On 31 January 2000, Alaska Airlines Flight 261, a McDonnell Douglas MD-83 registered N963AS, dived into the Pacific Ocean about 2.7 miles north of Anacapa Island, off Point Mugu, California, after a complete loss of pitch control. All 88 people aboard — two pilots, three cabin crew, and 83 passengers — were killed. There were no survivors. The aircraft was en route from Puerto Vallarta, Mexico, to Seattle–Tacoma, with an intended stop at San Francisco, when the mechanism that trimmed its horizontal stabiliser failed and tore itself apart.
The cause lay in a single threaded assembly in the tail. The MD-80’s horizontal stabiliser is moved by a jackscrew — a long acme-threaded screw that turns inside a fixed acme nut, raising or lowering the front of the stabiliser to trim the aircraft in pitch. On Flight 261 the threads inside that acme nut had worn almost entirely away. As the crew attempted to manage a jammed stabiliser, the last of the nut’s threads stripped; the jackscrew pulled free of the nut, and the horizontal stabiliser swung to an extreme nose-down position that no other control surface could overcome. The crew, who at one point flew the aircraft inverted in a desperate effort to maintain some control, could not recover, and the MD-83 entered an unrecoverable dive.
The wear had a mundane and preventable origin: the jackscrew assembly had not been adequately lubricated, and the periodic check that measures thread wear — the “end play check” — had been performed at intervals stretched so far that the wear was allowed to run to failure between inspections. The National Transportation Safety Board, in report AAR-02/01, found the accident was a maintenance failure: insufficient lubrication wore the threads away, and an extended inspection interval — approved by the carrier and the FAA — removed the chance to catch it. The board also faulted the absence of any fail-safe device that would have stopped a total thread loss from being catastrophic.
The investigation widened into an examination of Alaska Airlines’ maintenance practices and the FAA’s oversight of them, and it reshaped how the industry treats the lubrication and inspection of flight-critical mechanisms.
On 11 May 1996, at 14:13:42 eastern daylight time, ValuJet Airlines Flight 592, a Douglas DC-9-32 registered N904VJ, crashed into the Everglades about ten minutes after takeoff from Miami International Airport, bound for Atlanta. All 110 people aboard — both pilots, three flight attendants, and 105 passengers — were killed. The airplane struck the marsh at high speed in a nose-down, right-wing-low attitude and disintegrated, leaving little more than scattered debris in the water and saw grass. The cause was a fire in the forward cargo hold, fed by aviation oxygen the airplane was unknowingly carrying as freight.
The National Transportation Safety Board found that the fire was initiated by the actuation of one or more chemical oxygen generators improperly carried as cargo. These are the small canisters that supply emergency oxygen to passenger masks; when triggered, they produce oxygen through a chemical reaction that also generates intense heat. ValuJet’s maintenance contractor, SabreTech, had removed scores of expired generators from three older MD-80 aircraft, failed to fit the required safety caps over their firing mechanisms, and packed them — still capable of activating — into cardboard boxes that were mislabeled and loaded aboard Flight 592 as company material. In the Class D cargo hold, with no fire detection and no suppression, an activated generator’s heat and the oxygen it released created a fire the design assumed could not happen.
The Board’s probable cause distributes responsibility across three parties: SabreTech, for failing to properly prepare, package, and identify the generators; ValuJet, for failing to oversee the contract maintenance program that was supposed to ensure those very practices; and the FAA, for not requiring smoke detection and fire suppression in Class D cargo compartments. The accident is therefore an operator and oversight failure, not a piloting or airframe one — the airplane was destroyed by what was loaded into it and by the systems that were supposed to catch the mistake and did not.
The legal and regulatory consequences were substantial. SabreTech was prosecuted; the FAA grounded ValuJet for months; and the FAA moved to require fire detection and suppression in cargo holds across the fleet — directly closing the design gap the Board identified. The disaster became a textbook case of how an airline’s diffuse responsibility for a contractor’s work, combined with a permissive regulatory standard, can put a hidden hazard aboard a passenger aircraft.
On the evening of 8 September 1994, USAir Flight 427, a Boeing 737-300 descending toward Pittsburgh, rolled suddenly to the left, pitched over, and dived into wooded hills near Aliquippa, Pennsylvania. The aircraft struck the ground nose-low at high speed about six miles short of the runway. All 132 people aboard — 127 passengers and five crew — were killed. The upset took place in clear evening air in under thirty seconds, with no warning, no distress call that explained anything, and no obvious cause in the wreckage. For years it was one of the most baffling crashes in American aviation.
The aircraft had been mechanically airworthy on departure and the crew were experienced and unimpaired. What the investigation eventually established was that the 737’s rudder had moved hard to the left while the pilots were commanding it the other way. As the aircraft passed through the wake turbulence of a Boeing 727 ahead and the crew worked to counter a mild roll, the main rudder power control unit’s servo valve jammed in such a way that the rudder deflected opposite to the pilots’ input — an uncommanded full rudder reversal. The first officer, flying, pressed harder on the right pedal precisely as the rudder swung fully left, and the aircraft rolled past the point of recovery at an altitude that left no room to save it.
The National Transportation Safety Board’s investigation ran for more than four and a half years — at the time the longest in the agency’s history — and adopted its final report, NTSB/AAR-99/01, in March 1999. Its probable cause was a loss of control resulting from the movement of the rudder to its blowdown limit in a direction opposite to that commanded by the flight crew. The mechanism was a jam of the main rudder PCU servo valve secondary slide to the servo valve housing, offset from its neutral position, with overtravel of the primary slide. Crucially, this finding also solved an earlier mystery: the unexplained 1991 crash of United Airlines Flight 585 at Colorado Springs, and a non-fatal 1996 upset of Eastwind Airlines Flight 517, were attributed to the same rudder failure mode.
The consequence was one of the most extensive flight-control redesigns in airliner history. The FAA ordered Boeing to redesign the 737 rudder control system across the entire fleet — thousands of aircraft worldwide — adding redundancy and eliminating the single-point failure the valve represented. The case also reshaped how the NTSB, manufacturers, and airlines work together on long, contested mechanical investigations.
On 13 January 1982, Air Florida Flight 90, a Boeing 737-200 attempting to take off from Washington National Airport in a snowstorm, climbed only a few hundred feet before stalling, struck the 14th Street Bridge over the Potomac River, and fell into the freezing, ice-choked water. Of the 79 people aboard, 74 passengers and 5 crew, all but five were killed; four people on the bridge also died in the impact. The official toll was 78 dead — 74 aboard the aircraft and 4 on the ground — with five survivors pulled from the river. It was a takeoff accident in plain sight of the United States capital, and the National Transportation Safety Board’s reconstruction made it one of the most-studied crew-performance cases in aviation.
The 737, registration N62AF, had been deiced before pushback, but a long delay between deicing and departure left it accumulating fresh snow and ice on the wings as it waited in the falling snow for takeoff clearance. Critically, the crew did not switch on the engine anti-ice system. Without it, the engine pressure probes iced over and gave falsely high thrust readings; the engines were in fact producing substantially less power than the gauges indicated. On the takeoff roll the captain pressed on despite the first officer twice voicing concern that the readings looked wrong. Contaminated by ice and under-powered, the aircraft lifted off, struggled to climb, stalled, and came down on the bridge and into the river.
The NTSB determined the probable cause to be the flight crew’s failure to use engine anti-ice during ground operation and takeoff, their decision to take off with snow and ice on the wings, and the captain’s failure to reject the takeoff when the first officer drew attention to the anomalous engine readings. Contributing factors included the prolonged ground delay after deicing, the known tendency of the 737 to pitch up when its leading edges are contaminated, and the crew’s limited experience operating jet transports in winter conditions.
The crash drove lasting changes in cold-weather operating procedures, in deicing and holdover practice, and in the training of crews for winter takeoffs. It also entered the public record for the conduct of the rescue, including a passenger who repeatedly passed a helicopter lifeline to others before slipping beneath the ice, and the bystanders and aircrews who pulled survivors from the river.