- Email: [email protected]
Failures in military aircraft
Engineering Failure Analysis 12 (2005) 755–771 www.elsevier.com/locate/engfailanal
Failures in military aircraft Graham Clark Defence Science & Technology Organisation, 506 Lorimer street, Fishermans Bend, VIC 3207, Australia Received 12 July 2004; accepted 13 December 2004 Available online 31 March 2005
Abstract The severe operating conditions for components in military aircraft lead to a wide range of failure modes and introduce many factors which can influence those failures. As a result, the accident investigator or failure analyst may need to explore issues more widely than might be the case with systems operating in more benign or controlled environments. Complicating factors are the increasing age of military fleets, as a result of the rising cost of fleet replacement, increasing reluctance or inability of OEMs to provide impartial technical support, and the widespread use of materials and processes near their stress and environment limits, in an effort to achieve that last little bit of operational performance. DSTO provides failure analysis and accident investigation support to the Australian Defence Force (ADF) and has developed a strong capability as an impartial adviser on aviation failures, in part because of the absence of major manufacturer support, but also because of a long history of ADF self-reliance. This presentation provides a brief overview of military aviation accident investigation and failure analysis in Australia, and then uses two recent examples to illustrate a fundamental tenet of failure analysis i.e., ‘‘all damage must be explained’’. The examples also illustrate how a full investigation can be required, even in cases where operational factors appear to be the likely principal factors. The first example is drawn from an accident investigation into the collision of two ADF helicopters, which demanded one of the most technically challenging investigations DSTO has ever undertaken, and one in which ultimately, by developing new methods, it was possible to provide a remarkable level of certainty about the event. The aspect chosen as an example illustrates the approach adopted to resolve some apparently anomalous features in the wreckage. Resolution of these features drew heavily on an understanding developed over many years of the failure modes of carbon-fibre composite materials and components. The second example illustrates the growing emphasis on taking a ‘‘whole system’’ view, and relates to a serious incident in which fuel in a tank was ignited as a result of a wiring system failure. The investigation illustrates the problem of resolving failure sequences when a number of possible scenarios need to be assessed. In this case, earlier development, over a number of years, of a capability for assessment of wiring system failures paid off, when a very detailed investigation opened up a wide range of wiring system issues elsewhere in the fleet. Crown Copyright Ó 2005 Published by Elsevier Ltd. All rights reserved.
E-mail address: [email protected] 1350-6307/$ - see front matter. Crown Copyright Ó 2005 Published by Elsevier Ltd. All rights reserved. doi:10.1016/j.engfailanal.2004.12.010
756
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Keywords: Aircraft; Aviation; Failure analysis; Accident investigation
1. Introduction Public acceptability of aviation injuries is extremely low, and since aviation is inherently sensitive to failures, we rely heavily on design and manufacturing approaches which minimise the risk of losing an aircraft. However, things still go wrong, and forensic engineering – finding out why an event occurred – is a key part of maintaining aviation safety. For many years, fail-safe design, in which load path redundancy allows the aircraft structure to survive one failure long enough for it to be detected, has been the mainstay of civil aircraft design, and in view of the low rate of aircraft loss due to structural failure, this approach has been largely successful. In contrast, high-performance military aircraft rely for their performance on minimal weight design in which redundancy is more limited, and accept a somewhat higher risk of failure. Furthermore, military aircraft can operate under conditions which are more severe than their civil counterparts; examples include dust-laden environments, heavy and repeated exposure to salt water, and operation from rough airstrips, and it is therefore hardly surprising that forensic engineering is a critically important part of operating and maintaining military fleets. DSTO has provided scientific and engineering support to the Australian Defence Force (ADF) for over 60 years [1], and has developed a number of specialised capabilities which assist in performing this role. A few of these capabilities are described briefly in this paper, and are illustrated by reference to specific failures investigated. DSTO support also extends to investigation of military accidents, and several of the examples quoted involve such investigations. In recent years, two significant changes have started to affect the way this support is provided; the first is the increasing attention being given to the legal implications of the investigation. It is now quite common for legal proceedings to surround an accident – even in military service – and many of the parties in an accident are represented legally. Naturally, this has the potential to make witness statements more cautious, and to encourage support for explanations which, while technically unlikely, might be to the benefit of some individuals. The onus is now clearly upon the investigators to ensure that their findings are fully defensible, and as robust as possible. The second change is an increasing awareness of the role played by aircraft mechanical, electrical and hydraulic systems in contributing to aircraft losses, and of the potential for failures in these systems to lead to recurring incidents, increased maintenance costs or reduced aircraft availability. These systems therefore feature increasingly in forensic investigations, and demand a broadening of the capabilities of the investigators. 1.1. Some principles Over many years, a number of significant principles can be identified as underpinning the effectiveness of DSTOÕs forensic and accident investigations [2,3]. Apart from the obvious principles of independence, impartiality, evidence preservation and quality management, which would be expected of any highly competent investigation agency, the following observations are made: Continual evaluation of evidence is essential. The big picture is critical – the investigator is not simply providing scientific observations for further discussion elsewhere, but is expected to assess the implications, continually evaluating the detail against the big picture, as far as it is known, as the investigation progresses. Accordingly, mechanisms for encouraging a team approach, and extensive debate, are important.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
757
A jigsaw analogy has sometimes been used, with continual matching of the pieces in hand against those already placed. Openness to different views. Following the jigsaw analogy, a single new piece of evidence has the potential to upset some earlier suppositions, and investigations in which there is an unwillingness to shift point-ofview will usually fail. Anomalies and puzzles in the evidence are extremely important – they are telling us something, and if followed, will usually add significantly to the result. All damage must be explained! Anomalies left unresolved point to a problem with our view of the big picture, and until resolved, cast doubt on the whole interpretation. Conversely, arriving at a big picture in which all the anomalies or puzzles are seen to be resolved, will usually indicate a correct result. Do not rely on ‘‘experts’’. Original Equipment Manufacturers (OEMs) and aircraft operators often operate under financial, legal and practical constraints, and when things go wrong, have a vested interest in not having adverse findings. This may involve, for example, having information which is not released to the investigation, or offering ‘‘solutions’’ which, however credible, may divert attention towards other parties. Be wary of eyewitness accounts. It is remarkable how many factors – preconceptions, perceptual distortions, post-event discussion and rationalisation – influence witness perception and recollection. It is not unusual for some witness statements to clash significantly with solid physical evidence.
2. Examples of analysis methods Forensic engineering for aircraft components relies on a wide range of ‘‘traditional’’ metallurgical methods, including metallography, fractography, microscopy (light or electron-optical), micro-analysis, metrology, strength measurements, non-destructive examination. Some examples of the application of these methods to analysis of specific parts are shown in Figs. 1–7. Fig. 1 shows the assessment of filaments in
Fig. 1. (Left) Examples of filament failures in warning light globes, showing some of the characteristics of hot and cold (on and off) failures. The lower images show how melted globes may be cleaned and polished to allow veiwing of the internal structure. (Right) Attitude indicator from crashed aircraft; the markings on the ball can be used to derive the attitude at impact.
758
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 2. ‘‘Deep focus’’ method developed to allow rough fracture surfaces to be viewed conveniently; the method is based on automatically imaging the surface at different focal positions, and assembling the viewable image from the ‘‘in-focus’’ parts of these images.
Fig. 3. Fires caused by rapid burning in high-pressure oxygen system is often attributable to ignition caused by contaminant particles.
instrument panel globes to determine their on/off state at the time the globe is broken; the assessment can be made on macroscopic structure of the filament (tangled or ‘‘brittle’’) or microscopic assessment of the ends of the broken filament. In the situation where fire causes collapse of the glove envelope, the outer surface can be cleaned and polished to allow viewing of the filament condition. Fig. 1 also shows the use of small witness markings on attitude indicators to establish the orientation of the ball (and aircraft) at impact. Fig. 2 illustrates the result of the ‘‘Deep Focus’’ method [4] developed to allow rough fracture surfaces to be viewed in focus; the method is based on automatically imaging the surface at different focal positions, and then assembling one viewable image using only the ‘‘in-focus’’ parts of these images. Fig. 2 shows an area of fracture surface, and (lower) the same area after the ‘‘deep focus’’ method has been applied. Fig. 3 illustrates the consequences of ignition in high-pressure oxygen systems; such an ignition is usually so intense that it is perceived as an explosion – rapid burnthrough of metallic valve systems can occur, as shown, and the process can be caused by the impact of contaminant particles onto a metallic surface when
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
759
Fig. 4. A scene from the Graphic Replay Software used by DSTO to visualise the events in an accident.
Fig. 5. Damaged balls from an engine thrust bearing; note the severe damage to all of the balls except one.(shown in inset compared to adamaged ball).
valves are opened [5,6]. Fig. 4 shows a single frame of output from the graphic replay software developed at DSTO for visualising the events in an accident, based on data obtained from on-board recorders, or from a flight simulation.
760
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 6. Wreckage map of a helicopter accident, and (inset) the GPS system used to record and locate the components.
Fig. 7. Wreckage map showing overlay of wreckage locations, photograph of area, outline of specific areas on the ground, and the aircraft outline.
An example of the dangers of relying on OEM advice is shown in Fig. 5, in which badly damaged balls from an engine bearing were removed from service after the bearing failed—all, that is, except for one ball which is relatively undamaged – and exactly 1 mm smaller in diameter than the rest! The manufacturer explained this by claiming that the smaller ball had been machined down, as a sphere, in service! A more likely explanation would be that incorrect assembly with one ball of the wrong size, had led to the failure.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
761
In recent years, activities have been more widely supported by a range of electron microscopic methods, extensive finite element based structural analysis methods, impact dynamics analysis, fracture mechanics and computational fluid dynamics. Some additional methods, or refinements, in use at DSTO include the following. 2.1. Wreckage mapping Wreckage mapping at an accident site provides essential information about possible break-up sequences, as well as a framework into which the many individual component histories may be inserted. Traditional surveying methods take a long time, during which the investigation is stalled, vital evidence may be destroyed or lost, and the facility cannot be reopened. In addition, the survey usually covers only the largest pieces of wreckage, and hence is not comprehensive. To overcome this problem, DSTO developed a GPSbased wreckage mapping system [7] that has proved its worth many times in recent years; it uses Differential GPS to plot the position of components and features to within a few centimetres. The systemÕs main advantage, though, is that it is readily portable, and with addition of a PC and camera, a part may be identified, photographed, logged and have its position recorded within a few seconds. Fig. 6 illustrates the output from the system – in this case, a helicopter crash site was mapped in a few hours; note the ability to mark features like fire areas, individual blade strikes, and to log the type of wreckage or damage. The ability to locate hundreds of parts provides additional value to the investigation. Fig. 7 shows the use of the system to develop a wreckage map onto which can be overlaid a photograph of the area, areas of ground scar, and even the profile of the aircraft; in the example shown, it was possible to determine the angle of impact and the attitude of the aircraft by superimposing the outline of the aircraft on the ground wreckage map. 2.2. Quantitative fractography for crack growth analysis Fatigue cracking continues to be a significant source of component failures, and post-event analysis of fracture surfaces can yield essential information when markings on the surface are correlated with the load history of the component [8,9]. The crack growth rate in service can be determined, if enough is known of the loading history. Example. Fig. 8 shows a fracture surface from a failed wing spar which caused a loss of the aircraft [10]; the critical crack grew from a hole which had been poorly drilled, leaving sharp flute marks at the base of the hole – fatigue cracks grew from these sharp grooves. Detailed examination of the surface allowed correlation of the surface markings with significant loading events in the aircraftÕs history, and the growth curve shown in the main panel of Fig. 9 was derived, providing valuable information which could be related to the rest of the fleet. Of more generic importance, plotting log of crack size against service life, as shown in the inset of Fig. 9, often reveals a straight line, and this straight line behaviour [8], where the slope of the line is controlled by stress level and material, may be used to represent, and in some cases predict, the growth of cracks in service. 2.3. Composites failure analysis While metallic failure analysis has had many decades to develop, failures in composite materials are much more complex, and less well understood. Since these materials are now used widely in aerospace applications, and since adequate investigation of an event in which composites fail would not be complete unless the source of the composites damage is understood, DSTO and several other laboratories have been developing expertise in failures of the more widely used composite laminates. Example. To illustrate the benefit of this research, Fig. 10 shows the failure of four helicopter tail rotor blades, which have a carbon-fibre composite spar.
762
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 8. Fatigue fracture from a damaged hole in a wing spar; cracking initiated at flute marks at the base of the hole (marked).
Fig. 9. (Main) Crack growth in the failed wing spar, deduced by correlating fatigue surface markings with significant events in the known loading history of the aircraft. (Inset) Representation of crack growth from wing spars on a log (crack length) vs. Life plot, showing how exponential crack growth appears to represent the history of the spars, and how different stress conditions produce different slopes in the plot.
The background to the accident. Two helicopters collided during an exercise; both helicopters were destroyed in the collision, with substantial loss of life. One aircraft was reconstructed at DSTO, with extensive analysis of parts, to allow determination of the collision mechanics. The investigation succeeded in its main
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
763
Fig. 10. Tail rotor blades from helicopter, showing the mid-length separation.
aims of determining the location of the collision point, and the likely track of each aircraft, as well as the details of the collision. Extensive support was also provided on many other aspects of the accident. The investigation required development of several innovative approaches, including a way of analysing the wreckage distribution to establish the collision location, as well as producing some challenges in component failure analysis. One such analysis challenge arose when it was observed that the failure surface of the spar (shown in Fig. 11) was very flat, suggesting that the spar might have been cut by a main rotor blade from the other helicopter (No. 2) involved in the collision. The difficulty this posed was that (Fig. 12) for this to have happened, the main rotor disc of the helicopter No. 2 would have to be below that of the No. l, and that situation was inconsistent with other evidence (specifically damage to the main rotor blades, which showed that the Main rotor of No. 1 had struck the fuselage of No. 2). Hence resolution of this issue was critical in the investigation.
Fig. 11. Flat appearance of fracture surface of spar of tail rotor blade and macroscopic view of another spar.
764
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 12. The two possible scenarios for rotor meshing during the accident: Scenario 2 would allow cutting of the tail rotor blades by the main rotor of the other aircraft.
Fortunately, earlier research had shown that (Figs. 13 and 14) the failure mode of a unidirectional composite like this, in tension, leaves fibres of various lengths sticking out of the surface, while compression can lead to formation of a micro-buckled band in which each fibre suffers two bending failures, with associated markings on the ends of the fibres – this microbuckling then creates a failure which is very localised on one plane. Hence the failures of the spars are consistent with a bending failure of the spar, in which the neutral axis is displaced to reflect a small area of failure in tension (noting the high tensile strength of the composite), and a much larger (reflecting the lower strength in compression) apparently flat surface, which is actually compressive failure. Hence the failures in the spars were consistent with a crippling failure of the rotor blades when the tips impacted the ground (Fig. 15). As a result of clearing this issue, the investigation of the accident was able to continue, and to reach firm conclusions as to the sequence of the events in the collision. 2.4. Wiring systems failures Wiring system failures are quite common, and while most are contained effectively, there have been several major civil aircraft losses in recent years which are associated with wiring system fires. Overall, most of the wiring system incidents are associated with connectors or chafing, and where they result in open circuits,
Fig. 13. Microscopic view of the fractured blade, showing the bending fracture of individual fibres, and the presence of a ‘‘kink band’’ along the line of fracture.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
765
Fig. 14. Schematic of kink band formation in compression failure of composite.
Fig. 15. Schematic of separation and scattering of tail rotor blades on contact with the ground, illustrating the bending failure of each blade.
may have little significant effect. However, short circuits can occur in a variety of ways, and may result in fires under some conditions. Analysis of these failures, post-event, can be extremely difficult, since the wiring system may burn, and the fires which can accompany a crash will produce similar-looking damage to the many kilometres of wiring in the aircraft. Example. In a recent event in Australia, an F-111 aircraft returning to base suffered substantial damage when fuel vapour ignited in a fuel tank, as a result of a wiring system fault. The ignition caused structural damage to the fuel tank, allowing fuel to leave the tank, and if the circumstances of the incident had been different in any of several ways, the aircraft might have been lost. The investigation into this fault identified many features in the damaged loom, and then in other similar looms, which may have been involved in the incident, and finding the sequence of events became a challenging exercise which serves to illustrate some of the principles outlined earlier in the paper. The wiring consists (Fig. 16) of an (upper) 90° elbow which is captive to the bulkhead, and which directs the 115V 3-phase, return and earth wires downwards towards the pump. Fig. 17 shows a cross-section of the loom. The construction of the wire is (from the inside): conductor (silver-coated copper), followed by primary insulation (extruded PTFE), followed by layers of PTFE coated glass tape, followed by PTFE coated glass braid, followed by convoluted stainless steel conduit, single welded seam, followed by stainless steel braid – in fact, a highly-engineered electrical construction. The five leads of wiring are encapsulated in the stainless steel conduit with a silicon compound. The silicon compound was probably injected from the top of the elbow through a hole which was then sealed with thermoflex wool and a grub screw and welded over. The five wiring leads are not centred in the convoluted conduit, and are in contact with it at some locations. In the region near the observed ÔburnÕ, the wiring was
766
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 16. Photograph of the damaged booster pump loom showing the location of the Ôburn-throughÕ (arrowed) and close-up of that area, showing melting of the stainless steel braid, indicating a high temperature rupture. Significant internal damage to the wire conductors is apparent. The fibrous material is PTFE coated glass braid.
Fig. 17. Construction of the wiring loom.
close to that part of the conduit wall (the conduit was visible in the tracks of the wires through the silicon rubber). A burn hole through the two layers of stainless steel was visible near the point where the conductors entered the 90° bend (Fig. 16). X-ray examination (Fig. 18) and painstaking dissection of the failed region (Figs. 19 and 20) revealed three broad regions of internal damage, and several potential contributing factors, including arcing between the wires and either (i) a grub screw, which impinged on the insulation of one or more wires, or (ii) the tight entrance to the 90° elbow (Fig. 21). In similar looms, cracking was visible in the corrugations of the conduit, suggesting the possibility that crack edges had damaged the insulation on the power wires. All of these observations provided a wealth of information which was eventually going to have to be incorporated satisfactorily in the explanation. Several initial hypotheses were generated, based on the arc starting in each of the internally damaged regions. Further detailed examination was then used to try to eliminate or refine these hypotheses:
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
767
Fig. 18. DSTO X-ray of the damaged loom. The X-ray revealed three regions of wiring damage, one region in the elbow (arrow 1), one region around the collar (arrow 2) and the region associated with the blow-out (arrow 3). It also highlighted the presence of a grub screw (marked).
Fig. 19. Exposure of the convoluted conduit and removal of a segment of the elbow confirmed the existence of a region of electrical damage, in the region of the collar, arrow.
(a) Initial arcing in region 1 was possible as a result of close proximity of the wiring to the corrugations, but the initiator was not obvious; the possibility that a crack in the corrugations chafed the insulation, was rejected on the grounds that the crack ends would still be visible near the burn hole. In addition, the failed loom did not display the machining irregularities visible on some other components and which in some cases had led to cracking of the tubing. (b) Initial arcing in region 2 had no obvious cause. (c) Initial arcing in region 3 could have been initiated by the grubscrew, or by the sharp edges observed on the entry to the elbow. The key observations which assisted in developing a likely failure scenario were: (d) Observation of insulation damage on the wires in a location which had no damage-causing edges nearby.
768
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 20. Dissected and reconstructed loom, showing the burnthrough region (ringed), and the various regions in which conductors had been consumed.
Fig. 21. Close-up of the collar in a similar loom, showing (left) the close fit of the conductors in the collar, and (right) the same region, with wires pulled back, showing how the edge of the collar can damage the insulation on the conductors.
(e) Observation of other insulation-damaged regions in other looms – even those which had not been in service. (f) Observation of ‘‘birdcaging’’ of wires at the connectors (example from another loom shown in Fig. 22). These observations suggested that during construction of the loom, the wires were pushed well through the elbow (presumably to allow connector installation), leading to insulation damage. When the connector was pushed back, the damaged regions would then move back to another location. The next step was to look for evidence of such damage. Further examination led to: (g) Observation of damaged insulation remnants in locations consistent with the hypothesis. (h) Observation of a small amount of kinking (Fig. 23) on the end of wire C which would have been near the observed burnthrough.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
769
Fig. 22. X-ray showing damage to wires in an unused loom, confirming that push-back of the connectros, into the shell, during manufacture, causes damage.
Fig. 23. Damage to wire C near the burn hole; note the mechanical damage, suggesting that the wire was damaged in this region during manufacture, and supporting the proposed damage mechanism.
(j) Observation of a region of the elbow entry which had been manufactured with a sharp edge capable of causing insulation damage (Fig. 24). Hence, the likely explanation involved initial failure at region 1, but from damage caused when the wire had been pushed/pulled through the elbow (region 3) at manufacture, prior to being pushed back into location. Burnthrough occurred as a result of in-service flexing, and led to arcing back to the source, preferentially between the initial failure wire and the others, then between the wires and the elbow (grubscrew and
770
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 24. The raised lip of the collar region-the probable cause of damage in the failed loom.
entry region). A feature of this investigation was the need to explain all the features, and the need to be prepared to re-examine hypotheses continually as new evidence appeared. The examination led to a substantial program of examination of the looms in the fleet and in storage, to give assurance of continued system safety.
3. Conclusion The purpose of this paper was to illustrate the application of a range of scientific and technical approaches to the investigation of failures in military aircraft, and give examples which illustrate how detailed and comprehensive investigation can lead to a confident assessment of the events involved in the failure. A key requirement for successful investigation – one usually developed only through experience – is an appreciation of the value of anomalous observations in the course of the examination, and the way that resolution of these anomalies provides a framework for understanding the bigger picture surrounding the events.
Acknowledgements The author acknowledge the many individuals in DSTO, the ADF, and staff from Boeing Australia Ltd who made up the teams investigating the failures and accidents which are discussed, briefly, in this paper. Particular note should be made of the contributions of Noel Goldsmith, Simon Barter, Robert Pell and Nick Athiniotis to the examples quoted.
References [1] Kepert JL. Aircraft Accident Investigation at ARL, the First Fifty Years. Report GD37, Defence Science and Technology Organisation, Melbourne; Australia 1993. [2] Cox AF, Kepert JL, Clark G. In: Proceedings of the Australian aeronautical conference on accident and failure analysis: learning from experience. Melbourne: I.E.Aust; October 1989.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
771
[3] Clark G. In: Proceedings of the 1995 conference international society of air safety investigators on wreckage and component analysis, Seattle, WA; September 1995. [4] Goldsmith NT. Deep focus: a digital image processing technique ro produce improved focal depth in light microscopy. Image Anal Stereol 2000;19:163–7. [5] Barter SA, Hillen LW. Oxygen fires, materials compatibility and system contaminants. In: Stolftzfus JM, Benz FJ, Stradling JS, editors. Symposium on flammability and sensitivity of materials to oxygen-enriched atmospheres, fourth volume, ASTM STP 1040. Philadelphia: American Society for Testing and Materials; 1989. [6] Grubb JW. Case study of Royal Australian Air Force P3B Orion ground oxygen fire incident. In: Benning MA, editor. Flammability and sensitivity of materials to oxygen-enriched atmospheres, second volume, ASTM STP 910. Philadelphia: American Society for Testing and Materials; 1986. p. 171–9. [7] Barter SA, Clark G. Development of a GPS-based wreckage analysis system. In: Proc Conference ASASI Surfers Paradise; July 1999. [8] Goldsmith NT, Clark G. Analysis and interpretation of aircraft component defects using quantitative fractography. In: Strauss BM, Putatunda SK, editors. Quantitative methods in fractography, STP 1085. Philadelphia, USA: American Society for Testing and Materials; 1990. [9] Clark G, Goldsmith NT. Fractographic techniques for the assessment of aircraft component defects. In: Berkovits A, editor. Aeronautical fatigue in the electronic era. Warley, UK: EMAS; 1989. [10] Clark G, Jost GS, Young G. Recovery of the RAAF MB326H fleet; the tale of an aging trainer fleet. In: Poole P, Cook R, editors. Fatigue in new and ageing aircraft. Warley: EMAS; 1997.
Failures in military aircraft Graham Clark Defence Science & Technology Organisation, 506 Lorimer street, Fishermans Bend, VIC 3207, Australia Received 12 July 2004; accepted 13 December 2004 Available online 31 March 2005
Abstract The severe operating conditions for components in military aircraft lead to a wide range of failure modes and introduce many factors which can influence those failures. As a result, the accident investigator or failure analyst may need to explore issues more widely than might be the case with systems operating in more benign or controlled environments. Complicating factors are the increasing age of military fleets, as a result of the rising cost of fleet replacement, increasing reluctance or inability of OEMs to provide impartial technical support, and the widespread use of materials and processes near their stress and environment limits, in an effort to achieve that last little bit of operational performance. DSTO provides failure analysis and accident investigation support to the Australian Defence Force (ADF) and has developed a strong capability as an impartial adviser on aviation failures, in part because of the absence of major manufacturer support, but also because of a long history of ADF self-reliance. This presentation provides a brief overview of military aviation accident investigation and failure analysis in Australia, and then uses two recent examples to illustrate a fundamental tenet of failure analysis i.e., ‘‘all damage must be explained’’. The examples also illustrate how a full investigation can be required, even in cases where operational factors appear to be the likely principal factors. The first example is drawn from an accident investigation into the collision of two ADF helicopters, which demanded one of the most technically challenging investigations DSTO has ever undertaken, and one in which ultimately, by developing new methods, it was possible to provide a remarkable level of certainty about the event. The aspect chosen as an example illustrates the approach adopted to resolve some apparently anomalous features in the wreckage. Resolution of these features drew heavily on an understanding developed over many years of the failure modes of carbon-fibre composite materials and components. The second example illustrates the growing emphasis on taking a ‘‘whole system’’ view, and relates to a serious incident in which fuel in a tank was ignited as a result of a wiring system failure. The investigation illustrates the problem of resolving failure sequences when a number of possible scenarios need to be assessed. In this case, earlier development, over a number of years, of a capability for assessment of wiring system failures paid off, when a very detailed investigation opened up a wide range of wiring system issues elsewhere in the fleet. Crown Copyright Ó 2005 Published by Elsevier Ltd. All rights reserved.
E-mail address: [email protected] 1350-6307/$ - see front matter. Crown Copyright Ó 2005 Published by Elsevier Ltd. All rights reserved. doi:10.1016/j.engfailanal.2004.12.010
756
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Keywords: Aircraft; Aviation; Failure analysis; Accident investigation
1. Introduction Public acceptability of aviation injuries is extremely low, and since aviation is inherently sensitive to failures, we rely heavily on design and manufacturing approaches which minimise the risk of losing an aircraft. However, things still go wrong, and forensic engineering – finding out why an event occurred – is a key part of maintaining aviation safety. For many years, fail-safe design, in which load path redundancy allows the aircraft structure to survive one failure long enough for it to be detected, has been the mainstay of civil aircraft design, and in view of the low rate of aircraft loss due to structural failure, this approach has been largely successful. In contrast, high-performance military aircraft rely for their performance on minimal weight design in which redundancy is more limited, and accept a somewhat higher risk of failure. Furthermore, military aircraft can operate under conditions which are more severe than their civil counterparts; examples include dust-laden environments, heavy and repeated exposure to salt water, and operation from rough airstrips, and it is therefore hardly surprising that forensic engineering is a critically important part of operating and maintaining military fleets. DSTO has provided scientific and engineering support to the Australian Defence Force (ADF) for over 60 years [1], and has developed a number of specialised capabilities which assist in performing this role. A few of these capabilities are described briefly in this paper, and are illustrated by reference to specific failures investigated. DSTO support also extends to investigation of military accidents, and several of the examples quoted involve such investigations. In recent years, two significant changes have started to affect the way this support is provided; the first is the increasing attention being given to the legal implications of the investigation. It is now quite common for legal proceedings to surround an accident – even in military service – and many of the parties in an accident are represented legally. Naturally, this has the potential to make witness statements more cautious, and to encourage support for explanations which, while technically unlikely, might be to the benefit of some individuals. The onus is now clearly upon the investigators to ensure that their findings are fully defensible, and as robust as possible. The second change is an increasing awareness of the role played by aircraft mechanical, electrical and hydraulic systems in contributing to aircraft losses, and of the potential for failures in these systems to lead to recurring incidents, increased maintenance costs or reduced aircraft availability. These systems therefore feature increasingly in forensic investigations, and demand a broadening of the capabilities of the investigators. 1.1. Some principles Over many years, a number of significant principles can be identified as underpinning the effectiveness of DSTOÕs forensic and accident investigations [2,3]. Apart from the obvious principles of independence, impartiality, evidence preservation and quality management, which would be expected of any highly competent investigation agency, the following observations are made: Continual evaluation of evidence is essential. The big picture is critical – the investigator is not simply providing scientific observations for further discussion elsewhere, but is expected to assess the implications, continually evaluating the detail against the big picture, as far as it is known, as the investigation progresses. Accordingly, mechanisms for encouraging a team approach, and extensive debate, are important.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
757
A jigsaw analogy has sometimes been used, with continual matching of the pieces in hand against those already placed. Openness to different views. Following the jigsaw analogy, a single new piece of evidence has the potential to upset some earlier suppositions, and investigations in which there is an unwillingness to shift point-ofview will usually fail. Anomalies and puzzles in the evidence are extremely important – they are telling us something, and if followed, will usually add significantly to the result. All damage must be explained! Anomalies left unresolved point to a problem with our view of the big picture, and until resolved, cast doubt on the whole interpretation. Conversely, arriving at a big picture in which all the anomalies or puzzles are seen to be resolved, will usually indicate a correct result. Do not rely on ‘‘experts’’. Original Equipment Manufacturers (OEMs) and aircraft operators often operate under financial, legal and practical constraints, and when things go wrong, have a vested interest in not having adverse findings. This may involve, for example, having information which is not released to the investigation, or offering ‘‘solutions’’ which, however credible, may divert attention towards other parties. Be wary of eyewitness accounts. It is remarkable how many factors – preconceptions, perceptual distortions, post-event discussion and rationalisation – influence witness perception and recollection. It is not unusual for some witness statements to clash significantly with solid physical evidence.
2. Examples of analysis methods Forensic engineering for aircraft components relies on a wide range of ‘‘traditional’’ metallurgical methods, including metallography, fractography, microscopy (light or electron-optical), micro-analysis, metrology, strength measurements, non-destructive examination. Some examples of the application of these methods to analysis of specific parts are shown in Figs. 1–7. Fig. 1 shows the assessment of filaments in
Fig. 1. (Left) Examples of filament failures in warning light globes, showing some of the characteristics of hot and cold (on and off) failures. The lower images show how melted globes may be cleaned and polished to allow veiwing of the internal structure. (Right) Attitude indicator from crashed aircraft; the markings on the ball can be used to derive the attitude at impact.
758
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 2. ‘‘Deep focus’’ method developed to allow rough fracture surfaces to be viewed conveniently; the method is based on automatically imaging the surface at different focal positions, and assembling the viewable image from the ‘‘in-focus’’ parts of these images.
Fig. 3. Fires caused by rapid burning in high-pressure oxygen system is often attributable to ignition caused by contaminant particles.
instrument panel globes to determine their on/off state at the time the globe is broken; the assessment can be made on macroscopic structure of the filament (tangled or ‘‘brittle’’) or microscopic assessment of the ends of the broken filament. In the situation where fire causes collapse of the glove envelope, the outer surface can be cleaned and polished to allow viewing of the filament condition. Fig. 1 also shows the use of small witness markings on attitude indicators to establish the orientation of the ball (and aircraft) at impact. Fig. 2 illustrates the result of the ‘‘Deep Focus’’ method [4] developed to allow rough fracture surfaces to be viewed in focus; the method is based on automatically imaging the surface at different focal positions, and then assembling one viewable image using only the ‘‘in-focus’’ parts of these images. Fig. 2 shows an area of fracture surface, and (lower) the same area after the ‘‘deep focus’’ method has been applied. Fig. 3 illustrates the consequences of ignition in high-pressure oxygen systems; such an ignition is usually so intense that it is perceived as an explosion – rapid burnthrough of metallic valve systems can occur, as shown, and the process can be caused by the impact of contaminant particles onto a metallic surface when
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
759
Fig. 4. A scene from the Graphic Replay Software used by DSTO to visualise the events in an accident.
Fig. 5. Damaged balls from an engine thrust bearing; note the severe damage to all of the balls except one.(shown in inset compared to adamaged ball).
valves are opened [5,6]. Fig. 4 shows a single frame of output from the graphic replay software developed at DSTO for visualising the events in an accident, based on data obtained from on-board recorders, or from a flight simulation.
760
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 6. Wreckage map of a helicopter accident, and (inset) the GPS system used to record and locate the components.
Fig. 7. Wreckage map showing overlay of wreckage locations, photograph of area, outline of specific areas on the ground, and the aircraft outline.
An example of the dangers of relying on OEM advice is shown in Fig. 5, in which badly damaged balls from an engine bearing were removed from service after the bearing failed—all, that is, except for one ball which is relatively undamaged – and exactly 1 mm smaller in diameter than the rest! The manufacturer explained this by claiming that the smaller ball had been machined down, as a sphere, in service! A more likely explanation would be that incorrect assembly with one ball of the wrong size, had led to the failure.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
761
In recent years, activities have been more widely supported by a range of electron microscopic methods, extensive finite element based structural analysis methods, impact dynamics analysis, fracture mechanics and computational fluid dynamics. Some additional methods, or refinements, in use at DSTO include the following. 2.1. Wreckage mapping Wreckage mapping at an accident site provides essential information about possible break-up sequences, as well as a framework into which the many individual component histories may be inserted. Traditional surveying methods take a long time, during which the investigation is stalled, vital evidence may be destroyed or lost, and the facility cannot be reopened. In addition, the survey usually covers only the largest pieces of wreckage, and hence is not comprehensive. To overcome this problem, DSTO developed a GPSbased wreckage mapping system [7] that has proved its worth many times in recent years; it uses Differential GPS to plot the position of components and features to within a few centimetres. The systemÕs main advantage, though, is that it is readily portable, and with addition of a PC and camera, a part may be identified, photographed, logged and have its position recorded within a few seconds. Fig. 6 illustrates the output from the system – in this case, a helicopter crash site was mapped in a few hours; note the ability to mark features like fire areas, individual blade strikes, and to log the type of wreckage or damage. The ability to locate hundreds of parts provides additional value to the investigation. Fig. 7 shows the use of the system to develop a wreckage map onto which can be overlaid a photograph of the area, areas of ground scar, and even the profile of the aircraft; in the example shown, it was possible to determine the angle of impact and the attitude of the aircraft by superimposing the outline of the aircraft on the ground wreckage map. 2.2. Quantitative fractography for crack growth analysis Fatigue cracking continues to be a significant source of component failures, and post-event analysis of fracture surfaces can yield essential information when markings on the surface are correlated with the load history of the component [8,9]. The crack growth rate in service can be determined, if enough is known of the loading history. Example. Fig. 8 shows a fracture surface from a failed wing spar which caused a loss of the aircraft [10]; the critical crack grew from a hole which had been poorly drilled, leaving sharp flute marks at the base of the hole – fatigue cracks grew from these sharp grooves. Detailed examination of the surface allowed correlation of the surface markings with significant loading events in the aircraftÕs history, and the growth curve shown in the main panel of Fig. 9 was derived, providing valuable information which could be related to the rest of the fleet. Of more generic importance, plotting log of crack size against service life, as shown in the inset of Fig. 9, often reveals a straight line, and this straight line behaviour [8], where the slope of the line is controlled by stress level and material, may be used to represent, and in some cases predict, the growth of cracks in service. 2.3. Composites failure analysis While metallic failure analysis has had many decades to develop, failures in composite materials are much more complex, and less well understood. Since these materials are now used widely in aerospace applications, and since adequate investigation of an event in which composites fail would not be complete unless the source of the composites damage is understood, DSTO and several other laboratories have been developing expertise in failures of the more widely used composite laminates. Example. To illustrate the benefit of this research, Fig. 10 shows the failure of four helicopter tail rotor blades, which have a carbon-fibre composite spar.
762
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 8. Fatigue fracture from a damaged hole in a wing spar; cracking initiated at flute marks at the base of the hole (marked).
Fig. 9. (Main) Crack growth in the failed wing spar, deduced by correlating fatigue surface markings with significant events in the known loading history of the aircraft. (Inset) Representation of crack growth from wing spars on a log (crack length) vs. Life plot, showing how exponential crack growth appears to represent the history of the spars, and how different stress conditions produce different slopes in the plot.
The background to the accident. Two helicopters collided during an exercise; both helicopters were destroyed in the collision, with substantial loss of life. One aircraft was reconstructed at DSTO, with extensive analysis of parts, to allow determination of the collision mechanics. The investigation succeeded in its main
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
763
Fig. 10. Tail rotor blades from helicopter, showing the mid-length separation.
aims of determining the location of the collision point, and the likely track of each aircraft, as well as the details of the collision. Extensive support was also provided on many other aspects of the accident. The investigation required development of several innovative approaches, including a way of analysing the wreckage distribution to establish the collision location, as well as producing some challenges in component failure analysis. One such analysis challenge arose when it was observed that the failure surface of the spar (shown in Fig. 11) was very flat, suggesting that the spar might have been cut by a main rotor blade from the other helicopter (No. 2) involved in the collision. The difficulty this posed was that (Fig. 12) for this to have happened, the main rotor disc of the helicopter No. 2 would have to be below that of the No. l, and that situation was inconsistent with other evidence (specifically damage to the main rotor blades, which showed that the Main rotor of No. 1 had struck the fuselage of No. 2). Hence resolution of this issue was critical in the investigation.
Fig. 11. Flat appearance of fracture surface of spar of tail rotor blade and macroscopic view of another spar.
764
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 12. The two possible scenarios for rotor meshing during the accident: Scenario 2 would allow cutting of the tail rotor blades by the main rotor of the other aircraft.
Fortunately, earlier research had shown that (Figs. 13 and 14) the failure mode of a unidirectional composite like this, in tension, leaves fibres of various lengths sticking out of the surface, while compression can lead to formation of a micro-buckled band in which each fibre suffers two bending failures, with associated markings on the ends of the fibres – this microbuckling then creates a failure which is very localised on one plane. Hence the failures of the spars are consistent with a bending failure of the spar, in which the neutral axis is displaced to reflect a small area of failure in tension (noting the high tensile strength of the composite), and a much larger (reflecting the lower strength in compression) apparently flat surface, which is actually compressive failure. Hence the failures in the spars were consistent with a crippling failure of the rotor blades when the tips impacted the ground (Fig. 15). As a result of clearing this issue, the investigation of the accident was able to continue, and to reach firm conclusions as to the sequence of the events in the collision. 2.4. Wiring systems failures Wiring system failures are quite common, and while most are contained effectively, there have been several major civil aircraft losses in recent years which are associated with wiring system fires. Overall, most of the wiring system incidents are associated with connectors or chafing, and where they result in open circuits,
Fig. 13. Microscopic view of the fractured blade, showing the bending fracture of individual fibres, and the presence of a ‘‘kink band’’ along the line of fracture.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
765
Fig. 14. Schematic of kink band formation in compression failure of composite.
Fig. 15. Schematic of separation and scattering of tail rotor blades on contact with the ground, illustrating the bending failure of each blade.
may have little significant effect. However, short circuits can occur in a variety of ways, and may result in fires under some conditions. Analysis of these failures, post-event, can be extremely difficult, since the wiring system may burn, and the fires which can accompany a crash will produce similar-looking damage to the many kilometres of wiring in the aircraft. Example. In a recent event in Australia, an F-111 aircraft returning to base suffered substantial damage when fuel vapour ignited in a fuel tank, as a result of a wiring system fault. The ignition caused structural damage to the fuel tank, allowing fuel to leave the tank, and if the circumstances of the incident had been different in any of several ways, the aircraft might have been lost. The investigation into this fault identified many features in the damaged loom, and then in other similar looms, which may have been involved in the incident, and finding the sequence of events became a challenging exercise which serves to illustrate some of the principles outlined earlier in the paper. The wiring consists (Fig. 16) of an (upper) 90° elbow which is captive to the bulkhead, and which directs the 115V 3-phase, return and earth wires downwards towards the pump. Fig. 17 shows a cross-section of the loom. The construction of the wire is (from the inside): conductor (silver-coated copper), followed by primary insulation (extruded PTFE), followed by layers of PTFE coated glass tape, followed by PTFE coated glass braid, followed by convoluted stainless steel conduit, single welded seam, followed by stainless steel braid – in fact, a highly-engineered electrical construction. The five leads of wiring are encapsulated in the stainless steel conduit with a silicon compound. The silicon compound was probably injected from the top of the elbow through a hole which was then sealed with thermoflex wool and a grub screw and welded over. The five wiring leads are not centred in the convoluted conduit, and are in contact with it at some locations. In the region near the observed ÔburnÕ, the wiring was
766
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 16. Photograph of the damaged booster pump loom showing the location of the Ôburn-throughÕ (arrowed) and close-up of that area, showing melting of the stainless steel braid, indicating a high temperature rupture. Significant internal damage to the wire conductors is apparent. The fibrous material is PTFE coated glass braid.
Fig. 17. Construction of the wiring loom.
close to that part of the conduit wall (the conduit was visible in the tracks of the wires through the silicon rubber). A burn hole through the two layers of stainless steel was visible near the point where the conductors entered the 90° bend (Fig. 16). X-ray examination (Fig. 18) and painstaking dissection of the failed region (Figs. 19 and 20) revealed three broad regions of internal damage, and several potential contributing factors, including arcing between the wires and either (i) a grub screw, which impinged on the insulation of one or more wires, or (ii) the tight entrance to the 90° elbow (Fig. 21). In similar looms, cracking was visible in the corrugations of the conduit, suggesting the possibility that crack edges had damaged the insulation on the power wires. All of these observations provided a wealth of information which was eventually going to have to be incorporated satisfactorily in the explanation. Several initial hypotheses were generated, based on the arc starting in each of the internally damaged regions. Further detailed examination was then used to try to eliminate or refine these hypotheses:
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
767
Fig. 18. DSTO X-ray of the damaged loom. The X-ray revealed three regions of wiring damage, one region in the elbow (arrow 1), one region around the collar (arrow 2) and the region associated with the blow-out (arrow 3). It also highlighted the presence of a grub screw (marked).
Fig. 19. Exposure of the convoluted conduit and removal of a segment of the elbow confirmed the existence of a region of electrical damage, in the region of the collar, arrow.
(a) Initial arcing in region 1 was possible as a result of close proximity of the wiring to the corrugations, but the initiator was not obvious; the possibility that a crack in the corrugations chafed the insulation, was rejected on the grounds that the crack ends would still be visible near the burn hole. In addition, the failed loom did not display the machining irregularities visible on some other components and which in some cases had led to cracking of the tubing. (b) Initial arcing in region 2 had no obvious cause. (c) Initial arcing in region 3 could have been initiated by the grubscrew, or by the sharp edges observed on the entry to the elbow. The key observations which assisted in developing a likely failure scenario were: (d) Observation of insulation damage on the wires in a location which had no damage-causing edges nearby.
768
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 20. Dissected and reconstructed loom, showing the burnthrough region (ringed), and the various regions in which conductors had been consumed.
Fig. 21. Close-up of the collar in a similar loom, showing (left) the close fit of the conductors in the collar, and (right) the same region, with wires pulled back, showing how the edge of the collar can damage the insulation on the conductors.
(e) Observation of other insulation-damaged regions in other looms – even those which had not been in service. (f) Observation of ‘‘birdcaging’’ of wires at the connectors (example from another loom shown in Fig. 22). These observations suggested that during construction of the loom, the wires were pushed well through the elbow (presumably to allow connector installation), leading to insulation damage. When the connector was pushed back, the damaged regions would then move back to another location. The next step was to look for evidence of such damage. Further examination led to: (g) Observation of damaged insulation remnants in locations consistent with the hypothesis. (h) Observation of a small amount of kinking (Fig. 23) on the end of wire C which would have been near the observed burnthrough.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
769
Fig. 22. X-ray showing damage to wires in an unused loom, confirming that push-back of the connectros, into the shell, during manufacture, causes damage.
Fig. 23. Damage to wire C near the burn hole; note the mechanical damage, suggesting that the wire was damaged in this region during manufacture, and supporting the proposed damage mechanism.
(j) Observation of a region of the elbow entry which had been manufactured with a sharp edge capable of causing insulation damage (Fig. 24). Hence, the likely explanation involved initial failure at region 1, but from damage caused when the wire had been pushed/pulled through the elbow (region 3) at manufacture, prior to being pushed back into location. Burnthrough occurred as a result of in-service flexing, and led to arcing back to the source, preferentially between the initial failure wire and the others, then between the wires and the elbow (grubscrew and
770
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
Fig. 24. The raised lip of the collar region-the probable cause of damage in the failed loom.
entry region). A feature of this investigation was the need to explain all the features, and the need to be prepared to re-examine hypotheses continually as new evidence appeared. The examination led to a substantial program of examination of the looms in the fleet and in storage, to give assurance of continued system safety.
3. Conclusion The purpose of this paper was to illustrate the application of a range of scientific and technical approaches to the investigation of failures in military aircraft, and give examples which illustrate how detailed and comprehensive investigation can lead to a confident assessment of the events involved in the failure. A key requirement for successful investigation – one usually developed only through experience – is an appreciation of the value of anomalous observations in the course of the examination, and the way that resolution of these anomalies provides a framework for understanding the bigger picture surrounding the events.
Acknowledgements The author acknowledge the many individuals in DSTO, the ADF, and staff from Boeing Australia Ltd who made up the teams investigating the failures and accidents which are discussed, briefly, in this paper. Particular note should be made of the contributions of Noel Goldsmith, Simon Barter, Robert Pell and Nick Athiniotis to the examples quoted.
References [1] Kepert JL. Aircraft Accident Investigation at ARL, the First Fifty Years. Report GD37, Defence Science and Technology Organisation, Melbourne; Australia 1993. [2] Cox AF, Kepert JL, Clark G. In: Proceedings of the Australian aeronautical conference on accident and failure analysis: learning from experience. Melbourne: I.E.Aust; October 1989.
G. Clark / Engineering Failure Analysis 12 (2005) 755–771
771
[3] Clark G. In: Proceedings of the 1995 conference international society of air safety investigators on wreckage and component analysis, Seattle, WA; September 1995. [4] Goldsmith NT. Deep focus: a digital image processing technique ro produce improved focal depth in light microscopy. Image Anal Stereol 2000;19:163–7. [5] Barter SA, Hillen LW. Oxygen fires, materials compatibility and system contaminants. In: Stolftzfus JM, Benz FJ, Stradling JS, editors. Symposium on flammability and sensitivity of materials to oxygen-enriched atmospheres, fourth volume, ASTM STP 1040. Philadelphia: American Society for Testing and Materials; 1989. [6] Grubb JW. Case study of Royal Australian Air Force P3B Orion ground oxygen fire incident. In: Benning MA, editor. Flammability and sensitivity of materials to oxygen-enriched atmospheres, second volume, ASTM STP 910. Philadelphia: American Society for Testing and Materials; 1986. p. 171–9. [7] Barter SA, Clark G. Development of a GPS-based wreckage analysis system. In: Proc Conference ASASI Surfers Paradise; July 1999. [8] Goldsmith NT, Clark G. Analysis and interpretation of aircraft component defects using quantitative fractography. In: Strauss BM, Putatunda SK, editors. Quantitative methods in fractography, STP 1085. Philadelphia, USA: American Society for Testing and Materials; 1990. [9] Clark G, Goldsmith NT. Fractographic techniques for the assessment of aircraft component defects. In: Berkovits A, editor. Aeronautical fatigue in the electronic era. Warley, UK: EMAS; 1989. [10] Clark G, Jost GS, Young G. Recovery of the RAAF MB326H fleet; the tale of an aging trainer fleet. In: Poole P, Cook R, editors. Fatigue in new and ageing aircraft. Warley: EMAS; 1997.