Graham Warwick/WASHINGTON DC
The US Federal Aviation Administration describes it as a "landmark scientific study", but it is not clear exactly what the lengthy, and presumably expensive, investigation of the Boeing 737 rudder control system has actually uncovered.
The FAA-led Engineering Test and Evaluation Board (ETEB)has identified 30 potentially catastrophic failure modes, but most were known about already, and considered highly unlikely. Three or four of the modes have already been eliminated by changes to the rudder system mandated in a series of airworthiness directives (ADs) following two 737 crashes, in 1991 and 1994.
In reality, the team has uncovered few new possibilities for catastrophic failure, and Boeing and the FAA have yet to determine how likely - or unlikely - those possibilities are.
Established in May last year, the ETEB is due to present its findings and recommendations at the end of June. Although the rudder review is still underway, press speculation that the final report would call for a control system redesign prompted the FAA last week to provide a progress update "to put our study and its preliminary information into the proper context", says Beth Erickson, director, aircraft certification service.
"The ETEB has found no immediate safety problems, I can't stress that enough," Erickson says. "The 737 by all measures is one of the safest aircraft," she says, noting the 3,600 aircraft delivered have logged 100 million flight hours with half the accident rate of comparable aircraft. "It has the best record in its class."
Independent panel
Formation of an independent panel to review the 737 control system was recommended by the US National Transportation Safety Board after it concluded rudder reversal was the probable cause of the crash of US Air Flight 427 in 1994. The ETEB began its work against the background of a series of ADs designed to prevent rudder reversals and minimise the effect of rudder system malfunctions. These included redesigning the servo valve, improving the yaw damper and limiting the rudder authority.
The ADs address some of the failure modes identified by the ETEB, says Erickson. All 737s are being retrofitted with a rudder pressure limiter which reduces the control authority in all phases of flight except the first 30s after take-off and the last 200ft (60m) before landing. This reduces rudder authority by up to half and limits its ability to overpower other control surfaces in the event of a hardover (see diagram). Aircraft are also being retrofitted with a more reliable digital yaw damper. Fleet-wide implementation of the ADs is expected by August.
The ETEB was tasked with identifying all failure modes that could result in uncommanded rudder movement - "without regard for their likelihood", says Erickson. Following release of the final report, Boeing and the FAA will conduct a statistical safety analysis to establish the probability of the modes identified and determine whether any require corrective action.
Erickson says the ETEB was structured to provide "a totally fresh look" at the 737 rudder control system. The multidisciplinary team of 22 experts, led by an FAA engineer with a flight test background, brings together a diverse experience base, she says. It includes engineers from NASA, the US Department of Defense, Ford Motor and the Russian Interstate Aviation Committee. Pilots and maintenance technicians are also represented.
Not on the team is anyone at Boeing or the FAA who participated in the design and certification of the 737 flight control system. Also absent is anyone from Boeing Commercial Airplanes Group. The 737 manufacturer is represented by engineers from the company's Phantom Works, Military Aircraft and Missiles and Douglas Products divisions.
In addition to the ETEB, there is an independent "challenge" team, the role of which is to review the evaluation board's processes and findings. "They have really been a help," Erickson says. "They provide a fresh set of eyes, a valuable perspective, on the ETEB's work." Findings and recommendations in the final report may yet change because of input from the challenge team, she cautions.
The ETEB began its work with an extensive engineering analysis of possible failure modes - "however remote they might be", stresses Erickson. The analysis was then confirmed with component, integrated system, and flight tests. Although flight testing is complete, component and system tests continue, so the team's findings are still preliminary, she says.
"The team did quite a job," says Erickson. "This is a landmark scientific study...the 737 rudder is the most studied flight control system ever." The study has required the development of sophisticated analysis and testing tools, she says. A complete computer model of the rudder system was developed and used to simulate and identify failure modes. "We were not sure it would work, and it took several go-arounds, but it proved very effective," she says.
Another breakthrough was made possible by the involvement of the Ford engineer on the ETEB. "He developed a method of measuring the inner workings of the dual-concentric servo actuator," Erickson says. This used external eddy-current sensors to determine how the valves move relative to each other without interfering with the operation of the actuator.
Other tools include a shaker/environmental test facility, which has allowed the team to collect "immense" amounts of data in realistic and extreme temperature and pressure conditions. A fin rig housing the whole rudder system and hooked up to an aerodynamic loads simulator has allowed the team to simulate all the predicted failures.
A window in the fin allows testers to observe the rudder system in operation, Erickson says An engineering flight simulator has been programmed with the identified failure modes and flown by line pilots to evaluate aircrew procedures for detecting and dealing with rudder malfunctions. Finally, an "extensively instrumented" Purdue University 737-200 has been used for flight testing.
By mid-April, the ETEB had completed the failure analysis and flight testing, Erickson says. Many of the possible failure modes identified by computer analysis have been replicated in ground testing and some of them in flight testing, she says. The team has identified 30 "Class 1" failure modes, which are considered catastrophic with little or no chance of recovery; and 16 "Class 2" failure modes, which are deemed hazardous and put a significant burden on the crew. Some modes are common to all 737s, Erickson says, and some are limited to the non-Next Generation 737 models (-100/200 and "classics" : -300/400/500) with its unique dual-concentric servo valve.
Failure modes known
Most of the failure modes were already known about and determined to be highly improbable during safety analyses conducted as part of the original certification, Erickson says. One of the new modes uncovered involves a "significant" buildup of ice on the rudder control system's external linkage and requires a simultaneous yaw damper hardover. In these conditions, a rudder hardover is possible. "This was not a known failure mode. We previously assumed the ice would break off," she says.
The failure mode requires an ice accumulation of at least 6.5mm (0.25in) on the input crank to the servo valve. While most types of ice accumulation did break off, the team was able to replicate conditions in which it did not, but the FAA does not yet know whether such icing could occur in flight. "They had to get it really cold then mist the water on to get the ice to build up," Erickson says. The follow-on safety analysis will determine whether the likelihood is sufficient to warrant corrective action.
The ETEB also found that existing aircrew procedures for dealing with a rudder malfunction should be improved. The team has drafted new procedures, but these need to be tested in the simulator "to check they really are an improvement", Erickson says. The need to improve rudder system inspections to detect latent failures is another preliminary finding.
The ETEB's final report will include short-term and long-term recommendations. The team will recommend that, in the long term, control system failures resulting in hardovers need to be addressed by design modifications. The nature and timescale of such changes has not been detailed.
The short-term recommendations so far are that operational and maintenance procedures be enhanced. The team has also suggested "minor changes" to the rudder system design. These include installing a cockpit rudder position indicator and a switch to shut off all hydraulic power to the rudder. Erickson is unable to shed any further light on these recommendations until the report is finalised.
The report's release will be followed by the Boeing/FAA safety analysis. Any identified failure mode with a probability of occurring in service that is greater than 1 in 1 billion will have to be re-evaluated and may require corrective action, Erickson says. Follow-on work will include finalising changes to operational procedures and maintenance practices, and developing and validating appropriate design solutions.
Boeing, meanwhile, continues work on a "reliably redundant" rudder system design, as called for by the NTSB. Erickson cautions there is no certification standard for reliable redundancy, but says the ETEB's work could be used to evaluate the proposed system against the current standards and make a judgement as to whether it is reliably redundant.
The ETEB appears to have succeeded in its task of identifying all the possible ways the 737 rudder control system can fail. The task now facing Boeing and the FAA is determining which, if any, could actually occur in service. As Erickson points out, every mechanical system has failure modes - what matters is their probability. Most of the rudder failure modes identified look highly improbable, but - at least until the safety analysis is complete - not impossible.
Source: Flight International
