In the early 2000s, I had the distinct pleasure of working with several long time Cessna engineers who had started their careers in the mid-1960s. I worked with two of them in the structures group who had experienced the massive expansion of general aviation in the 1960s and 70s. It was always enjoyable to hear the Cessna stories and learn the aviation culture of the past. One of the most significant differences between early aviation and today is the mere fact that nobody ever thought airplanes would remain in service for so long. Our longtime Cessna engineers reminisced about starting their new jobs in the 1960s when airplanes were sold by model year. Cessna airplanes were updated every year with model year design changes just like cars. The sales volume was so high during that era that airplanes weren’t considered any different than cars. At the time there was a belief that customers would get tired of their old airplanes, trade them up, and soon those old model years would be out of service. It was inconceivable that any airframe would accumulate more than a few thousand hours and there was no concept of an airframe life limit. I’m sure if anyone at that time thought that Model 172 serial number 1 would still be around in 2006 for the AOPA 50th anniversary celebration, they would get laughed out of the cigarette smoke-filled break area. Now that a half a century has passed, we’ve learned a lot about aging airplanes. It all started with a company called Dan Air in 1977.
Dan Air Crash, 1977
On May 14, 1977, a Boeing 707 operated by Dan Air Services Ltd. crashed short of the runway at Lusaka International Airport. The airplane crashed due to an in flight separation of the right hand horizontal stabilizer and elevator as a result of metal fatigue. Airplanes were certified either safe-life or failsafe at that time. A failsafe design is one that has one or more redundant structural elements which are capable of carrying the flight loads in the event of a failure of one of the primary load members. A safe-life design is one that has an established life limit based on fatigue testing. The Boeing 707 was certified failsafe, and the Model 707-300 flown by Dan Air did not undergo a fatigue test program. Boeing performed an extensive structural fatigue test on the Model 707-100 which was an earlier variant of the Model 707-300. Without diving too far into the details of the design history, it was thought that a new fatigue test wasn’t necessary for the Model 707-300 and the regulations didn’t require it for failsafe designs. The Model 707-300 was designed failsafe and therefore met the regulatory requirements.
Part 25, Amendment 45
The Dan Air crash showed that total reliance on the failsafe design approach may not meet the intended minimum level of safety. The crash illustrated shortcomings in failsafe analysis assumptions and associated inspections. In order to prevent these shortcomings, damage tolerance was introduced into Part 25 at Amendment 45 on December 1, 1978. While the new rule was beneficial to the safety of new designs, there wasn’t any guidance regarding aging airplanes certified prior to Part 25 Amendment 45.
AC 91-56, 1981
On May 6, 1981 AC 91-56 was published which created the expectation that manufacturers develop a SSIP (Supplemental Structural Inspection Program) which is contained in a SID (Supplemental Inspection Document) for their aging airplanes. The guidance of AC 91-56 was originally intended for large transport airplanes which were certified prior to Part 25 Amendment 45. FAA mandated SSIPs through ADs on 11 different transport category models. With the introduction of damage tolerance for new designs and SSIPs for aging airplanes, it seemed the shortcomings of the past requirements had been fixed. However, in 1988 the Aloha accident happened.
On April 28, 1988 a Boeing 737-200 operated by Aloha Airlines experienced an explosive decompression and structural failure of the upper forward portion of the cabin. The Boeing Model 737 was certified in 1967 which was prior to Part 25 Amendment 45. Just like the Dan Air Boeing 707, the 737 was certified failsafe. However, Boeing did have a published SSIP which was being used to inspect a fleet of high time 737s which included the Aloha airlines airplane. Boeing’s approach for the 737 SSIP was to reassess the airplanes using the new damage tolerance approach which was in the Part 25 Amendment 45 rule. During the program formulation, a structural classification system was created to determine which inspections should be included in the SSIP. One of the classifications that was excluded from the directed inspections was that of “damage obvious or malfunction evident”. Fuselage minimum gauge skin that fails by controlled decompression and flapping was considered “obvious”. All of the failsafe testing that Boeing had done up to this point showed that controlled decompression and flapping was the failure mode of the fuselage. That failure mode turned out not to be representative of the Aloha failure since the failure was explosive and uncontrolled.
Aging Aircraft Safety Act, 1991
Prior to the Aloha accident, the FAA was utilizing guidance from AC 91-56 coupled with AD action on specific model airplanes to handle aging aircraft issues. Since that approach didn’t appear to meet the intended level of safety for Part 121 transport operations (based on Aloha), congress passed the Aging Aircraft Safety Act (AASA) on April 23rd, 1991. The AASA directed the FAA administrator to establish aircraft maintenance safety programs and it directed air carriers to demonstrate that maintenance of aircraft structure is adequate to ensure the highest degree of safety. Now that FAA had a congressional mandate to meet those safety objectives, FAA went into rule making with the Aging Aircraft Safety Rule. Note that all of the regulatory focus was on transport operations at this point. Part 23 was not yet subject to rule making, but we will get to that shortly.
AC 91-56A, 1998
On April 29, 1998 the FAA published a revision to AC 91-56. The guidance provided in this AC was still applicable to large transport airplanes certified under the failsafe and fatigue requirements of Part 25 prior to Amendment 45. An evaluation for Widespread Fatigue Damage (WFD) was added at this revision. Widespread fatigue damage is characterized by simultaneous presence of cracks at multiple structural details that are of sufficient size and density such that the structure will no longer meet damage tolerance requirements and could catastrophically fail. Consider that uniformly loaded structure may develop cracks in adjacent fasteners or in adjacent similar structural details. These cracks can interact and reduce the damage tolerance of the structure in a manner that may not be readily detectable. While AC 91-56A only applied to airplanes certified prior to Amendment 45, the requirement for a WFD evaluation was eventually written into Part 25 at Amendment 132.
Repair Assessment for Pressurized Fuselages, 2000
FAA started working on the Aging Aircraft Safety Rule (AASR) immediately after the congressional mandate of the AASA, but it still took a number of years to reach a final rule. There were two NPRMs (1993 and 1998), the interim final rule (2002), and the final rule (2005). After the 1998 NPRM of the AASR, the FAA moved forward with a rulemaking proposal which would require operators of the 11 airplanes with FAA mandated SSIPs (through previous ADs) to incorporate repair assessment guidelines for the fuselage pressure boundary into their FAA approved maintenance programs. The final rule was published on April 25, 2000. In the final rule, FAA sited the structural issues regarding the Aloha accident as the justification for rulemaking. While not cited in the final rule preamble, it seems likely that the crash of a Japan Air Lines Boeing 747 in 1985 due to an improperly repaired aft pressure bulkhead had significant influence on this rule making. Even though the FAA previously mandated SSIPs through ADs on 11 different transport category models, any repairs done on those airplanes are not covered by those SSIPs. Since the AASR was not published as a final rule yet, this rule change was intended to provide the same level of assurance as the original SSIPs for areas of the structure that have been repaired on those 11 airplanes.
Aging Aircraft Safety Rule, 2005
As we discussed earlier, after two NPRMs, an interim final rule and then a final rule, the AASR published on February 2, 2005. The AASR changed the operational requirements for Parts 121 and 129 and created a December 20th, 2010 deadline for implementing damage tolerance based inspections and procedures. It also included a requirement for addressing the adverse effects that repairs and alterations may have on fatigue critical structure and on required inspections. These requirements were generally intended for passenger carrying transport operations, so the rules were limited to (1) a maximum type certificated passenger seating capacity of 30 or more; or (2) a maximum payload capacity of 7,500 pounds or more. Since these requirements were operational requirements, there still needed to be something in place to make sure the Design Approval Holders (DAHs) were generating the data necessary for the operators to meet these new requirements. On December 12, 2007, the FAA published Part 26, Continued Airworthiness and Safety Improvements for Transport Category Airplanes.
Part 26, 2007
Because of the AASR operational rule changes, operators are required to implement damage tolerance based inspections and procedures. They are also required to evaluate repairs and alterations. How does an operator accomplish such a task when the DAH is the only entity who holds the design data necessary to develop those inspections and procedures? It was clear that the DAH had to play a role in the process because operators didn’t necessarily have the capability to produce the necessary design data. FAA recognized this and Part 26 was created which required DAHs to make available to operators the damage tolerance data for repairs and alterations to fatigue critical airplane structure. It is still the responsibility of the operator to come up with a means to address the adverse effects of repairs and alterations; however, the DAH is required to develop the damage tolerance data which supports an operator’s means to comply. The FAA recommends in AC 120-93 that operators create an Operator Implementation Plan (OIP) which contains the means to comply, and data from the DAH is used to develop the OIP. Not only did operators have to address new repairs and alterations, the rule also required them to review existing repairs throughout the fleet.
We’ve been discussing airline transport design and operational history, but what about general aviation? After the Dan Air accident, the FAA recognized that not only did transport operations need to be addressed, but general aviation also needed guidance. AC 91-60 was published as a follow-on companion to AC 91-56.
AC 91-60, 1983
We discussed earlier how the FAA published AC 91-56 on May 6, 1981, three years after the Dan Air accident in 1978. The guidance of AC 91-56 was originally intended for large transport airplanes which were certified prior to Part 25 Amendment 45. AC 91-56 was followed by AC 91-60 on June 13, 1983. AC 91-60 was intended for the development and use of continued airworthiness programs of older airplanes not covered under AC 91-56 (so in other words, it covered everything else). AC 91-60 essentially provided guidance and coverage for general aviation airplanes. It recommended that manufacturers develop “continued airworthiness programs”, and it also asked operators to remain diligent in following manufacturers recommendations, FAA Airworthiness Directives, and to consider how their operations might differ from what the manufacturer assumed. Note that AC 91-60 didn’t apply to any specific airplane models and was only a recommendation for manufacturers. The only way FAA can mandate a follow-on inspection program is through AD action.
Notable General Aviation Accidents
There have been some notable general aviation accidents leading up to the publication of the AASR in 2005.
- There were three Beechcraft T-34A Mentor crashes due to fatigue and subsequent wing separation. The first was on April 19, 1999, the second on November 19, 2003, and the third on December 7, 2004.
- On May 9, 2005, a North American SNJ-6 crashed due to fatigue failure of the forward lower attach flange at the inboard side of the right wing attach joint.
- On December 19, 2005, a Grumman Turbo Mallard (G-73T) amphibious airplane operated by Flying Boat, Inc. (Chalk’s Ocean Airways flight 101) crashed shortly after takeoff from the Miami Seaplane Base. The probable cause of this accident was the in-flight failure and separation of the right wing due to fatigue.
The both the SNJ-6 and the T-34A operations were being conducted under Part 91, so those accidents are not in the realm of passenger carrying service. However, Chalk’s Ocean Airways flight 101 is a little bit of an outlier in terms of general aviation. While operations were conducted under Part 121, because of the airplane size and date of its type certificate the airplane was not subject to the additional inspection requirements of 14 CFR 121.370a. “Supplemental Inspections” apply to transport-category, turbine-powered airplanes (except for those airplanes operating entirely within the state of Alaska) that were type certificated after January 1, 1958, and had a maximum passenger seating capacity of 30 or more or a maximum payload of 7,500 pounds. Even though the Chalk airplane was in Part 121 passenger service, it wasn’t being maintained like its larger airline counterparts.
General Aviation Operations
The term “general aviation” is a very broad definition which can cover many different kinds of airplanes being operated in different ways. Looking at the accidents, the SNJ-6 and the T-34A’s were subject to repeated high g loadings due to aerobatic operations. While the Chalk airplane was not doing aerobatic maneuvers, scheduled passenger service creates demands on the airframe that isn’t typical of private general aviation airplanes. Consider that it takes decades for the typical piston single engine airplane to accumulate over 5,000 hours, and twin turbine small and mid-size business jets rarely reach 20,000 hours in their lifetime. At the time of the Chalk accident, the Turbo Mallard had accumulated 31,226 hours. Even though I’m associating these airplane accidents with general aviation, these operations are not typical of the wider cross section of Part 91 private general aviation operations. There is wide variance in fatigue performance of general aviation airplanes due to such wide variance in operations.
Part 23 Damage Tolerance
Throughout the AASR rule making activity, these general aviation aging airplane issues weren’t being ignored. Since airplane accidents due to fatigue failures were significantly influenced by their operations not typical of the entire fleet of general aviation airplanes, policy changes were made but not to the same extent as Part 25 and Part 121. After the ASAA was signed into law on April 23rd, 1991, Part 23 amendment 45 was published on September 7, 1993. Part 23 amendment 45 brought damage tolerance into the rule; however, it was only mandatory for composite structure and still optional for metallic structure. This lasted for 3 years until Part 23 amendment 48 was published on March 11, 1996 which made damage tolerance mandatory for commuter category airplanes.
Part 23 Policy
Advisory Circular 23-13 was a new AC published on April 15, 1993 which was just a few months before Part 23 amendment 45. While the AC didn’t yet consider damage tolerance, it did emphasize inspection and detection of fatigue cracks in critical structure. It wasn’t until the AC was revised and published on September 29, 2005 (AC 23-13A) that it addressed damage tolerance for commuter category airplanes. It also clarified the use of the failsafe approach since history has shown that failsafe structure alone is not adequate without a proper inspection program. It probably wasn’t coincidence that the FAA released AC 23-13A a few months after the AASR published in early 2005. This completed the most recent policy update for 14 CFR Part 23 in regards to aging airplanes.
Post AASR Policy, 2008 and on
In 2008, FAA created another revision to AC 91-56 (revision B, March 7, 2008) and published AC 91-82 covering “Fatigue Management Programs for In-Service Issues” (April 29, 2008). AC 91-60 was cancelled by AC 91-82. A few years later FAA published a revision to AC 91-82 on August 23, 2011. AC 91-56B, AC 120-93 and AC 91-82A are the most current guidance available regarding fatigue management programs for both transport and general aviation operations. Here is a quick summary:
- Guidance for showing compliance with the applicable regulations in order to satisfy the AASR.
- Guidance is considered applicable to all airplane models large or small; therefore the term “Large Transport Category” was removed from the title of the AC.
- Damage tolerance SSIPs are required for all airplanes operated under subpart D of part 121 and 129.
- 30 passengers or more.
- Payload of 7,500 pounds or more.
- Guidance for developing and incorporating a means for addressing adverse effects that repairs or alterations might have on fatigue critical structure.
- Intended for operators of transport category airplanes who are complying with the requirements of the AASR.
- 30 passengers or more.
- Payload of 7,500 pounds or more.
- Guidance for developing and implementing a fatigue management program for metallic fatigue critical structure.
- An applicant must develop a fatigue management program as one method to address an unsafe condition when FAA determines an airplane has a demonstrated risk of catastrophic failure due to fatigue.
- Not mandatory unless there is a demonstrated risk of catastrophic fatigue.
- Applies to Part 23 certificated airplanes, Part 25 certificated airplanes not covered under AC 91-56B or AC 120-93, and airplanes certificated in the primary and restricted categories.
It’s been over 10 years since the FAA completed the major milestones of policy creation for fatigue management programs. As industry and regulators gain experience with airplane design and maintenance, it’s apparent that much more is known about fatigue and damage tolerance than a few decades ago. Inspections are key to FAA safety initiatives, and those inspections are tied to structural assessments which creates a high level of safety. In the case of airplane operations that fall outside of the mandatory SSIPs, FAA encourages manufacturers and operators work together to participate and develop fatigue management programs based on fatigue assessment rather than demonstrated risk.
Joel Heck has been with Cessna, now Textron Aviation, for 24 years in engineering. His entire career has been focused on the design approval aspects of FAA certification, and his technical work experience in certification spans the Cessna, Beechcraft, and McCauley product lines.