Shift Change Tragedy

Shift Change Tragedy

Former NTSB and FAA investigator Jeff Guzzetti discusses what many believe to be the most striking example of an airline accident caused by systemic deficiencies in maintenance and safety culture.

As a newly hired NTSB field investigator in the early 1990s, I was assigned to a field office that was co-located at NTSB headquarters in Washington, D.C. This location allowed me to attend final NTSB board meetings in which the causes and factors of major airline accidents were presented and discussed in public. One such meeting occurred in July 1992 to adopt the final report of an accident that occurred nine months earlier on September 11, 1991.

Graphic 2 – Final resting site of the main wreckage of the EMB-120. Pieces of the horizontal stabilizer were missing in this area.
Graphic 2 – Final resting site of the main wreckage of the EMB-120. Pieces of the horizontal stabilizer were missing in this area.

The accident involved Continental Express Flight 2574, an Embraer 120 Brasilia turboprop airplane (see graphic above) that broke apart over a cornfield near Eagle Lake, Texas, killing the two flight crewmembers, one flight attendant, and 11 passengers. This commuter airline accident continues to serve as a striking example of a tragedy caused by systemic deficiencies in maintenance, and it introduced the topic of safety culture as an essential tenet in aviation safety.

Graphic 3 – The horizontal stabilizer was the first piece of wreckage along the wreckage distribution path, indicating that it had separated first from the airplane in flight.
Graphic 3 – The horizontal stabilizer was the first piece of wreckage along the wreckage distribution path, indicating that it had separated first from the airplane in flight.

Flight 2574 departed Laredo, Texas, at 9:09 a.m. and was destined for Houston Intercontinental Airport. About an hour into the flight, as it was descending through 12,000 feet on approach to Houston, the airplane suddenly exploded in flames. Several eyewitnesses described the Embraer 120 as “flying normally … wings level, slightly nose down” when it was suddenly “consumed by a fireball with wingtips and part of a tail protruding.” They watched as the airplane entered into a flat spin until impacting the ground, shedding parts during its descent (see graphic 2).

Graphic 4 -  shows the radar-derived descent profile. The last radar contact occurred as flight 2574 was descending through 11,800 feet.
Graphic 4 – shows the radar-derived descent profile. The last radar contact occurred as flight 2574 was descending through 11,800 feet.

Many of the separated parts of the airplane were located within a two-mile radius of the main wreckage. The horizontal stabilizer, located on top of the T-tail, was lying about 650 feet southwest of the main wreckage (see graphic 3). Some of the structure from the upper third of the vertical stabilizer was still attached to the horizontal stabilizer. The lower two-thirds of the vertical stabilizer remained attached to the tail cone in the main wreckage. The leading edge/deice boot assembly for the left side was missing from the horizontal stabilizer, but was later found in a small corral about one mile west of the main impact site. This part was the first chunk of wreckage found along the wreckage path, indicating that it was the first to separate from the airplane in flight.

Graphic 5 – radar-derived ground track and wreckage diagram.
Graphic 5 – radar-derived ground track and wreckage diagram.

Black Box Data and Recorded Radar

One of the first actions that NTSB performs in an airline accident investigation is to recover the cockpit voice recorder (CVR) and flight data recorder (FDR). In this case, their quick recovery yielded valuable data. A readout of the FDR showed the airplane was descending through 11,500 feet at 260 knots when it abruptly pitched down and entered a steep dive. A negative load factor of at least 3.3 g was reached about one second after the upset, with a corresponding decrease in airplane pitch attitude.

The CVR picked up sounds of objects being upset in the cockpit followed immediately by a human “grunt” at the time of the accident. The remaining sounds heard were produced by the airplane’s aural warning systems along with mechanical sounds that were consistent with an inflight structural failure.

The NTSB also collected and analyzed recorded radar data that traced the breadcrumb trail of Flight 2574 during the accident flight. Graphic 4 shows the radar-derived ground track of flight 2574, selected sounds from the CVR, and the wreckage distribution. Graphic 5 provides a close-up view of part of the ground track and wreckage distribution. It was clear to investigators that the horizontal stabilizer had separated from the fuselage before ground impact. Investigators surmised that the loss of the leading edge/deice boot assembly exposed the front spar of the left horizontal stabilizer to the airstream, prompting an aerodynamic stall that greatly reduced the downforce produced by the horizontal stabilizer, as shown in graphic 6, next page.

But why did the horizontal stabilizer come apart in flight? Investigators quickly realized that the 47 screw fasteners that would have attached the upper surface of the leading edge assembly to the left horizontal stabilizer were missing. Additionally, there was no evidence of distress in the upper attachment holes or any other indication that the screws were installed when the assembly separated from the horizontal stabilizer.

Systemic Maintenance Deficiencies

The NTSB review of the maintenance records revealed that two weeks prior to the accident, during a fleet-wide campaign to examine aircraft deice boots for winter operation, a quality control inspector had noted both leading edge boots on the accident airplane had dry-rotted pin holes along the entire length of the boots. So, on the night before the accident, the airline’s maintenance control office scheduled both deice boots to be replaced. NTSB interviews with maintenance personnel revealed that this maintenance action occurred during a shift change.

The Continental Express General Maintenance Manual (GMM) had FAA-approved procedures for shift turnovers that required briefings by mechanics to supervisors, briefings by outgoing supervisors to incoming supervisors, completion of maintenance and inspection shift turnover forms (so that oncoming personnel would be aware of incomplete work), and the documentation of incomplete work that would be noted by the mechanic on the reverse sides of work cards. The Safety Board concluded that the GMM contained clear procedures, which, if followed, could have prevented the accident.

Graphic 6 – The T-tail was designed to produce a down force (shown by blue arrow pointing down) to balance the wing lift forces.  However, in this accident, the left half of the tail force was eliminated by the failure of the leading edge (shown in red lettering).
Graphic 6 – The T-tail was designed to produce a down force (shown by blue arrow pointing down) to balance the wing lift forces. However, in this accident, the left half of the tail force was eliminated by the failure of the leading edge (shown in red lettering).

Investigators interviewed a dozen mechanics who had worked on the airplane. They discovered that the events during the maintenance and inspection of the aircraft on the night before the accident were directly causal to the accident. Several errors were made by specific individuals responsible for the airworthiness of the airplane.

For example, the second shift supervisor responsible for the accident airplane failed to solicit an end-of-shift verbal report (shift turnover) from the two mechanics he assigned to remove the deice boots. Moreover, he failed to give a turnover to the oncoming third shift supervisor. To add insult to injury, the second shift supervisor had demonstrated recent substandard performance that was not addressed by management. For example, one month before the accident, he “missed a crack in the inspection of an engine exhaust stack” on one occasion, and he “missed 15 task cards” while performing maintenance on another occasion.

The Safety Board concluded that the upper row of screws that had been removed from the leading edge of the left horizontal stabilizer was undetected because the approved procedures in the GMM were not followed by the maintenance personnel directly charged with evaluating the airworthiness of the airplane before it was returned to service.

However, in the end, they determined that the reasons for the errors and the overall failure of the maintenance program were complex and not simply related to a single failure by any single individual. The NTSB also found no evidence that the two pilots were informed of the work that had been performed on the tail. The top of the horizontal stabilizer on the airplane’s T-tail rests about 20 feet above the ground; therefore, the flight crew could not have seen the area of the missing screws on top of the leading edge/deice boot during their normal preflight inspection. However, if they had been informed of the maintenance, they might have discussed the work and conducted a visual inspection of the stabilizer’s upper surface.

Another factor discussed in the final NTSB board meeting was the failure of Continental Express maintenance and quality assurance personnel to treat the deicing boot replacement — which requires removal of the leading edge of the horizontal stabilizer — as a Required Inspection Item (RII). By doing so, a separate inspection by quality control inspectors would have been required of the work performed that night. Even though regulations clearly establish that the horizontal stabilizer is an RII, Continental Express maintained that the deice boot/leading edge assembly was a “non-structural” item, and therefore not subject to the more rigorous inspection requirements.

Inadequate Safety Orientation

The NTSB report identified “substandard practices and procedures and oversight” by numerous individuals, each of whom could have prevented the accident. Included were mechanics, quality assurance inspectors, and supervisors, all of whom demonstrated a “general lack of compliance with the approved procedures.” Departures from approved procedures included failures to solicit and give proper shift-change turnover reports, failures to use maintenance work cards as approved, failures to complete required maintenance/inspection shift turnover forms, and a breach in the integrity of the quality control function by virtue of an inspector serving as a mechanic’s assistant during the early stages of the repair work performed on the accident aircraft.

Furthermore, investigators discovered two previous maintenance actions taken on the accident aircraft, each of which departed from the approved procedures, and each of which involved employees different from those engaged in the deice boot replacement. The first event was the replacement of an elevator without use of the required manufacturer-specified balancing tools, and the second was a failure to follow specified procedures and logging requirements in response to an engine overtorque.

wreckage investigation

Finding no. 18 in the report sums up the issue of Safety Culture: “The deficiencies noted in the maintenance department at Continental Express indicate that the airline’s management did not instill an adequate safety orientation in its maintenance personnel by emphasizing the importance of adhering to procedure.” During the months and years after this investigation, the words “safety orientation” were replaced by the term “safety culture” in the lexicon of aviation safety. The seeds of Safety Management Systems (SMS) for aviation were planted.

wreckage documentation

The NTSB determined that the probable cause of the accident was “the failure of Continental Express maintenance and inspection personnel to adhere to proper maintenance and quality assurance procedures for the airplane’s horizontal stabilizer deice boots that led to the sudden in-flight loss of the partially secured left horizontal stabilizer leading edge and the immediate severe nose-down pitch-over and breakup of the airplane.” Contributing to the cause was “the failure of the Continental Express management to ensure compliance with the approved maintenance procedures, and the failure of FAA surveillance to detect and verify compliance with approved procedures.”

A Rare Dissenting Opinion

But the story doesn’t stop there. Following the adoption of the probable cause, a rare “dissenting opinion” was issued by one of the NTSB board members — Dr. John K. Lauber, considered a giant in the field of human factors. Lauber wrote: “I am perplexed by the majority decision that the actions of Continental Express senior management were not [determined to be] causal in this accident. It is clear … that the series of failures which led directly to the accident were not the result of an aberration, but rather resulted from the normal, accepted way of doing business at Continental Express. … By permitting deviations to occur on a continuing basis, senior management created a work environment in which a string of failures, such as occurred the night before the accident, became probable. Accordingly, their role must be considered causal in this accident.”

Lauber also expressed his concern that senior personnel responsible for maintenance did not understand that the leading edge of any airfoil is a critical component for which improper repair work could seriously compromise the safety of the aircraft.

As a result of this investigation the Safety Board issued four safety recommendations to the FAA to review the rules and practices regarding RIIs, advise pilots of critical maintenance actions, enhance surveillance of Continental Express, and emphasize inspection of equipment, procedures and quality assurance to evaluate the effectiveness of air carrier maintenance programs.