Engineering Alloys (307) Lecture 8 Case Study 2: Sioux City

1. Engineering Alloys (307) Lecture 8Case Study 2: Sioux City © Imperial College London

2. Why Case Studies? © Imperial College London • MSE307 is about how alloys are designed and used, as well as (less important) a survey of alloy systems • How engineering systems fail has a large influence on the alloy design and certification process • i.e. We always fight the last war! • Aim to • Make you think about how a failure investigation is run • Make you realise that a production error, undetected at the time, may result in court appearances by the supervising managers (you) later! • Illustrate that systems fail as systems, and that usually no one part is to blame (so everybody is to blame)

3. How will these Aims be Assessed? © Imperial College London • May be a question on its own, asking you to discuss ONE of the cases that you know of (incl. further study), or • May be part of a connected technical question, e.g. • defect acceptance limits • defect types • lifing philosophy • predicted defect growth rates • Will ask you to give the direct materials failure AND outline the fault sequence • MAY ask you to discuss the indirect causes • MAY ask you to discuss WHY the failure occurred (who do you think was to blame?) • MAY ask you to discuss what might be done differently • MAY ask you what is meant by a ‘Safety Culture’ and compare that to a risk-taking or innovation culture

4. UA232 a.k.a. The Sioux City Disaster © Imperial College London

5. What Happened? © Imperial College London • A Ti fan rotor disc failure • Debris disabled all 3 hydraulic flight control acutation systems • Crew could not effect a controlled landing • 111/296 persons aboard died when the airplane broke up on landing

6. Fault Sequence © Imperial College London • UA232 was a DC-10 delivered in 1971 that was 26 years old with an airframe life of 43,000 hrs and 17,000 flight cycles • The flight was from Denver, CO to Philadelphia, PA • ~1hr into flight at 15:16, the tail-mounted engine failed with a loud bang. Hydraulic power was lost, and could not be restored using backup systems. Airplane roll could be corrected via wing engine power settings • Crew elected to land at Sioux Gateway Airport, closer than Des Moines Int’l. Sioux City Category B, rather than Category D at Des Moines – not rated for DC10, only smaller 727 / 737 etc. Fire cover provided by Air Nat’l Guard. • Crew concerned about (i) structural stability of airframe, (ii) ability to land plane. Difficulty in controlling speed, heading and rate of descent simultaneously.

7. Aircraft ground track © Imperial College London

8. Fault Sequence (2) © Imperial College London • At ~15:42, dumped remaining fuel down to reserve levels • Landed on (disused) runway 22, 6,600 ft long, rather than runway 31, 9,000 ft long. Crew wanted to avoid a go-around, and happened to align on runway 22. • Landed at 16:00, left of the centerline on runway 22. Contact by right wing tip, right engine nacelle, right main landing gear. • Airplane skidded, rolled and broke up. Debris scattered over an approx 1mi. long track. • Fire crews attended, ran out of retardant, but provided blanket cover for many passenger to escape. Failure of the reserve tender’s resupply hose led to a ~10min gap in the application of foam, due to rotation of a 50¢ plastic stiffener. This meant it took a further few hours to control the fire, but probably resulted in only a few more deaths.

9. Debris Track © Imperial College London

10. Seat Map © Imperial College London

11. Might the Crew have been expected to be able to land safely? © Imperial College London • Simulator tests with experienced DC-10 pilots, trainers and test pilots concluded that effecting a landing with 2 engines and no control surfaces was not trainable • Crew experience was significant • Although landed at ~1500 ft/min rate-of-descent and 200+ kts IAS, very little they could have done

12. Should a bigger airport have been tried? © Imperial College London • With hindsight, the airframe was probably OK to fly for some time • could have vectored to a bigger airport, • assessed the condition of the plane better, and • prepared emergency crews more fully • Stresses the importance of snap decisions by aircraft crew, Air Traffic Control and United Ops center

13. Should the fire crews have extinguished the fire? © Imperial College London • Used more retardant than were required to have on hand • Bigger incident than would have trained for • Had never tested tender resupply hose in operation • Once the plane is on the ground, in pieces and burning, these are trivial, besides-the-point issues

14. Should the disc failure have been ‘safe’? © Imperial College London • Much comment at the time that the airplane design was deficient • In this case, triple redundancy in the hydraulics did not resolve the problem – all 3 failed due to turbine debris striking the rear left horizontal stabiliser

15. No: Failure should never have occurred © Imperial College London • Rotating parts should not fail: review reveals that airplane loss occurs ~25% of the time after a disc failure • GEAE expected life for a defect-free disc was 54k cycles, FAA rated to 1/3rd of that: 18k cycles • Energy contained in a disc (170kg at ~40,000 rpm?) is so large that the fragments are uncontainable • Alloy Ti-6Al-4V: very well established and widely used • So what happened?

16. History of #2 Engine and Stage 1 Disc © Imperial College London • Engine #2, a GEAE CF6 SN 451-243 had 42.4k hours total time • The stage 1 disk, SN MPO 00385 manufactured at GEAE 3-Sep to Dec-11 1971. Accumulated 41.0k hrs / 15.5k cycles (originally installed in another engine). • Inspected 6 times during routine overhauls, most recently at 38.8k hrs / 14.7k cycles (not required at all for disc until 14k cycles).

17. Disc GA © Imperial College London

18. Disc Reconstruction © Imperial College London Disc reconstructed from pieces found in fields near the initial in-air failure, and from crash site

19. Fractography © Imperial College London

20. Fracture Mechanics of the Failure © Imperial College London • NTSB could count the striations on the crack and match to the number of cycles: defect had existed since new • Crack grew in-line with GEAE fracture mechanics calculations • At last inspection, crack was 0.5in long and 0.05in across in the forward bore area • Dye penetrant fluid residue was found on the crack surface • Why was it not found by the inspector? • working alone • piecework – appropriate for a critical job? • difficult inspection location / procedure • low awareness of potential cracking issue at bore, focus was on blade root cracking (but blade release is containable)

21. So where did the crack come from? © Imperial College London • Microstructure of region ‘C’ a nitrogen-stabilised hard-alpha inclusion, approximately 1mm in diameter • Should have been found in the manufacturing process, one would think? • disc ultrasonically inspected and macroetched in Rough Machined Form (RMF), before final finishing. Not subsequently etched. -> defect missed. • NTSB concluded that hard alpha inclusion was knocked out during final shot peening.

22. Heat Tracking © Imperial College London • GE had records for 2 discs with SN MPO 00385 • Inspection of 6 of the 7 sister discs from the same forging by Alcoa, Timet heat K8283, resulted in 3 with rejectable defects, 2 alpha case and one overheating during forging • Confusion as to whether Timet or RMI heat • Possibility that the set of 8 discs from heat K8283 actually came from two heats • RMI heat Ar-melted, Timet Vacuum-melted (Ar melting withdrawn in late 1971). • (not in report) Some inspectors convinced that discs were swapped between the two heats on Alcoa’s factory floor

23. Implications for Manufacturing © Imperial College London • Switchover to Skull melting / hearth melting process (80s) • Mandate vacuum triple melting (1972) • specify no remelted material in critical rotating components • COST • major stumbling block to use of Ti

24. Implications for Lifing Philosophy © Imperial College London • NTSB suggested moving to a damage tolerance philosophy, e.g. assume a defect present, then retire for cause based on inspection • Advantage: • avoids arbitrary 1/3rd life retirement of >90% of components: $$$ • Disadvantage: • requires the inspectors to catch every flaw, which they didn’t in this case • At present: continue to assume no flaws, ramp cost by continuous improvement in quality of manufacture -> space shuttle approach

25. Future Directions – Damage Aware Materials © Imperial College London • Another approach is to use a material that will tell you about its flaws, on the flight line • e.g. incorporate conducting wires into composites, detect breaks • then can retire only for cause, and catch every defect!

26. Conclusions - 1 © Imperial College London • UA232 was lost due to the failure of a Ti-6Al-4V stage one fan disc in flight that lead to the loss of the hydraulic control systems and made lading the aircraft impossible • UA failed to detect the flaw • GEAE failed to track their components properly • Alcoa may have swapped remelt / non-remelt and vacuum / Ar remelt material on their factory floor • Douglas failed to design a hydaulics system that was damage tolerant • The flight crew could have selected a better crash location • The fire crews suffered from equipment failure • -> Everybody was at fault in some way

27. Conclusions - 2 © Imperial College London • Records matter! • Materials tracking matters! • Processing matters! • Lifing philosophy is a diffcult issue! • What you do on a factory floor as a 20-something can bite you 27 years later when you are divisional director! • Failure investigations involve a huge CYA operation on all sides, making the inspectors’ lives hard • Metallurgists, fatigue prediction, process design and QA procedures all become critical in an investigation

28. r dr 5nm g’ Review: Nickel Superalloys II (L5-6) © Imperial College London Ordering Coarsening & Strength Manufacture Theory of Cast Ni Superalloys