← back to the reports
MY-012 Boeing 737-300 · USAir, USA 1994

USAir Flight 427 — A Rudder That Slammed the Wrong Way

flight-controlnarrowbody-jet1990s
Killed
132
Aircraft
Boeing 737-3B7
Operator
USAir
Status
Mechanical

Summary

On the evening of 8 September 1994, USAir Flight 427, a Boeing 737-300 descending toward Pittsburgh, rolled suddenly to the left, pitched over, and dived into wooded hills near Aliquippa, Pennsylvania. The aircraft struck the ground nose-low at high speed about six miles short of the runway. All 132 people aboard — 127 passengers and five crew — were killed. The upset took place in clear evening air in under thirty seconds, with no warning, no distress call that explained anything, and no obvious cause in the wreckage. For years it was one of the most baffling crashes in American aviation.

The aircraft had been mechanically airworthy on departure and the crew were experienced and unimpaired. What the investigation eventually established was that the 737's rudder had moved hard to the left while the pilots were commanding it the other way. As the aircraft passed through the wake turbulence of a Boeing 727 ahead and the crew worked to counter a mild roll, the main rudder power control unit's servo valve jammed in such a way that the rudder deflected opposite to the pilots' input — an uncommanded full rudder reversal. The first officer, flying, pressed harder on the right pedal precisely as the rudder swung fully left, and the aircraft rolled past the point of recovery at an altitude that left no room to save it.

The National Transportation Safety Board's investigation ran for more than four and a half years — at the time the longest in the agency's history — and adopted its final report, NTSB/AAR-99/01, in March 1999. Its probable cause was a loss of control resulting from the movement of the rudder to its blowdown limit in a direction opposite to that commanded by the flight crew. The mechanism was a jam of the main rudder PCU servo valve secondary slide to the servo valve housing, offset from its neutral position, with overtravel of the primary slide. Crucially, this finding also solved an earlier mystery: the unexplained 1991 crash of United Airlines Flight 585 at Colorado Springs, and a non-fatal 1996 upset of Eastwind Airlines Flight 517, were attributed to the same rudder failure mode.

The consequence was one of the most extensive flight-control redesigns in airliner history. The FAA ordered Boeing to redesign the 737 rudder control system across the entire fleet — thousands of aircraft worldwide — adding redundancy and eliminating the single-point failure the valve represented. The case also reshaped how the NTSB, manufacturers, and airlines work together on long, contested mechanical investigations.

Timeline

3 March 1991
An unsolved precursor
United Airlines Flight 585, a Boeing 737-200, rolls inverted and crashes on approach to Colorado Springs, killing 25; the NTSB cannot determine a cause and the case is left open.
8 September 1994, ~18:00 EDT
Departure
USAir Flight 427, a Boeing 737-3B7 registered N513AU, departs Chicago O'Hare for Pittsburgh with onward service to West Palm Beach, carrying 132 people.
8 September 1994, ~18:57 EDT
Approach into Pittsburgh
The aircraft descends toward runway 28R, slowing and configuring; ahead of it a Delta Boeing 727 has left a trail of wake turbulence.
19:02:57 EDT
Wake encounter
Flight 427 enters the 727's wake; thumps and a roll to the left begin, and the autopilot disconnects.
Seconds later
Rudder reverses
As the crew counters the roll, the rudder deflects hard left, opposite the pilots' inputs; the first officer presses the right pedal but the aircraft rolls further left and pitches down.
~19:03:25 EDT
Impact
About 28 seconds after entering the wake, the 737 strikes wooded terrain in Hopewell Township near Aliquippa, roughly six miles from the airport. All 132 aboard are killed.
1994–1996
A stalled, contested inquiry
The NTSB cannot reproduce the upset; Boeing and USAir's pilot union advance competing theories — pilot rudder input versus a mechanical fault — with no resolution.
9 June 1996
A survivor's clue
Eastwind Airlines Flight 517, a 737, suffers a brief uncommanded rudder event near Richmond but lands safely, giving investigators a recoverable case to study.
1996–1997
The valve recreated
Thermal-shock and rig testing show the PCU dual servo valve can jam and drive the rudder opposite to command; the failure mode is finally demonstrated.
24 March 1999
Probable cause
The NTSB adopts AAR-99/01, attributing the crash to an uncommanded rudder reversal from the jammed PCU servo valve and linking United 585 and Eastwind 517 to the same mechanism.
By September 2000
Fleet redesign
The FAA directs Boeing to redesign the 737 rudder system across all variants — more than 3,400 US-registered aircraft alone — adding redundancy to remove the single-point failure.

The Aircraft and the Approach

The Boeing 737-300 was, and remains, one of the most widely flown airliners in the world, and N513AU was a routine example of it: a healthy aircraft on a scheduled evening flight, crewed by Captain Peter Germano and First Officer Charles Emmett, both experienced and fully qualified. The leg from Chicago to Pittsburgh was the ordinary business of a domestic hub-and-spoke network. Weather was not a factor; the evening was clear and the approach unremarkable as the aircraft descended toward Pittsburgh and configured for landing.

The single environmental complication was a faint one. A Delta Air Lines Boeing 727 had passed along the same arrival path a short time earlier, leaving behind the invisible counter-rotating vortices that any large aircraft sheds — wake turbulence. Encountering another aircraft's wake is a common event, usually producing nothing worse than a brief jolt and a manageable roll. On a normal aircraft, the crew's standard control inputs would have damped it out within seconds. Flight 427 entered the 727's wake at 19:02:57, felt the expected thumps, and began to roll gently left, and First Officer Emmett, who was flying, responded as trained.

That ordinary moment is precisely what made the accident so dangerous to diagnose. There was no storm, no fire, no engine failure, no impairment, nothing in the flight plan or the maintenance record to point to. An airworthy 737 had encountered a routine wake at a routine altitude, and seconds later it was uncontrollable. For years the absence of an obvious external cause pushed the investigation toward the crew, even as the physical evidence stubbornly refused to fit a simple pilot-error story.

Twenty-Eight Seconds and a Hidden Valve

What actually happened unfolded in the rudder. As the aircraft rolled into the wake and Emmett worked the controls, the main rudder power control unit — the hydraulic actuator that moves the single large rudder — suffered a jam in its dual servo valve. Under the right combination of conditions, the valve's secondary slide could seize against its housing offset from neutral, and the primary slide could then overtravel, with the result that hydraulic pressure drove the rudder hard over in the direction opposite to the pilot's pedal command. Emmett was pressing the right pedal; the rudder went fully left, to its aerodynamic blowdown limit.

A full rudder deflection at the relatively low speed and altitude of an approach is close to unrecoverable. The aircraft yawed and rolled steeply left; the harder Emmett pushed for right rudder, the more the reversed surface resisted him. The 737 banked past 90 degrees, the nose dropped, and the aircraft entered a near-vertical descent. The cockpit voice recorder captured the crew's confusion and alarm — Captain Germano calling out as the G-forces built — but not comprehension, because nothing in their training told them the rudder itself had turned against them. About 28 seconds after entering the wake, the aircraft struck the ground nose-low and was destroyed. There were no survivors.

The destruction at impact erased the very evidence needed to read the valve. The PCU was recovered but bore no obvious jam, because a thermal or transient jam can release after the failure, leaving the hardware looking normal. This is why the investigation took so long: the failure mode was intermittent, condition-dependent, and self-erasing. Investigators could not simply point to a broken part; they had to prove that an apparently intact valve could, under specific circumstances, do something it was never supposed to do.

A Mystery Solved by Testing

For its first two years the inquiry was a stalemate, and at times an acrimonious one. The NTSB could not reproduce the upset, and two camps formed. Boeing argued the crew had applied and held inappropriate rudder; the air-line pilots' union and others argued for a mechanical fault in the rudder system. Each side had data and neither could close the case. The breakthrough came from two directions. First, the June 1996 Eastwind incident gave investigators a 737 whose crew had felt an uncommanded rudder movement and survived to describe it, providing a recoverable analogue to the fatal cases. Second, rigorous bench testing of the PCU finally exposed the mechanism: by thermally shocking a cold servo valve with hot hydraulic fluid, engineers reproduced a jam in which the rudder reversed against command.

That result reframed everything. It demonstrated that the 737's rudder could move opposite to the pilots' input, undetected, under conditions that could plausibly occur in service. The NTSB adopted AAR-99/01 on 24 March 1999, stating that the probable cause of the Flight 427 accident was a loss of control resulting from the rudder surface deflecting to its blowdown limit in a direction opposite to that commanded by the flight crew, most likely caused by a jam of the main rudder PCU servo valve secondary slide to the servo valve housing offset from its neutral position with overtravel of the primary slide. The Board also concluded that the same rudder failure mode had most likely caused the previously undetermined 1991 crash of United Flight 585 at Colorado Springs and the 1996 Eastwind upset.

Two crashes and a near-miss, spread across eight years, were thus tied to one design flaw in one component. The finding vindicated the years of testing and the refusal to settle for the simpler pilot-error narrative. It also illustrated a hard lesson about single-point failures: a control surface as powerful as the 737's single rudder, driven through one actuator with one valve, had no independent backstop if that valve misbehaved. The aircraft's defense against rudder hardover depended on the valve never failing — and it had failed at least three times.

The Five Factors

01
A single rudder with a single point of failure
The 737's large rudder was driven by one power control unit; a jam in its dual servo valve could deflect the surface fully and uncommanded with no independent override. Safety-critical actuation that powerful needs redundancy so that one component's misbehavior cannot command a catastrophic input. The redesign that followed added exactly that.
02
A failure mode that erased itself
A thermal or transient valve jam could release after the upset, leaving the recovered hardware looking normal. Failures that leave no trace defeat conventional wreckage analysis; investigators must be prepared to reproduce a fault by test rather than to find it in the debris, and designers must consider faults that hide.
03
Full rudder at low altitude is unrecoverable
A rudder hardover to the blowdown limit on approach left the crew no altitude and no procedure to escape it. The margin between a control malfunction and a crash collapses near the ground, so a failure mode survivable at cruise can be lethal in the final minutes of a flight.
04
A crew with no way to know
The pilots pushed for right rudder while the surface drove left, with no indication that the control had reversed and no training for a fault their manuals did not describe. Crews cannot recover from a failure the system hides from them; diagnosis and procedures must be provided for the failure modes a design admits.
05
Patterns across separate accidents
United 585, USAir 427, and Eastwind 517 were investigated as isolated events until the rudder mechanism connected them. Treating similar unexplained upsets in the same fleet as independent obscures a common cause; cross-case pattern analysis is itself a safety tool, and a single undetermined report should not close the question.

Aftermath

USAir 427 produced one of the most sweeping flight-control fixes in commercial aviation. Acting on the NTSB's findings, the FAA required Boeing to redesign the 737 rudder system across all variants — a fleet numbering in the thousands worldwide and more than 3,400 US-registered aircraft alone — to add redundancy and eliminate the servo-valve single-point failure, along with crew training and procedures for rudder anomalies. The retrofit programme stretched over years and stands as a model of a regulator forcing a fundamental design change on an in-service aircraft once a latent hazard was proven.

The investigation also changed institutional practice. Its length, its technical depth, and the early adversarial split between manufacturer and pilot representatives became a case study in managing contested mechanical inquiries and in the value of preserving every recoverable incident — the Eastwind near-miss being the clue that broke the case. For the families of the 132 dead, civil litigation against Boeing and the component makers proceeded over the following years, and the eventual closing of the file at least resolved the central question that had haunted the case from the first night: the aircraft, not the crew, had turned against the people flying it. The episode remains a touchstone for the principle that an unexplained crash is not a solved one, and that persistence — through years of testing — is sometimes the only path to the cause.

Lessons

  1. Build redundancy into powerful flight-control actuation; no single valve or unit should be able to command a full, uncommanded control deflection without an independent backstop.
  2. Anticipate failures that hide. A fault that releases and leaves intact-looking hardware must be reproducible by test, and designs should be assessed for the failure modes they can conceal from both crew and investigators.
  3. Give crews the indication and the procedure for every failure mode a design admits; pilots cannot recover from a malfunction the aircraft does not reveal to them.
  4. Treat similar unexplained upsets in the same fleet as possibly connected, not independent; cross-case analysis and preserved near-misses can expose a common cause a single accident cannot.
  5. Do not close an undetermined investigation prematurely; the persistence that solved Flight 427 also solved a crash three years older, and prevented others.

References