Aircraft Accident Investigation
In the media, we are learning about possible structural problems regarding the Alaskan Airlines Flight 261, MD-80 aircraft. We have learned of maintenance issues linked to required inspections, alleged corrosion problems associated with the horizontal stabilizer, runaway trim, loud noises which occurred prior to loss of control, and the possibility of separation of structural pieces prior to impact. Some or all of these events may be involved in some way in the catastrophic loss of this aircraft. With the recovery and analysis of the flight data and cockpit voice-recorder black boxes, more will become known about the accident. However, only recovery of the aircraft and comprehensive accident investigation will lead to the true sequence of failure and the precipitating cause.
Having aircraft accident investigation experience associated with military service and from my 34 year-perspective as a materials engineer, I offer a few comments regarding causes for 'loss of structural integrity' of an aircraft.
A most obvious reason for a structure to fail is excessive load. Excessive load occurs when a structural member is required to carry loads (or stresses) too great for it to sustain. One possibility is that the subject part was 'under-designed'; or, alternatively, an unusual condition may have occurred which over-stressed the part. To sustain a load, the part must meet or exceed the projected service conditions. For example, if going 75 mph in your car causes sufficient wind-loading to bend your radio antenna so that you can't retract it at the car-wash (not likely!), then the antenna is under-designed. Because of accepted engineering practices, such instances are indeed infrequent. Additionally, in aircraft manufacture, damage-tolerant and redundant design principles are applied. By these methodologies, a critical part of the aircraft is assumed to fail, and the remaining structure is tested to confirm that the aircraft will remain airworthy. However, a sequence of interrelated events may occur which engineers may not anticipate, sequences by which a part or component may experience 'excessive' loads.
A sequence of 'reasonable' but unanticipated operational events may result in bending, cracking or excessive wear of a part. Consider one extreme example. In the Vietnam war, the Republic Aircraft's F-105 "Thunderchief" was an operational fighter/bomber. When chased by Russian MIG fighter-aircraft, and at a critical point in the chase, pilots would perform a maneuver using the F-105 control-stick, and the result was change in speed of the aircraft from about the speed of sound to zero ground speed! The maneuver would essentially 'flip' the aircraft and bring it to a stall condition. Due to this extreme maneuver pilots would often black-out. If they had enough altitude, the pilots would recover and live to fight another day, for the MIG fighters would have no idea what happened to the target that had, in prior seconds, been in their sights.
During routine maintenance of the F-105, structural engineers began to find cracks in the upper part of the aircraft just behind the cockpit. Engineers had no idea what caused these cracks. Large stresses in these areas were unanticipated. Re-design teams set to work to beef-up this apparently weak area of the aircraft. If was some time before engineers learned of the cause of these cracks.
This brings up another type of structural failure: fatigue. It is sometimes referred to as 'metal fatigue', but even plastic parts succumb to cyclic loading. Cyclic, 'back-and-forth' loading of a metal or plastic part will first cause cracks to form, and then to grow. Fracture results. An easy demonstration of this is to take a paper-clip, bend it straight, and then flex it back and forth until it breaks. Repeat loading can cause failure at much lower stresses than those required to break a part under a one-time load.
For metallic components, a load insufficient to even distort (ie, bend) a part if the load were applied once, will, if applied cyclically and often, cause the part to crack and ultimately fracture. Thus, normal operational loads will cause structural members in any aircraft to eventually fail. The F-105 cracking problem described above was a fatigue event. It was not one evasive maneuver that caused the crack, but a number of them. Also, more than 90% of all aircraft structural cracks (including cracks in rotating aircraft parts such as hydraulic pump shafts) involve fatigue, but the number of cycles to failure in a typical instance is several hundred thousand.
Fatigue failure is insidious in the following sense. You may have undergone a particular loading situation, like cycling your bicycle pedals, a number of times without incident, and yet, one fine day, on a casual ride, one pedal may suddenly break (an awkward situation). Let's consider another 'extreme' example. Aircraft accidents (particularly military aircraft) have involved loss of part of, or all of, for example, one wing. Such a situation occurred during the 1960's. The North American F-100D Super Sabre aircraft, which served in Vietnam, suffered wing loss due to fatigue. In a dramatic example and during an air show at Laughlin AFB in Texas on October 21, 1967, Thunderbird (USAF Flight Demonstration Team) pilot Captain Merrill A. McPeak's F-100 disintegrated in midair during a solo demonstration. Fortunately, he was able to eject safely. Captain McPeak's jet lost both wings, left and right, due to wing cracks that had been produced by metal fatigue. A similar incident occurred at Binh Hoa Air Force Base in Vietnam sometime after the Thunderbird incident. As a result, the entire F-100D fleet was temporarily restricted to a 4-G maneuver limit until all the planes could be fixed by carrying out a complete modification of the wing structural box. Basically this means the aircraft had to be taken apart and re-built!
Do you know that every aircraft you have ever flown on is likely to have contained structural cracks or other defects? It is true. Breathe easy as small cracks are no problem. It is only when they become a critical size that they do cause fracture. What is meant by a 'critical size crack?' A crack is critical when it grows large enough to 'let go' under normal operational loads. For example, even under normal loading during take-off, flight or landing of an aircraft, a cargo door latch will break if a crack in the latch has grown, by fatigue or some other mechanism, to critical size. The good news is engineers are able to predict with high accuracy the size and orientation of critical cracks. They can also predict how long it takes (or how many takeoff, flight and landing cycles) for a crack to grow to critical size. Thus, the safe life for structural members can be evaluated by the engineer. Additionally, engineers can accurately detect the presence of very small cracks (using sound and x-rays), cracks well below the limit of resolution of the human eye (0.2mm). Thus, if there is a conscientious effort to inspect the cargo door latch for existing cracks, and if the period between inspections has been small enough to insure that a crack that wasn't detected during the prior inspection has had insufficient time to grow to critical size, then all is okay. This is an essential part of the damage-tolerant design concept. The engineer must 1) accept all structural members to contain flaws, 2) determine the critical flaw size, 3) use reliable inspection methods and equipment to monitor flaw size and orientation, 4) assure an appropriate interval between inspections, 5) replace components, parts and members when they are no longer safe. One can appreciate why sound design, maintenance and inspection requirements are so crucial to safe flying.
Here is a reasonable, and hypothetical failure analysis situation. Suppose one learns of a cracking problem in a key structural element of a helicopter, say a rotating metal shaft that drives system hydraulics for example. One knows of the crack because of successful investigation of a non-injury crash which occurred three months earlier. Three other helicopter accidents (two fatal) may have involved failure of this component (this has not yet been fully determined). More than one-third of your helicopter fleet has at least as many or more recorded flying hours, and many other agencies and individuals have helicopters with this type of hydraulic component. What do you do? Do you ground all helicopters with similar components; or only those with a certain number of flying-hours? Do you require immediate inspection? If the inspection can only be done at a few key locations, do you fly the affected helicopters there, ship them, or remove and replace the hydraulic system? What are the economic and marketing considerations? How are these concerns balanced? Would you be willing to fly back to the service facility in one of the affected helicopters? Interesting, ain't it. This is real engineering, and real engineering is a challenge.
We have heard of the possibility of the involvement of corrosion in the loss of Flight 261. Corrosion of aircraft alloys such as steel, aluminum and titanium does occur, but we are not talking of the gross corrosion (ie, loss of thickness) common to steel equipment left in the yard and exposed to the elements. Corrosion that affects aircraft parts is usually much more subtle.
Anyone who has had a garage door spring fail and penetrate the roof of the garage (or damage their car) has suffered one subtle form of corrosion: stress corrosion cracking. Stress corrosion cracking (SCC) acts on a susceptible material to cause existing cracks to grow, or new ones to form and to grow. A corrosive environment is needed, but this may simply be high-humidity conditions, such as your garage may suffer during wet weather. To drive stress corrosion cracking, the spring must carry a sustained load, and this is the usual situation. Look at the 'stretched' condition of the springs you have in your garage when the door is closed (most of the time it is closed and the springs are stretched). This stretch is responsible for counter-balancing the weight of the typical garage door (from about 130 to 250 pounds), making it possible for you to readily open the darn thing. These ingredients (a susceptible material, the presence of an aggressive agent such as moisture or sea breeze, and a sustained stress) can cause failure of a steel spring. One would need the most sophisticated analytical equipment to confirm the role that corrosion (or hydrogen, a byproduct of the corrosion process) plays in SCC. Stress corrosion does occur in the aircraft industry, but it is probably involved in less than 5% of aircraft structural failures.
Another form of subtle corrosion that could lead to problems in aircraft safety is that which can occur between mated, moving parts. The product of corrosion is, in the case of aluminum alloys for example, a white powdery substance (an oxide of aluminum typically containing aluminum, oxygen and hydroxyl ions). The volume occupied by the corrosion product, per unit weight, is greater than the volume occupied by the original metal. Thus, corrosion occurring between mated parts usually 'expands' and this makes moving one part past the other much more difficult. Anyone familiar with the use of penetrating oil to release a 'froze' bolt or screw is familiar with this problem. Corrosion does not have to be extensive to have profound effect on the performance of high-tech, aircraft parts. Increased friction between moving parts will require higher operational loads to perform the required function. See the problem?
Another type of localized corrosion, common to aircraft materials and particularly to high-strength aluminum alloys, is called 'exfoliation corrosion' . Exfoliation corrosion was involved in the Aloha Flight 243 air disaster (April, 1988). Corrosion originating in fastener holes in the thin, aluminum sheets that make-up the 'skin' of the fuselage. The corrosion penetrated from many rivet holes and along the mid-thickness of the skin in all directions weakening the ability of the fuselage skin to carry, for example, cabin-pressurization loads. This corrosion phenomenon may be likened to what water penetration does to the strength and usefulness of particle-board. Exfoliation is more likely to occur in older aircraft, and aircraft serving coastal or transoceanic routes are more prone to this problem. Exfoliation corrosion is not easy to see as the damage spreads along the mid-thickness of the sheet, not at the surface. One must include an inspection requirement to detect exfoliation and crack damage in older aircraft, and this is part of the action taken by the FAA (Federal Aviation Administration) in the wake of the Aloha Flight 243 incident.
A trained failure analysis (FA) expert, with access to the proper inspection, mechanical testing and associated FA equipment, can differentiate between the failure mechanisms described above (ie, excessive-load, fatigue, SCC) and a myriad of other possible failure mechanisms. Tell-tale evidence is present on the surfaces of the crack or fracture. In most situations, information about the level of the loads applied and even the number of load-cycles to catastrophic fracture can be determined. Also, one can 'read' the fracture surfaces (in aircraft accident investigation there are typically several miles of fracture-length to study as the structure disintegrates sometimes before and during impact) and find his/her way back to the point of origin, that is, the point where everything started. Correct interpretation of the metallurgical and fracture information may lead to determination of the cause of the failure, and perhaps, the cause of the accident.
Finding the true cause of failure is really a difficult process, and often, only the 'most likely' scenario for an air-disaster can be put forward. This is the case, for example, in the TWA Flight 800 disaster that occurred when a Boeing 747 exploded off Long Island on July 17, 1996. It appears that a spark coming from wear-damaged, insulated electrical wires within an almost empty central fuel tank may have been the initiating event in the explosion.
The intent of this article is not to offer possible reasons for the loss of Alaskan Airlines Flight 261. Rather it is an attempt to demonstrate to the public how complex and challenging aircraft accident investigation is. After all, structural failure is only one possibility in an aviation disaster. Too, confirmation that a structural member did fail is not necessarily the initiating event in the failure sequence. Other difficult issues must be resolved to complete the investigation. The FA engineer is one player, but a critical player, in pursuit of the truth in an aircraft accident investigation and in defining the appropriate corrective actions.
Patrick P. Pizzo, Professor Emeritus
Materials Engineering, San Jose State University