Redesign and Retrofit of Elevator Controls Called for on DC-8 Aircraft

Air Safety Week,  August 11, 2003  

• E-mail
• Print
• Link

Missing retention bolt in elevator actuator mechanism led to crash of Emery jet

For want of proper maintenance, the retaining bolt was improperly installed. For want of the bolt, the elevator jammed. For want of redundancy, the pilots lost pitch control. For want of control, the airplane crashed.

While the proximate cause of the fatal Feb. 16, 2000, crash of an Emery Worldwide Airlines DC-8 freighter may track to actions not taken on the hangar floor, the ultimate cause links back to the design floor.

In terms of a "single point failure," the accident is an important case study. The National Transportation Safety Board (NTSB) concluded its investigation into the crash of Emery Flight 17 last week with a battery of recommendations for improved maintenance. Also contained in the numerous recommendations is a call to retrofit all DC-8s with a more redundant flight control system. Such a mandate would affect 110 DC-9s in U.S. registered service (148 others are in service worldwide and 72 are stored).

No escape clause

The recommendation is significant because it does not leave the matter of retrofit optional, as occurred before. In its report of the fatal January 2000 crash of an Alaska Airlines MD-83 twinjet, also from a failed elevator control system, the safety board called for the installation of a fail-safe system "if practicable." Those two words are absent in the board's recommendations emanating from the Emery crash. To avoid an "unacceptable response" categorization by the NTSB, the Federal Aviation Administration (FAA) must mandate retrofit of a modified design. Compare the relevant recommendations:

Emery DC-8: "Require Boeing to redesign DC-8 elevator control tab installations and require all DC-8 operators to then retrofit these installations such that pilots are able to safely operate the airplane if the control tab becomes disconnected from the pushrod." Recommendation #5 of 15 recommendations adopted Aug. 5.

Alaska MD-83: Conduct a systematic engineering review to ... identify means to eliminate the catastrophic effects of total acme nut failure in the horizontal stabilizer trim system jackscrew assembly in Douglas DC-9, MD-80/90 and Boeing B717 series airplanes and require, if practicable, that such failsafe mechanisms be incorporated in ... all existing and future airplanes that are equipped with such ... trim systems." (Emphasis added) Recommendation A-02-49, adopted Dec. 30, 2002.

Of interest, the DC-9, MD-80/90 and B717 aircraft also feature tab-driven elevators.

Investigators first thought the crash of the Emery freighter was caused by an out-of-balance condition, as the flight crew reported such in their last radio transmission to air traffic control: "Emery 17, extreme CG [center of gravity] problem." The crash seemed to repeat that of a Fine Air DC-8 freighter from an out of balance condition in 1997. But when it became evident that the Emery jet was within its weight and balance limits, investigators dug deeper. Anomalies in the elevator position during the doomed airplane's brief flight pointed to a control problem.

Bolt in backwards

The left and right elevators on the DC-8 are moved up and down in response to aerodynamic forces on a control tab attached to each. The tab is moved up and down in response to a pushrod that is connected via cabling to the control yoke. Pull back on the stick and the control tab moves down. The resulting upward aerodynamic force on the tab moves the elevator trailing edge up, which in turn pushes the nose up. Push forward on the stick and the control tab moves up, forcing the elevator trailing edge down, thereby dropping the nose.

Each tab assembly depends on the integrity of a single bolt connecting the pushrod to the bellcrank, which is affixed to the tab. If the tab control mechanism on one side fails, causing the hinged elevator to move to the full trailing edge up position, the tab control system on the other side cannot overcome the failure, because the elevators have more nose-up than nose-down movement. The airplane was built to certification standards in effect more than 40 years ago, in which this kind of design was acceptable. Material submitted by the Air Line Pilots Association (ALPA) as part of the investigation address this issue of a single point failure. ALPA represented Emery pilots. The cargo carrier, described by Mark McConaughy, the FAA's deputy operations inspector for Emery, as "the largest inexpensive airline in the world," has since gone out of business (see ASW, July 1, 2002).

The elevator control system underwent maintenance when the accident airplane was overhauled in November 1999. This D check was performed by Tennessee Technical Services of Smyrna, Tenn., which was doing the work on contract to Emery. During the course of this work, the elevator assemblies were removed.

Eight days after the D check was completed, pilots reported that the elevators seemed stiff, requiring more back pressure to flare the aircraft on landing. Emery technicians found the elevator dampers had been reversed during the course of the work at Tennessee Tech. However, placing the dampers in their proper position would have had no effect in alleviating the control stiffness reported by pilots, NTSB investigator-in-charge Frank Hildrup said at the board hearing last week.