BY ROBERT HEDRICK AND KERRY KOVARIK
The National Transportation Safety Board (NTSB) recently issued an updated report in the accident investigation of a seaplane crash that killed 10 people, including a child and WSBA member Gabrielle Hanna, when the plane went down in Mutiny Bay near Whidbey Island on Sept. 4, 2022. The NTSB updated report contains findings relevant to the cause of the accident, and also reveals jackscrew design issues that are similar to those found in the crash of Alaska Airlines Flight 261 on Jan. 31, 2000.
In most aviation accidents the NTSB keeps its investigative process and the results of its fact-finding, testing, and analysis confidential until it issues its factual report, typically 12 to 18 months after an accident. Sometimes the NTSB issues an interim report to update the public on a significant accident investigation or to inform aircraft owners, operators, and the flying public that a likely cause of the accident has been discovered and appropriate safety steps are being taken to prevent similar accidents from happening.
On Oct. 24, the NTSB released its Aircraft Accident Investigative Update for the Mutiny Bay accident, following the recovery of the De Havilland DHC-3 Otter (N725TH) wreckage by the U.S. Navy from nearly 200 feet below the surface in Mutiny Bay, southwest of Whidbey Island in Puget Sound.11 www.ntsb.gov/investigations/Documents/DCA22MA193%20Investigative%20Update.pdf. Photos and illustrations contained in this article are from this NTSB Updated Report. The Navy recovered approximately 85 percent of the aircraft from the sea floor (see fig. 1).22 Id. at 1.
FIG. 1. Green reflects recovered wreckage and orange reflects recovered flight controls. (Photos and diagrams from the National Transportation Safety Board (NTSB) report on the Mutiny Bay accident)
While the wreckage was heavily damaged due to water impact and being submersed for nearly four weeks, critical components of the aircraft’s pitch flight control system (which controls the nose up and nose down attitude or nodding motion of the aircraft used for climb and descent) appear to reveal a potentially catastrophic failure. The horizontal stabilizer actuator (see fig. 2), which controls the up and down movement of the stabilizer, and importantly is the only means that keeps the stabilizer in a stable horizontal position, was separated. A critical lock ring used to keep the horizontal stabilizer actuator together was not found. The NTSB cannot currently determine if the lock ring was installed before the aircraft impacted the water.33 Id. at 9. If the stabilizer separated while in flight, this would cause the stabilizer to float freely about its hinge and rotate uncontrollably.44 “The Systems group found the horizontal stabilizer actuator had separated into two pieces at a threaded assembly fitting.” Id. at 2, 9. The result can be a loss of pitch control and ultimate loss of control of the airplane.55 Id. at 9.
In order to relieve flight control pressure on the pilot during changing flight attitudes and power settings, the DHC-3 Otter is designed, like other aircraft, with a moveable horizontal stabilizer. Pilot adjustments are made by turning the pitch trim control wheel in the cockpit either nose up or nose down. The actuator (see fig. 3) is manipulated by the trim wheel through control cables that rotate the actuator screw, which extends or retracts the actuator changing the angle of the horizontal stabilizer.66 Id. at 3. The actuator, which is located inside the tail section, has its lower end connected to the airframe in the tail, while the upper end is connected to the horizontal stabilizer, which pivots on hinges.
FAR LEFT > FIG. 2. Horizontal stabilizer actuator.
FIG. 3. Detail of actuator with clamp nut at top and barrel.
Critically, the secondary role of the actuator is to keep the stabilizer in its set position. In other words, by design the actuator is the sole means of securing the stabilizer from un-commanded movement. Thus, the separation of the actuator will allow the stabilizer to swing freely,77 Id. at 9. with a resulting loss of pitch control. A rough analogy might be like losing the power steering in a car, which, if not designed safely, might cause the front wheels to freely and uncontrollably turn sideways. Worse yet, unlike a driver, a pilot in flight cannot just slow down and pull over.
As reflected in the NTSB’s updated report, after the wreckage was recovered the actuator was discovered to be separated at the upper portion where it connects to the horizontal stabilizer. Normally at this upper point a clamp nut is attached to one end of the stabilizer and the other lower end is attached to the body of the actuator, located in the barrel section. On installation, the barrel section is screwed into the clamp nut, which is then secured by a wire lock ring that snaps into a groove on the outside of the barrel. The ring has a tang (end bent inward) which goes through a small hole in the barrel and into a corresponding small hole in the clamp nut threads. When properly seated, the lock ring keeps the barrel and clamp nut together by preventing any rotation (unthreading) between them.88 Id. at 5, 6.
If the lock ring is not installed (or is improperly installed and not fully seated) the barrel and clamp nut may be susceptible to unscrewing and becoming detached. While this would cause failure of the trim control, much more critically it could cause failure of the stability of the entire horizontal stabilizer because the actuator is the only mechanism keeping the stabilizer secured in its position (see fig. 4).
FIG. 4. Clamp nut and barrel from wreckage: completely separated. In addition, the lock ring was not located (an example lock ring is seen at right).
In the Mutiny Bay accident, it is not suspected that the clamp nut and barrel became separated when the aircraft impacted the water, because there is no evidence that they were pulled apart by impact tension; if they had been, there would be stripping of the threads on the nut and/or in the barrel.99 Id. at 5. The NTSB investigation of the threads found that the actuator became separated by the nut and barrel rotating apart (unthreading) and out of each other (see fig. 5).1010 “Examination of the threads inside the barrel and the threads on the clamp nut revealed that the two components separated by unthreading (that is, rotation of the barrel and/or clamp nut) as opposed to being pulled apart in tension.” Id.
FIG. 5. Clamp nut from accident aircraft showing three of five holes drilled into it.
Although the NTSB’s investigation and lab work is continuing, and it has not issued its factual report, by issuing this updated report the NTSB is both timely informing the public of additional facts and findings, and is coordinating with the Transportation Safety Board of Canada to request that the type certificate holder, Viking Air Ltd, draft additional inspection instructions to ensure that the lock ring is properly seated to prevent unthreading of the barrel from the clamp nut.1111 Id. at 9.
FAA Issues Airworthiness Directive Based on the NTSB Updated Report
On Nov. 2, 10 days after the NTSB issued its updated report, the FAA issued airworthiness directive (AD) 2022-1409, which requires owners and operators of DHC-3 Otters in the U.S. to perform an immediate inspection of the DHC-3 Otter horizontal stabilizer actuators to ensure that the lock ring is correctly seated in the barrel groove and is properly engaged in the clamp nut.1212 www.regulations.gov/document/FAA-2022-1409-0001. The FAA is unequivocally clear that this inspection is critical: “This condition, if not detected and corrected, could result in a reduction or loss of pitch control during flight with consequent loss of control of the airplane.”1313 Id. Inspections must be performed within the next 10 hours in service of each aircraft. In issuing the AD, the FAA determined that this unsafe condition “is likely to exist or develop in other products of the same type design.”1414 Id.
The FAA also recognized that this AD is an “interim action,” pending further review.1515 On Oct. 4, 2022, the FAA issued emergency airworthiness directive (AD) 2022-21-51, which requires almost immediate inspection of the left elevator auxiliary spar (elevator horizontal support beam) of De Havilland Otter DHC-3 aircraft. While it is not known if this is also related to the Northwest Seaplanes Mutiny Bay accident on Sept. 4, 2022, it was issued shortly after the wreckage of N725TH was recovered. This AD brings to light many questions of FAA activity since 2018, which the emergency AD explicitly relates back to. As the FAA issued an AD on this spar, it could be a dangerous condition that the FAA came across during their investigation of the Mutiny Bay accident, but not causally related to the accident because it was not addressed in the later-issued NTSB Accident Investigative Update. A copy of AD 2022-21-51 is at: https://drs.faa.gov/browse/excelExternalWindow/DRSDOCID139391948320221005002535.0001. The AD applies to the 63 DHC-3 Otters registered in the U.S. The projected cost per aircraft to comply with the AD is $85, which is one hour of mechanic time.
Revisiting Similar Design Concerns From Alaska Flight 261
A single-point catastrophic failure exists when the failure of one part or component of a safety critical system causes the entire system to fail. For aviation safety, those systems, such as the flight control system, should not only be designed to prevent single-element failure, but the “single point” should be eliminated by use of a redundant or backup safety design, which allows for continued safe use after one element fails.
In the Mutiny Bay accident, if what the NTSB is considering in its updated report, that a maintenance assembly step related to a simple wire lock ring may have caused N725TH to fall out of the sky, the obvious question arises: is there sufficient redundancy designed in the DHC-3 flight control system? Part of the answer may lie in revisiting the 2000 Alaska Airlines Flight 261 accident, and specifically the NTSB’s investigation and report related to horizontal stabilizer actuator design.
On Jan. 31, 2000, Alaska Airlines Flight 261, an MD-83, lost control and crashed into the Pacific Ocean off the coast of Southern California, taking the lives of all 88 persons on board. The NTSB determined that the crash was caused by loss of the airplane pitch control that resulted from an in-flight failure of the horizontal stabilizer trim system.1616 www.ntsb.gov/investigations/AccidentReports/Reports/AAR0201.pdf. Though the failure itself was caused by inadequate lubrication and excessive wear of the horizontal stabilizer actuator jackscrew, the NTSB also determined that the aircraft did not have a fail-safe redundant design in the system. Without a backup, once the actuator failed, the horizontal stabilizer swung freely without self-limiting control, which resulted in complete loss of aircraft pitch flight control caused by a single-point failure.1717 Id. at 180.
While the mechanism of failure between the Flight 261 accident and the Mutiny Bay accident is not the same, the potential lack of design redundancy of both systems is similar. Three of the 46 findings listed in the Flight 261 final report have particular relevance to the Mutiny Bay accident, as well as to the overall design of the DHC-3 pitch trim system. These are:
41. When a single failure could have catastrophic results and there is a practicable design alternative that could eliminate the catastrophic effects of the failure mode, it is not appropriate to rely solely on maintenance and inspection intervention to prevent the failure from occurring; if a practicable design alternative does not exist, a comprehensive systemic maintenance and inspection process is necessary.
42. Transport-category airplanes should be modified, if practicable, to ensure that horizontal stabilizer trim system failures do not preclude continued safe flight and landing.
43. Catastrophic single-point failure modes should be prohibited in the design of all future airplanes with horizontal stabilizer trim systems, regardless of whether any element of that system is considered structure rather than system or is otherwise considered exempt from certification standards for systems.1818 Id.
In the Flight 261 Report the NTSB also recommended that the FAA:
evaluate the horizontal stabilizer trim systems of all other transport-category airplanes to identify any designs that have a catastrophic single-point failure mode and, for any such system; . . .
identify means to eliminate the catastrophic effects of that single-point failure mode and, if practicable, require that such fail-safe mechanisms be incorporated in the design of all existing and future airplanes that are equipped with such horizontal stabilizer trim systems.1919 Id. at 183.
The Flight 261 report was issued 20 years before the Mutiny Bay accident. It is not known what steps, if any, the FAA has taken since then to identify, analyze, and/or attempt to modify the horizontal stabilizer actuator design on DHC-3 aircraft, which appear to have a single point of failure mode similar to the MD-80 series aircraft of Flight 261; i.e., once the single actuator fails and loses restraint of the horizontal stabilizer, there is no backup and flight control is lost. By contrast, the NTSB cited an example: “the DC-8 was equipped with a dual jackscrew design that provided structural and operational redundancy.”2020 Id. at 21 (emphasis added).
The NTSB recommended that the FAA establish new design changes for future aircraft certification, by calling on the FAA to:
Modify the certification regulations, policies, or procedures to ensure that new horizontal stabilizer trim control system designs are not certified if they have a single-point catastrophic failure mode … 2121 Id. at 184.
Last, in citing the FAA’s own advisory circular, AC 25.1309-1A, which is based on federal aviation design regulation 14 CFR 25.1309, the NTSB recognized:
AC 25.1309-1A specifies that in demonstrating compliance with 14 CFR 25.1309, the failure of any single element, component, or connection during any one flight should be assumed, regardless of its probability, and such single failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure condition.2222 Id. at 21.
While there is no doubt that many lessons were learned on many levels following the Flight 261 accident, from an aircraft design perspective, serious concerns regarding horizontal stabilizer design were raised in the 2002 report, and changes were recommended. It remains to be seen whether at least some of the recommended changes contained in the Flight 261 report should have made it to the DHC-3 Otter before the Mutiny Bay accident. Perhaps the NTSB will answer this question, or at least will address this apparent recurring design issue, in its factual report of the Mutiny Bay accident, where the NTSB should not only try to solve the “what happened” causal mystery, but also the “why did it happen” causal mystery as well.
NOTES
1. www.ntsb.gov/investigations/Documents/DCA22MA193%20Investigative%20Update.pdf. Photos and illustrations contained in this article are from this NTSB Updated Report.
2. Id. at 1.
3. Id. at 9.
4. “The Systems group found the horizontal stabilizer actuator had separated into two pieces at a threaded assembly fitting.” Id. at 2, 9.
5. Id. at 9.
6. Id. at 3.
7. Id. at 9.
8. Id. at 5, 6.
9. Id. at 5.
10. “Examination of the threads inside the barrel and the threads on the clamp nut revealed that the two components separated by unthreading (that is, rotation of the barrel and/or clamp nut) as opposed to being pulled apart in tension.” Id.
11. Id. at 9.
12. www.regulations.gov/document/FAA-2022-1409-0001.
13. Id.
14. Id.
15. On Oct. 4, 2022, the FAA issued emergency airworthiness directive (AD) 2022-21-51, which requires almost immediate inspection of the left elevator auxiliary spar (elevator horizontal support beam) of De Havilland Otter DHC-3 aircraft. While it is not known if this is also related to the Northwest Seaplanes Mutiny Bay accident on Sept. 4, 2022, it was issued shortly after the wreckage of N725TH was recovered. This AD brings to light many questions of FAA activity since 2018, which the emergency AD explicitly relates back to. As the FAA issued an AD on this spar, it could be a dangerous condition that the FAA came across during their investigation of the Mutiny Bay accident, but not causally related to the accident because it was not addressed in the later-issued NTSB Accident Investigative Update. A copy of AD 2022-21-51 is at: https://drs.faa.gov/browse/excelExternalWindow/DRSDOCID139391948320221005002535.0001.
16. www.ntsb.gov/investigations/AccidentReports/Reports/AAR0201.pdf.
17. Id. at 180.
18. Id.
19. Id. at 183.
20. Id. at 21 (emphasis added).
21. Id. at 184.
22. Id. at 21.