USAir Flight 427 was a scheduled flight from Chicago O’Hare International Airport to Pittsburgh International Airport, with a final destination of West Palm Beach, Florida. On Thursday, September 8, 1994, the Boeing 737 flying this route crashed while approaching runway 28R of Pittsburgh International Airport, located in Findlay Township, Allegheny County, Pennsylvania, which at the time was the largest hub for the airline. After the longest investigation in the history of the National Transportation Safety Board (NTSB), it was determined that the probable cause was that the aircraft’s rudder malfunctioned and went hard-over in a direction opposite to that commanded by the pilots, causing the plane to enter an aerodynamic stall from which the pilots were unable to recover. All 132 people on board the aircraft were killed.
The aircraft involved was a Boeing 737-3B7, registration N513AU, and previously registered as N382AU. The aircraft was delivered in 1987 and was powered by two CFM56-3B2 engines. The aircraft had recorded approximately 18,800 hours of flight time before the crash.
The flight crew consisted of Captain Peter Germano, 45, who was hired by USAir in February 1981, and First Officer Charles B. “Chuck” Emmett III, 38, who was hired in February 1987 by Piedmont Airlines (which merged into USAir in 1989). Both were regarded as excellent pilots and they were both very experienced: Captain Germano logged approximately 12,000 flight hours (including 4,064 on the Boeing 737), while First Officer Emmett logged 9,000 flight hours, with 3,644 of them on the Boeing 737. Flight attendants Stanley Canty and April Slater were hired in 1989 by Piedmont Airlines. Flight attendant Sarah Slocum-Hamley was hired in October 1988 by USAir.
During its arrival into Pittsburgh, Flight 427 was sequenced behind Delta Air Lines Flight 1083, a Boeing 727-200. At no time was Flight 427 closer than 4.1 miles to Delta 1083, according to radar data. Flight 427 was on approach at 6,000 feet (1,800 m) altitude, at flaps 1 configuration, and at approximately 190 knots.
At 7:02:57 p.m., the aircraft entered the wake turbulence of the Delta 727 it was sequenced behind, and there were three sudden thumps, clicking sounds, and a louder thump, after which the 737 began to bank and roll to the left. As the aircraft stalled, Germano exclaimed “hold on” numerous times, while Emmett, under physical exertion, said, “oh shit.” Germano exclaimed, “what the hell is this?” As air traffic control noticed Flight 427 descending without permission, Germano keyed the mic and stated, “four-twenty-seven, emergency!” The mic was keyed for the rest of the event, resulting in the following exclamations in the cockpit being heard in the tower at Pittsburgh. The aircraft continued to roll while pitched nose-down at the ground, at which point against sharply rising G-forces, Germano yelled “pull” three consecutive times before screaming, during which Emmett stated “God, no” seconds before impact. In an 80-degree nose-down position, banked 60 degrees left and traveling at approximately 300 mph (480 km/h), the 737 slammed into the ground and exploded at 7:03:25 p.m. in Hopewell Township, Beaver County, near Aliquippa approximately 28 seconds after entering the wake turbulence.
Cockpit view of accident based on information from the flight data recorder.
The National Transportation Safety Board investigated the crash. All 127 passengers and five crew members were killed. For the first time in NTSB history, investigators were required to wear full-body bio-hazard suits while inspecting the accident site. As a result of the severity of the crash impact, the bodies of the passengers and crew were severely fragmented, leading investigators to declare the site a bio-hazard, requiring 2,000 body bags for the 6,000 recovered human remains. USAir had difficulty determining Flight 427’s passenger list, facing confusion regarding five or six passengers. Several employees of the U.S. Department of Energy had tickets to take later flights, but used them to fly on Flight 427. One young child was not ticketed. Among the victims of the crash was noted neuroethologist Walter Heiligenberg.
Both the CVR and FDR were recovered and used for the investigation. Due to the limited parameters recorded by the FDR, investigators did not have access to the position of the flight-control surfaces (rudder, ailerons, elevator, etc.) for the accident. However, two parameters recorded by the FDR were crucial, one being the aircraft’s heading, the other being the pitch control yoke position. During the approach, Flight 427 encountered wake turbulence from Delta 1083; the FAA, however, determined “the wake vortex encounter alone would not have caused the continued heading change that occurred after 19:03:00.” The abrupt heading change shortly before the dive pointed investigators immediately to the rudder. Due to the absence of rudder pedal positions from the data, investigators had to determine whether the rudder moved hard-over by a malfunction or by pilot command. This in turn led to the CVR being more heavily scrutinized than most other recordings as statements and breathing from the pilots could potentially tell investigators if they were fighting for control over a rudder malfunction or inadvertently stomped on the wrong rudder pedal in excitement from the wake-turbulence. Boeing felt the latter more likely, while USAir and the Pilot’s Union felt the former was more likely. The FDR revealed that after the aircraft stalled, it along with the crew and passengers were subjected up to a 4 g load throughout the dive until impact with the ground in an 80 degree nose-down attitude traveling at approximately 300 mph under significant sideslip.
Reading the control yoke data from the FDR revealed that the pilots made a crucial error by pulling back on the control yoke throughout the dive with the stick-shaker audible on the CVR from the onset of the dive. This raised the aircraft’s angle of attack, removed all aileron authority, prevented recovery from the roll induced by the rudder, and caused an aerodynamic stall. Because the aircraft had entered a slip, pulling back on the yoke only aggravated the bank angle further. Boeing’s test pilots reenacted the fatal dive in both a simulator, as well as a test 737-300 by flying the same parameters on the accident FDR, and found that recovery from a fully deflected rudder at level flight, while at 190 knot crossover speed, was accomplished by turning the wheel to the opposite direction of the roll, and not pulling back on the yoke to regain aileron authority. The FAA later remarked that the CVR proved that the pilots failed to utilize proper crew resource management during the upset, while continuing to apply full up elevator after receiving a stall-warning. The NTSB remarked that no airline had ever trained a pilot on the proper recovery technique for the situation experienced by the pilots and that the pilots had just 10 seconds from the onset of the roll to troubleshoot before recovery of the aircraft was impossible.
After the longest accident investigation in NTSB history — lasting more than four and a half years — the NTSB released its final report on March 24, 1999. The NTSB concluded that the accident was due to mechanical failure:
The National Transportation Safety Board determines that the probable cause of the USAir Flight 427 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
The NTSB concluded that similar rudder problems had caused the previously mysterious March 3, 1991 crash of United Airlines Flight 585 and the June 9, 1996 incident involving Eastwind Airlines Flight 517, both Boeing 737s. The final report also included detailed responses to Boeing’s arguments about the causes of the three accidents.
At the time of the crash, Flight 427 was the second-deadliest accident involving a Boeing 737 (all series); as of 2019, it now ranks as the ninth deadliest. It was also the seventh-deadliest aviation disaster in the history of the United States, and the deadliest in the US involving a 737; as of 2019, it ranks eleventh. The accident marked USAir’s fifth crash in the period from 1989 to 1994. The Commonwealth of Pennsylvania spent approximately $500,000 in recovery and cleanup for the accident site. The FAA disagreed with the NTSB’s probable cause verdict and Tom McSweeney, the FAA director of aircraft certification, issued a statement on the same day it was issued which read: “We believe, as much as we have studied this aircraft and this rudder system, that the actions we have taken assure a level of safety that is commensurate with any aircraft.”
However the FAA changed its attitude after a special task force, the Engineering Test and Evaluation Board, reported in July 2000 that it had detected 46 potential failures and jams in the 737 rudder system that could have catastrophic effects. In September 2000 the FAA announced that it wanted Boeing to redesign the rudder for all iterations of the 737, of which there were then more than 3,400 in the USA alone.
USAir submitted to the NTSB that pilots should receive training with regard to a plane’s crossover speed and recovery from full rudder deflection. As a result, pilots were warned of and trained how to deal with insufficient aileron authority at an airspeed at or less than 190 knots (352 km/h), formerly the usual approach speed for a Boeing 737. Boeing maintained that the most likely cause of the crash was that the co-pilot inadvertently deflected the rudder hard-over in the wrong direction while in a panic and for unknown reasons maintained this input until impact with the ground. Boeing agreed to redesign the rudder control system with a redundant backup and paid for the retrofit of the entire worldwide 737 fleet. As one of the NTSB’s main recommendations, airlines were required to add four additional channels of information — pilot rudder pedal commands — into flight data recorders, with which the FAA gave airlines until August 2001 to comply. In 2016, former investigator John Cox stated that time so far has proven the NTSB correct in their findings due to the absence of a rudder reversal incident since Boeing’s redesign.
Following the airline’s response to the Flight 427 accident, the United States Congress required airlines to deal more sensitively with the families of crash victims. USAir ceased using Flight 427 as a flight number. Flight 427 was the second fatal USAir crash in just over two months, the other being Flight 1016 at Charlotte-Douglas Airport in July 1994. The crashes contributed to the financial crisis USAir was experiencing at the time.
The crash site of USAir Flight 427, on March 10, 2018
Transcript of the Cockpit Voice Recorder (CVR)
CAM-1 = Captain
CAM-2 = First Officer
CAM-3 = Cockpit Area Mike (cabin sounds and flight attendants)
RDO-1 = Radio Communications (Captain)
APP: Pittsburgh Approach
CAM-3: They didn’t give us connecting flight information or anything. Do you know what gate we’re coming into?
CAM-1: Not yet.
CAM-3: Any idea?
CAM-3: Do ya know what I’m thinkin’ about? Pretzels.
CAM-3: You guys need drinks here?
CAM-1: I could use a glass of somethin’, whatever’s open, water, uh, water, a juice?
CAM-2: I’ll split a, yeah, a water, a juice, whatever’s back there. I’ll split one with ‘im.
CAM-3: Okey-dokey. Do you want me to make you my special fruity juice cocktail?
CAM-1: How fruity is it?
CAM-3: Why don’t you just try it?
CAM-2: All right, I’ll be a guinea pig.
CAM-3: [Sound similar to cabin door closing]
The crew recieve instructions to reduce speed to 210kts, maintain FL100 and contact Pittsburgh Approach at 121.25.
CAM-1: Two ten, he said?
CAM-2: Two ten? Oh, I heard two fifty …
CAM-1: I may have misunderstood him.
Pittsburgh Approach asks Flight 427 to turn left heading 100.
CAM-3: [Sound of cockpit door opening]
CAM-3: Here it is.
CAM-1: All right.
CAM-2: All right. Thank you. Thank you.
CAM-3: I didn’t taste ’em, so I don’t know if they came out right.
CAM-1: That’s good.
CAM-2: That is good.
CAM-3: It’s good.
CAM-2: That is different. Be real good with some dark rum in it.
CAM-3: Yeah, right.
APP: USAir 427, Pittsburgh Approach. Heading 160, vector ILS Runway 28 Right final approach course speed 120.
CAM-2: What kind of speed?
RDO-1: We’re comin’ back to 210 and, uh, one sixty heading, down to ten, USAir 427.
CAM-1: What runway did he say?
CAM-1: It tastes like a…
CAM-1: There’s little grapefruit in it?
CAM-3: Yeah. You saw that from the color.
CAM-1: Else is in it?
CAM-2: Uh, Sprite?
CAM-3: Diet Sprite.
CAM-3: And I guess you could do with Sprite. Probably be a little better if you do.
CAM-1: Yeah. There’s more?
CAM-3: One more.
CAM-3: You got it.
CAM-3: Cranberry, orange, and Diet Sprite.
CAM-2: Really nice.
CAM-3: It’s different…
CAM-1: I always mix cranberry and the grapefruit. I like that.
CAM-3: Okay, back to work.
CAM-3: [Sound similar to cockpit door opening and closingl
CAM-2: I suspect we’re going to get the right side.
APP: USAir 427 descend and maintain six thousand.
RDO-1: Cleared to six, USAir 427.
CAM-2: Oh, my wife would like that.
CAM-1: Cranberry, orange, and Sprite.
CAM-2: Yeah. I guess we ought to do a preliminary.
Pre-landing checks take place; Approach requests a left turn heading 140, and speed reduction to 190kts.
CAM-3: [Sound similar to flap handle being moved; sound of single chime similar to seat belt chime]
CAM-2: Oops. I didn’t kiss ’em goodbye. What was the temperature? Remember?
PA: Seatbelts and remain seated for the duration of the flight.
PA: Folks, from the flight deck, we should be on the ground in about ten more minutes. Uh, sunny skies, a little hazy. Temperature … temperature’s, ah, 75 degrees. Wind’s out of the west around ten miles per hour. Certainly ‘ppreciate you choosing USAir for your travel needs this evening. Hope you enjoyed the flight. Hope you come back and travel with us again. This time we’d like to ask our Flight Attendants please prepare the cabin for arrival. Ask you to check the security of your seatbelts. Thank you.
CAM-3: [Seatbelt chime]
RDO-1 : Did you say Runway 28 Left for USAir 427?
APP: Uh, USAir 427, it’ll be 28 Right.
RDO-1: 28 Right, thank you.
CAM-1: 28 Right.
CAM-2: Right, 28 Right. That’s what we planned on. Autobrakes on one for it.
CAM-1: Seven for six.
CAM-2: Seven for six.
CAM-1: Boy, they always slow you up so bad here.
CAM-2: That sun is gonna be just like it was takin’ off in Cleveland yesterday, too. I’m just gonna close my eyes. [Sound of laughter]. You holler when it looks like we’re close. [Sound of laughter]
APP: USAir 427, turn left heading one zero zero. Traffic will be one to two o’clock, six miles, northbound Jetstream climbing out of thirty-three for five thousand.
RDO-1: We’re looking for the traffic, turning to one zero zero, USAir 427.
CAM-3: [Sound in engines increasing rpms]
CAM-2: Oh, yeah. I see the Jetstream.
CAM-3: [Sound of thump; sound like ‘clickety-click’; again the thumping sound, but quieter than before]
CAM-1: Whoa … hang on.
CAM-3: [Sound of increasing rpms in engines; sound of clickety-click; sound of trim wheel turning at autopilot trim speed; sound similar to pilot grunting; sound of wailing horn similar to autopilot disconnect warning]
CAM-1: Hang on.
CAM-2: Oh, Shit.
CAM-1: Hang on. What the hell is this?
CAM-3: [Sound of stick shaker; sound of altitude alert]
CAM-3: Traffic. Traffic.
CAM-1: What the…
CAM-1: Oh God, Oh God…
RDO-1: 427, emergency!
CAM-2: [Sound of scream]
CAM-1: Pull… pull…
CAM-1: [Sound of screaming]
CAM-2: No… END OF TAPE.
United Airlines Flight 585 was a scheduled passenger flight on March 3, 1991 from Denver to Colorado Springs, Colorado, carrying 20 passengers and 5 crew members on board. The plane experienced a rudder hardover while on final approach to runway 35 at Colorado Springs Municipal Airport, causing the plane to roll over and enter an uncontrolled dive. There were no survivors.
N999UA, the aircraft involved
The NTSB was initially unable to resolve the cause of the crash, but after similar accidents and incidents involving Boeing 737 aircraft, the crash was determined to be caused by a defect in the design of the 737’s rudder power control unit.
Aircraft and flight crew
Flight 585 was operated by a Boeing 737-291, registered N999UA. The 737 was originally manufactured for Frontier Airlines in 1982 and was bought by United Airlines in 1986. On the date of the accident, the aircraft had accumulated approximately 26,000 flight hours. The flight crew consisted of Captain Harold Green (52) First Officer Patricia Eidson (42), and 3 flight attendants. The captain, who had over 10,000 hours as a United Airlines pilot (including 1,732 hours on the Boeing 737), was regarded by colleagues as a conservative pilot who always followed standard operating procedures. The first officer had accumulated over 4,000 flight hours (including 1,077 hours on the Boeing 737), and she was considered by Captain Green to be a very competent pilot.
Flight 585 was a regularly scheduled United Airlines Flight from General Wayne A. Downing Peoria International Airport in Peoria, Illinois to Colorado Springs, Colorado, making intermediate stops at Quad City International Airport in Moline, Illinois and the now-decommissioned Stapleton International Airport in Denver, Colorado. On March 3, 1991, the flight operated from Peoria to Denver without incident.
At 09:23 AM Mountain Standard Time, Flight 585 departed Denver with 20 passengers and 5 crew members on board, and was scheduled to arrive in Colorado Springs at 09:46 AM. At 09:37 AM, the aircraft was cleared for a visual approach to runway 35. The aircraft then suddenly rolled to the right and pitched nose down. The crew tried to initiate a go-around by selecting 15-degree flaps and an increase in thrust. The altitude decreased rapidly and acceleration increased to over 4G until the aircraft crashed into Widefield Park, less than four miles from the runway threshold, at a speed of 245 mph. The aircraft exploded on impact and an enormous fireball erupted as a result. According to the accident report, the resulting crash and explosion carved a crater 39 ft. by 24 ft. long and 15 ft. deep. Everyone on board was killed instantly, and an eight year old girl who lived nearby the tumbling jet was knocked to the ground by the force of the impact, suffering minor injuries.
The National Transportation Safety Board (NTSB) commenced an investigation, which lasted for 21 months. Although the flight data recorder (FDR) outer protective case was damaged, the data tape inside was intact and all of the data was recoverable. Five parameters were recorded by the FDR: heading, altitude, airspeed, normal acceleration (G loads), and microphone keying. The FDR did not record rudder, aileron or spoiler deflection data, which could have aided the NTSB in reconstructing the plane’s final moments. The data available proved insufficient to establish why the plane suddenly went into the fatal dive. The NTSB considered the possibilities of a malfunction of the rudder power control unit servo (which might have caused the rudder to reverse) and the effect that powerful rotor winds from the nearby Rocky Mountains may have had, but there was not enough evidence to prove either hypothesis.
The cockpit voice recorder (CVR) was also damaged, but the data tape inside was also intact. However the data tape had creases in it, resulting in the playback quality being poor. The CVR determined that the pilots made a verbal (and possible physical) response to the loss of control.
This was only the fourth time in the NTSB’s history that it published a final aircraft accident report with an undetermined probable cause.
Renewed investigation and probable cause
The NTSB reopened its investigation into Flight 585 in parallel with the Flight 427 investigation, due to the similar nature of the circumstances.
During the NTSB’s renewed investigation, it was determined that the crash of Flight 585 (and the later Flight 427 crash) were the result of a sudden malfunction of the aircraft’s rudder power control unit. Another incident (non-fatal) that contributed to the conclusion was that of Eastwind Airlines Flight 517, which had a similar problem upon approach to Richmond on June 9, 1996. On March 27, 2001, the NTSB issued a revised final report for Flight 585, which found that the pilots lost control of the airplane because of a mechanical malfunction. The renewed investigation concluded with a “probable cause” that stated:
The National Transportation Safety Board determines that the probable cause of the United Airlines flight 585 accident was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide.
On June 9, 1996, while operating a passenger flight from Trenton, New Jersey to Richmond, Virginia, the crew of Eastwind Airlines Flight 517 temporarily lost control of their Boeing 737-200 due to a rudder malfunction. The crew were able to regain control and landed the aircraft successfully. One person aboard was injured.
Flight 517 was instrumental in resolving the cause of Boeing 737 rudder issues that had previously caused two fatal crashes. Flight 517 was the first flight to experience such rudder issues and land safely, allowing investigators to interview the pilots about their experience and to study the aircraft.
N221US, the aircraft involved in the incident, two years after the incident.
Flight 517 was a scheduled Eastwind Airlines passenger flight from Trenton-Mercer Airport in Trenton, New Jersey, to Richmond International Airport in Richmond, Virginia. The flight was operated using a Boeing 737-200 (registration number N221US). On June 9, 1996, Flight 517 was operated by Captain Brian Bishop and First Officer Spencer Griffin. A total of 53 people were on board.
Flight 517 departed Trenton without incident and encountered no turbulence or unusual weather en route to Richmond. While on approach to Richmond International Airport, at an altitude of about 5,000 feet (1,500 m) MSL, the captain felt a brief “kick” or “bump” on the right rudder pedal. Around the same time, a flight attendant at the rear of the plane heard a thumping noise underneath her. As the plane continued to descend through 4,000 feet (1,200 m), the captain suddenly experienced a loss of rudder control and the plane rolled sharply to the right.
Attempting to regain control, the captain tried to apply full left rudder, but the rudder controls were stiff and did not respond to his commands. The captain applied left aileron and increased power to the right engine to try to stop the roll. The airplane temporarily stabilized, and then rolled to the right again. The crew performed their emergency checklist and attempted to regain control of the aircraft, and after several seconds they abruptly regained control. The airplane operated normally for the remaining duration of the flight.
No damage occurred to the aircraft as a result of the incident. One flight attendant suffered minor injuries. No other passengers or crew aboard Flight 517 were injured.
Investigation and aftermath
The NTSB investigated the incident, with a particular focus on determining whether the events of Flight 517 were related to previous Boeing 737 crashes.
During the investigation, the NTSB found that prior to the June 9 incident, flight crews had reported a series of rudder-related events on the incident aircraft, including abnormal “bumps” on the rudder pedals and uncommanded movement of the rudder.
Investigators conducted interviews with the pilots of Flight 517, and removed rudder components from the aircraft for examination, which helped to establish the cause of the previous crashes of United Flight 585 and USAir Flight 427. The NTSB determined that all three incidents could only be explained by pilot error or a malfunction of the rudder system, and based partly on post-accident interviews with the Flight 517 pilots, concluded that rudder malfunctions were likely to have caused all three incidents.
The NTSB also determined that, unlike the United or USAir accidents, the rudder problem on Flight 517 occurred earlier in the landing process and at a higher speed, which increased airflow over the other control surfaces of the aircraft, allowing the pilots to overcome the rudder-induced roll.