I would like to thank my good friend Bob Pap, who is the president of both the Accurate Automation Corporation and the International Society for Air Breathing Engines, for inviting me to speak to this distinguished group of engineers and scientists.
I needn’t tell you that engine technology has improved immensely over the years, probably representing one of the areas that has shown the greatest increase in reliability and safety. The transition from piston to turbine engines had an immeasurable impact on aviation safety. Yet, accidents relating to powerplant failures still occur, and what I want to talk to you about is what you can do to eliminate such failures.
But first, I’d like to say a few words about the National Transportation Safety Board, which is responsible for the investigation of accidents and incidents involving planes, trains, buses, barges, bridges, pipelines, and ships.
The Safety Board also proactively pursues safety by conducting special studies and issuing safety recommendations. Recommendations are usually directed to the regulatory authority responsible for the respective mode of transportation, but they are also addressed to states, manufacturers, and operators of transportation equipment. Because we have no regulatory authority, our recommendations are not binding. However, they do carry a lot of weight. Historically, more than 80 percent have been implemented.
About 2,000 aviation accidents and 500 accidents in the surface modes are investigated every year by our agency of just 360 persons. In addition, we are involved in 50 to 60 foreign investigations every year. With all this activity, it still costs each of you less to fund the Safety Board for a year than to mail a single post card.
It is no secret that the last year has been a difficult one for our small agency. We are currently investigating two Boeing 747 accidents -- each of which took the lives of more than 200 persons -- the in-flight explosion of TWA flight 800 near Long Island, and the crash of Korean Airlines flight 801 in Guam. In the past year, we have also been investigating the catastrophic engine failure on a Delta Air Lines MD-88, in Pensacola, Florida; two accidents involving Federal Express jumbo jets; the runway collision involving a United Express commuter airliner at Quincy, Illinois; the crash of a Comair commuter in Monroe, Michigan; the takeoff crash of the Fine Air DC-8 in Miami; and numerous other air carrier accidents and incidents, including a number of powerplant-related issues that I will be discussing further.
Additionally, the NTSB is still actively investigating the accident of USAir flight 427, a Boeing 737, at Aliquippa, Pennsylvania, that occurred 3 years ago this week. The importance of this accident, coupled with the extreme destruction of the aircraft and the inadequacy of its flight recorder have required this protracted effort.
Yesterday, 35,000 airline flights took more than a million passengers safely to their destinations here in the United States alone. That’s twice as many flights as were operated 10 years ago and half as many as will be operated 10 years from now. How are we going to ensure that the flying public maintains its confidence in that system?
I have been invited here this morning to offer you, as engineers and scientists, a series of challenges. Too often during our accident and incident investigations, we discover that an engine component failed, leading to a propulsion system failure. Sometimes the failure has dramatic results.
Propulsion system engineers know that engine failures are a fact of life and will occur, if only on rare occasions. Unfortunately, the Safety Board hears about the worst of these. For example, last week the Board was informed of two new accidents involving engine failures, both occurring on Saturday, September 6.
In one, we are told that a Saudia Boeing 737 ran off the end of the runway and burned following a rejected takeoff with low engine power and a possible engine fire.
The second accident involved a Canadien Airlines Boeing 767 in Beijing that suffered an uncontained failure of one of its General Electric CF6-80C2 engine high pressure compressor hubs. While the details of this failure are not immediately known, the Safety Board is very interested and is participating in this investigation to see if it is related to other apparently similar failures leading to corrective actions that the Board attempted to initiate in August of 1995.
Redundancies that go beyond a second engine mitigate the consequences of most engine failures. But inadequate training can negate these built-in redundancies and what should have been just a routine engine shutdown can become much more. For example, in January 1989, about 10 minutes after departure from London Heathrow Airport, a British Midland Airways Boeing 737 crashed, killing 47 passengers. The investigation revealed that during climb, the left engine, a CFM-56, experienced a catastrophic fan blade failure that caused noise, vibration and a burning smell. The flight crew elected to divert to East Midlands Airport. During the descent, the crew reduced power on the right engine, which consequently reduced the noise, shuddering, and surging on the left engine. Persuaded they had correctly identified the defective engine, they shut down the right – which turned out to be the wrong -- engine.
The pilots continued their descent and during final approach, they increased power on the left engine, whereupon the engine lost thrust and the airplane crashed about 800 yards short of the runway. Unfortunately, the pilots had not been informed that flames had been seen emanating from the left engine by many airplane occupants.
In another case of pilots misdiagnosing an engine problem, on December 12, 1994, a Flagship Airlines Jetstream 32 was destroyed when it crashed near Raleigh-Durham Airport in North Carolina. During the instrument approach, with the landing gear and flaps extended, the captain was distracted by the illumination of an ignition light that led him to believe one of the engines had flamed out.
During the ensuing discussion about the suspected engine failure and whether or not to continue the approach, the captain leveled off, and the plane began to lose airspeed. The cockpit voice recorder revealed that he spontaneously decided to execute a missed approach, and in so doing, advanced one power lever, believing the other engine was inoperative. However, the second engine was still operating normally. The captain pulled the nose up, causing the aircraft to stall and crash.
The NTSB determined that the probable cause was the captain’s improper assumption than an engine had failed and his subsequent failure to follow approved procedures for engine failure, single-engine approach and go-around and stall recovery.
The dialogues between the flight crews captured on both cockpit voice recorders ultimately show that pilots can compare engine instrument indications from two normally operating engines and conclude that one has failed. Alternatively, as in the British Midlands accident, pilots can compare engine instrument indications from a failed engine to an operating engine and not be able to conclude that one has failed. Instead he or she relies on senses, not instruments, to identify the failed engine. In both cases, each cockpit had engine displays that satisfied the Federal Aviation Regulations; worse yet, they satisfied the engineers.
Who should be cited in the probable cause? Is the manufacturer of the propulsion system responsible even though the engine fails at an acceptable rate? Is the manufacturer of the aircraft responsible even though it had a second engine with the requisite engine instrument displays? Or is the airline responsible even though it had trained the pilot to perform engine-out approaches and landings scores of times?
Here is your first challenge: Design improved engine instrument displays that provide an accurate indication of power output and an instantaneous, accurate and unambiguous indication of a failing or failed engine in any power setting, in all operating conditions, including severe vibration, whether at night or in bad weather. And, by all means, make the warning light bright enough for the pilots to see it!
Your second challenge involves corrosion. I am sure that manufacturers would spare no expense if they could fabricate engine parts from 100 percent corrosion-resistant material. They have made great strides; however, we in the accident investigation business see how deadly corrosion is in turbine engines.
For example, on October 10, 1992, an El Al Boeing 747 freighter crashed into two 9-story apartment buildings while attempting to return to the Schiphol Airport, Amsterdam for an emergency landing. Four flight crew and 43 people on the ground were killed. During the departure and while climbing through 6,000 feet, the No. 3 Pratt & Whitney JT9D engine and pylon separated from the wing. The separated engine then rotated outboard and struck the No. 4 engine, which also separated. With two engines powering from one side, and no power from the other, the airplane rolled upside down and crashed.
During the investigation, in which the NTSB participated, a fatigue crack was discovered during a metallurgical examination of the No. 3 engine pylon-to-wing attachment fuse pins. The crack originated from corrosion pitting on the inner diameter wall of the fuse pin and propagated through approximately 50 percent of the pin’s cross-section before catastrophic failure. The resulting loss of 47 lives, a widebody aircraft and 2 apartment buildings illustrates the consequences of our failure, for whatever reason, to detect corrosion in transport category aircraft structures or components.
The Safety Board also investigated the ValuJet Airlines DC-9 accident in Atlanta where, during a takeoff on June 9, 1995, a compressor disk from the Pratt & Whitney JT8D engine experienced a catastrophic failure. Fragments from the failed disk perforated the fuselage, cut a fuel line and set the aircraft on fire. All passengers and crew were safely evacuated; however, the aircraft was destroyed by the fire.
The investigation revealed that several fatigue cracks originated from corrosion pitting inside the tie rod holes of the steel 7th stage high pressure compressor disk. Further, the corrosion pitting had been plated over with a nickel-cadmium coating that was found to worsen the tendency for cracking. The plating in the crack showed that it existed during the previous overhaul of the disk. The fatigue crack propagated through approximately 75 percent of the disk’s cross-section before the catastrophic failure.
These two accident investigations gave the NTSB dramatic examples of how a tiny corrosion pit can initiate a crack and propagate through steel several inches thick. Although these investigations also revealed problems about the fuse pin installation on the Boeing 747 wing and the overhaul procedures of the JT8D engine, the Safety Board learned that high stresses combined with corrosion can be a deadly mix.
That brings us to challenge number 2: Develop new and better protective coatings that can prevent corrosion. Examine and protect against the effects of stress and corrosion in all your engine designs. If possible, determine the life of your components based on known or empirical crack propagation models. Additionally, develop design features and/or manufacturing processes that reduce the stresses that make components susceptible to corrosion cracks.
To get to the third challenge we can agree that propulsion system engineers know how reliant the aerospace industry is on non-destructive inspection methods, like fluorescent particle inspection, magnetic particle inspection, ultrasound and blue etch anodize, to name just a few.
Depending on the material and crack location, these inspection methods can be very effective. However, Safety Board investigators continually discover that even large cracks manage to evade detection. Unfortunately, sometimes the best non-destructive testing laboratories in the world, the ones we know and trust, have failed at one time or another.
For example, on July 19, 1989, a United Airlines DC-10 experienced a catastrophic failure of the No. 2 GE CF6-6 engine at 37,000 feet, and crashed during an attempted emergency landing at Sioux City, Iowa. Of the 296 persons aboard, 111 died. The fractured segments from the center engine’s fan hub, fan blades and shrapnel perforated the aircraft’s horizontal stabilizer and severed hydraulic lines to all three hydraulic systems.
Metallurgical examination of the titanium fan hub revealed that a fatigue crack originated from an inclusion near the surface of the hub’s bore. The inclusion had been formed during the titanium vacuum-melting process at the time of manufacture about 2 decades earlier, which developed an internal cavity during final machining and/or shot peening. At the time of manufacture, the fan hub had been ultrasonic and macroetch inspected.
Further, the investigation revealed that the fan hub had been inspected six times during its operational life, each of which included a fluorescent particle inspection. The last inspection took place approximately one year or 760 cycles before the catastrophic failure. Based on a fracture mechanics prediction, the crack length was estimated to be almost ½-inch long at the time of its last inspection, and in fact dye penetrant from that inspection was found in the crack.
A example more recent than the ValuJet accident I just spoke of is the crash of an EMB-120 in Carrollton, Georgia after a propeller blade fractured in flight because corrosion pitting in the blade was not detected in its most recent inspection.
We will soon conclude our investigation on that Delta Air Lines MD-88 engine failure I mentioned earlier. Metallurgical examination of the fracture surface of that fan hub revealed that a fatigue crack had originated from a machining defect in a tie rod hole. Further, the fan hub had been fluorescent particle inspected only seven months before the failure, when the crack was estimated to be approximately ½-inch long.
These accidents reveal that cracks can still evade detection from ultrasonic and fluorescent particle inspections. During virtually every engine failure investigation, we discover that there was either a missed or improper inspection. Consequently, we have reviewed the processes and procedures associated with virtually all non-destructive inspection methods, and frankly, the results are not very encouraging. But these processes are the state of the art as we know it.
Even under ideal circumstances, with tightly controlled environments, temperatures, and concentrations, there is a minimum detectable crack size by each of the inspection methods. Some engineers allege that cracks in some components, such as titanium fan hubs, can’t be detected because residual stresses hold the crack closed. Further, some inspectors have been examining fan hubs for 20 years and have never seen a crack; their level of expectation somehow must be raised so that they won’t miss the occasional crack that can lead to a catastrophic failure.
Your third challenge, therefore, is to be innovative. Develop new and improved enhanced visual non-destructive methods. As you develop new methodologies, consider the steps that can be taken to increase the probability of detection by inspectors with normal human performance limitations. And finally, determine inspection intervals based on known or empirical crack propagation models.
These accidents and others clearly indicate that there are many current metallurgical and engineering problems that plague aviation propulsion systems. Pilots misidentify anomalies or failures because of ambiguity in their engine instrumentation displays. We have found rotating steel, aluminum, and titanium engine components that had corrosion pits, inclusions, and machining flaws, that caused cracks that led to catastrophic failures. Finally, we have found that the non-destructive inspection methods in widespread use sometimes fail to detect these cracks, even when crack sizes are clearly within the detection-capability of the test equipment.
There is hope, however. Currently, there are consortiums, review boards, seminars, committees, and workshops, in which some of you are involved, that address instrument displays, corrosion, non-destructive inspection regarding aircraft engines and components. Your participation is essential, because your innovations will prevent accidents. Whatever an innovative design or inspection procedure will cost, it surely would not equal the cost of an accident they are meant to prevent.
According to the FAA, the direct cost of just one fatal commercial aviation accident – the DC-10 crash in Sioux City – totaled over $300 million, in addition to the enormity of the human tragedy involved.
Let me leave you with one request, as you develop new ideas and technologies for tomorrow, be mindful of how these new ideas, materials, and processes can be used to solve today’s problems. If you feel your idea can help, we would like to know about it. Our Offices of Aviation Safety and Research and Engineering would be happy to meet with you at any time.
I wish you great success in you efforts. Your work continues to expand the horizons of air breathing engines. May your only interaction with my agency be at forums like this. Thank you for your invitation.
Jim Hall's Speeches