What They Had Was '...a Failure to Lubricate'

There are a lot of lessons here -- some about flying, but particularly about maintenance.
Everything is important; a little mistake can have great consequences; cleanliness and lubrication are critical; properly-designed tooling can make the difference; scientific testing needs to precede changes in maintenance procedures; the acceptable application of two different lubricants does not necessarily mean the two lubes are compatible with each other; and when you're in an emergency flight mode and find some tactic that works, stick with it.

Here's what happened, straight from the NTSB:

1. The flight crewmembers on Alaska Airlines flight 261 were properly certificated and qualified and had received the training and off-duty time prescribed by Federal regulations. No evidence indicated any preexisting medical or other condition that might have adversely affected the flight crew's performance during the accident flight.

2. The airplane was dispatched in accordance with Federal Aviation Administration regulations and approved Alaska Airlines procedures. The weight and balance of the airplane were within limits for dispatch, takeoff, climb, and cruise.

3. Weather was not a factor in the accident.

4. There was no evidence of a fire or of impact with birds or any other foreign object.

5. No evidence indicated that the airplane experienced any preimpact structural or system failures, other than those associated with the longitudinal trim control system, the horizontal stabilizer, and its surrounding structure.

6. Both engines were operating normally before the final dive.

7. Air traffic control personnel involved with the accident flight were properly certificated and qualified for their assigned duty stations.

8. The longitudinal trim control system on the accident airplane was functioning normally during the initial phase of the accident flight.

9. The horizontal stabilizer stopped responding to autopilot and pilot commands after the airplane passed through 23,400 feet. The pilots recognized that the longitudinal trim control system was jammed, but neither they nor the Alaska Airlines maintenance personnel could determine the cause of the jam.

10. The worn threads inside the horizontal stabilizer acme nut were incrementally sheared off by the acme screw and were completely sheared off during the accident flight. As the airplane passed through 23,400 feet, the acme screw and nut jammed, preventing further movement of the horizontal stabilizer until the initial dive.

11. The accident airplane's initial dive from 31,050 feet began when the jam between the acme screw and nut was overcome as a result of operation of the primary trim motor. Release of the jam allowed the acme screw to pull up through the acme nut, causing the horizontal stabilizer leading edge to move upward, thus causing the airplane to pitch rapidly downward.

12. The acme screw did not completely separate from the acme nut during the initial dive because the screw's lower mechanical stop was restrained by the lower surface of the acme nut until just before the second and final dive about 10 minutes later.

13. The cause of the final dive was the low-cycle fatigue fracture of the torque tube, followed by the failure of the vertical stabilizer tip fairing brackets, which allowed the horizontal stabilizer leading edge to move upward significantly beyond what is permitted by a normally operating jackscrew assembly. The resulting upward movement of the horizontal stabilizer leading edge created an excessive upward aerodynamic tail load, which caused an uncontrollable downward pitching of the airplane from which recovery was not possible.

14. In light of the absence of a checklist requirement to land as soon as possible and the circumstances confronting the flight crew, the flight crew's decision not to return to Lic Gustavo Diaz Ordaz International Airport, Puerto Vallarta, Mexico, immediately after recognizing the horizontal stabilizer trim system malfunction was understandable.

15. The flight crew's decision to divert the flight to Los Angeles International Airport, Los Angeles, California, rather than continue to San Francisco International Airport, San Francisco, California, as originally planned was prudent and appropriate.

16. The flight crew's use of the autopilot while the horizontal stabilizer was jammed was not appropriate.

17. The captain should have kept the slats and flaps extended when the airplane was found to be controllable in that configuration after the initial dive. (TO BE REVISED)

18. Without clearer guidance to flight crews regarding which actions are appropriate and which are inappropriate in the event of an inoperative or malfunctioning flight control system, pilots may experiment with improvised troubleshooting measures that could inadvertently worsen the condition of a controllable airplane.

19. The acme nut threads on the accident airplane's horizontal stabilizer jackscrew assembly wore at an excessive rate.

20. Alaska Airlines' use of Aeroshell 33 for lubrication of the jackscrew assembly, acme screw thread surface finish, foreign debris, and abnormal loading of the acme nut threads were not factors in the excessive wear of the accident acme nut threads.

21. There was no effective lubrication on the acme screw and nut interface at the time of the Alaska Airlines flight 261 accident.

22. The excessive and accelerated wear of the accident jackscrew assembly acme nut threads was the result of insufficient lubrication, which was directly causal to the Alaska Airlines flight 261 accident.

23. Alaska Airlines' extension of its lubrication interval for its McDonnell Douglas MD-80 horizontal stabilizer components, and the FAA's approval of that extension, the last of which was based on Boeing's extension of the recommended lubrication interval increased the likelihood that a missed or inadequate lubrication would result in excessive wear of jackscrew assembly acme nut threads and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident.

24. When lubricating the jackscrew assembly, removal of used grease from the acme screw before application of fresh grease will increase the effectiveness of the lubrication.

25. A larger access panel would facilitate the proper accomplishment of the jackscrew assembly lubrication task.

26. If the jackscrew assembly lubrication procedure was a required inspection item for which an inspector's signoff is needed, the potential for unperformed or improperly performed lubrications would be reduced.

27. Alaska Airlines' extension of the end play check interval, and FAA's approval of the extension, allowed the accident acme nut threads to wear to failure without the opportunity for detection and, therefore, was a direct cause of the excessive wear and contributed to the Alaska Airlines flight 261 accident.

28. Alaska Airlines' end play check interval extension should have been, but was not, supported by adequate technical data to demonstrate that the extension would not present a potential hazard.

29. The existing process by which manufacturers revise recommended maintenance task intervals and by which airlines establish and revise these intervals does not include task-by-task engineering analysis and justification and, therefore, allows for the possibility of inappropriate interval extensions for potentially critical maintenance tasks.

30. Because of the possibility that higher-than-expected wear could cause excessive wear in less than 2,000 flight hours and the additional possibility that an end play check could be unperformed or improperly performed, the current 2,000-flight-hour end play check interval specified in Airworthiness Directive 2000-15-15 may be inadequate to ensure the safety of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 fleet.

31. The continued collection and analysis of end play data are critical to monitoring acme nut thread wear and identifying excessive or unexpected wear rates, trends, or anomalies.

32. Until August 2000, Alaska Airlines used a fabricated restraining fixture that did not meet Boeing specifications; however, the Safety Board could not determine whether the use of this noncompliant fixture generated an inaccurate end play measurement during the last end play check or whether the use of this fixture contributed to the accident.

33. The on-wing end play check procedure, as currently practiced, has not been validated and has low reliability.

34. Deficiencies in the overhaul process increase the likelihood that jackscrew assemblies may be improperly overhauled.

35. The absence of a requirement to record or inform customers of the end play measurement of an overhauled jackscrew assembly could result in an operator unknowingly returning a jackscrew assembly to service with a higher-than-expected end play measurement.

36. Operators will maximize the usefulness of end play measurements and wear rate calculations by recording on-wing end play measurements whenever a jackscrew assembly is replaced on an airplane.

37. Because the jackscrew assembly is an integral and essential part of the horizontal stabilizer trim system, a critical flight system, it is important to ensure that maintenance facilities authorized to overhaul these assemblies possess the proper qualifications, equipment and documentation.

38. The dual-thread design of the acme screw and nut does not provide redundancy with regard to wear.

39. The design of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 horizontal stabilizer jackscrew assembly did not account for the loss of the acme nut threads as a catastrophic single-point failure mode. The absence of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss contributed to the Alaska Airlines flight 261 accident.

40. When a failure could have catastrophic results, it is not appropriate to rely on maintenance and inspection intervention to prevent the failure from occurring if a practicable design alternative could eliminate the catastrophic effects of the failure mode. (TO BE REVISED)

41. Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes, and if found necessary other transport category airplanes, should be modified to ensure that loss of the horizontal stabilizer trim system's jackscrew assembly acme nut threads or other control assembly does not preclude continued safe flight and landing.

42. Catastrophic single-point failure modes should be prohibited in the design of all future airplanes with horizontal stabilizer trim systems, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems.

43. The certification requirements applicable to transport-category airplanes should fully consider and address the consequences of failures resulting from wear.

44. At the time of the flight 261 accident, Alaska Airlines' maintenance program had widespread systemic deficiencies.

45. The FAA did not fulfill its responsibility to properly oversee the maintenance operations at Alaska Airlines, and at the time of the Alaska Airlines flight 261 accident, Federal Aviation Administration surveillance of Alaska Airlines had been deficient for at least several years.

Probable Cause

The National Transportation Safety Board determines that the probable cause of this accident was a loss of airplane pitch control resulting from the in-flight failure of the horizontal stabilizer trim system jackscrew assembly's acme nut threads. The thread failure was caused by excessive wear resulting from Alaska Airlines' insufficient lubrication of the jackscrew assembly.

Contributing to the accident was
(1) Alaska Airlines' extended lubrication interval, and the FAA's approval of that extension, which increased the likelihood that an unperformed or inadequate lubrication would result in excessive wear of the acme nut threads; and
(2) Alaska Airlines' extended end play check interval, and the FAA's approval of that extension, which allowed the excessive wear of the acme nut threads to progress to failure without the opportunity for detection. Contributing also to the accident was the absence on the MD-80 of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss.

--
Perhaps even more-importantly in the long run, the NTSB had a number of safety recommendations:

As a result of the investigation of the Alaska Airlines flight 261 accident, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration:

1. Issue a flight standards information bulletin directing air carriers to instruct pilots that in the event of an inoperative or malfunctioning flight control system, if the airplane is controllable they should complete only the applicable checklist procedures and should not attempt any corrective actions beyond those specified. In particular, in the event of an inoperative or malfunctioning horizontal stabilizer trim control system, after a final determination has been made in accordance with the applicable checklist that both the primary and alternate trim systems are inoperative, neither the primary nor the alternate trim motor should be activated, either by engaging the autopilot or using any other trim control switch or handle. Pilots should further be instructed that if checklist procedures are not effective, they should land at the nearest suitable airport. (A-02-XX)

2. As part of the response to Safety Recommendation A-01-41, require operators of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes to remove degraded grease from the jackscrew assembly acme screw and flush degraded grease and particulates from the acme nut before applying fresh grease. (A-02-XX)

3. As part of the response to Safety Recommendation A-01-41, require operators of Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series airplanes, in coordination with Boeing, to increase the size of the access panels that are used to accomplish the jackscrew assembly lubrication procedure. (A-02-XX)

4. Establish the jackscrew assembly lubrication procedure as a required inspection item that must have an inspector's signoff before the task can be considered complete. (A-02-XX)

5. Review all existing maintenance intervals for tasks that could affect critical aircraft components and identify those that have been extended without adequate engineering justification in the form of technical data and analysis demonstrating that the extended interval will not present any increased risk and require modifications of those intervals to ensure that they (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. In conducting this review, the Federal Aviation Administration should also consider original intervals recommended or established for new aircraft models that are derivatives of earlier models and, if the aircraft component and the task are substantially the same and the recommended interval for the new model is greater than that recommended for the earlier model, treat such original intervals for the derivative model as "extended" intervals. (A-02-XX)

6. Conduct a systematic industrywide evaluation and issue a report on the process by which manufacturers recommend and airlines establish and revise maintenance task intervals and make changes to the process to ensure that, in the future, intervals for each task (1) take into account assumptions made by the original designers, (2) are supported by adequate technical data and analysis, and (3) include an appropriate safety margin that takes into account the possibility of missed or inadequate accomplishment of the maintenance task. (A-02-XX)

7. Require operators to supply the Federal Aviation Administration, before the implementation of any changes in maintenance tasks intervals that could affect critical aircraft components, technical data and analysis for each task demonstrating that none of the proposed changes will present any potential hazards, and obtain written approval of the proposed changes from the principal maintenance inspector and written concurrence from the appropriate FAA aircraft certification office. (A-02-XX)

8. Pending the incorporation of a fail-safe mechanism in the design of the Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 horizontal stabilizer jackscrew assembly, as recommended in [Safety Recommendation 13 in this report], establish an end play check interval that (1) accounts for the possibility of higher-than-expected wear rates and measurement error in estimating acme nut thread wear and (2) provides for at least two opportunities to detect excessive wear before a potentially catastrophic wear condition becomes possible. (A-02-XX)

9. Require operators to permanently (1) track end play measures according to airplane registration number and jackscrew assembly serial number, (2) calculate and record average wear rates for each airplane based on end play measurements and flight times, and (3) develop and implement a program to analyze these data to identify and determine the cause of excessive or unexpected wear rates, trends, or anomalies. The Federal Aviation Administration (FAA) should also require operators to report this information to the FAA for use in determining and evaluating an appropriate end play check interval. (A-02-XX)

10. Require that maintenance facilities that overhaul jackscrew assemblies record and inform customers of an overhauled jackscrew assembly's end play measurement. (A-02-XX)

11. Require operators to measure and record the on-wing end play measurement whenever a jackscrew assembly is replaced. (A-02-XX)

12. Require that maintenance facilities that overhaul Douglas DC-9, McDonnell Douglas MD-80/90, and Boeing 717 series jackscrew assemblies obtain specific authorization to perform such overhauls, predicated on demonstrating that they possess the necessary capability, documentation, and equipment for the task and that they have procedures in place to (1) perform and document the detailed steps that must be followed to properly accomplish the end play check procedure and lubrication of the jackscrew assembly, including specification of appropriate tools and grease types; (2) perform and document the appropriate steps for verifying that the proper acme screw thread surface finish has been applied; and (3) ensure that appropriate packing procedures are followed for all returned overhauled jackscrew assemblies, regardless of whether the assembly has been designated for storage or shipping. (A-02-XX)

13. Conduct a systematic engineering review of all transport category airplanes to identify means to eliminate the catastrophic effects of a system or associated structure failure in the horizontal stabilizer trim system jackscrew assembly, and, if practical, that all future transport category airplanes incorporate such fail-safe mechanisms. (A-02-XX) (TO BE REVISED)

14. Modify the certification regulations, policies, or procedures to ensure that new horizontal stabilizer trim control system designs are not certified if they have a single-point catastrophic failure mode, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems. (A-02-XX)

15. Review and revise aircraft certification regulations and associated guidance applicable to the certification of transport-category airplanes to ensure that wear-related failures are fully considered and addressed so that, to the maximum extent possible, they will not be catastrophic. (A-02-XX)

16. Issue a Flight Safety Information Bulletin directing air carriers to discourage their dispatch and maintenance control personnel from engaging in in-flight trouble shooting. (A-02-XX) (TO BE REVISED)

[That's what happened, according to the best accident investigators in the world. Now, the lawyers will tell juries what "really" happened, as they look for the deepest pockets (to empty into their own). Thus, money that could be spent on improving safety will be used to pay off "punitive" lawsuits, helping ensure a long-lasting revenue stream of blood money to law firms --ed.]

FMI: http://www.ntsb.gov/publictn/2002/AAR0201.htm