Damage Tolerance

Damage Tolerance


Damage tolerance, or safety by inspection, was developed as a design philosophy in the 1970s as an improvement on the fail-safe principle for structural deterioration.

The damage tolerance approach is based on the principle that while cracks due to fatigue and corrosion will develop in the aircraft structure, the process can be understood and controlled. A key element is the development of a comprehensive programme of inspections to detect cracks before they can affect flight safety. That is, damage tolerant structures are designed to sustain cracks without catastrophic failure until the damage is detected in scheduled inspections and the damaged part is repaired or replaced.

Unfortunately, history shows that it is an imperfect solution in practice.

Accidents and Incidents

The following events included Damage Tolerance as a contributory factor:

On 12 July 2013 an unoccupied and unpowered Boeing 787-8, remotely parked at London Heathrow after an arrival earlier the same day caught fire. An investigation found that the source of the fire was an uncontained thermal runaway in the lithium-metal battery within an Emergency Locator Transmitter (ELT). Fifteen Safety Recommendations, all but one to the FAA, were made as a result of the Investigation.

On 7 January 2013, a battery fire on a Japan Air Lines Boeing 787-8 began almost immediately after passengers and crew had left the aircraft after its arrival at Boston on a scheduled passenger flight from Tokyo Narita. The primary structure of the aircraft was undamaged. Investigation found that an internal short circuit within a cell of the APU lithium-ion battery had led to uncontained thermal runaway in the battery leading to the release of smoke and fire. The origin of the malfunction was attributed to system design deficiency and the failure of the type certification process to detect this.

On 26 September 2011, a Boeing 757-200 being operated by United Airlines on a scheduled passenger flight from Chicago to Denver experienced a left engine bird strike during deceleration after landing on runway 35R at destination in normal day visibility. The affected engine ran down as the aircraft cleared the runway and was shut down after a report of smoke being emitted from it. The aircraft was stopped and the remaining engine also shut down prior to a tow to the assigned terminal gate for passenger disembarkation. None of the 185 occupants were injured but the affected engine was severely damaged and there was visible evidence that some debris from it had impacted the aircraft fuselage.

On 10 November 2013 the left engine of a Fairchild SA227 on final approach suddenly ceased to produce any power at approximately 500 feet whilst continuing to operate. The crew did not identify what had happened in time to avoid losing control of the aircraft which then impacted terrain, caught fire and was destroyed. The Investigation found that premature failure of engine components had caused the engine malfunction and noted that some pilots may believe that the Negative Torque Sensing (NTS) System provided for the engines on this aircraft type will always detect high drag conditions arising from power loss.

On 24 October 2011, the crew of a Ryanair Boeing 737-800 operating the first flight after an unexpectedly severe overnight storm found that after take off, an extremely large amount of rudder trim was required to fly ahead. Following an uneventful return to land, previously undetected damage to the rudder assembly was found which was attributed to the effects of the storm. It was found that pre flight checks required at the time could not have detected the damage and noted that the wind speeds which occurred were much higher than those anticipated by the applicable certification requirements.

On 2 July 2013, a Korean Air Lines Boeing 777-300 experienced an uncommanded in-flight shutdown of one of its GE90-115B engines while crossing the Bering Sea. The crew made an uneventful diversion to Anadyr Russia. The Korean Aviation and Railway Accident Investigation Board (ARAIB) delegated investigative duties of this event to the National Transportation Safety Board (NTSB) which identified the cause of the failure as a manufacturing process deficiency which could affect nearly 200 similar engines.

On 16 January 2013, a main battery failure alert message accompanied by a burning smell in the flight deck was annunciated as an ANA Boeing 787-8 climbed through FL320 on a domestic flight. A diversion was immediately initiated and an emergency declared. A landing at Takamatsu was made 20 minutes later and an emergency evacuation completed. The Investigation found that the battery had been destroyed when thermal runway followed a suspected internal short circuit in one of the battery cells and concluded that certification had underestimated the potential consequences of such a single cell failure.

On 3 July 2010, an AW139 helicopter was climbing through 350 feet over Victoria Harbour Hong Kong just after takeoff when the tail rotor detached. A transition to autorotation was accomplished and a controlled ditching followed. All occupants were rescued but some sustained minor injuries. The failure was attributed entirely to manufacturing defects but no corrective manufacturer or regulatory action was taken until two similar accidents had occurred in Qatar (non-fatal) and Brazil (fatal) the following year and two interim Safety Recommendations were issued from this Investigation after which a comprehensive review of the manufacturing process led to numerous changes.

On 27 July 2006, a Bombardier CRJ200 being operated by Air Nostrum on a scheduled passenger flight from Barcelona to Basel, Switzerland in night VMC, suffered a sudden left hand engine failure and an associated engine fire when passing FL235 some 14 minutes after take off. An air turn back was made with indications of engine fire continuing until just three minutes before landing. An evacuation using the right hand exits was ordered by the Captain as soon as the aircraft had come to a stop and had been promptly actioned with the RFFS in attendance. There were no injuries to the 48 occupants during the evacuation and the only damage was to the affected engine.

On 1 April 2009, the flight crew of a Bond Helicopters Eurocopter AS332 L2 Super Puma en route from the Miller Offshore Platform to Aberdeen at an altitude of 2000 feet lost control of their helicopter when a sudden and catastrophic failure of the main rotor gearbox occurred and, within less than 20 seconds, the hub with the main rotor blades attached separated from the helicopter causing it to fall into the sea at a high vertical speed The impact destroyed the helicopter and all 16 occupants were killed. Seventeen Safety Recommendations were made as a result of the investigation.

On 29 January 2010, a Pilatus PC-12/45 being operated on an aerial work basis on a Medevac flight from Derby to Kununurra Western Australia and climbing through FL180 in night VMC experienced signs of engine malfunction and initiated an air turnback during which the engine failed completely. The subsequent 6nm glide descent and approach culminated in a successful landing with the aircraft undamaged and all four occupants unhurt.

On 4 November 2010, a Qantas Airbus A380 climbing out of Singapore experienced a sudden and uncontained failure of one of its Rolls Royce Trent 900 engines which caused considerable collateral damage to the airframe and some of the aircraft systems. A PAN was declared and after appropriate crew responses including aircraft controllability checks, the aircraft returned to Singapore. The root cause of the failure was found to have been an undetected component manufacturing fault. The complex situation which resulted from the failure in flight was found to have exceeded the currently anticipated secondary damage from such an event.

On 22 December 2008, a Boeing 757-200 on a scheduled passenger flight departing Las Vegas for New York JFK experienced sudden failure of the right engine as take off thrust was set and the aircraft was stopped on the runway for fire services inspection. Fire service personnel observed a hole in the bottom of the right engine nacelle and saw a glow inside so they discharged a fire bottle into the nacelle through the open pressure relief doors. In the absence of any contrary indications, this action was considered to have extinguished any fire and the aircraft was then taxied back to the gate on the remaining serviceable engine for passenger disembarkation. None of the 263 occupants were injured but the affected engine suffered significant damage.

On 29 January 2008, a Bombardier BD700 Global Express on a private passenger flight from Van Nuys, California to Luton experienced a single tyre failure when landing at destination in normal day visibility which caused significant secondary damage to the flight control system and localised structural damage to the wing. The aircraft was stopped on the runway and there were no injuries to the four occupants.

On 6 March 2005, an Airbus A310-300 being operated by Canadian airline Air Transat on a passenger charter flight from Varadero Cuba to Quebec City was in the cruise in daylight VMC at FL350 seventeen minutes after departure and overhead the Florida Keys when the flight crew heard a loud bang and felt some vibration. The aircraft entered a Dutch roll which was eventually controlled in manual flight after a height excursion. During descent for a possible en route diversion, the intensity of the Dutch Roll lessened and then stopped and the crew decided to return to Varadero. It was found during landing there that rudder control inputs were not effective and after taxi in and shutdown at the designated parking position, it was discovered that the aircraft rudder was missing. One of the cabin crew sustained a minor back injury during the event but no others from the 271 occupants were injured.

Related Articles


SKYbrary Partners:

Safety knowledge contributed by: