators, however, were skeptical.

A January 1995 report by the British Air Accidents Investigation Branch buttressed the belief of some investigators that Boeing had known about the rudder-control problem for years.

The agency, the British equivalent of the NTSB, had investigated why an elevator - a part on the horizontal tail section - had reversed momentarily on a British Airways 747-400 and pitched its nose down as it was climbing out of London.

The British agency blamed the 747 elevator reversal on the jamming of a servo valve similar to the one used in 737 rudders. Its report notes that, in the course of its investigation, Boeing informed the British agency that it had known about the servo's capacity to reverse since the mid-1970s.

From the Colorado Springs accident through the end of 1993, as safety officials hashed out improvements for the PCU, 11 more 737s crashed around the world. They included the accident in Panama as well as landing-approach crashes in China, Korea and India. The accidents drew scant public attention.

Rudder clues in India crash

Then on March 8, 1994, a Sahara India Airlines 737 flipped onto the runway at New Delhi Airport, killing nine people. Records indicate a rudder malfunction was immediately suspected.

Federal records show an NTSB investigator on the Colorado Springs crash and Boeing and Parker Bertea engineers were asked to examine the New Delhi airplane's rudder systems. Among those from Boeing was John Purvis, the company's director of air-safety investigations.

The accident happened as a veteran Sahara India 737 pilot was supervising touch-and-go landings with three pilot trainees in clear weather. With one of the trainees at the controls, the aircraft touched down, rolled along the runway and took off again, reaching an altitude of 400 feet.

Suddenly, the jet veered left and slammed back to earth near the airport's international terminal. Flaming parts skidded into a nearby Russian jet, setting it on fire. The four Sahara pilots, as well as five ground workers servicing the Russian plane, were killed.

Indian aviation authorities blamed the crash on pilot error. Yet there also was evidence suggesting the airplane's rudder had reversed to the left when the pilot had correctly commanded it to move right. In examining the plane's PCU, the American experts discovered its serial number had been removed and replaced with a number that was not familiar to Boeing or Parker Bertea. The unit evidently had been worked on by an unauthorized repair shop and assigned a bogus number.

Upon disassembling the PCU servo valve and checking the internal components, investigators also found that the spring guide had been machined to the wrong size and was similarly stamped with a bogus part number. Investigators reassembled the PCU with the improperly machined spring guide and ran it through lab tests. They found that, under certain conditions, the PCU reversed both to the left and to the right.

The reversals occurred when the inner slide jammed inside the outer slide as the pilot rapidly depressed a rudder pedal. The lab tests showed the outer slide would then move too far, directing fluid in a sequence that reversed the rudder.

Boeing's stand challenged

Boeing's Purvis took the position that only debris large enough and hard enough to leave marks could jam the servo slides. Since no scratches or nicks were found on the New Delhi jet's slides, he said jamming and rudder reversal couldn't have caused the crash.

But independent hydraulics experts say jamming can take place in servo valves without leaving any marks.

"There are a lot of different ways a valve can jam," said William Needleman, associate director of science and lab services at Pall Corp., a filter manufacturer. Numerous tests in industrial settings show soft particles, such as dirt, can jam valves temporarily. "When you unjam it and open the valve up, a lot of the contaminant washes away," Needleman said.

Nightmare over Honduras

A month after the New Delhi crash, there was another incident that focused attention on the 737's rudder.

On April 11, 1994, Captain Ray Miller was cruising a 7-year-old Continental Airlines 737-300 in clear, calm skies over Honduras when he heard a muffled thump. In the same instant, Miller felt the aircraft suddenly twist and roll violently to the right.

Miller disengaged the autopilot and turned the control wheel sharply to the left, holding it firm against stiff resistance. This deployed wing panels, called ailerons, to roll the plane left and thus counter the mysterious, insistent pull to the right.

"Our location was still well out over the water. I recognized that there was a very real possibility ...that we just might lose total control of this thing and end up in the Gulf of Honduras," Miller reported afterward.

For the next 18 minutes, Miller and his co-pilot struggled to keep the jet from rolling over to the right. The pilots guessed that a piece of tail or fuselage had fallen or blown off, creating an unbalanced aircraft.

Whatever was happening, Miller was grateful it began at 37,000 feet. Fighting to control the jet as it descended, Miller had time to run through problem checklists and discuss with his co-pilot the best way to land the aircraft.

Had the problem started at a lower altitude and slower air speed, Miller reported, the flight would have been "non-survivable... due to the alarming and violent nature of the event, and the very confusing control responses and clues as to what is happening."

So concerned was Miller that he began broadcasting a description of his situation to any aircraft nearby that might be listening "because if they had to get the recorders out of the water someone needed to know what happened."

Miller and his co-pilot decided they needed to fly the jet much faster than normal to execute a safe landing. A higher landing speed would keep more air flowing over the wings, making the ailerons more effective in controlling the jet's tendency to roll to the right, they deduced.

The strategy worked. Miller brought the jet down safely. Once the 737 came to a stop, Miller hurried outside to inspect the aircraft. To his surprise, he found the plane's exterior parts in perfect order. Continental mechanics immediately removed the flight-data recorder, the yaw damper, the PCU and other parts, handing them over to Boeing for analysis.

Boeing disputes account

Records show Boeing concluded that hydraulic fluid had leaked from the PCU onto the yaw-damper signaling component, creating an open electrical circuit that inadvertently moved the rudder 2.5 degrees to the left. Such a deflection should have caused the jet to veer only slightly off course, something easily controllable by the pilots. Moreover, Boeing said the problem could not have lasted more than 110 seconds.

Those findings contradicted Miller's 9,500-word written statement, which detailed the steps he had to take for 18 minutes to keep the aircraft from veering out of control. Miller had squeezed the control wheel so hard that he injured his left hand.

After reviewing Boeing's findings and the pilot's report, the NTSB and FAA took no action.

Miller filed a follow-up report with his superiors, complaining that authorities didn't seem to be taking him seriously:

"I have been told by my company ...that the FAA and Boeing (were) aware of the problems with the spurious rudder inputs but considered them to be more of a nuisance problem than a flight safety issue. I was informed, that so far as everyone was concerned, the rudder hard.overs were a problem but that the `industry' felt the losses would be in the acceptable range.

"I was being mollified into thinking the incident did not happen, and for the 'greater good' it would be best not to pursue the matter. In other words I am expendable as are the passengers I am responsible for, because for liability reasons the FAA, Boeing et al cannot retroactively redesign the rudder mechanisms to improve their reliability."

© 1996, The Seattle Times

By Byron Acohido

It was a clear, windless autumn evening as USAir Flight 427 prepared to land in Pittsburgh. The flight, a sellout, had originated in Chicago and was scheduled to travel on to Philadelphia.

At the controls of the 8-year-old Boeing 737-300 on Sept. 8, 1994, were Capt. Peter Germano and First Officer Charles Emmett III. Between them, they had logged more than 6,900 hours flying 737s. Their plane had been regularly serviced, including a maintenance check a month earlier during which its rudder system was inspected.

As the flight attendants prepared the passengers for arrival, Germano and Emmett ran through the landing checklist and took instructions from the control tower. Air-traffic controller Richard Fuga instructed them to descend to 6,000 feet and slow to 190 knots (218.5 mph). Germano complied.

As it continued descending, Flight 427 flew into some air turbulence trailing off the wingtips of a Delta 727 flying four miles ahead. The jostling, reflected by a momentary jump in airspeed, appeared to be routine, posing no threat. But it caught the pilots off guard.

"Sheez," said Germano.

"Zuh," said Emmett.

A series of unidentified sounds were then captured by the cockpit recorder. Thump. Clickety-click. Pssssssst. Thump.

That's the moment investigators believe Flight 427's rudder moved suddenly to its extreme left - a movement known as a "hardover," which is not supposed to happen while a 737 is in the air - and locked in that position.

The next 24 seconds were captured by the cockpit voice recorder.

The jet peeled off to the left, like a fighter plane in a World War II movie. Then it rolled upside down and began falling out of the sky, nose pointed almost straight down.

"Whoa," exclaimed Germano. Clickety click. "Hang on."

The engines whined as the jet accelerated from 190 knots to 260 knots - nearly 300 miles per hour.

Emmett grunted.

"Hang on," Germano said again. A wailing horn warned that the autopilot had disconnected. "Hang on."

"Oh (expletive)," exclaimed Emmett.

"Hang on," Germano shouted. Some investigators believe that, at this point, Germano cranked his control wheel as hard as he could to the right, deploying wing ailerons in an attempt to counter the roll. When that proved fruitless, he exclaimed: "What the hell is this?"

The control yoke began shaking, warning the pilots that the wings were about to lose all lift. An altitude warning tone sounded.

With 12.9 seconds left, the following exchange took place:

Germano: "What the . . ."

Emmett: "Oh."'

Germano: "Oh God, oh God."

Emmett: "(expletive)."

Germano: "Pull."

The pilots yanked back on the control yoke in an attempt to raise the nose.

Emmett: "Oh (expletive)."

Germano: "Pull. Pull."

Emmett: "God."

Germano screamed.

Emmett: "No."

Plummeting at 300 mph, Flight 427 sliced into a wooded ravine and exploded in a huge fireball. In an instant, the gleaming, 50-ton jetliner, carrying 132 people, shattered into hundreds of thousands of smoldering pieces.

The crashes of 737s in Colorado Springs, Panama and New Delhi, and a near-crash in Honduras, had given experts from the National Transportation Safety Board and from Boeing a chance to increase their understanding of the ways a 737 rudder could misbehave.

Many of these same investigators arrived in Pittsburgh the morning after the Sept. 8, 1994, crash. They were led by Tom Haueter and Greg Phillips, the safety board investigators who worked together on the 737 crashes in Panama and Colorado Springs.

In the Pittsburgh crash, there was no reason to suspect weather as a factor. That left the pilots and the airplane. Each would undergo intense scrutiny. First would be the plane.

Because eyewitness accounts, supported by radar data, depicted the jet twisting, then dropping straight down, a rudder hardover was immediately suspected.

Records show Phillips made it clear right from the start that he would impose stricter evidence-handling rules than he had during the futile probe of the 1991 Colorado Springs crash. He directed the meticulous removal of the rudder's control mechanism (called a power-control unit, or PCU) from the wreckage, making sure its hydraulic lines were capped to preserve the general positioning of key parts, as well as its fluid.

The PCU was stored for several days at a USAir hangar in Pittsburgh before being shipped to Boeing labs in Seattle. Because key parts had disappeared during the shipment of the PCU recovered from the Colorado Springs crash, Phillips insisted on chain-of-custody procedures documenting the handling of all the PCU parts. He even carried two small parts by hand to Seattle.

On Sept. 19, Phillips convened 20 investigators at Boeing's lab in Seattle, safety board records show. Half of them were Boeing engineers, and the rest represented Parker Bertea (the PCU's manufacturer), USAir, the Federal Aviation Administration and the Air Line Pilots Association.

Among the first things they found was that USAir had not yet upgraded the PCU servo valve's spring, spring guide and end cap on the ill-fated jet. Months earlier, in March, the FAA had ordered airlines to upgrade those parts to help prevent 737 rudders from reversing a routine command. USAir still had more than four years to meet the FAA's deadline.

The improved parts were designed to ensure the spring, spring guide and end cap always stayed in precise alignment. Investigators found the USAir jet's parts, though not yet upgraded, were adjusted "within acceptable limits."

The PCU then was shipped to Parker Bertea's lab in Irvine, Calif., where the investigators reconvened Sept. 21 for further analysis. This time all the parts showed up.

The hydraulic fluid filters were removed and drained and the PCU hung upside down to drain the rest of the fluid from the main cavity. The bent piston rod was removed and the cavity examined. No signs of abnormal wear were found inside the PCU.

A cover plate was then removed. Floating in the remaining hydraulic fluid and easily visible to the naked eye were small, shiny, metallic particles - flakes of aluminum-nickel-bronze, a material commonly used in bearings. Samples were taken, first with a syringe and then by pouring out the last of the contaminated fluid into a container.

A fixed-up PCU passes test

The investigators determined there was no way to test the PCU because all of the part's external levers, nuts and bolts were mangled. So, along with the bent piston, all the external parts were removed and replaced with new parts. The PCU was cleaned and injected with fresh hydraulic fluid. Only then was the unit tested.

It functioned normally.

Next, Boeing and Parker engineers ran a test to see if they could make the PCU reverse. They could not.

On Sept. 23, two weeks after the crash, Phillips signed a report concluding the Irvine tests had "validated" that the PCU was "capable of performing its intended functions" and was "incapable of rudder reversal or movement."

Phillips' finding was a victory for Boeing. If it held up, it could clear the airplane of responsibility for the crash and greatly lessen or eliminate any financial liability for Boeing.

Hydraulic fluid highly contaminated

Safety measures are drafted

Despite his public statements indicating a lack of evidence of any specific rudder-control problem having caused the Pittsburgh crash, Phillips remained concerned. In March 1995, Phillips drafted a detailed list of proposed 737 rudder-related safety measures.

Phillips called for pilots to be alerted to the possibility of rudder hardovers and trained in special recovery maneuvers. He advocated redesigning the 737 rudder to drastically limit its range of movement during most phases of flight.

Phillips' proposals became the focus of heated debate between Boeing and the NTSB for the next 19 months. The debate took place outside the public view.

Phillips' list eventually grew to include mandatory, periodic hydraulic fluid sampling and a limit on the number of flights a PCU could be used before it had to be replaced or overhauled. He also suggested far-reaching improvements for the yaw damper and called for fitting all 737 cockpits with an instrument that would tell pilots the position of the rudder at all times.

Special panel asks: Was the crew at fault?

Meanwhile, Boeing had begun a campaign to blame the Pittsburgh accident on pilots Germano and Emmett. At a March 1995 NTSB meeting in Washington, D.C., Boeing presented a thick packet of documents loosely linking cases of pilot error over several decades to the Pittsburgh crash. The material included excerpts from dozens of psychological case studies about why pilots make mistakes.

At Boeing's request, the safety board created a special "human performance" committee to focus on the possibility that Germano or Emmett caused the crash. The committee was chaired by Dr. Malcolm Brenner, the National Transportation Safety Board's psychologist, and included a Boeing test pilot, Michael Carriker; a Boeing psychologist, Dr. Curtis Graeber; three USAir pilots and two representatives from the FAA.

In a series of meetings over several months, a debate unfolded as Carriker and Graeber made the case that one of the pilots must have stepped on the left rudder pedal and kept it depressed until it was too late to recover.

Graeber cited the case of a helicopter pilot who occasionally made the mistake of depressing his left foot pedal, instead of the right pedal, to turn right. Graeber said that was because, under stress, the pilot reverted to a familiar childhood memory: snow sledding. As a boy, he had steered his favorite snow sled by pushing his left leg forward to veer to the right.

Perhaps, Graeber argued, one of the USAir pilots made a similar mistake while trying to adjust for what should have been a routine encounter with wingtip turbulence from a jet flying well ahead.

Carriker and Graeber also suggested that one of the pilots may have depressed the rudder pedal as the result of a seizure, pointing to a 1980 incident involving a Frontier Airlines 737. In that instance, a co-pilot suffered a seizure, shoved the rudder pedal to the floor and nearly caused the plane to crash during landing.

TSB won't release paper

The USAir pilots vehemently disputed Boeing's assertions.

In late January 1996, Carriker and Graeber distributed a 25-page position paper to the other panel members laying out Boeing's argument for why the airplane couldn't be blamed and why the pilots probably caused the Pittsburgh crash.

"They tried to attach it to the human factors group's factual report, but everybody raised so much hell, they withdrew it. It was so outrageous," said a source close to the special panel.

A week after distributing the report, Boeing asked the panel members to return or destroy all copies, sources said. The safety board denied a Seattle Times Freedom of Information Act request for that document on grounds it was preliminary, deliberative material not required to be released publicly.

Not surprisingly, word that Boeing was trying to persuade the NTSB to blame the crew did not sit well with many pilots. And it infuriated Chris Germano, the widow of Flight 427's pilot.

"My husband was a very careful, very meticulous pilot. He paid a lot of attention to his skills and he was physically ready to do his job," she said. "I have to deal with the fact that my husband's trust was violated. He walked on that airplane knowing that he was capable of doing his job and his plane wasn't up to it."

The NTSB committee so far has issued no finding on the role of the pilots.

Telling testimony from two engineers

With Boeing trying to blame the pilots and Phillips pushing to make 737s safer, two attorneys representing families of some Colorado Springs crash victims produced testimony that increased concern about the jets' rudder-control system.

The testimony came in depositions of Steve Weik and Shihyung Sheng, two of the Parker Bertea engineers involved in the investigations of the Colorado Springs and Pittsburgh crashes.

Weik and Sheng each unequivocally confirmed that any command to move the rudder slightly could result in a hardover in the direction commanded if both the PCU servo valve's inner and outer slides happened to jam simultaneously. Weik testified that this design characteristic was known "from day one" by both Boeing, which designed the PCU, and Parker Bertea, which built it.

Hydraulics experts consider such a dual jam to be highly unlikely. Nevertheless, Weik's and Sheng's disclosure meant an inadvertent rudder hardover theoretically was possible anytime a pilot depressed a rudder pedal or the yaw damper issued a signal to adjust the rudder - a command issued almost moment-to-moment on an average flight.

It also meant that a servo valve modified according to the FAA's upgrade order to prevent rudder reversals could still be dangerous. A properly adjusted spring, spring guide and end cap could prevent a rudder reversal - but could do nothing to stop hardovers in the direction commanded, caused by a dual jam. See graphic on previous page.

Boeing says jam 'improbable'

In May 1995, the FAA completed a seven-month special review of the 737's control system and underscored the concern over dual-jam hardovers. The FAA's study pointed out that since the outer slide is rarely asked to move, it theoretically could jam - and remain stuck for some time - without pilots or mechanics noticing.

Under that circumstance, the 737 would be a single failure away from disaster: If the inner slide jammed with the outer slide already stuck, the result would be a sustained rudder hardover.

The FAA asked Boeing to assess the probability of such a thing happening in flight. Boeing produced not one but three reports, which the company submitted to the FAA sometime before August 1996.

According to Tom McSweeny, the FAA director of aircraft certification, the Boeing reports reconfirm what the company has asserted all along: that most rudder problems are controllable by the pilot and that rudder hardovers are "extremely improbable."

However, McSweeny refused a Seattle Times request for a copy of Boeing's reports, saying they contained proprietary business information. McSweeny also said "the fact of the matter is, the average public isn't able to understand" the material. "That's why the FAA was created," he said, "to step in and do something."

"We have completed our review," McSweeny said. "And we concur with (Boeing's) analysis."

© 1996, The Seattle Times

How Boeing fights to limit liability

Jon Hamley did not expect much to come of his meeting at the Norfolk, Va., airport on a muggy day in July 1995.

He was wary of the man he was meeting: Keith Gerrard, a senior partner from the Seattle law firm Perkins Coie, representing The Boeing Co. Hamley knew Gerrard led a legal team that handled the millions and millions of dollars in lawsuits against Boeing that inevitably arose when one of its airplanes crashed.

Hamley, 29, was still grieving over the death of his wife 10 months earlier. Flight attendant Sarah Slocum-Hamley was among the five crew members and 127 passengers killed when a USAir Boeing 737-300 dived out of calm skies near Pittsburgh in September 1994.

Though wary, Hamley was curious, too. On the telephone, Gerrard had said he wanted to talk about "making arrangements" for the families of the Flight 427 crew members, even though investigators still hadn't concluded what caused the Pittsburgh crash.

The implication that Boeing was ready to talk settlement surprised Hamley. Boeing, he knew, was still aggressively fighting claims in the similar crash of a United Airlines 737-200 in Colorado Springs four years before. So why would a Boeing attorney fly across the country to buy him dinner?

"He was very warm, very friendly," Hamley recalled. "He offered his condolences, said how sorry he was this happened. And the next thing he says is, `Boeing had nothing to do with Sarah's death.' "

Safely flying large groups of people six miles above the earth at nearly the speed of sound leaves little margin for error. That air travel has become so indispensable owes much to the careful design, manufacture and operation of reliable aircraft.

Statistically, jet travel has evolved into the safest way to travel, and Boeing has thrived as the world's dominant supplier of big, reliable jet airplanes. Boeing has built its reputation with airplanes that work well.

Yet the manufacturer of something as technically complex as a jet airliner, in an inherently risky business, also must be prepared for things to go wrong.

In a world where an Alabama jury recently ordered General Motors to pay $150 million to someone injured because of a poorly designed door latch, aggressive defense against product-liability claims is as fundamental to Boeing's business as research, manufacturing and marketing.

The potential costs to a manufacturer are enormous if its product is blamed for deaths and injuries: millions of dollars to victims and their families, many millions more if a product must be recalled and fixed, and the incalculable cost of a damaged reputation.

Boeing's approach to defending product-liability claims was first outlined in the mid-1960s by J. Paul Coie, patriarch of the Perkins Coie law firm. Passenger-jet travel was still just getting started; a product-damage claim of $1 million was considered outrageous.

On June 8, 1965, as Boeing was hustling to get its new 737 series to market, Coie recounted the state of product-liability law at a symposium co-sponsored by Boeing and the University of Washington at Seattle's Olympic Hotel.

Coie made these points:

-- An airplane was "essentially a bundle of compromises, arrived at by exchanging expert views" about performance, while keeping safety considerations paramount.

-- U.S. courts had assigned airplane manufacturers an "affirmative duty to make reasonable tests and inspections to discover latent hazards." The courts also had made manufacturers "liable for failure to warn users of its aircraft of known dangerous characteristics."

-- Making improvements once an airplane was in service could come back to haunt manufacturers in court: Plaintiffs could point to changes as proof that an improvement was feasible and should have been done in the first place.

-- On the other hand, courts tended to credit manufacturers for due care if it could be shown that a product "has been free from injury-producing effects in the past." In other words, the last thing a manufacturer wanted was a track record of problems, what the industry referred to as a "service history."

The late J. Paul Coie, of the Perkins Coie law firm, outlined Boeing's legal strategy ina seminar in the mid-1960s. For much of his career. he headed the representation of the Boeing Co. in aviation cases.

Still the heart of its strategy

Coie's outline still appears to form the heart of Boeing's corporate strategy for dealing with the aftermath of an airplane crash, or even with criticism of its products:

-- It robustly defends against any complaint of defects in its airplanes, thus keeping them from acquiring a "service history."

-- After an accident it plays a large role in investigating and suggesting what could have caused the accident, and in evaluating safety recommendations.

In the U.S. the investigating agency is the National Transportation Safety Board. It determines what caused airplane crashes and it may make safety recommendations to the Federal Aviation Administration. The FAA makes a final decision about such recommendations, usually consulting the affected parties. Boeing and other airplane builders tend to question or contest such recommendations.

-- Boeing responds carefully to legal claims from victims. Some claims are quickly settled, others contested. Either way, one consideration is whether a judge or jury might pin blame for a crash on a Boeing airplane, and thus open the door to other lawsuits.

In one famous example, after a Japan Air Lines crash killed 520 people aboard a 747 in 1985, Boeing accepted responsibility, saying it had performed a faulty repair on the airplane a few years earlier. Attorneys for some passengers had hoped to force a trial on whether the blame actually lay with design of a hydraulic system that Boeing later modified.

In the 1991 crash of Flight 585 in Colorado Springs, Boeing acknowledged nothing and began what has become a long, involved legal defense of its product, the 737.

Things changed after the Pittsburgh crash in 1994, which placed the 737 rudder system under renewed scrutiny. When Keith Gerrard flew across the country to discuss settlements with families of USAir crew members, it was apparent Boeing had decided it needed a different legal approach.

Blaming the weather in Colorado crash

The aftermath of the Colorado Springs crash appeared to demonstrate the Coie product-defense principles in action.

Working with federal investigators, Boeing proposed a weather explanation for the crash that ultimately kept the NTSB from settling on the other chief possibility: that an errant, last-minute movement of the 737 rudder sent the plane into a fatal dive as it was close to landing.

The Colorado Springs crash (and later the Pittsburgh crash) bore flight characteristics of a phenomenon known as a "rudder hardover." Yet investigators looking for corroborating evidence could not find a single proven incident of a rudder hardover occurring on a 737 flight in the more than 20 years the jets had been flying.

Meanwhile in the courtroom, Gerrard and Boeing lawyers fended off wrongful-death lawsuits that hinged on finding Boeing liable because of a defect in the 737.

The cases that most concerned the Boeing lawyers involved claims filed on behalf of the families of pilots and flight attendants.

The insurance and legal systems create an important distinction between lawsuits filed by the families of passengers and lawsuits filed by families of airplane crew members.

The question of what caused an airplane crash - pilot error, weather, or defective equipment - generally does not arise in passengers' cases. Once a passenger boards a jetliner, liability is assumed on the part of the airline and manufacturer. Settling passenger claims focuses not on what caused death or injury, but on the amount of damages to be paid. The airline and aircraft maker, with their insurers, then negotiate how to split the overall cost. That split might be affected by what caused a crash.

Crew cases work differently. Worker-compensation rules prevent families from suing an airline (the employer) for death or injuries that occur on the job. Crew members are assumed to knowingly perform risky work. The only place crew families can turn for legal settlement is to the manufacturer of the airplane. Their wrongful-death claims depend on proving that a malfunctioning or defective airplane was to blame.

Because the stakes are high on both sides, such cases make for aggressive plaintiffs and aggressive defenders.

Workers at the Renton plant attach a tail to a 737-700, the first of a new series equipped with rudder limiters. Though the NTSB has recommended it, Boeing opposes the safety device for existing 737 models.

Boeing in no hurry to settle

In the aviation community, Gerrard - Harvard-trained and mentored by J. Paul Coie himself - has established Boeing as a formidable, no-holds-barred defender of crew claims.

"Keith is a very, very bright guy," said Dick Krutch, a Seattle aviation plaintiff attorney who has spent a career dueling Gerrard. "He's competent, he's tough, he strives to keep his client's money in his client's pocket."

Passenger lawsuits in the Colorado Springs crash followed the usual pattern. Eighteen of 20 claims were settled by United and Boeing within two years of the crash.

But a protracted legal fight was under way with the families of the crew members: Capt. Harold Green, First Officer Patricia Eidson and flight attendants Monica Smiley, Anita Lucero and Lisa Church. They were joined in their claims by families of two passengers, Michael Kavanagh, an Irish computer-company executive, and Andy Bodnar, a Canadian from Toronto.

As international travelers, Kavanagh and Bodnar fell under a treaty which limits an airline's liability in crashes to $75,000 per person. The only way for their survivors to get more was to join the crew families in pursuing product-liability damages from Boeing.

Boeing's lawyers were in no hurry to settle. Company engineers had pushed the case for a freak wind as causing the accident, and NTSB investigators were baffled. The NTSB couldn't decide between a rudder malfunction or Boeing's wind-rotor theory as the cause.

That left Gerrard with a stronger case to argue at trial, if the crew-family claims came to that. In the meantime, there were other ways to strengthen Boeing's legal position. One goal was to get the crew-family suits moved to federal court from various state courts where they were filed. Corporate lawyers consider federal court a more neutral forum, less likely to be swayed by state interests, and federal judges to be more sophisticated in cases involving complicated business issues.

The Kavanagh family's attorney, Gerald Sterns, had filed a wrongful-death claim in Illinois state court in Chicago, United Airlines' home town. Gerrard tried unsuccessfully a number of times to get it moved to federal court.

Taking it to federal court

Then, on the eve of the second anniversary of the crash, with a time limit about to expire for adding any new parties to the suit, Gerrard filed a complaint in Chicago. Naming the two Colorado Springs air-traffic controllers on duty when the crash occurred, the complaint alleged they had negligently guided the plane into a wind rotor.

The next day the U.S. Attorney's Office announced that the federal government - the air-traffic controllers' employer - was substituting itself for them, and moving the case into federal court.

"It was pure Gerrard and it was really brilliant," said Sterns, a longtime aviation plaintiff lawyer.

The plaintiffs spent the next year getting the federal government out of the case, ultimately accepting a nominal settlement from the government to refocus the suit on Boeing. The case remained in federal court.

In late summer of 1994, Gerrard successfully argued that since the Kavanagh case was in federal court, it made sense to consolidate all the claims and send them to a federal judge in Denver.

The change created at least another year of pretrial paperwork and delay in the new court. It also steered the cases to one of the few states that cap damages in civil suits. Since federal courts usually apply state-court standards, if Boeing eventually lost at trial, there was a good chance no plaintiff would get more than the Colorado limit of $250,000.

Next spring will be the sixth anniversary of the Colorado crash. Boeing has made no settlement offer to the families of the crew or of the two international passengers. Attorneys for the families have deposed Boeing engineers and officials as they seek evidence to build a case that the 737 was known to have a faulty rudder.

"We still don't have a trial date," Dennis Lods, another attorney representing Kavanagh's survivors, said recently, "and we still don't know when we'll get one."

Overseeing two of the most extensive crash probes ever, NTSB investigators Tom Haueter, left, and Greg Phillips have been unable to establish whether the rudder caused 737 crashes in Pittsburgh and Colorado Springs. Boeing has aggressively contested any finding that would blame the 737's rudder-control system. Haeter and Philips were photographed in the NTSB's Washington, D.C., lab.

'First it's "My dog didn't bite you..."'

Even a much smaller case, far from the headlines, can provoke Boeing's legal tenacity if manufacturing liability is at issue.

In the late 1980s, Lance Schaeffer, a San Diego attorney, represented a USAir pilot, Richard O'Harren, in what became a knock-down, drag-out legal battle with Gerrard and Boeing.

Boeing ultimately paid O'Harren $317,000 in compensatory damages and legal fees, after a six-year fight, for injuries O'Harren suffered when he was sprayed in the face by a windshield rain repellent called RainBoe.

Invented by Boeing in the mid-'60s, RainBoe became standard equipment on jetliners. It was usually stored in a canister inside the cabin, within arm's reach of the pilot. Sometimes the canister leaked.

Boeing to this day contends RainBoe is nontoxic, though 95 percent of it is a solvent, Freon 113, which has been blamed in at least 12 deaths in industrial settings.

At a 1990 trial, Schaeffer produced substantial evidence that Freon 113 attacks the human central nervous system, causing disorientation, motor-skills impairment and sudden heart attack. Schaeffer also established that there was a pattern of RainBoe canisters leaking.

Led by Gerrard, Boeing's defense team disputed that RainBoe was toxic, denied the company was aware of any instances of it leaking and tried to portray O'Harren as a malingerer, court documents show. The case swung in O'Harren's favor when the company finally produced reports, years after Schaeffer first requested them, indicating one airline had reported 55 RainBoe leak incidents in a five-year period. There was a service history of problems, after all.

"It was a classic strategic retreat applied in the extreme," Schaeffer said. "First it's 'My dog didn't bite you,' then 'My dog wasn't there,' then 'I don't own a dog.' You buy time and point your finger anywhere you can to keep the heat off."

Making it costly for plaintiffs

In high-stakes product-liability cases, corporations defending against claims always hold the ultimate trump card. At any time, for some number of dollars, the company can settle and make the plaintiffs and their antagonistic lawyers go away.

But Gerrard built his reputation by keeping a tight fist on settlements and using delaying strategies to make it very difficult and expensive for plaintiffs to take Boeing to court.

"If you look past the tactics of settling a case, and step back and ask what constitutes a win in a major battle in the war, the answer is you look to destroy the plaintiff firm," said an experienced product-liability attorney who is not involved in the 737 cases. "You bleed them of their funds, you eliminate them as future players, you destroy them in the European tradition: You spike their heads at the city gates. It's standard strategy."

As the summer of 1994 came to a close, Gerrard's strategies had kept the Colorado Springs cases far away from a jury trial. Then came the disastrous nose dive of USAir Flight 427 in Pittsburgh. 

A complication: No wind in Pittsburgh

For all the striking similarities between the Colorado Springs and Pittsburgh crashes, there was one big difference, the weather: windy in Colorado, dead calm in Pittsburgh.

In the Colorado lawsuits, Boeing attorneys could anticipate making a strong case for a weather-caused accident, if necessary.

But the tranquil skies over Pittsburgh left investigators with little upon which to base an act-of-God explanation.

Because the Pittsburgh crash, like the Colorado crash, showed characteristics of a rudder hardover, investigative focus on the rudder system became intense.

The NTSB wanted to avoid reaching another inconclusive dead-end like the Colorado Springs investigation. There was also more public pressure on investigators this time, with many more people killed in a crash close to East Coast media centers. Magazines and TV shows hammered on the similarities between Pittsburgh and Colorado Springs.

In the summer of 1995, 10 months after the crash, Gerrard arranged to meet in person with Chris Germano, widow of Capt. Peter Germano, in New Jersey; with Glenda Emmett, widow of First Officer Chuck Emmett, in Texas; and with Jon Hamley, in Norfolk. He came to talk settlement.

"With the NTSB investigation over in (United Flight) 585, it may be they (Boeing) felt less threatened in Colorado Springs and felt they must remove the present risk in Pittsburgh," said Paul Hedlund, an aviation plaintiff lawyer from San Diego who represents several families of USAir Flight 427 passengers.

If the 737 rudder came to be blamed in Pittsburgh, Boeing, and not USAir, would bear the brunt of, by one estimate, $400 million that probably will be paid to the families of the 127 dead passengers. It could take another $20 million or more to settle with the crew families.

In dollar-and-cents terms, it would make sense for Boeing to settle damage claims sooner, while the cause of the crash was undetermined, rather than later, when it could face greater expenses if the airplane were blamed.

Settling also would make the plaintiffs' attorneys go away, so they wouldn't be fishing for evidence of rudder problems in the Pittsburgh crash. Such evidence could be useful to plaintiffs' lawyers in Colorado Springs to bolster their claim that a flaw in the airplane, not a freak wind, caused the United jet to crash in 1991.

Recall would be hugely costly

Beyond the lawsuits and their costs, Pittsburgh entailed risk of a massive jetliner recall if Boeing eventually were ordered to make major rudder-system changes, as NTSB investigator Greg Phillips had begun advocating inside his agency within a few months of the crash.

The cost of changes - the NTSB has now recommended 14 design, operational and maintenance improvements for the 737 - could reach hundreds of millions of dollars for parts and labor in a fleet of more than 2,700 aircraft. Millions more in airline revenue could be lost while the jets were taken out of service.

There was also potential cost to Boeing's reputation. The 737 is the backbone of fleets at United, Southwest, America West, Delta, Continental, USAir and many foreign carriers. Damaged public confidence in the 737 would be an advantage to Boeing competitors.

Families hear vague overtures of settlement

Jon Hamley understood much of this by the time he drove to meet Keith Gerrard at the Norfolk airport.

In the months since his wife had been killed, Hamley had become an angry, self-styled expert in 737 rudder problems. He had amassed a mountain of documents. He talked endlessly to lawyers and aviation experts. Using the deference allowed victims' families, he communicated regularly with Tom Haueter, the NTSB investigator heading the Pittsburgh investigation. He became distracted to the point of losing his job as a credit analyst.

He had come to believe Boeing was trying to obscure defects in the 737 rudder.

"I felt the people in Colorado Springs died in vain," he said. "I felt if Boeing, the NTSB and the FAA did their jobs after (Flight) 585, Sarah and the 131 other people on Flight 427 would never have died."

After he met Gerrard at the airport gate in Norfolk, Hamley remembers, they strolled to a restaurant inside the terminal. Gerrard learned through polite conversation how long Jon and Sarah Hamley had been married, what Jon did for a living and that Jon was in therapy. They talked briefly about the other crew members' families.

Hamley asked Gerrard why Boeing, if it was ready to talk about a settlement in Pittsburgh, was fighting crew-family claims in the Colorado case. Gerrard responded that the two crashes had nothing to do with each other and represented completely separate issues.

The subject of money was broached. Hamley says Gerrard warned him that crew families would not get as large a settlement as some of the passengers reportedly were getting because risk was an inherent element of their jobs.

He said Hamley probably "wouldn't like him" after hearing Boeing's settlement offer. Hamley recalls Gerrard saying that Boeing wanted to settle with all of the crew families at the same time.

"He said, `If we settle, we're going to settle with everybody, but if we fight one we're going to fight everybody,' " Hamley remembered.

No agreement with widow

Chris Germano, Capt. Germano's widow, said Gerrard made a similarly vague settlement overture to her in her living room in Moorestown, N.J.

"He said that certainly if Boeing was responsible for this, they would be the first to admit it and take responsibility for it," Germano said. "He just felt that in this case, they had absolutely, positively done nothing wrong."

She said Gerrard made it clear any cash Boeing paid to her could not be connected in any way with Capt. Germano's death. To date, Chris Germano has reached no settlement with Boeing.

Plaintiffs see a cover-up

In the past year, talk of settlement has been replaced by more acrimonious volleys from lawyers representing plaintiffs.

Last spring, with the safety board moving slowly on the Pittsburgh crash, two attorneys with Colorado Springs claims began seeking evidence from the Pittsburgh crash investigation that might help their own cases. They were Art Wolk, representing the Canadian family, and Lods, one of the Irish family's lawyers.

Lods and Wolk requested copies of all reports of disrupted 737 flights received by Boeing from mid-1995 on, as well as results of testing of rudder parts recovered in Pittsburgh. In response, Boeing lawyers produced a letter to Boeing from the NTSB general counsel instructing the company to withhold all documents related to the Pittsburgh investigation as long as the safety board's probe was active.

"It was just the most unbelievable attempt at cover-up I'd ever seen as a product-liability lawyer," Lods said. "The NTSB and Boeing had mutual motives to avoid more disclosure about what they'd done and not done . . . so they agreed not to produce any more information."

Lods argued that the NTSB instructions violated rules separating the executive branch from the judicial branch of government. He later received some documents from Boeing, but none, he said, related to the Pittsburgh crash.

Meanwhile, Jon Hamley hired Wolk as his attorney. In August they filed an unusual suit in U.S. District Court in Philadelphia.

The suit accuses Boeing and its rudder-parts suppliers of violating the federal Racketeer Influenced and Corrupt Organizations (RICO) Act by using the U.S. mail to deceive the NTSB and FAA about rudder defects in the 737.

Boeing is not required to respond to the suit until late November.

"My argument," Wolk said, "is if Boeing hadn't corrupted the FAA and NTSB investigation and had been honest and forthright after Colorado Springs, then Flight 427 would have never happened. We're really focusing the inquiry on how Boeing corrupted the NTSB and FAA as much as the cause of the crash."

© 1996, The Seattle Times