Former NTSB and FAA air safety investigator Jeff Guzzetti tells the story of how a single unsecured bolt led to a deadly crash of a DC-8 cargo plane and the eventual demise of an airline.
Readers of Aviation Maintenance may recall my article published in March 2020 about Alaska Airlines flight 261, an MD-82 that crashed off the coast of California (www.avm-mag.com/from-c-check-to-tragedy-lessons-learned-from-alaska-flight-261) in January 2000. While investigating that accident, my NTSB colleagues launched on yet another maintenance-related crash that occurred about 400 miles north of where Alaska 261 went down. This second crash occurred on February 16, 2000 — 16 days after Alaska 261 — and involved a Douglas DC-8 airliner operated by Emery Worldwide Airlines (see main image) as flight 17. The accident received less attention than Alaska 261, perhaps because it was “only” a cargo flight that had no passengers. Still, three crewmembers died, and the findings from the investigation continue to echo lessons that every mechanic and maintenance manager should heed.
Emery flight 17 slammed into an automobile salvage yard less than two minutes after lifting off from runway 22L at Mather Airport in Sacramento, California, while attempting to return to the airport for an emergency landing. The 43-year-old captain, 35-year-old first officer, and 38-year-old flight engineer perished in the accident. The airplane was destroyed by impact forces and a massive post-crash fire (see graphic 2). The jet was destined for Dayton, Ohio, with 31 tons of cargo in its hold, lighter than usual.
Extreme C.G. Problem
A few seconds after takeoff, the crew declared an emergency with air traffic control (ATC). The last radio call from the DC-8 was: “Emery 17, extreme C.G. problem.” Additional communications were eventually recovered from the voice and data recorders (CVR and FDR), which investigators overlaid on the accident flight path (see graphic 3). The overlay shows that as the DC-8 lifted off, it entered a left turn and the nose continued to rise upward. The crew pushed on the control column to get the nose down, but to no avail. They looped around to the left for the emergency landing and began to descend. The crew added power which helped a bit, but the DC-8 banked to the left and began to descend. That’s when the captain radioed his “extreme” problem with the C.G., or center of gravity.
The cargo plane’s left wing contacted the edge of a two-story building and careened into the automobile salvage yard, striking hundreds of cars and exploding into a torrent of flame. The wreckage was strewn over an area of about 1,500 feet long (see graphics 4 and 5). The fuselage was broken into several sections, along with the engines, landing gear, flight controls, wing sections, and stabilizers. Large portions of the airframe and its cargo were disintegrated or consumed by fire.
Cargo Shift or Flight Control Jam?
Most accidents that I have investigated involved one or more “red herrings” — pieces of information that can mislead or distract from the truth. For Emery flight 17, the “C.G.” comments served as the red herrings. Investigators spent days with the grim task of sifting through a mix of burnt aircraft and automobile parts, attempting to identify remnants of cargo flooring and tie-down components, in search of a potential cargo tie-down problem or load shift. Other go-team members worked off-site at locations where the airplane was loaded and maintained. They conducted ground crew interviews and perused records. The loading for the accident flight was routine, and the airplane was operated within its prescribed center of gravity limits and weight limitations.
Meanwhile, NTSB specialists back in Washington DC analyzed flight recorder data and compared it to previous cargo-related accidents like the Fine Air DC-8 cargo crash in Miami in 1997. The data from Emery flight 17 did not indicate a cargo shift, or a C.G. that was out of limits. Instead, they noticed anomalies with the movement of the elevators and the airplane pitch attitude which were consistent with a flight control malfunction. As a result, investigators at the accident site prioritized the identification of elevator control system components.
The DC-8’s elevator system is “tab-driven.” The cockpit control columns are mechanically linked to the elevator control tabs, and the deflection of the control tabs in flight results in deflection of the elevators which results in changes in the airplane’s up/down pitch attitude. Each elevator control tab is hinged to the inboard trailing edge of the associated elevator surface, then connected by a mechanical linkage that includes a crank fitting, pushrod, and bell crank (see graphics 6 and 7). Two pushrods, attached to the inboard and outboard ends of the elevator geared tabs, connect the tabs to the horizontal stabilizers’ rear spar. As the elevator position changes in relation to the horizontal stabilizer, linkages move the elevator geared tabs in the opposite direction, providing an aerodynamic boost in moving the elevators to reduce the control force required by the pilots.
Note: This graphic depicts the left side. The right side was the issue in the accident airplane.
A Missing Bolt
Examination of the elevator components at the crash site revealed a missing bolt at the right elevator control tab crank fitting where the control tab pushrod is normally attached. The pushrod was recovered separately and remained intact at the missing bolt location. Investigators were curious to see indications of contact damage on the forward edges of the right crank fitting (see graphics 8 and 9). There was no physical damage or other evidence indicating that the bolt failed or fractured, and failure of an installed castellated nut and/or cotter pin during normal operation would be very unlikely. The Board surmised: The bolt must have separated because it had not been properly secured; that is, the required castellated nut was either never installed, or it was improperly installed (for example, installed without a cotter pin).
By utilizing an exemplar DC-8 aircraft, the NTSB conducted tests on the elevator flight controls to identify the effects of a free pushrod when disconnected from its control tab. The testing revealed that a disconnected control tab would result in a mismatch between the left and right trim tab of 25 degrees throughout the range of control column travel. The testing further revealed that the disconnected control tab would be deflected about twice as far, and in an opposite direction to, the other control tab, even if the control columns were commanded full forward by the pilots (i.e., nose down).
After reviewing the behavior of the elevators during the previous 25 hours of recorded flight information on the FDR, the NTSB surmised that the bolt connecting the right elevator control tab crank fitting to the pushrod migrated out of its fitting at some time after the previous takeoff and before the accident takeoff. This allowed the control tab to disengage from its pushrod and shift to a trailing edge down position. When the aerodynamic forces increased as the airplane accelerated during the takeoff roll, the right elevator control tab crank fitting contacted the disconnected pushrod, restricting the control tab movement upward (see graphic 10). As a result of this deflection, the DC-8’s elevator surfaces were driven to an extreme airplane nose-up pitch attitude. Despite the pilots’ best efforts to push down on the control columns, they were unable to overcome the effects of the jam.
Clues in the Maintenance Records and Procedures
Investigators poured over the DC-8’s maintenance records for clues as to why the control tab bolt was not secured properly. Emery contracted most of their maintenance to an overhaul facility in Tennessee which performed the accident airplane’s most recent D-check. The MRO records indicated that the elevator assemblies, including their control tabs, had been replaced with overhauled assemblies during a D-7 check completed three months before the crash.
A review of Emery’s aircraft records indicated that the elevators were touched again a few weeks later during the airplane’s most recent B-check inspection, which was conducted overnight at Emery’s facility in Dayton three weeks before the accident. Emery’s DC-8 work card for this B-2 inspection was titled “RH and LH Horizontal Stabilizer External Surface Inspection.” Interviews with all the mechanics involved with the D-7 and B-2 checks revealed that no one specifically remembered working with the elevators, but they were able to correctly describe the procedure. The NTSB was unable to determine if the source of the unsecured bolt was from the most recent D inspection or the subsequent B-check maintenance. In the end, the probable cause was cited as “a loss of pitch control resulting from the disconnection of the right elevator control tab” which was “caused by the failure to properly secure and inspect the attachment bolt.”
More Discoveries
Investigators also discovered deficiencies and inconsistencies in the DC-8 manuals and work cards provided by the manufacturer, and those developed by the airline. For example, the applicable maintenance manual reference for the elevator check revealed that no hardware requirements were specified for the missing bolt location, and no specific instructions were provided for the inspection requirements of this installation.
Emery conducted a post-crash fleet inspection of its DC-8 elevators and reported that cotter pins were correctly installed on all of its DC-8 control tab pushrods at their forward and aft ends. However, they also discovered that the bolts installed at the aft pushrod connections were oriented opposite to that depicted in the DC-8 manual on 11 aircraft. Three pushrods were damaged and one was found installed backwards.
The agency made several safety recommendations to the FAA to require improvements with the DC-8 elevator rigging procedures and other aircraft specific components. Several more recommendations were issued for all aircraft and airlines to address deficiencies with the accuracy and management of maintenance manuals, illustrated parts catalogs, and task documents used to accomplish maintenance. The FAA acted on most of these recommendations.
The Rest of the Story
The story of Emery flight 17 began before the DC-8 slammed into the salvage yard. The airline had been hurting financially, and safety took a back seat in the maintenance department. About a month before the accident, the FAA placed Emery under a “heightened state of oversight” because FAA inspectors observed numerous apparent violations of the Federal Air Regulation (FARs) with maintenance.
Following the accident, the FAA conducted more special inspections of the airline and uncovered over a hundred apparent violations of the FARs, including improper repairs, repetitive pilot write-ups of the same problem on the same aircraft, unapproved aircraft installations/alterations, operations of unairworthy aircraft, procedural non-compliance of their manuals, and inadequate record keeping. Additionally, the FAA announced proposed fines totaling $198,000 because the airline operated one DC-8 without proper maintenance, and another aircraft without compliance with an airworthiness directive.
Emery also drew the NTSB’s attention with more incidents. One involved maintenance workers installing the wrong landing gear component in one of its remaining DC-8s, leaving the crew unable to lower its landing gear. In another incident, an Emery plane conducted an emergency landing in Denver after an engine failure and loss of cabin pressure that occurred due to the failure of a clamp that secured the high-pressure air duct.
After 19 months under this heightened oversight, on August 13, 2001, Emery signed an agreement with the FAA to immediately cease operating until it resolved the safety issues. Ultimately, the airline was unable to do so and surrendered its operating certificate on December 4, 2002 — less than two years after Emery flight 17. Emery’s cargo operations were subcontracted to other airlines and its successor company was later acquired by UPS in 2004.
Emery Worldwide, which had been one of the leading carriers in the cargo airline world for decades, was defunct. Its economic health may have been the cited reason for its demise, but the flight 17 accident was ultimately the back-breaker that served as the tip of the iceberg which indicated a larger problem beneath the surface of a weak maintenance program that did not receive the care it needed.