2017 runway overrun in the U.S.
Ameristar Charters Flight 9363 was a charter flight from Willow Run Airport to Washington Dulles Airport on March 8, 2017, which rejected takeoff and overran the runway. The crash was caused by a jammed elevator, which was damaged by high winds the day before the crash.
All 116 passengers and crew survived the crash, with only one minor injury, but the aircraft was damaged beyond repair. The NTSB investigation found that the elevator was damaged while the aircraft was parked, and then was not noticed due to flaws in the aircraft's design and Ameristar's operating procedures.
Accident.
The aircraft had been chartered to transport the Michigan Wolverines men's basketball team to the Big Ten tournament in Washington, D.C. for the following day's game against the Illinois Fighting Illini. Prior to the flight, the aircraft had been parked at Willow Run Airport since it arrived from Lincoln Airport in Lincoln, Nebraska on March 6.
Hours before the accident, the air traffic control tower at Willow Run Airport had been evacuated due to high winds.1 The windstorm affected much of Southeast Michigan, and resulted in power outages for over 800,000 DTE customers. A power outage at Willow Run disabled most of the weather instrumentation in the airport's automated surface observing system (ASOS), and manual weather observations were also unavailable due to the evacuation of the control tower.14
As a result, the flight crew of Flight 9363 obtained weather information from alternate sources, contacting company operations personnel for a temperature setting, and calling the nearby Detroit Metropolitan Airport on one of the pilots' cell phones to get the current weather information at the latter airport. Lacking information from the ASOS, the crew used windsocks at the airport to determine the predominant wind direction and inform their choice of runway.32, 52 The flight crew modified their planned takeoff to protect against the danger of wind shear, selecting a higher rotation speed than would otherwise be prescribed.36
The flight was delayed slightly, due to the communication difficulties caused by the power outages at the airport. Flight 9363 taxied uneventfully to runway 23L, and received its takeoff clearance from Detroit Metropolitan via cell phone due to the lack of ATC services at Willow Run. The check airman acting as pilot in command, 41-year-old Andreas Gruseus, directed the captain, 54-year-old Mark Radloff, to begin the takeoff roll, which began at 14:51:12 EST. The takeoff roll was normal until rotation speed (VR), at indicated airspeed (KIAS). At VR, when the captain pulled back on the control column to rotate the aircraft, the aircraft failed to respond, even after the captain applied additional back force to the control column. Judging the aircraft to be incapable of flight, the captain performed a rejected takeoff, immediately applying maximum braking followed by spoilers and reverse thrust.
By the time the captain rejected the takeoff, the aircraft had accelerated to , over above the decision speed (V1), and was moving too fast to stop in the remaining runway distance. The aircraft ran off the end of the runway and across the grassy runway safety area (RSA), before striking the raised pavement of an access road along the airport perimeter. Upon striking the road pavement, the aircraft's landing gear collapsed, and the aircraft slid on its belly over the road and a ditch just beyond, causing substantial damage to the belly and underside of the nose. The aircraft came to a stop with its empennage on the road and its nose in a grassy field on the far side of the road and ditch.
An orderly, rapid evacuation followed. The aircraft had 8 emergency exits, of which 4 were used. One emergency exit was rendered unusable by a faulty evacuation slide, and another was blocked by a seatbelt stuck in the door. All 110 passengers and 6 crew members survived the crash, with one injury, a passenger who suffered a laceration to the leg.
Aircraft.
The aircraft involved was a McDonnell Douglas MD-83 (DC-9-83), registration N786TW, manufacturer serial number (MSN) 53123, line number 1987. Constructed at Long Beach Airport, it was first delivered to Avianca on 14 April 1992 on lease from GECAS with Irish registration EI-CEQ. Between 2005 and 2006, it was named "Ciudad de Leticia". It was painted in the Juan Valdez special livery in December 2007. It was registered in Colombia as HK-4589X on 26 March 2010. It was purchased by Ameristar on 17 December 2010, registered in the United States as N786TW. It was damaged beyond repair in the accident and written off aged 25 years.
Investigation.
Aircraft design.
The crash occurred after the aircraft failed to rotate upwards, and the investigation focused on the aircraft's elevator system as a cause of the failure. The elevators of the MD-80 series aircraft are controlled indirectly via a system of servo tabs, using a design similar to the MD-80's predecessor, the DC-9.12
During a normal takeoff in an MD-80 aircraft, the pilot rotates the aircraft off the runway by pulling the control column back (aft), which moves the elevator control tab into a trailing-edge-down (TED) position. The elevator control tab directs airflow around the elevator, and causes lift from forward airflow to move the elevators in the opposite direction of the tab. The elevator is in turn linked to two more servo tabs, including a geared tab that provides mechanical advantage to the pilot's control inputs. During takeoff, the pilot's commands through the control column, via the system of three servo tabs, ultimately moves the elevator into a trailing-edge-up (TEU) position. This affects the pitch angle of the aircraft, and rotates it up and off the runway.912
As a consequence of this design, the elevators are not able to be moved during a typical preflight inspection, when the aircraft is stationary and there is no airflow over the elevators. A more thorough inspection of the elevators involves moving them by hand, but it requires a scissor lift (or similar equipment) to reach the top of the T-tail in the air, and is not typically performed during a preflight inspection.
Another consequence of the elevator system design is that when the aircraft is parked, the elevators move freely with the wind, within limits. The MD-80 is not equipped with a gust lock, which would prevent this motion. The range of motion of the elevator is constrained by stops, which are equipped with shock absorbers for protection. This system is designed to withstand high-speed airflow from straight ahead during flight, but strong forces from other directions can overcome the shock absorbers. If the linkages in the geared tab move too far, they can become "overcentered," jamming the elevator in place. The MD-80 was designed to withstand horizontal wind gusts of up to from any direction while on the ground.12
Postaccident condition of the control systems.
When the aircraft was inspected on site following the accident, the right elevator was found to be jammed in a full trailing-edge-down (TED) position slightly beyond its normal limit of motion, and could not be moved by hand. The inboard control linkage of the right elevator's geared tab was damaged, being locked in an overcenter position, beyond its normal limit of travel, and with portions of the control linkage bent and displaced outboard. When the damaged linkage was disconnected by investigators, the elevator could be freely moved by hand from stop to stop. The cockpit controls could be moved throughout their full range of motion, and the control tabs were observed to move properly in response to control column inputs.
Company policies and maintenance.
Ameristar's procedures were intended to protect aircraft from damage to flight controls from high winds. Per company policy, aircraft stored outside in winds of over 60 knots had to be parked facing into the wind. If aircraft had been exposed to wind gusts in excess of 65 knots from other than straight ahead while parked, a physical inspection of all flight control surfaces would have been required, including a check confirming that the control surfaces were free to move.33 Measurement equipment at Willow Run recorded maximum wind gusts of , below both thresholds.xi
A review of elevator-position data from the aircraft's flight data recorder (FDR) showed that the right elevator moved properly on the morning of March 6, during a maintenance check. By the next time the aircraft was powered up, at 12:38 on the day of the accident, the right elevator was already at the full trailing-edge-down position, and remained there in all elevator-position data recorded during the preparations for the flight to Dulles. In contrast, the left elevator moved several times throughout its full range of motion under the influence of ground winds. During the attempted takeoff, the left elevator followed the captain's commands, but the right elevator remained in the full trailing-edge-down position until partway through the attempted rotation, and then only moved slightly.
Prior elevator jam incident (Munich, 1999).
Prior to the Flight 9363 accident, the aircraft manufacturer had record of only one wind-induced elevator jam on any DC-9-series aircraft, which occurred at Munich Airport, Germany, in December 1999, and involved exposure to winds exceeding the elevator system's design limits.
In that incident, the airport had been subjected to a severe windstorm while the incident aircraft (another MD-83) was on the ground, with peak winds of up to . This exceeded the manufacturer's mandatory inspection limits for the DC-9/MD-80 flight control system, and the flight crew requested an inspection of the aircraft's flight control system. A full inspection of the aircraft's elevators, which would have involved moving the elevators by hand, was not conducted due to personnel-safety concerns in the continuing high winds. Instead, maintenance personnel had the flight crew perform a flight control check by moving the control column throughout its entire range of motion and checking for any abnormal resistance. No abnormalities were detected during this check, and the aircraft was released for flight. The aircraft was unable to rotate off the runway, and the flight crew were forced to reject the takeoff at very high speed. In this instance, the aircraft was safely brought to a stop on the runway.
The German Federal Bureau of Aircraft Accident Investigation (BFU) found that the Munich aircraft's left elevator was jammed in a full trailing-edge-down position, having been forced into that position by the high winds experienced on the ground. Boeing, as recommended by the BFU, instituted new procedures for DC-9, MD-80, and Boeing 717 operators, requiring inspections of elevator systems after aircraft were exposed to high winds on the ground. The threshold set was without the aircraft's nose pointed into the wind, and the requirements following exposure to winds below this threshold remained unchanged.
Wind field analysis and load testing of elevator system.
The aircraft in the Ameristar 9363 incident was damaged in the same way as the aircraft in Munich, but it was not subject to winds nearly as strong. Investigators identified a hangar immediately upwind of the aircraft's parking position as a potential cause of wind conditions that could have affected the aircraft. The investigators performed computational fluid dynamics (CFD) modeling of the wind field downwind of the hangar and around the parked aircraft, using a detailed three-dimensional model of the hangar obtained via drone imagery.
The CFD analysis showed that the hangar had a significant impact on the local winds at the parked aircraft. A horizontal gust passing over the hangar was found to produce a 58-knot gust at the aircraft itself. The hangar also introduced significant turbulence, which produced vertical forces. These forces could slam the aircraft's elevators forcefully between their stops, potentially resulting in flight-control damage.
To determine whether this theory was possible, the NTSB performed a series of static and dynamic load tests on the accident aircraft's undamaged horizontal stabilizers and left elevator. The tests, conducted at a Boeing laboratory in Huntington Beach, California, simulated the wind conditions calculated by the CFD analysis. The static tests consisted of hanging weights from the elevator while in its trailing-edge-down position, simulating constant wind speeds. Static testing resulted in no damage to the geared tab linkage (the damaged component of the accident aircraft), even at wind speeds of up to .
The dynamic load tests simulated turbulence in the wind flow by lifting the elevator and dropping it. The investigators used the same quantity of weight as the static tests, simulating the same horizontal wind speeds with more fluctuation of vertical wind speed. A simulated 60-knot gust applied to the