“That’s with no pulling or pushing at all,” Hewett said. All he’d had to do was turn the wheel right and hold it there.
Hewett then mentioned one of the mysteries of the cockpit voice recorder—the fact that neither pilot had given any clues about what was happening to the rudder. If the PCU was jammed, “Wouldn’t you be saying, ‘It’s jammed! Goddammit, it’s jammed!’?”
They flew again and Hall again recovered. But Cox didn’t like the way the session was going. It seemed to him that Hall was hearing only Boeing’s side of the story. He told Hall that it was understandable that the pilots pulled back on the stick. If they looked out the window, all they saw was the ground looming closer. “The airplane is not responding the way they want it to,” Cox argued. “The windscreen is full of the ground and it is understandable that they would try to reduce the number of variables that they are facing.”
“But,” said Hewitt, “anybody who has ever been trained in a jet knows, with the stickshaker going off, the only way to recover is to let up on the stick. His first reaction should have been to push up on the stick.”
Hall tried again. “There’s the rudder in full hard,” Hewett said. “Right wheel! Right wheel!”
But Hall turned left. The plane crashed.
“I almost recovered,” Hall said.
After the session, Hall said Hewett was too heavy-handed. The Boeing engineers had had nearly eighteen months to figure out how to recover. Emmett and Germano had had just ten seconds. “No one who was flying the plane had been trained what to do,” Hall said.
19. BLAMING GOD
“This valve,” said Boeing hydraulics engineer Ed Pfafman, “is what we consider our safety feature.”
Another Boeing engineer boasted that the unique valve-within-a-valve and a separate backup unit would create three ways to move the rudder on the new 737, which he said was “above and beyond the call of duty.” Some planes had only two.
But as the Boeing engineers explained the plans for the 737’s rudder system, FAA officials were skeptical. They were worried that the valve-within-a-valve might not be sufficiently redundant.
“The thing that is disturbing me is that you have more eggs in one basket here,” said FAA official Charlie Hawks. “It does shake me a little bit,” he added. “At this moment, at least, I’m still a little jumpy about it.”
The valve had been invented by Robert R. Richolt, a young Boeing engineer who had designed sophisticated valves on the Lockheed Electra. He had been so successful that he had retired and was living on a yacht when he was hired by Boeing. The dual valve was first used on the rudder of the 707 and the elevators in the 727. Richolt’s 1963 patent application for the 737 said the valve was “fail-safe” and that the device “provides an override feature in case the main slide becomes seized…. This eliminates the quick reaction time required of the pilot to prevent a crash.”
Redundancy is a fundamental tenet in designing airplanes, a concept that engineers jokingly call the “belt and suspenders approach.” If your belt fails, your pants are still held up by your suspenders.
On many transport jets, such as the older 727, there was redundancy on the tail itself. The rudder was split into an upper panel and a lower panel. If one malfunctioned, the other one could control the plane or be turned the opposite direction to neutralize the problem. But that wasn’t the case on the 737, which, during Boeing’s push for fewer parts and better reliability, was designed with one big rudder panel.
The 737 rudder system was unusual. On most big jets, rudders are powered by separate valves rather than by the valve-within-a-valve. Many planes, such as the newer 757 and 767, have a special feature called a “breakout.” If two valves detect that the other one is jammed, they break it out of the system.
But despite their reservations in the mid-1960s, FAA officials ultimately decided that the unique 737 valve met federal standards. The rules back then were relatively vague—they said that manufacturers must protect against failures “unless they are extremely remote.” That phrase was not defined, which gave Boeing leeway. The company convinced the FAA engineers that Richolt’s invention complied.
The first 737 flew in early 1967 with Richolt’s valve in its tail.
The FAA, an automatic party on every NTSB investigation, assigned more than a dozen employees to the Flight 427 probe. The team was led by Vikki Anderson, the former flight attendant, and included FAA test pilots, inspectors, engineers, and a doctor from the agency’s Civil Aerospace Medical Institute. The team had representatives on each of the important NTSB groups. There was a lot at stake for the FAA because it had certified that the 737 was safe. If the plane got blamed for the crash, the FAA would also get blamed.
The investigation revealed two faces of the FAA: the aggressive midlevel employees who handle the day-to-day scrutiny of Boeing, and the cautious top-level managers who occasionally sound like Boeing cheerleaders.
Steve O’Neal was an FAA bureaucrat, but he looked more like a friendly bartender than a paper-pushing drone. He was a gentle man with thinning brown hair and a thick moustache, forty-two at the time of the crash, with two stepdaughters and two grandchildren. He was a dog lover (he had an old Samoyed named Casey who was losing her vision), and he was passionate about flying. He could never afford to do much piloting on his own, but his job as an FAA flight test engineer in Renton allowed him to take test flights several days each month. He usually rode in the cockpit to make sure the plane met each FAA requirement. He had flown thousands of times, but he still got a thrill when the pilots took the plane to the edge of its limits, stalling it at scary angles and then recovering.
O’Neal spent his days studying failure modes, the myriad ways in which an engine or a flight control could malfunction. He had to be sure that those failures were benign or extremely improbable or that there was an adequate backup system to provide redundancy. He was especially proud that he had caught a complicated failure mode on three Airbus models involving a hydraulic failure. Airbus changed its pilot procedures because of his discovery.
In the 427 investigation, O’Neal was assigned to the NTSB aircraft performance group, which analyzed the flight data recorder. He was an independent thinker and was not shy about making suggestions that might be unpopular with his bosses. In a meeting with FAA managers about a month after the crash, he suggested grounding the entire fleet of 737s. Two of the planes had crashed in similar circumstances, he said, and the safest approach was to keep them on the ground until the safety board figured out the cause.
The idea went nowhere. Everyone else in the room felt there was insufficient evidence for such a dramatic step, which would have catastrophic consequences for virtually every airline in the country. Realizing that his idea had no support, O’Neal backed down. He was a conscientious employee, but he was also realistic. He knew he didn’t have proof that the 737 had a flaw. But he continued to have qualms about the plane and urged friends and relatives to fly other planes if possible. He worried that 737 pilots would not be able to recover if they had a rudder hardover.
The other face of the FAA was Thomas McSweeny, a top official in charge of airplane certification. McSweeny was a twenty-two-year veteran of the agency, having previously worked eight years for an aerospace company. He was not formally a member of the Flight 427 investigation, but as the FAA’s chief regulator of airplanes, he was in charge of any NTSB safety fixes that grew out of the accident.