The US National Transportation Safety Board's tireless pushing has finally forced the Federal Aviation Administration to admit that, in certificating the Boeing 737's rudder system in December 1967, it had approved a system which broke the basic premise of public transport aircraft certification. This simple tenet is that the failure of one unit in a system should not be able to bring down the aircraft.
In the case of the 737, a single unit in the rudder system has caused loss of pilot control leading to two fatal crashes and several worrying upsets. The FAA has now ordered Boeing to produce a completely new rudder system which has real, rather than apparent, redundancy.
Meanwhile the modified, but basically similar, 737 rudder system is allowed to go on flying for up to six years in more than 3,000 aircraft. This decision has been made on the grounds that the uncommanded rudder "hard-over" which, the NTSB determined, killed 25 passengers and crew at Colorado Springs in 1991 and 132 people at Pittsburgh in 1994, is very unlikely to happen.
The FAA is right, according to the statistics. According to the letter of the law, however, the aircraft should be grounded, because a single component in a single unit could bring down another 737. NTSB tests have proved that it is a possibility, however unlikely it might be.
Following the grounding of the Concorde fleet there has been much discussion of what it takes to precipitate the withdrawal of a certificate of airworthiness (C of A). A study of the two cases - Concorde and the 737 - provides an insight on how the world operates in reality.
In the case of Concorde, failure of a single component (a main gear tyre) set the aircraft on fire and rendered it uncontrollable just after take-off. In the case of the 737, a -200 model and a -300 model were rendered uncontrollable by an uncommanded rudder "hard-over". NTSB reports judged that a stuck shuttle valve in the rudder's main power control unit (PCU) was the most likely cause.
Why, then, is one of the types allowed to fly and the other not? Cynicism would be easy. There are few Concordes - only 13 - and 3,500 737s in service. Grounding Concorde inconveniences a few privileged travellers; grounding the 737 would cause a cataclysmic disruption of the air transport industry.
But that is not the reason. It is important to apply common sense, not just cold legal logic, to evaluate the two decisions.
Concorde's fleet has accumulated 76,000 flights and has suffered one fatal accident. Its British and French C of As were "suspended", but not just because the aircraft was proven not to meet a basic certification tenet. Many Concorde tyre failures causing damage had occurred before, and the civil aviation authorities judged it too much of a risk that the circumstances which caused the fatal crash could occur again.
In the Boeing case, the world 737 fleet had flown roughly 50 million departures before the first "rudder hard-over" crash. Now it has operated about 75 million flights. Considering fatal crashes attributed to that specific cause, there has been one per 37.5 million flights. It's in a different league from the risks that appear to be associated with Concorde.
That does not let the FAA and Boeing off the hook, however. The existing rudder controls consist of a main PCU fed by two separate hydraulic systems - either of which suffices to work it - and a backup PCU which can be fed by its own electrically driven hydraulic pump. This sounds like reasonable redundancy provision, but the trouble is that all the standbys become irrelevant in the event of a mechanical failure like the PCU valve jamming. The 737's other primary controls have manual reversion, but the rudder system does not.
It has taken the NTSB's punch to get the FAA and Boeing to admit that the existing rudder control system breaks the rules. It is not easy to admit that you have been wrong for 31 years, but finally they are doing the right thing in completely redesigning the rudder system, however statistically safe the old system is.
Source: Flight International
