Missing retention bolt in elevator actuator mechanism led to crash of Emery jet
For want of proper maintenance, the retaining bolt was improperly installed. For want of the bolt, the elevator jammed. For want of redundancy, the pilots lost pitch control. For want of control, the airplane crashed.
While the proximate cause of the fatal Feb. 16, 2000, crash of an Emery Worldwide Airlines DC-8 freighter may track to actions not taken on the hangar floor, the ultimate cause links back to the design floor.
In terms of a “single point failure,” the accident is an important case study. The National Transportation Safety Board (NTSB) concluded its investigation into the crash of Emery Flight 17 last week with a battery of recommendations for improved maintenance. Also contained in the numerous recommendations is a call to retrofit all DC-8s with a more redundant flight control system. Such a mandate would affect 110 DC-9s in U.S. registered service (148 others are in service worldwide and 72 are stored).
No escape clause
The recommendation is significant because it does not leave the matter of retrofit optional, as occurred before. In its report of the fatal January 2000 crash of an Alaska Airlines MD-83 twinjet, also from a failed elevator control system, the safety board called for the installation of a fail-safe system “if practicable.” Those two words are absent in the board’s recommendations emanating from the Emery crash. To avoid an “unacceptable response” categorization by the NTSB, the Federal Aviation Administration (FAA) must mandate retrofit of a modified design. Compare the relevant recommendations:
Emery DC-8: “Require Boeing to redesign DC-8 elevator control tab installations and require all DC-8 operators to then retrofit these installations such that pilots are able to safely operate the airplane if the control tab becomes disconnected from the pushrod.” Recommendation #5 of 15 recommendations adopted Aug. 5.
Alaska MD-83: Conduct a systematic engineering review to … identify means to eliminate the catastrophic effects of total acme nut failure in the horizontal stabilizer trim system jackscrew assembly in Douglas DC-9, MD-80/90 and Boeing B717 series airplanes and require, if practicable, that such fail-safe mechanisms be incorporated in … all existing and future airplanes that are equipped with such … trim systems.” (Emphasis added) Recommendation A-02-49, adopted Dec. 30, 2002.
Of interest, the DC-9, MD-80/90 and B717 aircraft also feature tab-driven elevators.
Investigators first thought the crash of the Emery freighter was caused by an out-of-balance condition, as the flight crew reported such in their last radio transmission to air traffic control: “Emery 17, extreme CG [center of gravity] problem.” The crash seemed to repeat that of a Fine Air DC-8 freighter from an out of balance condition in 1997. But when it became evident that the Emery jet was within its weight and balance limits, investigators dug deeper. Anomalies in the elevator position during the doomed airplane’s brief flight pointed to a control problem.
Bolt in backwards
The left and right elevators on the DC-8 are moved up and down in response to aerodynamic forces on a control tab attached to each. The tab is moved up and down in response to a pushrod that is connected via cabling to the control yoke. Pull back on the stick and the control tab moves down. The resulting upward aerodynamic force on the tab moves the elevator trailing edge up, which in turn pushes the nose up. Push forward on the stick and the control tab moves up, forcing the elevator trailing edge down, thereby dropping the nose.
Each tab assembly depends on the integrity of a single bolt connecting the pushrod to the bellcrank, which is affixed to the tab. If the tab control mechanism on one side fails, causing the hinged elevator to move to the full trailing edge up position, the tab control system on the other side cannot overcome the failure, because the elevators have more nose-up than nose-down movement. The airplane was built to certification standards in effect more than 40 years ago, in which this kind of design was acceptable. Material submitted by the Air Line Pilots Association (ALPA) as part of the investigation address this issue of a single point failure. ALPA represented Emery pilots. The cargo carrier, described by Mark McConaughy, the FAA’s deputy operations inspector for Emery, as “the largest inexpensive airline in the world,” has since gone out of business (see ASW, July 1, 2002).
The elevator control system underwent maintenance when the accident airplane was overhauled in November 1999. This D check was performed by Tennessee Technical Services of Smyrna, Tenn., which was doing the work on contract to Emery. During the course of this work, the elevator assemblies were removed.
Eight days after the D check was completed, pilots reported that the elevators seemed stiff, requiring more back pressure to flare the aircraft on landing. Emery technicians found the elevator dampers had been reversed during the course of the work at Tennessee Tech. However, placing the dampers in their proper position would have had no effect in alleviating the control stiffness reported by pilots, NTSB investigator-in-charge Frank Hildrup said at the board hearing last week.
The area of interest was on the right side, where the control rod and tab fitting were found, but not the bolt connecting the two. Sources say the nut was found inside the elevator. The consequence of a bolt falling out of position would be significant. It could happen if put in backwards, without a cotter pin. As Hildrup explained, a disconnected pushrod could slide over the face of the left bracket on the tab fitting, “blocking the tab in the extreme down position.” Indeed, score marks on the fitting suggest contact damage from a loose pushrod banging against the fittings.
As the airplane gained speed on takeoff, the aerodynamic force on the full-down tab would force the elevator trailing edge up, causing the nose to rise. The pilots could push the yoke forward, applying full nose-down pitch, to no avail. This is exactly the situation captured on the flight data recorder (FDR).
The bolt fell out of its proper position either by the bump of touchdown on landing of the previous flight from Las Vegas, Nev., to Rancho Cordova, Calif., or it slipped out during the flight control checks conducted routinely before takeoff. This scenario is supported by the dramatic difference in recorded elevator position during the previous flight and the accident flight. On the accident flight, the elevators never moved to the trailing edge down position, even during the 80-knot check during takeoff, when pilots move the elevators as a last-minute procedure to ensure that they have full range of control motion.
Vulnerable to a maintenance mishap
The absence of a reliably redundant design left the system vulnerable to shortcomings in maintenance. Of these, there were plenty, according to the reams of documents and witness testimony amassed during the course of the investigation. During the NTSB’s May 2002 fact-finding hearing on the crash, Bruce Robbins, former director of engineering for Emery, characterized the maintenance deficiencies as “warts” that might be found in any operation. NTSB member John Goglia shot back, “I think we’ve found cancer.”
The hearings revealed egregious shortcomings in maintenance and maintenance oversight. Manuals, work cards, the continuing analysis and safety surveillance (CASS) program and other key elements of maintenance management and control ran the gamut from out-of-date to ignored to dysfunctional. McConaughy’s description of the situation he and other FAA inspectors found at Emery, as related to NTSB officials following the crash of Flight 17, provides a description of slackness beyond complacent and potentially criminal. McConaughy told NTSB investigators, “I suggested to my superiors the possibility that a criminal investigation needs to be opened … because … as far as these [maintenance] sign offs, I mean, you need to write ‘Once Upon a Time’ across the page because it’s a fairy tale.”
The Emery pilots union published a newsletter to its membership warning of “an increasing potential for disaster.” (See ASW, July 1, 2002) “Management makes minimal investment in … aircraft and our safety, as our aging DC-8 fleet …further deteriorates,” the newsletter said.
“Management has dealt us a losing hand and we are the ones who have everything to lose, not them!” the newsletter lamented.
That was in January 2000, published with chilling coincidence just before the Flight 17 crash.
Grounded too late?
In August 2001, FAA inspectors found more than 100 “apparent” violations and ordered the carrier to cease operations (see ASW, Aug. 20, 2001, and May 20, 2002).
Yet there are some who believe the FAA was not sufficiently aggressive in dealing with the regulatory evasions at Emery. Family members of pilots killed in the Emery and the earlier Fine Air crash asserted in a May 14, 2002, letter to every member of Congress that FAA oversight was lacking. Donald Land, father of copilot George Land on Emery Flight 17, charged that the FAA awarded airworthiness certificates to unqualified people and companies, and to Emery in particular. Even while under special FAA scrutiny, the airline “was still ignoring maintenance and line-safety issues by allowing continued operation of non-airworthy aircraft,” Land said. “It is time to stop the killings,” he pleaded.
In that correspondence to Congress, Audrey Ulozas and Deidre Thompson, mothers of the dead Fine Air pilots, were even more scorching in their criticism of the FAA:
“The FAA’s failure to provide adequate oversight, and enforce Federal Aviation Regulations, are direct causes of the Emery and Fine Air tragedies.
“Emery 17’s crash is the second time within 30 months that the FAA has dropped the ball. Eleven days before the Fine Air crash, it was reported to the FAA by another commercial airline pilot that he overheard [a] first office of Fine Air on the radio saying, ‘What are you trying to do, kill us?’
“For both Fine Air 101 and Emery 17, our government had advance knowledge that disaster was looming and in both cases chose to ignore it.”
In the NTSB’s findings in the crash of Emery Flight 17, short-comings in oversight were not mentioned. Nor was any FAA laxity mentioned in the probable cause. In two previous cases, the NTSB specifically cited shortcomings in FAA oversight as contributing factors.
NTSB chairman Ellen Engleman said the tragedy of Emery Flight 17 “illustrates the interdependence and critical roles and responsibilities of each member of the aviation safety chain.
“Safety requires 100 percent performance by everyone,” she said. “Everyone” includes, by implication, the FAA.
Nonetheless, ALPA officials asserted that the FAA skirted criticism. “The board’s recommendations hit on the technical issues and on the problems with the maintenance manuals, but in a perfect world the board could have been more specific about the FAA’s oversight of Emery and of cargo carriers in general,” said Capt. Terry McVenes, executive air safety vice-chairman at ALPA.
Shortly after the NTSB’s final hearing on the Emery crash adjourned, ALPA issued a statement expressing its view that the NTSB could have gone further:
“This investigation revealed significant safety issues in cargo airline operations, loading and maintenance practices, and FAA oversight. While … we are pleased with the recommendations the Board did make, we are disappointed that these recommendations did not go far enough in addressing deficiencies in corporate safety culture and FAA oversight.”
An industry source suggested an unofficial “nonaggression pact” presently exists between the NTSB and the FAA. Besides, the Department of Transportation/Inspector General (DOT/IG) already has roundly criticized FAA oversight of contract maintenance. (See ASW, July 21). The NTSB has little to gain by adding to the DOT/IG’s sweeping findings.
The NTSB’s technical focus in the Emery case appears to be part of a larger theme. It might be called the quest for reliable redundancy. In the aftermath of fatal crashes and incidents involving the B737 rudder, the safety board called for the retrofit of a “reliably redundant” rudder control system (see ASW, March 29, 1999, and April 26, 1999). The safety board urged a similar approach to the pitch trim system on Douglas-designed twinjets and their derivatives after the Alaska Flight 261 crash.
Now, in the Emery case, while the words “reliably redundant” do not appear specifically, that standard is the desired end-point in the redesign and retrofit of the control tab installations the board has called for on DC-8 aircraft. >> Engleman, tel. 202/314-6143; Goglia, tel. 202/314-6660 <<