7263E E P L U R I B U S U

N U M

N A T I O N A

L

T

R A S P O

R T A T

I O N

B O

A

R D S A F E

T Y N 

## National Transportation Safety Board

Washington, D.C. 20594



### Safety Recommendation

Date: January 8, 2003

In reply refer to: A-02-36 through -51 Honorable Marion C. Blakey

Administrator

Federal Aviation Administration Washington, D.C. 20591

On January 31, 2000, about 1621 Pacific standard time, Alaska Airlines, Inc., flight 261, a McDonnell Douglas MD-83, N963AS, crashed into the Pacific Ocean about 2.7 miles north of Anacapa Island, California. The 2 pilots, 3 cabin crewmembers, and 83 passengers on board were killed, and the airplane was destroyed by impact forces. Flight 261 was operating as a scheduled international passenger flight under the provisions of 14 Code of Federal Regulations (CFR) Part 121 from Lic Gustavo Diaz Ordaz International Airport (PVR), Puerto Vallarta, Mexico, to Seattle-Tacoma International Airport (SEA), Seattle, Washington, with an intermediate stop planned at San Francisco International Airport (SFO), San Francisco, California. Visual meteorological conditions prevailed for the flight, which operated on an instrument flight rules flight plan. 1

The National Transportation Safety Board determined that the probable cause of this accident was a loss of airplane pitch control resulting from the in-flight failure of the horizontal stabilizer trim system jackscrew assembly’s acme nut threads. The thread failure was caused by excessive wear resulting from Alaska Airlines’ insufficient lubrication of the jackscrew assembly. Contributing to the accident were Alaska Airlines’ extended lubrication interval and the Federal Aviation Administration’s (FAA) approval of that extension, which increased the likelihood that a missed or inadequate lubrication would result in excessive wear of the acme nut threads, and Alaska Airlines’ extended end play check interval and the FAA’s approval of that extension, which allowed the excessive wear of the acme nut threads to progress to failure without the opportunity for detection. Also contributing to the accident was the absence on the McDonnell Douglas MD-80 (MD-80) of a fail-safe mechanism to prevent the catastrophic

effects of total acme nut thread loss. 2

1 For more detailed information about this accident, see National Transportation Safety Board. Loss of Control and Impact with Pacific Ocean, Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, About 2.7 Miles North of Anacapa Island, California, January 31, 2000. Aircraft Accident Report NTSB/AAR-02/02. Washington, DC.

2 Additional safety recommendations resulting from this accident investigation were addressed to the FAA in an October 1, 2001, safety recommendation letter (Safety Recommendations A-01-41 through -48).2

Accident Sequence 3

The Safety Board determined that the longitudinal trim control system on the accident airplane was functioning normally during the initial phase of the accident flight, but that the horizontal stabilizer stopped responding to autopilot and pilot commands after the airplane passed through 23,400 feet. The pilots recognized that the longitudinal trim control system was jammed, but neither they nor the Alaska Airlines maintenance personnel could determine the cause of the jam. 4 When the acme screw and nut jammed, this prevented further movement of the horizontal stabilizer until the initial dive. The initial dive from 31,050 feet began when the jam between the acme screw and nut was overcome as a result of the operation of the primary trim

motor. 5 Release of the jam allowed the acme screw to pull up through the acme nut, causing the horizontal stabilizer leading edge to move upward, thus causing the airplane to pitch rapidly downward. The acme screw did not completely separate from the acme nut during the initial dive because the screw’s lower mechanical stop was restrained by the lower surface of the acme nut until just before the second and final dive about 10 minutes later.

The Safety Board determined that the cause of the final dive was the low-cycle fatigue fracture of the torque tube, followed by the failure of the vertical stabilizer tip fairing brackets, which allowed the horizontal stabilizer leading edge to move upward significantly beyond what is permitted by a normally operating jackscrew assembly. The resulting upward movement of the horizontal stabilizer leading edge created an excessive upward aerodynamic tail load, which caused an uncontrollable downward pitching of the airplane from which recovery was not possible.

Flight Crew Decision-Making

Decision to Continue Flying Rather than Return to PVR

Safety Board investigators considered several reasons that might explain the captain’s decision not to return immediately to PVR after he experienced problems with the horizontal stabilizer trim system during the climbout from PVR.

Neither the Alaska Airlines MD-80 Quick Reference Handbook (QRH) Stabilizer Inoperative checklist nor the company’s QRH Runaway Stabilizer emergency checklist required landing at the nearest suitable airport if corrective actions were not successful

. These checklist

3 This section contains a brief summary of the Safety Board’s conclusions relating to the accident sequence. The basis for these conclusions are discussed in greater detail in the Board’s final report.

4 The Board determined that the worn threads inside the horizontal stabilizer acme nut were incrementally sheared off by the acme screw and were completely sheared off during the accident flight.

5 The horizontal stabilizer moved immediately after the autopilot was disconnected. Normally, the autopilot is disconnected by the pilot flying using the autopilot disconnect switch located on the outboard side of the control wheel. However, the autopilot will also disconnect when the primary trim control system is activated by either the control wheel trim switches or the longitudinal trim handles on the center pedestal. After the initial dive, the captain told the Alaska Airlines maintenance technician at Los Angeles International Airport (LAX), Los Angeles, California, “we did both the pickle switch [control wheel trim switches] and the suitcase handles [longitudinal trim handles] and it ran away full nose trim down [sic].” Based on this comment and those made by the Alaska Airlines LAX maintenance personnel immediately preceding the autopilot disconnect, it appears that the captain disconnected the autopilot when he activated the primary trim control system by using either the control wheel trim switches, the longitudinal trim handles, or both.3

procedures were the only stabilizer-related checklist procedures contained in the QRH, and the flight crew most likely followed these checklist procedures in their initial attempts to correct the airplane’s jammed stabilizer.

The airplane’s takeoff weight of 136,513 pounds was well below the takeoff and climb limits for the departure runway, but it exceeded the airplane’s maximum landing weight of 130,000 pounds. Because the airplane did not have an in-flight fuel dumping system, the airplane would have had to remain in flight for about 45 minutes after takeoff until enough fuel had burned to reduce the airplane’s weight by the 6,500 pounds needed to reach the airplane’s maximum landing weight. A return to PVR to execute an overweight landing would have required higher-than-normal approach speeds for landing and would have created additional workload and risk. An overweight landing at PVR would have been appropriate if the flight crew had realized the potentially catastrophic nature of the trim anomaly. However, in light of the airplane’s handling characteristics from the time of the initial detection of a problem to the initial dive, the flight crew would not have been aware that they were experiencing a progressive, and ultimately catastrophic, failure of the horizontal stabilizer trim system.

The flight crew would have been aware that Alaska Airlines’ dispatch and maintenance control in SEA and LAX could be contacted by radio (via ground-based repeater stations) when the airplane neared the United States. However, even though the last horizontal stabilizer trimming movement was recorded by the flight data recorder (FDR) about 1349:51, the flight crew did not contact Alaska Airlines’ maintenance until shortly before the beginning of the cockpit voice recorder (CVR) transcript about 1549, 6 which suggests that control problems caused by the jammed horizontal stabilizer remained manageable for some time. 7 Further, the positive aerodynamic effects of the higher cruise airspeed 8 and fuel burn would have reduced the necessary flight control pressures to roughly 10 pounds 9 and made the airplane easier to control. Therefore, the Safety Board concludes that, in light of the absence of a checklist requirement to land as soon as possible and the circumstances confronting the flight crew, the flight crew’s decision not to return to PVR immediately after recognizing the horizontal stabilizer trim system
malfunction was understandable.

Although they elected not to return to PVR, later in the flight the flight crew decided to divert to LAX, rather than continue to SFO, where the flight was originally scheduled to make an intermediate stop before continuing to SEA. Comments recorded by the CVR indicated that the

6 The FDR indicates that a continuing series of radio transmissions began over the very-high frequency 2 channel (used for all non-air traffic control radio transmissions) at 1521. These transmissions continued until the end of the FDR recording, which suggests that the flight crew began contacting Alaska Airlines maintenance personnel

at this time.

7 The Safety Board notes that the 30-minute CVR recording did not capture the flight crew’s earlier troubleshooting efforts or the beginning of the flight crew’s discussions with maintenance personnel. A longer CVR recording that captured these events would have aided in this investigation. In Safety Recommendation A-99-16, the Board recommended that CVRs on all airplanes required to carry both a CVR and an FDR be capable of recording the last 2 hours of audio. This safety recommendation is currently classified “Open—Unacceptable Response.”

8 Although the flight plan called for a cruise speed of 283 knots calibrated airspeed, FDR data indicated that the airplane’s cruise speed increased, starting at 1424:30, eventually reaching 301 knots indicated airspeed (KIAS).

9 For almost 7 minutes after the autopilot disconnect, the airplane continued to climb at a much slower rate than before the disconnect, reaching about 31,050 feet by 1400:00. During this part of the ascent, the elevators were deflected in the airplane-nose-up direction between -1o and -3o, which, according to airplane performance calculations, would have required up to 50 pounds of combined pulling force on the control column(s). The calculations further indicated that, after leveling off at 31,050 feet, only about 30 pounds of pulling force would have been required to maintain level flight for the next 24 minutes while the airplane was flying at 280 KIAS.4

flight crew may have felt pressure from Alaska Airlines dispatch personnel to land in SFO. 10 However, after discussing the malfunctioning trim system and current and expected weather conditions at SFO and LAX with Alaska Airlines dispatch and maintenance personnel, the captain decided to land at LAX rather than continue to SFO. The decision to divert to LAX was apparently based on several factors, including more favorable wind conditions at LAX (compared to a direct crosswind at SFO) that would reduce the airplane’s ground speed on approach and landing 11 and the captain’s concern, expressed to Alaska Airlines dispatch personnel, about “overflying suitable airports.” The Safety Board concludes that the flight crew’s decision to divert the flight to LAX rather than continue to SFO as originally planned was prudent and appropriate. Further, the Safety Board concludes that Alaska Airlines dispatch personnel appear to have attempted to influence the flight crew to continue to SFO instead of diverting to LAX.

Use of the Autopilot

After the flight crew had manually flown the airplane for almost 2 hours, the autopilot was engaged about 1547, disengaged at 1549:56, and re-engaged 19 seconds later. The autopilot remained engaged until 1609:16, just before the initial dive. No discussion on the CVR (which began at 1549) indicated why the autopilot was engaged in either instance. As discussed previously, the increased airspeed and reduced weight would have brought the airplane closer to a trimmed condition, thus allowing autopilot engagement to maintain altitude and heading while further troubleshooting was attempted. However, Alaska Airlines’ MD-80 QRH Stabilizer Inoperative checklist states, “do not use autopilot” if both trim systems are inoperative. In light of the autopilot’s inability to maintain trim (using the alternate trim motor) during the climbout from PVR and the flight crew’s subsequent unsuccessful attempts to manually activate the primary trim control system (using the primary trim motor), the flight crew should have known that both the alternate and the primary trim control systems were inoperative. Thus, the flight crew’s use of the autopilot was contrary to company procedures.

Because the alternating current load meter registered electrical spikes when the crew attempted to activate the primary trim system, the flight crew should have realized that the primary trim motor was operational and that the system was jammed beyond the trim motor’s capability. Further, engagement of the autopilot, which would have been making automatic elevator corrections to the airplane’s mistrimmed condition, masked the airplane’s true condition from the flight crew. If the autopilot had subsequently been disconnected without one of the flight crewmembers holding the control wheel and making immediate corrective inputs, the airplane’s out-of-trim condition would have resulted in a severe pitch maneuver immediately

10 At 1552:02, after the captain had stated his intention to divert to LAX, Alaska Airlines dispatch personnel cautioned that if the flight landed at LAX rather than SFO, “we’ll be looking at probably an hour to an hour and a half [before the airplane could depart again] we have a major flow program going right now.” At 1552:41, the captain responded, “I really didn’t want to hear about the flow being the reason you’re calling us cause I’m concerned about overflying suitable airports.” At 1555:00, the captain commented to a flight attendant, “it just blows me away they think we’re gonna land, they’re gonna fix it, now they’re worried about the flow, I’m sorry this airplane’s [not] gonna go anywhere for a while...so you know.” After a flight attendant replied, “so they’re trying to put the pressure on you,” the captain stated, “well no, yea.”

11 According to Alaska Airlines’ MD-80 QRH S tabilizer Inoperative checklist, 15o of flaps would have been the appropriate flap setting for the accident airplane’s approach and landing with a jammed stabilizer; this reduced flap setting would have increased approach speeds and required a corresponding increase in the amount of runway needed during landing.5

after the autopilot disconnect. Therefore, the Safety Board concludes that the flight crew’s use of the autopilot while the horizontal stabilizer was jammed was not appropriate. 12

Configuration Changes

At 1615:56, after recovery from the initial dive, the captain told the air traffic controller that he wanted to “change my configuration, make sure I can control the jet and I’d like to do that out here over the bay if I may.” The captain then ordered extension of the slats at 1617:54 and the flaps at 1618:05. The captain did not brief the first officer about what to expect or what to do if these configuration changes resulted in excessive flight control pressures or loss of control of the airplane. Further, the captain did not specify that the flaps should be extended at a slower-than-normal rate, which would have been a prudent precaution to minimize the possibility of the configuration change causing abrupt airplane movements that could be difficult to control. Nevertheless, at 1618:17, after the slats and flaps were extended, the captain noted that the airplane was “pretty stable right here.” The captain added that the airspeed needed to decrease to 180 KIAS (the airplane was then at 250 KIAS). Nine seconds later, at 1618:26, the captain ordered retraction of the slats and flaps, and the airspeed began to subsequently increase. It was not clear from the CVR recording why the captain ordered retraction of the slats and flaps and allowed the airspeed to increase nor did the CVR recording indicate any discussion about the possible effects of the slat and flap extension.

The Safety Board notes that an airplane with flight control problems should be handled in a slow and methodical manner and that any configuration that would aid a landing should be maintained if possible. On the basis of the captain’s comment, the airplane was stable after the slat and flap extension at 1618:05. This configuration would have aided the approach and landing process. The Safety Board concludes that flight crews dealing with an in-flight control problem should maintain any configuration change that would aid in accomplishing a safe approach and landing, unless that configuration change adversely affects the airplane’s controllability.

Activation of the Primary Trim Motor

At 1618:49, after the slats and flaps were retracted, the captain stated that he wanted to “get the nose up...and then let the nose fall through and see if we can stab it when it’s unloaded.” The first officer responded, “you mean use this again? I don’t think we should...if it can fly.” These statements suggest that the captain may have been indicating his intention to retry the primary trim system after reducing aerodynamic forces on the horizontal stabilizer. However, after the first officer’s statement at 1619:14, “I think if it’s controllable, we oughta just try to land it,” the captain abandoned his plan and responded, “ok let’s head for LA.”

The Safety Board notes that the earlier repeated attempts to activate the primary trim system went well beyond what was called for in Alaska Airlines’ checklist procedures and ultimately precipitated the release of the jam of the acme screw and nut, resulting in the lower mechanical stop impacting the bottom of the nut. An additional attempt to use the trim switches at this point would not have been prudent. The severity of the initial dive changed the situation aboard the airplane to an emergency, which required a more deliberate and cautious approach.

The Safety Board recognizes that, from an operational perspective, the flight crew could not have known the extent of airplane damage. Although flight crews are trained in jammed

12 The Safety Board also notes that the captain’s disconnection of the autopilot when he was the pilot not flying was also contrary to standard industry procedures. Normally, the pilot flying would use the autopilot disconnect switch on the control column and then assess the airplane’s controllability.6

stabilizer and runaway stabilizer scenarios, the loss of acme nut and screw engagement exceeded any events anticipated in emergency training scenarios, and the flight crew was not trained to devise or execute appropriate configurations and procedures to minimize further damage to the airplane or to prevent the accident. However, the flight crew’s earlier attempts to activate the trim motor and configuration changes may have worsened the situation. As previously discussed, the captain’s activation of the primary trim motor at 1609:16 precipitated the release of the jam and the initiation of the initial dive. However, it was not clear how many times previous to that the flight crew activated the primary trim motor nor was it clear whether or to what extent the prior activations hastened the release of the jam. Therefore, the Board could not determine the extent to which the activation of the primary trim motor played a role in causing or contributing to the
accident.

Adequacy of Current Guidance

The Safety Board notes that after the flight 261 accident, Boeing issued a flight operations bulletin outlining procedures to be followed in the event of an inoperative or malfunctioning horizontal stabilizer trim system. The bulletin advised flight crews to

complete the flight crew operating manual (FCOM) checklist(s). Do not attempt additional actions beyond that contained in the checklist(s). If completing the checklist procedures does not result in operable trim system, consider landing at the nearest suitable airport.

The Safety Board agrees that this advice is generally appropriate. However, the Board does not agree that the flight crew should merely “consider” landing at the nearest suitable airport if accomplishing the checklist items does not result in an operational trim system. In such a case, the flight crew should always land at the nearest suitable airport as expeditiously and safely as possible. Further, the bulletin provides additional information regarding the possibility that repeated or continuous use of the trim motors may result in thermal cutoff and states that the motor may reset after a cooling period. The Board is concerned that this additional information addressing repeated or continuous use of the trim motors may weaken or confuse the initial guidance to refrain from attempting troubleshooting measures beyond those specified in the checklist procedures.

The Safety Board concludes that, without clearer guidance to flight crews regarding which actions are appropriate and which are inappropriate in the event of an inoperative or malfunctioning flight control system, pilots may experiment with improvised troubleshooting measures that could inadvertently worsen the condition of a controllable airplane. Accordingly, the Safety Board believes that the FAA should issue a flight standards information bulletin directing air carriers to instruct pilots that in the event of an inoperative or malfunctioning flight control system, if the airplane is controllable they should complete only the applicable checklist procedures and should not attempt any corrective actions beyond those specified. In particular, in the event of an inoperative or malfunctioning horizontal stabilizer trim system, after a final determination has been made in accordance with the applicable checklist that both the primary and alternate trim systems are inoperative, neither the primary nor the alternate trim motor should be activated, either by engaging the autopilot or using any other trim control switch or handle. Pilots should further be instructed that if checklist procedures are not effective, they should land at the nearest suitable airport. The Safety Board also believes that the FAA should direct all Certificate Management Offices to instruct inspectors to conduct surveillance of airline dispatch and maintenance control personnel to ensure that their training and operations directives provide appropriate dispatch support to pilots who are experiencing a malfunction threatening safety of flight and instruct them to refrain from suggesting continued flight in the interest of airline flight scheduling.7

Lubrication of the Jackscrew Assembly

Alaska Airlines’ Lubrication Interval Extension

Douglas DC-9 (DC-9) test results and Douglas DC-8 service history indicated that frequent lubrication of the jackscrew assembly would allow the acme screw to meet its original design life of 30,000 flight hours. DC-9 certification documents, including Douglas Process Standard 3.17-49 (issued August 1, 1964), specified a lubrication interval for the jackscrew assembly of 300 to 350 flight hours. However, the 300- to 350-flight-hour recommended
lubrication interval for the DC-9 was not contained in the manufacturer’s initial on-aircraft maintenance planning (OAMP) documents for the DC-9 or the MD-80. Instead, those documents specified a lubrication interval of 600 to 900 flight hours.

In 1987, Alaska Airlines’ lubrication interval for horizontal stabilizer components, including the jackscrew assembly, was every 500 flight hours, consistent with the manufacturer’s recommendation in the Maintenance Review Board (MRB) report and OAMP documents derived from Maintenance Steering Group (MSG)-2 guidance, which recommended a lubrication interval of 600 to 900 flight hours. In 1988, Alaska Airlines’ lubrication interval increased to every 1,000 flight hours (a 100 percent increase); in 1991, to every 1,200 flight hours (an additional 20 percent increase); and, in 1994, to every 1,600 flight hours (an additional 33 percent increase). In 1996, the interval was changed to 8 months with no specified flight-hour limit. Based on fleet utilization at the time, 8 calendar months equated to about 2,550 flight hours, an additional increase of greater than 59 percent. Thus, at the time of the accident, Alaska Airlines’ lubrication interval for the jackscrew assembly was more than 400 percent greater than
it was in 1987.

The investigation did not determine what type of information, if any, was presented as justification for the lubrication interval extensions in 1988, 1991, and 1994. However, according to the FAA principal maintenance inspector (PMI) for Alaska Airlines, who reviewed and accepted the 1996 interval extension, Alaska Airlines presented documentation of the manufacturer’s recently extended recommended interval as justification for its increase. (The extended recommended lubrication interval in the MRB report and OAMP document derived from the MSG-3 guidance was every C check, or every 3,600 flight hours.)

Testimony at the Safety Board’s public hearing and Boeing documents indicated that the original design engineers’ recommended lubrication interval was not considered during the MRB-3 decision-making process regarding the extension of the manufacturer’s recommended interval. Further, Boeing design engineers were not consulted about nor aware of the extended 3,600-flight-hour MRB-3 recommended lubrication interval. Although Alaska Airlines’ extended lubrication and end play check intervals have now been superseded by the 650-flight-hour lubrication and 2,000-flight-hour end play check intervals specified in Airworthiness Directive (AD) 2000-15-15, the Board is concerned that there is no mechanism in place to prevent similar unsafe interval extensions for other maintenance tasks. This issue and associated safety
recommendations are discussed further later in this letter.

Safety Implications of Lubrication Interval Extension

As grease is used in a system, it loses its effectiveness over time and requires replacement. Longer lubrication intervals increase the likelihood that a missed or inadequate lubrication will result in excessive wear. Conversely, shorter lubrication intervals increase the likelihood that, even if a lubrication is missed or inadequately performed, the existing grease will
remain effective until the next scheduled lubrication.8

The Safety Board notes that at the time of Alaska Airlines’ increase to an 8-month lubrication interval, it was the only U.S. airline that had a calendar-time lubrication interval with no accompanying flight-hour limit and no specification, “whichever comes first.” A calendar-time lubrication interval can degrade the margin of safety because wear is directly related to aircraft usage, or flight hours, and not to calendar time. Also, a purely calendar-based interval does not account for increases in flight hours that result from increased airplane utilization. Conversely, intervals based on flight hours, or on calendar time with an accompanying flight-hour time limit and the proviso, “whichever comes first,” ensure that the flight-hour limit will not be exceeded as a result of increased airplane utilization. Thus, unless a maximum utilization is also specified, calendar-time intervals are inappropriate for certain tasks, such as lubrication or inspections for fatigue, when component deterioration is related to usage,
not time. 13

In sum, at the time of the accident, Boeing’s recommended lubrication interval for the MD-80 jackscrew assembly was every 3,600 flight hours, about 4 to 6 times longer than Douglas’ original recommendation in the MSG-2 OAMP document of every 600 to 900 flight hours. Alaska Airlines’ lubrication interval for the MD-80 jackscrew assembly—although it was
still less than the manufacturer’s recommended interval in the MSG-3 OAMP document of 3,600 flight hours—was about 3 to 4 times longer than Douglas’ originally recommended lubrication interval, resulting in a significant decrease in the MD-80 fleet’s ability to tolerate missed or inadequate lubrications. The Safety Board notes that the negative safety implications of the ongoing lubrication interval extensions were magnified by the simultaneous ongoing extensions of the end play check interval in that there would be fewer and fewer opportunities to discover and address any excessive wear resulting from lubrication deficiencies.

Therefore, the Safety Board concludes that Alaska Airlines’ extensions of its lubrication interval for its MD-80 horizontal stabilizer components and the FAA’s approval of these extensions, the last of which was based on Boeing’s extension of the recommended lubrication interval, increased the likelihood that a missed or inadequate lubrication would result in excessive wear of jackscrew assembly acme nut threads and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident.

Adequacy of Lubrication Procedures

The horizontal stabilizer lubrication procedure specifies that, after the access doors are opened, grease is to be applied to the acme nut grease fitting under pressure. The procedure further specifies the brush application of a light coat of grease to the acme screw threads and operation of the trim system through its full range of travel to distribute the grease over the length of the acme screw.

Safety Board investigators observed maintenance personnel from two MD-80 operators perform jackscrew assembly lubrications and discussed the lubrication procedure with those and other maintenance personnel from those operators. Investigators noted many differences in the methods used by the personnel to accomplish certain steps in the lubrication procedure, including the manner in which grease was applied to the acme nut fitting and screw and the number of times the trim system was cycled to distribute the grease. Several of the methods observed by or reported to investigators did not involve application of grease to the entire length of the acme screw and cycling the trim system several times.

13 In contrast, some maintenance tasks are intended to prevent or control conditions (such as corrosion or deterioration based on aging) that are based solely on the passage of time. Such tasks might appropriately be tied to calendar-time intervals without any flight-hour limits.9

Laboratory demonstrations designed to compare the effectiveness of various methods of lubricating the jackscrew assembly found that application of a complete coating of grease over all exposed threads, filling the thread valleys, followed by the cycling of the trim system several times, maximized the distribution of the grease over the length of the acme screw. In contrast, the observations and demonstrations established that applying grease only through the acme nut grease fitting and then cycling the trim system several times did not distribute an adequate amount of grease over the remainder of the acme screw. Although both methods of grease application are specified in the lubrication procedure, if a mechanic mistakenly believed that lubricating only through the acme nut grease fitting was adequate, the acme screw and nut would
receive insufficient lubrication.

The extent to which these deficiencies in the lubrication procedure may have played a role in the inadequate lubrication of the accident jackscrew assembly could not be determined. However, in an October 1, 2001, safety recommendation letter, the Safety Board expressed its concern that the current lubrication procedure was not adequate to ensure consistent and thorough lubrication of the jackscrew assembly by all operators and issued Safety Recommendation A-01-41, which asked the FAA to require Boeing to “revise the lubrication procedure for the horizontal stabilizer trim system of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 [717] series airplanes to minimize the probability of inadequate lubrication.” In a December 12, 2001, letter, the FAA responded that it agreed with the intent of Safety Recommendation A-01-41 and that it was “working with the Boeing Commercial Airplane Group to rewrite the lubrication procedures to the optimal standard.” On June 14, 2002, the Safety Board classified Safety Recommendation A-01-41 “Open—Acceptable Response.”

After the issuance of Safety Recommendation A-01-41, Safety Board investigators continued to evaluate the adequacy of the current lubrication procedure and identified three
additional areas that should be addressed.

First, the Safety Board is concerned about the wear debris produced as a result of the wear process and other foreign debris that may accumulate in the grease over time. Because material that infiltrates the working grease reduces its lubricating effectiveness, it is desirable to flush out these materials before fresh grease is added (that is, to completely replace used, less effective grease with fresh, more effective grease). 14 The Board notes that the current jackscrew lubrication procedure does not stipulate the removal of used grease from the acme screw before the application of fresh grease. 15 The Board is aware that Boeing is developing a revised lubrication procedure for the jackscrew assembly that includes removal of the used grease before application of the fresh grease. Although the revised procedure, if properly performed, should improve the effectiveness of the lubrication, it is not yet known whether the FAA will require the use of this improved procedure.

The Safety Board concludes that when lubricating the jackscrew assembly, removal of degraded grease from the acme screw before application of fresh grease will increase the effectiveness of the lubrication. Therefore, the Safety Board believes that as part of the response to Safety Recommendation A-01-41, the FAA should require operators of DC-9, MD-80/90, and

14 This finding was further supported by interviews with representatives of the largest manufacturer of nonaviation jackscrew assemblies, Nook Industries. Nook representatives told Safety Board investigators that purging old grease out of the jackscrew assembly, and then refreshing the acme screw with new grease, increases the

life of the acme nut.

15 The current jackscrew lubrication procedure does call for the application of new grease into the nut , via the grease fitting, until grease is observed extruding from the nut; however, this does not remove the old grease from the acme screw surface or a large portion of the nut.10

717 series airplanes to remove used grease from the jackscrew assembly acme screw and flush degraded grease and particulates from the acme nut before applying fresh grease.

Second, Safety Board investigators noted that when they attempted to perform the lubrication procedure, it was difficult to insert a hand through the access panel openings because
of their size. 16 They further noted that after a hand was inserted, it blocked the view of the jackscrew assembly, requiring the task to be accomplished primarily by “feel.” The Board is aware that Boeing is developing a modification for an expanded access panel.

The Safety Board concludes that a larger access panel would facilitate the proper accomplishment of the jackscrew assembly lubrication task. Therefore, the Safety Board believes that, as part of the response to Safety Recommendation A-01-41, the FAA should require operators of DC-9, MD-80/90, and 717 series airplanes, in coordination with Boeing, to increase the size of the access panels that are used to accomplish the jackscrew assembly lubrication procedure.

Third, this investigation has highlighted the need for improved methods for ensuring that jackscrew assembly lubrications are accomplished properly at scheduled lubrication intervals. Currently, the lubrication procedure is generally performed and signed off by a single maintenance technician, and that technician’s work is not required to be inspected.

Although the Safety Board cannot be certain that such a requirement would have prevented the Alaska Airlines flight 261 accident, the Safety Board concludes that if the jackscrew assembly lubrication procedure were a required inspection item for which an inspector’s signoff is needed, the potential for unperformed or improperly performed lubrications would be reduced. Therefore, because of the critical importance of adequately lubricating the jackscrew assembly and the potentially catastrophic effects of excessive acme nut wear resulting from insufficient lubrication, the Safety Board believes that the FAA should establish the jackscrew assembly lubrication procedure as a required inspection item that must have an inspector’s signoff before the task can be considered complete.

Monitoring Acme Nut Thread Wear

Because the MD-80 jackscrew assembly’s structural function is critical to the safety of flight, and that structural function cannot be maintained without proper acme nut and screw thread engagement, it is essential that acme nut thread wear be regularly monitored. The failure to adequately monitor acme nut thread wear may result in continued operation of an airplane with excessive nut thread wear. As demonstrated by the Alaska Airlines flight 261 accident, because no other structure performs the function of the jackscrew assembly, the loss of acme nut and screw engagement as a result of excessive wear will most likely have catastrophic results.

In-service acme nut thread wear is monitored by performing an on-wing end play check procedure at specified intervals. Before 1967, there were no required periodic inspections. The jackscrew assembly had an expected service life of 30,000 hours, at which time the end play measurement was expected to be 0.0265 inch. However, as a result of higher-than-expected wear rates reported in 1966, in 1967, Douglas developed the end play check procedure and increased the maximum permissible end play measurement at which a jackscrew assembly could remain in service to 0.040 inch. (The minimum end play measurement remained at 0.003 inch.) 17 In All

16 Two access panel openings (one 4 inches by 6 inches and the other 8 inches by 7 inches) are generally used to accomplish the lubrication procedure.

17 As a result of these higher-than-expected wear rates, Douglas also changed some of the materials specifications and manufacturing processes for the acme screw (increased heat treating and nitriding) to reduce11

Operators Letter 9-48A, Douglas stated that jackscrew assemblies could remain in service as long as the end play measurement remained within these tolerances.

Alaska Airlines’ Preaccident End Play Check Intervals

Alaska Airlines has consistently required end play checks at every other C check. However, the length of its C-check interval has changed over time. As a result of those C-check interval changes, between 1985 and 1996 Alaska Airlines increased its end play check interval by almost 200 percent.

In 1985, when Alaska Airlines’ MD-80 maintenance program was initially approved by the FAA, C checks were conducted every 2,500 flight hours; therefore, end play checks were performed every 5,000 flight hours. By July 1988, C-check intervals had been extended to 13 months, with no corresponding flight-time limit; therefore, end play checks were performed every 26 months, which was approximately 6,400 flight hours, based on the airplane utilization rate at that time. Although FAA approval would have been required for this C-check interval extension, no information was available regarding what documentation, if any, Alaska Airlines presented to the FAA to justify the extension.

In 1996, Alaska Airlines’ C-check interval was extended to 15 months; therefore, end play checks were only required every 30 months. Because Alaska Airlines’ airplane utilization had also increased, this 30-month interval was equivalent to approximately 9,550 flight hours. Alaska Airlines sought and obtained advance FAA approval for this C-check interval extension. Alaska Airlines’ director of reliability and maintenance programs testified at the public hearing that Alaska Airlines had presented the FAA with a data analysis package based on the maintenance histories of five sample airplanes to justify the C-check interval extension. He indicated that individual maintenance tasks tied to C-check intervals (such as the end play check) were not separately considered in connection with the extension. 18 Thus, the FAA’s approval of the 1996 C-check extension also effectively constituted approval to extend the end play check from 26 to 30 months, a 15 percent increase, and, more importantly, a 55 percent increase in flight-hour intervals, from approximately 6,400 to 9,550 flight hours.

Although Alaska Airlines’ extended 30-month end play check interval was consistent with the manufacturer’s recommended calendar-time limit, the resulting 9,550-flight-hour interval far exceeded the manufacturer’s recommended flight-hour interval, which at that time was 7,000 or 7,200 flight hours (depending on whether MSG-2 or MSG-3 guidance was used). At that time, Alaska Airlines had the second highest end play check interval of all operators of DC-9, MD-80/90, and 717 series airplanes. Further, Alaska Airlines was the only U.S. carrier at that time that did not have an accompanying flight-hour limit with the specification, “whichever comes first,” for its end play check interval. As discussed previously in connection with Alaska Airlines’ lubrication interval, use of only a calendar-time interval does not account for increased airplane utilization rates and could result in a lower safety margin than intended.

The Safety Board notes that, because of Alaska Airlines’ extended end play check interval of 30 months, or about 9,550 flight hours, after the accident airplane’s last end play check in September 1997, the jackscrew assembly would not have been required to undergo

wear.

18 However, based on the history of maintenance discrepancies noted for the five sample airplanes, two maintenance tasks were identified as inappropriate for extension, and these tasks were converted to stand-alone items to be performed at shorter intervals. The two maintenance tasks identified as requiring shorter intervals based on service history were (1) lubrication of the bent-up, trailing-edge wing doors and (2) lubrication of the bearings and bushings in the elevator hinges.12

another end play check until March 2000. Between the time that the 0.040- and 0.033-inch end play measurements were recorded in September 1997 and the time of the accident, the airplane had been flown for 28 months, nearly 9,000 flight hours. During this time, the acme nut thread wear progressed to failure.

In light of what has been learned in this investigation, it is now apparent that the manufacturer’s previously recommended end play check intervals of 7,000 or 7,200 flight hours were not adequate. 19 Nonetheless, the Safety Board notes that if Alaska Airlines had not extended its end play check interval to beyond the recommended interval, the airplane would have been required to undergo an end play check at least 1,800 to 2,000 flight hours before the accident, and the excessive end play could have been identified at that time. Thus, the Safety Board concludes that Alaska Airlines’ extension of the end play check interval and the FAA’s approval of that extension allowed the accident acme nut threads to wear to failure without the opportunity for detection and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident.

Adequacy of Existing Process for Establishing Maintenance Task Intervals

The Safety Board is concerned that the absence of any significant maintenance history pertaining to the jackscrew assembly was apparently considered by Alaska Airlines and the FAA as sufficient justification to extend the end play check interval as part of the C-check interval extension. In general, the absence of maintenance history should not be considered adequate justification to extend the interval for the performance of a critical maintenance task. Any significant maintenance change associated with a critical flight control system should be independently analyzed and supported by technical data demonstrating that the proposed change will not present a potential hazard. Therefore, any maintenance task change related to the jackscrew assembly, which is an essential element of a critical flight control system, should be
handled in this manner.

The Safety Board is further concerned that the MSG and MRB-based process by which manufacturers develop initial and revised recommended maintenance task intervals resulted in significant extensions of both the lubrication and end play check intervals without any such analysis or support. Testimony at the Safety Board’s public hearing and Boeing documents indicated that Douglas’ original recommended lubrication interval of 600 to 900 flight hours was not considered during the MSG-3 decision-making process to extend the recommended interval to 3,600 hours. Further, Boeing design engineers were not consulted about nor aware of the escalated lubrication interval specified in the MSG-3 documents. The FAA’s MD-80 MRB chairman testified at the public hearing that the escalation of C-check intervals in the MSG-3 MD-80 MRB did not involve a task-by-task analysis of each task (such as the jackscrew lubrication task and end play check) that would be affected by the changed interval.

The Safety Board concludes that Alaska Airlines’ end play check interval extension should have been, but was not, supported by adequate technical data to demonstrate that the extension would not present a potential hazard. The Safety Board further concludes that the existing process by which manufacturers revise recommended maintenance task intervals and by which airlines establish and revise these intervals does not include task-by-task engineering analysis and justification and, therefore, allows for the possibility of inappropriate interval extensions for potentially critical maintenance tasks. In addition, the Board notes that the FAA plays a limited role in this process compared to the role it plays in the initial certification process.

19 This issue is discussed further later in this letter.13

Therefore, the Safety Board believes that the FAA should review all existing maintenance intervals for tasks that could affect critical aircraft components and identify those that have been extended without adequate engineering justification in the form of technical data and analysis demonstrating that the extended interval will not present any increased risk and require modification of those intervals to ensure that they (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. In conducting this review, the FAA should also consider original intervals recommended or established for new aircraft models that are derivatives of earlier models and, if the aircraft component and the task are substantially the same and the recommended interval for the new model is greater than that recommended for the earlier model, treat such original intervals for the derivative model as “extended” intervals. The Safety Board further believes that the FAA should conduct a systemic industrywide evaluation and issue a report on the process by which manufacturers recommend and airlines establish and revise maintenance task intervals and make changes to the process to ensure that, in the future, intervals for each task (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the
maintenance task.

The Safety Board also believes that the FAA should require operators to supply the FAA, before the implementation of any changes in maintenance task intervals that could affect critical aircraft components, technical data and analysis for each task demonstrating that none of the proposed changes will present any potential hazards, and obtain written approval of the proposed changes from the PMI and written concurrence from the appropriate FAA Aircraft Certification
Office.

Adequacy of Current End Play Check Intervals

The Safety Board recognizes that the FAA acted promptly following the Alaska Airlines flight 261 accident by issuing ADs that shortened the end play check interval to 2,000 flight hours. However, evidence collected during this investigation suggests that acme nut thread wear at a higher-than-expected rate could allow a potentially dangerous level of wear to occur in less than 2,000 hours.

Two jackscrew assemblies installed sequentially on the same Hawaiian Airlines DC-9 airplane that were removed because of high end play measurements were found to have worn at an unprecedented rate. The first acme nut had an approximate wear rate of 0.015 inch per 1,000 flight hours, and the second had an approximate wear rate of 0.008 inch per 1,000 flight hours. These wear rates are about 15 and 8 times greater, respectively, than the expected wear rate of about 0.001 inch per 1,000 flight hours. This accelerated wear was attributed to the presence of grit-blasting material that had been introduced inadvertently into the jackscrew assembly and become embedded in the grease on the acme screw.

If the first excessively worn jackscrew assembly had measured just within, rather than beyond, the 0.040-inch limit at the last end play check, and assuming the acme nut threads had continued to wear at an approximate rate of 0.015 inch per 1,000 flight hours, the end play measurement would have been about 0.069 inch by the time of its next scheduled end play check 2,000 flight hours later. Further, assuming that this end play check was either missed or improperly accomplished and the jackscrew assembly remained in service despite an end play of 0.069 inch and continued to wear at the same rate, the end play measurement would have been about 0.099 inch by the time of the next scheduled end play check. Moreover, there is no basis for assuming that the wear rate of this Hawaiian Airlines jackscrew assembly represents the maximum possible acme nut thread wear rate. Just as the wear rate and wear mechanism on the14

Hawaiian Airlines jackscrew assembly was unprecedented and unanticipated, there may be other unprecedented and unanticipated wear rates and mechanisms that could also result in excessive or accelerated wear. Therefore, it is possible that acme nut threads could wear at an even faster rate than the Hawaiian Airlines acme nut threads, possibly even to catastrophic limits 20 in 2,000 flight hours.

To establish an appropriately conservative end play check interval, the uncertainties regarding possible wear mechanisms and the maximum possible wear rate must be considered in addition to the significant possibility of inaccurate end play measurements. The Safety Board notes that, when failure mechanisms are known and clearly defined, standard industry practice to ensure a damage tolerant design is to have a safety margin that allows for two complete inspection cycles before the predicted failure time. 21 Thus, even if one inspection is missed or inadequately performed, there will be at least one other opportunity to detect and correct the condition. However, when uncertainties exist in the failure mechanism, as in the case of acme nut thread wear, standard industry practice is to increase the safety margin to account for the reduced level of confidence in the predicted failure time.

In a June 26, 2001, letter to the Safety Board, the FAA stated that it believed the 2,000-flight-hour interval provided an acceptable level of safety, citing the “robust design” of the acme nut and the fact that it could safely carry normal flight loads even when worn beyond 0.080 inch. The FAA also stated that the 650-flight-hour inspection and lubrication interval in AD 2000-15-15 provided frequent opportunities (in addition to the end play check every 2,000 flight hours) to detect wear debris and, therefore, possible excessive wear. Nonetheless, the Board is concerned that significantly higher-than-expected wear—wear even greater than that of the Hawaiian Airlines jackscrew assemblies—could result from foreign-object contamination, such as grit blast, or from other factors that have not yet been identified.

The Safety Board concludes that, because of the possibility that higher-than-expected wear could cause excessive wear in less than 2,000 flight hours and the additional possibility that an end play check could be not performed or improperly performed, the current 2,000-flight-hour end play check interval specified in AD 2000-15-15 may be inadequate to ensure the safety of the DC-9, MD-80/90, and 717 fleet. Therefore, the Safety Board believes that, pending the incorporation of a fail-safe mechanism in the design of the DC-9, MD-80/90, and 717 horizontal stabilizer jackscrew assembly, as recommended in Safety Recommendation A-02-49 in this report, the FAA should establish an end play check interval that (1) accounts for the possibility of higher-than-expected wear rates and measurement error in estimating acme nut thread wear and (2) provides for at least two opportunities to detect excessive wear before a potentially catastrophic wear condition becomes possible.

To establish an appropriate end play check interval, it is necessary to monitor end play measurements over time to identify any excessive or unanticipated wear rates and to continue evaluating the reliability and validity of end play measurements. Therefore, the FAA, Boeing, maintenance facilities that overhaul jackscrew assemblies, and operators should closely evaluate

20 According to the Safety Board’s study of thread stress and deformation, the acme nut threads will begin to deflect and begin the process of sliding over the acme screw threads at a wear level of about 0.093 inch.

21 According to the FAA’s Damage Tolerance Assessment Handbook, Volume I, issued in February 1999, “damage tolerance refers to the ability of the design to prevent structural cracks from precipitating catastrophic fracture when the airframe is subjected to flight or ground loads. Transport category airframe structure is generally made damage tolerant by means of redundant (‘fail safe’) designs for which the inspection intervals are set to provide at least two inspection opportunities per number of flights or flight hours it would take for a visually detectable crack to grow large enough to cause a failure in flight.” Although this refers to cracks, the Safety Board notes that the damage tolerance principles can be applied to acme nut wear.15

the measurement data currently being reported pursuant to AD 2000-15-15. The Safety Board concludes that the continued collection and analysis of end play data are critical to monitoring acme nut thread wear and identifying excessive or unexpected wear rates, trends, or anomalies. Therefore, the Safety Board believes that the FAA should require operators to permanently (1) track end play measurements according to airplane registration number and jackscrew assembly serial number, (2) calculate and record average wear rates for each airplane based on end play measurements and flight times, and (3) develop and implement a program to analyze these data to identify and determine the cause of excessive or unexpected wear rates, trends, or anomalies. The Safety Board further believes that the FAA should require operators to report this information to the FAA for use in determining and evaluating an appropriate end play check
interval.

Deficiencies of Jackscrew Assembly Overhaul Procedures and Practices

The accident jackscrew assembly was never overhauled nor was it required to be. However, to determine the adequacy of maintenance and inspection procedures applicable to all DC-9, MD-80/90, and 717 jackscrew assemblies, Safety Board investigators evaluated jackscrew assembly overhaul procedures and practices. Specifically, investigators reviewed the DC-9 Overhaul Maintenance Manual and visited several maintenance facilities that overhaul jackscrew assemblies, including Integrated Aerospace, the only contract facility currently used by Boeing to overhaul acme nut and screw pairs to manufacturing end play specifications.

Safety Board investigators identified several deficiencies in the DC-9 Overhaul Maintenance Manual procedures and in the practices of several of the maintenance facilities that were visited. Specifically, the overhaul manual did not require the use of work cards documenting each step in the overhaul process, and (with the exception of Integrated Aerospace) the facilities did not use such work cards. Also, the manual called for replacement of the acme nut only if the end play measurement was more than 0.040 inch. Although some overhaul facilities had lower self-imposed end play measurement limits for replacement of the acme nut, at least one facility indicated that it would return an overhauled jackscrew assembly to a customer as long as the end play measurement did not exceed 0.040 inch. Further, the manual contained no requirement to record or inform the customer of the end play measurement of an overhauled jackscrew assembly. This means that a jackscrew assembly with an end play measurement of up to 0.039 inch could be represented as “overhauled” and returned to service by an operator that might not be aware of the high end play measurement. 22 A jackscrew assembly could require overhaul for reasons other than excessive end play; however, it would be reasonable for a customer to expect that an assembly would be returned after an overhaul with an end play close to manufacturing specifications.

Further, the required steps for properly conducting the end play check procedure were not well described and the required equipment was not specified in the DC-9 Overhaul Maintenance Manual. During visits to maintenance facilities, Safety Board investigators learned that the facilities used different methods and various tools for measuring end play. (Although investigators saw no evidence that the differences affected the accuracy of the results, the lack of standardization nonetheless increases the potential for error to occur.) The overhaul manual also did not contain detailed instructions on how to apply grease to the jackscrew assembly at the completion of the overhaul nor did it clearly specify which type of grease to use. Further,

22 Although the DC-9 Overhaul Maintenance Manual calls for more frequent end play checks (every 1,000 flight hours) to be conducted on an overhauled unit that was reinstalled with an end play measurement between 0.034 to 0.039 inch, this provision is of limited value because there is no requirement for operators to be informed of this elevated end play measurement. Further, operators receiving an overhauled jackscrew assembly would not be expected to consult the overhaul manual for special maintenance instructions.16

although the manual does require that an overhauled jackscrew assembly be lubricated before it can be returned to the customer, investigators learned that at least one maintenance facility returns overhauled assemblies without lubricating them first.

In addition, the DC-9 Overhaul Maintenance Manual did not contain detailed instructions nor specify appropriate equipment for checking that the proper acme screw thread surface finish had been applied. Many of the maintenance facilities visited by Safety Board investigators indicated that they relied on subvendors to ensure that the proper acme screw thread surface finish was applied and had no standard method for verifying that this action had occurred.

Finally, the DC-9 Overhaul Maintenance Manual did not clearly specify appropriate packaging procedures for transporting jackscrew assemblies after overhaul. Although the overhaul manual contained detailed protective packaging instructions for jackscrew assemblies going into “storage,” it did not specify any such protective packaging for jackscrew assemblies being transported. However, it would be prudent to use protective packaging for all overhauled jackscrew assemblies being returned to a customer because a maintenance facility cannot be expected to know what the customer intends to do with an assembly after it is returned.

Integrated Aerospace, the only maintenance facility authorized by Boeing to overhaul the acme nut and screw to an “as new” end play condition that meets manufacturing specifications, uses more rigorous and reliable overhaul procedures and significant quality control measures that are not used or required by the other facilities that overhaul jackscrew assemblies. For example, Integrated Aerospace uses detailed work cards to document each step of the overhaul process. Whenever Integrated Aerospace receives a jackscrew assembly with an end play measurement greater than 0.015 inch, it will install a new acme nut, thereby restoring the assembly to the manufacturing specifications for a new jackscrew assembly (0.003 to 0.010 inch). In doing so, Integrated Aerospace must comply with detailed specifications provided by Boeing in a service rework drawing, which are not contained in the DC-9 Overhaul Maintenance Manual.

In addition, the investigation revealed that no special authorization beyond a class 1 accessory rating is required for a maintenance facility to overhaul jackscrew assemblies in accordance with the DC-9 Overhaul Maintenance Manual. A class 1 accessory rating allows a facility to perform maintenance and alteration of a number of mechanical accessories. The maintenance facility is not required to demonstrate that it has the necessary capability and equipment to perform jackscrew assembly overhauls. Safety Board investigators found that the PMI of an FAA-certified maintenance facility may not even be aware that the facility is performing overhauls of jackscrew assemblies.

The Safety Board concludes that deficiencies in the overhaul process increase the likelihood that jackscrew assemblies may be improperly overhauled. The Safety Board further concludes that the absence of a requirement to record or inform customers of the end play measurement of an overhauled jackscrew assembly could result in an operator unknowingly returning a jackscrew assembly to service with a higher-than-expected end play measurement. Therefore, the Safety Board believes that the FAA should require that maintenance facilities that overhaul jackscrew assemblies record and inform customers of an overhauled jackscrew assembly’s end play measurement.

In addition to recording the end play measurement information provided by a maintenance facility when it returns an overhauled jackscrew assembly, it would also be prudent for operators to record end play measurements for the same assembly after it is installed on an airplane. The Safety Board notes that end play measurements recorded by maintenance facilities are likely to be obtained during bench checks. However, after the overhauled assembly is re-installed on an airplane, end play measurements will likely be obtained through use of the on-wing end play check procedure, which may yield a slightly different measurement because of17

differences in the procedure. A wear rate that is calculated using a bench-check measurement at one point in time compared with an on-wing measurement at a later point in time will not be as informative or useful as a wear rate that is calculated using measurements obtained through use of the same end play check method. Therefore, the Safety Board concludes that operators will maximize the usefulness of end play measurements and wear rate calculations by recording on-wing end play measurements whenever a jackscrew assembly is replaced on an airplane. Accordingly, the Safety Board believes that the FAA should require operators to measure and record the on-wing end play measurement whenever a jackscrew assembly is replaced.

Finally, the Safety Board concludes that, because the jackscrew assembly is an integral and essential part of the horizontal stabilizer trim system, a critical flight system, it is important to ensure that maintenance facilities authorized to overhaul these assemblies possess the proper qualifications, equipment, and documentation. Therefore, the Safety Board believes that the FAA should require that maintenance facilities that overhaul DC-9, MD-80/90, and 717 series airplanes’ jackscrew assemblies obtain specific authorization to perform such overhauls, predicated on demonstrating that they possess the necessary capability, documentation, and equipment for the task and that they have procedures in place to (1) perform and document the detailed steps that must be followed to properly accomplish the end play check procedure and lubrication of the jackscrew assembly, including specification of appropriate tools and grease types; (2) perform and document the appropriate steps for verifying that the proper acme screw thread surface finish has been applied; and (3) ensure that appropriate packaging procedures are followed for all overhauled jackscrew assemblies, regardless of whether the assembly has been designated for storage or shipping.

Horizontal Stabilizer Trim System Design and Certification Issues

Acme Nut Thread Loss as a Catastrophic Single-Point Failure Mode

The DC-9 horizontal stabilizer trim system (which was also incorporated in the MD-80/90 and 717 series airplanes) is a critical flight system because certain failures of the system can be catastrophic. One such failure is the loss of acme screw and nut thread engagement. However, the designers of the system assumed that at least one set of the jackscrew assembly’s acme screw and nut threads would always be intact and engaged to act as a load path. Therefore, the repercussions of stripped acme nut threads and the corresponding effect on the airplane (including the possibility of the acme screw disengaging from the acme nut) were not considered in the design of the horizontal stabilizer trim system.

At the Safety Board’s public hearing, Boeing engineers stated that they considered loss of the acme nut threads to be a “multiple failure event” and that such loss caused by excessive wear was not considered a “reasonably probable single failure” for certification purposes. 23 The Boeing engineers indicated that the jackscrew assembly was designed to accommodate thread wear but acknowledged that monitoring and managing thread wear was essential to maintaining the integrity of the design. Similarly, an FAA certification engineer testified that thread wear “was not considered as a mode of failure for either a systems safety analysis or for structural considerations” and that the “design of the acme nut and screw provided enough over-strength so that regulatory requirements could be met with a significant amount of wear.” However, as the

23 The certification basis for the DC-9, MD-80/90, and 717 horizontal stabilizer trim systems was Civil Aeronautics Regulations (CAR) 4b. CAR 4b.320, “Control Systems,” stated that “an adjustable stabilizer shall incorporate means to permit, after the occurrence of any reasonably probable single failure of the actuating system, such adjustment as would be necessary for continued safety of the flight.” (Current certification regulations specify, in 14 CFR 25.671, that the airplane must be shown to be capable of continued safe flight and landing after “any single failure” of the actuating system.)18

Alaska Airlines flight 261 accident demonstrates, complete loss of the acme nut threads because of excessive wear is possible. Further, the accident jackscrew assembly is not the only jackscrew assembly in which excessive acme nut thread wear has occurred. Excessive wear of acme nut threads has occurred on other occasions as a result of inadequate lubrication, improper acme screw thread surface finish, and contamination. In addition, other potential rapid wear mechanisms may not have yet been identified.

The Safety Board notes that the dual-thread design of the acme screw and nut does not adequately protect against excessive acme nut thread wear. Although Boeing contends that the two thread spirals along the length of both the acme screw and nut provide structural redundancy, the Board notes that each set of thread spirals is always carrying loads in flight and that both sets of thread spirals are subject to the same wear mechanisms. Thus, although the dual-thread design may prevent a crack in one thread set from propagating through the other thread set, both sets of threads remain vulnerable to simultaneous wear failure. Therefore, the Safety Board concludes that the dual-thread design of the acme screw and nut does not provide redundancy with regard

to wear.

The FAA’s certification scheme is intended to protect against catastrophic single-point failure conditions. Specifically, 14 CFR 25.1309 requires that airplane systems and associated components be designed so that “the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable.” Further, Advisory Circular (AC) 25.1309-1A, “System Design and Analysis,” defines “extremely improbable” failure conditions as “those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type” and “having a probability on the order of 1 x 10 -9 or less each flight hour, based on a flight of mean duration for the airplane type.” AC 25.1309-1A specifies that in demonstrating compliance with 14 CFR 25.1309, “the failure of any single element, component, or connection during any one flight...should be assumed, regardless of its probability,” and “such single failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure condition.”

An FAA senior certification engineer testified at the public hearing that 14 CFR 25.1309 24 did not apply to the jackscrew assembly acme nut because the FAA did not consider it part of a system. Rather, he stated that the jackscrew assembly was a “combination structural element and systems element” and that each category was governed by its respective regulatory requirements. He indicated that those portions of the jackscrew assembly below the gearbox and trim motors carried primary flight loads and, therefore, were covered by regulations pertaining to structure, not systems. He testified that the acme nut met the applicable regulatory requirements pertaining to structure, specifically, CAR 4b.201(a), “Strength and Deformation,” which states that structure “shall be capable of supporting limit loads without suffering detrimental permanent
deformation.” 25 He stated that acme nut threads that are within manufacturing specifications far exceed the requirements for ultimate strength and deflection limit load and added that the FAA
does not consider deflection of worn acme nut threads to be deformation in the context of this regulation.

In addition, a Boeing structures engineering manager testified that the acme nut complied with certification regulations pertaining to fatigue evaluation of structure. Specifically, CAR 4b.270, “Fatigue Evaluation of Flight Structure,” required, for “those portions of the airplane’s flight structure in which fatigue may be critical,” an evaluation of either fatigue

24 The predecessor to the current 14 CFR 25.1309 was CAR 4b.606, which required that all systems “be designed to safeguard against hazards to the airplane in the event of their malfunctioning or failure.”

25 A substantially similar requirement is currently contained in 14 CFR 25.305(a).19

strength (also referred to as “safe life”) or fail safe strength (also referred to as “damage tolerance”). 26 However, the Boeing manager testified that neither evaluation was performed because the acme nut was not considered “fatigue critical” because of its robust design.

It is unclear whether the design and certification of the DC-9 (and MD-80/90 and 717) horizontal stabilizer trim system would have been any different if the certification requirements for aircraft systems, in addition to those applicable to structure, had been applied to the jackscrew assembly acme nut during the design phase. Boeing engineers testified at the public hearing that the horizontal stabilizer trim system design complied with the requirements of 14 CFR 25.1309. However, the FAA certification engineer indicated that, even if section 25.1309 had been applicable to the entire jackscrew assembly, acme nut thread wear would not have been considered in the required systems safety analysis. He explained, “if you refer to a [section 25.1309] type safety analysis to try and determine a failure rate for a wear item, there are not, and there’s really no such thing as a wear-critical item, never has been. The question of wear being a quantifiable element so that one could do a safety-type analysis for structure—it’s not
feasible. The data to do such an evaluation is not available. It doesn’t exist.” 27

In sum, the Safety Board is concerned that Boeing and the FAA did not account for the catastrophic effects of total acme nut thread loss in the design and certification of the horizontal stabilizer trim control system. The Board is also concerned that the certification requirements for aircraft systems were not considered applicable to the entire jackscrew assembly, particularly the acme nut. Because the loss of acme nut threads in flight most likely would result in the catastrophic loss of the airplane, the Board considers the acme nut to be a critical element of the horizontal stabilizer trim control system; therefore, it should have been covered by the certification philosophy and regulations applicable to all other flight control systems. The Safety Board concludes that the design of the DC-9, MD-80/90, and 717 horizontal stabilizer jackscrew assembly did not account for the loss of the acme nut threads as a catastrophic single-point failure mode. The Safety Board further concludes that the absence of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss contributed to the Alaska Airlines flight 261 accident.

Prevention of Acme Nut Thread Loss Through Maintenance and Inspection

Currently, prevention of acme nut thread loss is dependent on regular application of lubrication and on recurrent inspections of the jackscrew assembly to monitor acme nut thread wear. However, this maintenance-based approach to maintaining the horizontal stabilizer trim system’s structural integrity has weaknesses.

First, current lubrication and end play check intervals may not be adequate, and their length can change. Research and testing relating to lubrication effectiveness and the prior service history of the MD-80 fleet suggests that the current 650-flight-hour lubrication interval is probably adequate to ensure proper lubrication of the jackscrew assembly. However, because of the potential for additional undiscovered rapid wear mechanisms and uncertainty regarding the maximum possible wear rate even for known wear mechanisms, there is no such basis for assuming that the current 2,000-flight-hour end play check interval is sufficient to ensure fleetwide safety. Further, there is no guarantee that these intervals will not eventually be extended, which would further reduce the level of safety.

26 Substantially similar requirements are currently contained in 14 CFR 25.571.

27 The Boeing manager confirmed that “the condition of wear or wear-out was not included in the original DC-9 fault analysis.”20

Second, and more importantly, all maintenance and inspection tasks are subject to human error. This investigation has identified several weaknesses in the lubrication and inspection procedures that could affect their intended results and compromise safety. Further, several Safety Board accident investigations, including the Alaska Airlines flight 261 investigation, have demonstrated that even simple maintenance tasks are sometimes missed or inadequately performed and can have catastrophic results. 28 Therefore, the current horizontal stabilizer trim system design remains vulnerable to catastrophic failure if maintenance and inspection tasks are not performed properly.

Elimination of Catastrophic Effects of Acme Nut Thread Loss Through Design

The Safety Board concludes that, when a single failure could have catastrophic results and there is a practicable design alternative that could eliminate the catastrophic effects of the failure mode, it is not appropriate to rely solely on maintenance and inspection intervention to prevent the failure from occurring; if a practicable design alternative does not exist, a comprehensive systemic maintenance and inspection process is necessary. In the case of the horizontal stabilizer trim system, such a design would incorporate a reliable, independent means for eliminating, overcoming, or counteracting the catastrophic effects of acme nut thread loss. The Board notes that such a design change would not necessarily need to incorporate dual actuators, or any other form of system redundancy; the design would only need to provide a mechanism for preventing stripped acme nut threads from resulting in unrecoverable movement of the horizontal stabilizer. The Board notes that among the several design concepts listed in AC 25.1309-1A that can be used to avoid catastrophic failure conditions are the following: (1) “designed failure effect limits, including the capability to sustain damage, to limit the safety impact or effects of a failure”; and (2) “designed failure path to control and direct the effects of a failure in a way that limits its safety impact.”

The Safety Board concludes that transport-category airplanes should be modified, if practicable, to ensure that horizontal stabilizer trim system failures do not preclude continued safe flight and landing. Therefore, the Safety Board believes that the FAA should conduct a systematic engineering review to (1) identify means to eliminate the catastrophic effects of total acme nut thread failure in the horizontal stabilizer trim system jackscrew assembly in DC-9, MD-80/90, and 717 series airplanes and require, if practicable, that such fail-safe mechanisms be incorporated in the design of all existing and future DC-9, MD-80/90, and 717 series airplanes and their derivatives; (2) evaluate the horizontal stabilizer trim systems of all other transport-category airplanes to identify any designs that have a catastrophic single-point failure mode and, for any such system; (3) identify means to eliminate the catastrophic effects of that single-point failure mode and, if practicable, require that such fail-safe mechanisms be

28 For example, following the September 11, 1991, crash of a Continental Express Embraer 120 in Eagle Lake, Texas, the Safety Board concluded that the airline’s maintenance inspection and quality assurance programs failed to detect that the upper row of screws on the leading edge of the left horizontal stabilizer had been removed during maintenance and had not been replaced. The partially secured left horizontal stabilizer leading edge separated in flight, causing a severe nose-down pitchover. The airplane broke up in flight, and all 14 people on board were
killed. For more information, see National Transportation Safety Board. Britt Airways, Inc., d/b/a Continental Express Flight 2574, In-flight Structural Breakup, EMB-120RT, N33701, Eagle Lake, Texas, September 11, 1991.

NTSB/AAR-92/04. In addition, the Board’s investigation of the July 6, 1996, uncontained engine failure on a Delta Air Lines MD-88 in Pensacola, Florida, determined that a fluorescent inspection process used to detect fatigue cracks during maintenance was susceptible to error because it involved multiple cleaning, processing, and inspection procedures dependent on several individuals and because of a low expectation of finding a crack. Shrapnel from the uncontained engine failure pierced the fuselage and entered the rear cabin. Two passengers were killed, and two others were seriously injured. For more information, see National Transportation Safety Board. Uncontained Engine Failure, Delta Airlines Flight 1288, McDonnell Douglas MD-88, N927DA, Pensacola, Florida, July 6, 1996.

NTSB/AAR-98-01

.21

incorporated in the design of all existing and future airplanes that are equipped with such horizontal stabilizer trim systems.

Further, the Safety Board is concerned that the FAA certified a horizontal stabilizer trim system that had a single-point catastrophic failure mode. The Safety Board concludes that catastrophic single-point failure modes should be prohibited in the design of all future airplanes with horizontal stabilizer trim systems, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems. Therefore, the Safety Board believes that the FAA should modify the certification regulations, policies, or procedures to ensure that new horizontal stabilizer trim control system designs are not certified if they have a single-point catastrophic failure mode, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems.

Consideration of Wear-Related Failures During Design and Certification

The Alaska Airlines flight 261 investigation revealed that the FAA certification processes and procedures did not adequately consider and address the consequences of excessive wear in the context of certifying the DC-9, MD-80/90, and 717 horizontal stabilizer trim system. In light of this finding, the Safety Board is concerned that the consequences of excessive wear might not be considered in the contexts of other certifications as well. One way to ensure that such consequences are considered would be to include wear-related failures in the failure modes and effects analyses (FMEA) and fault tree analyses that are required under 14 CFR 25.1309. Boeing and the FAA have accepted the premise that wear cannot be considered a mode of failure in systems safety analyses such as FMEAs and fault trees; however, the Board notes that standards developed by the Society of Automotive Engineers (SAE) specify that wear should be
considered in FMEAs. 29 Design guidelines should require that a wear-related failure be assumed
and that the results of such a failure be evaluated.

The Safety Board concludes that the certification requirements applicable to transport-category airplanes should fully consider and address the consequences of failures resulting from wear. Therefore, the Safety Board believes that the FAA should review and revise aircraft certification regulations and associated guidance applicable to the certification of transport-category airplanes to ensure that wear-related failures are fully considered and addressed so that, to the maximum extent possible, they will not be catastrophic.

29 SAE’s Aerospace Recommended Practices 4761, “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment,” in paragraph G.3.2.2.1 of appendix G, lists wear among the failure modes to consider in performing an FMEA.22

Recommendations

As a result of the investigation of the Alaska Airlines flight 261 accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation
Administration:

Issue a flight standards information bulletin directing air carriers to instruct pilots that in the event of an inoperative or malfunctioning flight control system, if the airplane is controllable they should complete only the applicable checklist procedures and should not attempt any corrective actions beyond those specified. In particular, in the event of an inoperative or malfunctioning horizontal stabilizer trim control system, after a final determination has been made in accordance with the applicable checklist that both the primary and alternate trim systems are inoperative, neither the primary nor the alternate trim motor should be activated, either by engaging the autopilot or using any other trim control switch or handle. Pilots should further be instructed that if checklist procedures are not effective, they should land at the nearest suitable airport. (A-02-36)

Direct all certificate management offices to instruct inspectors to conduct surveillance of airline dispatch and maintenance control personnel to ensure that their training and operations directives provide appropriate dispatch support to pilots who are experiencing a malfunction threatening safety of flight and instruct them to refrain from suggesting continued flight in the interest of airline flight scheduling. (A-02-37)

As part of the response to Safety Recommendation A-01-41, require operators of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to remove degraded grease from the jackscrew assembly acme screw and flush degraded grease and particulates from the acme nut before applying fresh grease. (A-02-38)

As part of the response to Safety Recommendation A-01-41, require operators of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes, in coordination with Boeing, to increase the size of the access panels that are used to accomplish the jackscrew assembly lubrication procedure. (A-02-39)

Establish the jackscrew assembly lubrication procedure as a required inspection item that must have an inspector’s signoff before the task can be considered complete. (A-02-40)

Review all existing maintenance intervals for tasks that could affect critical aircraft components and identify those that have been extended without adequate engineering justification in the form of technical data and analysis demonstrating that the extended interval will not present any increased risk and require modifications of those intervals to ensure that they (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of
the maintenance task. In conducting this review, the Federal Aviation Administration should also consider original intervals recommended or established for new aircraft models that are derivatives of earlier models and, if the aircraft component and the task are substantially the same and the recommended interval for the new model is greater than that recommended for the earlier model, treat such original intervals for the derivative model as “extended” intervals. (A-02-41)

Conduct a systematic industrywide evaluation and issue a report on the process by which
manufacturers recommend and airlines establish and revise maintenance task intervals23

and make changes to the process to ensure that, in the future, intervals for each task (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. (A-02-42)

Require operators to supply the Federal Aviation Administration (FAA), before the implementation of any changes in maintenance tasks intervals that could affect critical aircraft components, technical data and analysis for each task demonstrating that none of the proposed changes will present any potential hazards, and obtain written approval of the proposed changes from the principal maintenance inspector and written concurrence from the appropriate FAA aircraft certification office. (A-02-43)

Pending the incorporation of a fail-safe mechanism in the design of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 horizontal stabilizer jackscrew assembly, as recommended in Safety Recommendation A-02-49, establish an end play check interval that (1) accounts for the possibility of higher-than-expected wear rates and measurement error in estimating acme nut thread wear and (2) provides for at least two opportunities to detect excessive wear before a potentially catastrophic wear condition becomes possible. (A-02-44)

Require operators to permanently (1) track end play measures according to airplane registration number and jackscrew assembly serial number, (2) calculate and record average wear rates for each airplane based on end play measurements and flight times, and (3) develop and implement a program to analyze these data to identify and determine the cause of excessive or unexpected wear rates, trends, or anomalies. The Federal Aviation Administration (FAA) should also require operators to report this information to the FAA for use in determining and evaluating an appropriate end play check interval. (A-02-45)

Require that maintenance facilities that overhaul jackscrew assemblies record and inform customers of an overhauled jackscrew assembly’s end play measurement. (A-02-46)

Require operators to measure and record the on-wing end play measurement whenever a jackscrew assembly is replaced. (A-02-47)

Require that maintenance facilities that overhaul Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes’ jackscrew assemblies obtain specific authorization to perform such overhauls, predicated on demonstrating that they possess the necessary capability, documentation, and equipment for the task and that they have procedures in place to (1) perform and document the detailed steps that must be followed to properly accomplish the end play check procedure and lubrication of the jackscrew assembly, including specification of appropriate tools and grease types; (2) perform and document the appropriate steps for verifying that the proper acme screw thread surface finish has been applied; and (3) ensure that appropriate packing procedures are followed for all returned overhauled jackscrew assemblies, regardless of whether the assembly has been designated for storage or shipping. (A-02-48)

Conduct a systematic engineering review to (1) identify means to eliminate the catastrophic effects of total acme nut thread failure in the horizontal stabilizer trim system jackscrew assembly in Douglas DC-9 (DC-9), McDonnel Douglas MD-80/90 (MD-80/90), and Boeing 717 (717) series airplanes and require, if practicable, that such fail-safe mechanisms be incorporated in the design of all existing and future DC-9, MD-80/90, and 717 series airplanes and their derivatives; (2) evaluate the horizontal24

stabilizer trim systems of all other transport-category airplanes to identify any designs that have a catastrophic single-point failure mode and, for any such system; (3) identify means to eliminate the catastrophic effects of that single-point failure mode and, if practicable, require that such fail-safe mechanisms be incorporated in the design of all existing and future airplanes that are equipped with such horizontal stabilizer trim systems (A-02-49)

Modify the certification regulations, policies, or procedures to ensure that new horizontal stabilizer trim control system designs are not certified if they have a single-point catastrophic failure mode, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems. (A-02-50)

Review and revise aircraft certification regulations and associated guidance applicable to the certification of transport-category airplanes to ensure that wear-related failures are fully considered and addressed so that, to the maximum extent possible, they will not be catastrophic. (A-02-51)

Acting Chairman CARMODY and Members HAMMERSCHMIDT, BLACK, and

GOGLIA concurred with these recommendations.

By: Carol J. Carmody Acting Chairman