More than two and a half hours prior to the accident, the air traffic control tower at Willow Run Airport had been evacuated due to high winds;[1]: 1 [6] the winds had also caused a power failure which rendered inoperative most of the weather instrumentation of the airport's automated surface observing system.[1]: 14 [6][b][c][d] As a result, the flightcrew of Flight 9363 obtained weather information from alternate sources, contacting company operations personnel for a temperature setting, calling Detroit Metropolitan Airport on one of the pilots' cell phones to get the current weather information at the latter airport,[e] and using a windsock to determine the predominant wind direction (and, thereby, the best runway to use for takeoff).[1]: 32, 52
The flight taxied uneventfully (apart from a delay in successfully filing and activating a flight plan, due in part to the power outage at Willow Run)[1]: 122–124 [6] to runway 23L, and, at 14:51:12 Eastern Standard Time, with the flightcrew having finished all preflight checks and obtained a takeoff clearance from Detroit Metropolitan (again via cell phone), the check airman acting as pilot in command directed the captain to begin the takeoff roll.[1]: 1–2 [f] The takeoff roll was normal until rotation speed (VR), at 150 knots (170 mph; 280 km/h) indicated airspeed (KIAS).[g] At VR, when the captain pulled back on the control column to rotate the aircraft, the aircraft failed to respond, even after the captain applied additional back force to the control column. Judging the aircraft to be incapable of flight, the captain performed a rejected takeoff, immediately applying maximum braking followed by spoilers and reverse thrust. However, by this point, the aircraft had accelerated to 173 knots (199 mph; 320 km/h), over 30 knots (35 mph; 56 km/h) above the decision speed (V1), and was moving too fast to stop in the remaining runway distance; it ran off the end of the runway and across the grassy runway safety area (RSA) before striking the raised pavement of an access road along the airport perimeter.[1]: 2–4, 50, 53–54 [3][h] Upon striking the road pavement, the aircraft's landing gear collapsed, and the aircraft slid on its belly over the road and a ditch just beyond (causing substantial damage to the belly and underside of the nose),[1]: 3–4, 17 [14] coming to a stop with its empennage on the road and its nose in a grassy field on the far side of the road and ditch. An orderly, rapid evacuation followed, with only one (relatively minor) injury occurring.[1]: 17–18 [3]
Aircraft
The aircraft involved was a McDonnell Douglas MD-83 (DC-9-83), registration N786TW, manufacturer serial number (MSN) 53123, line number 1987. Constructed at Long Beach Airport, it was first delivered to Avianca on 14 April 1992 on lease from GECAS with Irish registration EI-CEQ. Between 2005 and 2006, it was named Ciudad de Leticia. It was painted in the Juan Valdez special livery in December 2007. It was registered in Colombia as HK-4589X on 26 March 2010. It was purchased by Ameristar on 17 December 2010, registered in the United States as N768TW. It was damaged beyond repair in the accident and written off aged 25 years.[15]
Investigation
Recorded flight data from the attempted takeoff of Flight 9363.
The failure of the aircraft to rotate, despite even a greater-than-normal nose-up control column input, focused suspicion on the aircraft's elevator system. The MD-80 (in common with all other DC-9s except for the MD-90[i]) uses a tab-driven elevator, with the pilots' control columns connected via cables to servo tabs on the trailing edges of the inboard elevators.[17] When a nose-up control input is commanded by the pilots, the elevator control tabs deflect in the trailing-edge-down direction, creating an upwards aerodynamic force on the elevators which causes them to deflect in the trailing-edge-up direction.[1][17] Two geared tabs, one per elevator, are located outboard of the control tabs; these are mechanically connected to the elevators, and deflect in the direction opposite that of the elevators, producing additional aerodynamic force to help move the elevators.[j]
The inboard geared tab linkage of the accident aircraft's right elevator, showing the bent and damaged control linkage.
When the aircraft was inspected on site following the accident, the right elevator was found to be jammed in a trailing-edge-down (TED) position slightly beyond its normal limit of motion, and could not be moved by hand.[1][17][3][4] The inboard control linkage of the right elevator's geared tab was damaged, being locked in an overcenter position, beyond its normal limit of travel, and with portions of the control linkage bent and displaced outboard;[1][17] when the damaged linkage was disconnected by investigators, the elevator could be freely moved by hand from stop to stop.[17] The cockpit controls could be moved throughout their full range of motion, and the control tabs were observed to move properly in response to control-column inputs;[1][17][k] as the elevators are not mechanically connected to the cockpit controls, the jammed right elevator would not have altered the feel of the control column, preventing the elevator jam from becoming apparent to the flight crew prior to their attempting to rotate the aircraft.[1][17] Due to the MD-80's T-tailed design, which places the horizontal stabilizers and elevators atop the vertical stabilizer, the elevators are about 30 feet above the ground when the aircraft is on its wheels, making it impractical to directly check whether the elevators can move (which would require someone to raise themself up to the horizontal tail, using a lift or similar equipment, and then attempt to physically move the elevator surfaces), and such a check is not routinely performed on the MD-80 during preflight inspection unless there is reason to suspect damage to a particular aircraft's elevator system.[1][l]
A review of elevator-position data from the aircraft's flight data recorder (FDR) showed that the last time the right elevator was recorded as not being in the full-TED position was on the morning of March 6, over two days previously, when the aircraft's electrical system was briefly powered up during a maintenance check several hours after arriving from Lincoln.[1][18] By the next time the aircraft was powered up (at 1238 on the day of the accident), the right elevator was already at the full-TED position, and remained there in all elevator-position data recorded during the preparations for the flight to Dulles;[1][m] in contrast, the left elevator moved several times throughout its full range of motion under the influence of ground winds.[1][18] During the attempted takeoff, the left elevator followed the captain's control-column inputs; in contrast, the right elevator remained in the full-TED position until partway through the attempted rotation, and, even then, moved only slightly upwards, not enough to allow the aircraft to rotate.[1][18] Due to the aircraft's inability to rotate during takeoff, the NTSB concluded that the captain was justified in rejecting the takeoff despite being well past V1 (normally the point beyond which a takeoff should not be rejected unless, as occurred here, there is reason to consider the aircraft incapable of flight) and at too high a speed for the aircraft to have been stopped on the runway, as the elevator jam could not reasonably have been detected prior to this point.[1][3][4][n]
While the aircraft was parked at Willow Run, it had been exposed to the high, gusting winds affecting the airport. Wind of sufficient strength coming from directions other than straight ahead can cause damage to an aircraft's flight control system. The MD-80's flight control system, in accordance with the airworthiness standards applicable at the time of the accident, was designed to withstand horizontal wind gusts of up to 65 knots (75 mph; 120 km/h) from any direction with the aircraft on the ground;[o] winds greater than this were neither forecast to occur during the time the aircraft was parked at Willow Run (the maximum wind gusts forecast for the airport during this time period were only 48 knots (55 mph; 89 km/h)), nor recorded by the anemometers at the airport (which detected a maximum gust of 55 knots (63 mph; 102 km/h) during this time period).[1][19] Had the winds affecting the airport been forecast to exceed 60 knots during the time the aircraft was on the ground there, the aircraft maintenance manual (AMM) for the aircraft would have required it to be parked facing into the forecast wind direction; if the aircraft had been exposed to wind gusts in excess of 65 knots from other than straight ahead while parked, a physical inspection of all its flight control surfaces would have been required, including a check confirming that the control surfaces were free to move.[1]
Prior elevator jam incident (Munich, 1999)
Prior to the Flight 9363 accident, Boeing,[p] and Douglas and McDonnell Douglas before them, had record of only one wind-induced elevator jam on any DC-9-series aircraft, which occurred at Munich Airport, Germany, in December 1999, and involved exposure to winds exceeding the elevator system's design limits.[1]
In that incident, which was investigated by the German Federal Bureau of Aircraft Accident Investigation (BFU), the airport had been subjected to a severe windstorm while the incident aircraft (another MD-83) was on the ground, with peak winds of up to 70 knots (81 mph; 130 km/h), exceeding the manufacturer's mandatory inspection limits for the DC-9/MD-80 flight control system,[1][17][20][21] and the flightcrew, seeing their aircraft's control surfaces "striking their respective stops with considerable force", requested an inspection of the aircraft's flight control system.[17][20] A full inspection of the aircraft's elevators (which would have included attempting to move the elevator surfaces by hand to confirm freedom of movement) was not conducted, due to personnel-safety concerns in the continuing high winds;[q] instead, maintenance personnel had the flight crew perform a flight control check by moving the control column throughout its entire range of motion and checking for any abnormal resistance.[1][21][r] No abnormalities were detected during this check, and the aircraft was released for flight, but failed to rotate during takeoff when commanded to do so, forcing the flight crew to reject the takeoff at very high speed; the aircraft was safely brought to a stop on the runway.[1][20][21]
The BFU's investigation found that the Munich aircraft's left elevator was jammed in a full-TED position, having been forced into that position by the high winds experienced on the ground.[1][17][20] As a result, the BFU recommended, and Boeing instituted, enhanced inspection and maintenance requirements for DC-9s with primarily-tab-driven elevators (the DC-9-10 through -50, MD-80, and Boeing 717) following exposure to ground winds exceeding 65 knots (75 mph; 120 km/h) without the aircraft's nose pointed into the wind; however, the requirements following exposure to winds below this threshold remained unchanged.[1][21]
Wind field analysis and load testing of elevator system
Computer simulation of the airflow downwind of the Willow Run hangar, showing turbulence generated by the hangar's presence; the horizontal and vertical tail surfaces of the parked accident aircraft are visible at the far right of the image.Computer simulation of the horizontal (left) and vertical (right) winds affecting the tail surfaces of the accident aircraft.
As the aircraft had sustained damage despite the ambient wind speeds apparently remaining below the theoretical damage threshold, the NTSB scrutinized the aircraft's parking circumstances to see if there were any factors that could have resulted in the aircraft experiencing local winds of damaging intensity. A large hangar immediately upwind of the aircraft's parking position was an obvious candidate, and the investigators performed computational fluid dynamics (CFD) modeling of the wind field downwind of the hangar and around the parked aircraft, using a detailed three-dimensional model of the hangar obtained via drone imagery.[1]: 22–23, 55 [22][23][24][s]
The CFD analysis showed that the turbulence produced by the interaction of the wind with the hangar both intensified the local winds affecting the parked aircraft (a 55-knot (63 mph; 102 km/h) horizontal gust passing over the hangar produced a 58-knot (67 mph; 107 km/h) gust at the aircraft itself), and also introduced significant vertical components to the wind (the same 55-knot horizontal gust induced a strong updraft at the parked aircraft's tail, immediately followed by a strong downdraft) which could slam the aircraft's elevators forcefully between their TEU and TED mechanical stops, potentially resulting in flight-control damage.[1]: 23–24, 55 [22]
Video of dynamic load testing of the elevator system starting from the full-TEU position at simulated wind speeds of 55 and 60 knots (63 and 69 mph; 102 and 111 km/h). In the 60-knot test, the inboard geared-tab linkage can be seen to become locked overcenter.
The NTSB performed a series of static and dynamic load tests to determine the effects on the MD-80's elevator system of winds of various strengths, both alone and combined with the additional loads produced by slamming the elevator to the full-TED position from the neutral or full-TEU position.[1]: 25–26 [17][25] The accident aircraft's undamaged horizontal stabilizers and left elevator were mounted in a test rig,[t] with the aerodynamic loads on the elevator being simulated by means of hanging weights of various sizes from it; for the dynamic testing, the elevator was lifted to the neutral or full-TEU position using a forklift and then allowed to fall freely to the full-TED position.[1]: 26 [17][25] Static load testing at simulated wind speeds of up to 75 knots (86 mph; 139 km/h) did not result in the elevator's geared-tab linkages becoming locked overcenter, but the inboard geared-tab linkage of the test elevator did become locked overcenter, and jam the elevator, during dynamic load testing at simulated wind speeds of 60 knots and greater.[1]: 26, 56–57 [17]
Damage produced by load testing of the elevator mechanism (left), compared with the damage seen on the accident aircraft (right).
As a final test, with the inboard geared-tab linkage of the test elevator locked in an overcenter position, a TEU force was applied to the elevator using the forklift. The overcentered links failed and bent outboard, in the same manner as the damage observed on the inboard geared-tab linkage of the accident aircraft's right elevator.[1]: 27 [17]
Probable cause
The NTSB released their final report on 14 February 2019,[1] which concluded that
...the probable cause of this accident was the jammed condition of the airplane's right elevator, which resulted from exposure to localized, dynamic wind while the airplane was parked and rendered the airplane unable to rotate during takeoff. Contributing to the accident were (1) the effect of a large structure on the gusting surface wind at the airplane's parked location, which led to turbulent gust loads on the right elevator sufficient to jam it, even though the horizontal surface wind speed was below the certification design limit and maintenance inspection criteria for the airplane, and (2) the lack of a means to enable the flight crew to detect a jammed elevator during preflight checks for the Boeing MD-83 airplane. Contributing to the survivability of the accident was the captain's timely and appropriate decision to reject the takeoff, the check airman's disciplined adherence to standard operating procedures after the captain called for the rejected takeoff, and the dimensionally compliant runway safety area where the overrun occurred.[1]: 64
The report praised the actions of the flight crew for contributing to the lack of serious injuries or fatalities in the accident.[1]: 53–54, 63–64 [26] In a press release on 7 March, NTSB chairman Robert Sumwalt stated "This is the kind of extreme scenario that most pilots never encounter – discovering that their plane won't fly only after they know they won't be able to stop it on the available runway. These two pilots did everything right after things started to go very wrong."[26]
Postaccident corrective actions
As a result of the load-test results which showed that wind gusts below the DC-9's design limit could, in some cases, produce dynamic effects sufficient to jam the elevator system, Boeing developed a modification involving the addition of a secondary mechanical stop to the DC-9 elevator system (which would physically prevent the elevator from moving far enough past its limits to allow the geared-tab linkages to become locked in an overcenter configuration); for DC-9s with tab-driven elevators not yet equipped with the secondary elevator stop (encompassing all unmodified classic DC-9s, MD-80s, and 717s), the maintenance manual was revised to decrease the wind strengths which would necessitate a physical inspection of the elevator system before further flight.[1]: 48 The NTSB recommended that Boeing finalize and fully implement these changes, and also develop a means for DC-9 flight crews to detect an elevator jam before attempting to take off.[1]: 58, 65
See also
2021 Houston MD-87 crash, an MD-80 runway excursion that resulted in the total destruction of the aircraft due to flight-control damage similar to Flight 9363
Notes
^After the accident, the team was able to make alternative travel plans and arrived in Washington in time for the game.[9][10][11][5]
^The only ASOS weather instruments which continued to operate throughout the power outage were the three barometers used to determine the airport's altimeter setting, which received electrical power from a different source from that used by the remainder of the ASOS weather instrumentation.
^Normally, in the event of the failure of one or more ASOS instruments, the missing information would be supplied manually by weather-observation personnel in the control tower. However, as the tower had been evacuated, this did not occur in this case.
^These high winds affected the entire southeastern portion of the Lower Peninsula of Michigan; a high wind warning had been declared that morning for the area.[12][13]
^Detroit Metropolitan Airport is 8 nmi to the east of Willow Run, close enough that - barring the presence of small-scale frontal or convective weather systems, which were not present on the day of the accident - the weather conditions at one of these two airports can reasonably be assumed to also reflect conditions at the other of the two.
^The captain was transitioning to the MD-80, having previously flown older, smaller versions of the DC-9; although the MD-80 series is itself a version of the DC-9, it is sufficiently different from the older DC-9s to require that pilots moving from one to the other receive training on the differences between the two. As the captain was still undergoing differences training for the MD-80, the check airman was the pilot in command of the flight, although the captain was the pilot flying.
^Ordinarily, the aircraft’s weight and the ambient temperature at the time of the attempted takeoff would have called for a VR of 142 knots (163 mph; 263 km/h). However, due to the continued strong, gusty wind conditions, the flightcrew increased VR slightly to help protect against the possibility of a wind shear encounter during the takeoff; this is accepted practice in weather conditions conducive to wind shear.
^The RSA had been extended from its prior dimensions several years previously in order to bring it into compliance with accepted standards for RSA size and safety; the new, larger safety area was judged to have significantly increased the survivability of the accident by allowing additional space and time for the overrunning aircraft to decelerate. RSA improvements, finally carried out en masse by the Federal Aviation Administration in the early 2000s and early 2010s, had been the subject of numerous prior NTSB safety recommendations dating back to the 1980s.[1]
^The MD-90, the largest version of the DC-9, uses a hydraulically-powered elevator, but retains the manually-controlled servo tabs as a backup.[16]
^A third set of tabs even further outboard, the antifloat tabs, are connected to the trimmable horizontal stabilizer, and deflect downwards at large nose-up trim settings (corresponding to a large negative angle of attack of the stabilizer) to generate an upwards force on the elevators and prevent the elevators from floating in the trailing-edge-down direction under these conditions.
^During the postaccident inspection, some abnormal resistance to control-column movement was noted; however, this was determined to be the result of structural damage incurred during the accident sequence, which caused the elevator control cables (routed through the damaged area) to bind, and would not have been present prior to the collapse of the aircraft's landing gear.[1]
^The elevators, and the positions thereof, are readily visible from the ground; however, low-intensity winds can easily move one or both elevators to their mechanical stops in either direction without causing damage, and an observation of an elevator in the full-TED position is, therefore, not, on its own, indicative of an elevator problem.[1]
^When the MD-80 is on the ground, as sensed by the weight-on-wheels (WOW) switch in the nose landing gear, its FDR records aircraft parametric data whenever at least one engine fuel switch is on and the aircraft's parking brake is disengaged (when airborne, the FDR records regardless of the positions of the engine fuel switches or the status of the parking brake). During the two days between the maintenance check on March 6 and the aircraft being powered up on March 8, the aircraft was parked at Willow Run with engines shut down, and the FDR did not operate; it also stopped operating three times during the preparations for the accident takeoff, coincident with the parking brake being applied.[18]
^As the cockpit controls are linked to the elevator control tabs and not to the elevators themselves, preventing the pilots' control check during taxi from revealing the elevator jam, the jammed elevator could only be detected through its aerodynamic effect of preventing the aircraft from rotating when commanded. By the time the aircraft's lack of response to any of the captain's control-column inputs became apparent, which took several seconds (as it takes several seconds, even during a normal rotation, for the elevator control tabs to drive the elevators to a TEU position and for this change in elevator position to start noticeably pitching the aircraft nose-up, a timespan to which would need to be added the captain's reaction time and the time needed to verify that even an increased control-column input would not cause the aircraft to rotate after the failure of a normal-magnitude input to do so), the aircraft was too fast and too far down the runway to stop without an overrun.
^At the time the DC-9 was originally certificated, the applicable regulations only required flight controls to withstand a gust of up to 88 feet per second (27 m/s), or about 52 knots (60 mph; 96 km/h); this was increased in 1997 to 65 knots. However, the MD-80 was designed to withstand gusts of up to 65 knots (75 mph; 120 km/h) without damage, despite this not being required at the time.[1]
^Boeing took over the type certificate for the DC-9, of which the MD-83 is a variant, when it merged with McDonnell Douglas in 1997.
^Even had it been safe to perform, a physical inspection of the elevators would not have been required by the version of the AMM in force at the time; the AMM required an operational check of the aircraft's flight controls, but did not specify what form it should take. Following the Munich incident, Boeing updated the AMM to require that the elevators' ability to move be physically checked in circumstances such as these.
^This is a normal, routine procedure, performed prior to takeoff (along with similar tests of the rudder and aileron/spoileron controls) in all airplanes. Its primary purpose is to detect blockages or restrictions of the cockpit controls or of the flight control cables directly attached to them; for aircraft with hydraulically-, aerodynamically-, or electrically-driven control surfaces, it does not serve as positive verification that the control surfaces themselves are free to move.
^This also had the beneficial side effect of preserving an exquisitely-detailed record of the historically-significant hangar (the last survivor of many such buildings erected at Willow Run during World War II to build heavy bomber aircraft), which was scheduled for demolition.[24]
^The MD-80's left and right elevators are mirror images of each other, so testing performed using the left elevator produces results equally applicable to both.
_and_test_rig_(left).png)
