Copyright 2003 PBI Media, LLC. All rights reserved.
AIR SAFETY WEEK

August 11, 2003

For want of proper maintenance, the retaining bolt was improperly
installed. For want of the bolt, the elevator jammed. For want of redundancy,
the pilots lost pitch control. For want of control, the airplane crashed.
While the proximate cause of the fatal Feb. 16, 2000, crash of an Emery
Worldwide Airlines DC-8 freighter may track to actions not taken on the hangar
floor, the ultimate cause links back to the design floor.

In terms of a "single point failure," the accident is an important case
study. The National Transportation Safety Board (NTSB) concluded its
investigation into the crash of Emery Flight 17 last week with a battery of
recommendations for improved maintenance. Also contained in the numerous
recommendations is a call to retrofit all DC-8s with a more redundant flight
control system. Such a mandate would affect 110 DC-8s in U.S. registered service
(148 others are in service worldwide and 72 are stored).

No escape clause

The recommendation is significant because it does not leave the matter of
retrofit optional, as occurred before. In its report of the fatal January 2000
crash of an Alaska Airlines MD-83 twinjet, also from a failed elevator control
system, the safety board called for the installation of a fail-safe system "if
practicable." Those two words are absent in the board's recommendations
emanating from the Emery crash. To avoid an "unacceptable response"
categorization by the NTSB, the Federal Aviation Administration (FAA) must
mandate retrofit of a modified design. Compare the relevant recommendations:
Emery DC-8: "Require Boeing to redesign DC-8 elevator control tab
installations and require all DC-8 operators to then retrofit these
installations such that pilots are able to safely operate the airplane if the
control tab becomes disconnected from the pushrod." Recommendation #5 of 15
recommendations adopted Aug. 5.

Alaska MD-83: Conduct a systematic engineering review to ... identify
means to eliminate the catastrophic effects of total acme nut failure in the
horizontal stabilizer trim system jackscrew assembly in Douglas DC-9, MD-80/90
and Boeing B717 series airplanes and require, if practicable, that such fail-
safe mechanisms be incorporated in ... all existing and future airplanes that
are equipped with such ... trim systems." (Emphasis added) Recommendation A-02-
49, adopted Dec. 30, 2002.

Of interest, the DC-9, MD-80/90 and B717 aircraft also feature tab-driven
elevators.

Investigators first thought the crash of the Emery freighter was caused
by an out-of-balance condition, as the flight crew reported such in their last
radio transmission to air traffic control: "Emery 17, extreme CG [center of
gravity] problem." The crash seemed to repeat that of a Fine Air DC-8 freighter
from an out of balance condition in 1997. But when it became evident that the
Emery jet was within its weight and balance limits, investigators dug deeper.
Anomalies in the elevator position during the doomed airplane's brief flight
pointed to a control problem.

Bolt in backwards

The left and right elevators on the DC-8 are moved up and down in
response to aerodynamic forces on a control tab attached to each. The tab is
moved up and down in response to a pushrod that is connected via cabling to the
control yoke. Pull back on the stick and the control tab moves down. The
resulting upward aerodynamic force on the tab moves the elevator trailing edge
up, which in turn pushes the nose up. Push forward on the stick and the control
tab moves up, forcing the elevator trailing edge down, thereby dropping the
nose.

Each tab assembly depends on the integrity of a single bolt connecting
the pushrod to the bellcrank, which is affixed to the tab. If the tab control
mechanism on one side fails, causing the hinged elevator to move to the full
trailing edge up position, the tab control system on the other side cannot
overcome the failure, because the elevators have more nose-up than nose-down
movement. The airplane was built to certification standards in effect more than
40 years ago, in which this kind of design was acceptable. Material submitted by
the Air Line Pilots Association (ALPA) as part of the investigation address this
issue of a single point failure. ALPA represented Emery pilots. The cargo
carrier, described by Mark McConaughy, the FAA's deputy operations inspector for
Emery, as "the largest inexpensive airline in the world," has since gone out of
business (see ASW, July 1, 2002).

The elevator control system underwent maintenance when the accident
airplane was overhauled in November 1999. This D check was performed by
Tennessee Technical Services of Smyrna, Tenn., which was doing the work on
contract to Emery. During the course of this work, the elevator assemblies were
removed.
Eight days after the D check was completed, pilots reported that the
elevators seemed stiff, requiring more back pressure to flare the aircraft on
landing. Emery technicians found the elevator dampers had been reversed during
the course of the work at Tennessee Tech. However, placing the dampers in their
proper position would have had no effect in alleviating the control stiffness
reported by pilots, NTSB investigator-in-charge Frank Hildrup said at the board
hearing last week.

The area of interest was on the right side, where the control rod and tab
fitting were found, but not the bolt connecting the two. Sources say the nut was
found inside the elevator. The consequence of a bolt falling out of position
would be significant. It could happen if put in backwards, without a cotter pin.
As Hildrup explained, a disconnected pushrod could slide over the face of the
left bracket on the tab fitting, "blocking the tab in the extreme down
position." Indeed, score marks on the fitting suggest contact damage from a
loose pushrod banging against the fittings.

As the airplane gained speed on takeoff, the aerodynamic force on the
full-down tab would force the elevator trailing edge up, causing the nose to
rise. The pilots could push the yoke forward, applying full nose-down pitch, to
no avail. This is exactly the situation captured on the flight data recorder
(FDR).

The bolt fell out of its proper position either by the bump of touchdown
on landing of the previous flight from Las Vegas, Nev., to Rancho Cordova,
Calif., or it slipped out during the flight control checks conducted routinely
before takeoff. This scenario is supported by the dramatic difference in
recorded elevator position during the previous flight and the accident flight.
On the accident flight, the elevators never moved to the trailing edge
down position, even during the 80-knot check during takeoff, when pilots move
the elevators as a last-minute procedure to ensure that they have full range of
control motion.

Vulnerable to a maintenance mishap

The absence of a reliably redundant design left the system vulnerable to
shortcomings in maintenance. Of these, there were plenty, according to the reams
of documents and witness testimony amassed during the course of the
investigation. During the NTSB's May 2002 fact-finding hearing on the crash,
Bruce Robbins, former director of engineering for Emery, characterized the
maintenance deficiencies as "warts" that might be found in any operation. NTSB
member John Goglia shot back, "I think we've found cancer."

The hearings revealed egregious shortcomings in maintenance and
maintenance oversight. Manuals, work cards, the continuing analysis and safety
surveillance (CASS) program and other key elements of maintenance management and
control ran the gamut from out-of-date to ignored to dysfunctional. McConaughy's
description of the situation he and other FAA inspectors found at Emery, as
related to NTSB officials following the crash of Flight 17, provides a
description of slackness beyond complacent and potentially criminal. McConaughy
told NTSB investigators, "I suggested to my superiors the possibility that a
criminal investigation needs to be opened ... because ... as far as these
[maintenance] sign offs, I mean, you need to write 'Once Upon a Time' across the
page because it's a fairy tale."

The Emery pilots union published a newsletter to its membership warning
of "an increasing potential for disaster." (See ASW, July 1, 2002) "Management
makes minimal investment in ... aircraft and our safety, as our aging DC-8 fleet
...further deteriorates," the newsletter said.

"Management has dealt us a losing hand and we are the ones who have
everything to lose, not them!" the newsletter lamented.
That was in January 2000, published with chilling coincidence just before
the Flight 17 crash.

Grounded too late?

In August 2001, FAA inspectors found more than 100 "apparent" violations
and ordered the carrier to cease operations (see ASW, Aug. 20, 2001, and May 20,
2002).

Yet there are some who believe the FAA was not sufficiently aggressive in
dealing with the regulatory evasions at Emery. Family members of pilots killed
in the Emery and the earlier Fine Air crash asserted in a May 14, 2002, letter
to every member of Congress that FAA oversight was lacking. Donald Land, father
of copilot George Land on Emery Flight 17, charged that the FAA awarded
airworthiness certificates to unqualified people and companies, and to Emery in
particular. Even while under special FAA scrutiny, the airline "was still
ignoring maintenance and line-safety issues by allowing continued operation of
non-airworthy aircraft," Land said. "It is time to stop the killings," he
pleaded.

In that correspondence to Congress, Audrey Ulozas and Deidre Thompson,
mothers of the dead Fine Air pilots, were even more scorching in their criticism
of the FAA:

"The FAA's failure to provide adequate oversight, and enforce Federal
Aviation Regulations, are direct causes of the Emery and Fine Air tragedies.
"Emery 17's crash is the second time within 30 months that the FAA has
dropped the ball. Eleven days before the Fine Air crash, it was reported to the
FAA by another commercial airline pilot that he overheard [a] first office of
Fine Air on the radio saying, 'What are you trying to do, kill us?'

"For both Fine Air 101 and Emery 17, our government had advance knowledge
that disaster was looming and in both cases chose to ignore it."

In the NTSB's findings in the crash of Emery Flight 17, short-comings in
oversight were not mentioned. Nor was any FAA laxity mentioned in the probable
cause. In two previous cases, the NTSB specifically cited shortcomings in FAA
oversight as contributing factors.

NTSB chairman Ellen Engleman said the tragedy of Emery Flight 17
"illustrates the interdependence and critical roles and responsibilities of each
member of the aviation safety chain.

"Safety requires 100 percent performance by everyone," she said.

"Everyone" includes, by implication, the FAA.

Nonetheless, ALPA officials asserted that the FAA skirted criticism. "The
board's recommendations hit on the technical issues and on the problems with the
maintenance manuals, but in a perfect world the board could have been more
specific about the FAA's oversight of Emery and of cargo carriers in general,"
said Capt. Terry McVenes, executive air safety vice-chairman at ALPA.

Shortly after the NTSB's final hearing on the Emery crash adjourned, ALPA
issued a statement expressing its view that the NTSB could have gone further:
"This investigation revealed significant safety issues in cargo airline
operations, loading and maintenance practices, and FAA oversight. While ... we
are pleased with the recommendations the Board did make, we are disappointed
that these recommendations did not go far enough in addressing deficiencies in
corporate safety culture and FAA oversight."

An industry source suggested an unofficial "nonaggression pact" presently
exists between the NTSB and the FAA. Besides, the Department of
Transportation/Inspector General (DOT/IG) already has roundly criticized FAA
oversight of contract maintenance. (See ASW, July 21). The NTSB has little to
gain by adding to the DOT/IG's sweeping findings.

The NTSB's technical focus in the Emery case appears to be part of a
larger theme. It might be called the quest for reliable redundancy. In the
aftermath of fatal crashes and incidents involving the B737 rudder, the safety
board called for the retrofit of a "reliably redundant" rudder control system
(see ASW, March 29, 1999, and April 26, 1999). The safety board urged a similar
approach to the pitch trim system on Douglas-designed twinjets and their
derivatives after the Alaska Flight 261 crash.

Now, in the Emery case, while the words "reliably redundant" do not
appear specifically, that standard is the desired end-point in the redesign and
retrofit of the control tab installations the board has called for on DC-8
aircraft.

>> Engleman, tel. 202/314-6143; Goglia, tel. 202/314-6660 <<

Not an Evil Empire But a Few Evil People in the Empire

Observations of Mark McConaughy, assistant principal FAA operations
inspector for Emery, to NTSB investigators (extracts):

"When I started - about a week through this place I saw, you know, we've
got some big problems here."

"You're talking four different models of DC-8 [here at Emery]. So there's
a lot to keep track of there."

"In a lot of manuals ... there's a lot of vague statements and ... room
for, like my wife lovingly calls it, 'wiggle room,' where they can just dance
around some things."

"The training manuals made reference to other manuals that either didn't
exist or the material that was in them was outdated or just shouldn't have been
there."

"It doesn't take a rocket scientist to figure out what's going on around
here. If you're not right there when an incident occurred to see what was going
on, when the paperwork was done ... we don't have the tools ... to be able to
pull somebody in the room [and say], hey, Todd, you put this down here on the
paper, now what's the deal?"

"And if you can prove someone made a false statement intentionally just
for the purpose of moving an airplane, to me that's criminal."

"Like on these load planning sheets. They get signed before the last
pallet goes on the airplane. What it says in that statement is I certify that
all containers are properly loaded. But it goes on and says, I certify that all
this has been done. Well, it's not done when he signs it. That's a false
statement."

"I heard the vice president of maintenance say that he had discovered
that there's apparently a function on their maintenance computer that if a
write-up occurs over 'x' number of times, that it will flag it ... he discovered
that that [flag] had been turned off. It's turned back on now, but of course I'd
like to know who turned it off."

"The FARs [Federal Aviation Regulations] are written to deal with a
person whose initial objective is to comply with the regulations. When you get
into a situation where you have ... persons who ... don't want to comply with
the regulations, it starts getting real tough."

"As I heard someone quip once, 'this isn't an evil empire but there might
be a few evil people in the empire.' "

"Basically what we're dong is recertifying the airline in place, while
they're operating."

Source: NTSB, Docket No. SA-521, Exhibit 2-C


A Tale of Three Probable Causes


* Emery Flight 17, DC-8-71F, Feb. 16, 2000: "The probable cause of the
accident was a loss of pitch control resulting from disconnection of the right
elevator control tab. The disconnection was caused by the failure to properly
secure and inspect the attachment bolt." Approved Aug. 5, 2003

* Fine Airlines Flight 101, DC-8-61F, Aug. 7, 1997: "The probable cause
of the accident, which resulted from the airplane being misloaded to produce a
more aft center of gravity and a correspondingly incorrect stabilizer trim
setting that precipitated an extreme pitch-up at rotation, was (1) the failure
of Fine Air to exercise operational control over the cargo loading process; and
(2) the failure of Aeromar to load the airplane as specified by Fine Air.
Contributing to the accident was the failure of the Federal Aviation
Administration (FAA) to adequately monitor Fine Air's operational control
responsibilities for cargo loading and the failure of the FAA to ensure that
known cargo-related deficiencies were corrected at Fine Air.
Safety issues discussed in this report include the effects of improper
cargo loading on airplane performance and handling, operator oversight of cargo
loading and training of cargo loading personnel, the loss of critical flight
data recorder information, and FAA surveillance of cargo carrier operations."
Adopted, June 16, 1998.

* ValuJet Flight 592, DC-9-32, May 11, 1996: "The probable causes of the
accident, which resulted from a fire in the airplane's class D cargo compartment
... were (1) the failure of SabreTech to properly prepare, package, and identify
unexpended chemical oxygen generators before presenting them to ValuJet for
carriage; (2) the failure of ValuJet to ... oversee its contract maintenance
program ... and (3) the failure of the Federal Aviation Administration (FAA) to
require smoke detection and fire suppression in class D cargo compartments.
"Contributing to the accident was the failure of the FAA to adequately
monitor ValuJet's heavy maintenance programs ... [and] the failure of the FAA to
adequately respond to prior chemical oxygen generator fires." Adopted Aug. 19,
1997 Source: NTSB

'A Single Fastener in a Critical Flight Control Link'
ALPA's discussion of DC-8 pitch control design issues:
Split Controls

Unlike newer transport aircraft, the left and right sides of the DC-8's
pitch control system cannot be isolated from one another in the event of a jam
or malfunction on one side. The DC-8 was certificated in 1959, while the FARs
[Federal Aviation Regulations] addressing control system problems (US
25.671) became law in 1964. These FARs were not retroactive; they did not apply
to previously certificated designs. FAR US 25.671(c)(1) and (2) tend to
require redundancy or separation of flight control systems to maintain control
after single and multiple failures, while US 25.671 (c)(3) requires the
airplane to be capable of continued safe flight and landing after:

"Any jam in a control position normally encountered during takeoff,
climb, cruise, normal turns, descent, and landing unless the jam is shown to be
extremely improbable, or can be alleviated. A runaway of a flight control to an
adverse position and jam must be accounted for if such runaway and subsequent
jamming is not extremely improbable."

In modern aircraft, compliance with this requirement has been
accomplished through 'split controls,' which are incorporated into the entire
pitch control system, from [control] column to elevator. If a jam occurs
anywhere on one side of the system, breakouts have been provided to allow
independent operation of the unaffected side. Mechanical means for providing
breakouts include springs, shear bolts, or rivets, and all require higher-than-
normal control forces for activation. Some aircraft designs provide unlock
features for jam protection, where the pilot is required to pull a handle or
lever to decouple the two sides of a split control system.

The DC-8 uses a tab-actuated pitch control system, whereby the control
column is only connected directly to the control tabs, and not to the elevator.
With the exception of a mechanical failure or disconnect, the two control
columns cannot be moved independently of one another. This also applies to the
two control tabs and the two elevator panels. If the FARs requiring split
controls or their equivalent had been made to retroactively apply to the DC-8,
this accident might not have occurred.

Dual Locking

Emery Flight 17 crashed as a direct result of the loss of a single
fastener in a critical flight control link. In accordance with FARs applicable
at the time the DC-8 was certificated, this fastener was secured with only one
locking device. In 1970, in response to several accidents and eleven years after
the DC-8 was certificated, the FAA modified the regulations to require two
locking devices for critical fasteners. For convenience, this FAR is partially
cited here:

US 25.607 Fasteners

Each removable bolt, screw, nut, pin, or other removable fastener must
incorporate two separate locking devices if –

Its loss could preclude continued flight and landing within the design
limitations of the airplane using normal pilot skill and strength,

or

Its loss could result in reduction in pitch, yaw or roll control
capability or response below that required by Subpart B of this chapter.

This FAR was not retroactive, and therefore did not apply to the DC-8, or
any other aircraft certificated prior to 1970. It is possible that if FAR US
25.607 was retroactive and applied to the DC-8, this accident would not
have occurred, and the crew of Emery 17 would be alive today.

Source: ALPA submission of Dec. 27, 2002, to NTSB, p. 20