|Construction workers in the little town of Supply, North Carolina looked up as the roar of turboprop engines surpassed the noise from their tools. The men were stunned to see an aircraft pass overhead at an altitude of less than 50 feet with both engines running steadily. Seconds later, the U.S. Navy aircraft clipped power lines and crashed nose first into a cornfield. The aircraft exploded violently upon impact, scattering debris and bodies a hundred yards around an impact crater ten feet deep. Flames from the burning wreckage shot 100 feet into the air. As the downed power lines continued to spark and flash, it was clear that no one had survived such a cataclysmic accident. 1
Indeed, all five crewmen aboard the Grumman E-2C Hawkeye were killed. Stilled electric clocks marked the time at 2:03 P.M., January 14, 1978. Investigators were soon able to determine the direct cause of the accident. The improper installation of a small locking key had resulted in the in-flight disconnection of a critical flight control system, leaving the aircraft uncontrollable.2 With flight control integrity in question, the entire fleet of E-2 aircraft was grounded as Navy safety officials checked other aircraft for the potentially fatal flaw. 3
As government and industry personnel delved further into the matter, it became evident that the potential for such catastrophic failure was not limited to this single aircraft type. All modern aircraft, including commercial airliners, remain potentially vulnerable to a similar disconnection of flight control linkages. 4
Despite this disturbing revelation, bureaucratic inertia has prevented this important safety issue from proper examination. Engineering solutions have been actively resisted due to cost concerns, despite the safety-critical nature of the hazard. Both the aerospace industry and the government agencies charged with the regulation of aviation safety believe the risk of a repetition of the failure that doomed the crew of the E-2C to be insignificant. This assessment may prove perilous.
Safe flight depends on the pilot maintaining authority over flight control surfaces that are required to control the aircraft. Examples of such flight control surfaces include ailerons, rudders and elevators. On modern aircraft, these flight control surfaces are positioned and controlled by powered actuation systems. The connection between these actuators and the flight control surface is often established through the use of a rod end locking device system. 5
The improperly installed key that led to the E-2C crash is a commonly used type of rod end locking device. These locking devices are sophisticated mechanical fasteners used in a variety of aircraft applications, including critical installations in flight control and landing gear systems. Such parts are designed to provide a positive lock to prevent rotation in mechanical linkages or actuator systems while simultaneously allowing for linear adjustment. Locking action is obtained via a keying device that locks a shaft to a keyway in a rod end terminal and is secured by a jam nut that is then attached to the locking device with safety wire. Unfortunately, the existing designs of locking device remain susceptible to failure as a result of improper installation, with potentially disastrous results.
The failure of the locking device on the E-2C is an instructive example. This small steel key is a National Aerospace Standard (NAS) part, procured in accordance with standard part number NAS 559. The failure of a NAS 559 locking device was found to have resulted in the complete disconnection of a control rod in the longitudinal flight control system that operated the elevators of the aircraft. With the control rod disconnected from the elevator actuator, the pilot was unable to control the aircraft.
The NAS 559 design is a locking key that seats in the keyway of the rod end and under the threads of the jam nut. In a typical actuator application the actuator rod is slotted on the end to accept the lug end of the locking key. Thus, the keyway of the rod end and a slot of the actuator piston rod are secured by the locking key. Finally, a jam nut holds the key securely in place if properly torqued and correctly safety-wired.
Somehow, on the E-2C the key was improperly installed so that it wedged between the slotted collar and the jam nut rather than being inserted into the slots. This resulted in a broken, deformed key that ultimately did not provide a positive lock. The consequence was the fatal separation of the control rod and actuator.
This cannot be dismissed as a one-time maintenance error. As part of the investigation into this accident, other military aircraft were inspected for proper installation of rod end locking devices. As many as one third of the locking devices on a typical military aircraft were found to be improperly installed, with one quarter of these improper installations found on critical control linkages. 6
Recent inquiries and reports show the situation is unchanged. A mechanic overhauling commercial airliners reported regularly finding broken NAS 559 locking devices in thrust reverser installations. Manufacturers and maintenance personnel have even reported finding failure of the lug itself due to its thin cross section. 7 Although the potential for improper installation of the NAS 559 design is enormous, and is officially inactive for new design, it remains widely used.
An examination of other locking device designs is hardly reassuring. All existing locking devices share the common denominator of being dependent on the security of the jam nut. It is imperative that locking devices are correctly safety-wired to the jam nut to preclude the possibility of rotation and to prevent disengagement of the lock. Extensive testing and reported incidents have shown that if the jam nut is not properly secured, normal in-flight vibration can cause the nut to back off from the face of the locking device. It can be further demonstrated that even less than half a revolution of the nut can result in disengagement of the locking device. Once the locking device disengages from the piston rod slots, further vibration may cause degraded motion control that can lead to a complete disconnection of the linkage. Failure to safety-wire the jam nut can result in failure of any of the existing locking device designs.
The NAS 513 design is a washer type locking device with a projected locking tab that engages both the rod end groove and one of the slots on the end of an actuator piston or other linkage. Once again the jam nut must be properly torqued against the face of the locking device and properly safety-wired to a hole in the washer. This design calls for the washers to be manufactured from ordinary 1095 spring steel as a stamping that is then heat treated. The locking tabs have been prone to failure due to bending or breaking, and the washer can easily be installed backwards. Any of these conditions will prevent the fastener from fulfilling its intended function.
The Mil-B-81935/3, MS 14198 and MS 14227 designs are all essentially similar washer designs, but are strengthened by using a larger locking tab and being made as investment castings. However, the possibility of failure from backward installation or absent safety wire remains.
Perhaps the best of the existing designs is the NAS 1193 that again functions as a washer with a locking tab, but is comprised of two halves with serrations on one side of each. While the serrations can allow for very fine linear adjustment of the rod end in some applications, this design is just as prone to failure as the others in the event of improper installation. As a two-piece assembly the NAS 1193 has been especially vulnerable to the problems of backward installation, installation of only one half of the locking device, or installation when the serrations do not mesh. It can be demonstrated that if the safety wire is broken or inadvertently omitted, as little as one half revolution of the jam nut can cause the NAS 1193 serrations to disengage.
Unfortunately the potential problems of installing the washers backwards or omitting the safety wire and having the washers disengage are present with all these locking devices. The current designs do not have sufficient redundancy to preclude the possibilityof a disconnection and are inadequately foolproofed.
Moreover, the current designs violate the safety specifications governing military and commercial aircraft. Existing locking device designs are clearly not in compliance with the guidelines mandated in these specifications:
From the General Specification for Design and Construction of Aircraft Weapon Systems SD-24L, Volume I, Fixed Wing Aircraft:
22.214.171.124.20 FOOLPROOFNESS - Component systems shall be foolproof to avoid incorrect assembly which would result in damage or malfunction, or involve safety of flight. Turnbuckle and cable ends, cable or actuator-arm lengths, joints, etc. shall be arranged so that incorrect assembly will be difficult. Brackets, levers, links, bearings, control rods, torque arms, etc. that can be installed backwards or upside down shall be symmetrical about each of the axes, or it shall be impossible to install unsymmetrical parts upside down or backwards. All electrical, fluid or mechanical connections such as connections for controls, instrument lines, hydraulic lines, fuel lines, oil lines, etc. shall be incapable of being reinstalled incorrectly where such incorrect reinstallation would involve damage, malfunctioning or safety of flight....
From Military Specification Mil-F-18372, Flight Control Systems: Design, Installation and Test of Aircraft (General Specification For):
126.96.36.199 GENERAL - Flight Control systems shall be as simple, direct and foolproof as possible with respect to design, operation, inspection and maintenance....
188.8.131.52.3 REMOVABLE CONTROLS - Components provided with a disconnect feature for removal shall be so designed as to prevent incorrect installation.
From Code of Federal Regulations, Aeronautics and Space:
23.673 Primary flight controls.
(a) Primary flight controls are those used by the pilot for the immediate control of pitch, roll, and yaw.
(b) The design of two-control airplanes must minimize the likelihood of complete loss of lateral or directional control in the event of failure of any connecting or transmitting element in the control system.
23.685 Control system details.
(d) Each element of the flight control system must have design features, or must be distinctively and permanently marked to minimize the possibility of incorrect assembly that could result in malfunctioning of the control system.
The airplane may not have design features or details that experience has shown to be hazardous or unreliable. The suitability of each questionable design detail and part must be established by tests.
(a) Each removable bolt, screw, nut, pin or other removable fastener must incorporate two separate locking devices if--
(1) Its loss could preclude continued flight and landing within the design limitations of the airplane using normal pilot skill and strength; or
(2) Its loss could result in reduction in pitch, yaw or roll capability or response below that required by Subpart B of this chapter.
From MIL-F-9490D Flight Control Systems - Design, Installation and Test of Piloted Aircraft, General Specification For
3.1.3 General FC design. Flight control systems shall be as simple, direct,
and foolpoof as possible, consistent wih overall system requirements.
184.108.40.206 Invulnerability to maintenance error. Flight control systems shall be
designed so that it is physically impossible to install or connect any
component improperly without one or more overt modifications of the equipment
or the aircraft....
220.127.116.11.5 Push-pull rod installations. Push-pull rod installations shall be
designed to preclude binding or separating from the mating linkage, and shall
permit servicing and rigging.
18.104.22.168.5.1 Push-pull rod assemblies. Push-pull rod assemblies shall be
designed and installed such that inadvertent detachment of adjustable
terminals is impossible, and such that any change in length due to loosening
of the terminals cannot result in an unsafe condition. On any single rod
assembly, adjustment shall be possible at one end only. The fixed end of each
rod shall be attached to its mating linkage element in a manner which
precludes rotating of the installed assembly.... When an unsymmetrical rod is
used, such as one with a cutaway portion to allow for relative motion of an
attached link, the rod end terminals and mating linkage elements shall
positively prevent incorrect installation of the rod....
22.214.171.124.1 Joining with removable fasteners.
b. Each removable bolt, screw, nut, pin, or other removable fastener, the
loss of which would degrade operation below FCS Operational State III, shall
incorporate two separate locking or retention devices either of which must be
capable of preventing loss of the fastener by itself and retain it in its
proper installation with the other locking or retention device missing, failed
126.96.36.199.2.2 Retention of removable fasteners- Unless restrained from moving
by the attachment of adjoining parts, all removable fasteners shall be
positively locked in place....
It would seem evident that the demonstrated and potential hazards associated with improper installation of locking devices are long overdue for correction. Although engineering solutions have been proposed in response to this safety-critical hazard, no substantive action has yet been taken by the aerospace industry or the government agencies responsible for aviation safety.
As a result of the accident involving the Grumman aircraft, Grumman Aerospace began exploring alternatives to existing designs. Eventually a new Double Locking Device (DLD) was designed and developed by Murray Cohen, P.E., then leader of the Flight Controls Group at Grumman Aerospace. The U.S. Navy recognized the serious nature of the problems with the existing locking device standards, and awarded a development contract to Grumman Aerospace for the DLD.
The design of the DLD provides an elegant solution to the serious problems associated with existing rod end locking devices. The DLD system is an assembly that utilizes a secondary lock that ensures engagement of the primary lock. This is accomplished through an integral dog screw component that prevents disengagement of the locking device even if the jam nut backs off completely. Although the DLD also requires safety wire for added reliability, the DLD experienced no failures in severe vibration testing even when the safety wire was omitted.
The DLD is compatible with all existing installations. A side-shelf of the lock key serves as a guide for correct installation of the dog screw component, and will interfere with the jam nut if inverted installation is attempted. Unlike other locking devices, the DLD cannot be installed backwards.
It should be noted that use of the DLD will necessitate the rework or replacement of the rod end fitting or actuator piston rod by adding tapped holes to accommodate the dog screw. Although detailed fatigue studies revealed no detrimental effects from this modification, this rework will not be inexpensive. The DLD assembly itself will obviously cost more than the simple washers and keys currently in use. However, it is indisputable that the safety benefits clearly outweigh any costs associated with this rework.
Intended for introduction as a Military Standard (MS), the DLD is a mature product that has successfully completed the rigorous qualification testing required for such a designation. 8
This work was conducted under the combined supervision of the United States Air Force and the Naval Air Development Center and culminated in the unanimous support for such a designation. A complete set of MS drawings for the DLD was issued, with only the final numbering designation to be assigned by the Department of Defense to complete the standardization process. 9
The completion of this standardization process would not in itself mandate use of the DLD, and it is likely that in many non-critical applications designs such as the NAS 1193 may be deemed sufficient. Implementation of a standard would provide the essential step of making the DLD design available to engineers for new aircraft designs or to retrofit existing critical applications.
However, a new policy on Military Standards was recently implemented by the Department of Defense that has resulted in the suspension of any new standards and the wholesale cancellation of many existing standards. Accordingly, the nascent Military Standard that would have facilitated widespread adaptation of the DLD and with it enhanced flight safety received a de facto cancellation.
The impact of this policy is summarized in this excerpt from an article originally published in the March 1996 issue of the Aerospace Industries Association Newsletter by Bruce Mahone:
"The U.S. aerospace industry has argued for years the need to cancel overly restrictive "how to" military specifications that burden contractors with unnecessary layers of oversight and excessive costs for military systems. What has caught industry by surprise, however, is the recent wholesale cancellation of numerous military specifications that define parts and materials used in aircraft manufacture worldwide. These military specifications... constitute essential engineering information that defines as much as one-third of the parts used on most of the aircraft built throughout the world. In essence, these specifications have become de facto commercial specifications, as well as de facto international specifications. In its zeal to adopt commercial practices, the Department of Defense (DoD) is canceling or attempting to cancel hundreds of these documents. In other words, DoD is canceling documents that constitute the state-of-the-art in actual commercial practices. The burden then falls on industry to prepare new documents to replace those that are cancelled."
However, industry has not filled the void in the case of the DLD. Since the Military Standard would appear to be out of the question, another alternative would be to have the Society of Automotive Engineers (SAE) Aerospace issue a technical standard. This organization is the world's largest developer of aerospace standards. Again, the issuance of such a standard would not mandate adaptation of the DLD in any way; it would merely make it available for use to the aerospace industry.
As part of the original development contract awarded to Grumman, the U.S. Navy selected Aerospace Products Company of Indianapolis, Indiana as the prime contractor for manufacturing the prototype and initial production DLD assemblies. Grumman, now absorbed into Northrop Grumman, abandoned the DLD project after the Military Standard was not issued. Accordingly, Northrop Grumman granted a license to Aerospace Products Company as the actual manufacturer of the DLD to pursue its development. Murray Cohen, the original inventor of the DLD, also volunteered his services as principal consultant in hopes of finally bringing a standard to fruition.
Finally, in October 1996, the standards committees of the SAE agreed to put the DLD standard on the agenda at a meeting of the Airframe Control Bearing Group in Seattle. Mr. Cohen traveled to Seattle to make a formal presentation of the subject as is outlined in this report. Committee members raised several general questions concerning materials, thread engagement and comparison of linear adjustment features but no technical or engineering objections were voiced. No member disputed the potential hazards associated with improper installation of existing locking device designs. However, objections to the DLD were raised solely on the basis of cost.
As previously stated, incorporation of the DLD in retrofitting existing flight controls may require scrapping and replacing existing components. This is without question a costly proposition. In critical flight control linkages, objecting on grounds of cost to at least having a standard available to address the problem of improper locking device installation is of questionable probity. Moreover, new systems designed for the DLD would not require scrapping old parts. However, by a show of hands, the committee voted not to approve a standard for the DLD.
Perhaps the DLD will eventually receive attention that will lead to standardization. So far, major aerospace manufacturers have not demonstrated interest in sponsoring development of any alternative to the status quo. The rejection of the standard at the SAE meeting in Seattle underscores this complacent attitude. The Department of Defense has shown its disinterest by abandoning the proposed Military Standard. FAA officials have claimed that the matter lies outside the responsibilities of that agency.10 It will be inexcusable if inattention to this safety hazard results in another fatal accident.
President, Aerospace Products Company
in memoriam January 14, 1978:
Lt. Cmdr. Kenneth W. Ilgenfriz of Virginia Beach, Va.
Lt. Cmdr. Thomas J. Davis of Chesapeake, Va.
Lt. James C. Beamer, Richmond, Va.
Lt. (jg) Kenneth Shainess of Roslyn, N.Y.
Ensign Carlton J. McLawhorn of Albmarle, N.C.
1. The Sunday Star-News, Wilmington, NC, January 15, 1978
2. Grumman Aerospace Briefing Sheet 123-QA-78-009, January 24, 1978
3. The New York Times, January 22, 1978
4. Naval Air Development Center, Warminster, PA, Report NADC-87-027-60, May 15, 1986
5. Aircraft Flight Control Actuation System Design, Raymond, E.T., Society of Automotive Engineers, 1993
6. Safety Alert #K4-S-78-01, March 22, 1978, Government Industry Data Exchange Program
7. Private Correspondence with Author, 1997
8. Qualification Test Reports, September 14,1987 through May 12,1988, conducted by Cincinnati Electronics for Wright-Patterson AFB, Contract F33601-87-M-4094
9. MS Drawings, Systems Engineering and Standardization Department, Naval Air Engineering Center, Lakehurst, NJ, March 20,1986
10. Letter of May 19, 1997, Federal Aviation Administration, Thomas E. McSweeny, Director, Aircraft Certification Service