Unscrewing Disaster: The 2022 Mutiny Bay seaplane crash
On the 4th of September 2022, a seaplane operating a scheduled passenger flight in Washington state abruptly plunged from the sky off the coast of Whidbey Island, killing all 10 people on board and prompting an urgent search for answers. The weather was clear, the pilot was experienced, and there had been no prior signs of trouble, so clearly a catastrophic event had occurred, but how? The answer would come surprisingly fast, when the wreckage of the DHC-3 Otter was retrieved from the sea floor just a few weeks after the accident. There investigators found the smoking gun, a failure so self-evident that almost all doubt was immediately erased: somehow, two critical components of the plane’s pitch control system had come unscrewed from one another in flight, sending the single-engine plane plummeting nose-first into the water in a matter of seconds. The cause was a single missing lock ring less than 5 centimeters across, whose undetected absence made disaster only a matter of time. And with numerous DHC-3 Otters still flying passengers around the world, the discovery has prompted an ongoing NTSB campaign to ensure that this dangerous vulnerability is permanently fixed — before tragedy strikes again.
◊◊◊
In the city of Seattle, seaplanes are part of the fabric of everyday life, even if most people will never ride one. Near their downtown bases, the rumble of engines is ever-present during the summer months, and the brightly-colored planes can be seen departing from various vantage points around the city (including this author’s own backyard, which lies directly beneath their approach path). At peak times, over 100 commercial seaplane flights depart every day from Seattle’s Lake Union, located just blocks from downtown, and an equal number operate from nearby Lake Washington. Most of the seaplanes’ destinations lie on the numerous populated islands that dot Washington’s Puget Sound and the nearby Salish Sea, providing local residents with a rapid connection to and from Seattle, while also offering tourists the chance to see the region’s beautiful scenery from a unique perspective.
The largest commercial seaplane operators in the region are Seattle Seaplanes, based in Lake Union, and Kenmore Air, which flies out of both Lake Union and the north end of Lake Washington. But these companies also have several smaller competitors, including Northwest Seaplanes, which has been owned and operated by the Carlson family since 1988 and flies out of Renton, at the south end of Lake Washington. Northwest Seaplanes has several wholly owned subsidiaries that operate the parent company’s airplanes, including West Isle Air, which in 2022 had a fleet of five six-passenger de Havilland Canada DHC-2 Beavers and one nine-passenger DHC-3 Otter. The Otter, registration N725TH, rolled off the assembly line in 1967 with serial number 466, making it the very last DHC-3 ever built, and it had since been retrofitted with a turbine engine by a previous owner before being added to the Northwest Seaplanes fleet in 2018. West Isle Air operated both the Otter and the Beavers (and still does operate the latter) under the brand name Friday Harbor Seaplanes, specializing in scheduled and private charter flights to the San Juan Islands in the Salish Sea, and private charters to fishing lodges on the Canadian coast.
Like many small companies registered under Part 135 of the Federal Aviation Regulations, which applies to charter operators and air taxis, Friday Harbor Seaplanes operates using a demand model, offering a specified number of round trips between Seattle and the San Juans each day, but with stops only in the locations where passengers want to get on and off, with the exact destination order left at the pilot’s discretion. The company’s chief pilot, Shane Carlson, has described it as more akin to a bus service than a traditional airline, with passengers pulling the metaphorical “stop requested” line when they book their tickets.
Friday Harbor Seaplanes, like its competitors, operates seasonally, offering flights almost exclusively between late spring and early autumn when the weather is clear. The pilots are therefore also seasonal, and most have second jobs to carry them through the winter, when the company goes into hibernation. This was the reality for their sole DHC-3 Otter pilot, 43-year-old Jason Winters, who flew for Friday Harbor Seaplanes during the summer and spent winters working for a specialized soil business in California. Although he only flew seasonally, he was considered an excellent airman, and chief pilot Carlson had selected him to be his successor. In fact, he already played a vital role, flying the lion’s share of the company’s DHC-3 flights, with Carlson himself stepping in to complete the schedule whenever Winters had a day off.
The 4th of September, 2022 was to be an ordinary day at work for Winters, with three scheduled round trips between the San Juan Islands and the company’s seaplane base in Renton using the DHC-3 Otter. The first round trip, featuring four intermediate stops, went off without a hitch, as Winters ferried passengers around between the various islands before returning to base just after noon. After a lunch break, he then began the second round trip, flying first from Renton to Lopez Island, then to Roche Harbor on neighboring San Juan Island, and finally to Friday Harbor, also on San Juan Island (and the company’s namesake), where the last exchange of passengers took place before the return flight to Renton. In all, nine passengers boarded for this final leg, plus the single pilot, totaling 10 occupants.
After taxiing out of the harbor, N725TH accelerated across the blue waters of the Salish Sea and took to the air at 14:50, having made the turnaround in Friday Harbor in only 12 minutes. Unlike airline flying, there wasn’t a long climb phase, as the DHC-3 cruised between 600 and 1,000 feet above the water while navigating visually. Operating under visual flight rules in unrestricted airspace, Winters was not obligated to contact air traffic control, and in fact he typically didn’t use the radio at all, because there was cell service throughout the route and company policy was to report any anomalies to the chief pilot via text message.
Today, however, there was nothing amiss, so no texts were sent. Some passengers texted loved ones to share photos of the view out the window, one of which is shown above, and the mood was likely relaxed. With no clouds below 4,000 feet, navigation was a breeze, and although there was some turbulence and wind shear along the route, it was nothing Winters couldn’t handle. Certainly nobody could have predicted that catastrophe was just seconds away.
At 15:08, about halfway through the flight, as the aircraft was passing off the west side of Whidbey Island, some turbulence might have prompted Winters to initiate a shallow climb, which would help him reduce his airspeed. Company procedures called for pilots to cruise at lower airspeeds in turbulence to prevent momentary accelerations, which constitute a real concern on the slow-moving DHC-3 Otter. This was likely foremost on Winters’ mind when, at 15:08 and 43 seconds, while climbing through 1,000 feet, something in the back of the plane (presumably) went “clunk.”
Initially, the nose of the plane pitched about 8 degrees up, but most likely before Winters could react, it very abruptly slammed over to at least 58 degrees down, and then kept right on going. The plane hurtled into an immediate nosedive, plunging rapidly toward the water below in a near-vertical descent. Flight data, broadcast to receivers on the ground, last captured the aircraft descending at 9,500 feet per minute from a height of just 600 feet. On nearby Whidbey Island, witnesses caught sight of the plane as it plunged from the sky, corkscrewing once on the way down, before it slammed into the water with a thunderous boom, throwing up an enormous splash on the horizon. Less than ten seconds had passed between the first sign of trouble and impact.
At the company headquarters in Renton, chief pilot Shane Carlson soon noticed that N725TH was no longer being tracked on the FlightRadar24 website. Growing concerned, he texted Jason Winters to ask if something was wrong. But there was no reply.
At the scene, local residents and witnesses immediately climbed into their boats and rushed to the crash site, located in the waters of Mutiny Bay, in order to search for survivors — but when they arrived, there was little for them to find. Most of the plane immediately sank to the bottom of Puget Sound, and the first would-be rescuers found only a few scattered items, including personal effects, pieces of the cabin floor, and the body of a woman, which was handed over to the Coast Guard. The other nine people on board were declared missing and presumed dead.
The crash came as a complete shock to the Seattle seaplane community, a tight-knit business where everyone knows one another. Others around the country also mourned the loss of the passengers, who included a family of three, expecting soon to be four; tourists from Minnesota and California; and a civil rights activist from Spokane. All had been torn so suddenly from the sky, while using a service that is not only an essential lifeline for residents of the San Juan Islands, but also a Seattle mainstay with an excellent safety record stretching back decades. Industry insiders were mystified, noting that the weather was clear, the pilot was well-respected, and flight data suggested that nothing was wrong before the plane abruptly dived into the Sound. Speculation immediately focused on the one possibility that made sense: a catastrophic mechanical or structural failure. But witnesses said they didn’t see any pieces come off the plane before it hit the water, and that nothing about the aircraft looked obviously amiss. Besides, the DHC-3 Otter is considered a highly reliable airplane that rarely breaks down and is easy to fly. So what went wrong?
The following day, a large team of National Transportation Safety Board investigators arrived at Mutiny Bay to begin searching for answers. But before they could say what had happened to the plane, they needed to find it, somewhere on the bottom of Puget Sound. The general location of the aircraft was known, but it ultimately took the better part of a month to organize the required equipment, detect its exact position on the sea floor, and bring the wreckage back to the surface. The recovery operation ultimately lasted from September 26th to September 30th, with the remote underwater vehicle only able to operate during brief windows each day due to Puget Sound’s powerful tidal currents. Nevertheless, investigators were able to retrieve the bodies of several victims, which were returned to their families, as well as the majority of the airplane by weight, including all its critical structural elements and flight controls. However, the aircraft was not equipped with black boxes, nor was it required to be, so the cause would have to be determined via “tin-kicking” alone.
By this point, one of the main theories was a catastrophic failure of one of the elevators, which were known to be vulnerable to cracks and corrosion. This problem had caused several previous non-fatal incidents, and was one of the best leads investigators had. But almost as soon as they raised the tail section from the sea floor, they discovered another problem entirely — one that would change the course of the investigation overnight.
◊◊◊
The NTSB’s discovery involved the trimmable horizontal stabilizer, a system that we’ll need to review in detail.
The horizontal stabilizer, or tailplane, at the rear of the aircraft makes stable flight possible by creating downforce to balance the center of lift and the center of gravity. On most small airplanes, the horizontal stabilizer performs this role passively, but on larger aircraft it can be moved up and down, or “trimmed,” to more actively counteract different weight distributions and eliminate the need for the pilot to apply constant control pressure to maintain the desired pitch attitude. While the elevators, which are hinged to the back of the stabilizer, may be used to actively fly the aircraft, the stabilizer or “trim” setting determines what the airplane’s pitch will be when the pilot is not making inputs at all.
Although trimmable horizontal stabilizers are most commonly found on large airliners, the DHC-3 Otter also has one. On the DHC-3, the pilot manipulates the horizontal stabilizer using a trim wheel in the cockpit, which is connected by a cable to the trim actuator in the tail. The cable wraps around the actuator drum, rotating it left or right depending on the input direction. Rotation of the drum extends or retracts a threaded screw to increase or decrease the length of the actuator; increasing the actuator length pushes the trailing edge of the horizontal stabilizer up, causing the plane to pitch up, while reducing the length of the actuator pulls the trailing edge down and causes the plane to pitch down. The leading edge of the stabilizer is affixed to the vertical tail by a hinge. (Note that this is opposite to the layout that has been described in many of my previous articles. On jets the system is typically set up the other way around, with the actuator manipulating the leading edge of the stabilizer while the hinge is affixed at the rear.)
Now, breaking down the system in a more granular fashion, the part of the actuator that extends and retracts is referred to as the “barrel.” The barrel is attached to the screw and rotates with it, presenting a fun engineering problem, because it has to connect to the stabilizer, which doesn’t rotate. This problem is solved by the inclusion of a bearing, which sits inside the top end of the barrel and allows the barrel to rotate relative to a part called the “top eye end.” The top eye end fits on the inside of the bearing and is attached to the trailing edge of the horizontal stabilizer using a bolt. Collectively, the top eye end and the bearing are held in place inside the end of the barrel using a clamp nut, which fits around the top eye end and then screws into threads on the inside of the barrel, preventing the eye-end-and-bearing assembly from pulling out.
Now, zooming in even further, the clamp nut is prevented from unscrewing via the insertion of a lock ring. The lock ring, which is about 4.5 cm in diameter and made of metal, resembles a broken circle, with one of the broken ends bent inward toward the center at a 90-degree angle. This inward-pointing end is called the “tang.”
The lock ring rests within a groove stretching all the way around the circumference of the barrel just below its top end, with a hole drilled through the barrel wall to accommodate the tang. During manufacture, a hole is also drilled through the clamp nut in line with the hole in the barrel, so that when the lock ring is inserted, the tang passes through both holes and thus prevents the clamp nut from rotating relative to the barrel.
With all of that in mind, consider the scene in the NTSB hangar when the tail section was brought in for examination and investigators discovered that the clamp nut had completely separated from the actuator barrel without any damage to the threads whatsoever.
During a crash, impact forces seldom rip apart components that are threaded together, and when they do, it invariably results in the threads being stripped away, leaving behind massive damage. Therefore, to find the clamp nut and the barrel so cleanly separated could only mean that they had unscrewed from one another, rather than being forced apart. Furthermore, the actuator barrel was found suspiciously aligned with a circular hole on the bottom central skin of the horizontal stabilizer, where an object had punched through from below, forming a flap that was stamped with a red circle of grease the exact size and shape of the open end of the barrel. Needless to say, this mark could only have been created if the top end of the actuator barrel was open when it contacted the skin, and that in turn could only mean that the clamp nut and barrel had unscrewed from one another sometime prior to impact.
◊◊◊
The NTSB is not used to finding smoking guns — more often than not, a cause is only pieced together after much painstaking analysis — but if they ever did find one, it was there, on the remains of N725TH. Even many laypeople, with no more background on the actuator system than I provided in this article, could probably have identified the problem. And from there, it was not hard to follow the sequence of events all the way to the crash site: because the actuator props up the stabilizer in the desired position, upon disconnection the stabilizer’s trailing edge would have dropped as far it was physically possible to go in the nose down direction. Propelled by aerodynamic forces — recall that the stabilizer produces downforce, hence it wants to go downward at all times — the free-floating control surface likely slammed down so hard that the actuator barrel punched through its lower center skin, while witness marks elsewhere on the stabilizer indicated that it was indeed forced well past its full nose-down stop. This failure caused the plane to enter a catastrophic, near-vertical nosedive from which recovery was impossible.
As for how the actuator barrel and clamp nut came unscrewed, the most obvious reason was that the lock ring was missing. Investigators never identified any trace of it, although not for lack of trying, as the NTSB scrounged through every corner of the empennage by hand and with magnets, and even conducted a spectroscopic analysis of the punch-through in the stabilizer skin to search for traces of chemical elements used in the lock ring, but nothing was found. All they could say was that the lock ring was not present during the accident sequence, either because it was never there, or because at some point it broke and fell off.
Once the lock ring was gone, disaster was likely inevitable, but not immediate. Because the barrel rotates as the actuator extends and retracts, any friction between the clamp nut and the bearings could cause the clamp nut to snag as the barrel turns around it, resulting in an unscrewing motion. This can also cause a re-screwing motion when the barrel turns back the other way, but as anyone who has ever worked on moving vehicles should be aware, loose nuts seldom screw themselves back on again. The clamp nut might have moved back and forth countless times, but over some indeterminate timeframe the unscrewing tendency would have gradually overpowered the re-screwing tendency until the nut finally came off.
In an effort to understand why the lock ring went missing in the first place, investigators pursued a number of avenues, including the possibility that maintenance crews had simply forgotten to put it back on last time they worked on the actuator. The Northwest Seaplanes Director of Maintenance told the NTSB that the company replaced the actuator bearings every year before the start of the flying season, which would have required removing the lock ring, unscrewing the clamp nut, and pulling out the top eye end and bearings. This procedure was last performed on April 21st, 2022, and there was no specific documentation of the steps that were completed, but the technicians involved stated that they did reinstall the lock ring. This line of inquiry was therefore inconclusive.
Alternatively, there was evidence that the lock ring could also have broken after being installed. Most notably, a DHC-3 operator told the NTSB that during a 2019 inspection it found an actuator lock ring that had split into two pieces due to metal fatigue, with one half found in the bottom of the fuselage and the other hanging loosely from the tang hole. The tang was no longer restraining the clamp nut and the nut had rotated one half turn away from the fully secured position. Furthermore, it was unclear whether this condition would be discovered during Northwest Seaplanes’ regular 100-hour airframe inspections, because the inspection procedures did not specifically identify the actuator lock ring as a point of concern.
In order to learn more about the effectiveness of the lock ring as a restraining device, the NTSB turned to Viking Air, the Canadian aircraft company that has managed the type certificates for several older de Havilland Canada models, including the DHC-3, since 2006. Viking Air was able to supply an exemplar actuator, including the lock ring and clamp nut, that had previously been in service on a DHC-3. However, investigators observed that it was in far from nominal condition, because the diameter of the lock ring and the radius of the tang bend were out of spec; the end of the tang was beveled; and the clamp nut had not one, but three holes drilled into it, even though the manufacturer’s specifications only called for one, and Viking Air stated that there was no procedure that would require drilling more. Nevertheless, this was clearly occurring with some regularity, because the accident clamp nut itself had no less than five drill holes, of which only two were actually usable.
In the course of laboratory tests on the accident and exemplar actuators, the NTSB made a number of concerning observations. For one, the lock ring tang only protruded into the clamp nut hole by 1.6 mm, and even this rather meager overlap could only be achieved by compressing the lock ring using a C-clamp. If this was not done, then the overlap was only 0.7 mm, which was not a lot of tang, considering the importance of its job description. And to make matters worse, they discovered that when the tang was inserted into certain holes on either of the clamp nuts, any attempt to unscrew the clamp nut would cause the tang to simply pop out of the hole, rendering it useless, as shown in the above demonstration.
However, the most problematic element in the NTSB’s opinion was the presence of a moisture seal between the top eye end and the clamp nut, which was installed on both the accident and exemplar actuators but was not part of the manufacturer’s original assembly drawings, the official parts diagram, or the Aircraft Maintenance Manual. According to technicians at Northwest Seaplanes, the moisture seal was installed to prevent water from seeping into the top of the actuator and corroding the bearings, which was a major problem on the seaplane fleet. But on the accident actuator, the bottom of the moisture seal protruded past the bottom of the clamp nut and interfered with the bearings below, causing friction in their rotation. Any friction in the bearings while the actuator barrel was rotating could cause the clamp nut to snag and start unscrewing. To prove the point, investigators vigorously spun the actuator barrel with no lock ring installed, and observed that the clamp nut unscrewed more when the moisture seal was present than when it was not. Therefore, while the exact role that it may have played in the accident was uncertain, the presence of the moisture seal — originally a good faith attempt to improve safety — could have had the unintended consequence of hastening the airplane’s demise.
◊◊◊
Although all the aforementioned tests stretched well into 2023, the seriousness of the problem became apparent almost as soon as the wreckage was lifted out of the water, and the NTSB moved to warn the industry in what chairwoman Jennifer Homendy called “record time.” On October 26th, 2022, after gathering all the necessary evidence and documentation, the NTSB issued an urgent recommendation calling on the Federal Aviation Administration and Transport Canada to require immediate inspections of all DHC-3s to confirm that the stabilizer actuator lock rings were in place. Both agencies followed up swiftly, issuing joint airworthiness directives on November 2nd mandating the inspections, and Viking Air sent a similar letter to all known operators describing the problem. As of this writing, no missing or broken lock rings have been reported, but because so many DHC-3s are operated by small companies on an ad-hoc basis in remote parts of the world, the authorities are still working to verify that every DHC-3 has actually been inspected.
At the same time, NTSB investigators and alarmed seaplane operators immediately began working together on a longer-term solution. Spearheading the effort, the Seattle seaplane company Kenmore Air, which operates 10 DHC-3s, commissioned an engineer to design a secondary locking mechanism that would ensure the clamp nut cannot unscrew from the actuator barrel even if the lock ring is missing. Within a short time, the effort produced a redesigned clamp nut that can be safety wired to the barrel, along with a torque seal, consisting of a smear of blue sealant across the barrel, the lock ring, and the clamp nut, which reveals at a glance whether the three components have moved from their fully secured positions. The modifications were approved by the FAA in January 2023 and Kenmore Air has since distributed more than 30 retrofit kits to various DHC-3 operators.
However, an undetermined number of DHC-3s around the world have not yet been retrofitted and may have been subjected to no more scrutiny than the one-time inspection called for in the airworthiness directive. To address this shortcoming, in October 2023 the NTSB recommended that the FAA and Transport Canada mandate the installation of a “secondary retention feature,” whether that be Kenmore Air’s safety wire or some other system yet to be developed; and that operators be required to inspect their lock rings at regular intervals until a secondary lock is installed. This article was written just days after these recommendations were issued, at which time the NTSB is still awaiting the FAA’s response, but it’s widely expected that the proposals will be accepted and the improvements made mandatory, given their low cost and high return on investment.
In addition to these, the NTSB has also recommended that Viking Air develop criteria to determine whether a lock ring needs to be replaced; instruct operators to remove unapproved moisture seals from their stabilizer actuators; and improve the description of the actuator reassembly process in the Aircraft Maintenance Manual.
◊◊◊
Having explained everything thus far, before we conclude I would like to take a step back and consider the context. The DHC-3 Otter was first certificated by the FAA, or rather the predecessor to the FAA, and its Canadian counterpart in 1952, more than 70 years ago, according to a set of airworthiness regulations that came into force in 1949. DHC-3s are beloved by seaplane operators and bush pilots for their ruggedness and reliability, but part of their continued prevalence has to be attributed to the lack of any modern alternative that can fill the same niche. In aerospace terms, the DHC-3 is ancient technology, having been designed substantially closer to the Wright Brothers than the writing of this article, and while it is extremely reliable when maintained properly, its design still reflects the era in which it was conceived. In its investigation into the Mutiny Bay tragedy, the NTSB noted a number of features that highlight the DHC-3’s age, including a lack of standardization across supposedly standard parts, and a severe lack of specificity in the official maintenance manual, which did not explain, among other things, what an improperly installed or unairworthy lock ring looks like; whether it’s okay to drill additional holes in the clamp nut if the original hole doesn’t line up; or even whether the lock ring was ever intended to be a reusable item or not.
Most importantly, however, the regulations in force in 1952 required only one type of locking mechanism on all “bolts, pins, and screws,” regardless of their significance. This regulation was updated in 1996 to require a secondary locking mechanism on any fastener whose loss “would preclude continued safe flight and landing,” but the new rule was not retroactively applied to existing aircraft, such as N725TH, which was built in 1967. Therefore, the DHC-3 Otter was allowed to operate with a potential “single point of failure” — the type of vulnerability that the aviation industry has worked hard to eradicate. A safety-critical lock ring with no backup is unacceptable in modern aircraft, but in unreviewed and poorly understood legacy designs, such features persist. This particular design decision, made seven decades ago in a context utterly foreign to modern air travelers, cost the lives of 10 people long after the deaths of most of the engineers who set the sequence of events in motion.
For those who still operate, maintain, and support these legacy airplanes, this crash should serve as a wake-up call to preemptively keep watch for other previously unidentified single points of failure and notify them to the FAA. Although the crash of N725TH was difficult to foresee, it was not unpreventable, had this type of proactive approach been taken earlier — for example, when the unspecified DHC-3 operator discovered a broken lock ring and a partially unscrewed clamp nut. At that moment, an opportunity was missed to identify and correct an earlier generation’s mistake, which has only now been rectified at incalculable cost. No doubt there are other design features on other aging airplanes that could benefit from review, and as long as these aircraft continue to carry passengers, attention must be devoted to finding them. The seaplane operators of Seattle, whose own trust in their workhorse airplane was shaken by the findings, are surely looking — on behalf of all those who love or rely on these iconic aircraft, and for the families of those who were lost in 10 harrowing seconds over Mutiny Bay.
_______________________________________________________________
Don’t forget to listen to Controlled Pod Into Terrain, my new podcast (with slides!), where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode, featuring UPS flight 006. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 250 similar articles
