65. A particular stimulus to our inquiry was the recent high-profile accidents, in particular the crash of a Boeing 747-100 operated by TWA off New York on 17 July 1996, killing all 230 people on board, and that of a McDonnell-Douglas MD11 operated by Swissair off Nova Scotia on 2 September 1998, killing all 229 people on board. We also considered the apparent spate of incidents involving Boeing 737s, including the accident at Pittsburgh on 9 August 1994, and the United Airlines crash at Colorado Springs on 3 March 1991.

The TWA800 and Swissair flight 111 accidents

66. Despite the speculation about the TWA800 crash which immediately followed the accident,[170] its cause is now clear: there was an explosion in the main fuel tank, which caused the aircraft to break up in flight. As the Chief Inspector of Air Accidents told us, however, "what happened is understood. Why, is not".[171] Boeing said that "it looks like there was a fuel tank explosion that was started by some unknown means that caused the airplane to crash".[172] The suspected cause of the explosion is the "wiring associated with the fuel contents systems",[173] and the fuel pumps themselves. In short, it is suspected that damage to the wiring of a fuel pump caused an electrical spark, which ignited fuel vapours in the main fuel tank. As a result, Boeing, together with the Federal Aviation Administration, have made a number of recommendations to airlines and regulatory authorities around the world, including that they should inspect fuel tanks on aircraft already in service, and service and improve the electrical system around the fuel tank.[174] Boeing has itself "made some improvements to the fuel pumps".[175] This response, Boeing said, was a typical "safeguard to improve ... safety when we do not have a definitive cause in hand".[176]

67. The cause of the Swissair crash is also not yet fully understood. The pilots of the aircraft reported smoke in the cockpit, and diverted their aircraft initially towards Boston, and then towards Halifax, Nova Scotia. They then undertook a manoeuvre to allow time to dump fuel from the aircraft, before finally crashing several minutes after the emergency was first announced. The Chief Inspector of Air Accidents told us that "the fire which caused the loss of the Swissair aircraft is thought to be associated with a wiring problem".[177] Our witnesses from Boeing, which has recently taken over McDonnell-Douglas, told us that "there was some wire chafing that was found",[178] which may have ignited the fire. The wiring in a new in-flight entertainment system installed for first-class passengers has been suggested as the most likely cause of the fire.[179]

68. British Airways, at the time of our inquiry, operated 25 Boeing 747-100 and 747-200 aircraft, and 51 Boeing 747-400s, whilst Virgin Atlantic had eleven Boeing 747s in all.[180] No other British airline operates Boeing 747s, and no British airline operates MD11s. We were pleased to note that both British Airways and Virgin had complied with the various interim Airworthiness Directives relating to the TWA800 accident, and have completed inspections of wiring, fuel pumps, and check valves.[181] Although it does not operate Boeing 747s, British Midland assured us that they had applied "very quickly the lessons that have come out of the inquiry [into TWA800]. For instance, on the Boeing 737s we have checked all the fuel tank wiring on every aircraft that has come into our maintenance bays for wiring problems".[182] Britannia Airways told us that it "always follows the manufacturers' recommendations as soon as they come out",[183] and easyJet said that in response to Boeing's recommendations it had "completed a fleet-wide inspection".[184] The TWA800 and the Swissair crashes remain the subjects of inquiries by, respectively, the United States National Transportation Safety Board and the Canadian Transportation Safety Board. We trust that all British airlines will respond quickly to any further recommendations that arise from those inquiries.

69. Despite the fact that it does not operate MD11 aircraft, British Airways told us that it had "re-examined [its] procedures for cabin fires in the air, especially the advice on overweight landings, following Swissair 111".[185] It has been suggested that if the crew of the Swissair flight had not chosen to dump fuel prior to landing at Halifax the aircraft would have had time to land. The Safety Regulation Group said that advice that "you do not waste time burning off fuel ... [since] aircraft are able to land overweight"[186] was already written into flight manuals and operating manuals, and that since the Swissair crash it had "made sure that airlines reinforce this advice ... to make sure people are not conditioned in taking one action at the expense of another".[187] We recommend that the Safety Regulation Group re-iterates its advice to airlines that the priority in certain emergencies, such as in-flight fires, is to land, rather than to seek to dump fuel in order to avoid an overweight landing. It should ensure through its inspections that airlines are passing on that information to aircrews. Furthermore, we recommend that air traffic controllers be given similar advice, so that they are able to respond appropriately to such emergencies.

Boeing 737 incidents

70. On 3 March 1991, a United Airlines Boeing 737-291 crashed just before landing at Colorado Springs airport. The cause of the accident was described as "loss of control for undetermined reasons".[188] As it began its final approach to the airport, the aircraft rolled to the right, and pitched its nose downwards, "until it reached a nearly vertical attitude before hitting the ground".[189] All 25 people on board were killed. The National Transportation Safety Board believed at the time that the most likely reason for the change in the aircraft's attitude was an unusual wind vortex, or 'rotor'. In recent years, however, the National Transportation Safety Board has begun to consider the possible cause of the crash as being a rudder malfunction.[190]

71. On 8 September 1994, USAir flight 427, a Boeing 737-300 crashed near Pittsburgh, again just prior to landing. On this occasion the aircraft suddenly began to descend at an angle of approximately 80 degrees, and hit the ground at about 260 knots. All 132 people on board were killed.[191] The subsequent National Transportation Safety Board inquiry "determined that at the start of the upset, there was an uncommanded rudder displacement that exceeded the normal operating limits of the yaw damper system".[192] On 9 June 1996, a Boeing 737-200 operated by Eastwind Airlines experienced a similar uncommanded rudder displacement, which led the aircraft to roll and yaw, on approach to Richmond, Virginia. In that case the crew were able to regain control of the aircraft, and no-one was injured.[193]

72. The reason for the uncontrolled rudder displacement, commonly described as a 'rudder hard-over' or 'rudder jam', is a matter of some contention: Boeing told us that "there is no definitive evidence ... that there was a rudder jam. I think they [the National Transportation Safety Board] said that the evidence was consistent with a jam, but there was in fact no physical evidence that said that the rudder jammed".[194] Nevertheless, the National Transportation Safety Board has made a number of recommendations as a result of these incidents, and consequently the Federal Aviation Administration, together with Boeing, has taken steps to address the issue.

73. There are two aspects to what British Airways called the "Boeing 737 rudder problem".[195] The first is a potential failure of the yaw damper, a device which is attached to the rudder to limit some of the oscillations of the aircraft in flight, caused by "corrosion of an electrical coupling within the yaw damper".[196] British Airways said that it was first found by one of its aircraft on a test flight, and that it had "worked with the manufacturer [Boeing] to determine exactly what the cause was, and that work resulted in an Air Worthiness Directive being issued to all operators of the Boeing 737".[197] Boeing acknowledged that in 1996 it had identified this problem, and that it was "currently ... retro-fitting some 3,000 plus airplanes that were subject to this unlikely event. All those airplanes had to be refitted, according to the Federal Aviation Administration, by August of this year [1999]".[198]

74. The second issue is that the unit which controls the rudder "has a known failure mode which can result in what is called a rudder hard-over... the original certification of the 737 should prove that in the event of rudder hard-over lateral control could still be maintained by use of ailerons, but it was found that at certain speeds there was not enough aerodynamic force available within the ailerons to maintain lateral control".[199] In other words, a malfunction in the rudder control unit which causes a rudder hard-over can be overcome by using other controls, such as the ailerons, but at low speed the flow of air over the ailerons is insufficient to allow the aircraft to recover in this way. Consequently the National Transportation Safety Board recommended that airlines should provide training to aircrews "in the recognition of and recovery from unusual attitudes and upset manoeuvres".[200] The Safety Regulation Group told us, "pilots have ... been briefed as how best to deal with a rudder malfunction so that they continue to fly the aircraft should one occur".[201] In essence, pilots have been trained to use different thrust speeds from the engines, as well as adjusting their flaps, in order to correct a rudder hard-over.

75. It is important to be balanced in this matter: the Boeing 737 has an excellent safety record, having flown more than 80 million hours since 1980[202] with relatively few mishaps. Even so, we are convinced that there is or has been a problem with its rudder, which may cause rudder hard-overs: all of our witnesses, except Boeing themselves, accepted that fact either implicitly or explicitly. It is a problem of particular concern to the United Kingdom, since "we have the largest Boeing 737 fleet in Europe, some 127 aeroplanes":[203] of the airlines we took oral evidence from, British Airways, British Midland, and easyJet all operate Boeing 737s. We note the steps already taken to address the problem, and recommend that any further recommendations that arise from investigations into the accidents involving Boeing 737s are rapidly implemented by British airlines. We further recommend that the Safety Regulation Group should closely monitor the situation, to ensure that all necessary steps to deal with the problem with the aircraft's rudder are taken.

76. During our inquiry we sought to compare the response of regulators to a safety issue such as the potential failure of the Boeing 737 rudder to the steps taken as a result of an accident at Chicago in 1979 involving a DC10. In that case the entire fleet of DC10s worldwide was 'grounded' immediately after the crash until the problem was put right. We asked why the regulatory authorities had not taken a similar approach to Boeing 737s following the accidents in which they had been involved.

77. One of our witnesses, Mr Frank Taylor, of Cranfield College of Aeronautics, told us that "in 1974 the Federal Aviation Administration were found by most people to have grossly under-reacted to an earlier accident in 1972 when a cargo door came off a DC10. I believe a gross under-reaction in 1974 led to a gross over-reaction in 1979".[204] The Chief Inspector of Air Accidents pointed out that 'grounding' was a colloquial expression: aircraft are occasionally prevented from flying "pending inspections for a specific purpose, and that was the case with the DC10 and has been the case with other aircraft".[205] Since the cause of the accidents involving Boeing 737s, and for that matter the TWA800 and the Swissair crashes, were not immediately apparent, there was no good reason to prevent the aircraft from flying.

Litigation and its impact on aircraft manufacturers, operators and others

78. The evidence we took about Boeing 737s showed that there is a possibility that the operators' and manufacturers' fear of litigation might undermine open discussion about the cause of an accident. Although we make no particular allegation about the evidence we received from Boeing, the company's insistence on reminding us that "there has never been any evidence to show what caused the rudder jam [on the USAir flight]",[206] and that "there is no evidence ... that there was a rudder jam",[207] caused us some concern. After all, if an airline manufacturer admits that there is a fault in an aircraft which has crashed, it opens itself to the risk of litigation, and the damages which that might occasion, particularly in countries like the United States. The manufacturer may instead attempt to insist that some other factor contributed to the accident, such as pilot error, hampering attempts to ensure that such an incident does not occur again.

79. We recognise that this is a delicate matter. We do not suggest that the rights of injured passengers, or the relatives of those who have died, to seek compensation should be overly curtailed: nor do we wish to create a situation where disreputable or negligent manufacturers or airlines get away scot-free. Nevertheless, we believe that an appropriate balance can be struck. We recommend that the Government should open a dialogue with interested parties, both within the industry and outside, to consider limiting to a sensible level the liability of manufacturers and operators in the event of aviation accidents. It should explore such matters within relevant international fora, with the objective of limiting liability worldwide. We believe that such a step may help to encourage greater openness about safety matters in the aftermath of accidents.