AIRWORTHINESS

It is two years since Ansett ’s last flight. Mark Wolff and Martin Aubury report on the lessons learnt CRACK ATTACK from the airline’s collapse. AP/Rob AP/Rob Griffith

LIGHTS OPERATED by the of Victoria, is a flight simulator business, cases undetected fatigue cracking had the Group ceased some regional subsidiaries now run by potential to eventually lead to structural on March 5, 2002 when the other companies, some unsold aircraft failure. Fonce-great Australian airline and the Sir Reginald Ansett Museum in On December 23, 2000 Ansett grounded flew its last flight, from to . Hamilton. seven of its 767-200s after discovering the Days later, Ansett’s leased Airbuses So what is the legacy of Ansett’s demise? aircraft had not undergone structural departed for the US to go into storage in There have been big personal and finan- inspections that, in some cases, should Mojave, California, leaving 32 aircraft for cial costs, but perhaps the key legacy has have been carried out much earlier. sale. been heightened awareness in the avia- The aircraft were out of service for a The firm of accountants appointed tion sector of the importance of control short time while general safety inspections to wind up the group after its financial of airworthiness data, particularly for were performed. CASA allowed them back collapse, KordaMentha, embarked on ageing aircraft. Other consequences are in the air under strict conditions. a fire sale in an attempt to pay out staff new rules, expected to go to the Federal Ansett blamed the error on a single tech- entitlements and creditors. KordaMentha Government for approval this year, putting nical officer who allegedly received a service sold off aircraft, spare parts, subsidiary more responsibility on operators to act on bulletin from Boeing two years earlier noti- airlines, airport terminal slots, property manufacturers’ safety advice. fying the airline that the 767s needed to and equipment. Even the giant head office A series of safety problems beset Ansett undergo the inspection on reaching 25,000 kitchen sink was sold when the adminis- before its financial collapse. There were cycles. Ansett said the officer somehow trators auctioned remaining goods from two key events: in December 2000 and mistook the figure for 50,000 cycles and the airline’s headquarters. in April 2001, a number of Ansett B767 filed the bulletin, thinking it would be All that is physically left of the aviation aircraft were withdrawn from service some time before it would apply. company Sir Reginald Ansett started in because fatigue damage inspections of the The error was noticed by Ansett engi- 1936 at Hamilton, in the western districts aircraft structure had been missed. In both neers on one aircraft on which they were

36 FLIGHT SAFETY AUSTRALIA MARCH-APRIL 2004 AIRWORTHINESS working. Further checks revealed another six B767s had exceeded the 25,000 cycles mark. CASA launched an investigation into the airline’s quality assurance systems following this and other incidents that occurred in quick succession. The groundings came at the Christmas travel peak, disrupting some services. But what happened in the lead up to the following April was worse. The story starts with the issue by Boeing on March 2, 2000 of an alert service bulletin (No 767-57A0070 revision 1) covering inspections of early model B767- 200s for fatigue cracks in the fittings which connect the engine support structure to the wing (see diagram). Boeing recommended the inspections be performed within 180 Critical condition Fatigue crack in an Ansett B767 wing front spar outboard pitch load fitting. days. An alert is the highest level of Boeing Location of the fitting (below). SB, and although it is not compulsory to comply (as it is with an airworthiness directive), any airline not doing so could be regarded as foolish at best and, at worst, derelict in its duty of care to passengers. The bulletin applied to B767-200s up to serial number 101 off the line. Ansett’s original five B767s were serial numbers 24, 28, 32, 35 and 100, delivered between March 1983 and September 1984. In addi- tion, a former Britannia Airways aircraft (serial number 79, built in early 1984) was in the fleet, along with some later models. Systemic problems In December 2000, Ansett discovered that engine pylon inspections covered by the Boeing alert service bulletin had been overlooked, although this information did not enter the public domain until April 2001. Ansett consulted CASA and Boeing on the best way of making up the inspections. The end of April was the deadline to complete them. The nightmare continued into the first days of 2001 when hairline cracks were found in the tail support structure of one of the 767s undergoing the delayed 25,000 cycles check. Although the cracks presented no immediate safety problem, the resulting publicity further damaged Ansett’s public image. The situation for Ansett worsened later in January 2001 when it was discovered that a B767-300 had been incorrectly fitted with a leading edge slat from a B767- 200. Although the slats are the same size

FLIGHT SAFETY AUSTRALIA MARCH-APRIL 2004 37 AIRWORTHINESS AP Grounded Ansett B767s parked at Tullamarine Airport, Melbourne. and work on both models, the 767-300 then, only recommendations that had been at that time had not issued an airworthi- slat is strengthened and is technically a adopted were fully documented. CASA ness directive mandating the alert service different part. The error was discovered said the changes would allow it to carry bulletin, CASA took action to mandate shortly before the aircraft was due to leave out safety audits more effectively. the service bulletin in Australia. The FAA Melbourne for Hong Kong. CASA’s initial investigations revealed followed suit. CASA announced it was expanding its shortcomings in the airline’s maintenance As a result of CASA’s action, another investigation into Ansett to include the systems in several areas. It planned a major three 767s were immediately grounded latest incident and to discover if the mix- audit of Ansett’s maintenance activities for for inspection. up was “indicative of wider, systemic prob- early March. In the meantime, there was The situation deteriorated on April 12 lems at Ansett that had not been under- some good news for Ansett as the B767- when the ATSB revealed that the airline stood fully by CASA or the airline”. 200s affected by the original problem had flown a 767 with an incorrectly stowed Also in January, the Australian Transport had now met all the necessary inspection – and therefore inoperative – emergency Safety Bureau said it was conducting its requirements and were clear to resume exit slide on eight sectors before the fault own inquiry into Ansett and also “CASA’s normal operations. was discovered. The implications were systems for compliance, including proce- The last straw Things settled down for serious. With an unserviceability of this dures for delegating responsibilities to a month or so, but the worst was yet to kind, an airliner cannot legally fly with airlines for regulatory compliance”. come. passengers. CASA ordered changes to procedures On April 10, 2001 inspections of seven This was the last straw for CASA. It within Ansett in February, with the airline Ansett 767-200s covered by the Boeing grounded Ansett’s entire fleet of ten required to record in detail its handling engine pylon SB of March 2000 revealed Boeing 767s, saying the aircraft would of recommendations by aircraft manu- that three aircraft had cracks in the pylons not be able to fly again until it was satis- facturers for changes to maintenance and which required grounding and repair. fied they all met relevant safety standards. inspection procedures. A fourth 767 was quickly repaired and CASA announced it would undertake Details were required to be provided returned to service. safety checks on all the 767s, inspecting the when manufacturers’ recommendations CASA recognised the seriousness of aircraft and auditing recent maintenance were acted upon and a full technical justifi- the Boeing alert service bulletin. While work. The checks would begin over the cation recorded when they were not. Until the US Federal Aviation Administration Easter weekend.

38 FLIGHT SAFETY AUSTRALIA MARCH-APRIL 2004 AIRWORTHINESS

CASA warned Ansett of its intention and ongoing commitment to appren- to issue a notice giving Ansett 14 days to ticeships, and would bring in additional An ageing fleet show cause why its air operators certificate resources from Boeing for specific aircraft and certificate of approval should not be repair planning issues. A new risk manage- NSETT WAS ONE of the first airlines withdrawn. The forewarning of a possible ment review process would also be put into Ain the world to operate B767 aircraft, notice was based on a pattern of ongoing place. and did so largely for domestic opera- structural, management and personnel An important structural change was the tions within Australia from 1983. problems. Ansett would have to prove to moving of maintenance control from the Certified under damage tolerance CASA that it could lift its game in these engineering organisation to the airline. design criteria, the B767 requires peri- areas quickly and reform its maintenance The first of the grounded Boeing 767s odic inspections of the aircraft struc- systems. returned to service on April 20 on comple- ture. As in-service experience with On April 15, CASA gave Ansett approval tion of its paperwork and physical inspec- the type grows, additional inspection to charter six aircraft from overseas opera- tions. All the affected 767s were back in requirements are notified to operators. tors to relieve the capacity shortage caused service by early May. As aircraft age, the need to inspect, by the 767 grounding. Air New Zealand That Ansett had serious problems repair or replace parts increases. provided a 767-300 and 747-400, Singa- managing its maintenance programs is Specific needs for ageing aircraft pore Airlines a 747-400, Air Canada a 767- an inescapable fact. Four months later, in include the detection of fatigue cracks 300 and Emirates two 777s. September 2001, the full extent of Ansett’s The next day, Ansett and CASA struck a and Air New Zealand’s financial problems under fasteners; small cracks associ- deal to “work together … to reach mutual was revealed, putting the events of the ated with widespread fatigue damage; agreement on the structure of the engi- previous year into perspective. hidden corrosion; cracks and corrosion neering organisations within Ansett; and Managing structural fatigue Ansett’s in multi-layer structures; and stress the internal control systems relating to the problems in maintaining its diverse and corrosion cracking. planning and implementation of airwor- ageing fleet have thrown the spotlight on The average age of the fleet of thiness directives and service bulletins”. the management of structural fatigue. Western-built jets is 12.9 years, Singapore Airlines (now a 25 per cent Structural fatigue is a threat that cannot according to aviation consultant, GAB shareholder in Air New Zealand) agreed be avoided, because aircraft designers Robins. There are 4,489 Western jets to help Ansett compile the data required must always strike a compromise between over 20 years old. The average age by CASA. weight and strength. Many variables make of Western turbo-prop aircraft is 15.5 On April 18, the physical inspection of accurate prediction of structural failure years. the first 767 started. Meanwhile, Ansett very difficult. Advances in computer technology managers began a busy two days convincing The problem used to be managed by have cleared the way for more accu- CASA management that the airline did not estimating an approximate life, cutting it rate stress analyses on three-dimen- deserve to have its AOC withdrawn. On by a safety factor and after that discarding sional crack configurations, more real- April 20, CASA announced that Ansett the structure. would not be issued with a formal “show This “safe life” approach is still used for istic simulations of fatigue and fatigue cause” notice. small aircraft and helicopters. cracking in structural components, and Ansett had undertaken to perform a Another approach was to duplicate better fracture mechanics concepts to wide-ranging review of its maintenance critical structure so that if one part failed assess the residual strength and fail- division, including staff, training and prematurely another structure was there to safe capability of aircraft structures. spares management. It had also agreed to take the load. This is “fail safety”, the meth- NASA’s airframe structural integrity introduce better maintenance planning odology used to design aircraft throughout program is trying to develop a compu- and control measures and a system that the 1960s, up to and including the Boeing tational methodology to predict fatigue properly tracks documentation. Under- 747. crack growth and fatigue life, and to takings were given to implement quality Implicitly, fail safety depended on simulate stable tearing for residual control in all areas through a special new detecting the first failure before the back- strength prediction of thin shell struc- unit to ensure work met the desired stand- up structure also failed. That did not always tures, including aircraft fuselages, for ards. happen. In 1977 a 14-year-old Boeing 707 large single cracks or multiple cracks. Ansett management also promised to crashed in Zambia when its tailplane sepa- New alloys, materials, and processing introduce a safety education campaign for rated, because failure of its main spar had technologies, developed since older all staff. The company said it would ensure gone unnoticed. aircraft were originally designed, are all 767 service bulletins were assessed, and The big advance in managing structural being used to produce better compo- full technical justification recorded where fatigue has been the science of fracture SBs were not implemented. In addition, mechanics, which has made so-called nents with significantly lower life-cycle the company said it would provide a strong “damage tolerance” possible. costs.

FLIGHT SAFETY AUSTRALIA MARCH-APRIL 2004 39 AIRWORTHINESS

fail-safe design in the rear spar struc- fluid lines. The bulkhead ruptured as its Examples of fatal ture. Shortcomings in design assessment, strength had been reduced by inadequate certification and inspection procedures repair and fatigue cracks. fatigue accidents were significant factors. Boeing 737, N73711, Maui, Hawaii, USA De Havilland Canada DHC-2 Beaver, 28 April 1988 near Armidale, NSW, Australia The aircraft experienced an explosive 10 September 1963 decompression and structural failure at The aircraft was at the end of a super- 24,000ft. Despite the loss of 18ft of the phosphate spreading run when the left aircraft cabin skin, the aircraft landed wing was seen to separate from the safely. One flight attendant died. Investi- aircraft at around 150 ft above the ground. gation determined that the maintenance The aircraft immediately rolled to the left program failed to detect significant and struck the ground. The pilot died. disbonding and fatigue damage of the Investigators determined that the left lift fuselage lap splice. strut upper attachment fitting failed in flight due to a fatigue crack allowing the McDonnell Douglas DC-10, N110AA, left wing to separate. Chicago, Illinois, USA 25 May 1979 Vickers Viscount, 720C, VH-RMQ, near During take-off rotation the left engine Port Hedland, WA, Australia and pylon assembly and about three 31 December 1968 feet of the leading edge of the left wing The aircraft was on a scheduled flight separated from the aircraft and fell to from Perth to Port Hedland, when it the runway. The aircraft collided with went down 28nm south of its destina- the ground. 271 people on board and two tion. Witnesses saw the aircraft descend people on the ground died. Investigation rapidly and steeply, but did not see it hit revealed that damage by improper main- the ground. tenance procedures resulted in an over- Bell 206B Jet Ranger, N213AL, South The investigation found that the right load fracture and fatigue cracking of the Marsh 275, Gulf of Mexico, USA wing outboard of the number three engine pylon aft bulkhead upper flange. 23 April 1991 had separated from the aircraft, with the The pilot did not make a required radio primary failure at the lower boom of the check after departure from an offshore oil main spar. The failure was due to fatigue rig, so a search was initiated. Two hours cracking of the right inner wing main spar later, debris was found floating three miles lower boom, adjacent to the outer edge of from the departure point. Two people died. the number three engine nacelle. A metallurgic examination found that the vertical fin attachment fittings had sepa- Boeing 707-321C, G-BEBP, near Lusaka, rated due to fatigue induced by corrosion Zambia and corrosion pitting. 14May 1977 The accident occurred on approach to Cessna 402C, N819BW, Goldsby, Okla- landing, in daylight and in good weather. homa, USA Shortly after the selection of landing flap, Boeing 747, JA-8119, Mount Ogura, 27 April 1999 the right horizontal stabiliser and elevator Japan The aircraft hit the ground in an uncon- detached. The aircraft pitched rapidly 12 August 1985 trolled descent following in-flight sepa- nose down and collided with the ground The aircraft experienced an explosive ration of the right wing during a normal about two miles short of the runway. decompression while climbing through descent. The investigation was conducted by 23,900ft. The flight data recorder indi- Metallurgical examination revealed the UK at the request of the Zambian cated the aircraft began to oscillate and that the right wing front spar failed due to authorities. It concluded that the acci- roll. After around 40 minutes it crashed fatigue that started at an area of mechan- dent was the result of a loss of pitch into a mountain. 524 people were killed. ical damage and rough machining marks. control following the in-flight separation The investigation found that a failure The presence of primer covering the of the right-hand horizontal stabiliser and of the rear pressure bulkhead caused mechanical damage suggested that the elevator. The failure wa due to a combi- part of the vertical stabiliser and tail to damage was produced during the manu- nation of metal fatigue and inadequate blow away, rupturing all main hydraulic facturing process.

40 FLIGHT SAFETY AUSTRALIA MARCH-APRIL 2004 AIRWORTHINESS

Damage tolerance involves analysis and tests to estimate how quickly cracks grow, their maximum length before the structure fails and then scheduling inspections scien- tifically. In some places, the critical crack length is microscopic and sophisticated inspection techniques are needed. Elsewhere, cracks can be a metre long and visual inspections suffice. Airliners have been designed to damage tolerance principles for more than 20 years, with earlier aircraft revalidated and their inspection programs revamped. Knowing where to look for cracks is diffi- cult. Manufacturers usually test a complete Smith AAP Image/Julian airframe to simulate several lifetimes of airline service to see where cracks start. On continuing airworthiness But the best aids are reports from routine anufacturers designing new aircraft, engines or propellers are required by inspections on hundreds of aircraft around Mthe applicable certification regulations to develop and publish instructions for the world. Findings are reported to the ensuring the continued airworthiness of the aircraft, engine or propeller in service. manufacturer, and operators notified. A type certificate is not generally issued until the manufacturer has developed contin- Causes and conclusions The ATSB uing airworthiness instructions and published them in documents, such as maintenance concluded that Ansett failed to do the manuals, overhaul manuals and service instructions. 25,000-flight-cycle inspections, recom- Once an aircraft, engine or propeller has entered service, the operator's regulator mended by Boeing in June 1997 and requires the operator to report defects that might compromise the airworthiness of the updated in June 2000 to include fatigue aircraft. crack inspections. The aircraft manufacturer is also required to pass on to the certifying regulatory It also failed to act within the recom- authority (for Boeing, that is the FAA) reports of problems that have occurred in the mended six months on a March 2000 operation or maintenance of its aircraft. Boeing alert SB relating to possible cracking Reports suggesting the safety of the aircraft has been compromised are typically in B767 engine mount fittings. called major defect reports (MDR) in Australia. There is no single cause for Ansett’s To address the reports, the manufacturer develops service instructions. Those dealing demise, and commentators have noted with MDRs are typically called service bulletins. several major factors at play. The role of the certifying regulator does not end with the issue of the new type certifi- The first relates to strategic adjustment cate. The regulator is required to monitor the continuing airworthiness of the product, a in a service organisation during times of role that continues until the type certificate is cancelled. It reviews and assesses both significant change. Also at play was the the defect reports as received by the manufacturer and the manufacturer’s response. Its purchase of too many aircraft types during review is carried out by specialists qualified in design, certification and maintenance. the 1980s, which led to unsustainable When the regulator deems a condition unsafe, it issues an airworthiness directive maintenance costs, large inventories and, mandating corrective action. Most ADs mandate a service bulletin addressing an as the fleet aged, increased running costs. unsafe condition. In addition to errors and omissions by ADs issued by a foreign government are not mandatory in Australia unless they are individuals in Ansett, the ATSB found detailed in an Australian airworthiness directive. there were deeper systemic and resource weaknesses in the group. The actions by Ansett and CASA to new regulations will force operators to Sources: Investigation into Ansett Australia ground the B767 aircraft until safety could take more responsibility for assessing SBs. maintenance safety deficiencies and the be assured protected the flying public. Operators will have to implement the control of continuing airworthiness of Class The ATSB investigation also found that recommendations or record their reasons A aircraft, Department of Transport and the Australian and international systems for not doing so. Regional Services, Australian Transport for continuing airworthiness of Class A CASA continues to review service Safety Bureau, November 2002; Ansett: aircraft were not as robust as they could bulletins, and takes a close interest in the the Story of the Rise and Fall of Ansett, have been. management and information systems that Stewart Wilson, Aerospace Publications To strengthen the Australian system, support continuing airworthiness. (2002).

FLIGHT SAFETY AUSTRALIA MARCH-APRIL 2004 41