For Want of a Nail: The crash of Emery Worldwide Airlines flight 17
On the 16th of February 2000, a four-engine cargo plane loaded with clothing and auto parts ran into trouble moments after lifting off from Mather Airport in Sacramento, California. The pilots faced a simple but terrifying problem: their DC-8 wouldn’t stop pitching up, no matter how hard they tried to make it pitch down. Struggling to remain airborne with its nose in the air, the plane repeatedly lost speed and height, swaying wildly up and down and from side to side as the pilots fought their way back to the airport. Tragically, however, they never made it. Just 115 seconds after it took off, Emery Worldwide Airlines flight 17 plowed belly-first into an auto salvage yard, where all three crewmembers perished in an immense ball of fire.
Although the pilots thought in their final moments that their cargo had shifted, investigators would eventually find that there was never anything wrong with the plane’s center of gravity. Instead, evidence pointed to a mechanical failure of the DC-8’s pitch control system, which caused the elevators to jam in a nose up position. The system had not broken, but rather became disconnected, due to a tiny but deadly maintenance error: someone had left out a single cotter pin while reassembling the elevator control system. The National Transportation Safety Board would ultimately prove that this small mistake brought down the DC-8, but the question of who was responsible would never receive a clear answer, as the various parties to the investigation descended into a heated contest of accusations. Amid mutual allegations of deception, slander, and lies, the truth was most likely lost forever — even though the evidence still paints a picture of an airline whose lack of attention to safety had left it flirting with disaster for years.
◊◊◊
Underneath the highly visible world of major cargo airlines like FedEx, UPS, and DHL lies another world of second-tier cargo carriers — companies that aren’t household names, but are nevertheless critical to the global air freight network. In the second half of the 20th century, one of the leaders of this second tier was indisputably Emery Worldwide Airlines, an integrated air carrier and freight forwarder founded in 1946 by businessman John Colvin Emery. At its height in the 1990s, Emery Worldwide operated over 100 aircraft, including dozens of Boeing 727s and one of the largest remaining fleets of McDonnell Douglas DC-8s. And yet just a few short years later, Emery would be forced to permanently cease operations, erasing its name from the ranks of America’s largest cargo carriers. The decline and downfall of Emery Worldwide Airlines had multiple causes, but perhaps central to the story was the tragic fate of flight 17, an accident thought to have been made possible by pervasive cultural rot — a decay of standards which Emery steadfastly refused to fully acknowledge all the way to the end.
The story of Emery Worldwide flight 17 brings us first to Dayton, Ohio, Emery’s largest hub, on the 16th of February, 2000, where three crewmembers picked up a McDonnell Douglas DC-8–71F, known by its registration number N8079U. Among those who boarded the plane was 43-year-old Captain Kevin Stables, who planned to catch some sleep in the crew rest area as the aircraft flew across the country to Reno, Nevada.
Upon arriving in Reno that afternoon, Captain Stables took over command, and he was joined by 38-year-old local Reno-based Flight Engineer Russell Hicks, who along with the First Officer from the previous leg helped ferry the plane on a short hop over the Sierra Nevada Mountains to Sacramento, the capital and sixth largest city of California. The plan was to pick up a load of freight at Sacramento Mather Airport, the city’s main cargo terminal, and carry it back to Dayton, where Stables’ duty day would end. The First Officer would also disembark, to be replaced by 35-year-old First Officer George Land, who was waiting at the airport to join the crew for the flight to Ohio.
None of the crewmembers could possibly have known that N8079U was a ticking time bomb on the brink of detonation, and probably had been for several weeks. The aircraft appeared to be whole, undamaged, and in good working order — and indeed the plane was not damaged in any way — but deep in the tail, a tiny but critical part was missing.
The problem in question involved the plane’s elevator control system, and requires some amount of background to understand properly. Every airplane is equipped with elevators on the tail which control pitch by using the force of the airflow to rotate the aircraft about its central axis. When the elevators deflect downward, the airflow pushes the tail up, causing the nose to drop; conversely, when the elevators deflect upward, the airflow pushes the tail down, and the nose rises.
Due to the large aerodynamic forces involved, moving the elevators on a plane the size of the four-engine DC-8 requires considerable strength, more than a human pilot could reasonably be expected to apply. This problem can be overcome in various ways: on aircraft in service today, for instance, pilot inputs may be transferred via cables to a hydraulic actuator, which amplifies the input in order to move the elevator; alternatively, on fly-by-wire aircraft, control inputs are fed to a computer which then commands the hydraulic actuators electrically. But on the Douglas DC-8, which was one of the first ever jet aircraft when it entered service in 1959, the elevators were neither hydraulically nor electrically actuated, but rather relied on a system of control tabs.
Control tabs are a purely mechanical means of reducing the force required to move the elevators. The principle behind control tabs is the same as that behind the elevators, only instead of rotating entire aircraft up or down, the tabs rotate the elevators themselves, which in turn rotate the plane. Hinged to the trailing edge of the elevators, the control tabs can be moved up or down using a system of cables, cranks, and pushrods connected directly to the pilots’ control columns. When the tabs deflect downward, aerodynamic forces push the elevators up, and when the tabs deflect upward, aerodynamic forces push the elevators down. The control tabs’ much smaller surface area eliminates any difficulty in moving them.
To keep all these directions straight, it helps to reiterate: to pitch the plane up, the control tab deflects down and the elevator deflects up; and to pitch the plane down, the control tab deflects up and the elevator deflects down.
Mechanically speaking, the position of each control tab depends on whether a part called the control tab pushrod is extended or retracted. Each pushrod, one for each elevator, is attached to a crank which converts pilot inputs into extension or retraction of the pushrod, a simple metal rod with links on both ends. The aft end of the pushrod is hinged to the control tab crank fitting, which transforms extension and retraction of the pushrod into downward or upward deflection of the control tab, respectively. Therefore, when the pushrod retracts, the control tab moves up, the elevator moves down, and the plane pitches down; and when the pushrod extends, the control tab moves down, the elevator moves up, and plane pitches up, as shown in the above diagram.
The pushrod is attached to the crank fitting using a simple bolt. The link at the end of the pushrod rests between two lugs on the crank fitting, and then the bolt is run through the lugs and the link, joining them together to form a hinge. The bolt is then secured using a castellated nut, and the nut in turn is secured using a cotter pin, a tiny pin which runs between the castellations on the nut and through a hole in the bolt itself, preventing the nut from turning. Because the bolt acts as a hinge, without the cotter pin the constant rotation of the hinge would slowly unscrew the nut, leaving the bolt unsecured. In such a condition, the bolt would eventually work its way loose and fall out. In this way, the cotter pin, as small as it may be, is critical to the integrity of the control tab system.
As you may have already guessed, N8079U was in fact missing the cotter pin securing the pushrod-to-crank fitting attachment bolt on its right elevator. How it came to be missing, and who was responsible, have never been satisfactorily determined, and the various arguments will be examined later in this article. But the fact remains that it was not there, and probably had not been there since November 1999. By the time N8079U departed Reno on the evening of the 16th of February 2000, the nut had probably come unscrewed as well, and now the bolt was working its way out too. Indeed, none of the pilots noticed that exactly eight minutes and 20 seconds before landing in Sacramento, the bolt fell out, never to be seen again.
As the manufacturer had anticipated when it designed the system, the immediate consequences of the failure were negligible. Aerodynamic forces pushing up on the control tab caused the crank fitting to slip a little farther over the end of the pushrod than would be possible with the bolt in place, but this resulted in only a minor alteration of three to four degrees toward aircraft-nose-down in the relationship between the control column and control tab positions. The pilots subsequently had no difficulty pitching up to flare the airplane for touchdown, because the end of the pushrod was still stuck between the lugs on the crank fitting, allowing the blunt end of the link to push the crank fitting aft and deflect the control tab downward.
However, as the plane rolled to a halt on the runway and taxied to the ramp, the aerodynamic forces on the elevator disappeared. Without the bolt attaching the crank fitting to the pushrod, these aerodynamic forces had been the only thing holding the right control tab in the neutral position, and once the plane slowed below a certain speed, the tab fell down into the full trailing edge down (aircraft nose up) position under the force of gravity. In doing so, the lugs on the crank fitting pulled off the end of the pushrod, eliminating any residual linkage between the two, as shown in the above diagram.
Although it was now impossible for a pilot to control the DC-8’s right elevator, nobody immediately noticed. Night had fallen, and the plane was parked on a poorly lit ramp while cargo handlers loaded several pallets of clothing and automobile parts into the hold. The previous First Officer went off duty and was replaced by George Land, while Flight Engineer Hicks conducted a walkaround inspection of the airplane. Gazing up at the elevators, located some 20 feet (6 m) above the ground, under conditions of darkness, he apparently did not notice that the right elevator control tab was pointed trailing edge down, while the left control tab was not — something which normally should never happen.
◊◊◊
After an hour and 15 minutes on the ground, cargo loading concluded at about 19:30, and the pilots began preparing for their imminent takeoff. At 19:42, with the flight already taxiing to the runway, the cockpit voice recorder captured the pilots performing a routine check of their flight controls.
“Ready on the rudders?” said Captain Stables.
“Yep,” said Flight Engineer Hicks.
“You’re ah, clear right,” said First Officer Land.
“Left rudder, center…” Stables called out.
“Checked,” Hicks announced.
“Elevator forward, coming back,” said Stables, pushing his control column forward, then pulling back to verify its range of motion.
“EPI checks,” said Land, referring to the Elevator Position Indicator, or EPI. The indicator, a small gauge located on the First Officer’s instrument panel, was designed to present information about the deflection of the elevators — but notably, not the control tabs. Without aerodynamic forces present, moving the DC-8’s control column forward or aft results in minimal movement of the elevators, because the control columns are only directly hooked up to the control tabs. The value of any movement which First Officer Land may have seen on the EPI was therefore quite limited.
With the control checks now complete, captain Stables called for the taxi check, and the pilots set the flaps, checked the fuel panel settings, confirmed the spoilers were stowed, checked the stabilizer setting, and accomplished other routine items.
In the background, a helicopter reported its position over the Mather Airport frequency. Because Mather Airport lacked a control tower, pilots were responsible for reporting their position and intentions over a common frequency at all times.
“Sounds like he’s getting a massage,” First Officer Land joked, at the expense of the helicopter pilot’s audio quality.
“Whirling dervish!” said Hicks.
“That’d be fun,” said Land. “I’ve never been in one of those Airstar helicopters — you know, like the Cadillac of helicopters. I’ve never really been in a helicopter, you know.”
“I went up in one of those R22 Robinsons,” said Hicks. “That was a [*] thing.”
“Yeah, now that was a helicopter,” Land said.
“Went up to [*] and did some autorotations,” Hicks continued. “That was a blast. Really weird going that slow in the air though. I don’t like it,” he said with a chuckle.
“Hey, you’re hanging by that bolt, you know,” said Land.
“Yeah… [the] Jesus nut,” Hicks joked.
◊◊◊
Minutes later, at 19:47, they arrived at the threshold of runway 22 Left, and First Officer Land contacted the regional control facility for clearance to fly to Dayton — notably not clearance to take off, which was at their discretion. “Sacramento Departure, Emery seventeen heavy, number one two two left Mather, need our release to ah… Dayton,” Land said.
“Emery seventeen heavy, Sacramento Approach, you’re released for departure, report airborne,” the controller replied.
“Emery seventeen heavy, we’ll call you in the air,” Land acknowledged.
Captain Stables called for the before takeoff checklist, and the pilots started running up the engines. Over the common frequency, First Officer Land announced, “Mather area traffic, Emery seventeen heavy, runway two two left, be a left downwind departure Mather.”
Land and Hicks then ran through the checklist, arming the anti-skid system, turning on the transponder, checking the hydraulics, and releasing the parking brake.
“Before takeoff checklist complete,” Hicks called out.
With Land now at the controls, the pilots pushed the engines up to takeoff power, and the DC-8 began to rumble away down the runway.
“Airspeed’s alive,” Stables announced, glancing at his airspeed indicator.
“Alive here,” said Land.
“Eighty knots,” Stables called out.
Per company procedure, Land responded to the 80 knot call by conducting one last check of the elevators. The cockpit voice recorder captured two clunks as he pushed his control column forward, then returned it to neutral. “Elevator checks,” he said, spotting nothing unusual.
At this point, with aerodynamic forces now in play, the elevators should have deflected in response to his inputs — and yet, even though he pushed his control column almost all the way forward, the elevators never actually moved past neutral into the nose down position. Most likely, Land simply observed that the indicator was moving and didn’t stop to consider its actual location. Neither pilot realized that the right control tab was jammed in a trailing edge down, or aircraft nose up, position. In fact, when the control tab crank fitting pulled off the end of the pushrod after landing, the pushrod became slightly displaced, and could no longer align with the gap between the lugs on the fitting. Therefore, when aerodynamic forces returned, the resulting upward force on the control tab could not push the tab into or beyond the neutral position because the crank fitting lugs would collide with the end of the pushrod, as shown in the above diagram. This effectively forced the right elevator into an extreme nose up position. Furthermore, on the DC-8 the left and right elevators were mechanically interconnected, so the left elevator was jammed nose up as well — thus there was, in fact, no way for the pilots to pitch down.
Seconds later, the flight reached V1, the highest speed at which the takeoff could be aborted. Four seconds after that, Captain Stables called out, “Rotate,” instructing First Officer Land to begin pulling up for liftoff. But the nose was already rising all on its own, propelled upward by the jammed elevators. Land pushed farther forward on his control column in an attempt to keep the uncommanded rotation in check, but this was insufficient, and within four seconds he began using the stabilizer trim switches to push the stabilizer nose down as well. The trimmable horizontal stabilizer, to which the elevators are attached, determines the plane’s neutral pitch angle, and Land’s first thought must have been that it was set too high. But even this proved ineffective.
“Watch the tail,” Captain Stables warned.
Moments later, the plane lifted off the runway and immediately pitched beyond 18 degrees nose up, even though Land was pushing his control column almost fully forward.
“Positive rate,” Stables called out.
“I got it,” said Land, trying to wrangle the nose down.
“You got it?”
“Yep.”
“Alright.”
Within seconds, however, it was clear that Land did not, in fact, have it. Even with his control column pushed forward to the stop, the elevators wouldn’t move below 2.8 degrees nose up, and the plane was still climbing much too steeply. Feeling that something was seriously wrong, Land announced, “We’re going back.”
“What the hell?” Hicks exclaimed.
“C.G.’s waaay out of limits!” said Land, referring to the center of gravity. As a cargo pilot, his first thought was that his load had shifted to the tail, and that that was why the plane was pitching up.
“Shit. Do you want to pull the power back?” Hicks asked.
Reducing engine power could help lower the nose, but it would also reduce their airspeed, which was already falling dangerously due to the high pitch angle. As the speed dropped, the plane threatened to stall, and it became difficult to keep the wings level; ten seconds after liftoff, the left wing suddenly fell through, and the plane banked 35 degrees to the left. Hicks pulled back the thrust, but as soon as he did so, the stick shaker stall warning activated, shaking the pilots’ control columns to alert them to an impending stall.
“Oh shit,” Land said.
“Push forward,” Stables urged.
“Goddamn,” Land grunted, pushing forward with all his might, but he only barely managed to silence the stick shaker. “God!”
Keying his mic to speak to Sacramento departure control, Stables said, “Emery seventeen, emergency!”
“Aaah, shit!” said Land.
“Emery seventeen, Sacramento Departure, radar contact, say again?” the controller asked.
“You steer, I’m pushing,” Land said. Pushing forward with all his might, he had no time or strength to spare for steering the plane.
“Emery seventeen has an emergency,” Stables repeated.
At that moment, the plane reached a height of 937 feet above the ground, its nose still pitched high in the air, but it no longer had sufficient speed to climb. Once again on the brink of stalling, the DC-8 began to descend. “We’re sinking!” Hicks called out. “We’re going down, guys!”
“Emery seventeen, go ahead,” said the controller.
Hicks pushed the engines back to high power in an attempt to increase their speed. With the plane now dropping fast, the ground proximity warning system burst to life, calling out, “WHOOP WHOOP, PULL UP! WHOOP WHOOP, PULL UP!”
“Power!” Land ordered. “Damn!”
“WHOOP WHOOP, PULL UP!” blared the GPWS.
At that moment their speed increased enough for the plane to pull out of its descent at a height of about 500 feet above the ground. “Alright, alright, alright,” Stables said, but it was clear that the situation was not under control. Within moments, the plane was pitching steeply upward again, prompting First Officer Land to call out, “Push!”
“Okay, so we’re going back up,” said Hicks. “There you go.”
If they kept going up, however, they would surely stall. Unable to pitch down, the pilots opted for more drastic measures: by banking steeply, they could reduce lift and force the nose to drop, then fly out of the resulting near-stall. To this end, Captain Stables said, “Roll out! Roll out!” Then, finally replying to air traffic control, he said, “Emery seventeen, extreme C.G. problem!”
“Emery seventeen, roger,” said the controller.
“Shit,” said Hicks. “Anything I can do, guys?”
“Roll out to the right,” said Stables. In a steep left bank, they had managed to turn part way back to the airport, but now they needed to level the wings.
“Okay, push,” said Land. “Push forward.”
The cockpit voice recorder picked up ominous creaking sounds as the plane reached a peak altitude of 987 feet, once again threatening to stall. First Officer Land let out several expletives.
“You got the trim maxed?” Hicks asked, referring to the stabilizer.
“Power,” Land ordered.
“More?” said Hicks.
“Yeah.”
Once again, the plane lost speed and began to descend. The ground proximity warning system activated again: “WHOOP WHOOP, PULL UP! WHOOP WHOOP, PULL UP!”
“We’re gonna have to land fast,” said Land.
“WHOOP WHOOP, PULL UP!”
“Left turn,” said Stables.
“Okay,” said Land. “What I’m trying to do is make the plane’s position match the elevator. That’s why I’m putting it in a bank.”
Unaware that his elevators were actually jammed nose up, Land believed that he might be able to regain control if he could bank steeply, causing the nose to drop, until the pitch angle matched the position of his control column, which he presumed would correspond to the position of the elevators. This procedure can work in response to some malfunctions, such as a runaway stabilizer, but in this case there was really very little he could do.
“Alright,” said Stables. “Left turn.”
“So we’re gonna have to land it in like a turn,” said Land. The only way to prevent the plane from climbing steeply toward a stall was to apply bank, so they would be unable to level the wings until nearly the moment of touchdown. If they managed to reach the runway at all, which they must have known was in doubt, then a crash landing was likely.
“Bring it around,” Stables said. The runway was in sight now, off to their left; they were more than half way through the turn back, but their control over the airplane remained limited to non-existent.
At that moment, the stick shaker stall warning activated again. “Bring at around!” Stables said once more.
“Goddamn,” Land exclaimed, grunting from exertion. “You got the airport?” he asked.
“Bring it around,” Stables repeated.
“Power,” Land ordered.
Unable to keep the nose down for long, they simply didn’t have enough airspeed to stay in the air. At that moment the ground proximity warning system activated a third time: “WHOOP WHOOP, PULL UP! WHOOP WHOOP, PULL UP,” it blared.
But this time, they were well and truly out of options.
“Power,” Land ordered again, in a futile attempt to bring their speed up and halt the descent. The ground was rising up beneath them with alarming speed, and he could see that they weren’t going to make it. “Awww shit…” he exclaimed.
Someone let out an indistinct shout, and then it was over.
At 19:51 and 8 seconds, just under two minutes after takeoff, Emery Worldwide flight 17, descending in a nearly nose-level attitude, clipped a concrete commercial building and plowed directly into the Insurance Auto Auction automobile salvage yard in Rancho Cordova, about 2.5 kilometers east of the runway. A massive explosion lit up the night as the DC-8 plowed through a sea of cars, breaking apart as it went, scattering vehicles before it as the wreckage tumbled over, engulfed in flames. For a moment, the fuselage was visible amid the carnage, but before anyone could even dream of searching for survivors, the inferno overtook it, and all traces of the plane disappeared into a wall of fire.
Firefighters battled the blaze throughout the night, braving heavy smoke and exploding cars in an effort to knock down the flames. By the time they succeeded, little remained of the plane, save for charred wreckage rendered almost indistinguishable from the innumerable hulks of burned-out automobiles which surrounded it. In the wreckage of the cockpit, all three crewmembers were found deceased, having perished where they sat. Autopsies would later suggest that Captain Stables and Flight Engineer Hicks likely died on impact, while First Officer Land perished in the fire moments later.
◊◊◊
For the National Transportation Safety Board, the final resting place of Emery Worldwide flight 17 represented one of the more unusual crash sites in the agency’s history. Investigators were forced to dig through a sea of debris, painstakingly fishing airplane parts from amid the wreckage of at least 150 automobiles. At the same time, the flight crew’s report of an “extreme center of gravity problem” prompted an investigation of the cargo loading, which turned up empty: no evidence, physical or otherwise, pointed to the load having been incorrectly distributed or secured.
Only after discovering and correcting several points of unreliable data from the flight data recorder did NTSB investigators realize that the elevators were not responding properly to pilot inputs, and in fact remained above the neutral position throughout the flight, even though First Officer Land was pushing his control column fully forward almost continuously from liftoff to impact. Unable to bring the nose down, the pilots struggled to keep enough forward airspeed to stay in the air, a battle which they ultimately lost. By all accounts, there was probably nothing they could have done to save their plane once it took off, although they certainly tried their hardest until the end.
The reason for their difficulties was revealed in the wreckage itself — not because of what was broken, but because of what wasn’t. The right elevator tab crank fitting and pushrod were found separate from each other but completely intact, which should be impossible when they’re bolted together. By contrast, the left pushrod had fractured during the impact as it ripped away from the crank fitting, while there was no evidence that the right pushrod had ever been attached. Furthermore, the bolt, nut, and cotter pin were not found, and contact marks on the crank fitting lugs suggested that they had repeatedly impacted the end of the pushrod before the crash, which could only have happened if the bolt was not in place and the two parts had already separated.
Further tests proved that if the bolt were to fall out, the control tab could be pulled off the end of the pushrod under the force of gravity while the plane was parked. Then, if the pushrod shifted even slightly to either side, during the subsequent takeoff it would impact one of the lugs on the crank fitting rather than slipping between them, preventing the control tab from rotating back in the trailing edge up (aircraft nose down) direction.
This fact revealed a major vulnerability in the design of the DC-8. Although the type was certified in accordance with an early version of the Civil Aviation Regulations dating clear back to 1953, even that comparatively ancient set of rules clearly stated that “tab control systems shall be such that disconnection or failure of any element… cannot jeopardize the safety of flight.” The DC-8’s original manufacturer, McDonnell Douglas, no longer existed at the time of the crash, but the DC-8 type certificate had recently been taken over by Boeing, which was able to furnish Douglas’s original justifications for the design of the system. According to the documents, Douglas believed that the loss of the control tab bolt would not be dangerous because the pushrod link would lodge between the crank fitting lugs, permitting continued operation of the control tab. What was not envisioned was that this failure would go undetected after landing, that the crank fitting would pull off the end of the pushrod due to gravity, and that the aircraft would attempt to take off again in such a condition.
An examination of the accident airplane’s FDR data revealed that eight minutes and 20 seconds before it landed in Sacramento, a change in the relationship between the elevator position and control column position occurred, which was consistent with the bolt having fallen out at that point. The fact that the plane landed without the pilots even noticing a problem proved Douglas’s original assumption correct — the separation of the bolt in flight would not jeopardize the safety of the aircraft. The faulty assumption was that a problem with the affected elevator would subsequently be discovered during the pre-flight walk-around check or the before takeoff control checks. Because this assumption was taken for granted, further analysis of how the system might behave with the missing bolt was never conducted.
In the NTSB’s opinion, however, these checks would have been far from foolproof. Although the absence of the bolt would have caused an asymmetry in the positions of the control tabs while the plane was parked, the official walkaround procedure did not explicitly state that the tabs should be symmetrical. Furthermore, it was dark outside, the ramp was poorly lit, and the control tabs were located well above the ground, out of reach of the Flight Engineer. That he failed to notice the discrepancy under these circumstances was understandable.
The control check during taxi, meanwhile, would have been almost entirely useless. As stated earlier, the elevators do not move very much in response to pilot inputs unless aerodynamic forces are present, so there would not have been any meaningful readings on the elevator position indicator.
The best chance to notice the problem was probably during the 80-knot check, half way through the takeoff roll. The elevator check at 80 knots was not even a required item, but it had been part of Emery’s procedures for many years, and the company called on the First Officer to observe the EPI indications. However, the procedure did not explicitly state that the pilot should observe motion of the indicator both above and below the neutral position, and investigators found that many pilots had developed a habit of checking only whether the indication moved in response to their inputs, and not where it was moving. Contributing to this habit was the fact that the EPI was small and hard to read, thanks to its location at the very bottom of the right side instrument panel, where the First Officer might have difficulty seeing it, and where the Captain couldn’t read it at all. In any case, on the night of the accident, First Officer Land saw nothing which struck him as amiss, and in that moment their fate was sealed.
◊◊◊
Of course, all of this having been said, one glaring questions remains: why did the bolt come loose in the first place? Clearly it had been installed without the cotter pin, or perhaps without the cotter pin and the nut, allowing it to work itself loose over time. But who had made this elementary mistake? The search for answers to this question would ultimately cause the investigation to descend into bitter recrimination.
The problem was that in the months before the accident, two different companies had possibly worked on the elevator control system. One of these was a maintenance company called Tennessee Technical Services, based out of Smyrna, Tennessee. The company, known as TTS for short, was one of numerous contractors to which Emery delegated the vast majority of its heavy maintenance, including both non-scheduled repairs and regular heavy inspections. The accident airplane, N8079U, had last visited TTS in November 1999, where it underwent a D-check, the heaviest type of inspection, which involved deep examinations of every part of the airplane. During this period, Emery also asked TTS to perform a number of unscheduled maintenance items, including most notably a total replacement of the elevator control system.
Because Emery didn’t have replacement elevator control system components lying around, the airline ordered an overhauled system from a commercial parts broker based in Arizona. The system was then installed and inspected by TTS before the aircraft was declared airworthy and returned to Emery. One possibility was that TTS mechanics had accidentally left the cotter pin off the right elevator control tab attachment bolt while installing the new control system.
However, investigators found that Emery mechanics might have also worked on the elevators after the plane was released from the D-check. About one week after N8079U returned to service, a pilot complained that excessive control force was required to flare the aircraft for touchdown, and the plane was sent in for troubleshooting. In the process of diagnosing the problem, a mechanic observed that the elevator dampers, which provide damping force to prevent excessively rapid elevator movements, had been installed backwards — the left elevator damper was installed on the right elevator, and vice versa. According to Emery’s technical logs, mechanics swapped the dampers using a procedure in the manual, and no more complaints about control forces were received.
Notably, the procedure for swapping the dampers did not call for mechanics to touch the control tab connections, nor does the NTSB report on the accident mention anything about Emery mechanics having done so. However, submissions by Tennessee Technical Services and the Air Line Pilots Association alleged that they did, for reasons which will be discussed shortly. Emery’s submission argued that TTS most likely left the cotter pin off, while Boeing’s submission did not make a determination. The NTSB ultimately went with Boeing’s approach and declined to state who installed the bolt incorrectly. However, the arguments for both sides can be found in the NTSB’s public docket on the accident, and some of the investigators have since let slip their personal opinions. These sources add significant drama and intrigue to the story of the Emery Worldwide accident.
Emery Worldwide’s argument was quite simple: none of its mechanics ever touched the elevator control system connections, nor did any of the procedures they used call for such, and therefore the mistake couldn’t have happened at Emery. The only answer, then, was that it happened at TTS during the D-check in November 1999, when mechanics installed the new elevator control system. Emery also took a separate swipe at TTS, alleging that it installed the elevator dampers backwards, and that their failure to detect this was evidence that their inspection of the elevators was inadequate.
On the other hand, TTS contended that the dampers were swapped by the parts broker which supplied the system, pointing out that another control system from the same vendor was later found with swapped dampers as well. In their view, this issue had arisen because of Emery’s insistence on buying from sketchy parts brokers in order to reduce costs. TTS admitted that it did not detect the discrepancy, but argued that it was difficult to spot that the dampers were backwards unless one had encountered the issue before. Furthermore, they defended their inspection of the control system, pointing out that the work was inspected four times by three career inspectors with a combined 110 years of aircraft maintenance experience.
Next, TTS noted that according to an NTSB study late in the investigation, the swapped elevator dampers probably did not cause the pilot report of excessive pitch control forces during the landing flare, but the fact that no more reports were received would seem to suggest that some other corrective action was taken. In TTS’s view, this action may have involved work on the control system. However, in a later reply, Emery pointed out — in my view, correctly — that this assumption is flawed, because sometimes issues simply go away without explanation, especially highly subjective ones like control feel abnormalities.
Nevertheless, suspicion that Emery mechanics messed with the control system remains. In its own submission, the Air Line Pilots Association (ALPA), citing an NTSB test that I was unable to locate, argued that accessing the elevator dampers is difficult unless the range of elevator motion is first increased by disconnecting the control tab linkage, which is not an approved procedure. In an interview for the TV show Mayday some 18 years after the crash, NTSB maintenance investigator John Goglia, who worked on the case, endorsed the theory that an Emery mechanic had disconnected the control tab pushrod in order to ease access to the damper, and then simply forgot to put the cotter pin back in during reassembly after he finished.
According to the public investigation docket, the mechanic who performed the elevator damper swap testified that at no point did he touch the control tab connections, and his supervisor testified the same. However, ALPA claimed that a witness had changed his testimony, perhaps under pressure from Emery’s lawyers, after initially telling the NTSB over the phone that he saw several fairings removed, other than those covering the elevator dampers. In their response, Emery claimed that these allegations were merely the result of a misleading NTSB transcript which the witness later asked to be corrected. This issue does not appear to have been resolved.
Additionally, TTS and ALPA both argued that Emery missed an opportunity to detect the missing cotter pin during a scheduled B-check inspection in December 1999, which called for an inspection of the elevators’ “security of attachment.” In their view, this clearly included the control tab connections, and TTS personnel testified that when they performed B-checks on DC-8s, they normally removed the control tab fairings (labeled on earlier diagrams) in order to observe the pushrods, crank fittings, and attachment bolts. However, Emery argued that the manufacturer’s B-check procedure did not call for any fairings to be removed, and therefore removing these fairings was not intended to be part of the check. Boeing (always the legalist!) took Emery’s side. In this author’s opinion, it nevertheless remains unclear how one is supposed to inspect the elevators’ “security of attachment” without looking at the mechanical connections. All we know for sure is that Emery probably did not remove the fairing that was concealing the improperly installed bolt during the B-check, and thus failed to notice the missing cotter pin.
On top of these arguments, both TTS and ALPA — in addition to the NTSB itself — presented quite a lot of evidence indicating that Emery Worldwide suffered from a seriously deficient maintenance culture during the years before and after the crash. Anecdotally, TTS cited the testimony of one of their employees, who witnessed an Emery mechanic incorrectly installing an aileron control system, but was told to “mind [his] own business” when he attempted to intervene. Similarly, TTS reported receiving an Emery DC-8 which had just come out of a contracted overhaul in Costa Rica, only to find over 200 maintenance discrepancies during a basic, non-invasive inspection. There was more concrete evidence as well: in fact, the Federal Aviation Administration had been on Emery’s case for some time. FAA inspections had repeatedly discovered long lists of violations which Emery had not fixed in a timely manner, including failure to correct recurring malfunctions, carrying out unapproved aircraft alterations, operating unairworthy aircraft, poor adherence to procedures, improper repairs, and poor record-keeping. These findings prompted the FAA to place Emery under a “heightened state of oversight” in January 2000, after the latest inspection found over 100 violations of the Federal Aviation Regulations.
ALPA went even farther than TTS in its criticism of Emery’s safety culture. The pilots’ union accused Emery of “pencil-whipping” (falsifying) maintenance records and knowingly buying and installing unapproved parts, and noted that the airline had been fined $482,000 by the Occupational Safety and Health Administration for repeated improper handling of hazardous cargo. At least one former Emery pilot alleged that his colleagues were keeping track of violations and believed the airline would certainly suffer a crash. ALPA echoed this language, writing that Emery was “poised to have a fatal accident” and “lacked a functional or effective safety culture,” and described its operational model as being “reminiscent of ValuJet.”
In its response to the ALPA and TTS submissions, Emery lashed out harshly at its detractors. The airline accused the rival submissions of containing “unsubstantiated, irrelevant, and/or erroneous allegation[s]” and described ALPA’s submission as a “random diatribe” that hardly dignified a response. Emery contended that the arguments boiled down to, “ALPA thinks lowly of EWA, therefore EWA must be at fault in this accident,” and stated that it was “offended” by accusations of pencil-whipping. The company accused both parties of acting in their self-interest due to ongoing litigation against Emery, although the same was true of Emery itself, a fact which was not acknowledged. Continuing its rebuttal, Emery called many portions of TTS’s submission “wholly unsubstantiated or clearly wrong” and described the allegation that mechanics changed their testimony as “flatly untrue.” Emery was particularly critical of TTS’s admittedly dubious allegation that the pitch feel problem must have been solved by some undisclosed maintenance action, which it likened to base conspiracy theories and accused TTS of engaging in “grassy knoll-type thinking.”
The response was characteristic of Emery’s complete denial of responsibility for any aspect of the crash, or its frankly well-documented safety problems. Emery was said to have a standoffish attitude toward any suggestion that it was not a safe airline, an observation which was substantiated by an internal FAA memo, in which the FAA certificate management team assigned to Emery wrote, “It was obvious that EWA’s management representatives would rather spend their resources defending their decisions or denying that a compliance issue even exists.” These denials continued even after Emery suffered an additional accident, when in April 2001 a DC-8 crash landed in Nashville, Tennessee, after one of its main landing gear bogies failed to deploy. The NTSB found that the crash was caused by improper maintenance of a key hydraulic valve by Emery personnel.
Finally, on August 13th of that year, the FAA and Emery reached an “agreement” in which the latter would suspend operations for 30 days in order to bring its practices in line with federal regulations. However, the 30 days came and went without Emery making much progress, and on December 5th, 2001 the company announced that it would permanently cease operations. Emery Worldwide Airlines was subsequently dissolved, and its airplanes were sent to boneyards and torn up for scrap.
◊◊◊
Looking back, despite Emery’s claims that circumstantial evidence of its poor safety culture did not amount to proof that it was responsible for the accident, suspicion remains. Tennessee Technical Services did not have a history of negligent maintenance practices or federal enforcement actions, but Emery did. Off the record, investigators suspected Emery, but could not prove it. And yet in the end, the only results were angry recriminations, inconclusive lawsuits, and three bereaved families who must live with the certainty that someone out there probably knows the truth, but has taken a vow of silence.
Nevertheless, several safety actions were taken. The FAA began requiring DC-8 operators to teach crews that asymmetric control tabs may be a sign of a malfunction, and Boeing redesigned the DC-8’s control tab pushrod and crank fitting to preclude the possibility of a jam, even if the attachment bolt should come loose. This change was subsequently mandated by a binding FAA airworthiness directive. Boeing and other manufacturers also evaluated other older planes for compliance with certification requirements concerning disconnection or jamming of control systems, which resulted in an additional service bulletin being issued for the Boeing 707. Efforts were also undertaken to improve the specificity of maintenance work cards, and ensure access to clear and up-to-date installation drawings. Although changes to the DC-8 are no longer relevant today, given that the type has almost entirely been removed from service around the world, the other changes to maintenance documentation have had a more widespread positive impact on the quality of aircraft maintenance in the United States.
All of this having been said, it remains both tragic and remarkable that an airplane could be lost because of a single, disposable cotter pin, not more than a few centimeters in length. An old parable comes to mind — for want of a nail, the kingdom was lost. In this case, for want of a cotter pin, the nut was lost, and for want of a nut the bolt was lost, and for want of a bolt, the control tab was lost, and for want of a control tab…
The lesson, perhaps, is that any part of an aircraft system could be important, especially on an old airplane like the DC-8, which was not built to modern failsafe or redundant design standards. A mechanic cannot predict whether a single cotter pin might cause the loss of an airplane, and so must treat every cotter pin and safety wire as though its absence will be catastrophic. The young Emery mechanic who may or may not have left off the cotter pin certainly learned that lesson the hard way. Most others need not follow in his footsteps, because his example is already there — written in the fiery remains of a DC-8 which was lost because of a single pin, and a company culture which failed to give that pin the respect it deserved.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 240 similar articles
_______________________________________________________________
Note: this accident was previously featured in episode 47 of the plane crash series on July 28th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
