Boeing 737 rudder hardover: the failure mode no test could find

Here is an uncomfortable observation from twenty years of failure analysis: the deadliest failure mode in this file passed every test ever written for it. United 585 and USAir 427 killed 157 people, and for years the best accident investigators alive could not say why. Not a rogue procedure. Not a worn-out part. A servo valve that jammed under conditions nobody had thought to combine. In PFMEA language: occurrence near zero, severity ten – and a detection rating that was fiction.

The situation

The 737's rudder is driven by a hydraulic power control unit whose signature safeguard was a dual servo valve: two metering slides in one housing, so a jam in one channel would, in theory, be contained by the other. The design's certification lineage ran back to the late 1960s. On paper, an uncommanded full deflection – a hardover – against the crew's pedals at low altitude sat outside the credible scenarios. Then, on 3 March 1991, United 585 rolled inverted on final at Colorado Springs and hit the ground. 25 dead. The NTSB chased mountain-wave rotor winds, found the evidence would not carry the hypothesis, and closed the file undetermined.

How it unfolded

Three years later the pattern repeated. USAir 427, on approach to Pittsburgh after crossing the wake of a preceding jet, rolled and dived. 132 dead. Wake turbulence was simulated and could not produce a sustained hardover. Two wreckages, one shared system, no mechanism. The break came in 1996, when an Eastwind Airlines 737 crew met the anomaly and recovered – a live aircraft, testimony instead of wreckage. Laboratory work then pushed the PCU servo valve through thermal and mechanical conditions certification had never combined, and the dual valve jammed, driving the rudder toward hardover. In 1999 the Board concluded both crashes most likely stemmed from a jam of the main rudder PCU's dual servo valve to the hardover side. The FAA mandated redesigned valves and additional safeguards across the older fleet.

Root-cause anatomy

Technically, a common-mode defeat of claimed redundancy. Both channels shared one housing, one hydraulic fluid, one thermal environment; a rare combination of cold-soaked thermal state and mechanical pre-load could seize the slides in a position commanding full rudder. Occurrence across millions of flight hours: vanishingly rare. Severity: ten. Detection: presumed, never demonstrated.

The organisational failures ran deeper. Certification testing validated the valve's function and never its provocation – no test asked what makes this thing jam. Each investigation closed on its own evidentiary standard, and "undetermined" is honest for a board but corrosive for a system, because nothing forces the design's assumptions back open. Nothing treated two unexplained rolls of the same type as a single dataset until a third, survivable event made denial impossible.

Where the quality system failed

The PFMEA failure is the spine of this file. A severity-10 mode carried a near-zero occurrence rating, and its detection rating was inherited from test plans that exercised function, not worst-case mechanism. The detection column had become arithmetic, not evidence. In 8D terms, "the redundancy contains it" was an interim action promoted to permanent corrective action with no verification of effectiveness. The change-control failure is quieter: the dual-valve redundancy assumption was written in the 1960s and never re-validated as thermal understanding advanced. The audit question nobody asked was not which test covers this part. It was which test provokes this failure.

A test that fails to provoke the failure proves the limits of the scenario, never the safety of the part.

What would have caught it

Start with provocation testing driven by severity. For a catastrophic item, detection must be demonstrated by a test built to make the part fail – thermal shock, pre-load and contamination combined at the corners of the operating envelope. Nothing exotic. The lab work that finally produced the jam used standard instrumentation; the gap was the envelope, not the equipment.

Second, run common-mode analysis on every redundancy claim. Shared housing, shared fluid, shared environment means shared failure; "dual" is a topology, not a guarantee. Third, aggregate rare anomalies. Two unexplained rolls plus one recovered incident were one dataset, and sibling events – across operators, lines or shifts – deserve to be treated as correlated until proven otherwise. And a fourth discipline follows from the third: re-opening triggers. A second mystery that mirrors the first invalidates the first closure. That is a trigger, not a coincidence.

My take

I read this file like everyone else – from the outside, years later. It belongs to the NTSB and to the families. But I have lived the smaller version. Across two decades in automotive and aerospace quality, at Witte Automotive and later building the QA organisation for a 900-strong greenfield plant at SNOP, the fights worth having were always in the detection column. Someone rates a mode "1" because a test exists, not because the test provokes the mode. I have watched supplier-designed hardware inherit detection ratings from legacy plans nobody re-read, and this PCU looks like exactly that class of component. My rule since: severity sets the burden of proof. QRQC taught me the same on the shop floor – reproduce the failure first, argue afterwards. Nobody ever wants to fund the test designed to break their own part.

157 people boarded two aircraft carrying a failure mode that had existed since the day the design was certified, silent through decades of passing tests. The lesson is not that testing is useless. It is that a test regime answers only the questions it was built to ask. Somewhere in your PFMEA is a row with a catastrophic severity and a comfortable detection rating, defended by a test that has never once provoked the failure it rates. Find that row. Ask which test breaks the part. If nobody can answer, you are not managing the risk – you are waiting for your Eastwind.