ASC-TR-2010-5002

THREATS TO AIRCRAFT STRUCTURAL SAFETY,

INCLUDING A COMPENDIUM OF SELECTED
STRUCTURAL ACCIDENTS / INCIDENTS

C. F. Tiffany, J. P. Gallagher, and C. A. Babish, IV

Engineering Directorate (ASC/EN)

Aeronautical Systems Center

MARCH 2010
Final Report

AERONAUTICAL SYSTEMS CENTER

ENGINEERING DIRECTORATE
WRIGHT-PATTERSON AIR FORCE BASE, OH 45433-7101
AIR FORCE MATERIEL COMMAND
UNITED STATES AIR FORCE

DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.

 NOTICE AND SIGNATURE PAGE

Using Government drawings, specifications, or other data included in this document for any
purpose other than Government procurement does not in any way obligate the U.S. Government.
The fact that the Government formulated or supplied the drawings, specifications, or other data
does not license the holder or any other person or corporation; or convey any rights or
permission to manufacture, use, or sell any patented invention that may relate to them.

This report has been cleared for public release by the Aeronautical Systems Center Public Affairs
Office and is available to the general public, including foreign nations. Copies of this report may
be obtained from the Defense Technical Information Center (DTIC) (http://www.dtic.mil).

ASC-TR-2010-5002 HAS BEEN REVIEWED AND IS APPROVED FOR PUBLICATION IN

ACCORDANCE WITH ASSIGNED DISTRIBUTION STATEMENT.

This report is published in the interest of scientific and technical information exchange, and its
publication does not constitute the Government‟s approval or disapproval of its ideas or findings.

ii
 REPORT DOCUMENTATION PAGE Form Approved
OMB No. 0704-0188
The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, searching existing data
sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information,
including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway,
Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if
it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

1. REPORT DATE (DD-MM-YY) 2. REPORT TYPE 3. DATES COVERED (From - To)

March 2010 Final 01 January 2009 – 30 January 2010
4. TITLE AND SUBTITLE 5a. CONTRACT NUMBER
THREATS TO AIRCRAFT STRUCTURAL SAFETY, INCLUDING A In-house
COMPENDIUM OF SELECTED STRUCTURAL ACCIDENTS / INCIDENTS 5b. GRANT NUMBER
5c. PROGRAM ELEMENT NUMBER
N/A
6. AUTHOR(S) 5d. PROJECT NUMBER
Charles F. Tiffany (USAF Retired) N/A
Joseph P. Gallagher (USAF Retired) 5e. TASK NUMBER
Charles A. Babish, IV (ASC/EN) N/A
5f. WORK UNIT NUMBER
N/A
7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION
Aeronautical Systems Center (ASC/EN) REPORT NUMBER
Engineering Directorate ASC- TR-2010-5002
Wright-Patterson Air Force Base, OH 45433-7101
Air Force Materiel Command
United States Air Force
9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITORING
AGENCY ACRONYM(S)
Aeronautical Systems Center ASC/EN
Engineering Directorate
Wright-Patterson Air Force Base, OH 45433-7101 11. SPONSORING/MONITORING
AGENCY REPORT NUMBER(S)
Air Force Materiel Command
United States Air Force ASC- TR-2010-5002
12. DISTRIBUTION/AVAILABILITY STATEMENT
DISTRIBUTION STATEMENT A. Approved for Public Release; Distribution is Unlimited.
13. SUPPLEMENTARY NOTES
Report contains color.
14. ABSTRACT
This report discusses seven serious threats to structural safety that have become known as a result of past
accident/incident investigations. The report describes the historic evolution of military and civilian aircraft
structural requirements to prevent instantaneous and delayed structural failure due to these threats; these
structural requirements have evolved over the last 60 years to address the threats. Continued on next page
15. SUBJECT TERMS
Aircraft Structural Integrity Program, ASIP, structural integrity, MIL-STD-1530C
16. SECURITY CLASSIFICATION OF: 17. LIMITATION 18. NUMBER OF 19a. NAME OF RESPONSIBLE PERSON (Monitor)
a. REPORT b. ABSTRACT c. THIS PAGE OF ABSTRACT: PAGES Charles A. Babish, IV
Unclassified Unclassified Unclassified Unlimited 167 19b. TELEPHONE NUMBER (Include Area Code)
(937) 255-5312
Standard Form 298 (Rev. 8-98)
Prescribed by ANSI Std. Z39-18

iii
 ABSTRACT (continued)

The report summarizes each threat and provides authoritative accounts of threat-related
accident/incident investigations to further illustrate the nature of each threat; it also discusses
lessons-learned and the impact of accidents/incidents on aircraft structural design and
maintenance requirements. The report also describes the evolution of fail-safe design and testing,
the development of the Air Force‟s Aircraft Structural Integrity Program, and the development of
fracture mechanics based damage tolerance requirements for both military and civil aircraft. The
difficulties in developing and validating operational limits to prevent structural failure due to
widespread fatigue damage are also discussed. This report provides background for current and
future generations of aircraft engineers so that they can: 1) better understand the current
requirements; 2) potentially avoid repeating past mistakes; and 3) better address current and
future challenges to aircraft structural safety.

This report does not address some other threats to structural safety caused by structural overloads
(those that far exceed design limits and cause essentially immediate catastrophic failure) due to
excessive: 1) flight and/or ground loads (no matter the cause, e.g., pilot error, flight control
system anomalies, etc.); 2) extreme turbulence and gust loads; and 3) aero-acoustic loads.
Perhaps these threats and the related accidents and incidents will be the subject of a future report.

iv
 TABLE OF CONTENTS

CHAPTER PAGE
1.0 INTRODUCTION 1
2.0 THREATS 5
2.1 High Local Stresses 7
2.2 Manufacturing and Material Defects 9
2.3 Maintenance Damage/Deficiencies 11
2.4 Environmental Damage 12
2.4.1 Corrosion and Fretting 12
2.4.2 Stress Corrosion and Corrosion Fatigue 13
2.5 Discrete Source Impact 14
2.5.1 Ground Equipment 14
2.5.2 Uncontained Engine Failures 14
2.5.3 Bird Strikes 17
2.5.4 Runway Debris 19
2.6 Explosive/Ballistic Penetration of the Airframe 20
2.7 Excessive Operational Loads 21
2.8 The Onset of Widespread Fatigue Damage (WFD) 22
2.9 Summary of the Threats and Their Associated Mechanisms 24
3.0 MAINTAINING AIRWORTHINESS 26
3.1 Multiple Load Path Fail-Safe Structures 28
3.2 Crack Arrest Fail-Safe Structures 29
3.3 Non-Fail-Safe / Single Load Path Structures 31
4.0 CONCLUDING REMARKS 34
4.1 Recommendations 34
5.0 REFERENCES 36
5.1 Bibliography (Additional Reading) 38
COMPENDIUM OF SELECTED STRUCTURAL ACCIDENTS / 40
INCIDENTS

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM UNANTICIPATED Page

DIX A HIGH LOCAL STRESSES (COMBINED WITH POSSIBLE
MANUFACTURING DEFECTS)
A.1 BOAC Comet G-ALYP & G-ALYY A1
A.2 USAF Northrop F-89 A5
A.3 USAF Republic F-84 A6
A.4 USAF North American F-86 A8
A.5 USAF Boeing B-47 A9
A.6 USAF McDonnell-Douglas F-4 A11
A.7 Northwest Airlines Martin 202 A13
A.8 Argentine State Owned YPF AVRO 748 A14
A.9 Dan Air Airline Boeing 707-300 A16

v
 TABLE OF CONTENTS (continued)

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM UNANTICIPATED Page

DIX A HIGH LOCAL STRESSES (COMBINED WITH POSSIBLE
MANUFACTURING DEFECTS) (cont.)
A.10 Aer Lingus- Irish International Airlines Boeing 707-300 A19
A.11 USAF McDonnell-Douglas F-15C A21

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM MANUFACTURING Page

DIX B AND MATERIAL DEFECTS
B.1 USAF Northrop F-5/T-38 B1
B.2 USAF Boeing KC-135 B3
B.3 USAF Douglas C-133 B7
B.4 Curtis Wright X-19 VTOL B9
B.5 USAF General Dynamics F-111 B10

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM MAINTENANCE Page

DIX C DEFECTS/DEFICIENCIES
C.1 Beech 99 Commuter Aircraft C1
C.2 Eastern Airlines Boeing 727 C3
C.3 American Airlines McDonnell-Douglas DC-10 C5
C.4 Japan Airlines Boeing 747SR C7
C.5 China Airlines Boeing 747 C11
C.6 Chalk Airways Grumman Mallard G-73 C15

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM ENVIRONMENTAL Page

DIX D DAMAGE
D.1 British-European Airlines Vickers Vanguard 951 D1
D.2 Far Eastern Transport Boeing 737 D3

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM IMPACT FROM Page

DIX E GROUND EQUIPMENT
E.1 Alaska Airlines McDonnell-Douglas MD-80 E1
E.2 Varig Brazilian Airlines Boeing 747 E3

vi
 TABLE OF CONTENTS (concluded)

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM UNCONTAINED Page

DIX F ENGINE FAILURES
F.1 United Airlines McDonnell-Douglas DC-10 F1
F.2 National Airlines McDonnell-Douglas DC-10 F3
F.3 Air France Airlines Boeing 747 F5
F.4 UTAs Boeing 747 F6
F.5 Delta Airlines McDonnell-Douglas MD-88 F7
F.6 Mesa Airlines Bombardier Regional Jet CRJ 200 F9
F.7 American Airlines Boeing 767 F11

APPEN- Page
DIX G ACCIDENTS / INCIDENTS RESULTING FROM BIRD STRIKES
G.1 Delta Airlines McDonnell-Douglas MD-88 G1
G.2 American Airlines Boeing 767 G2
G.3 USAF Lockheed C-130 G4

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM RUNWAY Page

DIX H DEBRIS
H.1 Air France Concorde H1

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM EXPLOSIVE Page

DIX I PENETRATIONS
I.1 Qantas Airlines Boeing 747 I1

APPEN- ACCIDENTS / INCIDENTS RESULTING FROM WFD Page

DIX J
J.1 Aloha Airlines Boeing 737-200 J1
J.2 U.S. Forest Service Lockheed C-130A J6

APPEN- HISTORICAL SUMMARY OF U.S. TESTING Page

DIX K APPROACHES FOR DEMONSTRATING AIRFRAME FAIL- K1
SAFETY

vii
 LIST OF FIGURES

FIGURE PAGE
1 Uncontained Rotor Statistics (1963-1989) [22] 15
2 Percentages Associated With Types Of Causes Associated With 37 USAF 22
Structural Failures [28]
A1 BOAC Comet in Flight A1
A2 Photo of Comet (G-ALYP) Reconstruction of Fuselage and Tail Units at Royal A2
Aircraft Establishment at Farnborough during the Investigation of Accidents
[A2]
A3 Uncontained Running Cracks Led to Aircraft Breakup. Poor Detail Design of A2
Cutouts Led to Running Cracks in the Highly Stressed Low Toughness Skin
A4 Local Area that Had a Stop-Drilled Hole A3
A5 Uncontained Running Cracks Caused the Breakup of this Hydro Test of the A4
Retired Comet 1 (G-ALYU). Cracks Propagating from Forward Escape Hatch
on the Port Side. Note that No Straps or Shear Tied Frames Were Used. No
Crack Arrestment Capability was Provided by this Construction [A2]
A6 Photo of F-89 Aircraft A5
A7 Photo of a Pair of F-84 Aircraft in Flight A6
A8 Photo of a Republic Swept Wing F-84F Aircraft A7
A9 Photo of F-86 Aircraft in Flight A8
A10 Photo of B-47 Aircraft in Flight A9
A11 Sketch Illustrating Critical Locations of the B-47 Aircraft A9
A12 Photo of F-4C and F-4E Aircraft A11
A13 Sketch of F-4 Aircraft Illustrating Location Of Failure A12
A14 Photo of Martin 202 Aircraft A13
A15 Photo of AVRO 748 Aircraft A14
A16 Sketch of AVRO 748 Aircraft Illustrating Failure Location A15
A17 Photo of Boeing 707-300 Aircraft A16
A18 Photo of Right Horizontal Stabilizer that Separated from B-707-321C Aircraft A18
and Details of “Fail-Safe” Structure Associated with the Accident
A19 Photo of Boeing 707-300 Aircraft A19
A20 Photo of Section of Boeing 707-300 Aircraft Lost Due to Fatigue Failure A20
A21 Photo of F-15 Aircraft in Flight A21
A22 Artist‟s Rendition of F-15C Forward Fuselage Separation A21
A23 Location of Crack Site in F-15C Forward Fuselage Upper Longeron A22
A24 Cracking Events Occurring in the F-15C Forward Fuselage Upper Longeron at A23
FS 377
B1 Two T-38 Trainers in Flight B1
B2 Identification of Tool Damage Location and Resulting Wing Separation Point B2
B3 Tool Damage Led to Early Fatigue Cracking and Resulting Failure of the B2
Monolithic Wing
B4 Photo of KC-135 in Flight B3

viii
 LIST OF FIGURES (Continued)

B5 Illustration Shows Location of Fatigue Crack Resulting in a 28-Inch Panel B4

Failure in Lower Surface of a KC-135 Wing (Fairchild AFB, February 1971)
B6 Photo Illustrates the Critical Size of Fatigue Crack was Covered by the B5
Fastener Countersink Making It Impossible to Detect by Visual Inspection
B7 Photo of C-133 Transport Aircraft in Flight B7
B8 Details of the Cracking that Led to Failure of C-133 Transport Aircraft B8
B9 Photo of Curtis Wright X-19 Aircraft B9
B10 Sketch of Flaw Details Associated with X-19 Aircraft Accident B9
B11 Photo of F-111 Aircraft in Flight B11
B12 Photo Illustrating Forging Flaw and Subsequent Fatigue Crack that Caused the B12
Failure of F-111 Aircraft after 105 Hours of Flight Time
C1 Photo of Beech Commuter Aircraft C1
C2 Details of Maintenance Action that Led to Damage C2
C3 Photo of Damaged Hole and Cracked Spar Cap C2
C4 Photo of Boeing 727 Aircraft C3
C5 Maintenance Action that Led to Skin Failure by Fatigue C3
C6 Photos Illustrating the Structural Damage Resulting from Fatigue Skin Failure C4
C7 Photo of DC-10 Aircraft C5
C8 Diagrams Illustrating Nature and Result of the Maintenance Damage in the C6
Cause of a DC-10 Pylon Failure
C9 Photo of Boeing 747SR Aircraft C7
C10 Sketches of Location of Failure in 747SR Rear Pressure Bulkhead C8
C11 Construction Details Associated with Initial and Repaired 747SR Rear C9
Pressure Bulkhead
C12 Photos Illustrating Rivet Damage on 747SR Rear Pressure Bulkhead C10
C13 Photo of Boeing 747-200 C11
C14 Crack Location under Edge of Repair Doubler [C9]. C12
C15 Quasi-stable Crack Growth Identifying Numerous Starter Cracks (Prior to C13
Final Fracture) [C9]
C16 Predicted Residual Strength vs. Crack Length [C9] C13
C17 Photo of Grumman Mallard (G-73) C15
C18 Photo of the Fracture Face of the Right Wing Rear Spar Cap [C13] C17
D1 Photo of Vickers Vanguard 951 Aircraft D1
D2 Sketch of Construction Details that Led to Corrosion and Subsequent D2
Catastrophic Failure of the Vickers Vanguard 951 Aircraft
D3 Photo of Boeing 737 Aircraft D3
D4 Sketches Illustrating the Locations and Causes of Corrosion on B737 Aircraft D4
D5 Photo of Skin Corrosion in Lower Lobe of B737 Aircraft. D4
D6 Photo Illustrating Loss of Frame and Stringer Due to Severe Corrosion D5
D7 Photos Illustrating Severe Corrosion of FEAT B737 Aircraft D6
E1 Photo of McDonnell-Douglas MD-80 Aircraft E1

ix
 LIST OF FIGURES (Continued)

E2 Photo of Skin Failure Following Ground Handling Damage E2

E3 Photo of Boeing 747 Aircraft E3
E4 Sketch Illustrating Location Of Handling Damage Induced Crack on the B747 E3
Aircraft
F1 Photo of McDonnell-Douglas DC-10 Aircraft F1
F2 Photo of DC-10 Aircraft on Final Descent to Sioux City F2
F3 Sketch of General Electric Engine Defect Size and Location F2
F4 Photo of McDonnell-Douglas DC-10 Aircraft F3
F5 Sketch Illustrating Location of Fuselage Damage Due to an Uncontained F4
Engine Failure and Construction Details
F6 Photo of Air France Boeing 747 Aircraft F5
F7 Photos of Wing Damage on the B747 Aircraft Caused By Engine Failure F5
F8 Photo of UTA Boeing 747 Aircraft F6
F9 Photos of Wing Damage Caused by Engine Failure F6
F10 Photo of McDonnell-Douglas MD-88 Aircraft F7
F11 Photo of Engine and Fuselage Damage as a Result of Engine Failure F8
F12 Photo of Fractured Pratt & Whitney Compressor Fan Disk F8
F13 Photo of Bombardier Regional Jet CRJ 200 Aircraft F9
F14 Photo of Damage Associated with Engine Failure F10
F15 Photo of Damage Associated with Uncontained Rotor Failure in a GE CF6 F11
Engine
F16 Photo of B747 Fuselage with Disk Penetration Damage Caused by F12
Uncontained Rotor Failure
F17 Photo of B747 with Disk Embedded in No. 2 Engine Resulting from F12
Uncontained Rotor Failure in No. 1 Engine
F18 Photo of Engine Damage to the B747 Fuselage Resulting from Engine Failure F13
G1 Photo of McDonnell-Douglas MD-88 Aircraft G1
G2 Photo of Bird Strike Damage to Radome G1
G3 Photo of Bird Strike Damage to B767 Aircraft Just below the Cockpit G2
Windows
G4 Photo of Bird Strike Damage to Underside of Fuselage of B767 Aircraft G2
G5 Photo of Bird Strike Damage to Underside of B767 Fuselage Just Aft of the G3
Radome
G6 Photo of C-130 Aircraft. G4
G7 Photo of Bird Strike Damage to Outside of the C-130 Aircraft G4
G8 Photo of Bird Strike Damage to Front of C-130 Cockpit G5
G9 Photo of Bird Strike Damage to Interior of the C-130 Aircraft G5
H1 Photo of Concorde H1
I1 Photo of a Quantas Airlines Boeing 747 Aircraft I1
I2 Photo of Boeing 747 Fuselage after On-Board Explosion I2

x
 LIST OF FIGURES (Concluded)

I3 Close Up View of Boeing 747 Fuselage after On-Board Explosion I2

I4 Alternate Close Up View of Boeing 747 Fuselage after On-Board Explosion I3
Illustrating Loss of Structure
J1 Photo of Aloha Airlines Boeing 737 Aircraft J1
J2 Photo Illustrating Extent of Aircraft Damage to Boeing 737 Aircraft Following J1
Failure Due To Widespread Fatigue Damage
J3 Sketch Illustrating Side View of Fuselage with Missing Area of Boeing 737 J2
Aircraft
J4 Sketch Illustrating the Fuselage Missing Area from a View Looking Forward J2
J5 Sketch Illustrating the Development of Small Fatigue Cracks in the Skin J3
J6 Sketch Illustrating the Location of Small Fatigue Cracks in the Skin J3
J7 Sketches Illustrating the Development of Small Fatigue Cracks in the Skin J4
J8 Sketches Illustrating the Lap Splice Joint Designs of the B737 Aircraft J5
J9 Photo of a US Forest Service/Hawkins & Power Aviation‟s C-130A [J3] J7
K1 Boeing 707 Quonset Hut Test K1
K2 Boeing 737 Quonset Hut Test Setup K2
K3 Boeing 737 Blade Penetration K2
K4 Arrested Two-Bay Crack with Fractured Frame in Boeing 737 Fuselage K3
K5 DC-8 Wedge Penetration Tests K4
K6 Details of DC-8 Arrested Fuselage Crack K4
K7 View Inside the DC-8 Fuselage K5
K8 DC-10 Fuselage Curved Panel Tests K6
K9 DC-10 Curved Panel Fatigue Test Machine K6

xi
 LIST OF TABLES

TABLE PAGE
1 Roadmap for Accident/Incident Appendices 5
2 Accidents/Incidents Resulting from High Local Stresses 8
3 Accidents/Incidents Resulting from Manufacturing and Material Defects 10
4 Accidents/Incidents Resulting from Maintenance Damage/Deficiencies 11
5 Accidents/Incidents Resulting from Environmental Damage 13
6 Accidents/Incidents Resulting from Impact from Ground Equipment 14
7 Accidents/Incidents Resulting from Uncontained Engine Failures 16
8 Accidents/Incidents Resulting from Bird Strikes 19
9 Accidents/Incidents Resulting from Runway Debris 19
10 Accidents/Incidents Resulting from Explosive Penetrations 21
11 Accidents/Incidents Resulting from Widespread Fatigue Damage 23
12 Listing of Threats and Their Associated Mechanisms of Failure 24
B1 Listing of Annual Cracking Incidents on KC-135 Aircraft B4
J1 Accident Aircraft C-130A History J6
J2 Airworthiness Certificate Category and Operating Limitations J8

xii
 LIST OF ACRONYMS

ACRONYM MEANING
AD Airworthiness Directives
AFRL Air Force Research Laboratory
AIA Aircraft Industries Association
AIB Accident Investigation Board
AIDS Accident/Incident Data System
API Armor Piercing Incendiary
ASIP Aircraft Structural Integrity Program
AW&ST Aviation Week and Space Technology
BCAA British Civil Aviation Authority
BEA Bureaudende Tes et D'Analyse pour Secureti de L'Aviation
BMT Boeing Materials Technology
BOAC British Overseas Airways Corporation
BSC Bird Strike Committee
CAB Civil Aeronautics Board
CAR Civil Aviation Requirements
CFR Code of Federal Regulations
CFS Center Fuselage Station
CWS Center Wing Station
DADTA Durability and Damage Tolerance Analysis
DoD Department of Defense
DSG Design Service Goal
DT Damage Tolerance
EIFS Equivalent Initial Flaw Size
FAA Federal Aviation Administration
FAR Federal Aviation Requirements
FOD Foreign Object Damage
FSDO Flight Standards District Office
FSFO Flight Standards Field Office
FSFT Full Scale Fatigue Test
GSHWG General Structural Harmonization Working Group
H&P Hawkings and Powers Aviation, Inc.
HEI High Explosive Incendiary
IAW In Accordance With
IBSC International Bird Strike Committee
IED Improvised Explosive Device
JSSG Joint Services Specification Guide
MED Multiple Element Damage
MISO Manufacturing Inspection Satellite Office
MSD Multiple Site Damage
NDI Non-Destructive Inspection
NMAB National Materials Advisory Board
NPRM Notice of Proposed Rule Making

xiii
 LIST OF ACRONYMS (Continued)

ACRONYM MEANING
NTSB National Transportation Safety Board
OEM Original Equipment Manufacturer
POD Probability of Detection
SAB Scientific Advisory Board
SDR Service Difficulty Report
SLL Service Life Limit
SRM Structural Repair Manual
SSID Supplemental Structural Inspection Document
STC Supplemental Type Certificate
TC Type Certificate
T.O. Technical Order
TOGAA Technical Oversight Group on Aging Aircraft
USAF United States Air Force
USFS United States Forest Service
UTA Union des Transports Ae'riens
WFD Widespread Fatigue Damage
YPF Yacimientos Petroliferos Fiscales

LIST OF SYMBOLS

SYMBOL MEANING
da/dN Fatigue Crack Growth Rate
KISCC Threshold Stress Intensity Factor for Stress Corrosion Cracking
N Fatigue Life Parameter (cycles)
S Stress Parameter for Fatigue
K Range of Stress Intensity Factor in Fatigue

xiv
 ACKNOWLEDGMENTS

First and foremost this report represents a joint effort between Joseph P. Gallagher, Charles A.
Babish IV, and myself. I prepared an initial draft in 2008, however, it lacked the organization,
format, references, editing and the technical review required for a reputable report. Because of the
effort required and the concern that there may not be much interest in the subject, I had decided not
to proceed forward towards publication. This is when Joe stepped in and volunteered to assist. Joe
has been a close friend and colleague of mine since we worked together at WPAFB in the 1970s
and he has nearly four decades of experience in structural analysis, fracture mechanics and fatigue.
He personally reorganized and reformatted my early draft, performed a technical review, obtained
independent data on several accidents / incidents and provided text to both the body of the report
as well as the appendices. In addition, he worked directly with Chuck Babish, the current USAF
Aircraft Structural Integrity Technical Advisor, to obtain concurrence and commitment to the goal
that the report will be a living document, which would incorporate lessons learned and possible
changes in requirements in the future. Chuck suggested numerous changes and additions. His
contributions to Chapter 3, Maintaining Airworthiness, and Appendix A-11, the November 2007
F-15 accident, were particularly important.

In addition to reflecting Joe Gallagher‟s and Chuck Babish‟s extensive experience, the report
reflects more than five and one half decades of my personal experiences in the development and
application of damage tolerant design and analysis procedures directed at the improvement of the
structural safety of aircraft and aerospace vehicles. The report is based on first hand experiences
and philosophies, and includes inputs from many past and current associates at Boeing, Air Force,
NASA, FAA, and the FAA‟s former Technical Oversight Group on Aging Aircraft (TOGAA). The
contributions of Thomas Swift, formerly with Douglas Aircraft Co. and then with the FAA are
particularly important. He provided inputs on the development of the DC-8 and DC-10 structures;
he also contributed to several of the Accidents / Incidents included in the Appendices at the end of
this report some of which were previously included in the TOGAA final report to the FAA dated
August 24, 2004. Also, several of the Accidents / Incidents discussed have been previously
reported by and commented on by Jack McGuire, the former head of Structures at Boeing
Commercial Airplanes. The report also includes data developed by John W. Lincoln, my coworker
at WPAFB for eight years and friend until his death in 2002. Comments on the report have been
provided by my past TOGAA associates, Prof. James Mar formerly of MIT and Richard Tabery,
former VP of United Airlines and many past and present Boeing structures engineers, but
especially Jack McGuire, Pete Harradine, Gary Prescott and Steve Chisholm.

C.F. Tiffany

xv
 CHAPTER 1.0 - INTRODUCTION
Cracking and subsequent component failures due to fatigue, corrosion, stress corrosion and
corrosion/fatigue are major threats to aircraft structural safety. Such cracking can originate from
manufacturing defects, material defects, unforeseen high local stresses resulting from design and
analysis errors or test deficiencies, environmental damage, and service induced maintenance
deficiencies. Also, discrete source impacts from bird strike, ground equipment, dropped tools,
runway debris, uncontained engine rotor failures and explosive penetrations are serious threats to
structural safety. Although these impacts are generally accidental, they can inflict very large
damage and should be protected against to the maximum practical extent. Eventually an
operational limit will be reached in metallic structures with the onset of widespread fatigue
damage (WFD) or generalized fatigue cracking. At that point safety can no longer be assured and
the structural component(s) should be modified, or replaced. This report discusses the threats and
provides a historical perspective as to how the military, the Federal Aviation Administration
(FAA) and industry have dealt with these threats over the years.

The report includes a Compendium of Selected Structural Accident/Incidents. The Compendium

is organized by Appendices that specifically address the results of the threats to structural safety.
These accidents and incidents illustrate the oftentimes disastrous consequences of the threats.
While there have been lessons learned from nearly all of the accidents and incidents, those that
were seminal with respect to the design and certification of aircraft structures were the 1954
Comet failures, the 1958 B-47 accidents, the 1969 F-111 accident, the 1976 AVRO 748 accident,
the 1978 Dan Air 707 Lusaka accident and the 1988 Aloha Boeing 737 accident. The Comet
failures resulted in the use of fail-safe design in commercial aircraft; the B-47 accidents resulted
in the development of the Air Force Aircraft Structural Integrity Program (ASIP); the F-111
accident accelerated the introduction of damage tolerance design requirements in military
aircraft; the AVRO 748 and Dan Air Boeing 707 accidents resulted in complementing
commercial fail-safe design with damage tolerance requirements; and the Aloha Boeing 737
accident brought attention to the importance that WFD has in limiting the safe operation of
airplane structures.

The lessons learned from these past accidents/incidents and the changes in structural design, test
and analysis requirements have been evolutionary in nature with some changes having much
more of a positive impact than others. The change that had the greatest positive impact on the
structural safety of commercial transport aircraft was the development of the fail-safe design
concept, largely as a result of the Comet failures. This concept has undoubtedly prevented an
untold number of catastrophic accidents (approximately 40 are mentioned in the Compendium,
i.e., Appendices B.2, A.10, C.2, E.1, E.2, F.2-F.7, G.1-G.3, and I.1). However, not all
commercial airplanes were designed to the Civil Aeronautics Board (CAB) fail-safe option [1].
Due to the state of the art of fracture mechanics in the 1950s, the CAB rule did have some
shortcomings that became more apparent as a result of the AVRO 748 and Dan Air Boeing 707
accidents and the Boeing 737 Aloha accident. These accidents (along with advancements in
fracture mechanics technology) resulted in the FAA incorporating damage tolerance based
inspection requirements and full-scale fatigue test requirements in the Code of Federal
Regulations (CFR), but unfortunately this came at the expense of reduced emphasis on fail-safe
design. Contrary to the intentions of the Aircraft Industry Association (AIA) committee that

1
oversaw the change in the FAA regulation (i.e., amendment 45 to FAR 25.571 [2]) after the
AVRO 748 and Dan Air accidents, the explicit fail-safe design requirement was inadvertently
omitted.

In 1999 the FAA‟s Technical Oversight Group on Aging Aircraft (TOGAA) attempted to get the
regulation amended to explicitly require fail-safe design of commercial transport aircraft;
however, the effort failed when TOGAA objected to the changes that a joint U.S. and European
working group (called the General Structures Harmonization Working Group, GSHWG)
proposed. TOGAA recommended to the FAA that it was better to stay with the implicit fail-safe
requirements included in the 1998 amendment 96 to FAR 25.571 [3] than accept the GSHWG
proposal.

The need still exists today to have the FAR explicitly require that all safety-of-flight structure in
commercial transport aircraft be designed to be fail-safe in spite of the fact that some
manufacturers have such self imposed design requirements. The lack of such a rule could lead to
a relaxation of self imposed requirements and subsequent catastrophic failures in the future.

With regard to military aircraft, the change that had the greatest positive impact on structural
safety was the introduction of damage tolerance requirements in the early 1970s subsequent to
the F-111 accident in 1969. While the introduction of ASIP in 1958 [4], was important, it still
assumed flaw-free structure and promoted the use of single load path structure and safe-life
concepts (conventional stress-life fatigue analysis and Miner‟s Rule). As a result many fatigue
failures continued throughout the 1960s and early 1970s.

The 1969 F-111 accident highlighted the catastrophic effect that an initial material or
manufacturing flaw can have on non-fail-safe structure. With the 1974 revisions to ASIP (in
MIL-STD-1530A [5]), the introduction of detailed damage tolerance requirements (in MIL-A-
83444 [6]) and the performance of Durability and Damage Tolerance Assessments (DADTAs)
on all of the US Air Force aircraft, the losses of military aircraft due to structural failure were
greatly diminished.

However, in recent years inspection reliability has become a significant issue both due to frailties
of the nondestructive inspection (NDI) systems and concern over inspectors becoming
complacent as a result of performing numerous repeat inspections looking for rogue flaws
without any finds [7-10]. The inspection issue becomes even more acute as aging weapon
systems approach the onset of WFD. The inspection burden and aircraft down times tend to
overwhelm the depots and jeopardize both safety and operational readiness. To avoid this
probability, the Air Force has established operational limits (i.e., service life limits) in each
aircraft‟s Airworthiness Certificate. Also, the USAF has been promoting greater use and
reliance on fail-safe design concepts, which require only visual inspections. During 2007 and
2008, C.F. Tiffany assisted the USAF Aeronautical Systems Center Engineering Directorate
(ASC/EN) in drafting structural bulletins that address revisions in the damage tolerance
requirements for fail-safe and non-fail-safe (i.e., slow crack growth) structures. The revisions for
fail-safe and non-fail-safe structures are contained in Structures Bulletins EN-SB-08-001 [11]
and -002, [12] respectively. Also, a third Bulletin (-003 [13]) was published on performing fail-
safe assessments of current Air Force aircraft.

2
The report also discusses maintenance of airworthiness; this discussion is separated into three
parts that address operational limits according to the USAF defined structural concepts:

 Multiple Load Path, Fail-Safe Structure

 Crack Arrest, Fail-Safe Structure
 Non-fail-safe, Single Load Path Structure

This approach was taken since it is clear that the operational limits on fail-safe structure are
reached when the major components have reached the time when the onset of widespread fatigue
damage has occurred. It is less clear what the operational limits should be on single load path
structure.

For the multiple load path, fail-safe structure, the onset of widespread fatigue damage occurs
when the crack population in the component has degraded the load carrying capability of the
adjacent structure so that when the primary element fails, the adjacent structure can no longer
carry the required residual strength load. This situation of widespread fatigue damage is referred
to as multiple element damage.

For the crack arrest, fail-safe structure, the onset of widespread fatigue damage occurs when the
population of small cracks within the component are of sufficient number size and density such
that rapid crack propagation of the lead crack or inflicted damage will not be arrested and thus
the required residual strength in the presence of the design damage size cannot be achieved. This
situation of widespread fatigue damage is referred to as multiple site damage.

Single load path structure has been traditionally protected against structural failure using the
damage tolerance (DT) concept of slow crack growth and DT-based inspections. It was
assumed that one could continue inspecting such structures without end of life limits, until the
economic and loss of readiness burden became intolerable. This assumption is re-examined and
an operational limit based on durability-related fatigue cracking that overwhelms the inspection
system is suggested.

For all three structural concepts, operational limits of USAF aircraft are ultimately dictated by
the inability of the structure to maintain its required residual strength in the presence of damage
at a structural risk level exceeding a single flight probability of failure of 10-5 per flight. To
ensure continuing airworthiness, it is essential to take action (e.g., perform different types of
inspections, replace the component or implement flight restrictions or groundings) to maintain
the single flight probability of failure below 10-7 per flight and minimize exposure between 10-7
and 10-5 per flight according to MIL-STD-1530C.

3
This page intentionally left blank

4
 CHAPTER 2.0 - THREATS
The purpose of this chapter is to discuss the threats to structural safety and to illustrate each
threat‟s impact to the potential for aircraft accidents/incidents by a citing historical structural
failures resulting from these threats. The serious threats to structural safety are:

 High Local Stresses

 Manufacturing and Material Defects
 Maintenance Defects/Deficiencies
 Environmental Damage
 Discrete Source Impact (sub-categories)
 Ground equipment
 Uncontained Engine Failures
 Bird Strikes
 Runway Debris
 Explosive/Ballistic Penetrations
 Excessive Operational Loads
 Widespread Fatigue Damage

Table 1 was created to provide a roadmap relating the threats to the Chapter 2 sections, to the
corresponding appendix illustrating accidents/incidents associated with the threat and to
summarize the number of accidents/incidents that a given appendix group contains.

Table 1. Roadmap for Accidents/Incidences Appendices

Threat Sections Appendix Group Number of Appendices

in Group
High local stresses 2.1 A 11
Manufacturing and material defects 2.2 B 5
Maintenance damage/deficiencies 2.3 C 5
Environmental damage 2.4 D 2
Impact from ground equipment 2.5.1 E 2
Impact due to uncontained engine 2.5.2 F 7
failures
Impact due to bird strikes 2.5.3 G 3
Impact due to runway debris 2.5.4 H 1
Explosive/ballistic penetrations 2.6 I 1
Excessive operational loads 2.7 None None
Widespread fatigue damage 2.8 J 2

Many early aircraft accidents/incidents resulted from high stress locations that nucleated fatigue
cracks under operational loading. These high stress locations were typically not identified until
the accidents/incidents occurred. The early accidents/incidents, however, were not just the result
of the high local stress threat; the structures that failed typically were manufactured: 1) from high

5
strength materials having both low resistance to fatigue cracking and low crack tolerance
(implying short final crack sizes), and 2) with manufacturing and/or material defects (resulting in
life variability and which magnified the effect of high local stresses). The Comet problem (See
Appendix A.1) in many respects was not that much different than the results observed with
military airplanes designed in the 1950s and 1960s (See Appendices A.2 through A.6 and B.1
through B.4).

In the late 1950s, the solution to preventing catastrophic fatigue failures of commercial aircraft
(and large military transport and bomber aircraft) was to ensure that the design resulted in a
structure which had sufficient structural redundancy to maintain adequate residual strength after
any structural element failed. Aircraft manufactured using the structural redundancy concept
became known as fail-safe structure. The capability of fail-safe structure to carry the required
residual strength was demonstrated initially by experimental testing, because analytical fracture
mechanics had not yet matured. Appendix K describes the early development of fail-safe testing
by US aircraft manufacturers. In these early years of establishing fail-safe structure, fracture
mechanics had not been proven to support its use in design.

Operational lives were established using fatigue tests and design analyses utilized safe-life
fatigue analysis methods based on elastic stress analysis, stress-fatigue life (S-N) curves, and
Miner‟s Rule. This approach also incorporated the evolving technology of reliability analysis.
The stress-fatigue life curves were based on smooth bar fatigue tests and notched coupon fatigue
tests.

In the later part of the 1950s and beyond, part of the fatigue design verification usually included
at least one full-scale fatigue test. One of the main functions of the full-scale fatigue test was to
uncover local high stress locations which were not identified by the structural analysis. Many of
the aircraft that were operating in the late 1950s and early 1960s did not have a full-scale fatigue
test until after failures due to fatigue in high stress locations occurred. For military aircraft, it
was realized in the late 1950s that operational loads monitoring was a key element required to
establish operational lives beyond the initial full-scale fatigue test. Unfortunately, in the early
years, the safe-life fatigue analysis approach did not accurately capture the rates at which fatigue
damage was accumulating in service.

For those aircraft that had design operational lives validated by full-scale fatigue tests (FSFT)
there still were early fatigue failures in service; these in-service failures were found to start at
manufacturing and material defects. For example, the F-5 (Appendix A.6) was fatigue tested to
16,000 cyclic test hours without failure, but failed in 1900 hours due to a tool mark in a highly
stressed radius at the speed brake cut-out in the lower wing surface, the KC-135 (Appendix B.2)
was fatigue tested to 55,000 cyclic test hours without failure, but experienced 28 instances of
unstable cracking (at 1,800 to 17,000 flight hours) in the wings due to poor quality fastener holes
in a very low toughness material, and the F-111 (Appendix B.5) was eventually cycled to 40,000
cyclic test hours (10 lifetimes) but failed in 105 hours due to a relatively large forging flaw in a
low toughness material. The lack of correlation between operational lives validated during the
design phase and those experienced during operational experience resulted in significant concern
to the aircraft community.

6
During the late 1960s and beyond, analytical fracture mechanics was demonstrated for accurately
predicting: 1) critical crack sizes in aircraft structure, 2) crack growth behavior, and 3) the effects
of various structural configurations on crack behavior (both slow crack growth and critical crack
extension). This capability made it possible to extend the structural design tool box to include
and anticipate the effects of manufacturing and material defects in aircraft structures. The
capability of fracture mechanics tools to predict the crack growth behavior in aircraft structure
made it the “approach of choice” for determining inspection requirements and operational limits
(in essence replacing the safe-life approach). The fracture mechanics tools provided the ability
to correlate fatigue test results (crack behavior) with expected behavior in service.

However, there were still challenges correlating full-scale fatigue test results and operational
experience. Two aircraft (i.e., the F-4, see Appendix A.6, and the Dan Air Boeing 707, see
Appendix A.9) were subjected to severe operational cyclic load spectra that were not simulated
in the original fatigue test and for one aircraft (the Aer Lingus Boeing 707, see Appendix A.10),
there is considerable doubt as to whether this aft area of the fuselage was included in the original
707 hydro-fatigue test.

Ultimately, the combination of experimental testing, operational load monitoring and analytical
fracture mechanics has provided the structural engineer with the tools for: 1) predicting the
residual strength of aircraft structure experiencing crack damage; and, 2) predicting fatigue crack
growth for use in establishing inspection requirements.

2.1 High Local Stresses

During the late 1940s and early 1950s the primary emphasis in the development of military jet
aircraft was static strength and there were no design service life requirements. As these aircraft
went into service operation, structural failures began occurring and there were many fatal
accidents, believed caused by high local stresses. It was quickly determined that during service,
fatigue cracks were initiating at high stress concentration zones within the structure. During this
early period, there was no requirement for full-scale fatigue testing which in many cases would
have revealed the cracking sites not uncovered during initial design analysis. Appendix A
provides summaries of accidents/incidents associated with high local stresses. See Table 2 for a
listing of accidents/incidents covered.

Appendix A.1 discusses the two accidents associated with catastrophic failures of the first jet
passenger aircraft, the Comet. The catastrophic failure of these two Comet airplane fuselages in
1954, due to uncontained fatigue cracking, had high local stresses around cut-outs not disclosed
by the original fatigue test. During the failure investigation, manufacturing defects were also
found in the recovered aircraft. Traditionally, Comet failures have been associated with high
local stresses, so we have elected to include these accidents under this threat category.

7
 Table 2. Accidents/Incidents Resulting from High Local Stresses

Appendix Aircraft Accident/Incident Identified Time Period

A.1 BOAC Comet G-ALYP and G-ALYY Jan & Apr 1954
A.2 USAF Northrop F-89 Spring & Summer 1952
A.3 USAF Republic F-84 1952-1954
A.4 USAF North American F-86 Throughout 1955
A.5 USAF Boeing B-47 Mar & Apr 1958
A.6 USAF McDonnell-Douglas F-4 1960s and early 1970s;
Jan 1973 (Nellis AFB)
A.7 Northwest Airlines Martin 202 Aug 1948
A.8 Argentine State Owned YPF AVRO 748 Apr 1976
A.9 Dan Air Airlines Boeing 707-300 May 1977
A.10 Aer Lingus-Irish International Airlines Boeing 707- Sep 1970
300
A.11 USAF McDonnell-Douglas F-15C Nov 2007

During the early jet age, failures also occurred in military combat aircraft. Failures that occurred
in three different fighter aircraft models (i.e., F-89, F-84, and F-86) are briefly discussed in
Appendices A.2 through A.4, respectively. The exact causes of these accidents remain
uncertain; however, they were generally attributed to fatigue cracking due to high stresses
resulting from excessive external loads, poor design and/or a manufacturing deficiency. While
these accidents were tragic, the problem of structural fatigue of military aircraft did not reach
crisis proportions until 1958, when there were five B-47 losses in the period of March 13 through
April 15, 1958 as discussed in Appendix A.5. As a result of these B-47 losses, General Curtis
LeMay, the USAF Chief of Staff, directed the Air Force to initiate an Aircraft Structural
Integrity Program (ASIP) [14, 15].

The new 1958 Air Force ASIP required a “safe-life” fatigue design approach based on the
assumption of initially flaw free structure. A stress-life fatigue analyses (using Miner‟s rule) plus
a scatter factor of four were required to arrive at the safe-life estimates. Likewise full-scale
fatigue tests were required to four times the design life goal to validate the operational life.
Furthermore, a flight loads monitoring program (operational surveys) was initiated for military
aircraft to determine if the aircraft were being operated to the spectrum to which it was designed,
This approach was used throughout the 1960s and early 1970s. There was no specific fail-safe
requirement, since it was believed that combat aircraft could not tolerate the weight penalties
involved. Nevertheless, the airplane manufacturers generally designed the military transports to
be fail-safe to the CAR 4b270 requirements with an eye on getting potential derivative
commercial aircraft certified by the commercial regulatory authorities.

While flight restrictions and modifications, which were imposed on the B-47, were able to
prevent any further losses due to fatigue before they were retired by 1966, the new safe-life
design and test requirements did not prevent failures and the loss of many other military aircraft
in the 1960s and early 1970s directly due to fatigue.

8
Several of these later failures are discussed in the compendium including the F-4 (Appendix
A.6), F-5/T-38 (Appendix B.1) and F-111 (Appendix B.5). As discussed in Section 2.2, it was
the F-111 accident that precipitated the Air Force to revise their ASIP, where they abandoned the
safe-life approach to fatigue design and incorporated damage tolerance requirements.

Many fatigue cracks initiate at high local stress concentrations that are not analytically predicted
during initial design, but are later revealed during component or full scale fatigue testing. Once
identified, these locations should be added to the fracture-critical locations and either be
modified to reduce the local stress concentration or monitored by inspections based on the
predicted growth of the maximum probable initial flaw that may exist at these locations.
However, as described above, in the early 1950s (and much later for some commercial aircraft)
fatigue tests were generally not performed prior to cracks occurring during service operation and
these cracks oftentimes caused catastrophic failures. This was the case for all of the accidents
described in Appendices A.2 through A.5 plus A.7 and A.8.

Even with timely full-scale fatigue tests, the loads and local stress distributions are sometimes
not adequately represented and local stress concentrations are identified by cracks or failures that
occur in service. For example, the predicted loads and/or load spectrum may be deficient and
thus the actual loads or load spectrum may not be represented accurately in the fatigue test
spectrum. Two examples are shown in Appendices A.6 and A.9. In these examples, the failures
resulted from more severe cyclic load spectra than predicted combined with manufacturing
and/or service induced defects.

While catastrophic failure was avoided because of the fail-safe design of the fuselage, the
specific cause of the Aer Lingus-Irish International Airlines Boeing 707-300 depressurization
described in Appendix A.10 is not completely understood. The 707 fuselage was subjected to a
hydro-fatigue test; however, the main deck cargo door, where this failure occurred,
apparently was not included in the original 707 hydro-fatigue test. The fuselage crack and
depressurization was precipitated by a fatigue failure of a fuselage frame with fatigue cracking
also observed in adjacent frames. This could have been caused either by 1) high local stresses not
accounted for in the analyses and not included in the hydro-fatigue test or 2) manufacturing or
maintenance damage. Due to the lack of a specific evidence of such pre-existing damage the
authors have included it in the high local stress category.

2.2 Manufacturing and Material Defects

There are a myriad of possible manufacturing defects that can become initiation sites for fatigue
cracking. Fastener holes have been particularly prone to a variety of drilling defects (e.g., burrs,
tears, score marks, double drilled holes, burns, nicks, mislocated holes, short edge margins).
Fastener hole defects account for many past fatigue cracking incidents and failures in both
military and commercial aircraft. However, there have also been cracking incidents and failures
due to other types of manufacturing deficiencies such as weld defects (e.g., shrinkage cracks,
tungsten inclusions, sharp edged porosity), heat treat cracks, scribe marks, sanding marks,
gouges, dents, grinding burns, arc burns, tool marks, scratches and machining discrepancies.

9
In addition, a number of different material defects exist that can and have become initiation sites
for fatigue and/or stress corrosion cracking. These include inclusions, laps and sharp edged
porosity in steel, aluminum and titanium forgings, inclusions and sharp edged porosity in steel
aluminum and titanium castings, potential separation of large grain microstructure in beta
titanium, delaminations in some thick aluminum plate and composite materials and hydrogen
embrittlement (blisters and cracks) in steel forgings. For example, it was a forging lap that
initiated the fatigue crack that caused the crash of the F-111 at Nellis AFB in December of 1969
and caused the USAF to re-examine its approach to fatigue design and resulted in the
development of damage tolerance requirements (See Accident/Incident described in Appendix
B.5 in the Compendium).

Discussions of some past failures that initiated at manufacturing and material defects are
provided in Appendix B (See Table 3 for a listing of these structural failures). Appendix B
includes several examples where defects resulted in the loss of the aircraft. It also includes
several examples where fail-safe construction prevented an element failure from becoming a
catastrophic loss of aircraft.

Table 3. Accidents/Incidents Resulting from Manufacturing and Material Defects

Appendix Aircraft Accident/Incident Identified Time Period

B.1 USAF Northrop F-5/T-38 Apr 1970
B.2 USAF Boeing KC-135 1966-1977
B.3 USAF Douglas C-133 Feb 1970
B.4 Curtis Wright X-19 VTOL Mid-1965
B.5 USAF General Dynamics F-111 Dec 1969

A USAF study of 12 fleets of aircraft in the late 1960s indicated that more that 56% of all fatigue
cracks initiated from pre-existing manufacturing and material defects [16]. Recognizing that it
would be impossible to predict and model all of the potential types of manufacturing defects, the
Air Force with the concurrence of an AIA committee decided (in the early 1970s) to assume an
initial corner flaw (i.e., 0.05-inch corner crack) as the surrogate for all the possible types of
fastener hole defects. Unless a different initial flaw size could be justified, this flaw size was then
used in crack growth analyses to establish safety limits and inspection requirements. In addition,
an initial surface flaw was selected as the surrogate for possible manufacturing defects away
from fastener holes.

While there has been continuing pressure over the years to relax these initial USAF flaw size
assumptions, three and one-half decades of success is strong testimony for continuing the current
approach. Nevertheless, the success of a slow crack growth damage tolerance approach depends
on in-service inspections, which have not always been reliable, and does not protect against
larger damage sizes that occasionally occur. Therefore, wherever possible new aircraft should be
designed to be fail-safe.

10
Manufacturing and materials defects not only affect aircraft structures but also other critical
subsystem structural components. One good example of this is the propulsion system structural
failure that caused the United Airlines 1989 DC-10 accident in Sioux City, Iowa (see Appendix
F.1). The root cause of this accident was a hard alpha inclusion in a titanium forging that
initiated a crack that propagated to failure. The control of these types of defects has generally
been through improved processing (e.g., triple vacuum melt and hydrogen removal through
baking) and factory inspections. The maximum probable initial flaw size used in the
establishment of inspection requirements has generally been based on inspection capabilities.
Inspection capabilities for propulsion systems have been normally determined using NDI
probability of detection (POD) experiments, rather than an assumed initial flaw size.

In the case of the F-111, it became apparent that it was not possible to rely on NDI to detect the
very small flaws that could result in another catastrophic failure and as a result the cold proof test
was used to establish the maximum probable initial flaw sizes in the high strength D6AC steel.
This test was initially repeated at 1500 hour intervals then later extended to 3000 hours based on
a revised assessment of aircraft usage and predicted crack growth rates.

In the case of the F-22 titanium castings, the maximum probable initial flaw size developed for
shell and hard alpha inclusions was much larger than the USAF standard assumed initial flaw
sizes. General Moore discussed the challenges this problem represented as part of his 2007 ASIP
Conference presentation [17]. Thus, it is obviously a gross oversimplification to say that the Air
Force inspection requirement is simply one-half the time for the traditionally assumed initial
flaw (e.g., the 0.05 inch corner crack) to grow to failure.

2.3 Maintenance Damage/Deficiencies

The same type of defects that occur during the initial manufacturing can often and do occur
during modifications, maintenance and repair activities. In fact, the likelihood of occurrence may
be higher than it is in the factory depending upon where the activities take place and the skill and
training of the mechanics and the inspectors, as well as the processes/procedures used to ensure
that repairs are properly designed and installed. The accidents/incidents summarized in Table 4
provide examples of failures due to service induced maintenance damage.

Table 4. Accidents/Incidents Resulting from Maintenance Damage/Deficiencies

Appendix Aircraft Accident/Incident Identified Time Period

C.1 Beech 99 Commuter Aircraft July 1990
C.2 Eastern Airlines Boeing 727 Dec 1988
C.3 American Airlines McDonnell-Douglas DC-10 May 1979
C.4 Japan Airlines Boeing 747SR Aug 1985
C.5 China Airlines Boeing 747 May 2002
C.6 Chalk Airways Grumman Mallard G-73 Dec 2005

11
Appendices C.1 and C.2 describe incidents where the maintenance damage did not result in fatal
accidents. Appendix C.1 involves a non-fail-safe commuter aircraft where the fatigue crack
initiated from maintenance damage and had degraded the residual strength below limit load, but
the crack was fortunately discovered in a routine inspection before it could cause failure.
Appendix C.2 is an example where the maintenance damage caused unstable crack propagation
in the fuselage of an airliner, but the fail-safe design caused crack arrest thus avoiding a probable
catastrophic failure.

Appendices C.3 through C.6 all involve fatal accidents resulting from maintenance damage and/
or deficiencies due to non-compliance with the Original Equipment Manufacturing (OEM)
Structural Repair Manual (SRM). The DC-10 accident (Appendix C.3) was the result of the
airline using an expedited engine removal and reinstallation procedure (not recommended by the
OEM) that inflicted undetected damage to the engine pylon. While fail-safety had been a major
consideration in the design of the pylon, it was not fail-safe for the particular damage that caused
this accident. The Grumman Mallard accident (Appendix C.6) was another non-fail-safe
commuter aircraft where the fatigue cracking resulting from a faulty repair in the wing spar cap.
This crack went undetected thus causing the failure of the spar and loss of the airplane. Two of
the six fatal accidents (Appendices C.4 and C.5) were caused by uncontained depressurization of
the fuselages. In both cases, the fail-safe fuselage designs were compromised by faulty repairs of
previous tail-strike damage. In one case (Appendix C.5) the repair was not designed and
manufactured in compliance with the OEM‟s SRM and in the other case (Appendix C.4) it was
not manufactured and installed in accordance with the design.

To improve the integrity of the repairs of pressurized fuselages the FAA issued an Advisory
Circular on December 14, 2000 [18]. This was followed on November 20, 2007 with an
Advisory Circular that addressed requirements for damage tolerance inspections for repairs and
alterations [19].

2.4 Environmental Damage

2.4.1 Corrosion and Fretting

In most cases general pitting corrosion is visually detected and repaired before safety becomes an
issue. However, there have been a few cases in the past where corrosion either went undetected
or was ignored and resulted in catastrophic accidents. Table 5 identifies two accidents resulting
from corrosion. The first accident occurred in October 1971, when a British European Airlines
Vickers Vanguard 951 had the aft pressure bulkhead (which was not fail-safe) fail due to
corrosion. This is briefly described in Appendix D.1. The second accident resulted in the loss of
a Far East Air Transport Boeing 737 in 1981 due severe corrosion. It appears that this accident
occurred as a result of gross negligence. The corrosion was so severe over a wide area of the
lower fuselage that the skin thickness was reduced by over 70% and the frames were severely
corroded. The fail-safety of the structure was destroyed and the residual strength reduced to
below the design operating stress levels. See Appendix D.2.

12
 Table 5. Accidents/Incidents Resulting from Environmental Damage

Appendix Aircraft Accident/Incident Identified Time Period

D.1 British-European Airlines Vickers Vanguard 951 Oct 1971
D.2 Far Eastern Transport Boeing 737 Aug 1981

Subsequent to the introduction of DT based inspections on Air Force airplanes in the 1970s, it
was expected that DT inspections would detect any cracking that would initiate from corrosion
pits or due to fretting before the cracks become critical. It seemed inconceivable that cracks
could initiate and grow to a critical size faster than a pre-existing 0.05-inch corner flaw or a
0.125-inch deep surface flaw could reach critical size. However, this assumption needs to be
carefully re-examined in cases where one is counting on the benefits of cold working or
interference fit in the establishment of the initial DT inspection.

2.4.2 Stress Corrosion and Corrosion Fatigue

Subcritical crack growth in aluminum alloys caused by a combination of sustained load and a
stress corrosion mechanism generally occurs in the plane parallel to the primary applied stresses
(i.e., the short transverse direction) thus very large cracks occur and are generally detected before
structural failure occurs. This is particularly true of the older 7000 series aluminum alloys with
T6 tempers, which typically have very low threshold stress intensity factors for stress corrosion
cracking (i.e. measured by a low KISCC) in the short transverse direction. The KISCC values for
aluminum alloys in the long transverse and longitudinal directions are usually very high and thus
sustained stress crack growth is not a problem until the crack approaches its critical size. Below
the threshold for stress corrosion cracking, the time at stress or the cyclic frequency seems to
have very little effect on fatigue crack growth and thus corrosion/fatigue should not be an issue
in this regime. In other words, if sustained stress crack growth does not occur until the crack
approaches its critical size, it will have negligible effect on total crack growth life.

On the other hand, in high strength carbon steel alloys the KISCC values can be very low in all
grain directions and stress corrosion can occur even in relatively benign environments. Both
sustained stress crack growth and corrosion/fatigue are important issues in these alloys. High
strength carbon steels have typically been used in landing gear components, flap tracks,
pressurized fuselage ramp hooks, and in gears and fittings in rotorcraft where resistance to wear
is an important consideration. Although a number of measures are generally taken to preclude
stress corrosion such as protective coatings (from the environment) and shot peening to introduce
favorable compressive residual stresses, numerous component failures have occurred.
Fortunately landing gear failures have generally occurred during taxing and turning and have not
been catastrophic. Also, most of the in-flight airplane failures have involved fail-safe
components and thus have not resulted in loss of the aircraft. On the other hand, there have been
a few rotorcraft failures, which were catastrophic.

Stress corrosion and corrosion/fatigue can also be issues in some titanium alloys. However,
titanium is much more corrosion resistant than steel and aluminums in normal humid
environments, but can be reactive when exposed to some chemicals. For USAF aircraft designed
during the 1970s and beyond, the fracture mechanics design approach to address estimating

13
sustained cracking and corrosion fatigue lives was to: 1) utilize testing and material data (da/dN
vs. K) to ensure that the aircraft structure is designed to operate in the appropriate environment;
and 2) chose materials which have high KISCC values. A discussion of this approach can be
found in Ref 20.

2.5 Discrete Source Impact

Survivability and vulnerability requirements and the Live Fire Test Law (10 U.S.C. 2366) are
resulting in a higher degree of redundancy and fail-safety in the military‟s newer aircraft than has
existed in some of its older combat aircraft. The need to be able to sustain armor piercing
incendiary (API) and high explosive incendiary (HEI) hits and hydraulic ram effects without loss
of the aircraft is forcing the use of high fracture toughness materials and multiple load path
structural configurations. This tends to result in an inherent degree of fail-safety in new aircraft
designs even though the aircraft are certified damage tolerant based on slow crack growth
concepts. For the F-22 this is discussed in some detail in the 1995 NRC report entitled, “Live
Fire Testing of the F-22” [21]. Other than battle damage, aircraft structure has often been
subjected to many other types of discrete source impact damage. These include impacts from
dropped tools, collisions with ground equipment, uncontained engine failures, bird strike,
runway debris, and on board explosions.

2.5.1 Ground Equipment

Since damage caused by discrete source impact or enemy fire is generally visually detectable by
ground personnel or in-flight evident, special NDI inspections are generally not necessary.
However, some damage resulting from impact from tools or ground equipment is not always
immediately evident. This may be particularly true of structures made from fiber composites. In
such cases, catastrophic failure has been prevented due to the large damage capability afforded
by fail-safe design. Two examples of this are listed in Table 6 and are discussed in Appendix E.

Table 6. Accidents/Incidents Resulting from Impact from Ground Equipment

Appendix Aircraft Accident/Incident Identified Time Period

E.1 Alaska Airlines McDonnell-Douglas MD-80 Dec 2005
E.2 Varig Brazilian Airlines Boeing 747 May 1988

Probably the three major threats for non-combat discrete source impact are uncontained engine
failures, bird strike and runway debris. These are discussed separately below in subsections
2.5.2, 2.5.3 and 2.5.4, respectively

2.5.2 Uncontained Engine Failures

Since the inception of commercial jet aircraft more than five decades ago there have been many
structural failures of gas turbine engine rotors due to many causes such as foreign object damage
(FOD), manufacturing defects, material defects, design errors and environmental damage.
Fatigue crack growth often occurs prior to the actual component failures.

14
Probably one of the most comprehensive studies of aircraft gas turbine engine rotor failures in
United States commercial aviation was performed by Galaxy Scientific Corporation in
conjunction with the FAA Technical Center in Atlantic City, N.J. This study is reported in the
FAA report; AD-A256-045 [22] dated June 1992 and is entitled, “Statistics on Gas Turbine
Engine Rotor Failures that Occurred in U.S. Commercial Aviation during 1989”. The statistics
were based on data reported in FAA Service Difficulty Reports (SDR) and in the
Accident/Incident Data System (AIDS) and concentrated on a detailed evaluation of 1989 data,
however, it also reported on uncontained engine rotor failures over the 27- year period from 1963
through 1989.

In 1989 there were 435 gas turbine engine rotor failures reported in U.S. commercial aviation.
Rotor fragments were generated in 156 of these failures and of these 24 were uncontained. An
uncontained rotor failure is defined as a rotor failure that produces fragments which penetrate
and escape the confines of the engine casing and which could inflict damage on aircraft structure,
systems and/or personnel. Of these 24 uncontained failures, 18 involved blade fragments and 6
involved disk fragments. Figure 1 shows the distribution of uncontained engine rotor failure for
the years 1963 through 1989.

Figure 1: Uncontained Rotor Statistics (1963-1989) [22]

15
It should be noted that, prior to 1988, the data in Figure 1 include only the uncontained rotor
failures that were reported in SDRs and not from AIDS, so those earlier years may under
estimate the number of failures. In total the figure shows about 500 uncontained failures in the
U.S. over the 27-year period.

Although fragments from uncontained rotor failures have inflicted serious damage to commercial
(and military) aircraft structures, it has been relatively rare that the damage has resulted in loss of
commercial aircraft and/or loss of life. This can be directly attributed to the decision made in the
early 1950s by the large US commercial airplane manufacturers (i.e., Boeing, Douglas and
Lockheed) to design their structures to be fail-safe and later by the CAB to include the fail-safe
option in the Civil Aviation Requirements (CAR).

Table 7 summarizes a number of aircraft accidents/incidents resulting from uncontained engine

failures and the types of airframe damage that are created during such an event. Detailed
discussion of these accidents/incidents can be found in the corresponding Appendix F.

Table 7. Accidents/Incidents Resulting from Uncontained Engine Failures

Appendix Aircraft Accident/Incident Identified Time Period

F.1 United Airlines McDonnell-Douglas DC-10 Jul 1989
F.2 National Airlines McDonnell-Douglas DC-10 Nov 1973
F.3 Air France Airlines Boeing 747 May 1971
F.4 UTA Boeing 747 Jan 1985
F.5 Delta Airlines McDonnell-Douglas MD-88 Jul 1996
F.6 Mesa Airlines Bombardier Regional Jet CRJ 200 Jan 2007
F.7 American Airlines Boeing 767 Jun 2006

One example of a 1989 uncontained engine failure that did result in the loss of the aircraft was
the United DC-10 accident in Sioux City, Iowa. While the airframe structural damage did not
directly result in the accident, an engine disk fragment cut through an 8-inch wide passage
containing hydraulic lines for the three redundant hydraulic systems. It cut all three lines
draining the hydraulic fluid and causing loss of the airplane control systems. The crew had to try
and control the airplane by varying engine thrust between the two wing mounted engines, but
were unable to prevent the crash landing. Further detail as to the cause of this accident is briefly
discussed in Appendix F.1.

Appendices F.2 through F.6 provide several examples of where the structural fail-safety was able
to prevent loss of the aircraft. Appendix F.7 shows an uncontained rotor failure where both
engines were disabled on a Boeing 767 during a ground run.

16
2.5.3 Bird Strikes

It has been recognized for many years that aircraft collision with birds as well as other types of
wildlife (e.g., deer on runways) can result in damage to aircraft and in some instances pose a
threat to structural safety. The FAA has established bird strike structural design requirements and
in 1991 joined with DOD and the Department of Agriculture to form the “Bird Strike Committee
USA” to collect bird strike data, and facilitate information exchange between the various
stakeholders.

The design requirements for Part 25 transport aircraft are specified in the CFRs. The design
requirements are that the aircraft must be able to safely complete the flight after an 8 pound bird
strikes the empennage or a 4 pound bird strikes anywhere else on the airplane (e.g., the fuselage
or wings) at the design cruise speed. It also says that the windshield must be able to withstand
the impact of a 4-pound bird without penetration at the design cruise speed. Nevertheless, aircraft
occasionally encounter larger birds and very often encounter smaller birds.

The Joint Service Specification Guide JSSG-2006, Aircraft Structures [23], provides an
opportunity to define design requirements for bird strikes (as bird FOD) in Section 3.2.24.1 as
well as for verification requirements in Section 4.2.24.1; however, tailoring necessitates that bird
sizes and aircraft speed be chosen consistent with the aircraft missions. The JSSG document
provides rational, guidance, lessons-learned, and instructions for bird strikes in Appendix A
section A.3.2.24 [23]. In Appendix A, the guidance is applicable to any type of FOD including
that due to bird strikes and states that “The maximum acceptable frequency of loss of the air
vehicle or the incapacitation of the crew due to FOD impact is 1 x 10-7 per flight.” Figure 8 in
Appendix A of JSSG-2006 provides a graphical summary of the relative percentages of bird
strikes as a function of aircraft structural component.

The Bird Strike Committee (BSC) USA reported 7500 bird strikes with US civil aircraft in 2007
[24] and the Air Force reported 5,000 with USAF aircraft in 2006 [24]. In addition the BSC
estimated that 80% of the strikes to civil aircraft go unreported. The BSC also reported that
during the 15 year period ending in 2006 the cost to civil aviation was over $600 million per
year, there were more than 30 incidents necessitating emergency landings and since 1988, 219
people have been killed worldwide as a result of bird strikes.

From FY1985 to 2007, there has been approximately 3300 wildlife strikes on USAF aircraft in
the United States annually, and over this period the number has been increasing (in FY2007 4780
wildlife strikes occurred) [25]. From FY1973 to FY2007 (a 35 year time period), the USAF
Safety Center recorded 42 aircraft destroyed by bird strikes, an average of just over one a year
[25].

In a 2003 report [26], John Thorpe, the honorary chairman of the International Bird Strike
Committee (IBSC), noted that the major bird strike threat to airliners and executive jets has been
bird ingestion in the engines. Bird impacts on the windshields and the airframes have been lesser
threats. On the other hand, for general aviation airplanes and helicopters accident rates are higher
and bird impact on windshields and airframes were the major threats. He surmised that this was
due to the fact that these types of aircraft operate at lower altitudes (i.e. higher density of birds)

17
and the fact that these aircraft are usually designed and built to lower structural standards than
the large transport aircraft. He also pointed out that fatal accidents of jet airliners as a result of
bird strikes are extremely rare. He noted that up to 2003 there had only been one fatal accident of
a jet-powered airliner in over one billion flying hours. This was the Ethiopian Airlines Boeing
737 that crash landed near Bahar Dar, Ethiopia in 1988 due to loss of propulsion. This aircraft
encountered a flock of pigeons shortly after takeoff and ingested birds in both engines causing
the engines to surge and then lose power. The airplane was forced to make a wheels-up landing
in a field a few miles from the airport. The airplane caught fire on impact and 35 of the 104
persons on board died.

While there has only been this one fatal bird strike accident of a jet airliner through 2002, the
IBSC stated that there have been two other fatal propeller airliner accidents resulting from bird
ingestion in the engines and one resulting from a bird strike on the airframe. Also, there have
been several jet airliner bird strike accidents where the airplane was destroyed but there were no
fatalities and there have been numerous aircraft that have been damaged by bird strike (to
engines, airframe and/or windshields), but have been repairable.

The commercial airline accident attributed to bird strike that had the most fatalities was a
turboprop; an Eastern Airline Lockheed Electra. On October 4, 1960, the Electra plunged into
Boston Harbor shortly after taking off from Logan Airport, killing all but 10 of the 72 persons
aboard. The presence of many dead birds on the Logan runway indicated that the accident might
have been caused by ingestion of birds into the aircraft‟s engines. Subsequent investigations
provided evidence that Starlings were ingested in the No. 1, 2 and 4 engines. The No. 1 engine
shut down and the No. 2 and 4 engines had intermittent loss of power. This caused the aircraft to
lose speed, stall and dive into the harbor.

The fatal propeller airliner accident due to bird strike on the airframe was a United Airlines
Vickers Viscount. This accident is noteworthy in that it had a direct impact on regulatory design
requirements. As reported by the NTSB, on November 23, 1962, this aircraft was struck by
whistling swans while cruising at 6,000 feet on a flight between New York and Washington. A
swan struck the leading edge of the left horizontal tail and exited through the rear elevator
surface causing the complete separation of the left horizontal tail and loss of control of the
aircraft. The airplane crashed and none of the 17 persons on board survived. It was this accident
that resulted in the “eight pound bird strike design requirement” for tail surfaces on transport
aircraft.

In addition to the non-fatal U.S. Airlines Flight 1549 (Airbus A320) that crash landed in the
Hudson river on January 15, 2009 after ingesting geese in both engines, there have been several
other non-fatal accidents of jet airliners that resulted in the total loss of the aircraft. These
include a McDonnell Douglas DC-10 in New York in 1975, a Boeing 737 in Belgium in 1978
and an Airbus A300 in India in 1986. All resulted from bird ingestion in the engines.

Three examples of commercial and military transport aircraft that have survived significant bird
strike damage without loss of the aircraft or any fatalities are listed in Table 8 and briefly
described in Appendix G.

18
 Table 8. Accidents/Incidents Resulting from Bird Strikes

Appendix Aircraft Accident/Incident Identified Time Period

G.1 Delta Airlines McDonnell-Douglas MD-88 Feb 2008
G.2 American Airlines Boeing 767 Apr 2001
G.3 USAF Lockheed C-130 Aug 2005

Compliance with the FAR bird strike design criteria and the OEM‟s fail-safe design
requirements has significantly enhanced the bird strike resistance of transport aircraft. It is
doubtful that additional structural design requirements to further improve bird strike resistance of
transport aircraft are either necessary or justified. Improving the resistance of the smaller aircraft
and helicopters to withstand bird strikes seems desirable.

2.5.4 Runway Debris

The most serious accident that resulted from runway debris occurred to the Concorde supersonic
transport aircraft, which was developed to provide rapid air transportation between continents.
The accident resulted from runway debris that caused a tire to destruct/disintegrate and a major
tire part impacted and damaged the integral fuel tank under the left wing. The impact not only
caused a local penetration but also resulted in hammer shock damage to the fuel tank, resulting in
further structural damage to the airframe. Table 9 lists the appendix (H.1) that summarizes the
accident and its causes.

While FOD, such as resulted in the Concorde accident, does periodically cause airframe
structural damage as described by a presentation by Delta Airlines [27], it is more frequently a
serious worry for engine damage. Airports and military bases have FOD prevention activities
that effectively reduce the potential for aircraft and engine damage. These activities are focused
on clearing runways of debris before aircraft flights start using the runway. However, based on
the runway debris that has been found embedded in aircraft tires, relatively large pieces of debris
(bolts, tie down anchors, pieces of tire, etc.) could be flung into the airframe if the tire
disintegrates and releases the embedded debris. This threat is largely mitigated to ensure safety
by incorporating fail-safe concepts into those aircraft structural zones likely to experience FOD.

Table 9. Accidents/Incidents Resulting from Runway Debris

Appendix Aircraft Accident/Incident Identified Time Period

H.1 Air France Concorde Jul 2000

19
2.6 Explosive/ Ballistic Penetration of the Airframe

The military has long considered the threats associated with ground based weapon
systems/ground fire and have design and test procedures in place to ensure that ballistic
penetrations do not result in the immediate loss of aircraft. Typically, to ensure aircraft safety,
the areas of the aircraft subject to the ballistic threat are designed to be fail-safe. This fail-safe
structural redundancy is verified by testing as described in the beginning of Section 2.5.

Over the years there have been a number of civil aircraft lost as a result of explosive penetration
of missile warheads and on-board improvised explosive devices (IEDs) as a result of terrorist
acts. For example, between 1978 and 1999 more than 40 civilian aircraft were hit by shoulder-
fired missiles (e.g., the Soviet SA-7). While more than half of the aircraft (i.e., about 25) crashed,
some were able to sustain the damage inflicted due to fail-safe structural design and land safely.
World wide there were about 600 deaths as a result of these crashes. During approximately the
same time period (i.e., 1971 and 1996) there were 42 in-flight IED attacks and 19 on-ground IED
attacks. Of the 42 in-flight attacks there were 25 aircraft losses and 17 survived. Of the 61
attacks there were 40 aircraft losses and 21 were repairable. The most notable of the IED attacks
was the loss of Pan American Airlines Boeing 747 (Flight No. 103) over Scotland in 1988.

While the military have developed countermeasures that can defeat shoulder-fired missiles, the
airlines consider such countermeasures to be uneconomical. Consequently, commercial airliners
remain virtually defenseless against this threat. It appears that the most effective defense to date
has been for government and law enforcement agencies to keep the missiles out of the hands of
potential terrorists. Economically viable countermeasures may still be an option in the future.
With regard to protecting against IEDs, a 2001 British Civil Aviation Authority (BCAA) study
concluded that the threats cannot be eliminated but may be minimized through rigid security and
the use of hardened baggage containers, protective liners for the fuselage skin, and possible
further improvements in the fail-safe structural design [28].

In addition to explosive penetrations of the airframe from terrorist acts there have been a few
accidents and incidents caused by unintentional explosions. The most notable was the 1996
TWA 800 accident, where fuel vapors in the center fuel tank of the Boeing 747 were ignited
from an electrical short and the tank exploded in flight killing all the passengers and crew. Two
other explosions of fuel tanks have occurred on Boeing 737 aircraft during ground operations.
The most recent occurred on March 3, 2001 when a Thai Boeing 737-400 was destroyed by fire
on the apron at Bangkok Airport. Only the crew was aboard at the time, one of which was killed.
The other occurred in 1990 and was a Boeing 737-300 operated by Philippine Airlines.
Obviously these failures are not the result of inadequate structural design or structural
maintenance and the structure cannot be expected to survive such events.

However, there was a recent unintentional explosion that occurred on a Qantas Airline 747 (See
Table 10) where the large damage fail-safe structural design performed exactly as anticipated
and the plane landed safely without injury to the passengers or crew. While the accident
investigation is still ongoing, the initial findings indicate that the failure was the result of an
oxygen bottle explosion. This incident is briefly discussed in Appendix I.1.

20
 Table 10. Accidents/Incidents Resulting from Explosive Penetrations

Appendix Aircraft Accident/Incident Identified Time Period

I.1 Qantas Airlines Boeing 747 Jul 2008

As described above, several airliners were lost as a result of catastrophic explosions caused by
terrorist acts and unintentionally due to ignition of fuel vapors or from explosive cargo.
Obviously, such failures are not the result of inadequate structural design or maintenance and if
the explosive force is of sufficient magnitude fail-safe design may not be able to contain the
damage so as to allow a safe landing. However, fail-safe design has in some cases been able to
contain the large damage caused by internal explosions, such as illustrated by the recent Qantas
Airlines incident briefly described in Appendix I.1.

2.7 Excessive Operational Loads

An early recognized threat to structural safety was the application of an overload that exceeded
the aircraft design requirements; such overloads induced by various causes have resulted in
almost immediate catastrophic failures. Operational loads that have caused structural failures
were the result of excessive flight and/or ground loads (with or without pilot input or caused by
flight control system errors), excessive gust loads, excessive wind shear loads, acoustic loads,
vibrational instabilities due to flutter, transonic panel flutter, tail and/or outer wing panel buffet,
“whirl mode” aeroelastic phenomenon, harmonic oscillations, or other possible phenomenon due
to aerodynamic excitations and aeroelastic responses.

Babish [29] summarized all 37 USAF aircraft losses attributed to structural failures (as defined
by the USAF Safety Center) that have occurred to since 1972. Babish determined that seven of
the 37 structural failures were attributed to overloads caused by pilot error, flight control system
errors or to a combination of these two errors. Figure 2 provides a summary of the percentages
of catastrophic aircraft structural failures due to non-combat causes of the 37 aircraft.

While excessive operational loads can be and have been important threats to aircraft structural
safety that have caused both military and commercial accidents (e.g., Lockheed Electra, C-141,
F-15, F-16, B-52, Lockheed L-1011, Airbus A-320, Douglas DC-9, Boeing 747, etc.), they are
beyond the scope of this report. Knowledge of the operational loads and the potential for
excessive operational loads of is a key part of the structural design process. It is expected that a
future report will address the threat of excessive operational loads.

21
 Undetermined
Subsystems 3%
5%

Pilot Error, Fatigue

Flight System 44%
Control Error
19%

Maintenance
24%
Debond
5%

Figure 2: Percentages Associated with Types of Causes Associated with 37 USAF

Structural Failures [29]

2.8 The Onset of Widespread Fatigue Damage (WFD)

When aircraft reach or exceed their design lives as adjusted for their actual usage, the number of
cracking sites in fracture-critical areas continue to increase (i.e., fatigue cracks initiate at the
lower stress concentrations and less severe manufacturing and material defects). As long as these
cracks can be detected and repaired prior to reaching their critical sizes, the integrity of slow
crack growth designs can be maintained; however, when cracking occurs in multiple locations
the vulnerability of slow crack growth designs to inspection misses will increase and the large
damage residual strength of fail-safe designs can be lost. When cracking occurs in adjacent load
paths in multiple load path fail-safe designs (i.e., multiple element damage, MED) or within the
load path in crack arrest fail-safe designs (i.e., multiple site damage, MSD), the large damage
residual strength can be lost.

Loss of fail-safety due to either the actual onset of WFD or the threat of WFD has been a serious
structural safety issue for both commercial and military aircraft for many years; however, there
have been relatively few accidents or serious incidents that are directly attributable to WFD. This
has been due to inspection, repair, modification, component replacement and actual aircraft
retirement actions that have been taken to protect structural safety. For example, in the late
1960s, the onset of WFD resulted in extensive inspections and center wing box replacements in
the C-130B and early E models; in the 1970s the threat of WFD resulted in the initiation of a
major wing modification program (i.e., the H-Mod Program) for the C-5A; in the 1990s, the

22
onset of WFD in the E-8C lower wings, led to the replacement of affected wing panels and the
onset of WFD resulted in bonded doubler and station 405 chordwise joint modifications in the C-
141 wings. In addition, the threat of WFD in the wing spanwise splices contributed to retiring the
C-141s with the last retirement occurring in 2006. Also, a decision to replace center wing boxes
in additional C-130 aircraft occurred in the mid-2000s. Additional details on many of these
actions are provided in Appendix A of the National Materials Advisory Board (NMAB) report
[30].

Probably, the two major accidents resulting directly from the WFD threat were both on aircraft
operating under the FAA Civil Aircraft Rules and, in both cases, the National Transportation
Safety Board (NTSB) criticized the FAA for not mandating recommended inspection and
maintenance requirements. These accidents were the 1988 Aloha Airlines Boeing 737 accident
and the 2002 United States Forestry Service Lockheed C-130A accident. These two accidents
are referenced in Table 11 and described in the Compendium of Accidents/Incidents within
Appendices J.1 and J.2, respectively.

Table 11. Accidents/Incidents Resulting from Widespread Fatigue Damage

Appendix Aircraft Accident/Incident Identified Time Period

J.1 Aloha Airlines Boeing 737-200 Apr 1988
J.2 US Forest Service C-130A Jun 2002

As aircraft age, inspection reliability becomes ever more important (i.e., safety becomes more
and more dependent on finding and repairing these cracks) and the inspection burden and
airplane down times can overwhelm the operators and depots and jeopardize operational
readiness. A critical issue is to predict when this is likely to happen, so as to provide adequate
lead-time to prepare and obtain funding for the airplane replacement or modifications. The
military (USAF and US Navy), the commercial airlines and the OEMs have NOT done a good
job at this.

The authors believe that the most valuable tool for predicting the onset of WFD or when
durability-related generalized fatigue cracking is likely to occur, is through the use of teardown
inspections of both full-scale fatigue test articles and high time/usage airplanes. Assuming that
the crack growth models have been validated for the fracture-critical areas, the findings from
these teardown inspections can be used to analytically develop equivalent initial flaw size (EIFS)
distributions. These, in turn, can then be analytically projected forward using the same crack
growth models and the actual usage spectra to predict current and future crack distributions.
These crack distributions can then be used to assess the risk of failure at any specific critical
location as well as when the cracks will likely be of sufficient size and density to cause loss of
fail-safety or when the inspection system required to protect slow crack growth designs will be
completely overwhelmed and safety severely jeopardized.

The key to having a believable risk analysis depends on having believable crack distributions,
which can only be obtained if good EIFS data are obtained from: 1) full-scale fatigue test
teardown inspections and validated crack growth models for the structure being analyzed; or, 2)
teardown inspections of actual high time/usage aircraft plus validated crack growth models.

23
2.9 Summary of Threats and Their Associated Mechanisms

Table 12 summarizes the threats to structural safety and their associated mechanisms of failure.
Five of the threats typically result in fatigue failures in the structure; such failures have been
most difficult to anticipate primarily due to the large number of variables which can affect the
times to develop critical crack sizes in the operational environment. The design engineer has
utilized fracture mechanics technologies and the results from full-scale fatigue test to mitigate
many of these threats. However, as aircraft structures are used beyond their initial intended
design life goals, new unidentified cracking sites and cracking behaviors are again leading to
new catastrophic structural failures, The fatigue mechanism has been the dominant cause for
past structural accidents/incidents.

Table 12. Listing of Threats and Their Associated Mechanisms of Failure

Section Threat Mechanism of Failure No. of Examples in

the Compendium
2.1 High Local Stresses Fatigue 11
2.2 Manufacturing/Material Defects Fatigue 5
2.3 Maintenance Damage/Deficiencies Fatigue 5
2.4 Environmental Damage Corrosion (material loss) 2
2.5 Impact from Ground Equipment Fatigue 2
2.5 Impact due to Uncontained Engine Abrupt Cracking 7
Failures
2.5 Impact due to Bird Strikes Abrupt Cracking 3
2.5 Impact due to Runway Debris Abrupt Cracking 1
2.6 Explosive/Ballistic Penetrations Abrupt Cracking 1
2.7 High Operational Loads Overload not included in report
2.8 Widespread Fatigue Damage Fatigue 2

As described by this report, the various threats of impact can result in either immediate or
delayed aircraft structural failures. The abrupt cracking failures, caused by penetration due to
impacts, ballistic damage or explosions, are threats that have been largely addressed by
developing structural redundancies and fail-safe concepts into the airframe.

While most structural engineers believe that the problems associated with high operational loads
have been solved, accidents/incidents continue to be observed as a result of unusually high
operational loads caused pilot error or faulty flight control systems. Many airplanes have been
saved by the 1.5 factor of safety used to establish ultimate design loads.

With aircraft operating in aggressive environments, the potential for time-dependent attack
provides opportunities for corrosion attack (material loss mechanism), corrosion fatigue,
delamination/degradation of polymeric composites, and debonding of adhesively bonded joints.

While the time-dependent attack mechanisms degrade the strength over time in service, to date
they have been responsible for a limited number of catastrophic accidents. With proper
maintenance, and scheduled inspections to address the damage that results from environmental
attack, it is expected that this threat can be mitigated.

24
 CHAPTER 3.0 - MAINTAINING AIRWORTHINESS
As discussed in Chapter 2, cracks represent the major threat to maintaining structural safety
(airworthiness). Engineers have evolved DT structural concepts to protect structural components
from these threats. Structures are normally classified in one of two design categories: fail-safe
and non-fail-safe.

Fail-safe structures are designed to contain relatively large, visually-obvious crack damage from
causing catastrophic failure for a defined time period. Fail-safe structures generally require less
in-service maintenance and less intense inspections than those of the non-fail-safe variety.
Determining safe periods of operations between inspections require an understanding of the
nucleating fatigue crack populations in the unfailed parts of the structure.

Non-fail-safe structures can be designed to be structurally safe using the slow crack growth
design concept and DT based inspections to prevent a crack, if present, from growing to a size
that would cause catastrophic fracture of the component and thus loss of the aircraft. Safe
periods of operation between inspections are established based on slow crack growth behavior
for the type of cracks that could exist in the structure.

A study of aging aircraft structures reveals that despite the structural category, a damage
tolerance design concept can be overcome by durability-related fatigue cracking. This chapter
reviews DT structural design concepts and the operational limits associated with each damage
tolerance design concept utilized to control the effects of cracks on structures.

As further discussed below, it should be recognized that the operational limit associated with a
structural component is not necessarily the service life for the aircraft, since modifications to that
component, or even a change to the DT design concept, can extend the operational limit for that
component. In the past, owner/operators have invested in major modifications to KC-135, C-5A,
E-8C, C-130B/E, A-10, Boeing 737 and other aircraft, to maintain airworthiness while
continuing to satisfy mission and operational requirements. It should also be noted that the Air
Force has recently been establishing Service Life Limits (SLL) for their aircraft, which define
the time that corrective actions such as modifications or component replacements are required to
ensure continued airworthiness. These service life limits should be considered to be synonymous
with the operational limits described in this report and as proposed by the FAA in a 2006 Notice
of Proposed Rule Making (NPRM) to be mentioned later. They are not absolute limits in that
they can be extended once corrective actions have been implemented.

The eventual aircraft retirement (i.e., service life) generally involves multiple considerations well
beyond just structural modification requirements. Note however, if the operational limit (or
SLL) for a structural component is reached and no action is taken, structural safety is
compromised and the risks of catastrophic aircraft failures are high.

To maintain structural airworthiness, the Aircraft Structural Integrity Program described in MIL-
STD-1530C [31] provides overall direction and dictates when action must be taken based on the
risks of catastrophic structural failures. Section 5.5.6.3 of MIL-STD-1530C indicates that:

25
1. If the probability of catastrophic aircraft structural failure is at or below 10-7 per flight, the
risk is considered adequate to ensure safety for long-term military operations.
2. If the probability of catastrophic aircraft structural failure exceeds 10-5 per flight, the risk
should be considered unacceptable.
3. If the probability of failure is between these two limits, consideration should be given to
mitigating risk through inspection, repair, operational restrictions, modification, or
replacement.

Thus, the operational limit for any type of USAF structure (fail-safe or non-fail-safe) is given by
item 2 above, i.e., the operational limit is reached when the single flight probability of failure
reaches 10-5 per flight. Within the USAF, the 10-5 per flight limit can only be exceeded if the
service component executive accepts the risk of continuing flight to meet mission objectives.
Recently the Air Force has provided additional guidance in three 2008 Structures Bulletins, EN-
SB-08-001,-002 and -003 [11-13] to specifically address how operational limits for fail-safe and
non-fail-safe (single load-path) structures might be predicted. As discussed in these Structures
Bulletins, the approach to predicting operational limits, and the validation of these limits will
vary depending on the damage tolerance design concept, choice of materials and design stress
levels. For fail-safe structure, the structural operational limits are reached when the onset of
WFD has been reached. For the USAF this is equivalent to reaching the upper risk limit, 10-5 per
flight, for a catastrophic structural failure to occur.

There is a coupling between the MIL-STD-1530C and these recent Air Force Structural Bulletins
relative to establishing operational limits for aircraft structure to ensure maintaining
airworthiness. In some respects, the Structural Bulletins provide guidance in the absence of
current information within the Joint Service Specification Guide, JSSG-2006 [23]1.

The authors also note that in 2006, the FAA issued a NPRM [32] on Widespread Fatigue
Damage (which would require the operators to establish operational limits). As of August 2009,
the FAA had not yet released a final rule on this matter. In addition to predicting when structural
safety will be jeopardized due to the onset of WFD, as part of their policy change, the civilian
aircraft authorities should provide guidance on the validation and enforcement of operational
limits as well as to describe the actions that must be taken to protect the structural safety after the
limits have been reached and until the airplane structure is replaced or modified..

Generally, the predictions of the onset of WFD in fail-safe structure are heavily guided by the
results of the FSFT and its teardown inspection. Typically, the onset of WFD is reached at the
end of the durability life when many cracks are noticed at multiple locations in the structure. For
the USAF, MIL-STD-1530C suggests that the test life for the FSFT be extended beyond two
design service lives (based on the design spectrum), because the extensive cracking associated
with the onset of WFD does not always occur within the two lifetime test period. So unless the
time when the onset of WFD is revealed by the FSFT, estimates of this time are analytically
made based on EIFS data and expected crack growth behavior collected from coupon and feature

1
The structural bulletins document the USAF recommended changes to Ref. 23; before
incorporating such information into Ref. 23, coordination with the US Navy will be required.

26
tests. In either case, the onset of WFD is not expected to occur within one design lifetime of
operation.

Prior to approaching the estimate of the onset of WFD and durability-related fatigue cracking, it
is necessary to validate the estimate. This can be done by: 1) conducting at least partial
teardown inspections of high time/usage aircraft; 2) operating a robust surveillance program
(suggested by section 5.4.3.3 in MIL-STD-1530C) with good feedback on damage found to the
structures community (so that additional focused inspections of new cracking zones can be
conducted to verify the general nature of the cracking); and, 3) possibly conducting an additional
FSFT to a spectrum that more closely represents that which the fleet is flying. If it turns out that
the time estimate for the onset of WFD was conservative, additional testing and analysis is
required. A number of questions arise subsequent to the establishment of the time period for the
onset of WFD. These are documented within EN-SB-08-001 for fail-safe structure.

Some further background and comments are provided in the numbered sections below.

3.1 Multiple Load Path Fail-Safe Structures

With the multiple load path fail-safe structural design concept, the structure must retain its
required residual strength for a safe period of operational usage after the failure of a load path
due to any reason (e.g., manufacturing or maintenance induced defect, accidental damage,
environmental damage or discrete source damage) and whenever the failure might occur. The
adjacent load path or paths provide the second line of defense against catastrophic failure. It is
this adjacent structure that then controls the period of time that the aircraft is fail-safe. With the
eventual occurrence of MED the residual strength of the adjacent structure will be degraded.
The key is to predict when the MED (associated with durability-related fatigue cracking) has
progressed to the point such that it is likely that a fatigue crack of critical size under the
redistributed loads could exist in the adjacent structure.

An acceptable deterministic approach (based on initial crack sizes, sized as durability initial
crack sizes) to predicting when MED could occur is described in Structures Bulletin EN-SB-08-
001 [11]. A probabilistic approach (i.e., risk analysis), for predicting when a crack of critical
size (under the redistributed loads) could exist in the adjacent structure, is also acceptable
providing reliable crack population data are available to conduct such an analysis.

The questions that arise if the fail-safe operational limit is reached and there have been no
failures are:

 Has the fail-safe capability really been lost by virtue of MED in the adjacent structure?
 What is required to validate whether or not it has occurred?
 If so, how can the safety be protected until the airplane structure is replaced or modified?
 And, if MED has not yet occurred, how can the operational limit be extended? Some of
the approaches to answering these questions are given below.

It may require at least a partial teardown inspection of a high usage airplane to determine
whether or not the onset of MED has occurred when the predicted fail-safe operational limit has

27
been reached. This is particularly important if the predicted critical crack sizes are very small and
thus not detectable without fastener removal and non-visual inspections.

If it is concluded that MED does exist, the short term alternatives are: 1) groundings; 2) severe
operational restrictions to reduce stress levels (and thus increase the predicted critical crack
sizes) and slow the rate of crack growth; or, 3) DT slow crack growth inspections or proof testing
(if practical) to guard against failure of either the primary or the adjacent structure load paths
until the structure can be replaced or modified.

If it is concluded that MED has not yet occurred a careful teardown inspection of a high usage
airplane would be required plus a reassessment of when it is likely to occur. In addition,
consideration should be given to conducting an additional FSFT (or at least a component test) of
an existing in-service aircraft to a spectrum that is representative of the aircraft operational
spectra. Any FSFT should be followed with a careful teardown inspection.

3.2 Crack Arrest Fail-Safe Structures

Probably the best examples of crack arrest fail-safe structures are the pressurized fuselages on
commercial and military derivative transport aircraft. With this fail-safe concept, a crack in a
skin panel may attain critical size but the rapid fracture is arrested or contained because of design
features such as tear straps and/or shear tied frames. Ever since the Comet disasters in 1954, the
aircraft industry has strived for fail-safety through the selection of tougher materials, stress levels
and the incorporation of design features that provide for crack arrest. For example, a historical
summary of US testing methods for achieving fail-safe crack arrest structures is provided in
Appendix K.

The threat to the structural safety of crack arrest fail-safe structure (as well as to multiple load
path fail-safe structure) is WFD. While the specific type of WFD that threatens multiple load
paths is MED, the threat to crack arrest fail-safe structure is MSD, which is defined as, a type of
WFD characterized by the simultaneous presence of fatigue cracks in the same structural
element, such that fatigue cracks may coalesce with or without other damage leading to a loss of
required residual strength. The prediction of the fail-safe operational limit for crack arrest fail-
safe structure thus depends on predicting when the MSD will reach sufficient density and size
where the required fail-safe residual strength can no longer be maintained. Again, the MSD
event occurs as a result of numerous nucleated durability-related fatigue cracks.

Some experimental results reported by Jim Maclin, in a 1991 Boeing Commercial Airplane
Group paper [33] provided evidence of the significant effect that MSD has on fail-safe residual
strength. These test results from mechanically fastened aluminum panels have shown that very
small MSD in fastener holes (e.g., ~ 0.02-inch to 0.04-inch cracks) ahead of the arrested crack
can have a significant effect on the fail-safe residual strength (e.g., a 20 to 30% reduction in
residual strength). If such MSD existed in a pressurized fuselage and the design two-bay-damage
occurred (due to whatever reason), it would be very unlikely that there would be a safe
decompression. Indeed this is what happened when the 1988 Aloha Boeing 737 accident
occurred. In the Aloha accident, small MSD existed in several bays ahead of the lead crack that
had formed as a result of MSD cracks coalescing together. Because of the MSD that existed

28
ahead of the lead crack, the lead crack did not arrest at the two-bay-crack size and a large portion
of the upper fuselage was blown away, as shown in Appendix J.1.

Since such small cracks (e.g., ~0.02-0.04-inch) can cause loss of fail-safety, the prediction of the
onset of WFD (or MSD) becomes one of predicting when durability-related crack nucleation will
occur. Unfortunately, fatigue nucleation analyses (regardless of the life prediction methodology)
are notoriously unreliable for predicting when this will occur. The best measure of when the
onset of MSD will occur is from crack size data collected from the teardown inspection of the
FSFT article. This is particularly true for pressurized fuselages, since the pressure cycle is the
primary fatigue load and the test spectrum generally represents the actual operational spectrum
quite well. However, if the onset is to be quantified, the fatigue test duration needs to be
sufficiently long so that MSD occurs. If it does not occur in the required two-lifetime durability
test then one can be quite confident that the fail-safe operational limit is greater than the design
lifetime.

Not all MSD situations involve small cracks interacting with a large crack. For the C-130
rainbow fitting, small durability-related fatigue cracks nucleated in individual bolt-hole nodes of
the fitting. The rainbow fitting is a bolted joint which attaches the outer wing structure to the
center wing. When a bolt hole durability-related fatigue crack grew to a size of ~0.085-inch, the
crack rapidly extended across the bolt hole node (failing the node) and then arrested with a size ~
2-inch long. The small durability-related fatigue cracks challenged NDI capability, but 2-inch
cracks could easily be detected with existing field equipment. The real challenge to protect
airworthiness, however, was to ensure that no simultaneous bolt-hole node failures existed in any
set of three adjacent nodes in the fitting. Analysis showed that at least three simultaneous,
adjacent bolt-hole node failures with their 2-inch long cracks were required to reduce the level of
residual strength below the design requirement. In this MSD case, since inspections could detect
the presence of the 2-inch cracks at failed bolt-hole nodes, it was possible to provide an
inspection option and to reduce the risks of catastrophic failure and thus allow sufficient time to
start replacing high time rainbow fittings throughout the force, without grounding actions. This
MSD case involved the interactions of three relatively large cracks within the structural element.

For structure other than the pressurized fuselage that may rely on crack arrest fail-safety (e.g.,
wing and empennage skin and stringer panels), the teardown inspection of the FSFT is probably
still the best source for developing the predicted fail-safe operational limits. For such structure,
the MSD cracks, obtained from the full-scale fatigue test can be analytically backtracked to
develop an EIFS distribution. One can then analytically predict the growth of this distribution
(using the same crack growth model) for the actual usage spectrum and perform a risk analysis to
predict when the MSD will be of sufficient size and quantity to cause the fail-safe residual
strength to fall below the required level. The time, when the fail-safe residual strength falls
below the required level, is the fail-safe operational limit.

Validation of the fail-safe operational limit would require a teardown inspection of a high usage
airplane once the aircraft is approaching the predicted limit. If there is no evidence of MSD at
the predicted limit then extending this limit would probably require additional FSFT evidence.
TOGAA [34] suggested this approach in discussions of the FAR 25.571 Amendment 96, which
requires that there shall be full-scale fatigue test evidence that WFD (MSD) will not occur within
the design service goal (DSG). Thus, if a high time/usage aircraft teardown inspection validated

29
the presence of MSD and that the fail-safe operational limit had been attained (i.e., the fail-safety
had been jeopardized) then flight restrictions plus slow-crack-growth (DT) inspections could be
imposed (as an interim measure) until the structure is modified, replaced or the airplane retired.
For the USAF, it is necessary that the risk of catastrophic structural failure never exceed the 10-5
per flight limit established by MIL-STD-1530C.

As with the multiple load path fail-safe structure, when fail-safety is lost in crack arrest fail-safe
structure, one can attempt to manage the structure with slow crack growth DT based inspections
or with periodic proof testing until the structure is modified or replaced. If neither of these
options can be applied, the airplane should be grounded and the structure must be modified or
replaced at the fail-safe limit.

3.3 Non-Fail-Safe / Single Load Path Structures

With truly single load path structures, there is no second line of defense to structural element
failure. Catastrophic failure must be avoided by detecting subcritical cracks before they reach
their critical sizes (i.e., the first and only line of defense). While the assumed (surrogate) 0.05-
inch initial corner crack has been effective in protecting against rogue manufacturing defects in
metallic structures, single load path structures are still vulnerable to other threats that fail-safe
designs can protect against. While defining the safe operational limits for fail-safe designs is
relatively straightforward, it is more difficult to define a specific operational limit for single load
path structures.

When the USAF damage tolerance requirements were originally developed in the early 1970s, it
was believed that the DTbased inspections would protect single load path structures against
rogue flaws (as well as most other types of defects) indefinitely. As the airplane got older and
there were more and more critical areas to be inspected, and there was more and more durability
related cracking in these critical locations, it was thought that the economic burden associated
with all of the inspections and repairs would eventually force major modifications.

Thus, it was thought that inspections and modification would protect the structural safety while
economics and readiness would dictate the service life. Obviously, the problem with this
scenario is that it assumes that: 1) all potential critical cracking locations are identified; 2)
adequate inspection approaches are designed to detect cracks at these critical locations; 3) the
inspectors are adequately trained to apply the necessary NDI methods at the critical locations, 4)
all the required inspections will be performed as required; 5) the required inspections will
reliably detect all cracks before these cracks reached their critical sizes; and, 6) that the depots
have the resources (budget and skilled people) to address the increased inspection and repair
burden in a timely manner.

As discussed in a 2007 Aging Aircraft Conference paper [7], these assumptions are now believed
to be false. In fact, the poor inspection reliability could jeopardize safety well before the onset of
cracking events at multiple inspection locations. For a single load path element/component, if
the inspection reliability is poor at even a single inspection location, that is experiencing
frequently occurring cracks, the individual inspection location crack population may overwhelm
the inspection capability. Compounding the problem is that some military aircraft have reached
or are approaching the onset of durability related cracking at multiple locations. While inspection

30
reliability needs to be improved to protect against early failures, operational limits need to be
developed and enforced so as to help minimize the risk of encountering catastrophic failures as a
result of the inspection system missing a significant crack. A significant crack is one that has a
size that is large enough that it will grow to failure between inspections.

For truly single load path structures, the issue associated with establishing operational limits for
inspectable structures is primarily a function of the difficulties associated with adequately
performing inspections to ensure that no crack in the structure can grow to its critical size before
the next inspection. If cracks are occurring at multiple locations2 simultaneously (a type of
widespread fatigue damage), the inspection system [7] can be severely challenged to detect any
and all significant cracks that may be present at locations where a crack could cause a
catastrophic failure of the element/component/airframe.

To further complicate the-cracks-growing-simultaneously at multiple locations situation, for an

aging aircraft, while most critical locations are known and recognized, as a result either from
design (analysis and testing) experience or from prior in-service cracking experience, not all
potential critical locations show themselves until an accident occurs. (Typically, such accidents
occur after the structure has exceeded its demonstrated fatigue life, i.e., exceeded ½ the
equivalent flight hours associated with the full-scale fatigue test.)

For aging single load path structures, the occurrence of durability-related fatigue cracking
constitutes a type of generalized fatigue damage where multiple locations are simultaneously
experiencing durability-related cracking. The cracks at these multiple locations within the
structural element may interact or not. From experience, the multiple cracking locations in truly
single load path structures do not interact with each other and do not influence the damage
behavior at other critical locations before failure occurs. This means that if a number of
simultaneous cracking locations are occurring, each cracking location could separately lead to a
structural element/component failure when its crack reaches critical size. For some non-fail-safe
structures with multiple load paths, however, the multiple crack locations can separately
experience MED cracking and crack location interactions.

The need exists to define how much durability-related fatigue cracking is too much for non-fail-
safe or single load path designs. Determining how much durability-related fatigue cracking is too
much can likely be accomplished by performing a risk assessment on the cracking behavior at
the cracking locations. For the risk assessment to be believable, it is essential that the crack
populations be quantified (and then verified) as a function of time.

One approach to establishing the element/component operational limit would be to determine the
times when each cracking location reaches the USAF upper bound limit (10-5 per flight). The
location which takes the lowest time to reach the upper bound limit would be used to establish
the structural element‟s operational limit. If alternate inspection techniques/approaches can be
used to reduce the high risks associated with this location, or if modifications or element
replacements can be used to significantly reduce the structural airworthiness risks, then the time

2
A location is defined as a separate damage tolerance control point, i.e., if more than one crack exists in the
region, then each crack has the same stress-intensity factor, same stress, same crack configuration, same local
geometrical configuration, and the same crack growth curve.

31
for the next most likely cracking location to reach the upper bound structural risk would reset the
structural element‟s operational limit to this later time.

Simultaneous durability-related fatigue cracking at multiple critical sites normally starts

occurring when nucleation damage (due to typical material and manufacturing defects) at the
critical sites grows cracks that are large enough to be detected during in-service teardown
inspections of high time/usage aircraft. Most cracks at multiple known locations may be caught
by the inspection system; however, it is possible cracks may be growing at a number of unknown
locations. As a result of the number and size of these simultaneous cracks at multiple locations,
some significant cracks may be missed by the inspection system.

The time when a state of generalized cracking (a state where many locations are simultaneously
experiencing durability-related fatigue cracking) occurs may represent an absolute upper bound
operational limit for an aging single load path structure (or non-fail-safe structure). It should be
noted that this onset of generalized cracking is normally shortened when other in-service damage
mechanisms are operating, e.g., corrosion pitting, fretting damage, etc., simultaneously with
fatigue mechanisms.

As suggested above, surveillance inspections for damage in an aging aircraft are an important
ASIP activity to determine the presence of damage in zones: 1) where design and past history has
indicated such damage to occur; as well as 2) that have not previously indicated the potential for
damage. For single load path structure, it is especially important that the early detection of
damage be noted in all zones not previously identified during design or full-scale fatigue tests.
The surveillance requirement is identified in MIL-STD-1530C and approaches for conducting
surveillance inspections, and for recording, storing and reporting damage in aging aircraft
structures is presented in Ref 35. Using this feedback to conduct additional focused inspections
at new crack locations will reveal the extent of the problem and help dictate approaches that can
be used to mitigate structural risks.

In addition to the validation approaches used for fail-safe structure, for non-fail-safe structures,
maintenance feedback that provides the numbers, size and location of cracks can be used to
validate structural analysis models (damage tolerance models and risk models).

32
 CHAPTER 4.0 - CONCLUDING REMARKS
This report has defined the threats to aircraft structural safety and the accidents/incidents that
characterize the effects of each threat. It has also discussed how the threats have influenced the
development of regulations/codes and standards to mitigate the threat during both design and
operation.

The report was organized so that the tables (2-11) and the associated Appendices in the
Compendium can be updated as new accidents/incidents are written up; thus the report becomes
a living document for the structural integrity community.
The report cites the Aircraft Structural Integrity Program for diminishing the failures of single
load path aircraft structures (i.e., slow crack growth design concepts) due to fatigue and
environmentally assisted cracking caused by unanticipated high local stress concentrations,
manufacturing, material and maintenance defects. It also points out that fail-safe design is
required to protect the structural safety of aircraft against large damage threats (e.g., damage due
to discrete source impact) as well as the threats that can result in fatigue and/or environmentally
assisted cracking. Fail-safe design combined with damage tolerance analysis and tests has been
the primary factor responsible for protecting the structural safety of both civilian and military
transport aircraft.

This being said, the report points out that both fail-safe and slow crack growth design concepts
can be defeated by durability-related fatigue cracking and with the aging of both civilian and
military aircraft this becomes a major concern. Durability-related fatigue cracking manifests
itself in the literature as the onset of WFD. It is recommended that the operational limits be
developed for each of the aircraft structural design concepts relative to the onset of the type of
WFD (or durability-related fatigue cracking) that defeats the structure‟s ability to carry its
residual strength requirement:

 Multiple load path fail-safe structure is defeated by the onset of multiple element damage
 Crack arrest fail-safe structure is defeated by the onset of multiple site damage
 Single load path structure can be defeated by either a single location where inspection
capability is overwhelmed or by the onset of generalized cracking, where durability-
related fatigue cracking is simultaneously occurring at multiple (known and unknown)
locations.

While the operational limit for fail-safe structures has been reasonably accepted by the
community as the time when the onset of WFD occurs, the use of a similar durability-related
fatigue cracking concept for single load path structure is new.

4.1 Recommendations

 The US Navy should be given the opportunity to add accidents/incidents to the

Compendium in future updates of the report to improve its value to the overall military
fixed wing community.

33
 More attention must be given to determining the operational limits for single load path
structure.

 FAR 25.571 and JSSG 2006 should be updated to include more information that clarifies
the conditions establishing operational limits.

34
 CHAPTER 5.0 - REFERENCES
1. Civil Aeronautics Board‟s CAR Part 4b.270 adopted into the Civil Air Regulations as
Amendment 3 on February 7, 1956
2. FAA, Part 25 Airworthiness Standards: Transport Category Airplanes, amendment 25-45 to
FAR 25.571, final rule issued on 28 Sep 1978, effective 1 Dec 1978
3. FAA, Part 25 Airworthiness Standards: Transport Category Airplanes, amendment 25-98 to
FAR 25.571, final rule issued on 26 March 1998, effective 31 Mar 1998
4. Negaard, G.R., “The History of the Aircraft Structural Integrity Program,” Aerospace
Structures Information and Analysis Center (ASIAC), Wright-Patterson AFB, OH, 1980
5. Department of Defense, Military Standard, MIL-STD-1530A, “Aircraft Structural Integrity
Program, Airplane Requirements,” 11 Dec 1975.
6. Department of Defense (USAF); Military Specification, MIL-A- 83444 titled, “Airplane
Damage Tolerance Requirements,” 2 July 1974.
7. Gallagher, J.P., Butkus, L.M., Brausch, J.C., Babish, C.A., Malas, J.C., Berens, A.P.,
“Demonstrating the Effectiveness of an Inspection System to Detect Cracks in Safety of
Flight Structure,” Proc. of the 10th DoD/FAA/NASA Aging Aircraft Conference, April
2007, (http://www.jcaa.us/PublicLibrary/JCAAConferences/).
8. Butkus L.M,, Gallagher, J.P., Berens, A.P, Malas, J.C, Babish, C.A, “U.S. Air Force
Efforts In Understanding And Mitigating The Effects Of “NDI Misses”, Proceedings of the
24th International Committee on Aeronautical Fatigue Conference (ICAF 2007)
Symposium, Ed. L. Lazzeri & A. Salvetti, 16-18 2007, Naples Italy, Publ. by Pacini,, Vol.
I, pp. 288-305.
9. Brausch, J.C., “USAF NDI Reliability Improvements” Introductory briefing presented at
ASIP Panel Session on this topic by the session chair, Aircraft Structural Integrity
Conference (ASIP) Conference, 28 November 2006.
10. Gallagher, J.P., “A Review of Philosophies, Processes, Methods and Approaches that
Protect In-Service Aircraft from the Scourge of Fatigue Failures,” Proceedings of the 24th
International Committee on Aeronautical Fatigue Conference (ICAF 2007) Symposium,
Ed. L. Lazzeri & A. Salvetti, 16-18 2007, Naples Italy, Publ. by Pacini, Vol. I, pp. 1-36.
11. Air Force Structures Bulletin EN-SB-08-001, “Revised Damage Tolerance Requirements
for Fail-Safe Metallic Structures,” Aeronautical Systems Center, Engineering Directorate,
Wright-Patterson Air Force Base, September 2008.
12. Air Force Structures Bulletin EN-SB-08-002, “Revised Damage Tolerance Requirements
for Slow Crack Growth Design Concepts for Metallic Structures,” Aeronautical Systems
Center, Engineering Directorate, Wright-Patterson Air Force Base, September 2008.
13. Air Force Structures Bulletin EN-SB-08-003, “Fail-Safe Assessments of Current Aircraft,”
Aeronautical Systems Center, Engineering Directorate, Wright-Patterson Air Force Base,
September 2008.
14. Teletype message, AFCVC. C27229-M, Chief of Staff USAF, General Curtis Le May, to
Commander, Air Research and Development Command, et al., 19 November 1958.

35
15. Letter, Gen C.E. LeMay, Vice C/S, USAF, to Cmdr. AMC, Cmdr., ARDC, Subject:
Structural Integrity Program, 18 May 1959 (Contained in Ref. 4 as Appendix A).
16. Gran, Robert and Orazio, Fred, “Investigation and Analysis Development of Early Life
Structural Failures,” AFFDL-TR-70-149, March, 1971.
17. Moore, C.D., “Aircraft Structural Integrity and the F-22,” 2007 Aircraft Structural
Integrity Conference (ASIP) Conference, 4 December 2007.
18. FAA; Advisory Circular No. 120-73 titled, “Damage Tolerance Assessment of Repairs to
Pressurized Fuselages,” December 14, 2000.
19. FAA; Advisory Circular No. 120-93 titled, “Damage Tolerance Inspections For Repairs
and Alterations”, November 20, 2007
20. H.A. Wood, “The Use of Fracture Mechanics Principles in the Design and Analysis of
Damage Tolerant Aircraft Structures,” AGARD Publication, AGARD-AG-176, 1973, pp.
19-31.
21. NRC; National Research Council Report, “Live Fire Testing of the F-22 Aircraft,” National
Academy Press, Washington DC, 1995
22. Galaxy Scientific Corporation; “Statistics on Aircraft Gas Turbine Engine Rotor Failures
that Occurred in Commercial Aviation in 1989,” DOT/FAA Technical Report No. AD-
A256-045, June 1992.
23. Department of Defense, Joint Service Specification Guide, JSSG 2006, “Aircraft
Structures,” 30 October 1998.
24. Bird Strike Committee USA @ www.birdstrike.org; also see FAA, Federal Aviation
Administration National Wildlife Strike Database Serial Report Number 14 titled, “Wildlife
Strikes to Civil Aircraft in the United States 1990-2007”, June 2008.
25. USAF Safety Center Bird Strike database,
http://www.afsc.af.mil/organization/bash/statistics.asp
26. Thorpe, John; International Bird Strike Committee report no. IBSC/WP-SA1 titled,
“Fatalities and Destroyed Civil Aircraft Due to Bird Strike, 1912 – 2002,” Warsaw, 5-9
May 2003
27. J.H. Stephan, “FPD/Wildlife, An Airline’s Prospective,” Delta Air Lines Corporate Safety,
25 October 2005, www.fodnews.com/FOD_For_FAA-gif/slide001(...slide037).Htm
28. CAA; Civil Aviation Authority‟s Paper No. 2001/9 titled, “Aircraft Hardening Research
Program,” Published by Civil Aviation Authority, London, December 2001.
29. C.A. Babish IV, “USAF ASIP: Protecting Safety for 50 Years,” 2008 ASIP conference, San
Antonio, TX, 2 Dec 2008.
30. Tiffany, C.F. et al., “Aging of U.S. Air Force Aircraft,” National Research Council report
NMAB-488-2, National Academy Press, Washington D.C., Sep 1997.
31. DOD (USAF); Military Standard, MIL-STD-1530C titled, “Aircraft Structural Integrity
Program, (ASIP)”. 1 November 2005.

36
32. NPRM on widespread fatigue damage prevention dated April 18, 2006, contained in
Federal Register Doc 06-3621, Docket No. FAA-2006-24281, starting on page 19928.
33. Maclin, James R.; “Performance of Fuselage Pressure Structure”, Technical Paper
presented at the Third NASA/FAA International Conference on Aging Aircraft, 19-21
November 1991.
34. TOGAA: The Technical Oversight Group on Aging Aircraft (TOGAA), “The FAA’s
Recent Rulemaking activity and Its Adverse Effect on Transport Airplane and Rotorcraft
Structural Integrity,” 24 August 2004, Unpublished final report delivered to the FAA‟s
Associate Administrator for Regulation and Certification, 800 Independence Ave. SW,
Washington, DC 20591
35. J.P. Gallagher, M. Lang, and others, “Future Airframe Structural Lifing: Methods,
Applications, Management,” RTO Technical Report, RTO-TR-AVT-125, NATO, Dec
2008.

5.1 Bibliography (Additional Reading)

Boeing Presentation titled, “Statistical Summary of Commercial Airplane Accidents for

Worldwide Operations 1959-2006,” Published by Boeing Commercial Airplanes, July 2007.

FAA; Federal Aviation Administration Code of Federal Regulations, Part 25 Airworthiness

Standards for Transport Category Airplanes, published by The National Archives and Records
Administration.

Flight Safety Foundation; Aviation Safety Network on-line at www.flightsafety.org and

http://aviation-safety.net/index.php

Job, Macarthur; Air Disaster, Volumes 1-4, Published by Aerospace Publications Pty Ltd.
1994-2001

Kingsbury, Alex; “Airliners Remain Virtually Defenseless Against Shoulder Fired Missiles”,
Published in US News and World Report, 15 July 2008

Marriott, Leo, Stewart, Stanley and Sharpe, Michael; Air Disasters, Barnes and Noble Books,
Published by PRC Publishing Ltd., 1999

McGuire, Jack F.; “Fail-Safe Requirements for Aircraft Structures” Presented at the 47th
AIAA/ASME/AHS/ASCE/ASE Structures, Structural Dynamics and Materials Conference,
Newport, Rhode Island, 1-4 May 2006.

NTSB; National Transportation Safety Board‟s Official Aircraft Accident Reports from 1967 to
2008, Contained in the Hunt Library of Embry-Riddle Aeronautical University,
http://library.erau.edu/daytona/find/online-full-text/ntsb/aircraft-accident-reports.htm

37
For Information Covering FOD and Runway Debris:
R. Malcolm and B. Bachtel, presentation supporting FOD, “Challenges to Airport Ramp and
runway Debris Control,” Boeing Commercial Airplanes, Airport Technology‟s support to Basic
Airport Safety & Operations School, FAA/AAAE,
http://www.fodnews.com/pdf/Boeing_Slideshow.pdf.
National Aerospace FOD Prevention, Inc., http://www.nafpi.com.

38
COMPENDIUM OF SELECTED STRUCTURAL
ACCIDENTS / INCIDENTS

39
 APPENDIX A
ACCIDENTS/INCIDENTS RESULTING FROM UNANTICIPATED HIGH
LOCAL STRESSES (COMBINED WITH POSSIBLE MANUFACTURING
DEFECTS)

Appendix A.1
BOAC COMET G-ALYP & G-ALYY
Accident Summarized by
Charles F. Tiffany

Figure A1: BOAC Comet in Flight

Figure A1. illustrates a photo of a Comet in flight; the Comet was the first jet transport to enter
scheduled airline service in 1952. Comet 1 (DH 106-1) registration number G-ALYP was the
first jet transport to enter scheduled airline service on May 2, 1952. On January 19, 1954 after
only 1,286 pressurized flights this aircraft suffered an explosive decompression failure and
crashed in the Mediterranean off Elba.

On April 8, 1954 a second Comet 1, registration number G-ALYY, also experienced an

explosive decompression after only 903 flights and crashed into the Mediterranean off Naples.
These failures resulted in the permanent grounding of the Comet fleet and the initiation of an
intensive investigation as to the cause of the failures. The failures were unexpected in that the
fuselage had been successfully pressure cycled to about 18,000 flights without a problem [A1].

Intensive investigations followed including the recovery and close examination of much of the
G-ALYP aircraft. Approximately 70% of the structure of G-ALYP aircraft was recovered and
reassembled in Farnborough as shown in Figure A2. The G-ALYY aircraft was never
recovered. Investigations revealed that the failure of G-ALYP originated near the aft automatic

A1
direction finding (ADF) window. The likely scenario of aircraft breakup is illustrated in Figure
A3.

Figure A2: Photo of Comet (G-ALYP) Reconstruction of Fuselage and Tail Units at Royal
Aircraft Establishment at Farnborough during the Investigation of Accidents [A2]

According to Swift [A3], the origin was believed to be at the end fastener hole at a frame cut-out
adjacent to the ADF window. Swift has provided a detailed analysis, which describes the loss in
residual strength with crack progression and the reason for the lack of crack arrest and fail-safe
capability [A3-A5].

Figure A3: Uncontained Running Cracks Led to Aircraft Breakup. Poor Detail Design of
Cutouts Led to Running Cracks in the Highly Stressed Low Toughness Skin

While the stress levels adjacent to this ADF window as well as adjacent to other cut-outs were
high (due to poor detailed design) and certainly caused early crack initiation, this by itself
doesn‟t explain how the full-scale cyclic pressure test article could successfully sustain 18,000
pressure cycles and the two Comet airplanes failed at 1,286 and 903 pressure cycles when also

A2
subjected to high stress levels. To explain this requires also considering the effect that
manufacturing quality (i.e., manufacturing defects) has on fatigue life and recognizing that, in
low fracture toughness materials, small defects can cause very wide variations in life. Unless the
test article contains such defects in the high stress areas, fatigue cracks may not initiate until very
late during the test.
During the reconstruction of G-ALYP, a pre-existing manufacturing crack or tear was found at
the edge of the ADF window cut-out (See Figure A4). This crack had been stop-drilled, which
was the accepted repair practice at that time. Several other locations in this aircraft had similar
kinds of manufactured cracks or tears that had also been stop-drilled in the factory [A4].

This part of crack developed during life of aircraft

This part of crack made during manufacture

and stopped by drill hole

Figure A I-VI-3. Crack and Drill Hole in Reinforcing Plate at

Starboard Rear Corner of Front ADF Aerial Window
Comet G-ALYP

Figure A4: Local Area that Had a Stop-Drilled Hole

As part of the G-ALYP investigation, another full-scale hydro (pressurization) fatigue test was
performed on a retired Comet 1 (G-ALYU) until failure occurred. This article failed at a different
location (i.e., the port-side forward escape hatch window) due to fatigue cracking at about 9,000
simulated flight hours (i.e. 3,057 pressure cycles); however, to the author‟s knowledge details of
the manufacturing quality at his location were not noted. See Figure A.5 for details of the
uncontained cracking that occurred after cracks rapidly propagated from the initiation site [A6].
In the early 1950s when this airplane was being designed and manufactured there was no specific
emphasis on having large damage capability or fail-safety nor had either analytical or empirical
fail-safe design and test methods been developed. Also, fracture mechanics was in its infancy
and there was insufficient emphasis on using tough materials with reasonable design stress levels

A3
so as to achieve large critical crack sizes. If the structure had been designed to be fail-safe to
today‟s standards initial manufacturing defects could have been tolerated without resulting in
catastrophic failure. Figures illustrating this lack of crack containment capability of the fuselage
structure (i.e., lack of fail-safety) and photographs taken as part of the failure investigation are
shown in Figure A5.

Figure A.5: Uncontained Running Cracks Caused the Breakup of this Hydro Test of the
Retired Comet 1 (G-ALYU). Cracks Propagating from Forward Escape Hatch on the Port
Side. Note that No Straps or Shear Tied Frames were Used. No Crack Arrestment
Capability was Provided by this Construction. [A2]

A4
 APPENDIX A.2
USAF Northrop F-89
Accident Summarized by
Charles F. Tiffany

Figure A6: Photo of F-89 Aircraft

During 1952, several F-89Cs crashed due to wing structural failures. At least six aircraft lost
wings and crashed in the spring and early summer of 1952. One crash took place at the
International Aviation Exposition at Detroit. The Air Force was forced to ground the entire fleet
on September 22, 1952 until the cause could be found. The fatigue capability of the wing to
fuselage fitting was questioned and as part of this investigation a full-scale wing fatigue test was
conducted at Wright Air Development Center (WADC). The tests verified that the wing
attachment fittings had a very short fatigue life. During high-G maneuvers, the wing tended to
twist at the tip, exerting excessive strain on the wing attachment points and causing them to fail
due to fatigue. The large wingtip fuel tanks were found to be a significant factor in exerting this
twisting moment. A total of 194 F-89A, B, and C aircraft were shipped back to Northrop where
they were fitted with stronger wings with redesigned forged steel attachment fittings. At the
same time, a small fin was added to the outboard rear of each wingtip tank, which reduced the
aerodynamic forces on the tank that caused it to flex and twist during maneuvering [A7-A8].

A5
 APPENDIX A.3
USAF Republic F-84
Accident Summarized by
Charles F. Tiffany

Figure A7: Photo of a Pair of F-84 Aircraft in Flight

The most difficult of the F-84's development and early operational problems were catastrophic
wing failures. The Air Force knew of this situation as early as 1948, when tests revealed that the
wing construction was the main source of difficulty with the airplane. The fifth fatal broken wing
accident (August 1950) prompted the accident board to write, that this type aircraft has a history
of wing failures. Following the ninth fatal accident caused by a wing separating from the aircraft,
the Air Materiel Command tested the structural strength of the F-84s and concluded that wing
failure was caused by high speed pull-up in excess of specific limits noted in the technical order.
Therefore, it said that no further engineering action was needed. However, after the twelfth fatal
accident attributed to wing failure, the 86th Fighter-Bomber Wing examined its F-84s and found
that 60 to 70 percent had various wing fatigue cracks. From 1952 to 1954 approximately 61
cases of rear spar cracking due to fatigue were encountered on the F-84E and G series plus a
large number of skin cracks on the D, E and G series. As a result of this poor structural history
straight wing fatigue tests were performed and satisfactory fixes were developed and verified so
as to allow a 3,000-hour service life for the aircraft. This was deemed sufficient to reach the
planned retirement [A7].

With the service history of the straight wing F-84s as a background, Republic Aircraft attempted
to design about 5,000 hours into the swept wing F-84F (See Figure A8). A full- scale wing
fatigue test was conducted at Wright Air Development Center (WADC), which seem to validate
a 4,000 hour service life.

A6
Figure A8: Photo of a Republic Swept Wing F-84F Aircraft

A7
 APPENDIX A.4
USAF North American F-86
Accident Summarized by
Charles F. Tiffany

Figure A9. Photo of F-86 Aircraft in Flight

In 1955 the main wing attach fitting was suspected as the cause of several in-flight wing losses.
A service wide inspection of all F-86A, B, C, D, E, and F series was instituted to inspect for
cracked fittings. Of all the aircraft inspected 515 were found to have cracked fittings. A wing
fatigue test conducted at WADC found that this fitting could crack as early as 600 hours of
service usage thus a fix was developed. This reinforcement extended the service life of the
fittings to about 2,500 to 3,000 hours which was deemed to be adequate. In addition a redesigned
fitting was provided for future production aircraft [A7].

A8
 APPENDIX A.5
USAF Boeing B-47
Accident Summarized by
Charles F. Tiffany

Figure A10: Photo of B-47 Aircraft in Flight

A structural crisis was reached within the USAF Strategic Air Command on 13 March 1958,
when two aircraft broke up in midair in separate incidents. Near Homestead Air Force Base,
Florida, a B-47B disintegrated at 15,000 feet, three minutes after takeoff. Its center wing section
failed due to fatigue cracking at buttock line 45. The aircraft had a total of 2,077 hours at the
time of the accident. See Figure A11 for the critical locations on the B-47.

Figure A11: Sketch Illustrating Critical Locations of the B-47 Aircraft

A9
The same day a TB-47B broke up at 23,000 feet over Tulsa, Oklahoma, after the left wing lower
surface failed at buttock line 35 causing the wing to separate from the aircraft. This aircraft had
2,419 hours at the time of the accident. While these two accidents were being investigated, three
more crashes occurred. On March 21 a B-47E disintegrated during a pull-up near Avon Park,
Florida. It had only 1,129 hours. Next, a B-47E disintegrated at 13,100 feet just prior to a
refueling rendezvous near Langford, New York on April 10. This failure occurred at the aft
wing-to body fitting at fuselage station 515. The final tragedy in this series of five accidents
occurred on April 15 when another B-47E with 1,419 hours took off from McDill Air Force
Base, Florida in a storm and disintegrated. While one of these accidents was believed to be the
result of static overload during a pull-up, the other four were clearly the result of fatigue
cracking.

As a result of these failures severe flight operating restrictions and an urgent fleet wide
inspection and modification program was implemented. This program was termed “project milk
bottle” after the shape of the attachment pin in the fuselage station 515 wing to body fitting.
However, the program encompassed much more than this single critical area. The endeavor
involved 1,622 B-47 aircraft and by January 1959 all of the B-47s had been inspected and
reworked at least once. While this $62 million program allowed the strategic nuclear bomber
force to resume its normal operations, it was now clear that full-scale fatigue tests were required
to determine the useful life of the modified aircraft. A decision was made to cyclic test the B-47
to failure at three independent establishments – the Boeing plant in Wichita, Kansas; the Douglas
plant in Tulsa, Oklahoma; and the NACA laboratory at Langley, Virginia. These tests were
initiated during the summer of 1958 and soon disclosed additional areas in the fuselage requiring
further modification. Of particular concern was cracking and failure of the fuselage longeron at
station 508. Testing was completed by the spring of 1959 at which time it was thought that a
3,000-hour service life had been assured and perhaps 5,000 hours could be achieved with further
modifications and inspections. By 1966 the B-47 was phased out of the nuclear bomber force and
replaced by B-52s [A9-A11].

A10
 APPENDIX A.6
USAF McDonnell-Douglas F-4
Accident Summarized by
Charles F. Tiffany

Figure A12: Photo of F-4C and F-4E Aircraft [http://www.af.mil/photos]

The F-4 has a long fatigue cracking and structural failure history requiring many modifications
and multiple full-scale fatigue tests by both the Air Force and the Navy. By 1972 the Air Force
had purchased about 2,500 of these aircraft and had lost about 800 of them many of which were
non-combat accidents. The Air Force experienced 63 non-combat losses in S.E. Asia during the
Vietnam War compared to 35 air combat losses plus 347 losses attributed ground fire. The Navy
had purchased about 900 aircraft and had lost about one half of them. The USN and USMC
experienced 84 non-combat losses in S.E. Asia during the Vietnam War compared to 38 air
combat losses and 105 due to ground fire. While there were a variety of specific causes for the
many non-combat losses that occurred in S.E. Asia as well as in the continental United States
and around the world, structural/mechanical failures were believed to be a major contributor to
the losses. As a result the Air Force formed a damage tolerance evaluation team along with
McDonnell-Douglas in 1973 and spent more than two years developing inspection requirements,
developing additional modifications and performing another fatigue test at WPAFB [A12, A13].

Structural/mechanical cracking and failure problems on the F-4 included wing fatigue cracks,
wing spar stress corrosion cracks, horizontal tail upper surface fatigue cracks and fuselage
fatigue cracks. In addition, there were fatigue cracks in and failures of forward engine mounts;
cracking of fuselage fuel tank liners (due to excessive fuel pressure from maneuver loads)
causing bladder tears and in-flight engine fires; cracking and failure of control surface actuators
causing airplane crashes; cracking of outer wings due to high cycle (or buffet) fatigue loading
and failure of outer wing panel attach lugs.

The sketch shown in Figure A13 depicts one of many cracking problems that resulted in a non-
combat loss of an F-4. This one occurred at Nellis AFB as a result of a fatigue crack in the aft
locking lug at the wing fold. The outer wing separated from the aircraft, hit the tail and the
aircraft broke apart in the air and then crashed. Prior to this failure, there had been 34 lug failures
found when the wings were folded and the lug would drop out. As a result, it was standard
inspection procedure to fold the wings and look for a lug failure before flight.

A11
Although the wing fold hinge was not designed to be fail-safe, it was being managed as if it were
fail-safe. It worked 34 times before, but obviously did not work when the lug failed during the
fatal flight. In this case, a small fatigue crack was also found in the next lug forward, probably
caused by buffet loading that these outer wings frequently experienced. Both the frequency and
magnitude of the buffet stresses on these lugs were not anticipated in the original design nor
simulated during the full-scale fatigue testing performed on the airplane [A12, A13].

This failure is an example of multiple element damage (MED) overcoming the limited fail-safety
associated with the wing fold lugs. The possible contribution of deficient manufacturing quality
to this failure was never defined.

Figure A13: Sketch of F-4 Aircraft Illustrating Location of Failure

A12
 APPENDIX A.7
Northwest Airlines Martin 202
Accident Summarized by
Charles F. Tiffany

Figure A14: Photo of Martin 202 Aircraft

A Northwest Airline‟s Martin 202 with 33 passengers and a crew of 4 crashed near Winona,
Minnesota on August 29, 1948 killing all 37 aboard. The left wing separated from the airplane
when flying in turbulence caused by a thunderstorm in the area. The cause of the accident was a
fatigue crack at a step in thickness of the lower front spar chord, which was made from 7075-T6
aluminum alloy. The aircraft was a non fail-safe (“safe-life”) design which had accumulated only
1,321 flight hours at the time of the accident. Shortly after finding the cause of this accident a
fractured lower spar chord was found in the right wing of another Martin 202 and cracks in
similar locations were found in three other aircraft. This accident along with the Comet fuselage
failures in 1954 (See Appendix A.1) contributed to the development of the fail-safe design
concept [A14-A16].

A13
 APPENDIX A.8
Argentine State Owned YPF AVRO 748
Accident Summarized by
Charles F. Tiffany and Thomas Swift

Figure A15: Photo of AVRO 748 Aircraft

The Argentine state owned oil company, Yacimientos Petroliferos Fiscales (YPF), was making a
domestic staff-transfer flight in its AVRO (Hawker Siddeley) 748 aircraft on April 14, 1976,
when the right hand wing failed followed by the right hand tailplane. The airplane was flying at
an altitude of 4,000 feet at the time of the structural failure causing the airplane to crash killing
the 31 passengers and 3 crewmembers. The accident occurred 22 miles north of the Cutral airport
in Argentina. The airplane had accumulated a total of 25,753 hours at the time of the accident.
The cause of the failure was fatigue cracking in multiple rivet holes in the lower wing skin
(between stringers 3 and 12) under external reinforcing doublers at the outboard engine rib. See
Figure A16. The multiple site damage, MSD, was due to the local stress concentrations caused
by fastener loads not accounted for in the original design. The fasteners attaching the external
doublers to the skin were loaded in the spanwise direction as a result of strain compatibility
between the skin and doublers.

The AVRO 748 was the first aircraft designed by Hawker Siddeley Manchester Division that
was intended to be fail-safe by virtue of having the up bending load distributed in the skin made
up of planks containing multiple spanwise stringers as compared to being concentrated in front
and rear spar caps as used in earlier AVRO wing designs (i.e., the Manchester, Lincoln, Tudor,
Shakletons 1, 2 and 3, and the Argossy). The fallacy was that in order for the structure to be fail-
safe, the failure or partial failure of the load path must be detected and repaired prior to the
failure of the remaining intact structure. With the chordwise row of fastener holes in skin being
covered by the external engine rib doublers, the critical fastener holes in the skin were not
visually inspectable.

This design was in violation of the Civil Aeronautics Board‟s 1956 CAR 4b.270 fail-safe rule,
which said that a partial failure of a principal structural element must be obvious (which means
that it must be readily detectable). Also, the possibility of multiple site damage in adjacent
planks was not recognized nor discovered by a teardown inspection of a full-scale fatigue test
aircraft.

A14
This accident and the crash of Dan Air‟s Boeing 707 in 1977 highlighted some shortcomings in
the CAR 4b.270 fail-safe rule and precipitated a joint industry and government effort that led to
amendment 45 revision and expansion of FAR 25.571 in 1978. While this amendment included
the requirement for damage tolerance evaluations and the development of Supplemental
Structural Inspection Documents (SSIDs), it did not address all the issues needed to achieve fail-
safety. Amendment 45 did not address: 1) the possibility of adjacent structure damage and 2)
recognize the need to retain the required residual strength for a period of unrepaired usage; nor it
did not mandate the requirement for full-scale fatigue testing to disclose fatigue “hot spots” and
provide an estimate as to when fail-safety may be lost due to the onset of WFD [A17, A18].

Efforts to address these issues and strengthen the fail-safe requirement came later and are
described in detail in final report of the FAA‟s Technical Oversight Group on Aging Aircraft
(TOGAA) dated July 30, 2003 and revised August 24, 2004 [A5].

Figure A16: Sketch of AVRO 748 Aircraft Illustrating Failure Location

A15
 APPENDIX A.9
Dan Air Airlines Boeing 707-300
Accident Summarized by
Charles F. Tiffany

Figure A17: Photo of Boeing 707-300 Aircraft

On May 14, 1977, a Boeing 707-300 operated by Dan-Air Services crashed on approach to
Lusaka International Airport, located in Lusaka, Zambia. The accident was caused by the fatigue
failure of the right horizontal stabilizer or tail-plane. This was followed by a loss of control and
the crash killing all 6 occupants. While the aircraft had been certified as fail-safe per the 1956
CAR 4b.270 requirements, the upper rear spar chord failure (which occurred about 100 flights
earlier) was not discovered prior to the failure of the fail-safe chord during this final landing
approach. See a photograph and a sketch of the design in Figure A18 [A19].

The Dan-Air accident has been pointed to by some in the FAA as justification for dropping the
fail-safe design option and adopting the damage tolerance or slow crack growth based inspection
approach, which was adopted by the U.S. Air Force several years earlier for their predominately
single load path combat aircraft. However, this justification was based on the false premise that
damage tolerance could replace the fail-safe concept rather than merely complement it by
providing slow crack growth based inspection requirements as was originally intended by a 1978
AIA Committee. One cannot ignore the many cases (a few of which are pointed out in this
compendium) where fail-safety has prevented the loss of the aircraft and the fact that fail-safety
is the only concept that provides protection from large damage threats. An important lesson
learned from this accident regarding fail-safe design was:

Subsequent to a load path failure (in this case the upper rear spar chord), it is essential that
the remaining intact structure be able sustain the required flight loads for a safe period of
unrepaired usage, which is long enough to ensure that the failure will be detected and
repaired prior to the failure of the remaining structure.

This obviously was not achieved in this accident in that the actual period of safe unrepaired
usage was about 100 flights before the accident flight whereas the normal maintenance “C”
check inspection interval was being performed every 1800 hours or about every 630 flights. This
motivated the phrase, “for a period of unrepaired usage” in the definition of the term, “fail- safe”
in the current AC 25.571-1C. It also resulted in the inclusion of an inspection threshold policy in

A16
FAR 25.571 that says, “Inspection thresholds must be established based on crack growth
analyses and/or tests, assuming the structure contains an initial flaw of the maximum probable
size that could exist as a result of manufacturing or service-induced damage where it cannot be
demonstrated that load path failure, partial failure, or crack arrest will be detected and repaired
during normal maintenance, inspection, or operation of an airplane prior to failure of the
remaining structure.[A5]”

While the loss of tail-plane and the aircraft after 16,722 flights pointed out a major shortcoming
in the old CAR 4b.270 fail-safe requirement (which the FAA attempted to later correct in
Amendment 96 to FAR 25.571), it does not explain the root cause of the fatigue cracking that
resulted in spar cap failure. The available evidence indicates that this was due to unanticipated
high local stresses (and stress spectrum) combined with marginal quality fastener installations
and potential environmental effects. The failure originated from a fatigue crack in a fastener hole
in the rear upper spar chord. Fractographic analysis (i.e., striation counts) indicated that there
were about 7200 flights of slow crack growth before the crack reached critical size and fractured
the upper chord. The fatigue crack progressed from a small upper surface corner crack (0.02 to
0.03-inch) in a fastener hole in the flange of the upper spar chord and progressed across the
chord before reaching its critical size of a couple of inches.

The specific origin (about a 0.02 to 0.03 inch corner radius) appeared damaged, probably due to
impact after failure; consequently its exact nature could not be determined. However, there was
evidence of fretting and corrosion. There was also evidence that some fasteners had high bearing
stresses and initially had uneven loading amongst the fasteners. The fatigue crack at the origin
fastener hole initially had a rapid rate of growth for the first two millimeters (due to the high
bearing load) and then rather normal growth due to the bypass stress in the flange [A20].

Post accident flight tests revealed that deployment of the speed brakes during landing role
produced a horizontal load spectrum, which was significantly more severe than assumed during
the original design. Obviously, a good knowledge of both the external loads (and load spectrum)
and the local internal loads are essential in predicting crack initiation, crack growth and fail-safe
residual strength, which leads to this second lesson-learned:

It is essential that load surveys be performed to develop accurate loads and load spectra
(including both ground and flight loads) for use in damage tolerance (i.e., crack growth)
analyses, fatigue analyses and fail-safe residual strength and life analyses. These load
spectra are also very important for the full-scale fatigue test.

A17
Figure A18: Photo of Right Horizontal Stabilizer that Separated from B-707-321C
Aircraft and Details of “Fail-Safe” Structure Associated with the Accident

A18
 APPENDIX A.10
Aer Lingus - Irish International Airlines Boeing 707-300
Accident Summarized by
Charles F. Tiffany and
Jack F. McGuire

Figure A19: Photo of Boeing 707-300 Aircraft

This Aer Lingus Boeing 707-300 flying out of London on September 24, 1970 experienced a
rapid decompression; however, the fail-safe design prevented a catastrophic failure that could
have resulted in the loss of aircraft. The failure demonstrated the ability of the airplane to sustain
a 40 inch fuselage crack plus a broken frame, which is a current Boeing design requirement (i.e.,
a two bay crack plus a broken central frame) [A21, A22].

The location of the failure was in the main deck cargo door with frame failure and skin cracking
along the upper hinge line. Note that the frame spacing in the cargo door is 10 inches rather than
the normal 20 inch spacing throughout the rest of the fuselage. It is believed that the frame
cracking occurred first followed by the skin cracking and the blowout. While the specific cause
of the frame fatigue failures and skin cracking was not identified, it is expected that
unanticipated high local frame stresses was the primary factor. It is not known whether or not
there was any manufacturing or maintenance damage present. The main deck cargo door
apparently was not included in the hydro fatigue test that was performed in the 1950s; thus, this
critical area was not identified by the test. A photograph of the damage is shown in Figure A20.

A19
Figure A20: Photo of Section of Boeing 707-300 Aircraft Lost Due to Fatigue Failure

A20
 APPENDIX A.11.6
USAF McDonnell-Douglas F-15C
Accident Summarized by
Charles F. Tiffany with input from
Charles Babish and Joseph Gallagher

Figure A21: Photo of F-15 Aircraft in Flight

On November 2, 2007, an F-15C flown by the Missouri National Guard broke apart in mid-air
and crashed during a training exercise. An artist rendition of how the forward fuselage of this
aircraft manufactured by McDonnell-Douglas separated just behind the cockpit is shown in
Figure A22 [A23].

Figure A22: Artist’s Rendition of F-15C Forward Fuselage Separation

Both Boeing and the Air Force Research Laboratory‟s Materials Integrity Branch (AFRL/RXSA)
conducted structures and materials investigations in support of the Air Force‟s Accident
Investigation Board (AIB) [A24]. The Boeing failure analysis laboratory found a suspected
fatigue crack in the upper right hand longeron near the center fuselage station (CFS) 377 splice
joint that they thought could have caused the catastrophic failure (i.e., the longeron is a non fail-
safe single load path structure). The location of this crack is shown in the structural diagram
shown in Figure A23.

A21
 Figure B.6.3. Location of crack site in F-15C forward fuselage upper longeron.

Figure A23: Location of Crack Site in F-15C Forward Fuselage Upper Longeron

The AFRL/RXSA performed a comprehensive examination and metallurgical evaluation of the

fractured longeron [A25]. They found that the suspect crack originated due to fatigue in a thin
area of a machined pocket in the longeron just forward of CFS 377. The web thickness at the
crack origin ranged from 0.039 to 0.073-inches compared to the blueprint minimum thickness of
0.09 inches. This of course would result in significantly higher stresses in this local area than the
blueprint configuration. Also, the surface roughness of the machined surface was rougher than
the blueprint specification. The AFRL/RXSA report indicated that the cracking initiated at
multiple sites in machining groves in the thin undercut area of the longeron web and grew in a
stable manner over a significant period of time to where it was through the entire width of the
canopy sill web and progressing nearly 0.5-inch down the inner chord, when it reached its
critical size at the applied stress level and failure occurred This is illustrated in Figure A24.

Based on the AIB report [A24], it appears that the fatigue cracking and failure are due to high
stresses that were the result of poor workmanship and quality control (i.e., inadequate receiving
inspection of fracture critical parts that were improperly manufactured and inspected by a
subcontractor). This failure demonstrates the vulnerability of single load path (i.e., non fail-safe)
structures to manufacturing discrepancies and emphasizes the importance of developing and
enforcing rigid fracture control procedures (including factory inspections to ensure conformation
to blueprint and in-service damage tolerance based inspections) on those parts where fail-safe
designs are not practical.

A22
 UPPER RIGHT LONGERON
UP

AFT
SILL
2 OUTBD

3 1

Cracks found in right upper longeron of mishap aircraft:

• Cracks started in area 1, grew thru sill thickness from bottom side of sill
• Crack continued to area 2 and reached critical size (bottom of area 2)
• High Speed running crack thru area 3 resulted in failure of the longeron

Figure A24: Cracking Events Occurring in the F-15C Forward Fuselage Upper Longeron
at FS377

The Technical Advisor on Structural Integrity at WPAFB [A25] said that subsequent to the
release of the AIB report a further detailed stress analysis of the longerons was performed. He
indicated that the analysis revealed a local high stress area that had not been previously detected
by past analyses or tests. Major General Owen discussed this local high stressed area in his
presentation to the 2008 ASIP conference [A27]. A local change in the load path resulted in
bending stresses combined with the normal tension load in the longeron. Also, it was pointed out
that this local “hot spot” was not revealed by the original fatigue test. This was due to the fact
that the test spectrum was much too mild compared to the F-15C‟s actual usage spectrum (by a
factor of 10 or more) and the original test aircraft probably did not have the manufacturing
discrepancy found in the accident aircraft.

Inspection of the other operational F-15C aircraft as part of the accident investigation revealed
fatigue cracks in nine other aircraft, three of these other aircraft all ready had cracks were already
completely across the sill and into area 2. Two of these three aircraft had only minor
manufacturing discrepancies relative to meeting blue print configuration requirements. The
cracks were found were in the analytically predicted high stressed area, another high stressed
area associated with a nearby machine land. A damage tolerance analysis of the longeron
cracking locations was conducted to determine if the structural safety of the F-15 aircraft could
be protected by inspections. The required inspection intervals for the inspection approach was
based on the longeron blue print configuration, updated stress analysis, the current service loads
spectrum and an initial flaw assumption that the crack had a through-thickness size that extended
completely across the sill, i.e., the crack completely covered area 1 in Figure A24. The repeat
inspection intervals were sufficient to only conduct depot inspections.

A23
In retrospect, had this “hot spot“ been identified and the inspection intervals determined early on,
the accident aircraft would have been inspected at least twice prior to the accident flight. In other
words, the damage tolerance approach (based on an accurate detailed stress analysis and updated
loads spectrum) would have protected the structural safety in spite of the fact that there was a
gross manufacturing error (i.e., a deep undercut and surface roughness). It is apparent from these
findings that there was not only a breakdown in quality control procedures to ensure design
conformance as indicated by the AIB report, but also there was a breakdown in the basic ASIP
requirements. This includes the need for: 1) spectrum updates; 2) identification of critical areas
by analysis and test; 3) the implementation of an effective individual aircraft tracking program;
and, 4) the development and implementation of a damage tolerance based inspection program.
General Owen pointed out that the F-15 System Program Manager (SPM) thought that the root
cause for the accident was the direct result of a complacent and under-funded ASIP [A27].

A24
APPENDIX GROUP A REFERENCES

A1 “Report on Comet Accident Investigation Part 2 Accident Note No. 260, Ministry of
Supply, London W.C.2.
A2 Report on Comet Investigation, Ministry of Supply‟s Royal Aircraft Establishment,
London, England
A3 Swift, Thomas, “Fail-Safe design Requirements and Features, Regulatory
Requirements,” Technical paper presented at AIAA Conference, Dayton, Ohio, July
2004.
A4 Swift, Thomas and Tiffany, C. F., Personal Files Data.
A5 TOGAA: The Technical Oversight Group on Aging Aircraft (TOGAA) Final Report,
“The FAA’s Recent Rulemaking activity and Its Adverse Effect on Transport Airplane
and Rotorcraft Structural Integrity,”, Unpublished Final Report delivered to the FAA‟s
Associate Administrator for Regulation and Certification, 800 Independence Ave. SW,
Washington, DC 20591,24 August 2004
A6 Job, Macarthur, Air Disaster, Volume 1, Published by Aerospace Publications Pty Ltd.
1994-2001
A7 Tiffany, C.F., Personal Files (based on data J. W. Lincoln provided from the Aerospace
Structures Information and Analysis Center at WPAFB)
A8 Historical data also obtained from the Internet (e.g., The Troubled F-89C at
http://www.nicap.org/f89c.htm).
A9 Tiffany, C.F., first hand knowledge acquired as a young Boeing stress analyst during
the 1950s. Boeing data contained in C.F. Tiffany‟s personal files.
A10 Boyne, Walter J.; “Boeing B-52, A Documented History,” Chapter 2, The
Indispensable Forerunner, The B-47, Boeing Seattle, WA.
A11 Lincoln, J.W., Data obtained from the Aerospace Structures Information Center at
WPAFB, Ohio.
A12 Tiffany, C.F., Personal Files based on first hand knowledge of the F-4 fatigue problems
during the early 1970s and support provided to the Accident Investigation Board‟s
investigation of the 1973 accident at Nellis AFB. Also, C.F. Tiffany provided technical
oversight of the DADTA team led by Robert M. Bader from WPAFB and prepared
numerous briefings on the F-4 structural problems and presented them to USAF upper
management during the mid 1970s.
A13 Correll, John T., “The Vietnam War Almanac,” www.airforce-
magazine.com/almanac/other%20almanacs/0904vietnam.pdf.
A14 Flight Safety Foundation, Aviation Safety Network on-line at www.flightsafety.org and
http://aviation-safety.net/database/record.php?id=19480829-0
A15 Federal Court Record, 224F.2d120, Northwest Airlines vs. Glenn L. Martin Company,
U.S. Court of Appeals Sixth Circuit, May 31, 1966
http://bulk.resource.org/courts.gov/c/F2/224/224.F2d.120.12130_1.html

A25
A16 Tiffany, C.F., Personal recollections during the adoption of Boeing‟s fail-safe design
requirements in the early 1950s.
A17 Swift, Thomas, Personal Files of developed during his support to the FAA initiated
Fatigue Regulatory Review Committee that developed Amendment 45 to FAR 25.571
in 1978.
A18 Flight Safety Foundation; Aviation Safety Network on-line at www.flightsafety.org and
http://aviation-safety.net/index.php.
A19 Aircraft Accident Report 9/78; Boeing 707 321C G-BEBP Report on the accident near
Lusaka International Airport, Zambia on 14 May 1977; Department of Trade, Accidents
Investigation Branch, London, UK.
A20 Watson, Robert (chief of Boeing Structures at the time of the accident) and Stauffer,
Warren, Mar, James, and Swift, Thomas (who were all involved in the FAA Regulatory
Review Committee investigating the failure and development of Amendment 45 to
FAR 25.571), First hand accounts. .
A21 McGuire, Jack F., former Head of Structures at Boeing Commercial Airplanes,
Personal Recollections.
A22 McGuire, Jack F.; “Fail-Safe Requirements for Aircraft Structures,” Presented at the
47th AIAA/ASME/AHS/ASCE/ASE Structures, Structural Dynamics and Materials
Conference, Newport, Rhode Island, 1-4 May 2006
A23 ACC Video of the F-15C accident available from http://acc.af.mil/f-15fliesagain/index.
asp
A24 USAF Accident Investigation Report, F-15C, S/N 80-0034, 110th Fighter Squadron,
131st Fighter Wing, St IAP, ANG, 2 November 2007, Signed out by ACC/CC 8 January
2008. (Three Volumes).
A25 Calcaterra, Jeffery and Gentry, Amanda J., “AFRL Structural Analysis, F-15 Mishap
Structural Hardware Analysis,” Air Force Research Laboratory Report No.
AFRL/RXS 07-084A, published as part of the Air Force‟s F-15C Accident
Investigation Board‟s Report, December 2007
A26 Private Communication between C.F. Tiffany and C.A. Babish, dated 31 Dec 08
A27 Owen, Maj. Gen. Thomas B., HQ AFMC/A4, “F-15 Structures Mishap,” 2008 ASIP
Conference, 3 Dec. 2008.

A26
 APPENDIX B
ACCIDENTS / INCIDENTS RESULTING FROM MANUFACTURING
AND MATERIAL DEFECTS
APPENDIX B.1
USAF Northrop F-5/T-38
Accident Summarized by
Charles F. Tiffany

Figure B1: Two T-38 Trainers in Flight

Figure B1 illustrates two T-38 aircraft; the T-38 aircraft is the two seat trainer version of
Northrop‟s F-5 fighter. The sketch shown in Figure B2 depicts the failure of an F-5 at Williams
AFB, which originated at a tool gouge in a radius of the single piece, 0.42-inch thick wing plank.
The critical crack length of the fatigue crack was about 0.20-inches. A photo of the failure origin
is shown in Figure B3. As a result of this failure a damage tolerance assessment was performed
and damage tolerance inspection requirements established; however, these inspections were not
completely successful in that additional catastrophic wing failures occurred at Randolph AFB
and in PACAF in the mid 1970‟s. The final solution to this problem was a wing redesign to
substantially reduce the stress levels, incorporate a tougher aluminum alloy and cold working of
the fastener holes [B1, B2].

B1
Figure B2: Identification of Tool Damage Location and Resulting Wing Separation
Point

Figure B3: Tool Damage Led to Early Fatigue Cracking and Resulting Failure of the
Monolithic Wing

B2
 APPENDIX B.2
USAF Boeing KC-135
Incident Summarized by
Charles F. Tiffany

Figure B4: Photo of KC-135 in Flight

The KC-135, shown in Figure B4, is a military derivative of Boeing‟s Dash 80 prototype and the
Boeing 707 commercial Aircraft. Like the Boeing 707, the KC-135 was designed to be fail-safe,
but it did have some significant structural differences from the Boeing 707. One major difference
was that to save approximately 600 lb. of weight, Boeing and the USAF selected 7178-T6
aluminum rather than 2024-T3 aluminum for the wing lower surfaces of the KC-135. Although it
was not known at the time (early 1950s), the 7178-T6 Al wing had much lower fracture
toughness, smaller critical crack sizes and was much more sensitive to initial quality variations
(i.e., manufacturing defects) than the Boeing 707 2024-T3 Al wing. The consequences of this
decision were as follows [B3, B4]:

1. Between1966 and 1977, there were 28 reported incidents of unstable fatigue crack
propagation:

 14 failures of six different panels in the lower wing surface

 13 crack arrests in other fastener holes short of complete panel failure
 1 rear spar cap plus aft panel failure

2. These failures initiated at poor quality fastener holes (manufacturing defects) and thus
occurred at very low flight hours even though the airplane had been successfully fatigue
tested to 43, 200 cyclic test hours. A complete yearly tabulation of the incidents is provided
in Table B1.

B3
 Table B1. Listing of Annual Cracking Incidents on KC-135 Aircraft

Year No. of Incidents Flight Hours

1966 1 2,800
1967 3 2,800-3,500
1968 0
1969 6 1,800- 6,400
1970 1 11,000
1971 2 12,200 & 14,400
1972 5 4,700-12,900
1973 2 5,700 & 5,900
1974 2 6,900 & 7,300
1975 1 7,000
1976 4 7,000-17,000
1977 1 7,500

3. All of these failures were readily detectable or malfunction evident. Most were discovered
post flight as result of fuel leakage.

4. An example of one such panel failure that occurred in 1972 at Fairchild AFB is illustrated in
Figure B5. A picture of the failure origin is shown in Figure B6. Note that the fatigue crack
was still underneath the countersink, when it attained its critical size and caused the panel
failure.

Figure B5: Illustration Shows Location of Fatigue Crack Resulting in a 28-inch Panel
Failure in Lower Surface of a KC-135 Wing (Fairchild AFB, February 1971)

B4
 Figure B6: Photo Illustrates the Critical Size of Fatigue Crack was Covered by the
Fastener Countersink Making It Impossible to Detect by Visual Inspection

5. It should be emphasized that none of these 28 incidents resulted in catastrophic structural

failure, which attests to the importance of the fail-safe design. Twenty-eight potential
catastrophic failures were avoided, because of fail-safety!

6. A 1977 reevaluation of the fail-safe residual strength levels in the presence of a panel failure
concluded that, with the exception of one or two specific areas, the residual strength of the
wings exceeded 80% of limit load (i.e., the old CAR4b.270 requirement) providing there was
no widespread fatigue cracking in the adjacent panels.

7. Although by 1977 the USAF and Boeing were performing Damage Tolerance Assessments
of their existing aircraft inventory, it was clear that that structural safety of the KC-135 wings
could not be protected by damage tolerance based inspections and continued fail-safety was
mandatory.

 The NDI detectable crack sizes were nearly the same as the predicted and observed
critical crack sizes resulting in extremely short repeat inspection intervals.
 Even if inspections were technically feasible it would be economically unacceptable
because of the thousands of fastener holes that would require inspection.

8. Concern about the potential loss of fail-safety in the higher time aircraft due to the onset of
WFD led Boeing to perform tear down inspections of several KC-135 lower wing surfaces.

 A wing with 11, 500 hours was torn down and each fastener hole in selected areas was
inspected using an optical magnifier. At least 698 very small fatigue cracks were found
(most between .01 and .02 inches).
 From these results a Blue Ribbon Panel (made up of industry and government structures
experts) estimated that the fail-safe residual strength of some aircraft could be
unacceptably degraded between 8,000 and 9,000 flight hours (i.e., the onset of WFD).

B5
9. The Blue Ribbon Panel recommended that a major wing modification program (i.e., ECP
405) be implemented immediately whereby the lower surface would be redesigned using the
2024-T3 aluminum alloy used in the 707 wing and any aircraft with more than 8,500 flight
hours would be subject to flight restrictions until the mod kits were installed.

10. There have been no additional panel failures, since ECP 405 was implemented and the fail
safety of the wing structure has been successfully maintained for the past two to three
decades.

B6
 Appendix B.3
USAF Douglas C-133
Accident Summarized by
Thomas Swift

Figure B7: Photo of C-133 Transport Aircraft in Flight

A US Air Force C-133 transport aircraft (No. 59-530), manufactured by Douglas, suffered an
explosive decompression failure at an altitude of 24,000 feet while fully pressurized to 6.55 PSI
on the morning of 6 Feb. 1970 and crashed near McCook, Nebraska. The aircraft had completed
12,200 hours at the time of the accident. A longitudinal skin crack, originating in the skin at the
first hole in a skin-to-frame shear clip, had propagated into two adjacent skin bays to a total
length of 11.0 inches when fast fracture occurred. The crack was not arrested at adjacent frames
resulting in an explosive decompression failure of the fuselage (i.e., the structure was not fail-
safe) [B5-B7].

The fasteners were countersunk into dimpled skin. The crack that propagated to failure grew
from a manufacturing flaw caused by the dimpling operation. A C-133 was successfully full-
scale fatigue tested to 38,000 simulated flight hours. The high time airplane at the time of the
accident had accumulated 16,000 flight hours. A Douglas Aircraft team designed a crack
arresting system, so as to achieve fail-safety in the remaining C-133 fleet. A sketch of the initial
manufacturing flaw and subsequent fatigue crack is shown in Figure B8.

B7
 DOUGLAS C-133

DIMPLED
SKIN

INITIAL CRACK
SKIN CRACK
PROPAGATED INTO
TWO BAYS INITIAL MANUFACTURING
ROGUE FLAW DUE TO
DIMPLING OPERATION

SKIN CRACK ORIGIN

AT FIRST RIVET HOLE
IN FRAME SHEAR CLIP

SKIN CRACK FAST FRACTURED AT 11 INCH TOTAL LENGTH

AND WAS NOT ARRESTED

Figure
Figure B8: A I-VI-6
Details Douglas that
of the Cracking C-133
LedExplosive
to Failure Decompression
of C-133 Transport Aircraft
Precipitated by "Rogue Flaw"

B8
 Appendix B.4
Curtis Wright X-19 VTOL
Accident Summarized by
Charles F. Tiffany and Thomas Swift

Figure B9: Photo of Curtis Wright X-19 Aircraft

The Curtis Wright X-19 VTOL Experimental Aircraft, a tri-service research project, crashed
during a flight test at the FAA Test Center in Atlantic City New Jersey in mid 1965. The aircraft
crashed after a propeller nacelle magnesium casting failure. The cause of the crash was a
manufacturing defect in the magnesium sand casting used in the propeller nacelle. This material
flaw was a sand inclusion at the tip of one of the stiffening ribs in the most highly loaded
location of the nacelle structure. Some of the details of this flaw are illustrated in Figure B10
[B5, B7].

FATIGUE CRACK
PROPAGATION

INITIAL FLAW DUE TO

Nacelle SAND INCLUSION

FATIGUE CRACK

MAGNESIUM CASTING STIFFENING

RIBS
Figure
Figure B10:A I-VI-5
SketchCurtiss Wright
of Flaw X-19 VTOL
Details Aircraft with
Associated - Crashed
X-19atAircraft
the FAA Accident
Technical Center 1965 Due to "Rogue" Flaw in Propeller
Nacelle Casting
B9
 APPENDIX B.5
USAF General Dynamics F-111
Accident Summarized by
Charles F. Tiffany

Figure B11: Photo of F-111 Aircraft in Flight

On December 22, 1969, the left wing pivot fitting of U.S. Air Force F-111 No. 94 aircraft failed
during a 4.0g pull-up maneuver from a practice bombing run at Nellis Air Force Base in Nevada.
This was a fighter airplane designed and manufactured by General Dynamics for a limit load
factor of 7.33. Aircraft No. 94 had only accumulated 105 flight hours at the time of the accident.
The cause of the failure, resulting in loss of the aircraft and crew of two, was attributed to the
presence of a manufacturing defect (a forging lap) in the D6AC steel pivot fitting. A Photo of the
fracture face is shown in Figure B.12. The dark portion, shaped like the crescent on a thumbnail,
was the manufacturing defect that existed when the aircraft was delivered to the USAF. The
narrow band, lighter in color, is the growth of the manufacturing flaw in 105 hours of flight. This
crack, the manufacturing defect, in F-111 No. 94 is arguably the most infamous crack in aviation
history [B8, B9].

The USAF convened a special Scientific Advisory Board (SAB) to investigate the ramifications
of this accident. Many innovations in structural integrity came about because of this failure. The
USAF conducted a comprehensive evaluation of their Aircraft Structural Integrity Program
(ASIP). They abandoned the previous safe life approach to fatigue design, revised MIL STD
1530 [B10], released MIL A 83444 (Damage Tolerance Requirements) [B11] and performed
Durability and Damage Tolerance Assessments (DADTAs) of all of their existing airplane fleets.

B10
Figure B12: Photo Illustrating Forging Flaw and Subsequent Fatigue Crack that Caused
the Failure of F-111 Aircraft after 105 Hours of Flight Time

B11
APPENDIX GROUP B REFERENCES

B1 Tiffany, C.F., Personal Files.

B2 Tiffany, C.F. et al., “Aging of U.S. Air Force Aircraft,” Appendix covering Structural
History of the F-5/T-38, National Research Council report NMAB-488-2, National
Academy Press, Washington D.C., Sep
B3 Executive Briefing prepared by the 1977 Blue Ribbon Panel co chaired by C.F. Tiffany
(ASD/EN) and Prof. John McCarthy (MIT/SAB) with Panel members, Dr. J.W.
Lincoln (ASD/ENF), Thomas Swift (Douglas Aircraft), Bernie Nasal (AFLC/LOE),
Warren Stauffer (Lockheed) and Glen Purkey (ASD/ENFS). Technical support
provided by Oklahoma City ALC and Boeing Wichita Division (Bev Hodges, Chief
Engineer and John Dempster, Stress Unit Chief). Briefing contained in C.F. Tiffany‟s
personal files.
B4 Tiffany, C.F. et al., “Aging of U.S. Air Force Aircraft,” Appendix covering Structural
History of the KC-135, National Research Council report NMAB-488-2, National
Academy Press, Washington D.C., Sep 1997.
B5 Swift, Thomas, Personal Files.
B6 Swift, Thomas, “Fail-Safe design Requirements and Features, Regulatory
Requirements”, Technical paper presented at AIAA Conference, Dayton, Ohio, July
2004.
B7 TOGAA: The Technical Oversight Group on Aging Aircraft, “The FAA‟s Recent
Rulemaking activity and Its Adverse Effect on Transport Airplane and Rotorcraft
Structural Integrity,” 24 August 2004, Unpublished final report delivered to the FAA‟s
Associate Administrator for Regulation and Certification, 800 Independence Ave. SW,
Washington, DC 20591
B8 Scientific Advisory Board (SAB), Committee data from the personal files of C. F.
Tiffany (i.e., the 1970/71 F-111 Special SAB. Committee chaired by Prof. Holt Ashley
of which C. F. Tiffany was a member)
B9 Tiffany, C.F. et al., “Aging of U.S. Air Force Aircraft,” Appendix covering Structural
History of the F-111, National Research Council report NMAB-488-2, National
Academy Press, Washington D.C., Sep 1997.
B10 Department of Defense, Military Standard, MIL-STD-1530A, “Aircraft Structural
Integrity Program, Airplane Requirements,” 11 Dec 1975.
B11 Department of Defense (USAF); Military Specification, Mil-A- 83444 titled, “Airplane
Damage Tolerance Requirements,” 2 July 1974.

B12
 APPENDIX C
ACCIDENTS / INCIDENTS RESULTING FROM MAINTENANCE
DEFECTS/DEFICIENCIES
APPENDIX C.1
Beech 99 Commuter Aircraft
Accident Summarized by
Thomas Swift

Figure C1: Photo of Beech Commuter Aircraft

A Beech 99 commuter aircraft with a single spar wing was being maintained. During this
maintenance a fastener was removed by knocking the head off with a hammer and chisel as
illustrated in Figure C2. This action left a sharp fragment of the head on the shank of the
fastener, which gouged the side of the fastener hole as the fastener was being driven out. The
spar was re-assembled without removing the groove and the aircraft was returned to service.
During a routine inspection, 2100 flight hours later in July 1990, a fatigue crack was found that
had nucleated at the groove and propagated to the edge of the flange as shown in the photo in
Figure C3. A limit load application would have failed the wing. The spar had a 10,000 hour
fatigue life limit based on the most critical fastener hole in the spar cap. The gouge in the side of
the hole is clearly a “maintenance defect”[C1].

C1
 Most Critical Location Critical Fastener Head
in the Airplane Removed by Hammer
and Chisel
Splice Angles

Small Fragment of
Head Remained on
Shank

Groove in Hole

Figure A I-VI-4 Commuter Aircraft Single Spar Wing. Example of Manufacturing

Defect "Rogue Flaw"
Figure C2: Details of Maintenance Action that Led to Damage

Figure C3: Photo of Damaged Hole and Cracked Spar Cap

C2
 APPENDIX C.2
Eastern Airlines Boeing 727
Accident Summarized by
Charles F. Tiffany with input from
Thomas Swift and Jack McGuire

Figure C4: Photo of Boeing 727 Aircraft

The second example concerns an Eastern Airlines 727 that suffered sudden cabin decompression
caused by fatigue cracking induced by the X-Acto knife maintenance induced damage as shown
in Figure C5. The rivets in the lap splice had been removed to clean out corrosion in the splice.
Cold cure adhesive tape had been replaced and the excess tape trimmed off with an X-ACTO
knife. The knife created a sharp gouge in the skin that became sites for the nucleation of fatigue
cracks. Separate fatigue cracks linked together to form a long crack which eventually fast
fractured and caused decompression. Fortunately, the fast fracture was successfully arrested by
the aluminum crack stoppers located at the circumferential frames as shown in the sketch. The
very large damage „crack arrest fail-safe‟ capability designed into this fuselage saved this aircraft
[C2, C3].

Hole Blown In
Fuselage Skin

X-Acto
Circumferential Knife
Frame Gouge In Skin Scrim
Aluminum Cloth
Crack
Stopper

Skin Gouge Created By Trimming Skin Lap Splice

Scrim Cloth Resulted In Early
Fatigue Cracking Followed By
Cabin Decompression

Figure C5:Figure A I-VIII-7. Eastern Airlines B-727 Accidental Damage

Maintenance Action that Led to Skin Failure by Fatigue

C3
Photographs of the arrested damage are shown in Figure C6.

Figure C6: Photos Illustrating the Structural Damage Resulting from Fatigue Skin Failure

C4
 APPENDIX C.3
American Airlines McDonnell-Douglas DC-10
Accident Summarized by
Charles F. Tiffany with Input from
Thomas Swift

Figure C7: Photo of DC-10 Aircraft

One of the most dramatic examples of a major airplane accident caused by maintenance damage
was the crash of American Airlines DC-10 Flight No. 191 during takeoff from Chicago O’Hare
field on May 25, 1979. This crash resulted in the loss of 273 lives (271 in the aircraft and 2 on
the ground). During this takeoff, the No. 1 engine and pylon separated from the aircraft and flew
up and over the port wing and fell back on the runway behind the aircraft (See Figure C8). As a
result of this engine and pylon separation damage was inflicted to the wing leading edge slat and
the hydraulics system. The loss of hydraulics fluid caused the outboard leading edge slats to
retract. While the system failures in themselves should not have been fatal, the retraction of these
leading edge slats (which was unknown to the flight crew) had a profound effect on the aircraft’s
aerodynamic performance and controllability. With the port outboard slats retracted and all
others extended, the lift on the port wing was reduced and the stalling speed increased. With little
or no warning of the wing stall, the crew was unable to compensate for the asymmetric condition
and was unable to prevent the crash [C4-C6].

From the detailed investigation it became clear that the pylon separation began when the upper
flange of the rear bulkhead in the pylon failed. There was a pre-existing 10-inch long crack plus
a total of about 3-inches of fatigue growth in this upper flange. A crescent shaped deformation of
the upper flange exactly matched the radius of the wing clevis fitting. This strongly suggested
that the flange had been cracked when the pylon and engine was being removed or reinstalled
during maintenance. Further investigation revealed that both American and Continental Airlines
had devised an expedited procedure using a fork-lift for removing and reinstalling the engine and
pylon as a single unit rather than separately removing the engine and then the pylon as
recommended by the airplane manufacturer. This expedited procedure under certain

C5
circumstances could result in very large impact loads at the rear bulkhead attachment point and
inflict the type of damage observed. Inspection of other DC-10s where this expedited removal
procedure was used revealed eight other aircraft with cracks ranging from 3 to 6-inches long.
While the manufacturer, McDonnell-Douglas Aircraft, had designed the airplane including many
areas of the pylons to be fail-safe, it was not fail-safe for this particular failure scenario. The rear
bulkhead itself was split to achieve fail-safety, but the upper flange on the forward half of the
bulkhead was a single load path, and when the upper flange failed, the loss of the pylon and
engine ensued.

Figure C8: Diagrams Illustrating Nature and Result of the Maintenance Damage in the
Cause of a DC-10 Pylon Failure

C6
 APPENDIX C.4
Japan Airlines Boeing 747SR
Accident Summarized by
Charles F. Tiffany with Input from
Thomas Swift and Jack McGuire

Figure C9: Photo of Boeing 747SR Aircraft

On August 12, 1985 a JAL 747 crashed in the mountains in the Guma prefecture of Northern
Japan resulting in 520 fatalities. This airplane had flown 18,700 flights at the time of the
accident. The probable cause of this accident was the rupture of the rear pressure bulkhead that
released a massive outflow of air into the previously unpressurized compartment aft of the
bulkhead. This high pressure air then overcame the outflow vent door capacity and overloaded
the vertical stabilizer so that about one-third of it was lost. There was additional collateral
damage in that the rudder actuation hydraulic valve, fed by all four independent hydraulic
systems for fail-safety, was lost causing all hydraulic fluid to be lost. The aircraft was able to
continue flying for 32 minutes using engine differential thrust for control [C7,C8].

The rear pressure bulkhead of this aircraft had been damaged due to a tail strike in Osaka on June
16, 1978. At that time the aircraft had experienced 6516 pressurized flights. Boeing sent a
maintenance team to Japan to conduct the repair. The domed bulkhead is made up of pie shaped
pieces of 2024-T3 spliced together with two rows of rivets as shown in the sketch below. The
lower half of the bulkhead was replaced due to damage. During the repair one row of the rivet
holes had insufficient edge distance so a splice plate was installed over a 36-inch length of the
bulkhead web as also shown in Figure C10 [C2, C7, C8].

C7
 Rear Pressure Bulkhead Rupture Due to MSD
520 Fatalities
Caused by Rogue Faulty Repair
One Row of Rivets Carrying Hoop Tension Load
Due to Cabin Pressure Instead of the Required
Two Rows
MSD Over 40 Inches Of
Single Rivet Splice In
Crack Stopper Straps Bulkhead Web

Bulkhead Made Up From

Pie Shaped Segments
With Two Rivet Rows
Segment of Rear Pressure Bulkhead

Figure A I-VI-8 JAL Accident in Japan 12 August 1985 Due to Rogue Repair
Figure C10: Sketches of Location of Failure in 747SR Rear Pressure Bulkhead

The splice plate was incorrectly installed in two pieces as shown in Figure C11 such that only
one row of rivets was carrying load. Because of this overload, multi-site-damage initiated over a
40 inch length of the bulkhead web splice at the single row of rivets. The multi-site damage
linked up into a critical crack, which did not arrest, because of the MSD, and caused the
bulkhead to fail. Subsequent to this accident Boeing redesigned the bulkhead with heavier
“super” tear straps.

C8
 Short edge distance
on this row of Upper
Upper rivets in lower dome dome
dome
Two rivet
rows
Two effective
rivet rows
effective
Single rivet row
Lower transferring upper Lower
Lower
dome dome loads to dome
dome
lower dome
Original repair Intended repair Actual repair
design rework
Splice plate was installed in two
pieces inadvertently

Figure A I-VI-9 747. Sta. 2360 Pressure Bulkhead Repair Splice

Between Upper and Lower Dome.
Figure C11: Construction Details Associated with Initial and Repaired 747SR Rear
Pressure Bulkhead

In addition to the manufacturing defect of the two-piece splice plate, the rivets in the single row
were “clinched” as indicated in the photographs and sketches shown in Figure C12. Clinching is
caused by misaligning the bucking bar to the rivet. Consequently the head is smeared to one side
leaving a gap in the hole as shown in the figure. A clinched rivet does not properly fill the hole
and will result in a much earlier crack initiation. Along with the high stresses caused by the
single rivet row these repair defects contributed to the early development of the multi-site
damage. In fact, it is quite possible that if these rivets had been properly bucked the airplane
would have been retired before the accident took place.

C9
 Rivets in Single Row Out of square bucking
Were "clinched" Resulting
In very poor fatigue life

Gap allowing hole boundary

displacement - fastener not
filling the hole

Figure A I-VI-10. B-747 Bulkhead Repair - Clinched Rivets in Single Row

Figure C12: Photos Illustrating RivetRogue
Constituting Damage on 747SR Rear Pressure Bulkhead
Flaw.

C10
 APPENDIX C.5
China Airlines Boeing 747
Accident Summarized by
Charles F. Tiffany with input from
Steven Chisholm

Figure C13: Photo of Boeing 747-200

On May 25, 2002 China Airlines Flight C1611, A Boeing 747-200 experienced an explosive
decompression at an altitude of 34,900 feet. The aircraft was on a scheduled flight from Taipei,
Taiwan to Hong Kong, China when it crashed into the Taiwan Strait 23 miles northeast of
Makung, Penghu Islands. There were 225 fatalities (206 passengers and 19 crew members). The
aircraft had accumulated 20,400 flight cycles compared to the original design goal of 20,000
cycles [C9-C11].

The Republic of China‟s Aviation Safety Council concluded that the in flight breakup of Flight
C1611 was the result of structural failure of the lower aft lobe of the pressurized fuselage. They
concluded that the structural failure was in turn due to a faulty repair of damage that occurred to
the lower lobe some 22 years prior to the accident flight. On February 7, 1980 this aircraft
(which was nearly new at the time) suffered a tail strike while landing in Hong Kong. This tail
strike resulted in scrapes to the fuselage both in the pressurized Section 46 and the non-
pressurized Section 48 tail cone. Temporary repairs were made the next day and permanent
repairs were made on May 23 through 26, 1980, No permanent records of these repairs were
found and the China Airlines staff indicated that they considered the repairs to be minor and thus
it was not necessary to keep records or report them to Boeing [C12].

Inspection of the recovered skin panels indicated that the repairs were not made in accordance
with the Boeing Structural Repair Manual (SRM). The SRM said that the scrape marks (i.e.,
sharp edged scratches) must be cleaned up and if they exceed 15% of the skin thickness in depth
the damaged area must be removed and repaired with a doubler or the skin panel replaced. The
scratches did exceed the allowable depth, were not completely cleaned up by sanding and were
covered up with a doubler that did not extend sufficiently beyond the damaged area. In fact the
longitudinal scratch that initiated the fatigue crack that led to the fuselage failure was located
under the doubler, but just beyond (and in some areas through) the outer row of fasteners, which

C11
attached the doubler to the fuselage skin. Thus the doubler was ineffective in reducing the
applied hoop stress in the skin at this longitudinal scratch.

During the interim 22 years of service subsequent to the repair, fatigue cracks initiated at the root
of this scratch at numerous sites, grew through the thickness and linked up forming a 15.1-inch
long through the thickness crack centered at fuselage station 2100. Some multiple site cracking
(MSD) was present both forward and aft of this crack which formed a total length of about 25.4
inches. It is evident from fretting marks and additional crack arrest and fatigue marks that the
actual crack length that existed just prior to the final failure was very much longer. Based on the
fretting evidence the Aviation Safety Council concluded that the crack length that existed at the
time of the accident had to be at least 71-inches. Based on the indications of crack arrest
followed by increments of fatigue striations, The Boeing Materials Technology organization
(BMT) estimated the final crack length to be about 93-inches long. See Figure C14.

Figure C14: Crack Location under Edge of Repair Doubler [C9]

The repair doubler was made from 0.063-inch thick 2024-T3 aluminum and was 23-inches wide
by 120 inches long,

Figure C15 is a photograph of a portion of the fracture face showing bands of fatigue growth
following increments of unstable crack growth and arrest (i.e., termed quasi stable growth by
BMT). Each of the bands of fatigue growth represents a number pressurization cycles. Note that
the crack location is outside the outer row of fastener holes, but still covered by the doubler.

C12
 Figure C15: Quasi-stable Crack Growth Identifying Numerous Starter Cracks (Prior to
Final Fracture) [C9].

Boeing developed a non-linear finite element model to predict the effect of the doubler on the
residual strength vs. crack length, when the skin was cracked in the observed location and not
allowed to bulge because of the doubler. The analysis indicated that the doubler does increase the
residual strength by a small amount and the crack length at failure was increased from about 50
inches to about 58 inches when the doubler was installed. This was attributed to the doubler
allowing increased load redistribution around the cracking area and a small decrease in the crack
tip stress intensity. This result is shown in Figure C16. It is noted that this prediction is
conservative when compared to the previously mentioned 71 inch and 93 inch values. At any rate
the structure has a very large damage capability in excess of a two bay crack length.

Figure C16: Predicted Residual Strength vs. Crack Length [C9]

C13
The author of this summary report has a few observations that are important when attempting to
prevent future accidents like shown in this accident. They are as follows:

1. As evidenced by the metallurgical evaluation of this accident and the residual strength
analyses performed by Boeing, it is clear that the Boeing 747 fuselage has a significant large
damage capability. This, of course, is also supported by other incidences contained in this report.
However, this China Airlines accident emphatically illustrates that to be fail-safe the large
damage (i.e., the arrested crack) must be detected and timely corrective actions taken to preclude
a complete failure.

2. It is apparent that the doubler designed and installed by China Airlines not only deviated from
the Boeing SRM requirements (by not removing the damaged material and not making the
doubler sufficiently large), but it also had a highly adverse effect on the ability to readily detect
the fatal skin crack.

a.) The doubler prevented visual detection from the exterior of the aircraft during walk
around ground inspections or during more than 20 heavy maintenance checks that were
performed prior to the accident flight. While records indicate that the interior of the aft
lower lobe was visually inspected during a zonal inspection in January 1999, the area was
not cleaned prior to the inspection and no magnifying glass was used. No NDI devices
were used in any of the inspections of this area.

b.) The doubler inhibited skin bulging at the crack when the fuselage was pressurized thus
tending to significantly reduce air leakage, which otherwise may have provided in-flight
evidence of the problem.

3. It seems ironic that instead of restoring the structural integrity of the fuselage after the 1980
tail strike (as would have been the case had the SRM been followed) the China Airlines repair
did not significantly slow the initiation and growth of the fatal crack and actually destroyed fail-
safety that likely would have saved the aircraft had the repair not even been performed.

C14
 APPENDIX C.6
Chalk Airways Grumman Mallard G-73
Accident Summarized by
Charles F. Tiffany

Figure C17: Photo of Grumman Mallard (G-73)

On December 19, 2005 the right wing separated on Chalk Airway‟s G-73 seaplane shortly after
takeoff from Miami, and the crash into the coastal water killed all 20 aboard. The wing was
recovered from the water on Dec. 20 and National Transportation Safety Board (NTSB)
engineers and metallurgists quickly observed that the wreckage indicated fatigue fracture of the
wing spar (see photo below). As an immediate result, Chalk's grounded its remaining fleet of G-
73 airplanes. The Federal Aviation Administration did not order grounding, preferring instead to
advise operators of what happened. The December 23 advisory was followed a week later by an
emergency airworthiness directive (AD) ordering inspection of the affected structure and
reporting the results to the FAA in order for the agency to have a better appreciation of the extent
of the problem. Frakes Aviation (formerly Grumman American) developed the nondestructive
inspection procedure that was used [C13, C14].

The investigation determined that the right wing separated because of preexisting fatigue
fractures in a double drilled fastener hole in the lower skin and rear lower spar cap. They said
that this fatigue damage reduced the residual strength capability of the right wing structure,
leading to the failure. Examination of the wreckage disclosed that a major repair had been made
to the lower right-wing spar at the location where the wing separated from the fuselage.
Maintenance records provided to the Safety Board, however, didn‟t contain any entry for this
repair.

There had been a history of fuel leaks near the area where the wing failed, and the investigators
said these leaks were indicators of structural damage inside of the wing. Had the leaks been
properly addressed, the extent of the problem could have been discovered, the NTSB reported.
However, that would not necessarily have made the airplane safe, according to the investigators.
Metallurgical examination also showed significant fatigue cracks affecting the airplane‟s left
C15
wing, including one crack on the left-wing front spar lower cap that had extended from an area of
corrosion damage and had begun to progress fairly rapidly. The Safety Board said that had the
airplane not experienced the catastrophic failure of the right wing, the crack in the left wing
likely would have led to a catastrophic failure. The Board said that the company‟s maintenance
program was ineffective at identifying and correcting the long-standing structural problems that
led to the in-flight separation of the right wing. The company‟s Director of Operations was
quoted in the NTSB‟s report as defending the safety of airplanes in its fleet and pointing to the
company‟s 86-year unblemished safety record before the time of the accident. However, the
NTSB report referenced seven accidents or incidents involving Chalk‟s aircraft before the crash
of flight 101.

The Safety Board noted that the FAA inspector who was responsible for overseeing the
company‟s maintenance said it met all FAA requirements, and he was comfortable with the
maintenance being performed on Chalk‟s airplanes. He had conducted an aging-aircraft
inspection and records review only a few weeks before the accident. The Safety Board said he
should have raised a red flag about the recurring fuel leaks on the accident airplane [C13].

The Safety Board reported there were some other clues that should have caused the FAA to look
more closely at maintenance on Chalk‟s aircraft. Among these were: 1) paperwork from the
Department of Transportation expressing concern about the airline‟s financial condition; 2) an
incident in November 2004, when an airplane‟s elevator cable failed in flight and the airline
submitted a Service Difficulty Report to the FAA; and, 3) a landing-gear-fatigue failure incident
in 2001. The NTSB concluded that the Chalk‟s Ocean Airways maintenance program plan was
inadequate to maintain the structural integrity of its aircraft fleet.

The NTSB determined that the probable cause of this accident was the in-flight failure and
separation of the right wing during normal flight, which resulted from: 1) the failure of the
Chalk‟s Ocean Airways maintenance program to identify and properly repair fatigue cracks in
the right wing; and, 2) the failure of the FAA to detect and correct deficiencies in the company‟s
maintenance program.

Figure C18 provides a photograph of the fracture face of the right wing rear spar cap. Note the
double drilled hole, which occurred as a result of a repair performed at a significant (but
undetermined) time prior to the accident flight. Also, note the fatigue crack growth that occurred.

C16
Figure C18: Photo of the Fracture Face of the Right Wing Rear Spar Cap [C13]

C17
APPENDIX GROUP C REFERENCES

C1 Swift, Thomas, Personal Files.

C2 McGuire, Jack F., “Fail-Safe Requirements for Aircraft Structures” Presented at the
47th AIAA/ASME/AHS/ASCE/ASE Structures, Structural Dynamics and Materials
Conference, Newport, Rhode Island, 1-4 May 2006.
C3 Swift, Thomas, “Fail-Safe Design Requirements and Features, Regulatory
Requirements,” Technical paper presented at AIAA Conference, Dayton, Ohio, July
2004.
C4 NTSB, “Aircraft Accident Report – American Airlines, Inc.DC-10-10, N11OAA,
Chicago-OHare International Airport, Chicago, Illinois, May 25, 1979,” NTSB-AAR-
79-19, 21 Dec 1979, Washington DC.
C5 Report of the DC-10 Science Advisory Group titled, “An Investigation of the Structural
Integrity of the DC10-10 Engine Pylon, July 6, 1979.” This group reported to Mr.
Langhorn Bond, The FAA Administrator and was chaired by Dr. Raymond
Bisplinghoff. The other members of the group were Prof. James Mar, C .F. Tiffany, and
Prof. Lucien Schmit.
C6 Swift, Thomas, Personal Files, Mr Swift was the Group Supervisor for the DC-10
Pylon Damage Tolerance Evaluation at Douglas Aircraft Company.
C7 TOGAA: The Technical Oversight Group on Aging Aircraft, “The FAA‟s Recent
Rulemaking activity and Its Adverse Effect on Transport Airplane and Rotorcraft
Structural Integrity,” 24 August 2004, Unpublished final report delivered to the FAA‟s
Associate Administrator for Regulation and Certification, 800 Independence Ave. SW,
Washington, DC 20591
C8 Swift, Thomas, Personal Files, Mr Swift was a member of the NTSB accident
investigation team.
C9 The Republic of China‟s Aviation Security Council‟s Aviation Occurrence Report,
Volume 1 (ASC-05-02-001) titled, “In-Flight Breakup Over The Taiwan Strait
Northeast Of Makung, Penghu Island, China Airlines Flight CI611, Boeing 747-200, B-
18255”, May 25, 2002.
C10 The Republic of China‟s Aviation Security Council‟s CI611 Accident Investigation
Factual Data Collection Group Report: Structures Group, ASC-AFR-03-06-001, 3 June
2003.
C11 http://aviation-safety.net/database/record.php?id=20020525-0
C12 Chisholm, Steven A., Comments Mr Chisholm was Boeing Commercial Airplanes
Chief Structural Engineer for Technical Support, and participated in this accident
investigation, Comments dated June 16 2009 through June 24, 2009.
C13 NTSB Report, AAR-07/04 titled, “In-flight Separation of Right Wing, Flying Boat Inc.
(doing business as Chalk’s Ocean Airways) Flight 101 Grumman Turbo Mallard (G-
73T), N2969, Port of Miami, Florida, December 19, 2005,” Adapted 30 May 2007,
Washington DC.

C18
C14 Various other descriptions of the accident including the Flight Safety Foundation
Aviation Safety Network at www.flightsafety.org and from Wikipedia:
http://en.wikipedia.org/wiki/Chalk%27s_Ocean_Airways_Flight_101.

C19
 APPENDIX D
ACCIDENTS / INCIDENTS RESULTING FROM ENVIRONMENTAL
DAMAGE
APPENDIX D.1
British-European Airlines Vickers Vanguard 951
Accident Summarized by
Charles F. Tiffany

Figure D1: Photo of Vickers Vanguard 951 Aircraft

On October 2, 1971 a British-European Vickers Vanguard 951 in route from London to

Salzburg, Austria crashed in Belgium killing a total of 63 passengers and crew. The investigation
of this accident revealed that the rear pressure bulkhead had ruptured allowing the pressurized air
to enter into the horizontal tail plane blowing off upper skin panels leading to their breakup. This
structural failure then caused the airplane to pitch down and dive to the ground. A close
examination of the fractured aluminum pressure bulkhead revealed an eighteen-inch wide area of
corrosion and disbonded doubler strip near the bottom centerline of the airplane. This corrosion
combined with about 2.5-inches of fatigue tears then resulted in rapid propagation and complete
rupture of the bulkhead. This fracture initiated at point A shown in Figure D2. Moisture had
collected between the frame and the inner surface of the bulkhead due to condensation. The
water was unable to drain through a drain hole in the lower end of the frame web (not shown in
Figure D2), because it had been inadvertently filled with sealing paste. This water then caused
the corrosion, the disbonding of the doubler and the fatigue crack extension at point A [D1, D2].

D1
Figure D2: Sketch of Construction Details that Led to Corrosion and Subsequent
Catastrophic Failure of the Vickers Vanguard 951 Aircraft

D2
 APPENDIX D.2
Far Eastern Air Transport Boeing 737
Accident Summarized by
Charles F. Tiffany and Thomas Swift

Figure D3: Photo of Boeing 737 Aircraft

On August 5, 1981 Far Eastern Air Transport‟s (FEAT‟s) Boeing 737 B-2603 lost cabin pressure
during a flight from Taipei to Kaohsiung. On August 22, the same aircraft took off from Taipei
on a flight to Makung and again lost cabin pressure and then returned to Taipei where some
repair work was performed on the pack valves of the environmental control system. Later that
same day it again took off as flight number 103 to Kaohsiung. Fourteen minutes after take-off
the aircraft suffered an explosive decompression and crashed killing the 104 passengers and 6
crewmembers. The airplane had accumulated 33,313 pressure cycles at the time of the accident
[D3].

The investigation revealed that the probable cause of the accident was extreme corrosion in the
lower fuselage. There were a number of locations where intergranular corrosion pits had
penetrated the skin. In addition, there was exfoliation corrosion that caused extreme thinning of
the skin thickness. Investigation of the repair history indicated that there had been six repair
patches installed just below stringer S-26L while final fracture occurred at stringer S-27L in the
lower lobe of the fuselage. While the investigation was hampered due to difficulty finding the
corroded belly skin, a farmer eventually came forward with a section of the skin. This piece
indicated very severe corrosion over a length of 65-inches where the thickness had corroded
down to 0.01 inches from the nominal design thickness of 0.036-inch. This would result in a
hoop stress of about 55 KSI at the normal operating pressure. At this stress level, the fatigue life
is negligible and the fail-safety destroyed, since the corrosion damage existed well beyond the
design fail-safe damage size (i.e., a two bay crack with a broken central frame). According to the
signed inspection records the aircraft had received an internal inspection of the lower lobe
structure on June 22, 1981 and an external inspection of the fuselage skin just nine days before
the accident. Based on the extreme severity of the corrosion one certainly has to question
whether or not the inspections were really performed. A sketch showing the stringer locations
and the more severe areas of corrosion is in Figure D4.

D3
 Time on Aircraf t
22031 Hours, 33313 Flights

26 26
27 28 28 27
Inspection Records call
f or D Check 11 to 22 June Sev ere Corrosion
1981 in Bilge Area In Belly Skin Stn 360 to 540
Moisture Trap

Stringer Corrosion

Skin Corrosion
Under Stringer
27 L Inspection Records
call f or Skin Inspection
13 August 1981- 9 Day s
Bef ore Accident

Figure D4: Sketches Illustrating the Locations and Causes of Corrosion on B737 Aircraft

Two photographs of corrosion found in the lower lobe of this aircraft are shown in Figures D5
and D6.

Figure D5: Photo of Skin Corrosion in Lower Lobe of B737 Aircraft

D4
 Figure D6: Photo Illustrating Loss of Frame and Stringer Due to Severe Corrosion

While Taiwan was responsible for the accident investigation, a U.S. team consisting of
representatives from the NTSB, FAA and Boeing assisted. Tom Swift was the representative
from the FAA. While this team waited for portions of the accident aircraft to be recovered, they
had the opportunity to examine two other B 737 aircraft that had approximately the same number
of flight cycles (33, 274 and 30, 497). One aircraft was another FEAT 737 that was in
maintenance for an engine change and the second airplane was a China Airline‟s 737 that was
having some belly skin panels replaced because of corrosion. Mr. Swift reported that the exterior
of the FEAT 737 appeared to be clean, but when the interior floor was removed there were five
adjacent fuselage frames that were completely corroded through at stringer 26 on the left hand
side of the aircraft. The inspection records indicated that this area had been inspected and the
corrosion inhibitor LPS3 applied just nine months earlier thus again raising doubts about the
validity of the records. These doubts were further reinforced by the fact that it took two days to
remove the floor because of severe corrosion in the screws that attach the floor. It is difficult to
believe that these same screws had been removed just nine months previously for the inspection.

The skin panels that were removed from the FEAT‟s Boeing 737 were corroded so severely that
that they were paper-thin and could be torn by hand. Mr. Swift pointed out that, in addition to the
severe thinning, the intergranular corrosion had caused severe pitting and holes in the skin. He
said that it was difficult to imagine how the fuselage ever maintained pressure. Photographs of
the skin removed from the B 737 aircraft are shown in Figure D7.

D5
 Hole 6 Inches
Hole 3 Inches by 2 Inches
by 1.5 Inches

Corrosion

Hole 2 Inches
by 3 Inches
Crack Crack

Figure D7: Photos Illustrating Severe Corrosion of FEAT B737 Aircraft

D6
APPENDIX GROUP D REFERENCES

D1 Macarthur, Job, “Air Disaster, Volume 4,” Published by Aerospace Publications Pty
Ltd. 2001
D2 McGuire, Jack F., “Fail-Safe Requirements for Aircraft Structures,” Presented at the
47th AIAA/ASME/AHS/ASCE/ASE Structures, Structural Dynamics and Materials
Conference, Newport, Rhode Island, 1-4 May 2006
D3 Based on a first hand account and data and photographs provided by Tom Swift, who
was a member of a United States team that assisted the Taiwan Civil Aviation
Authority in the failure investigation

D7
 APPENDIX E
ACCIDENTS / INCIDENTS RESULTING FROM IMPACT FROM
GROUND EQUIPMENT
APPENDIX E.1
Alaska Airlines McDonnell-Douglas MD-80
Incident Summarized by
Charles F. Tiffany

Figure E1: Photo of McDonnell-Douglas MD-80 Aircraft

Aircraft are occasionally damaged by ground equipment. In the act of servicing aircraft between
flights, a great deal of ground equipment operates in close proximity to aircraft fuselages and
wings and they occasionally get bumped. Damage may be in the form of simple scratches in the
paint or small dents in the skin. However, because aircraft structures (including the outer skin)
play such a critical role in the safe operation of a flight, all damage is inspected, measured and
possibly tested to ensure that any damage is within safe tolerances. A dent that may look no
worse than common "parking lot damage" to an automobile can be serious enough to ground an
airplane until a repair can be made [E1].

The seriousness of this problem is illustrated by the December 28, 2005 depressurization incident
on Alaska Airlines flight 536. During ground services a baggage handler hit the side of the
aircraft with a tug towing a train of baggage carts. This dented the metal skin of the aircraft. This
sharp dent was not reported and the plane departed. Climbing through 26,000 feet the cabin
pressure and resulting membrane stresses in the skin resulted in skin cracking and arrest. The
cabin depressurized and an emergency landing was made. Post landing examination of the
fuselage revealed a 12-inch × 6-inch (30-cm × 15-cm) hole between the middle and forward
cargo doors on the right side of the fuselage (See Figure E2). The fail-safe design of the MD-80
fuselage prevented an explosive decompression, which could have caused the loss of the aircraft
and life of those aboard.

E1
 Figure E2: Photo of Skin Failure Following Ground Handling Damage

E2
 APPENDIX E.2
Varig Brazilian Airlines Boeing 747
Incident Summarized by
Charles F. Tiffany

Figure E3: Photo of Boeing 747 Aircraft

A 65-inch crack was discovered in the fuselage of a Varig Brazilian Airline 747 aircraft on May
22, 1988. Investigation of the incident revealed that the side of the fuselage had been impacted
by an air-stair during ground operations in Bermuda. This impact precipitated the 65 inch long
skin crack. Fail-safety was provided by the intact fuselage frames plus adjacent skin [E2].

Figure E4: Sketch Illustrating Location of Handling Damage Induced Crack on the B`747
Aircraft

E3
APPENDIX GROUP E REFERENCES

E1 Incident reported in Seattle Post Intelligencer newspaper by James Wallace, December

28, 2005. Photograph of fuselage depressurization damage obtained from Internet at:
http://www.askthepilot.com/theunthinkable2005.html
E2 McGuire, Jack F.; “Fail-Safe Requirements for Aircraft Structures,” Presented at the
47th AIAA/ASME/AHS/ASCE/ASE Structures, Structural Dynamics and Materials
Conference, Newport, Rhode Island, 1-4 May 2006.

E4
 APPENDIX F
ACCIDENTS / INCIDENTS RESULTING FROM UNCONTAINED
ENGINE FAILURES
APPENDIX F.1
United Airlines McDonnell-Douglas DC-10
Accident Summarized by
Charles F. Tiffany

Figure F1. Photo of McDonnell-Douglas DC-10 Aircraft

A United Airlines McDonnell Douglas DC-10, registration number N1819U, on a flight from
Denver to Philadelphia suffered a number 2 tail engine failure on 19th July, 1989. The aircraft
diverted to Sioux City Airport where it broke up and burned while making a crash landing.
There were 185 survivors and 111 fatalities [F1, F2]..
The accident was precipitated by failure of the stage 1 fan disk that had been manufactured by
General Electric Aircraft Engines. A type 1 hard alpha particle in the titanium Ti-6l-4V forging
in the most highly stressed region of the disk bore was not discovered by the quality assurance
program. Fatigue propagated this manufacturing defect to a critical size when fast fracture
occurred. The engine had experienced 16,899 cycles at failure.
The FAA formed a team “Titanium Rotating Components Review Team” to investigate all
aspects of titanium production. The team visited 23 organizations and facilities as a part of this
investigation. This investigation resulted in many changes to process controls throughout the
industry. The results of the FAA investigation are contained in “Titanium Components Review
Team Report” dated December 14, 1990 [F3]. A photograph of the airplane during its final
approach is shown in Figure F2. Figure F3 shows the location and size of the initial
manufacturing defect that resulted in the failure of the stage 1 fan disk.

F1
 Figure F2: Photo of DC-10 Aircraft on Final Descent to Sioux City

Sketch of Defect Size & Location

Stage 1 Fan
Rotor Disk

0.055 In. 0.015 In.

Bore of disk

C/L
Type 1 Hard Alpha Flaw
"Rogue" Flaw

Figure A I-VI-11 Stage 1 Fan Rotor Disk. DC-10 Accident at Sioux City, Iowa
Figure F3: Sketch of General July 19, 1989
Electric Engine Defect Size and Location

F2
 APPENDIX F.2
National Airlines McDonnell-Douglas DC-10
Accident Summarized by
Charles F. Tiffany

Figure F4: Photo of McDonnell-Douglas DC-10 Aircraft

This example addresses the need to design basic structure to tolerate very large damage. A
National Airlines DC-10 aircraft, cruising over New Mexico on November 3, 1973 suffered a
disintegration of the No. 3 engine. Engine fragments so severely damaged the fuselage that a
passenger was ejected through a window. The wing, empennage and the No. 1 engine were also
severely damaged as depicted in the sketch shown in Figure F5. The extensive damage to the
fuselage did not precipitate an explosive decompression failure because the DC-10 was designed
to sustain a two-bay crack and a broken central frame. This very large damage tolerance was
achieved through the addition of a titanium crack arresting and crack stopper system [F1, F4,
F5].

The National Transportation Safety Board determined that the probable cause of this accident
was the disintegration of the No. 3 engine fan assembly as a result of an interaction between the
fan blade tips and the fan case. The fan-tip rub condition was caused by the acceleration of the
engine to an abnormally high fan speed which initiated a multiwave, vibratory resonance within
the fan section of the engine. The precise reason or reasons for the acceleration and the onset of
the destructive vibration could not be determined conclusively.

F3
 Vertical
Stabilizer Passenger Lost
Damage Through
Window
Horizontal
Stabilizer Number 1
Damage Engine Damage

Wing Damage

Engine Failure
Frame
Fuselage Damage
Large And Small
Crack
Stopper

Figure F5: SketchFigure A I-VIII-5.

Illustrating DC-10
Location Accident,
of Fuselage New Mexico
Damage Due to an Uncontained
Engine Failure and Construction Details

F4
 APPENDIX F.3
Air France Airlines Boeing 747
Incident Summarized by
Charles F. Tiffany

Figure F6: Photo of Air France Boeing 747 Aircraft

In May 1971, an Air France Boeing 747 flying out of Paris had a compressor disk failure. The
resulting debris penetrated the wing. The photographs in Figure F7 show the wing damage [F6].

Figure F7: Photos of Wing Damage on the B747 Aircraft Caused By Engine Failure

F5
 APPENDIX F.4
UTA Boeing 747
Incident Summarized by
Charles F. Tiffany

Figure F8: Photo of UTA Boeing 747 Aircraft

In January of 1985 a 747 from the French airline Union des Transports Ae´riens (UTA) had an
uncontained engine failure while over Zaire. The wing damage is shown in Figure F9 [F6].

Figure F9: Photos of Wing Damage Caused by Engine Failure

F6
 APPENDIX F.5
Delta Airlines McDonnell-Douglas MD-88
Accident Summarized by
Charles F. Tiffany

Figure F10: Photo of McDonnell-Douglas MD-88 Aircraft

On July 6, 1996, at 1424 central daylight time, a McDonnell Douglas MD-88, N927DA,
operated by Delta Air Lines Inc., as flight 1288, experienced an engine failure during the initial
part of its takeoff roll on runway 17 at Pensacola Regional Airport (PNS) in Pensacola, Florida.
Uncontained engine debris from the front compressor front hub (fan hub) of the No. 1 (left)
engine penetrated the left aft fuselage (See Figure F11). Two passengers were killed, and two
others were seriously injured. The takeoff was rejected, and the airplane was stopped on the
runway. The airplane, operated by Delta as a scheduled domestic passenger flight under the
provisions of Title 14 Code of Federal Regulations (CFR) Part 121, with 137 passengers and 5
crew on board, was destined for Hartsfield Atlanta International Airport in Atlanta, Georgia [F7].

The National Transportation Safety Board determined that the probable cause of this accident
was the fracture of the left engine‟s front compressor fan hub (i.e., disk) as shown in Figure F12,
which resulted from the failure of Delta Air Lines‟ fluorescent penetrant inspection process to
detect a detectable fatigue crack initiating from an area of altered microstructure (i.e., a
manufacturing defect) that was created during the drilling process by Volvo for Pratt & Whitney
and that the defect went undetected at the time of manufacture.

F7
Figure F11. Photo of Engine and Fuselage Damage as a Result of Engine Failure

Figure F12. Photo of Fractured Pratt & Whitney Compressor Fan Disk

F8
 APPENDIX F.6
Mesa Airlines Bombardier Regional Jet CRJ 200
Incident Summarized by
Charles F. Tiffany

Figure F13: Photo of Bombardier Regional Jet CRJ 200 Aircraft

On January 25, 2007 a CRJ-200 aircraft operated by Mesa Airlines experienced an uncontained
engine failure during a flight between Denver and Phoenix. The No. 1 engine, a GE CF34-3B1,
threw a fan disk and blades during cruise. The debris took out the engine's forward cowling and
punctured the fuselage as it departed the aircraft as shown in Figure F14 [F8].

While the No. 1 engine experienced a fan disk separation, it resulted in the separation of the
inlet, fan rotor assembly, the fan containment case, and portions of the thrust reverser. The
airplane reversed course and landed without further incident. Post incident examination revealed
damage to the aft portion of the fuselage and empennage. An examination of the remaining
airplane systems revealed no anomalies. Portions of the fan disk were recovered and examination
of the fan disk revealed fatigue striations emanating from the aft bore corner of the fan disk. The
striations came from an area that exhibited characteristics consistent with arc-out damage, which
was the result of improper assembly and marking procedures during the electrochemical etching
process. This damage was not detected during the manufacturer's quality assurance process used
by the manufacturer. Further, the operator did not detect this damage while conducting the
inspections prescribed through required airworthiness directives because the inspection
procedures required were not detailed enough to detect the arc-out damage and the maintenance
personnel did not receive appropriate training. Following the incident, the manufacturer issued
alert service bulletins and the FAA issued an airworthiness directive to resolve these issues.

F9
Figure F14: Photo of Damage Associated With Engine Failure

F10
 APPENDIX F.7
American Airlines Boeing 767
Accident Summarized by
Charles F. Tiffany

On Friday June 2, 2006, a disk in the GE CF6 No. 1 engine failed during a ground run on an
American Airlines 767. The photograph in Figure F15 shows the failed engine. The photograph
in Figure F16 shows where the disk fragment passed through the fuselage cutting the lower
surface of the center wing box. The photograph in Figure F17 shows where the disk then
penetrated the casing of the number two engine on the opposite side of the airplane. The rear
fuselage (See Figure F18) and inboard flaps on the port side experienced over heating from
escaping combustor gases. It is likely that the airplane could not have survived had the failure
occurred during flight and the failed disk followed the same trajectory and stopped the second
engine [F9, F10, F11].

Figure F15: Photo of Damage Associated with Uncontained Rotor Failure in a GE CF6
Engine

F11
Figure F16: Photo of B747 Fuselage with Disk Penetration Damage Caused by
Uncontained Rotor Failure

Figure F17: Photo of B747 with Disk Embedded in No. 2 Engine Resulting from
Uncontained Rotor Failure in No. 1 Engine

F12
Figure F18: Photo of Engine Damage to the B747 Fuselage Resulting From Engine Failure

F13
APPENDIX GROUP F REFERENCES
F1 TOGAA: The Technical Oversight Group on Aging Aircraft (TOGAA) Final Report,
“The FAA‟s Recent Rulemaking activity and Its Adverse Effect on Transport Airplane
and Rotorcraft Structural Integrity,” 24 August 2004, Unpublished report delivered to
the FAA‟s Associate Administrator for Regulation and Certification, 800 Independence
Ave. SW, Washington, DC 20591
F2 NTSB Report, AAR90-06 “United Airlines Flight 232 McDonnell Douglas DC-10-10
Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989,” adapted 1 Nov 1990,
Washington, DC. http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-
reports/AAR90-06.pdf
F3 FAA‟s Titanium Rotating Components Review Team‟s Report dated Dec. 14, 1990.
Tom Swift was a member of this team.
F4 NTSB Report, AAR75-02, “National Airlines, Inc., DC-10-10, N60NA, near
Albuquerque, New Mexico, November 3, 1973,” adopted on 15 Jan 1975, Washington
DC. http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR75-
02.pdf
F5 Swift, Thomas; “Fail-Safe design Requirements and Features, Regulatory
Requirements,” Technical paper presented at AIAA Conference, Dayton, Ohio, July
2004.
F6 McGuire, Jack F.; “Fail-Safe Requirements for Aircraft Structures,” Presented at the
47th AIAA/ASME/AHS/ASCE/ASE Structures, Structural Dynamics and Materials
Conference, Newport, Rhode Island, 1-4 May 2006.
F7 NTSB, Aircraft Accident Report AAR-98-01, “Uncontained Engine Failure, Delta Air
Line Flight 1288, McDonnell-Douglas MD-88 N927DA, Pensacola, Fla., July 6, 1996,”
adopted on 13 Jan 1998, Washington DC. http://libraryonline.erau.edu/online-full-
text/ntsb/aircraft-accident-reports/AAR98-01.pdf
F8 Norris, Guy, “FAA calls for CF-34 Inspections after 25 January Mesa CRJ200 GE CF-
34 Uncontained Engine Failure,” www.FlightGlobal.com, Feb. 16, 2007.
F9 NTSB Identification: ENG06IA018.
The docket is stored in the Docket Management System (DMS). Please contact Records
Management Division, Nonscheduled 14 CFR, Incident occurred Friday, June 02, 2006
in Los Angeles, CA, Aircraft: Boeing 767-223(ER), registration: N330AA
F10 Photographs obtained on-line at http://forums.jetcareers.com/general-topics/69275-
american-767
F11 http://aviation-safety.net/database/record.php?id=20060602-0

F14
 APPENDIX G
ACCIDENTS/INCIDENTS RESULTING FROM BIRD STRIKES
APPENDIX G.1
Delta Airlines McDonnell-Douglas MD-88
Accident Summarized by
Charles F. Tiffany

Figure G1: Photo of McDonnell-Douglas MD-88 Aircraft

On February 18, 2008, a Delta Airlines MD-88 aircraft was damaged when it struck a large bird
while on approach to Austin–Bergstrom International Airport (Austin, Texas). The aircraft was
in the descent phase of a scheduled flight to Austin from Atlanta. The aircraft landed
successfully and there were no injuries. The damage to the aircraft‟s nose is shown in Figure G2
[G1].

Figure G2: Photo of Bird Strike Damage to Radome

G1
 APPENDIX G.2
American Airlines Boeing 767-300
Incident Summarized by
Charles F. Tiffany

On April 2, 2001 an American Airline‟s 767-300 enroute from Paris to Miami encountered a
flock of large birds while climbing through 12,000 feet. The radome, fuselage and wing leading
edge all received extensive damage as shown in the photographs below. One of the large birds,
believed to be cormorants, penetrated the cockpit area through the radome and forward pressure
bulkhead. The aircraft depressurized and the crew landed the plane in Paris with no injuries [G2].

Figure G3: Photo of Bird Strike Damage to B767 Aircraft Just Below the Cockpit
Windows

Figure G4: Photo of Bird Strike Damage to Underside of Fuselage of B767 Aircraft

G2
Figure G5. Photo of Bird-Strike Damage to Underside of B767 Fuselage Just Aft of the
Radome

G3
 APPENDIX G.3
USAF Lockheed C-130
Accident Summarized by
Charles F. Tiffany

Figure G6: Photo of C-130 Aircraft

In August of 2005 an Air National Guard C-130 transport aircraft flying near Tacoma,
Washington was hit by a bald eagle. As can seen by the photos in Figures G7 through G9, the
bird (obviously in excess of the 4 pound design weight) penetrated a small window on the left
side of the cockpit, missed the pilot and splattered against the bulkhead behind the pilot [G3].

Figure G7.: Photo of Bird Strike Damage to Outside of the C-130 Aircraft

G4
 Figure G8: Photo of Bird Strike Damage to Front of C-130 Cockpit

Figure G9: Photo of Bird Strike Damage to Interior of the C-130 Aircraft

G5
APPENDIX GROUP G REFERENCES
G1 Photos and description of the incident available at http://aircrewbuzz.com/2008/03/bird-
strike-damages-radome
G2 Photos and description provided by The Boeing Company‟s Customer Service
Organization.
G3 Photos and description of incident available at http://www.militaryphotos.net

G6
 APPENDIX H
ACCIDENTS / INCIDENTS RESULTING FROM RUNWAY DEBRIS
APPENDIX H.1
Air France Concord
Accident Summarized by
Joseph P. Gallagher

Figure H1: Photo of Concorde

On July 25, 2000, 113 individuals lost their lives as a result of an Air France Concorde
accident caused by runway debris. All 100 passengers and nine crew members on board
perished, and on the ground, four additional individuals died as a result of the crash [H1, H2].

The accident was found to be caused as a result of a relatively small titanium strap that dropped
to the runway from a Continental Airlines DC-10 that took off approximately 5 minutes before
the Concorde entered the runway. This titanium strap was about 1.2-inch wide and 17-inch long.
When this titanium strap struck the tire on the Concorde wheel No. 2 (attached to the left main
landing gear) while the plane was traveling at a speed exceeding 190 mph, it caused the tire to
disintegrate. Pieces of the tire then impacted, with at least one piece penetrating, the left wing
fuel tank No. 5 (above the left main landing gear).

The tire impact and fuel tank penetration was thought to then cause a hydraulic hammer shock
which resulted in further catastrophic damage to the fuel tank and a fire. Tire debris and the fire
caused the left engines (Nos. 1 & 2) to temporarily shut down, and while the pilots were able to
restart the No. 1 engine, it recovered for only a short period of time but later failed completely.
The damage to the landing gear prevented it from being retracted making flying difficult.
However, it was decided that the major structural damage to the left wing fuel tank and the loss
of thrust on the Nos. 1 and 2 made the aircraft incapable of continuing flight; and shortly after
leaving the Charles de Gaulle airport, the Concorde crashed.

H1
A large part of fuel tank No. 5 was found on the runway; the other part of this fuel tank was
found at the accident site and had a star shaped penetration that measured approximately 0.4-inch
by 1.6-inch. This penetration was believed caused by a piece of tire.

A piece of tire weighing about 10 pounds was found on the runway close to the titanium strip
along with other pieces of the tire. The titanium strip that fell to the runway from the DC-10 was
part of the thrust reverser cowl door for the No. 3 engine. The BEA investigation determined
that this strip was not manufactured nor installed in accordance to OEM procedures; this strip
was recently replaced on 9 July, 16 days before it fell from the DC-10 during takeoff.

H2
APPENDIX GROUP H REFERENCES

H1 BEA, “Accident on 25 July 2000 at La Patte d‟Oie in Gonesse (95) to the Concorde
registered F-BTSC operated by Air France,” Report (English) translation, Report no. f-
sc000725a, BUREAUDENCLE TES ET D‟ANALYSES POUR SECURETE DE
L‟AVIATION , Ministere De L‟Equipment Des Transports et Du Logement, CVLE,
France, December 14, 2004.
http://www.bea-fr.org/docspa/2000/f-sc000725a/htm/f-sc000725a.html.

H2 Concorde Flight 4590 crash, retrieved from "http://en.wikipedia.org/wiki/Concorde."

Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit
organization.

H3
 APPENDIX I
ACCIDENTS / INCIDENTS RESULTING FROM EXPLOSIVE
PENETRATION
APPENDIX I.1
Qantas Airlines Boeing 747
Accident Summarized by
Charles F. Tiffany

Figure I1: Photo of a Quantas Airlines Boeing 747 Aircraft

On July 25, 2008 a Qantas Airline Boeing 747 enroute to Melbourne, Australia from London
was cruising at 29,000 feet when it experienced an explosive decompression of the fuselage. Per
standard procedure the plane immediately descended to 10,000 feet and minutes later made an
emergency landing at the Manila airport in the Philippines. There were 346 passengers onboard
and there were no fatalities or injuries to any of the passengers or crew. Upon post flight
examination a large hole was seen in the lower right side of the fuselage just forward of the
wing. This is shown in the photographs in Figures I2 through I4 [I1].

I1
 Figure I2: Photo of Boeing 747 Fuselage after On-Board Explosion

Figure I3: Close Up View of Boeing 747 Fuselage after On-Board Explosion

I2
 Figure I4: Alternate Close Up View of Boeing 747 Fuselage After On-Board Explosion
Illustrating Loss of Structure

On August 29, 2008, the Australian Transportation Safety Bureau (ASTB) confirmed that the
incident was caused by the bursting of one of two oxygen bottles that were located in this area of
the cargo compartment and has been found to be missing. Also, shards from the missing oxygen
bottle and the oxygen regulator valve were found in the fuselage. This investigation the failure
provides another strong testament to the importance of having fail-safe structures with large
design damage sizes.

I3
APPENDIX GROUP I REFERENCES
I1 Based on several news reports. Photos obtained from http://www.airlineempires.net

I4
 APPENDIX J
ACCIDENTS / INCIDENTS RESULTING FROM WFD
APPENDIX J.1
Aloha Airlines Boeing 737-200
Accident Summarized by
Charles F. Tiffany

Figure J1: Photo of Aloha Airlines Boeing 737 Aircraft

At 1:25 PM on April 28, 1988 Aloha Airlines Flight No. 243 departed Hilo, Hawaii with a crew
and 89 passengers on board. When leveling off at 24,000 feet, there was an explosive
decompression of the fuselage, whereby the upper portion of the forward fuselage separated from
the airplane. One flight attendant was swept out of the airplane, but the passengers who still had
their seat belts fastened remained on board, and the pilot was able to successfully land the
airplane. Several of the passengers and crew sustained injuries. A photograph of the airplane is
shown Figure J2 [J1, J2].

Figure J2. Photo Illustrating Extent of Aircraft Damage to Boeing 737 Aircraft Following
Failure Due to Widespread Fatigue Damage

J1
The extent of the damage is shown in the Figures J3 and.J4.

Figure J3: Sketch Illustrating Side View of Fuselage with Missing Area of Boeing 737
Aircraft

Figure J4: Sketch Illustrating the Fuselage Missing Area from a View Looking Forward

J2
This accident was a watershed event in that it highlighted the fact that a fail-safe design will not
ensure structural safety after the structure encounters the onset of widespread fatigue damage
(WFD). This normally occurs late in the aircraft‟s operational life, but this onset can be
accelerated by other factors as it was in this case. At the time of the accident the airplane had
89,680 flight cycles compared to the design service objective of 75,000 flight cycles thus it was
considered to be an aging aircraft.

The investigation of the failure revealed that it initiated in the upper row of rivets in the stringer
no. 10 (S-10) longitudinal lap splice that was a cold bonded and riveted joint. Boeing used this
cold bonded design in the first 291 737 aircraft. However, it was later discovered that cold
bonded joints can be subject to disbonding when moisture is present. When this occurs all of the
pressure induced hoop load is transferred through the rivets rather than the bonded surface. This
induces very high stress concentrations at the knife edge countersinks in the outer skin and
fatigue cracks initiate. This is illustrated in the sketches shown in Figures J5. and J6.

Figure J5: Sketch Illustrating the Development of Small Fatigue Cracks in the Skin

Figure J6: Sketch Illustrating the Location of Small Fatigue Cracks in the Skin
J3
At the onset of WFD fatigue cracks have initiated in adjacent fastener holes and have reached the
size and density that the large damage fail-safety no longer exists. If allowed to continue to grow
the cracks will link up thus forming a lead crack, which will result in unstable rapid propagation
when it reaches its critical size. However, because of the initiation of small cracks in the fastener
holes ahead of the lead crack it will not arrest at the frames and tear straps and complete
catastrophic failure will ensue. The onset of WFD and the formation of a lead crack is illustrated
in the sketch Figure J7.

Figure J7: Sketches Illustrating the Development of Small Fatigue Cracks in the Skin

J4
This was the progression of the crack growth at the S-10 longitudinal lap splice in the Aloha 737
fuselage; unfortunately, the lead crack was not discovered (and repaired) prior to the accident
flight, since the recommended inspections were never performed.

On Boeing 737 aircraft beyond the 291st aircraft manufactured, the lap splice joint design was
improved with the incorporation of a moisture resistant hot bonded doubler, which was expected
to substantially delay the onset of WFD. This improvement is compared to the original design in
Figure J8.

Figure J8: Sketches Illustrating the Lap Splice Joint Designs of the B737 Aircraft

Subsequent to this accident and failure investigation the FAA took a number of actions directed
towards the prevention of further Aloha type accidents plus the broader issue of dealing with
aging aircraft. They also formed an independent Technical Oversight Group on Aging Aircraft
(TOGAA), which stayed in existence for nearly a decade and one half. This group guided
revisions to rules and advisory circulars that relate to fatigue, damage tolerance and widespread
fatigue cracking.

J5
 APPENDIX J.2
US Forest Service C-130A
Accident Summarized by
Joseph P. Gallagher

Figure J9: Photo of US Forest Service/Hawkins & Power Aviation C-130A [J3]

About mid-afternoon on June 17, 2002, a Lockheed C-130A owned by Hawkins & Powers
Aviation (and operated under contract to the US Forest Service (USFS)) crashed while
performing a fire-fighter mission (i.e., a fire retardant drop over a mountain drainage valley) near
Walker CA, destroying the aircraft and killing all three crew members. A video of the accident
showed both wings separating the aircraft as it pulled out of its fire retardant drop [J3]. Analysis
of the video showed that the right wing separated first. A brief history of the accident aircraft
which was converted from USAF military service to fire fighting operations is summarized in
Table J1.

Table J1. Accident Aircraft C-130A History

Owner/Operator Tail No. Dates of Flight Mission/Role

Owner- Hours
ship History

USAF USAF SN 56- 1957-1978 0- Military Transport

0538 19,546.8 Service
USAF USAF SN 56- 1978-1988 19,546.8 Desert Storage
0538
USFS/Helet Valley Registration 1988 19,546.8 Acquire/Contract for
Flying Service No. N134FF Installation of
(Contractor) Retardation Tanks
Hawkins & Powers Registration 1988-2002 19,546.8 - Purchase and Operate as
Aviation No. N130NP 21,863 Fire Fighting Air Tanker
(Contractor)/USFS

J6
The NTSB found that the probable cause of the accident was due to an inflight failure of the right
wing due to fatigue cracking in the center wing lower skin and underlying structural members
[J4]. The wing detached at the center wing box beam to fuselage attachment location [J.2.c].
The NTSB also found that a factor contributing to the accident was inadequate maintenance
procedures to detect fatigue cracking [J4].

At the time of the accident, the crack in the right wing was approximately 12-inch long (A
picture of this fatal crack can be found in J5). This crack developed from two cracks that
originated in fastener holes in the lower wing skin under a forward external doubler at Center
Wing Station (CWS) 56R at the stringers 16 and 17 location. The cracked fastener holes join the
external doubler and the internal stringers to the lower skin panel. The fastener-hole cracks grew
as undetected cracks, coalesced and then further grew to the critical length. The fatal crack was
found to have propagated past the area where they would have been covered by the doubler and
into the stringers beneath the doubler and across the lap joint between the middle skin panel and
the forward skin panel [J6].

The firefighting C-130A aircraft received restricted category special airworthiness certificates
from the FAA with associated operating limitations. Table J2 summarizes the purpose of each
restricted category certificate received and the associated operating limitations. What is obvious
from the table is that the firefighting aircraft would be operated in accordance with (IAW) the
USAF‟s operating, service and maintenance technical orders (T.O.s). What is not obvious from
the table is that the firefighting community did not track the rate at which damage was rapidly
accumulating as a result of the more severe firefighting operating. Thus, Hawkins and Powers
Aviation (H&P), the maintainer, did not adjust inspection periods to account for this effect.

The firefighting industry commissioned a firefighting tanker airplane flight envelope

performance study during the period between 1983 and 1989. The purpose of this flight load
survey was to establish the loads experienced fire service aircraft. Airspeed and g-load
exceedances were recorded. The envelope performance study revealed that the exceedances on
the instrumented airplanes were outside the operating envelope specified by the Type Certificate
or Supplemental Type Certificate. Note that the C-130A aircraft were not used as part of this
envelope performance study.

It did not appear that the firefighting industry envelope performance study was accompanied
with any subsequent fatigue evaluations of the effect of the fire service mission on the fatigue
cracking behavior of these fire service aircraft. In their narrative, the NTSB summarized the
results of fatigue life evaluations that determined the impact of fire fighting operations on three
other aircraft. In one case, the fatigue evaluation implied that there was no life effect; however,
in the other two fatigue evaluations, substantial negative impacts to the life of aircraft structure
were noted [J6]. Subsequent to the accident, Lockheed estimated that the fire service mission
was more severe than normal military operations for the C-130A aircraft, i.e., requiring
inspections to be accomplished 12 times more frequently than for typical military transport
service [J6].

J7
 Table J2. Airworthiness Certificate Category and Operating Limitations

H&P FAA Office Restricted Category Accompanying Operating

Application Airworthiness Certificate Limitations
Date/FAA
Certification
Date

10 Dec 1988/ Phoenix Special Airworthiness Aircraft must be operated

15 Dec 1988 Manufactur- certificate issued IAW 14.CFR IAW USAF Technical Order
ing Inspection 21.185(b); the application (T.O.) 1C-130A-1 (airplane
Satellite indicated that the aircraft flight manual) and serviced
Office which conformed to the type and maintained in
(MISO) design 14 CFR 21.33 & Type compliance with USAF T.O.
Certificate (TC) A15NM, 1C-130A-2-1 through 1C-
rev.2 130A-2-13
28 Dec 1988/ Helena Flight Reissued for the purpose of Same operating, service and
8 Aug 1989 Standards Carriage of Cargo maintenance requirements
District Office
(FSDO)
1 June 1998 Casper Flight Rescinded and issued new New Special Operating
Standards certificate for the following Limitation sheet which
Field Office special purpose operations: required compliance with
(FSFO) agriculture missions, forest the same operational service
and wildlife conservation, and maintenance required by
aerial surveys, and any other USAF T.O.s as previously
type of operation approved by required, but added a
the FAA requirement that the
company use a self-
developed maintenance
document entitled “H&P-C-
130A Inspection Guide”

In its support to the NTSB, Lockheed also estimated that for the fatal crack size, “the center wing
failed at a load that was approximately 30 percent of the design ultimate strength of the center
wing and that the presence of fatigue cracks in multiple locations and in multiple structural
elements reduced the residual strength to approximately 50 percent of the design limit load and
compromised the fail safety capability of the structure.” The NTSB also summarized for the
Lockheed report that, “Failure was likely caused by a symmetric maneuver load exceeding 2.0g
during the final drop of the fire retardant.” The vertical load factor associated with the final drop
was estimated by the NTSB to be ~ 2.4g [J6]. Lockheed‟s analysis certainly makes the case that
the onset of multiple element damage, a form of widespread fatigue damage, had already
occurred.

J8
While the fire service C-130A aircraft were being inspected in accordance with the USAF T.O.
1C-130A-36 inspection manual, there were no specific inspection requirements for cracks in the
fastener holes under the external doublers located at CWS 56R or 56L. The C-130A was
designed with two external doublers on each side of the wing; these doublers were located
inboard and outboard of CWS 61. The C-130A aircraft was the only C-130 mission design
series (MDS) aircraft with this doubler configuration. The later C-130 MDS aircraft had a single
doubler located at CWS 61. The 1C-130A-36 (inspection manual) had crack inspection
instructions for the area of the inboard doublers at CSW 56, but no unique inspection
requirement for the cracks in the fastener holes beneath these doublers. The H&P-C-130A
Inspection Guide, also called the Inspection Planning Guide, (IPG-182) followed these same
inspection instructions.

The NTSB [J6] also summarized Lockheed‟s 1970‟s service life analysis tests on major C-130
components (including the center wing). Results of the evaluation for military mission profiles
and environmental data at the time indicate that the service life endurance point was 19,384
flight hours. The service life endurance point is defined as the life where 50% of the center
wings would be expected to have major repair or replacement due to fatigue cracks.

Comparing the number of aircraft flight hours on the failed C-130A firefighting aircraft, and that
of the center wing service life endurance point, 21,863 and 19,384 hours, respectively, it is
apparent in hindsight that the maintenance/inspection program should have been revised for
more thorough detailed inspections at a number of C-130A potential cracking locations to
maintain airworthiness.

Two Aviation Week and Space Technology articles followed the impact of the C-130A accident
and a similar PB4Y aircraft accident that resulted from a fatigue-related wing failure on the
firefighting capability of the US Forest Service [J7, J8].

J9
APPENDIX GROUP J REFERENCES
J1 NTSB Report AAR-89/03, “Aloha Airlines, Flight 243, Boeing 737-200, N73711, Near
Maui, Hawaii April 28, 1988,” adopted on 14 June 1989, Washington DC.
http://libraryonline.erau.edu/online-full-text/ntsb/aircraft-accident-reports/AAR89-
03.pdf)
J2 Tiffany, C.F., Personal Files. As a member and past chairman of TOGAA many hours
were spent investigating the Aloha accident and WFD, and compiled much data on the
subject. Also, Thomas Swift was the FAA representative on this failure investigation.
J3 Taken from a video of the accident, which is available on
http://www.1001crash.com/telechvideo-video-tanker_CA-lg-2-descr-oui.html
J4 NTSB, Brief of Accident (Findings), ID LAX02GA201, adapted April 23, 2004.
J5 Aviation Week & Space Technology, September 2, 2002. p.48
J6 NTSB, Factual Report Aviation, Narrative, ID LAX02GA201, adapted May 1, 2003;
http://www.ntsb.gov/ntsb/brief2.asp?ev_id=20020621X00954&ntsbno=LAX02GA201
&akey=1.
J7 M. A. Dornheim, “Metal Fatigue Cited in Firefighter Crashes,” Aviation Week &
Space Technology, October 2, 2002;
http://www.aviationweek.com/aw/jsp_includes/articlePrint.jsp?storyID=news/aw1002fi
re.xlm&headline=nul.
J8 W. B. Scott, “Accidents Raise Concern for Safety of Aging Firefighting Aircraft,
Aviation Week & Space Technology, August 2, 2002;
http://www.aviationweek.com/aw/jsp_includes/articlePrint.jsp?storyID=news/aw08054
9.xlm&headline=nul.

J10
 APPENDIX K
HISTORICAL SUMMARY OF U.S. TESTING APPROACHES FOR
DEMONSTRATING AIRFRAME FAIL-SAFETY
by
Charles F. Tiffany and Thomas Swift

In the 1950s Boeing conducted about 30 guillotine tests on pressurized sections of the 707
fuselage (called Quonset huts), where blades were dropped through various structural
configurations until crack arrest designs were achieved. Figure K1 is a photo of an early 707
Quonset hut showing several arrested blade penetrations [K1].

Figure K1: Boeing 707 Quonset Hut Test

Several of the 707 guillotine tests demonstrated arrested longitudinal crack lengths greater
than 2 frame bays in length. The maximum-recorded length was 43.6 inches. The fail-safety
of the 707 fuselage was subsequently demonstrated by an Aer Lingus incident in 1970 when
a fuselage frame failed and a 40 inch skin crack was arrested. See Appendix A.10 for a
discussion of the Aer Lingus incident in the Compendium of Accidents/Incident Data.

Fuselage fail-safe tests were continued with the development of the 737, but with a double
bladed guillotine so as to sever the central frame as well as the skin. The test fixture is shown
in Figure K2; the double bladed penetration is shown in Figure K3; and, the final two bay
arrested crack with broken frame is shown in Figure K4.

K1
Figure K2: Boeing 737 Quonset Hut Test Setup

Figure K3: Boeing 737 Blade Penetration

K2
 Figure K4: Arrested Two-Bay Crack with Fractured Frame in Boeing 737 Fuselage

The final crack length in this test was 40 inches when the crack turned and the skin flapped open.
The applied pressure was about 16% above the normal operating pressure. This result was
repeated several times at pressures up to 22% above the operating pressure.

Many additional large damage fail-safe tests have been performed on the 747, 757, 767 and 777
aircraft and are scheduled for the composite 787 design.

Like Boeing, Douglas Aircraft was developing their first high altitude jet transport (i.e., the DC-
8) at the time of the Comet accidents. Also, like Boeing they embarked on development testing
to ensure that their new airplane had crack arrest fail-safe capability. This development testing
involved many fatigue test specimens, more than 30 large curved panel tests pressurized fatigue
tests and, finally, wedge penetration tests on a full-scale pressurized fuselage, which also had
inertial loads applied. A nitrogen pressure gun with a 15 inch wide blade was used to penetrate
the fuselage shell and various stiffening elements. Penetrations were made at six different
locations on the fuselage as shown in Figure K5 [K2].

K3
 15 INCH 4
5
Nitrogen Gun Used For
Penetration Tests
6

2
1
3

Figure K5: DC-8 Wedge Penetration Tests

In Test number 5 the 15-inch blade penetrated the skin, the circumferential frame, the
longitudinal stringer and the two bay crack flapped open and the fuselage safely depressurized.
This is illustrated in the sketch in Figure K6 and shown in the photograph in Figure K7.

Harpoon Blade
Penetration

Sta. 540

Circumferential Frames

Axial Stiffeners

15 Inch Wide Harpoon

Shell Radius 73.5 Inches Blade Damage
Skin 0.05 Inch 2014-.6 Crack Started to Turn
Frame Spacing 20 Inches Just Before The Frame
Turned Circumferentially
Test Pressure 9.27 PSI About Halfway Between
. Axial Stiffeners

Figure K6: Details of DC-8 Arrested Fuselage Crack

K4
 Figure K7: View Inside the DC-8 Fuselage

During the development of the DC-10 during the mid to late 1960‟s Douglas had another
extensive analysis and test effort to ensure the large damage fail-safe capability of the
pressurized fuselage. The entire fuselage was analyzed, tested and certified to be able to sustain a
two-bay longitudinal skin crack with both the central frame and tear strap broken. Also, it was
analyzed, tested and certified to be able to sustain a two-bay circumferential crack with a broken
central stiffener. Numerous developmental tests were performed to select materials, to correlate
with analyses, to assess crack stoppers, and to finalize detail designs. These tests included small
specimens, stiffened panels and pressurized, externally loaded small cylinders and large curved
panels. Finally, large curved panels were subjected to cyclic internal pressure, external loads,
large damage and static over pressure to demonstrate the fail-safe capability of the structure. A
sketch of the two most important residual strength tests is shown in Figure K8 and a photograph
of the curved panel vacuum fatigue test machine is shown in Figure K9.

K5
 Test Goal: Two-Bay Skin
Crack with Broken Central
Crack Stopper and Frame Axial Loading

Hoop Loading

Longitudianal Splice

Pressure
Panel 1 Circumf erential
Splice Panel 2
Skin 0.063 inch Thick
2024-T3 Skin 0.071 Inch Thick
Axial Stiffener 2024-T3
Rolled Hat 7075-T6 Axial Stiffeners
Area 0.214 Sq In. Extrusion 7075-T6
Crack Stoppers Area 0.312 Sq In
3.25 x 0.016 Crack Stoppers
Titanium 8-1-1 2.8 x 0.025
2
Frames Titanium 8-1-1
7075-T6 Frames
0.063 In Tk 7075-T6
1 0.071 In Tk

Figure K8: DC-10 Fuselage Curved Panel Tests

Figure K9: DC-10 Curved Panel Fatigue Test Machine

K6
Currently fail-safe design damage sizes are specified in US manufacturer‟s internal structural
design criteria. Some typical design sizes are:

 A completely severed frame, tear strap and the two adjacent skin bays for the fuselage.
 A completely severed stringer and adjacent skin bays for the fuselage, wing or empennage
skin and stringers.
 A completely severed stringer and at least one adjacent skin bay for the wing and
empennage splicing stringers.
 A completely severed frame, tear strap and adjacent bays of the fuselage longitudinal lap
splices.

A number of papers on predicting the residual strength and crack arrest in pressurized fuselage
structure have been published. Some examples of residual strength curves for various airplane
fuselages are included in Appendix 1 of TOGAA‟s Final Report [K1]

K7
APPENDIX K REFERENCES

K1 TOGAA: The Technical Oversight Group on Aging Aircraft (TOGAA) Final Report,
“The FAA‟s Recent Rulemaking activity and Its Adverse Effect on Transport Airplane
and Rotorcraft Structural Integrity,” 24 August 2004, Unpublished report delivered to
the FAA‟s Associate Administrator for Regulation and Certification, 800 Independence
Ave. SW, Washington, DC 20591
K2 Personal files of Charles Tiffany and Thomas Swift

K8