In June 1997, the Safety Board participated in a ground demonstration conducted by Boeing at its facility in Seattle, Washington. The demonstration was intended to identify and document the cockpit characteristics of a rudder PCU servo valve secondary slide jam. The demonstration was accomplished in a newly manufactured 737-300 airplane that was fitted with a special tool to simulate a rudder PCU servo valve secondary slide jam at three different positions (about 0 percent, about 25 percent, and about 50 percent of travel from the neutral position). The demonstration was conducted while the airplane was parked on the ground with both engines off and with hydraulic systems powered by an external source of power.
Before the demonstration began, the participants sat in the pilot seats of another newly manufactured 737-300 and manipulated the rudder pedals to become familiar with the feel of a normally functioning 737 rudder system on the ground. The participants then moved to the airplane that was fitted with the special jamming tool, and each participant manipulated the rudder pedals under the three simulated rudder jam conditions. As recorded in the Human Performance Group Chairman’s addendum report, one Safety Board participant described the demonstration as follows:

All demonstrations were conducted in the cockpit, with Boeing test pilot…sitting in one of the pilot seats to coordinate the procedure…. When I was the active participant, I sat in the right seat wearing the seat belt.The first demonstration in the test airplane represented a jam of the secondary slide about 25 percent off [its] neutral position. I pushed the respective rudder pedals slowly to their full down positions as though I were performing a slow rudder system check. The right rudder pedal seemed easier to push down than the left pedal, although the difference seemed subtle. I then performed about 7 tests in which I [applied] hard left rudder. With one or two exceptions, this input triggered a rudder reversal on the pedals. Immediately after my input, the left rudder pedal began moving outwards until it reached the upper stop. The motion was slightly slower than an input I would expect from a human. The motion was steady and continued without pause no matter how hard I pushed to counter it ("unrelenting" was a description that, at the time, seemed to capture my impression)…. [When] I…"stopped fighting" the motion, [the] action of the rudder system ended almost immediately and the rudder pedals returned to the neutral position. On subsequent trials, I "stopped fighting" the rudder motion earlier, before the left pedal had reached the upper stop. Again, the rudder motion stopped almost immediately as soon as I stopped applying pressure, no matter where the pedal was located, and the pedals returned to neutral.
The second demonstration represented a jam of the secondary slide about 0 percent off [its] neutral position. I pushed each respective rudder pedal slowly to the lower stop as though performing a rudder system check. The right pedal again seemed easier to push than the left pedal, although the difference was small. I also pushed the rudder pedals aggressively and abruptly, but this did not produce a rudder reversal situation.
The third demonstration represented a jam of the secondary slide about 50 percent off [its] neutral position. I performed about 9 trials. WhenI moved the pedals slowly and steadily [as though performing a rudder system check], I was generally able to move the pedals to their stops without starting a reversal. Sometimes, however, even a slow input initiated a rudder reversal situation (this time with the right pedal moving to the upper stop). Any abrupt motion on the pedals initiated an immediate rudder reversal situation. The rudder reversal motion was faster than was the case with a jam in [the] 25 percent position, perhaps similar to a relaxed or slow input speed by a human operator. Again, it was impossible to stop the motion by physically pushing against the rudder pedal. On several trials, I tried relaxing my input momentarily before the rudder pedal reached the upper stop. I found that the rudder reversal motion continued.
This [was not true in the jam at the approximate 25 percent position], when the relaxation of pressure seemed to automatically stop the reversal motion. This motion was faster, easier to initiate, and more difficult to stop. Other participants reported similar experiences during the demonstrations. They described the rudder back pressure during the reversal as "machine-like," "startling," and "relentless."

About 7:03 P.M., September 8, 1994, USAir (now US Airways) Flight 427, a Boeing 737-300 airplane, crashed while maneuvering to land at Pittsburgh International Airport.
All 132 persons onboard were killed.
The accident led to the longest and one of the most difficult investigations in the history of the National Transportation Safety Board (NTSB), an independent agency of the United States government tasked with investigating major transportation accidents and making recommendations to prevent their recurrence. To reach its determination on the cause of the accident, issued at its public board meeting on March 24, 1999, the Safety Board drew heavily on a human performance effort that tried, by a variety of investigative approaches, to explain the pilots' actions during the most critical moments of the flight.

Human performance is routinely part of every major investigation conducted by the Safety Board. A human performance investigator launched with the team that responded to the accident, and a human performance group was formed at the site that collected medical, professional, and personal evidence on the pilots. All evidence appeared routine.

The flight data recorder (FDR) on Flight 427 was unusually limited. It recorded only 11 parameters, providing no data for such major variables as aileron and rudder position. However, analysis of the FDR information indicated that a rudder motion could underlie the accident sequence. The motion of the airplane was smooth until, about 5,000 feet above the ground, the airplane encountered turbulence due to the wake of another airplane and entered a left roll from which it never recovered. The wake turbulence itself would not have been sufficient to cause the accident, as confirmed by flight testing, but a full left rudder motion beginning shortly after the wake encounter and maintained until impact (or near impact) would recreate the motion of the accident airplane. Engineering analysis indicated that only a full rudder motion, of all control surface combinations, would recreate the accident profile, while investigative evidence discounted alternative explanations such as midair collision, bird strike, or structural damage.

Based on this evidence, the investigation began to center on rudder issues. The Systems Group attempted to identify hardware failures that might lead to a full rudder input, while the Human Performance Group attempted to collect available human evidence to judge whether the pilots might have input full rudder inappropriately following a wake turbulence penetration. Beginning about one year after the accident, an expanded Human Performance group began an enlarged investigation during which the group:

• Reviewed in detail the accident pilots' flying and medical histories.
• Reviewed and analyzed wreckage information on seat position and rudder pedal damage for suggestions of control use at the moment of impact.
• Conducted ergonomic studies of leg force application on the B-737 rudder pedal, including issues involved in crew physical dimensions and B-737 anthropometric seat design limits.
• Conducted speech analysis on the audio recording of the cockpit voice recorder (CVR) in an attempt to extract additional information on crew actions.
• Recreated and analyzed the motions, visual cues, and auditory cues of the last minute of the accident flight, using large motion simulators at NASA and Boeing, by pairing the FDR-recorded motions with the CVR-recorded sounds.
• Analyzed the air traffic control view of the accident situation recreated by the FAA's Systematic Air Traffic Operations Research Initiative (SATORI).
• Reviewed evidence of pilot responses to wake turbulence and other upsets in available accident/incident records as well as interviews conducted by the group.
• Obtained from NASA's Aviation Safety Reporting System (ASRS) a structured callback project on in-flight upsets, involving a detailed interviewing of all airlines pilots who reported a multi-engine, turbojet upset between May-October 1995 [in addition to reviewing evidence from an ongoing ASRS callback project on wake turbulence penetrations].
• Reviewed evidence from the quick access recorder (QAR) project conducted as part of the investigation, involving in-flight rudder usage during about 57,000 hours of revenue passenger service by Boeing 737 pilots on a European airline between May 1996 to June 1997.

Many of these approaches were unusual for an investigation. For example, the pairing of FDR and CVR information in a large motion simulator was novel. The Vertical Motion Simulator (VMS) at NASA-Ames Research Center, which was used in one of these efforts, is the world's largest motion simulator (with 60 feet of vertical travel). NASA and Safety Board staff cooperated to develop a simulation that accurately represented the flight dynamics, accelerations, and visual cues of the final minute of the accident flight. By approval of the Board members, the appropriate segment of the CVR audio recording was allowed to be played outside of the Safety Board facilities for the first time so that it could be paired with this motion simulation. The members of the Human Performance Group experienced the resulting simulation numerous times, riding in the simulator cab with motion/speech cues only, with motion/speech/visual cues, and with sections of the simulation emphasized, in an effort to understand the cues experienced by the accident pilots that were reflected in their responses. In support of the human performance effort, an expert in human spatial orientation experienced this motion simulation and advised that disorientation of the accident pilots was unlikely (due, especially, to the clear visual conditions present at the time of the accident). In addition, three members of the Safety Board experienced this simulation as part of their effort to better understand the accident and determine a probable cause.

Another initiative of the human performance investigation was to conduct an extensive review of available accident/incident information to identify the action of pilots involved in upset situations that resembled those of the accident. For example, as a result of this review and a search of the FAA's Pilot Incapacitation database, the Human Performance Group identified two airline incidents in which pilots in revenue passenger service were confronted without warning with a full rudder deflection. Both cases involved Boeing 737 airplanes on final approach to landing

One airplane was below 600 feet in gusty conditions, while the other was at 1,500 feet in instrument conditions. In both cases, the rudder moved to full deflection as the result of the sudden medical incapacitation of the flying pilot with the pilot's leg becoming rigid on the rudder pedal. The Human Performance Group was interested in the responses of the nonflying pilots who, although startled, took control of the airplane in both cases and affected a safe missed approach and subsequent landing.

One of the most important sources of evidence proved to be speech analysis on the CVR recording. The CVR provided audio recordings of the last 30 minutes of the accident flight captured both from an overhead cockpit microphone and from individual boom microphones worn by the crewmembers. Recording quality was excellent and allowed speech analysis. Speech was clearly understood, breathing was often audible, and computer analysis could be made of acoustic aspects of speech including fundamental frequency ("pitch"), amplitude ("loudness"), and speaking rate. In addition to making laboratory measurements, the Safety Board enlisted the help of three outside experts' to provide written observations on different aspects of speech for use by the Human Performance Group in evaluating the CVR information.

Speech analysis provided clear insights on the crew responses. Prior to the wake turbulence encounter, cockpit communications were routine. The captain responded to the turbulence with an immediate exclamation ("sheeze"), followed, during the 25 second upset period before impact, by comments related to the ongoing problems ("hang on," "what the hell is this?"). Shortly before impact, the captain made a transmission to Air Traffic Control advising that the airplane was experiencing an emergency. Speech analysis indicated that the captain's respiration rate increased over the course of the upset period. Fundamental frequency and amplitude measures showed a similar increase. Yet the fact that the captain made an emergency transmission, and level of his speech characteristics during the transmission, suggested that the captain had not reached panic levels at this time. Rather, there was an impression of a pilot trying to deal with a problem and showing increased psychological stress as his efforts were unsuccessful.

In the case of the first officer, who was the flying pilot, speech analysis highlighted an important observation. The first officer was talking at the time of the wake penetration, but interrupted his speech and said little other than emotional exclamations during the upset period. However, he emitted short grunting sounds during the first seconds of the upset. Normal use of the cockpit controls should not produce these types of straining sounds. No similar sounds were recorded from the captain during this period.

The importance of the human evidence became clear as the investigation advanced and uncovered a possible new failure mechanism in the rudder system. By 1997, the Systems Group determined that, under very rare circumstances, a jam in the rudder power control unit (PCU) servo valve could cause a rudder reversal problem in which the rudder moved in the direction opposite to that commanded by the pilot. A human performance investigator, participating in a demonstration prepared by Boeing, found that a pilot would have difficulty understanding or stopping this reversal. The pilot, pushing down on the pedal to make a small input, would find that the pedal was unusually stiff or that the pedal might start to rise in a direction opposite to the input. Pushing harder would not help. A pilot would not be strong enough to overpower the hydraulic system and, as long as the pilot maintained pressure on the pedal, the rudder itself would move fully over in the opposite direction to that being commanded.

By contrast, the human performance evidence did not support an explanation of the accident based only on pilot input. To cause the accident, a pilot would have to input full left rudder early in the upset period, hold this input for at least 10 seconds as the airplane lost control, and the second pilot would have to allow this wrong input to be maintained. The human performance investigation could provide no plausible explanation under which this might have happened.
Airline pilots routinely recover from wake turbulence encounters, even those described as "startling" and extreme, and often from altitudes lower than that of Flight 427 (according to ASRS records). No airline accidents in the United States have been caused by wake turbulence encounters from the altitude of Flight 427 (according to NTSB records). Although pilots have entered inappropriate rudder inputs during emergency upset situations, no instance could be found in which a pilot held a wrong rudder input when it caused the airplane to go visibly out of control (according to a review of worldwide accident/incident records). No instances were found in which pilots entered a full rudder input for any reason during Boeing 737 revenue flights (according to the QAR project). No instances were found in which a pilot, confronted by a surprise full rudder input, failed to take appropriate corrective action. On balance, the human performance evidence could not explain why a pilot would make a full rudder input, why the pilot would hold this wrong input as the airplane went out of control, and why the second pilot would allow this to happen.

As part of the Flight 427 investigation, the NTSB examined a previous Boeing 737 accident at Colorado Springs, on March 3, 1991, involving United Airlines Flight 585. It also examined a Boeing 737 incident at Richmond, Virginia, on June 9, 1996, involving Eastwind Airlines Flight 517. In both cases, the human evidence (including self-report of the surviving pilots) was found to be consistent with a rudder reversal scenario.

The Safely Board determined that the probable cause of the USAir 427 accident was "a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide."

In reaching its determination, the Safety Board drew on an active human performance investigation.