Alaska Airlines Flight 261

Date

31 January 2000

Phase of flight

Descent

Location

Pacific Ocean, about 2.7 miles north of Anacapa Island, California, United States

Aircraft

McDonnell Douglas MD-83

Registration

N963AS

Operator

Alaska Airlines

Flight

Alaska Airlines 261

Occupants

88

Fatalities

882 pilots, 3 cabin crew members and 83 passengers

Investigating body

National Transportation Safety Board (United States)

Final report

NTSB/AAR-02/01

Report date

30 December 2002

Report title

Loss of Control and Impact with Pacific Ocean, Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, about 2.7 miles north of Anacapa Island, California, January 31, 2000

On 31 January 2000, about 16:21 Pacific standard time (local time), Alaska Airlines Flight 261, a McDonnell Douglas MD-83 registered N963AS, dived into the Pacific Ocean about 2.7 miles north of Anacapa Island, California. All 88 people on board were killed: the 2 pilots, 3 cabin crew members and 83 passengers.

The crew had been flying with a jammed horizontal stabiliser for more than two hours. The National Transportation Safety Board (NTSB) found that the threads of the acme nut in the stabiliser trim jackscrew had worn away because the assembly had not been adequately lubricated, and that maintenance intervals extended with the approval of the Federal Aviation Administration (FAA) had let the wear progress without detection. Once the threads had gone, the stabiliser was held first by a jam between screw and nut and then only by a stop on the end of the screw, until that restraint failed too.

The accident shows how a single worn part, a maintenance programme and its oversight can combine into a catastrophic failure, and it gave pilots a clear rule for flight control malfunctions: complete the checklist, do not improvise, and land.

The flight

Flight 261 was a scheduled international passenger flight under 14 CFR Part 121 from Puerto Vallarta, Mexico, to Seattle, Washington, with a stop planned at San Francisco. It departed about 13:37 in visual meteorological conditions. The captain, aged 53, had about 17,750 hours, including about 4,150 hours as an MD-80 pilot-in-command; the first officer, aged 57, had about 8,140 hours, almost all as an MD-80 first officer. Both were properly certificated and qualified. The aircraft had been built in 1992 and had flown about 26,584 hours. It took off at 136,513 lb, above its maximum landing weight of 130,000 lb, and had no fuel jettison system.

How the MD-80 trims in pitch

The MD-80 has a T-tail. Its horizontal stabiliser, about 40 ft long, sits on top of the fin, hinged at its rear spar. A single jackscrew assembly at the front spar raises or lowers the leading edge to trim the aircraft. Electric motors turn a case-hardened steel acme screw, which runs through an aluminium-bronze acme nut fixed to the fin; each has two threads, and the nut is the part designed to wear. A titanium torque tube inside the screw transmits the motor torque. Leading edge up gives nose-down trim.

The primary trim motor, controlled by switches on each control wheel or by trim handles on the centre pedestal, moves the stabiliser about 1/3° per second. The alternate trim motor, used by the autopilot and by separate pedestal switches, moves it about 1/10° per second. Electrical stops limit normal travel to 12.2° leading edge down and 2.1° leading edge up, and mechanical stops on the screw act as a backup. If the stabiliser does not follow autopilot commands, an A/P TRIM light comes on after 10 seconds, but the autopilot stays engaged.

The accident

The trim system worked normally during the departure. At 13:49:51, climbing through 23,400 ft at 331 kt, the stabiliser made its last movement, to 0.4° nose down, and then stopped responding. The autopilot disengaged at 13:53:12. The crew flew by hand, first with up to 50 lb of pull on the control columns, then with about 30 lb at 31,050 ft, and, after increasing speed and burning fuel, with about 10 lb. They re-engaged the autopilot at 15:46:59.

The cockpit voice recorder, which held only the last 31 minutes, began about 15:49, as the crew discussed the jammed stabiliser with the company's dispatch and maintenance staff. The captain asked to divert to Los Angeles. A dispatcher pointed out a traffic flow programme at Los Angeles; the captain replied that he was concerned about "overflying suitable airports" and chose Los Angeles.

At 16:09:16, after a maintenance technician asked whether they had tried the primary trim controls, the captain disconnected the autopilot, apparently by operating the primary trim. The jam released. The stabiliser moved beyond the 2.5° nose-down limit of the flight data recorder, and the aircraft pitched down into a dive of about 80 seconds, reaching 353 kt and descending from 31,050 ft to between 23,000 and 24,000 ft. The pilots needed an estimated 130 to 140 lb of pull, with the speedbrakes out, to recover.

Level again near 24,000 ft, the captain told maintenance that the trim had run away full nose down and that he was reluctant to try it again. The flight was cleared towards Los Angeles and down to 17,000 ft, and the captain asked to check the aircraft's handling in the landing configuration over the sea. A flight attendant reported a "big bang" in the back. The slats and flaps were extended, the captain found the aircraft "pretty stable", and then, for reasons the NTSB could not establish, asked for them to be retracted. The first officer said that if the aircraft was controllable they should just try to land it, and the captain agreed.

At 16:19:21 the voice recorder picked up a series of thumps, and at 16:19:36.6 an extremely loud noise. The nose pitched down at nearly 25° per second to about 70° nose down, and the aircraft rolled inverted. The pilots tried to regain control, including while the aircraft was inverted, until it struck the ocean.

The investigation

An acme nut with no threads

The jackscrew was recovered from the sea. The acme nut contained no intact threads; worn thread remnants were found wrapped around the screw. About 90% of the thread thickness had worn away before the rest sheared. For comparison, a nut at the maximum wear allowed in service, shown by an end play of 0.040 in, has lost only about 22% of its thread thickness. The average wear rate since the last check was 0.012 in per 1,000 flight hours, against an expected rate of about 0.001 in.

The NTSB reconstructed the failure in stages:

1. Jam. The worn threads were sheared off incrementally, the last of them during the accident flight, and the screw and nut jammed as the aircraft passed 23,400 ft.
2. First dive. The torque of the primary trim motor at 16:09 overcame the jam. Aerodynamic load pulled the screw up through the stripped nut until the screw's lower mechanical stop caught on the nut, at about 3.1° nose down.
3. Final dive. For about 10 minutes the stop held the stabiliser, while loads on the offset stop cracked the torque tube by low-cycle fatigue. When the tube fractured, the stabiliser moved up until it met the fin's tip fairing brackets, which failed. The leading edge then rose far beyond its normal travel, creating an upward tail load from which recovery was not possible.

Why the threads wore

The NTSB ruled out the type of grease, the screw's surface finish, debris and abnormal loading. There was no effective lubrication on the screw and nut: no grease was found on the working part of the screw, and the nut's grease passage held only dried, degraded grease. The last lubrication, in September 1999 at San Francisco, had been done by a mechanic who said the task took about an hour, whereas Boeing indicated that, done properly, it should take more than four person-hours. Laboratory tests showed that unlubricated nut material wore roughly ten times faster than lubricated material.

Intervals stretched step by step

Wear is monitored by the end play check, which measures the axial play between screw and nut. Over 15 years Alaska Airlines had extended both tasks, with FAA approval:

The last lubrication extension had been justified by the manufacturer's revised recommendation to lubricate at every C check, part of a package of C-check changes that was not analysed task by task. The NTSB found that the longer lubrication interval made it more likely that one missed or poor lubrication would cause excessive wear, and that the longer end play interval let the wear reach failure without any chance of detection.

The last end play check

The aircraft's last end play check was at a C check in Oakland in September 1997. The first measurement was 0.040 in, the maximum allowed, and a non-routine work card called for the nut to be replaced. Three days later the check was repeated, found 0.033 in "five times with same result", and the aircraft returned to service. It was not checked again. The NTSB could not determine whether Alaska's non-compliant restraining fixture had produced an inaccurate reading, and it found the on-wing end play check procedure unvalidated and of low reliability.

Design and oversight

The two-thread design gave no redundancy against wear, and the design did not treat the loss of the nut threads as a catastrophic single-point failure. The NTSB also found widespread systemic deficiencies in Alaska Airlines' maintenance programme, and that FAA surveillance of the airline had been deficient for at least several years.

The crew's decisions

The NTSB found the decision not to return to Puerto Vallarta understandable, since no checklist required a landing as soon as possible and the aircraft was overweight for landing; it found the diversion to Los Angeles "prudent and appropriate". Alaska's dispatch staff appeared to have tried to influence the crew to continue to San Francisco. The use of the autopilot with a jammed stabiliser was not appropriate: the Stabilizer Inoperative checklist said not to use it, and it masked the out-of-trim condition. The repeated trim attempts went beyond the checklist and released the jam, although the Board could not determine how far trim motor activation caused or contributed to the accident.

Probable cause and contributing factors

The NTSB determined that the probable cause was "a loss of airplane pitch control resulting from the in-flight failure of the horizontal stabilizer trim system jackscrew assembly's acme nut threads. The thread failure was caused by excessive wear resulting from Alaska Airlines' insufficient lubrication of the jackscrew assembly."

Contributing were Alaska Airlines' extended lubrication interval and the FAA's approval of it, which made excessive wear from a missed or inadequate lubrication more likely; the extended end play check interval and its approval, which let the wear progress to failure undetected; and "the absence on the McDonnell Douglas MD-80 of a fail-safe mechanism to prevent the catastrophic effects of total acme nut thread loss."

Two Board members added statements. Member Goglia called it "a maintenance accident" and cautioned that a new fail-safe design should not lessen attention to maintenance. Acting Chairman Carmody wrote that she had not supported removing a draft recommendation for a further in-depth FAA inspection of Alaska Airlines.

Safety recommendations and what changed

On 11 February 2000 the FAA issued AD 2000-03-51 for the DC-9 family, including the MD-80 series, the MD-90 and the Boeing 717: inspect for metal shavings, lubricate at intervals not exceeding 650 flight hours and repeat end play checks at least every 2,000 flight hours. AD 2000-15-15 of 28 July 2000 superseded it and added a search for metallic particles in the grease.

In October 2001 the NTSB recommended revised lubrication and end play procedures, specialised training for the mechanics and inspectors doing them, and controls on grease changes (A-01-41 to -48). The final report added recommendations to the FAA, among them:

• tell pilots that, if a malfunctioning flight control leaves the aircraft controllable, they should complete only the checklist, not reactivate trim motors once both trim systems are confirmed inoperative, and land at the nearest suitable airport if the checklist does not work (A-02-36);
• ensure that dispatch and maintenance control staff do not suggest continued flight in the interest of scheduling (A-02-37);
• remove old grease before lubricating, enlarge the access panels and make the lubrication a required inspection item (A-02-38 to -40);
• require engineering data and analysis for any extension of maintenance intervals affecting critical components (A-02-41 to -43);
• set an end play interval giving at least two chances to detect excessive wear, and track end play data (A-02-44 to -48);
• develop a fail-safe jackscrew for the DC-9 family, and allow no single-point catastrophic failure in future stabiliser trim designs (A-02-49 to -51).

Lessons for pilots

Do not improvise with a controllable aircraft. After the accident Boeing told crews to complete the checklist and attempt nothing beyond it. The NTSB went further: when the checklist does not restore the trim, land at the nearest suitable airport. Flight 261 was flown for more than two hours with a jammed stabiliser; the dive began only when the trim was tried again.

Change configuration slowly and keep what works. The NTSB found that crews with a control problem should keep any configuration that helps a safe approach and landing, unless it harms controllability, and it noted that the captain had not briefed the first officer on what to expect and that a slower-than-normal flap extension would have been a prudent precaution.

Resist schedule pressure. The captain rejected the flow programme as a reason to continue, citing his concern about "overflying suitable airports", and the NTSB called the diversion "prudent and appropriate". It also recommended that dispatch and maintenance control staff refrain from suggesting continued flight in the interest of scheduling.

Maintenance is part of the design. The jackscrew nut is meant to wear, and its grease is essential to its life. The NTSB concluded that when a single failure could be catastrophic and a practicable design alternative exists, relying on maintenance and inspection alone is not appropriate, a principle behind failure conditions and system safety. Pilots who understand continuing airworthiness read technical logs more critically, and the trim malfunction procedures are written to keep a damaged but controllable aircraft flying to a landing.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.