Passengers and crew of Flight 243 begin to evacuate the damaged airliner at Kahalui Airport, Maui. (Unattributed) Photo shared from http://www.thisdayinaviation.com/28-april-1988/
Photo of the fuselage damage on Aloha Airlines flight 243
On April 28, 1988, a Boeing 737-200 (line number 152), N73711, was scheduled for several inter-island flights. At the start of the day the first officer performed a normal walkaround pre-flight inspection in the pre-dawn darkness and found nothing unusual. The same crew flew three roundtrip flights from Honolulu to Hilo, Maui, and Kauai. No visual inspections were performed by the flight crew between flights (the airline did not require them). The first officer was replaced at 11:00 for the remainder of the day.
At 13:25 Flight 243 departed from Hilo for Honolulu. As the airplane leveled at 24,000 feet, an explosive decompression occurred. The flight attendant that had been standing at row 5 was immediately swept overboard. The captain took over the controls from the first officer and began an emergency descent to Maui, successfully landing there a short time later.
The airplane had accumulated 89,680 flight-cycles and 35,496 flight-hours at the time of the accident.
There were eight serious injuries (seven passengers and one flight attendant) and one fatality (a flight attendant).
Illustration showing the missing fuselage section.
After the accident, a passenger reported that as she boarded the airplane she had seen a longitudinal fuselage crack (the crack was in the upper row of rivets along the stringer S-10L lap joint, about halfway between the cabin door and the jet bridge hood). She did not report this to the crew before takeoff.
The primary damage to the airplane consisted of the total separation and loss of a major portion of the upper crown skin and other fuselage structure. The damaged area extended from a little aft of the main cabin entrance door aft for about 18 feet. A video, taken from the air just after landing and showing the extent of damage to the airplane is available at the following link (Video taken after flight 243 landed).
The NTSB determined that the probable cause of the accident was the failure of the Aloha Airlines maintenance program to detect the presence of significant disbonding and fatigue damage which ultimately led to the failure of the lap joint at stringer S-10L and the separation of the fuselage upper lobe.
Illustration of a Lap Slice Cold Bonded (Looking Aft)
Lap Splice Design
Adjacent fuselage panels are joined longitudinally by overlapping the edge of the skin of the upper panel about three inches over the edge of the skin of the lower panel (the “lap splice”). On the early 737s (up to line number 291), the overlapping skins were bonded together with an adhesive and were fastened with three rows of rivets. The fuselage pressurization (hoop) loads were intended to be transferred through the adhesive bond, rather than through the rivets.
This design used a cold bond adhesive (a scrim cloth is impregnated with an adhesive that cures at room temperature and must be kept at dry ice temperature until shortly before its use to prevent premature curing). The cold bond process had manufacturing difficulties (surface preparation quality, condensation in the joint during assembly, and premature curing of the adhesive). These difficulties led to the random appearance of bonds with degraded adhesion, with susceptibility to corrosion, and with some areas that did not bond at all. Disbonded areas were then subject to in-service corrosion due to moisture wicking, which leads to further disbonding.
Widespread Fatigue Damage (WFD)
Once disbonding of the lap splice occurs, the fuselage pressurization loads that were intended to be transferred by the adhesive bond are instead transferred by the rivets. Since the countersink for the rivet head went through the entire thickness of the upper skin (creating a knife edge), a higher than typical stress concentration resulted (View flash animation which demonstrates the stress concentration effect).
The combination of effects from the high stress concentration, the rivet load transfer and the far field stress levels led to the development of fatigue cracks at many adjacent or neighboring rivet locations [Multi-Site Damage (MSD)]. An insidious feature of MSD is that many small, hard-to-detect cracks can link up rather suddenly to form a long, critical crack. The advanced stages of MSD, which occurred on this airplane, can result in Widespread Fatigue Damage (WFD), a condition where the airplane structure is no longer able to sustain the required residual strength loads.
Illustration of MSD Cracking Progression
(View Large Image)
Illustration of Redesigned Lap Splice (Typical Section Between Tear-straps)
(View Large Image)
Highlights of Lap Splice Service History
Lap joint corrosion occurring in service was first reported in 1970. Boeing Service Bulletin 737-53-1017 was released later that year to seal the lap joints to prevent corrosion, but this was only partially effective (sealing was also done in production starting at line number 249).
The cold bond lap joint design was discontinued in production in 1972. A redesigned lap joint that had increased joint thickness, allowing the rivets to transfer the pressurization loads, was introduced at line number 292. The adhesive bond that was used for load transfer was eliminated.
Boeing Service Bulletin 737-53-1039 was released in 1972 to inspect for lap splice corrosion.
Starting in 1974 there were reports of tear strap disbonding. The function of tear straps is to arrest the rupture of a crack, allowing for safe decompression by fuselage skin flapping.
Boeing Service Bulletin 737-53-1039 was revised (R2) in 1974 to also inspect for fatigue cracks in the lap splices. At the time of this revision, fatigue cracking had not yet been observed in service.
Boeing Service Bulletin 737-53A1039 was revised (R3) in 1987. The Service Bulletin was upgraded to alert status at this release (by now fatigue cracks had been observed in service at stringers S-4L, S-4R, S-10R, and S-14R).
In 1987 the FAA issued AD 87-21-08 which mandated some of the inspections in Boeing Service Bulletin 737-53A1039. The AD required that only the lap splices at stringers S-4 left and S-4 right be inspected (the service bulletin also provided information to inspect stringers S-10, S-14, S-19, S-20 and S-24, left and right).
The Aloha accident occurred in 1988, following the failure of the lap splice at stringer S-10 left. The accident airplane was line number 152.
Supplemental Structural Inspection Program
In 1978, the portion of 14 CFR 25.571 that addressed fail-safe requirements was amended to add damage-tolerance requirements using fracture mechanics analysis techniques. To address airplanes that were certified before this amendment was effective, a Supplemental Structural Inspection Program (SSIP) was created using damage tolerance concepts. For the 737, the SSIP was to be effective no later than November 1985.
During the creation of the SSIP, airplane structure was classified to determine which structure would be included in the SSIP. The SSIP only included structure where damage detection needed to be achieved through a new, directed inspection. Structure that was deemed to be “damage obvious or malfunction evident” was excluded. The minimum gage fuselage skin was excluded from the SSIP based on an assessment that controlled decompression through flapping would occur, i.e., that it was “damage obvious or malfunction evident.”
Maintenance Practices at Aloha Airlines
The Aloha Airlines maintenance program used a D-check (heavy maintenance and inspection check) interval of 15,000 flight-hours, which appears acceptable compared to the 20,000 flight-hour interval recommended by Boeing. However, due to the unusually short flights in the Aloha Airlines flight schedule, flight-cycles were accumulated at about twice the rate that Boeing considered when it produced its maintenance recommendations. In pressurized fuselage structure, the initiation of fatigue cracks and the subsequent rate of crack growth is predominated by the accumulation of flight-cycles, not flight-hours. This fact was not sufficiently regarded when the Aloha Airlines maintenance program was produced and then approved by the FAA (some maintenance tasks should have been more frequent).
The D-check concept, as envisioned in Boeing’s Maintenance Planning Document, has each aircraft in the check for a reasonable time period, usually a few weeks. Aloha Airlines split the D-check into 52 separate work packages. The overnight B-checks included portions of D-check items. The NTSB stated that this practice is “an inappropriate way to assess the overall condition of an airplane …”and further that “…it was obvious to both the maintenance and inspection personnel that each airplane would be needed in a fully operational status to meet the next day’s flying schedule.”
The post-accident investigation found that the S-4R lap splice had been inspected and repaired as a result of AD 87-21-08. However, a visual inspection of the accident airplane revealed cracks growing from the fastener holes of the top row of rivets. Further analysis showed that these cracks would have been detectable by the eddy current inspections that were required by the AD at the time the AD was accomplished. Aloha Airlines training records revealed that little formal training was provided in NDI techniques and methods. It is not known whether the eddy current inspections were ineffectively performed or if they were accomplished at all as documentation was lacking.
After the accident, visual inspection of the exterior of the airplanes in the Aloha Airlines 737 fleet was conducted. Swelling and bulging of skin, dished fastener heads, pulled or popped rivets, and blistering, scaling, and flaking paint were present at many sites along the lap joints of almost every airplane. According to the NTSB, Aloha Airlines did not produce evidence that it had in place specific severe operating environment corrosion detection and control programs as outlined in the Boeing Commercial Jet Corrosion Prevention Manual. The NTSB noted that “it appears that even when Aloha Airlines personnel observed corrosion in the lap joints and tear straps, the significance of the damage and its criticality to lap joint integrity, tear strap function, and overall airplane airworthiness was not recognized…” It was further noted that “the overall condition of the Aloha Airlines fleet indicated that pilots and line maintenance personnel came to accept the classic signs of on-going corrosion damage as a normal operating condition.” After the accident, two aircraft in the remaining Aloha Airlines fleet (N73712 and N73713) were determined to be beyond economical repair and were sold for parts and scrap. The accident airplane, N73711, was also scrapped.
Aloha Airlines’ Boeing 737-297, N73711, circa 1978. (Unattributed) Photo shared from: http://www.thisdayinaviation.com/28-april-1988/
Accident Board Findings
The NTSB determined that the probable cause of this accident was the failure of the Aloha Airlines maintenance program to detect the presence of significant disbonding and fatigue damage which ultimately led to the failure of the lap joint at S-10L and the separation of the fuselage upper lobe. The NTSB report number is NTSB/AAR-89/03, dated June 14, 1989.
Contributing factors to the accident cited by the NTSB were:
- The failure of Aloha Airlines management to properly supervise the Aloha Airlines maintenance program and to assess the airline’s inspection and quality control deficiencies.
- The failure of the FAA to broaden the scope of Airworthiness Directive 87-21-08 and mandate the inspection of all the lap joints, as was proposed by Boeing Alert Service Bulletin (SB) 737-53A1039. While the SB mandated the inspection of all the lap splices, the AD only mandated the inspection of the Stringer 4 location.
- The lack of a complete terminating action (neither generated by Boeing nor required by the FAA) after the discovery of early production difficulties in the B-737 cold bond lap joint. These difficulties consisted of low-bond durability, corrosion, and premature fatigue cracking.
Accident Board Recommendations
Key NTSB recommendations are listed below:
- Provide specific guidance and proper engineering support to Principal Maintenance Inspectors (FSDO) to evaluate modifications of airline maintenance programs and operations specifications which propose segmenting major maintenance inspections.
- Revise the regulations governing the certification of aviation maintenance technician schools and the licensing of airframe and powerplant mechanics to require that the curriculum and testing requirements include modern aviation industry technology.
- Require operators to provide specific training programs for maintenance and inspection personnel about the conditions under which visual inspections must be conducted. Require operators to periodically test personnel on their ability to detect the defined defects.
- Revise the National Aviation Safety Inspection Program objectives to require that inspectors evaluate not only the paperwork trail, but also the actual condition of the fleet airplanes undergoing maintenance and on the operation ramp.
- Require that all turbojet transport category airplanes certified in the future receive full-scale structural fatigue testing to a minimum of two times the projected economic service life. Also, require that all currently certificated turbojet transport category airplanes that have not been fatigue tested to two lifetimes, be subjected to such testing. As a result of this testing and subsequent inspection and analysis, require manufacturers to identify structure susceptible to multiple site damage and adopt inspection programs appropriate for the detection of such damage.
The complete list of the recommendations can be read in the NTSB report (NTSB/AAR-89/03).
Prevailing Cultural / Organizational Factors
The NTSB cited many deficiencies with the Aloha Airlines maintenance program. The NTSB summarized their belief that “the Aloha Airlines maintenance department did not have sufficient manpower, the technical knowledge, or the required programs to meet its responsibility to ensure the continued structural integrity of its airplanes.” The NTSB determined that a contributing factor to this accident was “the failure of the Aloha Airlines management to supervise properly its maintenance force.”
In 1987 the FAA issued AD 87-21-08 which mandated some of the inspections in Boeing Service Bulletin 737-53A1039. The AD only required that the lap splices at stringers S-4 left and S-4 right be inspected, even though cracks had also been observed on in-service airplanes at stringers S-10R and S-14R. At the public hearing for this accident, an FAA employee testified that the scope of the mandatory inspection was based on analysis of statistical information available to them (i.e., that the S-4 lap splice was more likely to crack) and the recognition of the scope of the work required.
When Boeing evaluated the Aloha Airlines maintenance program, they preferred to discuss their findings exclusively with Aloha Airlines (the FAA Principle Maintenance Inspector (PMI) was denied access to the information). The FAA Aircraft Certification Office likewise was not informed. The NTSB stated that there should be “more explicit criteria and guidelines to operators and manufacturers about what information should be reported to the FAA under the provisions of 14 CFR 21.3.”
Key Safety Issue(s)
The following key safety issues were identified from this accident:
- The Fuselage lap splices (cold bond process) were prone to develop Multi-Site Damage (MSD) leading to Widespread Fatigue Damage (WFD).
- The operator had an inadequate inspection and maintenance program.
The following safety/design assumptions proved to be flawed:
- A rupturing crack in the pressurized fuselage skin would be arrested at stiffeners/tear-straps, allowing the skin to flap and resulting in a safe decompression. The depressurization with flapping skin was considered “obvious damage,” thus eliminating the need for any directed inspections to find cracks. Several tests and fleet history had seemed to validate this assumption.
- The airlines maintenance and inspection programs would be effective, and the quality of those programs would be adequately maintained.
Resulting Safety Initiatives
As a result of this accident, the following items were issued:
- Mandatory corrosion control programs which require that all operators have prevention and inspection systems sufficient to ensure that hazardous corrosion never occurs.
- AD 2002-07-08 and 2002-07-11 which mandate removal and replacement of certain areas of the skin lap splice.
- 14 CFR 25.571 Amendment 96 which requires special consideration for WFD in the structure. This amendment, in part, says, “It must be demonstrated with sufficient full scale fatigue test evidence that WFD will not occur within the design service goal of the airplane.”
- Repair Assessment for Pressurized Fuselages Rule (14 CFR 91.410, 121.370, 125.248, and 129.32).
Technical Related Lessons:
If structural capability is dependent on bonded surfaces, then a robust inspection and maintenance program must be in place to assure the integrity of the bonding. (Threat Category: Structural Failure)
- The use of a cold bond adhesive (prone to disbonding) to transfer pressurization loads in the fuselage lap splices, combined with stress concentrations in countersunk fastener holes, led to the development of multi-site damage.
Structural inspection programs must be consistent with, and predicated upon a thorough understanding of the fatigue properties of the design being inspected. (Threat Category: Structural Failure)
- It was assumed that as the structure fatigued, a rupturing fuselage skin crack would be arrested at stiffeners/tear-straps, allowing the skin to flap, and resulting in a safe decompression. The depressurization with flapping skin was considered “obvious damage,” removing the need for directed inspections to find cracks. In fact, multiple small cracks went undiscovered for a sufficient time period to allow linking of cracks, and catastrophic failure.
Common Theme Related Lessons:
Long-term reliance on repetitive inspections of airplane structure with a known fatigue problem has inherent reliability limitations; accomplishing a terminating action is the preferred approach (Common Theme: Human Error)
Inspecting many details of large areas of airplane structure is especially tedious, and after many examinations with no findings there is a natural tendency to expect no findings. The physical environment also can have a significant effect on the reliability of the inspection (standing on scaffolding, awkward physical positioning/reaching, carrying equipment, use of safety harness, lighting, discomfort from the ambient temperature, etc.).
After the Aloha accident, the FAA received reports of cracks throughout the fleet. This indicated that issues with lap joint inspection and fatigue crack detection was not strictly limited to Aloha Airlines, but was rather a fleet wide problem.
Continued operational safety is dependent upon the development and implementation of an effective airplane maintenance and inspection program. (Common Theme: Organizational Lapses)
- The NTSB found that the quality of the Aloha Airlines maintenance and inspection program was deficient. Further, Boeing had conducted a maintenance evaluation of Aloha Airlines, and had made extensive recommendations for specific changes, and had noted the “deteriorated condition” of certain high-cycle 737s in the Aloha fleet.
Excerpted from FAA Lessons Learned From Transport Airplane Accidents http://lessonslearned.faa.gov/index.cfm
By Laura Victoria Duque Arrubla, a medical doctor with postgraduate studies in Aviation Medicine, Human Factors and Aviation Safety. In the aviation field since 1988, Human Factors instructor since 1994. Follow me on facebook Living Safely with Human Error and twitter@dralaurita. Human Factors information almost every day