Click for next page ( 88


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 87
Appendix B Excerpts From Official Accident Reports This section contains excerpts from official reports of two accidents involving jet transport aircraft that illustrate deficiencies in design, manufacturing, main- tenance, or service. They are: -Dan-Air Services, Ltd., Boeing 707-321C, G-BEBP near Lusaka, Zambia, May 14, 1977 (Aircraft Accident Report 9/78, Department of Trade, Accidents Investigation Branch, London); and American Airlines, Inc., McDonnell-Douglas DC-10-10, N 110Ah, Chicago O'Hare International Airport, Illinois, May 25, 1979 (NTSB AAR-79-17) DAN-AIR SERVICES, LTD., BOEING 707-321 C, MAY 14, 1977 The aircraft was engaged on a nonscheduled interna- tional cargo flight, on behalf of International Aviation Services for Zambian Airlines, from London Heathrow to Lusaka International Airport, with intermediate stops at Athens and Nairobi, where there was a crew change. The flight from London to Nairobi was without incident and only minor aircraft unserviceabilities were recorded en route. The aircraft took off from Nairobi for Lusaka at 7:17 a.m. with a fresh crew on board comprising a com- mander, copilot, two flight engineers (one under train- ing), and a loadmaster.- In addition, there was one pas- senger on board, a ground service engineer whose duty was to supervise ground handling during transit stops. The flight proceeded normally and apparently without incident at cruise altitude. At 9:07 a.m., the copilot 87

OCR for page 87
IMPROVING AI RCRAFT SAFETY/8 8 contacted Lusaka Approach on radio and the aircraft was cleared to descend. At 9:23 a.m. the copilot reported that the aircraft was leveling at 11,000 feet, 37 nauti- cal miles from Lusaka. The aircraft was then cleared by Lusaka Approach to a lower altitude following behind another aircraft also bound for Lusaka International Airport. The copilot reported that the airfield was in sight. Lusaka then cleared the aircraft to descend to an alti- tude of 6,000 feet (2,221 feet above touchdown eleva- tion). A minute later, the copilot reported that the aircraft was turning downwind with the preceding aircraft in sight ahead. The Lusaka approach controller then gave the aircraft a clearance to make a visual approach to runway 10 and to report leaving 6,000 feet. At 9:32 a.m. the copilot contacted the tower controller and reported that the aircraft was turning on base leg with an air- craft in sight on the runway. The tower controller then cleared the aircraft to land. The copilot replied "Roger"; this the aircraft. A readout of the Cockpit Voice Recorder (CVR) indi- cated that 50 degree flap was selected at 9:32 a.m. and that the landing checks were completed by 9:33 a.m. Six seconds later' a loud N break-up" noise was recorded. The record terminated five seconds after the fact. Eyewitnesses on the ground observed that the aircraft had established what appeared to be a normal approach to runway 10 at Lusaka International Airport. They saw a large portion of aircraft structure separate in flight. The aircraft then pitched rapidly nose down and dived vertically into the ground from a height of about 800 feet and caught fire. The accident was observed from the airfield: the fire and rescue services responded rapidly and were quickly at the scene of the accident. When the fire was under control, it became apparent that the degree of dam- age to the cockpit structure was such that no one could have survived the impact forces. In fact, all six occu- pants were killed. There were no casualties to persons on the ground. The complete right-hand horizontal stabilizer and elevator assembly was found some 200 yards back along the flight path, indicative of having become detached in flight prior to the final nose down pitch maneuver. was the last transmission received from

OCR for page 87
89/Appendix B Aircraft #G-BEBP was the first aircraft off the 707-300C series convertible passenger/freighter produc- tion line. Since manufacture, it had been operated in the passenger-carrying role registered as N765PA. After it was withdrawn from service in March 1976, it was put into storage in Florida. In June 1976, the aircraft was flown to the United Kingdom where it went through a mod- ification and overhaul program at the Dan-Air engineering facility prior to the issue of a U.S. Export Certificate of Airworthiness which was the basis for the issue of a U.K. Certificate of Airworthiness in the Transport cate- gory (passenger) on October 14, 1976. During service on the U.S. register, the aircraft had been maintained in accordance with an FAA-approved schedule and, subsequent to its transfer onto the British register, it had been maintained to a U.K. CAA-approved schedule. The records indicate that the aircraft had not been involved in any incidents which might have affected the aircraft's structure. It has been estab- lished that both the horizontal stabilizers on the air- craft at the time of the accident were those fitted at the time of manufacture. Both left and right horizontal stabilizers were removed and reinstalled by Dan-Air to provide access to the stabilizer center section and for minor refurbishment. Consideration was given to reports that the aircraft pitch trim was unusual in its response on the previous flight. No evidence was found that could be related to these reports, which referred to an unusually sensitive stabilizer trim brake. Such behavior could only be related to the stabilizer structural failure had there been stabilizer torsional deflections large enough to affect significantly the aircraft's flight character- istics. It is considered that such gross torsional deflections would have produced total failure at that time and the reported behavior is not therefore con- sidered relevant to the accident. Examination of the detached stabilizer revealed evi- dence of a fatigue failure of the top chord of the rear spar. The rear spar center chord, and lower chord, and the front spar root attachments had failed in overload because the stabilizer had bent downwards. There was evidence of a preexisting fracture of the rear spar upper web between the top chord (adjacent to the fracture), and the center chord, and in certain sections of the closure rib and associated structure.

OCR for page 87
IMPROVING AIRCRAFT SAFETY/9 0 The aircraft struck the ground with 50-degree tailing edge flap and leading edge flaps fully extended, with the landing gear down. Engine power could not be accurately assessed in the field but the damage to each unit indi- cated a low to moderate power setting. It was later established that the spoilers were retracted at impact. The stabilizer trim screw jack and associated cable drum were recovered from adjacent, but separate, areas of wreckage. Both units were found to be set at posi- tions consistent with a stabilizer setting of 6-1/4 units aircraft nose up. It was not possible to establish rudder and aileron trim settings although the cockpit rudder trim indicator was found at an approximately neutral setting. However, the impact attitude tended to rule out any significant directional or roll trim problems. All structures which became separated in the air, together with the left horizontal stabilizer, stabilizer center section, stabilizer jack screw and trim drum, and the power level console were transported to the United Kingdom for more detailed investigation. The detailed investigation of the wreckage was con- fined primarily to the stabilizer and rear fuselage structure to establish (i) the reason for and age of the fatigue failure and (ii) why the fail-safe structure in the rear spar had failed to carry the flight loads once the top chord had fractured as a result of fatigue. In order to check the accuracy of existing stabilizer flight-load data, which had been based on wind tunnel tests and on extrapolation of flight data obtained from earlier models of the 707 aircraft, the Boeing company conducted a flight test program on a suitably instru- mented 707-300 series aircraft during which horizontal stabilizer flight loads were recorded throughout the normal flight envelope. In general, the load values obtained approximated quite closely the predicted values. The maximum (normal operational) horizontal stabilizer down loads were experienced with the aircraft in the landing configuration with 50 degree wing flap extended and the landing gear down. In the normal landing config- uration, the flight tests indicated that the horizontal stabilizer bending moment during a simulation of the Lusaka approach was 75 percent of the value which caused the static test specimen to fail. Analysis shows that application of up elevator could increase this figure to about 120 percent of the test failure load.

OCR for page 87
91/Appendix B It was found that, during a normal landing roll, with spoilers deployed and using reverse thrust, the horizontal stabilizers were subjected to oscillating loads which peaked at a value of 80 percent of the maximum load on a typical flight. These oscillating loads, which were found to be caused by speed-brake deployment, were not accounted for during the initial fatigue analysis and explain the higher than expected crack growth rate on G-BEBP. Both the U.S. and U.K. regulations contain safe fatigue life or fail-safe design options. The Boeing 707 was designed to comply with the requirements of the fail-safe option. Neither the U.S. nor the British air- worthiness regulations specifically required fatigue testing. In both cases, the manufacturer was permitted to demonstrate compliance "by analysis and/or tests." Also, for the safe fatigue life case, it was acceptable that the service history of aircraft of similar design, taking into account differences in operating conditions and procedures, be used as a basis for fatigue life assessment. A review of the 707 fleet worldwide in June 1977 showed that 521 aircraft were then operating fitted with the 300 series horizontal stabilizer. A survey of post- accident inspections of these aircraft revealed that 38 of these aircraft (i.e., 7 percent of the fleet) were found to have horizontal stabilizer rear spar cracks of varying sizes. Four of these required spar replacement. The original Boeing 707-300 series stabilizer dif- fered from the 100 series design by having increased span and a redesigned rear spar of three chord construc- tion. The rear spar was redesigned because the fail- safe capability of the original structure with a top chord failure would not have been adequate to cope with the increased loads acting on the larger stabilizer. It was during the initial 300 series design phase that the assessment of fatigue sensitivity and fail-safe capa- bility was made for the purposes of certification. ~ ~A ~. . - , r accrue cescs on one earlier lUU Series StaOlilZerS had produced a crack in the top chord of the rear spar after a period representing some 240,000 flight cycles. The crack was caused by loads which were being fed into the chord by the trailing edge structure at a point where there was a change in chord geometry. There were no

OCR for page 87
IMPROVING AIRCRAFT SAFETY/92 indications of problems arising out of loads from the torsion box. The new 300 series spar chords were con- tinuous extrusions with integral terminal fittings and had no abrupt changes in section. sortable to conclude that, because the 100 and 300 series structures It was therefore rea- of the similarity of in the undamaged state, these spar chores would nave an Improved fatigue life over the original 100 series chords. The manufacturer appears to have taken this view and considered the rear spar safe in terms of fatigue in a normal service envi- ronment. However, the design was certificated on the basis that it was fail-safe, not as a result of fatigue tests. During the initial flight test program, a lack of stabilizer torsional stiffness became apparent. This shortcoming was cured by stiffening the top and bottom inner torsion box skins which, in the case of the top- skin, was achieved by a change in material from light alloy to stainless steel. This modification was made after the basic stress analysis work had been carried out. Because the stabilizer was certificated on static strength fail-safe capability, restressing was limited to that necessary to ensure that the static strength was not reduced by the modification. It was known that the greater stiffness of the stain- less steel skin would result in higher skin loadings, and hence higher fastener loads in the steel "hi-shear" fasteners toward the root end of the rear spar top chord. These higher fastener loads would also increase the bear- ing stress in the chord forward flange. However, given the existing chord flange design, there was little that could be done to improve this situation because the use of larger diameter fasteners to reduce the bearing stresses would have reduced the edge margin to an unac- ceptable level. (Boeing's current 1978 fatigue design practice is to use larger edge margins than were used on the 300 series.) However, it was considered that the design was adequate in this area, given the general acceptance at that time of its fail-safe capability. It was not realized that the skin modification, while improving the static strength, would significantly reduce the fatigue strength. This was the first of a chain of events which culminated in the accident to G-BEBP. It is considered that the design employed is evidence of a responsible approach on the part of the manufacturer

OCR for page 87
93/Appendix B . in attempting to cover, with additional margins of safety, the failure case which they considered to be the most critical, or the most likely to occur. However, the apparent lack of attention given to potential top chord failure cases outboard of the terminal fittings strongly suggests that the earlier work on the 100 series design influenced thinking on the 300 series design. While it might be considered reasonable to view the 707-100 and 300 series horizontal stabilizer structures as being broadly similar, this line of thought is only appropriate when the structures are completely undamaged. Subsequent to a top chord failure, the 300 series stabi- lizer structure behaves in a fundamentally different manner to that of the 100 series stabilizer. The failure to appreciate the influence which the top chord and upper web inboard of the fracture have on the local stress distribution was the principal factor in bringing about the final spar failure which resulted in the accident to G-BEBP. The U.K. Accident Investigation Branch summarized its findings as follows: The aircraft had been maintained to an approved maintenance schedule and its documentation was in order. The crew were properly licensed and adequately experienced to carry out the flight. Pitch control was lost following the in-flight separation of the right-hand stabilizer and elevator, which occurred shortly after the extension of 50-degree flap. The stabilizer variable incidence screw jack actuator fractured in the stabilizer separation sequence allowing the left-hand stabilizer to travel to the fully nose-up position under aero- dynamic loads, thereby increasing the aircraft rate of pitch, nose down. The right-hand stabilizer rear spar top chord had failed prior to the accident flight as a result of long-term fatigue damage. The fatigue crack had existed for about 7,200 flights, of which approximately 6,750 flights were made when the aircraft was on the U.S. register. Following the failure of the stabilizer rear spar top chord, the structure could not sustain

OCR for page 87
IMPROVING AIRCRAFT SAFETY/94 . . . . the flight loads imposed upon it long enough to enable the failure to be detected by the then existing inspection schedule. It cannot, there fore, be classified as fail-safe. Insufficient consideration had been given at the design and certification stages to the stress distribution in the horizontal stabi lizer spar structure following a top chord fail ure in the region outboard of the closure rib. The replacement of the horizontal stabilizer light alloy top skin by stainless steel signif icantly altered the stiffness distribution of the structure, creating the high fastener load ings which led, ultimately, to the fatigue fail ure in the rear spar top chord in G-BEBP. Neither the inspections detailed in the approved maintenance schedule nor those recommended by the manufacturer were adequate to detect partial cracks in the horizontal stabilizer rear spar top chord, but would probably have been adequate for the detection of a completely fractured top chord. The inspections required by the Dan-Air U.K. CAA-approved maintenance schedule in respect of the stabilizer rear spar top chord were less specific than those recommended by the manu facturer. No fatigue tests were carried out on the 707-300 series horizontal stabilizer structure prior to U.S. or U.K. certification. Neither at the time of certification nor at the time of writ ing were such repeated load tests required by either U.S. or U.K. legislation for structures declared to be fail-safe. A post-accident survey of the 707-300 fleet, worldwide, revealed a total of 38 aircraft with fatigue cracks present in the stabilizer rear spar top chord. Of this number, four stabi lizers required chord replacement. Post-accident flight tests revealed that deploy ment of speed brakes during the landing roll produced a horizontal stabilizer load condition spectrum which was significantly different to that used in the original design.

OCR for page 87
95/Appendix B Cause: The accident was caused by a loss of pitch control following the in-flight separation of the right-hand horizontal stabilizer and elevator as a result of a combination of metal fatigue and inadequate fail-safe design in the rear spar structure. Short- comings in design assessment, certifica- tion, and inspection procedures were contributory factors. AMERICAN AIRLINES , INC., MCDONNELL-DOUGLAS DC-10-10 May 25, 1979 About 3:04 p.m., CDT, May 25, 1979, American Air- lines, Inc.'s, Flight 191, a McDonnell-Douglas DC-10-10 aircraft, crashed into an open field just short of a trailer park about 4,600 feet northwest of the departure end of runway 32R at Chicago O'Hare International Air- port, Illinois. Flight 191 was taking off from runway 32R. The weather was clear and the visibility was 15 miles. Dur- ing the takeoff rotation, the left engine and pylon assembly and about three feet of the leading edge of the left wing separated from the aircraft and fell to the runway. Flight 191 continued to climb to about 325 feet above the ground and then began to roll to the left until the wings were past the vertical position. During the roll, the aircraft's nose pitched down below the horizon. Flight 191 crashed into the open field and the wreck- age scattered into an adjacent trailer park. The air- craft was destroyed in the crash and subsequent fire. All two hundred and seventy-one persons on board were killed; two persons on the ground were killed; and two others were injured. An old aircraft hangar, several automobiles, and a mobile home were destroyed. The National Transportation Safety Board determined that the probable cause of this accident was the asym- metrical stall and the ensuing roll of the aircraft because of the uncommanded retraction of the left-wing outboard leading edge slats and the loss of stall warning and slat disagreement indication systems resulting from the separation of the No. 1 engine and pylon assembly at

OCR for page 87
IMPROVING AIRCRAFT SAFETY/9 6 a critical point during takeoff. The separation resulted from damage by improper maintenance procedures which led to failure of the pylon structure. Contributing to the cause of the accident were the vulnerability of the design of the pylon attach points to maintenance damage; the vulnerability of the design of the leading edge slat system to the damage which pro- duced asymmetry; deficiencies in Federal Aviation Admin- istration surveillance and reporting systems which failed to detect and prevent the use of improper maintenance procedures; deficiencies in the practices and communica- tions among the operators, the manufacturer, and the FAA which failed to determine and disseminate the particulars regarding previous maintenance damage incidents; and the intolerance of prescribed operational procedures to this unique emergency. After the accident, the Federal Aviation Administra- tion required a fleetwide inspection of the DC-10. Dur- ing these inspections, discrepancies were found in the pylon assemblies. Among these discrepancies were vari- ances in the clearances on the spherical bearing's fore and aft faces; variances in the clearance between the bottom of the aft wing clevis and the fasteners on the upper spar web; interferences between the bottom of the aft clevis and the upper spar web fasteners; pylons with either loose, failed, or missing spar web fasteners; and aft pylon bulkheads with upper flange fractures. The fractured flanges were found only on the DC-10-10 series aircraft. During postaccident inspections, six DC-lOs were found to have fractured upper flanges on the pylon aft bulkheads (four American Airlines DC-lOs and two Conti- nental Airlines DC-lOs). The failure modes on the Continental Airlines' air- craft that were examined by metallurgists were similar to those found on the American Airlines' DC-lOs. Of the two Continental fractures discovered during the post- accident inspections, one crack was six inches long, and the other three inches long; neither crack showed any evidence of fatigue propagation. The investigation also disclosed that two other Con- tinental Airlines DC-lOs had had fractures on their upper flanges. These two aircraft were damaged on December 19, 1978, and February 22, 1979. The damage was repaired and both aircraft were returned to service. In addition,

OCR for page 87
97/Appendix B a United Airlines' DC-10 was discovered to have a cracked upper spar web on its No. 3 pylon and 26 damaged fas- teners. The damaged pylon aft bulkheads of the four other American Airlines' DC-lOs were also examined at the Safety Board's metallurgical laboratory. Each of these aft bulkheads contained visible cracks and obvious down- ward deformations along their upper flanges. The longest crack--about six inches--was the only one in which fatigue had propagated. The fatigue area was about 0.03 inch long at each end of the overstress fracture. Of the nine DC-lO's with fractured flanges, only the accident aircraft had shims installed on the upper sur- face of the flange. The National Transportation Safety Board summarized its findings as follows: 1. The engine and pylon assembly separated either at or immediately after liftoff. The flightcrew was committed to continue the takeoff. 2. The aft end of the pylon assembly began to sepa- rate in the forward flange of the aft bulkhead. 3. The structrual separation of the pylon was caused by a complete failure of the forward flange of the aft bulkhead after its residual strength had been critically reduced by the facture and subsequent service life. 4. The overload fracture and fatigue cracking on the pylon aft bulkhead's upper flange were the only pre- existing damage on the bulkhead. The length of the over- load fracture and fatigue cracking was about 13 inches. The fracture was caused by an upward movement of the aft end of the pylon which brought the upper flange and its fasteners into contact with the wing clevis. 5. The pylon to wing attach hardware was properly installed at all attachment points. 6. All electrical power to the No. 1 a.c. generator bus and No. 1 d.c. bus was lost after the pylon sepa- rated. The captain's flight director instrument, the stall warning system, and the slat disagreement warning light systems were rendered inoperative. Power to these buses was never restored. 7. The No. 1 hydraulic system was lost when the pylon separated. Hydraulic systems No. 2 and No. 3 oper- ated at their full capability throughout the flight. Except for spoiler panels No. 2 and No. 4 on each wing, all flight controls were operating.

OCR for page 87
IMPROVING AIRCRAFT SAFETY/98 8. The hydraulic lines and followup cables of the drive actuator for the left wing's outboard leading edge slat were severed by the separation of the pylon and the left wing's outboard slats retracted during climbout. The retraction of the slats caused an asymmetric stall and subsequent loss of control of the aircraft. 9. The flightcrew could not see the wings and engines from the cockpit. Because of the loss of slat disagreement light and the stall warning system, the flightcrew would not have received an electronic warning of either the slat asymmetry or the stall. The loss of the warning systems created a situation which afforded the flightcrew an inadequate opportunity to recognize and prevent the ensuing stall of the aircraft. 10. The flightcrew flew the aircraft in accordance with the prescribed emergency procedure which called for the climbout to be flown at V2 speed. V2 speed was 6 KIAS below the stall speed for the left wing. The deceleration to V2 speed caused the aircraft to stall. The start of the left roll was the only warning the pilot had of the onset of the stall. 11. The pylon was damaged during maintenance per- formed on the accident aircraft at American Airline's Maintenance Facility at Tulsa, Oklahoma, on March 29 and 30, 1979. 12. The design of the aft bulkhead made the flange vulnerable to damage when the pylon was being separated or attached. 13. American Airlines engineering personnel devel- oped an ECO [Engineering Change Order] to remove and reinstall the pylon and engine as a single unit. The ECO directed that the combined engine and pylon assembly be supported, lowered, and raised by a forklift. American Airlines engineering personnel did not perform an ade- quate evaluation of either the capability of the fork- lift to provide the required precision for the task, or the degree of difficulty involved in placing the lift properly, or the consequences of placing the lift improp- erly. The ECO did not emphasize the precision required to place the forklift properly. 14. The FAA does not approve the carriers' mainte- nance procedures, and a carrier has the right to change its maintenance procedures without FAA approval. 15. American Airlines personnel removed the aft bulkhead's bolt and bushing before removing the forward

OCR for page 87
99/Appendix B bulkhead attach fittings. This permitted the forward bulkhead to act as a pivot. Any advertent or inadvertent loss of forklift support to the engine and pylon assembly would produce an upward movement at the aft bulkhead's upper flange and bring it into contact with the wing clevis. 16. American Airlines maintenance personnel did not report formally to their maintenance engineering staff either their deviation from the removal sequence con- tained in the ECO or the difficulties they had encoun- tered in accomplishing the ECO's procedures. 17. American Airline's engineering personnel did not perform a thorough evaluation of all aspects of the maintenance procedures before they formulated the ECO. The engineering and supervisory personnel did not monitor the performance of the ECO to insure either that it was being accomplished properly or if their maintenance per- sonnel were encountering unforeseen difficulties in n~r- forming the assigned tasks. 18. The nine situations in which damage was sus- tained and cracks were found on the upper flange were limited to those operations wherein the engine and pylon assembly was supported by a forklift. 19. On December 19, 1978, and February 22, 1979, Continental Airlines maintenance personnel damaged aft bulkhead upper flanges in a manner similar to the damage noted on the accident aircraft. The carrier classified the cause of the damage as maintenance error. Neither the air carrier nor the manufacturer interpreted the regulation to require that it further investigate or report the damages to the FAA. 20. The original certification's fatigue-damage assessment was in conformance with the existing require- ments. 21. The design of the stall warning system lacked sufficient redundancy; there was only one stickshaker motor; and further, the design of the system did not provide for crossover information to the left and right stall warning computers from the applicable leafing edge slat sensors on the opposite side of the aircraft. 22. The design of the leading edge slat system did not include positive mechanical locking devices to pre- vent movement of the slats by external loads following a failure of the primary controls. Certification was based upon acceptable flight characteristics with an asymmet- rical leading edge slat condition.

OCR for page 87
IMPROVING AIRCRAFT SAFETY/10 0 23. At the time of the DC-10 certification, the structural separation of an engine pylon was not con- sidered. Thus, multiple failures of other systems resulting from this single event was not considered.