CASE STUDY: 1 AMSTERDAM AIR CRASH

1.1 INTRODUCTION Separation of an engine from a 747-200 cargo aircraft resulted in a catastrophic aircraft accident near Amsterdam. The engine separated, together with its pylon owing to fatigue and fracture of components connecting the pylon to the wing. These components were high strength steel lugs and two "fuse pins". One fuse pin was not recovered, but the other one and the lugs were investigated to find the most probable cause and sequence of damage leading to separation. The #3 engine and pylon separated from the right wing in an outboard and rearward direction. The #3 engine hit the #4 engine, causing this engine and its pylon also to separate from the wing. During engine separation the right wing leading edge was extensively damaged. This damage, together with loss of the engines, made control of the aircraft extremely difficult and aircraft became uncontrollable and crashed into an apartment block in a suburb 13 km east of Schiphol. 1.2 INVESTIATION Fig 1.1 is a schematic of the engine pylon-to-wing connections. The design incorporates six "fuse pins" which are less strong than other parts of the connections. If extreme loads occur on an engine and pylon, the fuse pins made from 4330M, a high strength low alloy steel, are supposed to shear off and allow a clean separation from the wing, thereby precluding damage to the wing and possible rupture of the wing fuel tank.

Fig: 1.1 Pylon-to-wing connections However, as found in the present case, and at least one other, engine and pylon separation was accompanied by severe damage to the wing leading edge. Macroscopic inspection of the components indicated that the upper link and diagonal brace had broken away owing to overload as the # 3 engine and pylon separated in an outboard direction. Fig: 1.2 shows the mid-spar pylon fittings. Each has two lugs that had been connected via fuse pins to two male lugs on each mid-spar wing fitting. The lugs on the outboard pylon fitting were unbroken but had witness marks indicative of scraping, as did the base of the throat between the lugs. However, the outer lug of the inboard pylon fitting was broken.

Detailed examination by the NLR showed that this lug had failed by a combination of tensile and bending overload. From these results two main conclusions were drawn: The missing inboard mid-spar fuse pin must have failed such that the outer lug of the inboard mid-spar pylon fitting took the entire load at this connection. Only thus is it possible to explain overload failure of the lug by tension and bending During failure of the inboard mid-spar connection the male lugs of the wing fitting moved outward from the throat of the lugs on the pylon fitting. On the other hand, failure of the outboard mid-spar connection resulted in the male lugs of the wing fitting moving into the throat of the lugs on the pylon fitting, thereby producing witness marks.

(a): Inboard

(b): outboard

(c): failed fuse pin

Fig 1.2: The lugs of the mid-spar pylon fittings. Fig: 1.2(c) gives two macroscopic views of the outboard fracture surface of the fuse pin. The partially separated sliver in figure contains a fatigue crack originally parallel to the coarse machining grooves on the inside wall of the fuse pin. Fig: 1.2(c) is a detail of the fatigue crack, which initiated at multiple origins along one or more machining grooves and progressed to at least half the wall thickness before overload. The stresses causing fatigue crack initiation were due to fuse pin bending. Fig: 1.3 shows the most probable sequence of events

Fig: 1.3 Sequence of failure 1.3. REMEDIAL ACTIONS Boeing instituted several remedial actions for the pylon-to-wing connections, some of which are shown in figure 8. These actions were:

A new design fuse pin made from corrosion resistant stainless steel and without thinwalled locations, compare Fig 1.4(a) and (b). This type of pin has a much improved resistance to fatigue.

(a): Old design (b): New design Fig 1.4: Fuse pin Two extra connections between the mid-spar pylon fittings. Larger mid-spar pylon fittings and stronger diagonal brace and upper link. These remedial actions are to prevent an engine and pylon separating from the wing under extreme loads in flight, i.e. the concept of clean separation during flight has been abandoned.

CASE STUDY: 2 CRASH LANDING AT SIUONX CITY

2.1 INTRODUCTION Date: July 19, 1989 Type: Uncontained engine failure, complete loss of flight controls Site: Sioux City. United States Passengers 285 Crew: 11. Injuries: 174. Fatalities: 112. Survivors: 184 Aircraft type McDonnell Douglas DC-10-10. Flight origin: Stapleton International Destination: Philadelphia International Airport 2.2 INVESTIGATION 2.2.1 ACCIDENT SEQUENCE The Safety Board determined that the accident sequence was initiated by a catastrophic separation of the stage 1 fan disk from the No. 2 engine during cruise flight. The separation, fragmentation, and forceful discharge of uncontained stage 1 fan rotor assembly parts from the No. 2 engine led to the loss of the three hydraulic systems shown in fig 2.1 (a) and (b) that powered the airplane's flight controls. The flight crew experienced severe difficulties controlling the airplane and used differential power from the remaining two engines for partial control. The airplane subsequently crashed during an attempted emergency landing at Sioux Gateway Airport. Upon ground contact, the airplane broke apart and portions of it were consumed by fire.

(b) Damage caused by fractured disc Fig 2.1 2.2.2 ANALYSIS OF FAN DISK FRACTURE Examination of the fracture surfaces of the fan disk disclosed that the near-radial, bore-to-rim fracture was the primary fracture. The fracture initiated from a fatigue region on the inside diameter of the bore. The remaining portions of the disk fractures were typical of overstress separations resulting from the fatigue failure. Because of the geometry of the fan disk and the load paths within the disk, the near-radial fracture created a bending moment in the disk arm and web that overstressed the disk, leading to rupture and release of a segment

(a) Three hydraulic system of aircraft

2.3 RECOMMENDATION Intensify research in the nondestructive inspection field. Use of fuse to stop excess amount of hydraulic fluid from ruptured parts CASE STUDY: 3 CUTTING EDGE: 3.1 INTRODUCTIION Date: January 31, 2000. Type: Mechanical failure, maintenance error Site: Pacific Ocean near Anacapa Island, California Passengers: 83 Crew: 5 Fatalities: 88 (all) Aircraft type: McDonnell Douglas MD-83 Flight origin: Lic. Gustavo Daz Ordaz International Airport Destination: Seattle-Tacoma International Airport 3.2INVESTIGATION A McDonnell Douglas MD-83, which crashed into the Pacific Ocean about 2.7 miles north of Anacapa Island, California Safety issues discussed in this report include lubrication and inspection of the jackscrew assembly, extension of lubrication and end play check intervals, jackscrew assembly overhaul procedures, the design and certification of the MD-80 horizontal stabilizer trim control system. As the jackscrew rotates it moves up or down through the (fixed) acme nut. This up and down motion moves the horizontal stabilizer for the trim system. The jackscrew was

found with metallic filaments wrapped around it; these were later determined to be remnants of the threads from the acme nut.

(a) Lead screw Fig : 3.1

(b) Acme nut

(a) Schematic diagram of screw jack for horizontal stabilizer Fig no 3.2

(b) Mechanism of screw jack for horizontal stabilizer

Later analysis estimated that 90% of the threads in the acme nut had been previously worn away, and that they were then completely sheared off during the accident flight. Once the threads failed, the horizontal stabilizer assembly was then subject to aerodynamic forces that it could not withstand, and ultimately failed. Based on the time since the last inspection of the jackscrew assembly, the NTSB determined that the wear had occurred at a much faster than average rate (0.012 inch per 1,000 flight hours, when the expected wear was 0.001 inch per 1,000 flight hours). The NTSB considered a number of potential reasons for this excessive wear, including the substitution by Alaska Airlines of Aeroshell 33 grease instead of the previously approved lubricant, Mobilgrease 28. The use of Aeroshell 33 was found not to be a factor in this accident. Insufficient lubrication of the components was also considered as a reason for the wear. Examination of the jackscrew and acme nut revealed that no

effective lubrication was present on these components at the time of the accident. Ultimately the lack of lubrication, and resulting excessive wear of the threads, was determined to be the direct causes of the accident. 3.3 RECOMMENDATIONS In the event of an inoperative or malfunctioning flight control system, if the airplane is controllable they should complete only the applicable checklist procedures and should not attempt any corrective actions beyond those specified. Identify means to eliminate the catastrophic effects of that single-point failure mode and, if practicable, require that such fail-safe mechanisms be incorporated in the design of all existing and future airplanes that are equipped with such horizontal stabilizer trim systems Proper lubrication system should be design for screw jack

CASE STUDY: 4 HANGING BY THREAD

4.1 INTRODUTION Date: April 28, 1988. Type: Explosive decompression caused by fatigue failure. Site: Kahului, Hawaii. Passengers: 90. Crew: 5. Injuries: 65. Survivors: 94. Aircraft type: Boeing 737-297. Operator: Aloha Airlines. Flight origin: Hilo International Airport. Destination: Honolulu International Airport. 4.2 INVESTIGATION Around 13:48, as the aircraft reached its normal flight altitude of 24,000 feet (7,300 m) about 23 nautical miles (43 km) south-southeast of Kahului, a small section on the left side of the roof ruptured. The resulting explosive decompression tore off a large section of the roof shown in fig 4.1 (a) and (b), consisting of the entire top half of the aircraft skin extending from just behind the cockpit to the fore-wing area.

Fig 4.1 (a)

Fig 4.1 (b)

As part of the design of the 737, stress may be alleviated by controlled area breakaway zones. The intent was to provide controlled depressurization that would maintain the integrity of the fuselage structure. The age of the plane and the condition of the fuselage (that had corroded and was stressing the rivets beyond their designed capacity) appear to have conspired to render the design a part of the problem; when that first controlled area broke away, according to the small rupture theory as shown in fig 4.2 (a) and (b), the rapid sequence of events resulted in the failure sequence. This has been referred to as a zipper effect.

(a) Basic construction of roof

(b) Small rupture theory Fig 4.2

(c) Fatigue crack near rivet

Investigation by the United States National Transportation Safety Board (NTSB) concluded that the accident was caused by metal fatigue exacerbated by crevice corrosion causing fatigue cracks around riveted area as shown in fig 4.2(c) (the plane operated in a coastal environment, with exposure to salt and humidity).The root cause of the problem was failure of an epoxy adhesive used to bond the aluminum sheets of the fuselage together when the B737 was manufactured. Water was able enter the gap where the epoxy failed to bond the two surfaces together properly, and started the corrosion process. The age of the aircraft became a key issue (it was 19 years old at the time of the accident and had sustained a remarkable number of takeoff-landing cycles of 89,090, the second most cycles for a plane in the world at the time of well beyond the 75,000 trips it was designed to sustain) 4.3 RECOMMENDATION Discontinue classification of fuselage skin as "malfunction evident" or "damage obvious" on supplemental structural inspection documents. In addition, review all the remaining structurally significant items in the damage obvious category for possible inclusion in the Supplementary Inspection Program. Initiate a corrosion prevention and control program designed to afford maximum protection from the effects of harsh operating environments

CASE STUDY: 5 OUT OF CONTROL

5.1 INTRODUCTION Date: 12 August 1985 Type: Explosive decompression due to Maintenance Error Site: Mount Osutaka. Passengers: 509 Crew: 15

Fatalities 520 Aircraft type: Boeing 747-SR46 Flight origin Tokyo International Airport Destination Osaka International Airport

5.2 INVESTIGATION The official cause of the crash according to the report published by Japan's then Aircraft Accidents Investigation Commission is as follows: The aircraft was involved in a tail strike incident at Osaka International Airport on 2 June 1978, which damaged the aircraft's rear pressure bulkhead shown in fig 5.1

The subsequent repair of the bulkhead did not conform to Boeing's approved repair methods. The Boeing technicians fixing the aircraft used two separate doubler plates, one with two rows of rivets and one with only one row as shown in fig 5.1 (a) and (b), while their procedure calls for one continuous doubler plate with three rows of rivets to reinforce the damaged bulkhead. This reduced the part's resistance to metal fatigue by 70%. According to the FAA, the one "doubler plate" which was specified for the job (the FAA calls it a "splice plate" - essentially a patch) was cut into two pieces parallel to the stress crack it was intended to reinforce, "to make it fit".[14] This negated the effectiveness of two of the rows of rivets. During the investigation Boeing calculated that this incorrect installation would fail after approximately 10,000 pressurizations; the aircraft accomplished 12,318 take-offs between the installation of the new plate and the final accident.

(a) Two row riveting

(b) One row riveting Fig 5.2

(c) failure due to single row riveting

When the bulkhead gave way, the resulting explosive decompression ruptured the lines of all four hydraulic systems. With the aircraft's flight controls disabled, the aircraft became uncontrollable.

CASE STUDY 6: CHINA AIRLINES FLIGHT 611

6.1 INRODCTION Date: 25 May 2002 Type: Flight structural failure (Metal fatigue), Explosive decompression, Maintenance error. Site: Taiwan Strait (37 km northeast of Makung, Penghu Islands). Passengers: 207 Crew: 18. Fatalities 225 (all) Aircraft type: Boeing 747-209B Operator China Airlines Flight origin: Chiang Kai-shek International Airport. Destination: Hong Kong International Airport 6.2 INVESTIGATION Searchers recovered 15% of the wreckage, including part of the cockpit, and found no signs of burns, explosives or gunshots. There was no distress signal or communication sent out prior to the crash. Radar data suggests that the aircraft broke into four pieces while at FL350. This theory is supported by the fact that articles that would have been found inside the aircraft were found up to 80 miles (130 km) from the crash site in villages in central Taiwan. The flight data recorder from Flight 611 shows that the plane began gaining altitude at a significantly faster rate in the 27 seconds before the plane broke apart, although the extra gain in altitude was well within the plane's design limits. 6.2.1 Metal Fatigue The final investigation report found that the accident was the result of metal fatigue as shown in fig 6.1(a) caused by inadequate maintenance after a previous incident. The report finds
that on 7 February 1980, the accident aircraft suffered damage from a tail strike accident while landing in Hong Kong. The aircraft was then ferried back to Taiwan on the same day de-pressurized, and a temporary repair done the day after. A permanent repair was conducted by a team from China Airlines from 23 May through 26 May 1980. However, the permanent repair of the tail strike was not carried out in accordance with the Boeing SRM (Structural Repair Manual). The area of damaged skin was not removed (trimmed) and the repair doubler which was supposed to cover in excess of 30% of the damaged area did not extend beyond the entire damaged area enough to restore the overall structural strength. Consequently, after repeated cycles of depressurization and pressurization during flight, the weakened hull gradually started to crack and finally broke open in mid-flight on 25 May 2002, exactly 22 years to the day after the faulty repair was made upon the damaged tail. An explosive decompression of the aircraft occurred once the crack opened up, causing the complete disintegration of the aircraft in mid-air as shown in fig 6.1(b).

Fig 6.1(a)

Fig 6.1(b)

One piece of evidence of the metal fatigue is contained in pictures that were taken during an inspection of the plane years before the disaster. In the pictures, there are visible brown stains of nicotine around the doubler plate. This nicotine was deposited by smoke from the cigarettes of people who were smoking about seven years before the disaster (smoking was allowed in a pressurized plane at that time). The doubler plate had a brown nicotine stain all the way around it that could have been detected visually by any of the engineers when they inspected the plane. The stain would have suggested that there might be a crack caused by metal fatigue behind the doubler plate, as the nicotine slowly seeped out due to pressure that built up when the plane reached its cruising altitude. The stains were apparently not noticed and no correction was made to the doubler plate, which eventually caused the plane to disintegrate in mid air. 6.3 RECOMMENDATION Aviation industries around the world immediately inspect the scratch on aircraft pressure vessel, especially if covered under doubler plate as it could have hidden damage that might develop into fatigue crack.

CASE STUDY 7: DERAILMENT AT ESCHEDA

7.1 INTRODUCTION Date: 3 June 1998. Time: 10:59. Location: Eschede, Germany. Operator: Deutsche Bahn AG. Type of incident: Derailment. Passengers: 287. Deaths: 101. Injuries: 88. 7.2 INVESTIGATION 7.2.1 Chronology of Events Wheel fracture

Six kilometres south of central Eschede, near Celle, the steel tire on a wheel on the third axle of the first car broke, peeled away from the wheel, and punctured the floor of the car, where it remained embedded as shown in fig 7.1 (a) Derailment As the train passed over the first of two track switches, the embedded tire slammed against the guide rail of the switch, pulling it from the railway ties. This steering rail also penetrated the floor of the car, becoming embedded in the vehicle and lifting the axle carriage off the rails. At 10:59 local time, one of the now-derailed wheels struck the points lever of the second switch, changing its setting. The rear axles of car number 3 were switched onto a parallel track, and the entire car was thereby thrown away from track. Car number 4, likewise derailed by the violent deviation of car number 3. Bridge collapse Coaches one and two cleared the bridge. Coach three hit the bridge, which began to collapse. Coach four cleared the bridge, moved away from the track, and hit a group of trees. Fig 7.1 (b)

Fig 7.1 (a)

Fig 7.2(b)

7.2.2 CAUSES 7.2.2.1 WHEEL DESIGN The ICE 1 trains were equipped with single-cast wheels, known as monoblock wheels. Once in service it soon became apparent that this design could, as a result of metal fatigue and out-of-round conditions, lead to resonance and vibration at cruising speed In response, engineers decided that to solve the problem: the suspension of ICE cars could be improved with the use of a rubber damping ring between the tire and the wheel body as shown in fig7.1 (a) and (b) This new wheel, dubbed a "wheel-tire" design, consisted of a wheel body surrounded by a 20 mm thick rubber damper and then a relatively thin metal tire. The following factors, overlooked during design, were noted: 1. The tires were flattened into an ellipse as the wheel turned through each revolution (approximately 500,000 times during a typical day in service on an ICE train), with corresponding fatigue effects. 2. In contrast to the monoblock wheel design, cracks could also form on the inside of the tire. 3. As the tire became thinner due to wear, the dynamic forces were exaggerated, resulting in crack growth.

4. Flat spots and ridges or swells in the tire dramatically increased the dynamic forces on the assembly and greatly accelerated wear

. Fig 7.2 (a) Fig 7.2 (b)

7.2.2.2 MAINTENANCE Investigators discovered via a maintenance report generated by the train's on-board computer that, two months prior to the Eschede disaster, conductors and other train staff filed eight separate complaints about the noises and vibrations generated from the bogie with the defective wheel; the company did not replace the wheel. Deutsche Bahn said that its inspections were proper at the time and that the engineers could not have predicted the wheel fracture.

7.3 REMEDIES Within weeks, all wheels of similar design were replaced with monoblock wheels. The entire German railway network was checked for similar arrangements of switches close to possible obstacles. Rescue workers at the crash site experienced considerable difficulties in cutting their way through the train to gain access to the victims. Both the aluminum framework and the pressure-proof windows offered unexpected resistance to heavy rescue equipment. As a result, all trains were refitted with windows that have predetermined breaking points.

REFERENCES
http://www.ntsb.gov/ http://www.nationalgeographic.com/ http://web.archive.org/web/20080626181929/http://verkeerenwaterstaat.nl/kennisplei n/uploaded/MIN/2005-07/39448/ElAl_flight_1862.pdf http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR9006.pdf http://en.wikipedia.org/wiki/The_Cutting_Edge http://www.airdisaster.com/reports/ntsb/AAR89-03.pdf http://www.mlit.go.jp/jtsb/eng-air_report/JA8119.pdf