Chapter 2
Learning from history (PDF – 170 kB)
2. LEARNING FROM HISTORY
About ignorance
Ignoring fatigue
Ignoring fracture mechanics
Ignoring ageing
Ignoring record tire busting
Ignoring impact performance
In the blink of an eye
Ignoring no more
First warning signs with composites in aircraft
American Airlines flight 587
Air Transat flight 961
Federal Express Memphis
- Airbus rudder control rod
EASE mandatory directive
With aluminium aircraft the present safety record has been gradually accomplished through experience over a period of some seventy-five years, among them many accidents – a number with fatal consequences. Accidents in aviation can have different causes and include human error, terrorism, weather, structural failure, maintenance and repair to name the most important. Exhaustive investigations of such accidents have led to new discoveries and new insights and resulted in new design approaches. Structural failure – the focus of this study – can occur for many reasons, including uncertainties about loading and environmental conditions, wrong choice of materials, design faults, defects in materials, manufacturing flaws, impact damage, lighting strike, fire, insufficient inspection, poor maintenance and inadequate repair. Total ignorance of warning signs that clearly indicated that safety was at risk led to accidents of the Comet, the Concorde and the Columbia. Learning from history, these accidents will be discussed here in brief – for more in depth discussion reference is made to the appendices.
With the Comet, Concorde and Columbia the aim was the desire to fly faster but this can only be accomplished by flying also higher – in case of Space Shuttle this was the principal objective. The aims were achieved – records were broken – but ended all in catastrophe essentially caused by material failure. Indeed, lessons have been learned. But it is too easy to front the issue with that it was the price that had to be paid to make progress – for entering areas of the aviation that had not been explored before. Passengers, in general, do not want to boldly go where nobody has gone before. They leave that to the crew of the Enterprise. Passengers must be sure that they can trust the aircraft, trust the airline, trust the crew and trust the mechanics involved with maintenance and inspection – astronauts should be able to trust NASA. It is therefore shocking to find out that with each of these accidents catastrophe could have been easily avoided and happened because of grove neglect – warning signs that safety was at risk were ignored – in case of the Comet for too long and with Concorde and the Columbia for a very long time.
Ignoring fatigue
With the Comet jet propulsion was introduced in civil aviation in 1952. The aircraft was an instant commercial success and deHavilland – the manufacturer of the aircraft – dreamed of selling a thousand aircraft. For the first time civil aircraft were to fly at 490 mhp / ~800 kmh at 30,000 ft / 10,000 m. Necessary pressurization of the fuselage at this altitude means that the structure had to withstand much greater cyclic pressure differentials and much larger temperature changes. But somehow the engineers underestimated the possible effects of fatigue – known at that time 36) – and deemed the double margins put in place enough to guarantee safety 27), based on no physical evidence whatsoever. Management – sales driven – can be blamed for being too ambiguous pushing forward unrealistic delivery times that put far too much pressure on the engineers during development The construction of the square windows – bigger than at any airplane before -led eventually to disaster; actually the construction was simplified because of tooling problems. When a third plane crashed – January 1954 – the fleet was grounded. Autopsy of the bodies that were recovered showed a distinct pattern of injuries of fractured skulls and ruptured lungs – the latter a sure indicator of sudden cabin depressurization. But this was ignored and service was resumed already in March. Within two weeks the plane crashed again. Again the fleet was grounded – this time indefinitely – and the Comet would not fly again until 1958, completely redesigned. Three weeks later the 707 entered service – provided with much smaller rounded windows – and this plane sold more than 1000 when production stopped in 1991. The Comet became never the commercial success hoped for – only 79 entered service. Appendix Comet provides a more in depth discussion of the accident.
Ignoring fracture mechanics
With the F111 – developed in the 1960’s – every effort was made to avoid what happened to the Comet and certification involved rigorous full-scale fatigue testing. Again, it went wrong – again fatigue at the root of problems. Several aircraft were lost before the engineers discovered that relative small manufacturing flaws had escaped detection with the inspection and testing methods that were in place at that time 28). Involved were high strength steel alloys that were applied for critical primary parts for the first time and behaved apparently different from normal steel. Not known at that time is that with metals both the percentage level at which cracks start to grow and the rate at which cracks grow increases with the strength of the alloy. This significantly limits the window of opportunity for inspection to discover such crack initiation and crack growth – actually in a way similar to composites that behave in this respect likewise high strength steel 29). The experience with the F111 led eventually to the application of fracture mechanics and later to the adaptation of damage tolerance philosophy in aviation.
Ignoring ageing
That fatigue is still a serious problem with aircraft showed the accident with an ageing Boeing 737 of Aloha Airlines when flight 234 lost a large part of the forward upper fuselage in 1988 but landed safely, with the unfortunate loss of one life. The aircraft was 19 years old and had sustained 89,090 takeoff-landing cycles, far beyond the 75,000 trips it was designed to sustain. The structure, that had stress corrosion damage, was deemed safe because crack stopper band (tear strips) had been applied in squares at the frame section. These were supposed to contain crack propagation within safe limits – but apparently not safe enough. With this accident engineers discovered that fatigue cracking can develop simultaneously at multiple locations – so-called ‘multi-site damage’ or ‘widespread fatigue damage’ – to link up to form a large crack that could not be contained by the tear strips and led to the accident, a phenomena not known at the time 30) but nowadays a basic design tool.
Ignoring record tire busting
The Concorde accident in 2000 was caused by something weird as a busted tire that could not withstand the structural limit – probably not even half of it – and this was ignored by Air France and British Airways – and the pilots – although the plane experienced an unprecedented record of busted tires and impacts over a very long period of time 31) – at one occasion in 1979 two tires busted simultaneously which caused a large hole right through the wing. With the 2000 accident a rubber tire part slammed the wing underneath the fuel tank and it is assumed that this generated a hydrodynamic pressure surge – shock wave – in the fuel that blew up the tank. After the accident stronger tires were developed by Dunlop and several other weak structures were discovered during the investigation, amongst others, the fuel tanks that were now provided with Kevlar lining. Whether these measures were sufficient to avoid further catastrophe will never be known. Concorde made its last emotional retirement flight in 2003, the same year the Space Shuttle Columbia broke up during re-entry. Appendix Concorde provides a more in depth discussion of the accident.
Ignoring impact performance
January 16th 2002, Columbia flight FT-107 took off for its 28th mission – 81.9 seconds after launch, a large piece of insulation foam broke away from the External Tank and struck the left wing. This damaged a Carbon-Carbon panel that protects the wing edge. During re-entry on the 1st of February, superheated air entered the wing, which led to total destruction of Columbia.
The investigation of the Columbia Accident Investigation Board 32) revealed that NASA – the by far biggest scientific organization in the world with a budget beyond imagination at that time – had paid no attention whatsoever to the impact behaviour of the heat shield materials, before the accident happened in 2003. The ceramic tiles and carbon-carbon edges were not tested for impact response – although the vulnerability of these materials was well known but somehow ignored. Actually the engineers knew beforehand that such damage would occur and could not be avoided. Damage to the heat shield materials occurred during every flight, often severe, but became soon a maintenance – ‘turnaround’ – issue. Only in 1999, when the composition of the foam was changed for environmental reasons and damage increased, NASA tested some tiles for foam impact in what in hindsight appeared to have been ‘a rudimentary program’ 33) that was not even finished. The reason was – bizarre at it may sound – that no proper test method was available at the time to test impact performance at high velocity. Going back to the original foam was not considered – did they really believe that the CFC’s – chlorofluorocarbons – used in the foam posed an environmental issue.
In the blink of an eye
After the accident a block of foam was shot at a carbon carbon panel with a pressure gun – for the first time, 22 years after the first Space shuttle, ironically also the Columbia, was launched and experienced first damage. To the total surprise of many this test confirmed that such impact produces indeed enough impact power to break up the panel. ‘I don’t think anyone expected to see a 16-inch square hole’, one of the engineers reported later, ‘In the blink of an eye, there it was, and hundreds of people immediately came to terms with how much damage a piece of foam can do’ 34)
The pressure gun has severe limitations, but a universal method to study impact performance is not available yet. This poses a serious safety concern to all-composite aircraft that are far more vulnerable to impact than aluminium aircraft – but this cannot be tested in proper way. A simple method for testing impact performance at velocities ranging from 10 to 1000 m/s has been proposed 35). Appendix Columbia provides a more in depth discussion of the accident.
Ignoring no more – please
The accidents of the Comet, the Concorde and the Columbia provide important lessons for the development of future aircraft – all composite aircraft in particular. For the engineers at that time flying faster and higher meant entering new and at least partly unknown territory. New technology had to be developed and to achieve these goals this technology had at once to be stretched to its ultimate limits – but with each case engineers went beyond that limit in that performance of certain materials failed beyond expectations. Material behaviour was underestimated or not understood. This led engineers to design and operate constructions that could not withstand the physical forces. A similar scenario seems to unfold with all composite aircraft. Engineers are well aware of composites’ poor damage tolerance but somehow that’s again largely ignored, as will be discussed later.
First warning signs with composites in aircraft
The Comet accidents during the 1950’s learned, in dramatic way, how stress concentrations and fatigue in metals can lead to failure and Aloha flight 234 provided a valuable lesson about metal ageing in 1988 37). Engineers are now also gaining experience with fatigue behaviour of composites applied for primary applications in aircraft – they soon found out that again technology had been stretched beyond its ultimate limits.
American Airlines flight 587.
November 12th, 2001 an Airbus A300-600 of American Airlines – flight 587 – lost its composite vertical stabilizer, shortly after take-off and crashed in the New York borough of Queens, killing all 260 people on board and 5 on the ground 38). In a most controversial ruling – rudder risk was cited by an American Airlines manager years before the crash 39) – the accident was officially blamed ‘to pilot’s excessive rudder pedal input that led to the crash’ or ‘aggressively swinging the rudder by the pilot’. But that is still being questioned. It was, however, also ruled that ‘Airbus rudder system design and elements of airlines pilot training program contributed to the accident’. From the investigation it appears that the first pilot did indeed apply maximum pressure, rapidly and repeatedly swinging the rudder to the left and the right. It is assumed that it was unknown to the crew that the A300 has not been designed for this load case. The structure fulfilled its duty because the vertical tail has been loaded above ultimate, i.e. outside the certified load envelope, but it might be speculated how a structure out of aluminium reinforced composite would have behaved.
Critics argue that even when the pilots had known that they were not to allow maximum pressure for too long, the aircraft was at the moment of the accident sufficiently below the speed at which max deflection, intentional or otherwise, should not cause damage the structure.
Composites fail in more brittle way, totally different from aluminium that behaves ductile. The investigators had no previous knowledge or experience with composite crash behaviour and were confronted with fibre failure, resin cracking, debonding, delamination, fibre pull out and fibre kinking – failure modes all new to them. It can therefore not be excluded that the rudders were somehow damaged prior to the accident, or just not strong enough because of a design flaw or a structural anomaly, which led to reduction of mechanical resistance – as the following accidents illustrate.
Air Transat flight 961
March 6th, 2005 an Airbus A310-300 operated by Air Transat carrying 270 passengers and crew on flight 961, was cruising above the Florida Keys when at an altitude of 35,000 feet a loud bang occurred followed by vibrations that lasted a few seconds 40). The pilots decided to return to Cuba, where it landed uneventfully. Upon landing, the pilots discovered that most of the aeroplane’s rudder had separated in flight – only the bottom closing rib and the spar between the rib and the hydraulic actuators were still there. Further examination of the vertical stabilizer determined that its two rearmost attachment lugs were damaged due to the high stresses associated with the rudder failure and separation.
Federal Express Memphis
November 27th 2005, in a hangar in Memphis, Tennessee, engineers were carrying out routine maintenance on a Federal Express A300-600, and accidentally bashed its sandwich composite rudder 41). To assess the extent of the damage, the engineers removed the lower rudder rib to be able to examine the rudder. The damage they found was far beyond what a bouncing hammer could have caused – substantial debonding had developed between the inner skin of the composite rudder surface and the honeycomb core. Tap test inspection determined the size of the debonding area to be approximately 838 mm (33 inches) by 355 mm (14 inches), or about 0.3 square meter (3 square feet). Further examination revealed traces of hydraulic fluid. It was concluded that leaked hydraulic fluid had contaminated the rudder between the honeycomb core and the fibreglass composite skin. This had led to progressive debonding that weakened the strength of the rudder. Further tests on the damaged rudder revealed that a rapid propagation of the debonding damage would have occurred during a next flight – and could have led to disaster.
The National Transportation Safety Board was very concerned about this accident and concluded amongst others that ‘The rate of growth of existing damage in the presence of this hydraulic fluid contamination is uncertain and currently unpredictable’, and ‘the resulting safety risks associated with the potential loss of the rudder or vertical stabilizer are severe’ 41) and recommended much more strict inspection procedures than Airbus had already imposed after the accident.
- Airbus rudder control rod
The 13th of September 2007 FAA – and several other agencies worldwide – published an Airworthiness
Directive 406) that included the following statement
‘One A320 operator has reported a disbond on the composite rudder control rod. Investigations conducted by the supplier revealed that this disbond is due to an incorrect low volume of resin in the fibre composite. The supplier and AIRBUS have confirmed that some rudder control rods installed on A330 and A340-200/-300 aircraft before delivery or delivered as spare are also affected by this defect. Rudder control rod rupture can lead, in the worst case, in combination with a yaw damper runaway to an unsafe condition.
In order to prevent such situation, this airworthiness Directive (AD) requires a one time detailed visual inspection to identify the affected rods and to replace those affected by this issue.
The unsafe condition is reduced control of the airplane.’
This is probably more of a routine issue but illustrates that quality control can go wrong with composites during manufacturing.
EASE mandatory directive
Note that the rudders involved with these accidents are composite sandwiched panel constructions that consist out of two layers of fibre glass composite with a thick foam material layer – honeycombed core – sandwiched in between. Analysis of the failures did produce valuable information but all composite aircraft are not out of relative thick sandwiched glass fibre composites but out of thin laminated carbon fibre composites that behave rather differently.
These accidents were further investigated and December 2007 the European Aviation Safety Agency (EASA) ordered extensive testing on a continuous base of the rudders of Airbus A300/310 series due to safety concerns. A stepped up inspection program was already recommend by Airbus, but this mandatory directive went much further. It calls for ‘first enhanced rudder checks to be completed within six months or 500 flights, some inspections on certain planes must be repeated every 1,400 flights’ 42). This is a relatively short compliance schedule for checking structural integrity of primary flight structures. The enhanced inspections include ultrasound, X-rays and other no-destructive testing techniques, breaking radically away from the visual inspection and manually tapping that were regarded adequate until then. About 400 A300s and A310s aircraft are covered by the added inspections, along with 20 wide-body Airbus A330 and A340 jetliners.
As for the maintenance programme of the 787 – approved by FAA December 2008 – it will be interesting to see how this relates to the EASE mandatory directive – to be found somewhere in ‘The 787 Maintenance Review Board Report [that] is a result of the most comprehensive maintenance program development effort in the history of the industry…..it is supported by more than 33,000 pages of supporting analysis, as well as the participation of eight regulatory agencies, 25 airlines and 30 suppliers and partners’ 43).
and designed by 