Every aeroplane has a part you have never heard of that is holding more of your life in its hands than the engines are. On a McDonnell Douglas MD-83, that part was a steel screw turning inside a nut, mounted near the top of the vertical fin.

The screw set the angle of the horizontal stabilizer. Not the elevator, the whole stabilizer: the surface that trims the aircraft in pitch across its entire speed range. There was one screw, one nut, and no second load path. If the nut gave way, nothing else was holding the front of the stabilizer.

On 31 January 2000, after the nut on Alaska Airlines N963AS had worn down to roughly a tenth of its original thread thickness, it gave way. Eighty-eight people died in the Pacific a few miles north of Anacapa Island, California.

The part of this story that matters is not the failure. Wear is not a surprise; the acme nut was designed as a wear component and everyone involved knew it. What matters is how the two maintenance tasks that existed to catch that wear came to be performed so rarely, and the answer is that nobody ever decided to make them rarer. They simply kept riding along inside a package that was itself being extended, year after year, until the lubrication interval had grown roughly sevenfold from the figure the manufacturer first published.

One screw, one nut

The MD-80 family inherited its longitudinal trim system from the DC-9. The horizontal stabilizer is hinged at its rear spar and moved at the front by a jackscrew assembly driven by two electric motors, a primary and an alternate. The screw turns. The acme nut, fixed to the structure, does not. As the screw winds through the nut, the leading edge of the stabilizer rises or falls and the aircraft trims nose-down or nose-up.

That is an elegant arrangement and a very old one. It is also, in this particular implementation, a single load path. Douglas addressed that not with redundancy but with margin: the nut was made deliberately over-strength and designated as the wear point, the cheaper and replaceable half of the pair, with the wear to be managed by maintenance rather than designed out.

The FAA understood the design the same way. At the Safety Board public hearing, an FAA senior certification engineer was asked how wear had been treated during certification.

That single sentence explains how a component with no backup could be certificated. A systems safety analysis asks what happens if a part breaks. It does not ask what happens if a part slowly disappears. Wear was handled by calling it a maintenance problem and moving on.

Two tasks did that controlling and monitoring. Lubrication, which kept the threads apart. And the end play check, which measured how much of the nut was left.

The measurement that condemns the nut

End play is axial slop: how far the screw can move up and down inside the nut without turning. A new assembly has almost none. As the nut threads wear, the gap opens, and the measurement grows in direct proportion to the metal that has gone.

The allowable band was 0.003 to 0.040 inch, and the 0.040 limit is where the arithmetic becomes uncomfortable. The Safety Board calculated that an assembly sitting right at that limit has lost only about 22 per cent of its thread thickness. The nut recovered from Flight 261 had lost about 90 per cent.

Think about what that gap means. The inspection that condemns the part fires when roughly a fifth of it has gone. Failure comes when nine tenths has gone. Between those two states the aircraft flies on, and the only thing standing between them is how often somebody carries out the check.

Fifteen years of intervals getting longer

Here is the chronology the Safety Board reconstructed from Alaska Airlines maintenance records, and it is worth following step by step, because no single step looks unreasonable.

In March 1985 the B check came round every 350 flight hours and the jackscrew was lubricated at every other one, so every 700 hours. In March 1987 the B check moved to 500 hours and the lubrication moved to every B check, so the interval actually fell to 500. So far, so attentive.

In July 1988 Alaska abolished the B check altogether and spread its tasks into the A and C checks. Lubrication landed on every eighth A check. A checks were 125 hours apart, so the interval became 1,000 hours. In February 1991 the A check went to 150 hours and the same every-eighth rule made it 1,200. In December 1994 the A check went to 200 hours and the same rule made it 1,600.

Notice what has happened three times in a row. Nobody decided to lubricate the jackscrew less often. Somebody decided to extend the A check, and the jackscrew interval moved because it was expressed as a multiple of the A check.

In July 1996 the task came off the A check entirely and went onto a time-controlled card with a maximum interval of eight months. There was no flight-hour limit attached at all. At the utilisation Alaska was flying at the time, eight months worked out at roughly 2,550 flight hours. In October 1996 the task was combined with the elevator lubrication, still at eight months, and that was the interval in force on the day of the accident.

Against the 300 to 350 flight hours that Douglas Process Standard 3.17-49 had specified when the DC-9 was certificated in 1964, that is an interval about seven times longer.

The end play check travelled the same road. Every other C check, which in 1985 meant 5,000 flight hours. By July 1988, with C checks on a 13-month cycle and no hour limit, about 6,400 hours. In April 1996 the C check went to 15 months and the end play check, still every other one, became every 30 months, or roughly 9,550 flight hours. Among MD-80 operators, Alaska had the second-longest end play interval in the United States.

Nobody ever examined the task

This is the finding that should have changed how the industry thinks, and it comes in two halves.

The first half is how Alaska justified its 1996 C-check extension. The airline's director of reliability and maintenance programs described the supporting data package at the public hearing.

He went on to confirm that individual tasks tied to the C check, the end play check among them, were not separately considered when the package was extended. The analysis asked whether C checks as a whole had been finding problems. It did not ask whether any one task inside the package needed its own interval. Two lubrication tasks were in fact pulled out and given shorter intervals on the basis of that review; the jackscrew end play check was not one of them. Approval came through about a month later.

The second half is worse, and it concerns the industry-wide maintenance logic rather than one airline. When the MD-80 programme moved to MSG-3, the modern task-based maintenance methodology, the recommended jackscrew lubrication interval was set at the C check, every 3,600 flight hours or 15 months. The FAA's MD-80 maintenance review board chairman testified that the extension was treated as part of a larger C-check package, and that it had not involved a task-by-task analysis of every task the change would affect.

And the Safety Board established two further things about that decision. Douglas's own earlier recommendation of 600 to 900 flight hours was not considered during the MSG-3 process. And Boeing design engineers were neither consulted about the extended interval nor aware of it.

So the number that governed how often the only wear-control task on a single-load-path flight control was performed had been set by a process that did not look at the task, did not look at the manufacturer's earlier advice, and did not involve the people who designed the part.

What the last check found

N963AS had its final end play check at a C check in September 1997. Five measurements were recorded on the maintenance form, all of them 0.033 inch. That is inside the 0.003 to 0.040 band, so the assembly stayed on the aircraft, and under the interval then in force the next check was not due for another thirty months.

Three scheduled lubrications followed that C check. The Safety Board found that the grease on the recovered assembly was not doing its job, and the probable cause turns on that word insufficient rather than on any single missed task.

Between that 0.033 inch reading and the accident, the nut went from a condition the system called acceptable to one in which roughly nine tenths of the thread thickness was gone. Under the interval then in force there was no scheduled opportunity to notice.

Two hours of flying a jammed aeroplane

The stabilizer stopped responding to both autopilot and manual trim commands as the aircraft climbed through 23,400 feet. What followed is one of the longest sustained emergencies in the record: the crew hand-flew for roughly two hours, working the trim handles and switches, consulting dispatch and maintenance, repeatedly trying the autopilot, which disengaged each time.

When the primary trim motor eventually broke the jammed nut free, the stabilizer ran to its lower mechanical stop and the aircraft entered a dive from 31,050 feet. The crew recovered it at about 24,000 feet, which is an extraordinary piece of flying. They extended the slats and flaps, and then retracted and redeployed them. Redeploying raised the aerodynamic load on the tail, the jackscrew and acme nut separated completely, and the aircraft was no longer controllable in pitch.

The Safety Board's probable cause runs as follows, and every clause in it is load-bearing.

Three things were listed as contributing. Alaska Airlines extended lubrication interval and the FAA's approval of it, which increased the likelihood that a missed or inadequate lubrication would produce excessive wear. Alaska Airlines extended end play check interval and the FAA's approval of it, which allowed that wear to progress to failure without the opportunity for detection. And the absence, on the MD-80, of any fail-safe mechanism against total loss of the acme nut threads.

Read those together and the shape of the accident is clear. The lubrication interval determined how fast the nut wore. The end play interval determined whether anyone would find out. The design determined what happened when nobody did.

What changed, and how fast

Eleven days after the accident, on 11 February 2000, the FAA issued AD 2000-03-51. It did not go through a notice of proposed rulemaking. It went out by individual telegram to every known United States owner and operator of the DC-9, MD-88, MD-90-30 and 717-200, and it required action within 72 hours of receipt. It was not printed in the Federal Register until 28 February, seventeen days after it had already taken effect. If you want to know what an airworthiness directive looks like when the regulator has decided it cannot wait, that is it.

What it demanded was simple and immediate: a general visual inspection of the grease on the jackscrew assembly and of the area directly beneath it for metal shavings and flakes, with the assembly replaced before further flight if any were found, plus inspection and lubrication within 650 hours or 72 hours, and end play checks within 2,000 flight hours of the last one and every 2,000 hours thereafter. In July 2000 AD 2000-15-15 superseded it and widened the inspection to metallic particles, slivers and dust, the FAA having received numerous reports of exactly those.

On 6 April 2000 Alaska Airlines changed its jackscrew lubrication interval from eight months to 650 flight hours, and its end play check from a task riding on the C-check cycle to a time-controlled item every 2,000 flight hours.

Set those numbers against the chart above. The lubrication interval went from roughly 2,550 flight hours to 650, a factor of about four. The end play check went from roughly 9,550 flight hours to 2,000, a factor of about five. Neither new figure required a technological advance. Both were available the whole time.

Mentour Pilot's account of the flight, from an airline pilot's perspective.

The part that keeps being relevant

It would be comfortable to file this as a story about one airline cutting corners. The Safety Board did not file it that way, and neither should anyone else. Alaska's intervals were long, but they were not unique: another operator's MD-80 lubrication interval was 600 flight hours, and the spread across the fleet was wide. The manufacturer's own MSG-3 recommendation had already moved the lubrication task to the C check. Every extension Alaska made was reviewed and accepted by the FAA.

What failed was a way of thinking. A maintenance programme built out of packages will drift, because extending a package is a single decision with a single business case, while the dozens of tasks inside it each have their own physics. Most of those tasks tolerate the drift. One of them was the only thing measuring the wear on a part with no backup.

Modern maintenance programmes are supposed to handle this by analysing tasks individually rather than inheriting intervals from the check they happen to sit in. That is what MSG-3 is for. Flight 261 is the case that shows what happens when the methodology is applied to the package and not to the task.

A stabilizer trim jackscrew assembly on a Boeing 767. Different aircraft, same class of mechanism, and a good look at the hardware.

The jackscrew is still there, on thousands of aeroplanes, doing the same job. It is checked far more often now, and it is checked because of what happened off Anacapa Island on a Monday afternoon in 2000.

The Smithsonian Channel on the investigation and the maintenance findings.

Sources: NTSB Aircraft Accident Report AAR-02/01, Loss of Control and Impact with Pacific Ocean, Alaska Airlines Flight 261, McDonnell Douglas MD-83, N963AS, 31 January 2000, in particular sections 1.6.3.2.1, 1.6.3.3.4, 1.18.1 and the probable cause; FAA Lessons Learned, McDonnell Douglas MD-83 N963AS; Federal Register document 00-4337, 28 February 2000, and document 00-19671, 8 August 2000.