Most of the bodies of the people who were sitting in the back of China Airlines (CAL) Flight CI-611 were found naked, a telling indicator of the tremendous stripping forces of rapid decompression when the B747-200 came apart over the Taiwan Strait on May 25, 2002 Hopefully, the last moments for the 225 passengers and crew were blessedly brief. The 23-year old plane came apart from metal fatigue, the possible result of a repair made 22 years before. As in the expression for iron that “rust never sleeps,” corrosion worked its way into the aluminum, the way shipworms once chewed their way through and weakened the wooden hulls of sailing ships.
The crash is likely to spur an increase in maintenance oversight, especially for older airplanes, and particularly of repair doublers, or the external patches applied to structure damaged in service. Such patching is commonly employed throughout the industry. In fact, the presence of more than 30 such patches scattered throughout the accident airplane reflects the extent of the practice. The accident findings suggest that hidden damage under doublers can be deadly. Since the cracking and corrosion under a doubler cannot be seen by visual inspection, periodic nondestructive inspection may become necessary. Already, the National Transportation Safety Board (NTSB) has said as much, adding that the actions taken by the Federal Aviation Administration (FAA) to inspect tail strike repairs on B747s need to be expanded to cover all transport category aircraft (see ASW, April 21).
The NTSB is an accredited representative to the Aviation Safety Council (ASC) of Taiwan, the body investigating the case. The ASC is Taiwan’s equivalent of the NTSB. Boeing [NYSE: BA] and engine manufacturer Pratt & Whitney [NYSE: UTX] are also serving as accredited representatives to the investigation. Earlier this month, the ASC released hundreds of pages of material documenting its investigative effort over the past year. The ASC has taken a microscope, literally, to the shivered remnants of one of the world’s largest airplanes in the search for what happened.
The microscope has shown that the patch applied over the scratches and gouges of a tail strike just six months into the airplane’s service life may have set the stage for the sudden failure of its pressurized fuselage. A full-scale reconstruction of the aft end of the airplane, completed in April, was undertaken to better understand the overall distribution of forces as the airplane broke up as it approached its cruising altitude of 35,000 feet for the flight over the Taiwan Strait from Taipei to Hong Kong.
The paper trail has led to a dead end, making it difficult to reconstruct the engineering judgments used to repair damage from the 1980 tail strike. Manufacturer Boeing may be less exposed to liability on this front, as it has credibly argued that it was never contacted nor did it approve the purported “permanent” repair of the tail strike. China Airlines did not retain its maintenance records, although it was sole owner of the airplane from factory delivery until its loss as Flight CI-611.
Process of elimination
The ASC at this point appears to have ruled out a number of possible scenarios. Originally, it was feared that the aging B747 might have been another victim of an explosion of flammable vapors in the center wing tank (CWT). To some experts, the conditions were right for a repeat of the kind of CWT explosion that destroyed TWA Flight 800 in 1996, another high-time B747 (see ASW, June 3, 2002).
Unlike the TWA jet, the China Airlines airplane had been retrofitted in 2001 with electrical current transient suppression devices. These were installed to prevent a surge of electrical power into the probes of the fuel quantity indicating system (FQIS), which the NTSB concluded triggered the explosion on the CWT of the TWA jet shortly after takeoff.
Major pieces of the CWT from the CAL jet were pulled out of the water as part of the general wreckage and victim recovery effort that extended through a five-month period and three interruptions from passing typhoons. According to the ASC, the various spanwise beams and sidewalls of the CWT did not exhibit the type of damage found on the TWA jet. For all the various pieces of the CWT, the ASC issued the same finding: “There is no evidence of any fire or soot accumulation.”
Some industry observers pointed to the possibility of a cargo door blowing open in flight. The B747 features two below the main floor – a cargo door forward of the wing leading edge, and an aft door. Both are the same eight by nine-foot size. Both are non-plug type. Rather than pushing harder into the door surround as the pressure differential increases between the inside of the fuselage and the air outside, these doors depend on cams and locking latches to remain shut. In 1989, the forward cargo door on United Airlines [NYSE: UAL] Flight 811, a B747, blew open while the aircraft was climbing through 13,000 feet after takeoff from Honolulu. Nine passengers were killed in the explosive decompression; the pilots were able to return the crippled airliner to Honolulu for an emergency landing.
In the case of the CAL jet, the door was under considerably more force pushing outward at the higher altitude where the accident occurred. The pressure differential at 35,000 feet was some 8.6 pounds per square inch (psi), more than double the 3.5 psi differential in the United Flight 811 case. The total force pushing outward was roughly 93,000 pounds, or more than 46 tons. A failure of the latching mechanisms in these conditions would be cataclysmic.
The aft door is the one of concern, as the physical evidence of the wreckage points to the rear of the airplane. The front cargo door did not burst open as in the UAL case 13 years before. As one indicator, so-called dado panels are installed along the junction of cabin floor to sidewall. The panels run alongside the air vent on the floor, by which air circulates from the cabin to the belly hold area. The dado panels are designed to spring open when the pressure differential exceeds 0.5 psi. When open, they increase the passageway for air to escape the cabin in the event of an explosive decompression below the main deck. This feature is intended to preclude further damage, such as a collapse of the floor. The only dado panels found open were in the rearmost section of the airplane. That evidence is an alibi for the front cargo door. Wreckage recovered from the aft door suggests that it held, too. According to the ASC, “The observation of the hinge, latches, and door mechanisms indicate that the aft cargo door did not open prior to airplane breakup.” To emphasize the point, the ASC said, “The door was recovered in the closed position.”
For the moment, the cargo doors are not under suspicion.
Nor is an uncontained failure of one or more engines, which could pepper the fuselage and wings with shrapnel from high-energy rotating parts. The ASC concluded that the damage on the engines was consistent with water impact.
What about a terrorist attack? While the ASC documents devote nearly 300 pages to structural findings, the security group’s report is merely six pages in length. It summarized the checks made of cargo, passengers, insurance, and of everything on board. It concluded simply, there was “no evidence associated with security matters.”
Rather, ASC investigators focused on structural item number 640. Numbered tags were affixed to the pieces of wreckage as they were recovered. Hence, item 640 was 640th of the sequence in which more than 1,400 pieces of wreckage were pulled out of the water. Item 640 contained the doublers installed over the tail strike damage of so many years before.
What investigators found under scanning electron microscope examination was dismaying – a welter of fatigue cracks, running generally rivet-to-rivet. In some cases, the cracks were completely through the underlying (original) fuselage skin. The ASC found that for the most part the fatigue cracks “initiated at the skin edge next to the doubler and progressed inboard through the direction of skin thickness. The propensity to crack may have been aggravated by the rivets, most of which had been overdriven when the doublers were installed, putting the metal of the two aluminum sheets under strain in the form of “stress risers” and weakening the rivets. Striation marks in the metal, analogous to tree rings, showed the progression of fatigue as the airplane accumulated flights over the years.
The fatigue failures tended to run along the scratch and gouge lines inflicted by the tail strike. Corrosion added to the cracking, further weakening the structure. At some points, the corrosion penetrated completely through the skin.
While the CAL B747 was steadily accumulating flights, the FAA published its program for repair assessment of pressurized fuselages (RAP). The program, based on surveys of repairs to other high-time airplanes, was intended to govern detailed inspections of repairs to all airplanes before they exhausted three-fourths of their design service goal, or life. Published May 25, 2000, with an implementation date of May 25, 2001 – coincidentally one year to the day before the accident – the RAP required detailed repair inspections before airplanes with more than 15,000 flight cycles achieved 22,000 flights. The accident airplane was in this population, and the accident occurred in the time window between RAP implementation and the 22,000-cycle deadline. If that one-year window had been moved up to start with the date the program was published, the degrading repair might have been caught before the accident.
The ASC asked Boeing to explain how the 22,000-flight limit was determined. Boeing said it was based on fatigue test results of other repairs, and to coincide with a mandated major inspection requirement at 22,000 cycles for the B747. However, the fatigue test results were based on proper repairs. In the case of the CAL tail strike repair, the scratches and gouges were not polished out before the doubler was applied. The failure to do so may have been acceptable for a temporary repair, but not for a permanent one expected to last many years. Thus, fatigue propagation was accelerated – possibly confounding Boeing’s estimate that 22,000 flights represented a comfortable buffer.
There was only a hint of a problem. Pursuant to implementing RAP, all doubler repairs on the accident aircraft were plotted and photographed seven months before the accident. For the tail strike repair, a brown streak appeared on the outside – the apparent residue of leftover coffee and tea poured out in the aft galley, exiting the outflow valve and running along the repair.
The crew of the flight immediately preceding the accident flight, two days before, told investigators the airplane performed normally. No wrinkle marks were noted on the skin, which would have been a clear indication of structural weakness. The cargo doors functioned properly. There was no problem with the electrical or pressurization systems, they said. The next-to-last flight had been flown at the same cruise altitude.
Pesky pressurization
During the accident flight, there was no discussion on the cockpit voice recorder among the captain, first officer and flight engineer of any pressurization problems as they climbed to their planned cruising altitude of 35,000 feet. It was an experienced crew; the three pilots had a combined total of more than 25,000 hours flying time in the B747.
An altitude alert sounded about 24 seconds before the CVR abruptly cut off. The CVR’s sudden termination may have resulted from the severing of electrical power as the aircraft broke into four major pieces. There are some unidentified sounds recorded in the seconds before and just after the altitude alert, and other unidentified sounds just before the recording ends.
The flight engineer would have been managing and monitoring cabin pressurization in order to maintain a 5,000-foot cabin altitude as the airplane climbed higher. At a June 3 press conference, ASC managing director Kay Yong said some of the air system pressurization knobs were in the closed position. Investigators believe the system was in the manual rather than the automatic mode. “It’s very abnormal,” Yong said.
Abnormal? Consider this scenario. The functioning of the pressurization system in a modern jetliner is analogous to maintaining inflation of a balloon with a hole in it. The engines pump pressurized “bleed air” into the fuselage, the temperature of which is controlled by air conditioning packs, and outflow valves in the aft part of the lower fuselage operate to adjust the rate of air escape to maintain the desired 5,000-foot cabin altitude. To extend the metaphor, with air escaping at a regulated rate, more air must continually be blown into the balloon to maintain pressurization.
In this case, maintaining the pressure differential of 8.6 psi for flight at 35,000 feet may also have put a final decisive strain on the cracks in that tail strike repair. The pressure was forcing cracks apart and elongating and marrying-up any spider web of cracking tracks.
If one is losing pressure differential during climb – when it is expected to increase – the flight engineer would be motivated to manually close the outflow valves. The final recorded cabin altitude was 13,765 feet, just a hair short of the 14,000 feet at which the “yellow cups” stored in the passenger service units would deploy automatically in the cabin to supply passengers with supplemental oxygen. Prior to reaching this point, with the cabin climbing faster than normal, closing the outflow valves would seem routine, with no need for any mention to the pilots. Rather than anticipating structural failure and so urging the pilots to minimize maneuver, reducing differential and descending immediately, the flight engineer (per his normal routine) would be looking for ways to sustain that pressure differential. It would seem a natural part of trouble-shooting and not potentially fatal. In the AUTO position, the system itself would have closed the outflow valves to maintain cabin altitude at 8,000 feet. The thought of imminent structural failure might not even occur to the flight engineer, even if he noticed the outflow valves in the closed position. His concern would be in not causing alarm by deploying the “rubber jungle” of passenger oxygen masks in the cabin.
The pressure relief valves were recovered (the outflow valves were not found, to the dismay of ASC investigators). Investigators could not determine from the contorted remains whether the pressure relief valves were open or closed at the time the structure finally gave way. The flight engineer’s instrument panel was recovered. It contained two dials showing outflow valve position. Unfortunately, the needles rotated freely on their posts. No help there. The last few thousand feet of climb may have been the proverbial straw that broke the back of this jumbo jet. Level off at cruise would be the climactic point – a balloon with a weakened section at the point of maximum inflation. A burgeoning fatigue failure would reach the point of no return. Crack propagation would instantly become very fast and the tail would blow off like a bursting balloon. Structural experts would recognize the denouement as the “fast fracture” phenomenon. It had been seen before, when cracks on a high-time Aloha Airlines B737 suddenly connected together, and the top third of the airplane’s fuselage unzipped itself in an instant of terror-stricken surprise. As in the case of the China Airlines disaster, no faults were noted on the preceding flight. In that 1988 accident, a flight attendant standing in the aisle was sucked out – her remains were never recovered. The pilots were able to land the airplane, and the stark evidence of metal fatigue along a lap joint above the window line set in motion a massive program to ensure the structural strength of aging jetliners. The China Airlines accident portends the same for structural repairs.
The strange sounds picked up by the CVR just prior to breakup might have been the metal tearing. The cockpit area microphone, attached as it is to the structure, would pick up the low frequency – inaudible to humans – of metal tearing down aft.
Data-free inference
The accident airplane was equipped with an obsolescent – for this day and age – flight data recorder. Its 21 parameters captured just the basics, such as altitude, speed, control wheel position and so forth. It did not record necessary elements to understanding this case: cabin altitude/pressurization differential, outflow valve switch selection, or outflow valve position. The ASC is in the position of having to make educated inferences as to the scenario leading to sudden structural failure.
Of interest, these parameters are not among the minimum 88 items required by regulation at present for flight data recorders installed in new airplanes. Only loss of cabin pressure applies, as in “loss” or “normal.”
A December 2001 report of future flight data recorder needs by a committee working under the auspices of the Radio Technical Commission for Aeronautics (RTCA) does not mention these parameters as needed. However, the RTCA report does cite the need for higher sampling rates (e.g., 100 to 1,000 samples per second vice 2-10 per second) to record rapid changes such as “decompression.”
Dearth of documentation
For maintenance, the insightful details are in the documentation. That is precisely what has frustrated the ASC in this investigation.
The temporary repair of the tail strike damage was done in accordance with a CAL engineering diagram, which called for the installation of two aluminum patches, one measuring about two by ten feet, and the other one by five feet. Both patches were about 0.063 inches thick.
Boeing approved the temporary repair, but of the claimed permanent repair in May 1980, investigators could find only one notation. Boeing claimed it had not been consulted and had not been informed of the work.
CAL officials claimed that the asserted repair was considered “minor,” and therefore there was no requirement to advise the manufacturer. The claim is contradicted by the one record of the 1980 repair. It was listed in the “Major Repair and Overhaul Record.” Moreover, according to FAA regulations in effect at the time (Part 43, Appendix A), a major repair was defined as any work – including strengthening and reinforcing – involving riveting of a damaged metal stressed skin area exceeding six inches in size. CAL officials also claimed the permanent repair was done in accordance with Boeing’s structural repair manual (SRM). The Sept. 15, 1977, version of this manual (SRM 53-30-03) stated that all “burrs, nicks, scratches, sharp edges or corners” should be removed from the damaged area (i.e., dressed or polished out).
The physical evidence from the wreckage shows that this was not done.
ASC investigators concede that much has changed since 1980 in terms of record-keeping requirements and maintenance practices. Regarding the absence of key documents surrounding the 1980 repair, CAL officials said Taiwan’s Civil Aeronautics Administration (CAA) at the time only required the so-called Technical Log Book to be kept for six months. That’s correct in terms of Article 4 of the CAA regulations, but Article 19 required operators to retain logbooks for two years after any aircraft was destroyed or withdrawn (e.g., retired) from service.
ASC investigators have pointedly avoided drawing any conclusions as to “probable cause” in the Flight CI-611 disaster, preferring to characterize the doubler repair as a “risk factor.”
The determination of cause will emerge from the analysis now under way and expected to take about a year to complete. A draft final report is to be ready for review by June 2004. However, the sheer weight of emphasis on structural degradation at the repair site suggests the likely direction the analysis will take.
In the meantime, consider the lotus flower on the tails of China Airlines jets. To the Chinese, the blossom among its many meanings conveys creative power and purity. The stalk is noted for the ease with which it can be bent while resisting breakage because of its many strong sinuous fibers. On the accident airplane, the uncorrected tail scrape scratches led to an infection of cracking and corrosion, degrading structural strength. The fuselage as “stalk” to the lotus blossom emblazoned on the tailfin finally broke.
More Questions Than Answers
ASC: Did Boeing representatives to China Airlines receive information on the [Feb. 7, 1980] tail strike?
Boeing: The Boeing representative in Hong Kong assisted China Airlines with the initial damage inspection in Hong Kong. We have found no records indicating whether the Boeing representative to China Airlines [in Taipei] received [this] information.
ASC: Was there an official request/record by China Airlines to Boeing for comments or recommendations regarding the tail strike repair?
Boeing: We have no record of any request. Note that China Airlines has provided the [ASC] with a copy of “Engineering Recommendation, ERE (747) AS062,” dated 8 February 1980. That document states that the temporary repair was concurred [in] by the Boeing field service representative [in Taipei].
ASC: After the repair was done, did Boeing representatives acknowledge the procedures followed by China Airlines, and could Boeing provide a record of such acknowledgement?
Boeing: Our field service representative in Taipei advised Boeing that China Airlines had accomplished a temporary repair consisting of skin patches … [and] further advised that China Airlines intended to complete a skin replacement or external permanent patch repair per SRM [structural repair manual] at a later date. We have found no record that indicates Boeing was advised that the permanent repair had been completed.
Source: ASC, Maintenance Records Group report (edited for clarity)