Systemic Pre-Crash Shortcomings Criticized

Inadequate redundancy, slipshod maintenance, and a near complete lack of regulatory oversight set the stage for the fatal crash of an Alaska Airlines [ALK] twinjet, according to pilot and mechanics union analyses.

Their blunt commentaries were submitted to the National Transportation Safety Board (NTSB) in the run-up to the board's final hearing this week into the Jan. 31, 2000, crash of the Alaska MD-83 twinjet, operating as Flight 261 on a flight from Puerto Vallarta, Mexico, to Seattle, Washington.

The board apparently is endeavoring to close this case before the third anniversary of the crash. The airplane crashed when the horizontal stabilizer jammed and, after repeated attempts by the pilots to regain some measure of pitch trim control (i.e., multiple circuit breaker resets), the stabilizer snapped off the airplane. All 88 passengers and crew were pitched to their doom. Whether the board calls for a "reliably redundant" horizontal stabilizer control system remains to be seen. Some sources say that the board would be wholly inconsistent in not pursuing a reliably redundant system for the fleet of Douglas-built twinjets, as it has in the case of the Boeing [BA] B737 fleet. The Federal Aviation Administration (FAA) recently announced its endorsement of Boeing's proposed rudder system redesign, which was developed in direct response to NTSB urging for greater built-in redundancy (see ASW, Oct. 14).

In the case of the Douglas twinjet fleet, the horizontal stabilizer is controlled by a single jackscrew and acme nut, in which redundancy supposedly was inherent to the design, in the form of a torque tube inside the jackscrew and dual threads in the acme nut. On the Douglas four-engine DC-8, redundancy was achieved through the use of two separate jackscrew assemblies to control the horizontal stabilizer. However, when the threads were virtually stripped off the single acme nut in the T-tail of the accident airplane, the jackscrew broke free, and the stabilizer to which it was attached blew off the airplane. National Aeronautics and Space Administration (NASA) engineers at the Kennedy Space Center have developed a failsafe jackscrew that they believe is eminently suitable precisely for preventing the kind of mechanical failure that downed Flight 261 (see ASW, Nov. 18).

However, should the NTSB limit its recommendations to improved maintenance practices, it is interesting to note that both the pilot and maintenance technician unions submissions to the docket fall short of recommending the retrofit of a reliably redundant horizontal stabilizer system - despite their sharp criticisms about the lack of redundancy in the current design.

The Air Line Pilots Association (ALPA) submission comes closest, recommending a "mechanical system" to prevent a flight control system from "reaching a position [where] the flightcrew would be unable to overcome the failure through other means." A failsafe jackscrew would satisfy this call.

The ALPA submission and that of the Aircraft Mechanics Fraternal Association (AMFA) shows that both the pilots and the maintainers are equally critical of the stabilizer control system's design, the extension of maintenance intervals without supporting justification, and the absence of adequate FAA oversight. They make their case in comments that run collectively to nearly 100 pages. Highlights presented here illustrate deficiencies and disparities that culminated in the crash.

Not reliably redundant

ALPA (extracts):

Case: "The horizontal stabilizer jackscrew components were considered a 'structural element' by the FAA. Because the assembly was considered a structural element, 'wear' was not considered a failure mode during certification ... as the FAA determined that 'wear' would be detected and corrected under an approved maintenance program.

"Wear to the acme nut was not monitored ... [the] alleged redundancy did not provide protection against this particular failure mode.

"FAR Part 25 airworthiness standards are based on the 'Failsafe Design Concept.' It is unlikely that the trim system of this derivative of the DC-9 would meet this Failsafe Design Concept."

Conclusion: "The certification requirements should be reviewed to determine whether they provide for an appropriate level of safety in component design."

Recommendation: "The FAA's concept of 'structural element' should be revisited."

AMFA (extracts):

Case: "According to the type certificate, the longitudinal trim system meets the requirements of CAR 4b, section 4b.320 entitled 'General Control Systems.' This section does not have requirements for catastrophic failure of flight control systems.

"The MD-83 is certificated as a derivative of the DC-9. CAR 4b was recodified to become FAR Part 25.

"Sect. 4b.322, Trim Control and Systems, states in part, 'Trim devices shall be capable of continued normal operation in the event of failure of any one connecting or transmitting element of the primary flight control system.

"The manufacturer concluded, in the DC-9 Flight Controls System Fault Analysis, that the failure mode of excessively worn acme nut threads was not formally considered."

Conclusions: "AMFA believes the certification of the MD-80 aircraft was without adequate redundancy.

"The NTSB investigation determined that the dual threads of the acme nut/screw assembly wore evenly, to a point of failure. With this fact in mind, AMFA questions the redundancy of the design."

Recommendation: " 'Hard time' flight critical components, such as the horizontal jackscrew assembly."

A fatal maintenance mishap

ALPA (extracts):

Case: "As the lubrication intervals for the stabilizer jackscrew assembly were being escalated ... the inspection end-play check intervals were not shortened in order to monitor the effects of the decreased frequency of lubrication.

"End-play checks were not recorded, nor were acme screw and nut wear rates tracked. Had this been a requirement, the accelerated wear rate on the accident component could have been identified and the accident might have been avoided. [ASW note: the endplay check measures the movement between mated threads of the jackscrew and acme nut. The greater the "play," the greater the evidence of wear. When the endplay measures 0.004 inches, the jackscrew and acme nut must be replaced. This was not done when the end-play check showed this degree of wear during the accident airplane's last heavy maintenance check in September 1997, 28 months before the crash. Rather, the end-play check was ordered redone until a measurement within limits was achieved and the costly jackscrew assembly, not in stock, did not have to be ordered, which would have delayed the airplane's return to service.]

"The ... next scheduled end-play check was not scheduled until May 2000, a 32-month interval.

"If the recommendations ... of the MSG-3 [maintenance steering group] MRB [maintenance review board] had been adhered to ... one additional end-play check would have been accomplished prior to the accident. This check was not conducted."

Conclusion: "Alaska Airlines extended their lubrication intervals based upon non-existent information and the FAA's oversight allowed these escalations to occur."

Recommendation: "The FAA must require the operators to record, retain and track all horizontal stabilizer end-play check measurements."

AMFA (extracts)

Case: "It should be noted in measuring the wear of the acme nut, only that portion of the threads with the least amount of wear [is] actually measured.

"At the time of the accident, Alaska Airlines called out for three different grease types and/or specifications in three different maintenance documents [emphasis in original]. The mixture of 90/10% or 10/90% of the two greases indicated a tendency for the clay-based Aeroshell 33 [green tint] to cause a 'washout' of the Mobilgrease 28 [red tint] lithium soap-based grease. This anomaly degrades the lubricating properties of both greases.

"The FAA allowed Alaska Airlines to drop the '3,600 flight hour' for their 'C1' check interval and go with 15 calendar months only.

"A 'Fly Fast' program was initiated, which resulted in even higher aircraft utilization [flight hours/cycles] between 'C' checks. In doing so, Alaska Airlines increased their average flight hours per day, thereby increasing the flight hours between 'C' checks."

"The acme nut/screw assembly has no reservoir to provide further lubrication to the system."

Conclusion: "Alaska Airlines' escalation of increased maintenance intervals over a continued period of time [left] the acme nut/screw threads without adequate lubrication."

Recommendations: "Air carriers and the FAA must not rely on 'tacit' or assumed approval for ... changes such as escalations for inspections ... lubrication ... [and] lubricants.

"Record and track all wear rate information for all flight critical components."

Inadequate oversight

ALPA (extracts):

Case: "The FAA's MRB document is simply an acceptance of MSG standards ... the FAA ... allows the industry group to totally direct and control these standards for maintenance programs. It is self-evident that the groups represented benefit from designing these programs to be as economical as possible."

Conclusion: "The FAA is not a safety net and ... FAA oversight of this entire process is systematically deficient."

Recommendation: "The FAA must ... improve its policies with respect to ... the tenure of its inspectors ... as well as its supervisory staff to prevent improper relationships with their certificate holders and misconduct on the part of inspectors and managers.

AMFA (extracts)

Case: "FAA staffing levels at the Alaska Airlines CMT [certificate management team] were below staffing levels of similar sized carriers ... According to a Nov. 12, 1999 FAA memorandum ... America West Airlines had 26% more aircraft and 175% more FAA staff. The same was true at Trans World Airlines - 133% more aircraft and 250% more FAA staff.

"Surveillance of Alaska Airlines decreased under ATOS [air transport oversight system] due to:

• Only ATOS inspectors assigned to a specific carrier are allowed to inspect that carrier.
• The inspectors assigned to Alaska ... were too busy conducting required ATOS safety attribute inspections ... to conduct surveillance at levels ... prior to ATOS implementation."

Conclusion: "Despite being in place since Oct. 1, 1998, the ATOS program failed to find and correct the issues surrounding the Flight 261 accident."

Recommendations: "Eliminate the FAA's ATOS system. Adopt a new system of surveillance, regulatory compliance and oversight.

"The ATOS program, if retained, should be modified to include more inspectors. A reduction in the number of airlines participating in the ATOS program should be adopted until ... procedures, staffing and training are put into place and proven to be effective."

The NTSB findings may be predictable from the tenor and implications of the ALPA/AMFA submissions. In terms of probable cause, there may be nothing really probable about it. The accident chain was completed via cost-conscious maintenance priorities and a flight crew focused on aerial trouble shooting. The pilots may be criticized for resetting the circuit breaker(s) and carrying out airborne experimentation which resulted in stripping the thread (instead of freezing everything and landing much earlier). However, the pilots were being subtly pressured by Alaska staff on the ground to continue the flight, at least to San Francisco rather than divert to Los Angeles. It is a case study in the bitter triumph of economics over safety.

Despite all of these factors, had the accident aircraft been outfitted with a failsafe jackscrew, the follower nut in such an assembly would have held after all the other "protections" - design, certification, maintenance and oversight - fell by the wayside. The headwaters of the case begin the lack of reliable redundancy.