The 28th of April marks 30 years since Aloha Airlines flight 243 had its hull ripped open at 24,000 feet. In light of the current focus on metal fatigue and the proper maintenance of aircraft, I thought it would be interesting to look at the accident in 1988 which changed the way we looked at both metal fatigue and maintenance timing. We often talk about how incidents and accidents change aviation. I suspect that Aloha Airlines flight 243 was quite possibly the biggest game-changer for aviation maintenance procedures and regulation… but feel free to tell me about other ones in the comments!

On the 28th of April 1988, Aloha Airlines flight 243 was a scheduled flight from Hilo International Airport to Honolulu International Airport.

The accident aircraft was a nineteen-year-old Boeing 737, part of Aloha Airlines 737 fleet for inter-island flights (ferrying passengers around Hawaii). That morning, the flight crew had arrived at the airport at Honolulu around 5am. The first officer did the external pre-flight inspection and was satisfied that the aircraft was ready for flight. The accident report says that the crew flew six flights, which it describes as ‘three roundtrip flights from Honolulu to Hilo, Maui, and Kauai’ which sounds to me like each ‘roundtrip’ must have been four take-off and landings.

At 11:00, a scheduled first officer change took place. The crew flew from Honolulu to Maui and then from Maui to Hilo…Neither pilot left the airplane on arrival in Hilo, and the crew did not perform any visual exterior inspection nor were they required to.

However it shakes up, the point here is that the Boeing 737 was making a lot of short hops, as was typical of all the aircraft in Aloha Airlines Boeing 737 fleet.

At 13:25, the flight departed Hilo for the last leg of the roundtrip, back to Honolulu. There were 95 souls on board: two flight crew, three flight attendents, an FAA air traffic controller in the cockpit’s observer seat and 89 passengers.

The weather was clear and the departure was uneventful. As the Boeing 737 reached its cruising altitude of 24,000 feet, a piece of the fuselage tore open. In the cockpit, there was a loud clap or whooshing noise, followed by the sound of wind. The first officer’s head was jerked backwards and she found herself staring at debris floating around the cockpit. The captain looked back and realised he could see straight into the cabin, the cockpit door was gone, and there was blue sky where the first-class ceiling should be.

The aircraft rolled to the left and then to the right as the pilots and the controller put on their oxygen masks. The captain took control and initiated an immediate descent. The cabin crew were standing at their positions along the aircraft while the passengers were still seated with the seat-belt sign illuminated. The cabin crew member at the front of the aircraft was swept out of the cabin through the hole on the left side of the fuselage. The other two cabin crew were thrown to the floor, one striking her head hard as she fell. The other managed to crawl up and down the aisle to assist and calm the passengers.

The first officer set the transponder to 7700, signalling an emergency, and attempted to contact Air Traffic Control. The flight crew could not hear each other and had to use hand signals to communicate. They also had no idea if their attempts to use the radio were successful.

As it happens, the controller did not receive the blind communication but noticed the emergency code on the transponder return. At the aircraft descended to 14,000 feet, the first officer changed frequency to Maui tower and again broadcast blindly that they’d had a rapid decompression and were declaring an emergency. This time, the message got through and Maui Tower prepared for an emergency landing with rescue vehicles along the left side of the runway.

In 1988, the control tower had to dial the emergency number 911 in order to get ambulance services, same as anybody else. But the controller didn’t realise that medical help would be needed. The flight crew stated their emergency as a rapid decompression which, while true, didn’t give Air Traffic Control any real understanding of the state of the Boeing 737.

The captain began slowing the aircraft as he reached 10,000 feet above mean sea level. He retracted the speedbrakes and removed his oxygen mask as he turned towards Maui’s runway 02. The noise level dropped and the flight crew were able to hear each other and the radio. The captain experimented with the flaps extension and speed to work out the best parameters for controlling the aircraft, deciding on flaps 5 and indicated airspeed of 170 knots.

The first officer gave as much information to the Maui tower controller as she could, explaining that they were unable to get through to the cabin crew and would need passenger assistance. She lowered the landing gear on the captain’s command. The nose gear indicator light did not illuminate. She selected manual nose gear extension and again, the green light did not appear. Neither did the red light, which would indicate ‘landing gear unsafe’. The captain decided against trying to use the nose gear downlock viewer, because the centre jumpseat was occupied and he felt it was more urgent to land the aircraft immediately. The first officer advised the tower that they didn’t have a nose gear and told them, “We’ll need all the equipment you’ve got.”

As if this wasn’t enough, as the captain was manoeuvring for the approach, the aircraft yawed: the left engine had failed. The Boeing 737 was shaking and rocking.

Despite all of this, at 13:58, 35 minutes after take off, Aloha Airlines flight 243 landed safely on Runway 02 at Kahului Airport on Maui. Unbelieveably, there was only one fatality, the cabin crew member who is listed on the report simply as “lost in flight”. If that isn’t a miracle, I don’t know what is.

I can only imagine the horror of the aircraft coming into sight and the relief as it touched down. However, the rest of the passengers and crew needed medical attention. Somehow, the first ambulance didn’t get notified until about the time of touchdown and it didn’t arrive at the scene until seven minutes later. Even if someone had called 911 from the very first, there was another problem – the island only had a couple of ambulances which were nothing like enough to deal with a Boeing 737 full of traumatised people. ATC ended up phoning a Hawaiian tour company and asking for as many of their 15-passenger vans as they could spare. Two of the tour company drivers had experience as medics, so they created a station on the runway to treat and move the injured, while office staff and airport mechanics drove the vans the three miles to the hospital.

There were only eight serious injuries, one cabin crew member and seven passengers, and as far as I can see, all of them recovered.

Obviously, it took some time to understand what had caused the damage, especially since the missing fuselage of the aircraft was never found, so the investigation was left to try to recreate what happened without physical evidence of the initial damage. The pilots had not seen anything wrong with the plane but, surprisingly, a passenger had. As she was boarding the plane at Hilo, she’d noticed a crack in the fuselage. She didn’t mention this to ground personnel or flight crew; she couldn’t have known that she was the only one to see it. But there was no exterior inspection at Hilo: the flight crew had never left the cockpit. The crack that she described was in the upper row of rivets along the S-10L lap joint, about halfway between the cabin door and the edge of the jet bridge hood.

A lap joint is where two or more pieces of material are overlayed and joined together. An aircraft fuselage is designed from sheets of metal which are overlapped and then held together with rivets; the line of rivets that you can see on the exterior are the lap joints. These rivetted ‘seams’ are the lap joints and they are known to be a structural weak point when it comes to pressurised aircraft. In 2004, there was a media exposé of this ‘big new problem for Boeing’ and the issue hit the news asgain in 2013 when Southwest Flight 812 lost a panel at 34,000 feet but actually, this was nothing new: the aviation industry actually became devastatingly aware of the problem in 1998 when it became clear how this had happened to Aloha Airlines flight 243. Now industry practices and testing means that there are rare cases which might slip through the net. At Aloha Airlines in 1988, it became clear that it was simply a matter of time until the first fuselage ripped open.

The Boeing 737 was designed for a service life of 20 years with 51,000 flight hours and 75,000 cycles. According to Boeing’s ‘fail-safe design’, the fuselage could suffer a 40-inch crack without suffering catastrophic failure. This was based on damage to the skin from external damage, such as projectiles from an uncontained engine failure – exactly the scenario of Southwest Airlines Flight 1380, the Boeing 737-700 in which the debris from the engine, effectively shrapnel, caused a rapid decompression in the cabin. A key point in this case, however, is that the window was the point of failure, not the fuselage.

The fuselage design includes ‘tear straps’ running around the fuselage skin (both longitudinal and circumferential) which redirect running cracks from external damage to a new direction, perpendicular to the crack. This redirections cause the fuselage skin to ‘flap open’ and release the internal pressure in a controlled manner.

In 1967, Boeing determined that the fuselage would withstand damage up to a 40-inch crack but that was of course with a ‘normal’ aircraft taking sudden damage. Boeing used ‘guillotine tests’ to demonstrate how the fuselage would fail safely: two side-by-side 15-inch blades penetrated the fuselage which produced an instant separation of the skin. The separation redirected itself as circumferentially, produced a flap and resulted in a controlled decompression, exactly as planned.

However at the time, the cumulative effect of adjacent cracks developing over time were not properly understood, and the result was completely different than the sudden sharp impact of a projectile.

The redirection of a fuselage crack depends on the integrity of the structure ahead of the track tip. On the accident flight, the skin tore but the area around it didn’t ‘stiffen’ as expected because it was also subject to cracks and deformed rivets. Under the stress of the initial tear, the tiny fatigue cracks linked up. Instead of a controlled loss of pressure, the aircraft suffered an explosive decompression as the hull was ripped off.

That’s not to say that there were no concerns with aging aircraft at the time. Boeing had established an Aging Fleet Program specifically to keep an eye on the changes of aircraft as they reached the end of their design life and to support operators in maintenance and repairs to keep their older aircraft safe. Lap joints showing fatigue cracking was initially reported in 1984, four years before the accident. In retrospect, it’s not surprising that this was first reported by Aloha Airlines.

Aloha Airlines was a part of Boeing’s Aging Fleet Program and was visited by the Boeing team for inspection of their highest flight/cycle time aircraft. N73713, the accident aircraft, was one of those surveyed. At the time, it was 19 years old and had 35,496 flight hours and 89,690 cycles, which was the second highest number of cycles in the worldwide Boeing 737 fleet. Now to be fair, Boeing personnel reported concern about the corrosion and skin patches they’d found on that aircraft specifically and on at least one other. They recommended that Aloha take their current 737 fleet, several of which had exceeded 75% of the 737’s design life, and totally strip and upgrade the structures, which would mean the aircraft being out of service for a month or two. Aloha Airlines hired a bunch of new staff to deal with keeping their fleet safe, including a Staff Vice President of Quality Assurance and Engineering, a Director of Quality Assurance and a Chief Inspector. But what they didn’t do was prioritise stripping and upgrading the 737s as a matter of urgency. After all, their 737’s flew short distances and at lower altitude. The flight hours were nowhere near maximum and, although the cycles were high, the short flights often did not reach the maximum pressure differential, so the number of full pressurization cycles were considered to be significantly fewer than the 75,000 the aircraft should be able to handle.

Aloha Airlines also pointed out that they were assured by Boeing personnel that the aircraft were still safe to operate. In fact, Boeing’s report with the recommendations were presented six months after the initial visits, clearly not giving the impression that they were urgent. Aloha Airlines felt confident that their aircraft were not suffering the same wear-and-tear as that of other operators and that there was plenty of time to get them upgraded.

We now know that this was utterly wrong. The stress on their fuselage was not the altitude or the pressure but the cycles. An aircraft has three parameters: physical age, actual flight time, and how many times it has taken off and landed: cycles. Although the aircraft wasn’t reaching full pressure differential, the repeated pressurisation and depressurisation of the aircraft was causing high stress on the fuselage, much more so than the actual hours in flight. Also, Aloha Airline’s fleet flew exclusively around small Pacific islands, a humid climate and surrounded by salt water. The Hawaiian environment was much more corrosive than for the ‘average’ aircraft. So at nineteen years old, the aircraft had suffered higher than normal levels of metal fatigue.

Currently, all Boeing 737s with over 50,000 cycles must have their lap joints reinforced with external doublers. But at the time, it was not at all obvious that Aloha Airlines were leading the way for research into the metal fatigue characteristics of an aging Boeing 737. Only after this accident did it become clear that this was an accident just waiting to happen.

On top of this, Aloha Airline’s maintenance procecdures were found to be faulty, ranging from badly trained staff to visual inspections being done at night. D-checks were started after an eight year interval and done in stages, so more than eight years had elapsed by the time the checks were finished, whereas Boeing stated D-checks must be completed every 6-8 years. This and other policies allowed a high number of flight cycles between structural inspections, allowing the corrosion and fatigue to accumulate.

And then there was the equipment. According to the Boeing manual, the eddy current inspections done at Aloha Airlines’ maintenance facility was supposed to find cracks that were 0.04 inches or longer (that is, 1.016 millimetres). But in fact, the Boeing on-scene current eddy inpection done only identified cracks larger than 0.08 inches (2mm). As an example, where the post-crash inspection done on site had found only one crack, the NTSB laboratory found five cracks, all around 0.08 inches.

After the accident, inspectors conducted visual inspections of the rest of Aloha Airlines B-737 fleet. They discovered ‘considerable evidence of corrosion on the fuselage as well as swelling and bulging of the skin, pulled and popped rivets and blistering and flaking paint along lap joints of almost every aircraft. There just isn’t the space to get into the problems here but you can get all the dirt in this scan of the final report.

These things are all very worrying and a key question is where the FAA oversight of this operator was. However, the NTSB also concluded that if the maintenance program and procedures had been as expected, it might not have made a big difference: a high number of cracks and signs of corrosion would still not have been identified.

No matter how well organized a corrosion detection and crack detection program may be and no matter how dedicated and vigilant the work force, the inspection process is inherently suspectible to some error rate.

The root of the problem, then, was not aging fleets or faulty maintenance but that allowing the patching and inspection of ageing fleets was dangerous because the structural flaws accumulating were not easy to spot. Instead, operators needed to prioritise the removal and replacement of the stressed areas.

Another issue that the NTSB brought up was the training of aircraft maintenance technicians. FAA approved training, they pointed out, was full of required studies that were largely irrelvant to the tasks that the maintenance personnel actually needed to achieve. FAA regulations required students to understand wood airframes, airframe fabric repair and the application of paint and lacquer, none of which are relevant in modern aircraft. The UK and other countries required in-depth training for Non-Destructive Inspection and other technology relevant to modern aircraft. But this was not required for mechanics studying in the US, where the curriculum made no reference at all to computers or composite materials. In 1988, it was possible, even likely, that a mechanic would be trained in wooden airframes and fabric repair and then be assigned to inspect Boeing 737s with very little training and out-of-date tools.

But now I’m drifting away from the conclusions of the board.

Probable Cause:
The National Transportation Safety Board determines that the probable cause of this accident was the failure of the Aloha Airlines maintenance program to detect the presence of significant disbonding and fatigue damage which ultimately led to failure of the lap joint at S-10L and the separation of the fuselage upper lobe. Contributing to the accident were the failure of Aloha Airlines management to supervise properly its maintenance force; the failure of the FAA to evaluate properly the Aloha Airlines maintenance program and to assess the airline’s inspection and quality control deficiencies; the failure of the FAA to require Airworthiness Directive 87-21-08 inspection of all lap joints proposed by Boeing Alert Service Bulletin SB 737-53A1039; and, the lack of a complete terminating action (neither generated by Boeing nor required by the FAA) after the discovery of early production difficulties in the B-737 cold bond lap joint which resulted in low bond durability, corrosion, and premature fatigue cracking.

As a result of this accident, the FAA began the National Aging Aircraft Research Program, tightening inspection and maintenance requirements for high-use and high-cycle aircraft.

The aircraft, valued at 5 million US dollars, was dismantled on site and sold for parts and scrap.

There one more aspect to this one that I want to bring up: the NTSB’s final conclusion included one dissenting opinion.

While I concur with most of the majority’s findings, I disagree with the probable cause and certain conclusions. Industry’s best engineers reviewed the carrier’s records, knew of its high-cycle operations, and even inspected some of Aloha’s fleet. No one—not Boeing, Aloha nor the FAA principal maintenance inspectors—recognized or predicted the critical nature of the multi-site cracking or that the aircraft hull was about to rupture. If a “failure” occurred, it was a system failure.

He felt the probable cause of should have been much simpler, for example “the presence of undetected disbonding and fatigue cracking,” with the systems and programs at Aloha, the FAA and Boeing as contributing factors.

I found this particularly interesting because I’d noticed that the concluding section of the report seemed a bit heavy handed when it came to spreading blame. The dissenter’s summary sounds much more like modern NTSB conclusions. So perhaps this report and the dissenting opinion also had an influence on aviation’s just culture for the results of aviation investigations.

You can read a scanned copy of the full accident report here.