Flight Safety Australia - July-August 2005 pg28-33 - Civil Aviation ...

COVER STORY
JAL 123: AUGUST 12, 1985
520 LOST
IT’S 20 YEARS SINCE THE WORLD’S
WORST SINGLE AIRLINER ACCIDENT.
MACARTHUR JOB AND STEVE SWIFT REPORT.
Japan Air Lines’ 747SR, registered
JA8119, completed four uneventful
inter-city trips on Monday, August 12,
1985, arriving back at Tokyo’s Haneda Airport
at 5.17 pm. Its next service was Flight JAL123
to Osaka, 215nm (400 km) south-west of
Tokyo. A senior training Captain was in command,
supervising the upgrading of a former
747 first offi cer.
With 509 passengers and 15 crew aboard,
JAL 123 took off at 6.12 pm. Th e planned route
was via the island of Oshima, 50 nm southwest
of Tokyo, cruising at FL240 (24,000 ft).
At 6.25, the controller saw the emergency
code 7700 suddenly appear beside the 747’s
radar target. Seconds later the aircraft called,
requesting an immediate return to Haneda.
Controller: “Roger – approved as requested.”
JAL123: “Radar vector to Oshima, please.”
Controller: “Turn right, heading 090.”
But instead of making the expected turn
back towards Oshima, the aircraft gradually
turned to a north-west heading.
Controller: “Negative, negative...confirm you
are declare [sic] emergency?”
JAL123: “Th at’s affi rmative!”
Controller: “Request your nature of emergency?”
Th ere was no immediate reply.
Controller: “JAL123 – fly heading 090 radar
vector to Oshima.”
JAL123 (tensely): “But now uncontrol! [sic]”
FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2005 28
News that the flight was in trouble leaked
to the media. Japanese television conducted a
live-to-air telephone interview with an eyewitness
watching the 747. He described it as “wavering
and having trouble keeping to its flight
path”. Meanwhile the aircraft had turned north
towards the mountain ranges forming a spine
along the main Japanese island of Honshu.
Then, just on sunset at 6.56
pm, as its altitude fell to
8400 ft, the controller was
horrified to see the target
vanish from his screen.
At 6.34 pm the company called the 747.
Company operator: “JAL123 – this is Japan
Air. Tokyo control received an emergency call
30 miles west of Oshima Island.”
Th e flight engineer responded, obviously
under pressure: “Ah ... the R5 door is broken.
Ah ... we are descending now...”
Company operator: “Roger – does the Captain
intend to return to Tokyo?”
JAL123: “Ah ... just a moment ... we are making
an emergency descent ... we’ll contact you
again. Ah ... keep monitoring.”
Out of control: Th e 747 continued north about
25 nm, then began a gradual turn north-east
in the direction of the US Air Force base at
Yokota, 77 nm distant. It was maintaining
around 22,000 ft above scattered thunderstorms
and rain showers.
When 45 nm west of Haneda Airport, the
aircraft entered a descending turn to the right,
completing a full circle before straightening out
on an easterly heading towards the airport. Its
descent then continued, but at 13,500 ft one of
the crew called in an agitated voice: “JAL123,
JAL123 – uncontrollable!”
Tokyo control: “Roger – understood. Do you
wish to contact Haneda (approach)?”
JAL123 (frantically): “Ah ... stay with us!”
JAL123 (now down to 9000 ft): “JAL123 –
request radar vector to Haneda!”
Controller: “Roger – I understand. It is runway
22, maintain heading 090.”
Still descending, the 747 now gradually
turned to the left on to a heading of about 340
degrees. It was below the level of mountains
that now lay in its path.
Controller: “Can you control now?”
JAL123 (desperately): “JAL123 – uncontrollable.
JAL123 – ah uncontrol. JAL123, uncontrol
[sic].”
Approach: “Your position ... ah ... 45 miles
north-west of Haneda.”
JAL123 (anxiously, with altitude read-out now
13,000 ft): “North-west of Haneda – ah – how
many miles?”
Approach: “According to our radar, 55 miles
north-west. I will talk in Japanese – we are ready

COVER STORY
Photo:AAP
photo: newsweek
for your approach anytime. Also Yokota landing
Sprawling (above): The wreakage of Japan
is available – let us know your intentions.”
Airlines Flight 123 on the slopes of Mount
Th ere was no reply. Th e 747’s height was
Osutaka. Clearly visible is part of a wing.
Aftermath (inset right): Rescue workers
now decreasing again and, by 6.54 pm, its
with debris from the accident.
altitude read-out was 11,000 ft. Approach
called the aircraft again, advising its position
was “50 miles – correction 60 miles”
to recover its balance to the right. It was
north-west of Haneda Airport. But again
flying just like a staggering drunk.”
there was no response.
Because of the inaccessibility of the area, it
A minute later, its target suddenly devi-
was not until 9 am, more than 14 hours after
ated 90° to the right and, as its altitude read-
the crash, that civil defence workers reached
out rapidly decreased, it entered a tight turn
the site. Fog had forced a temporary suspen-
of less than 2 nm radius. Th en, just on sunset
sion of mountain flying, but when conditions
at 6.56 pm, the controller was horrified to
improved, army paratroopers arrived aboard
see the target vanish from his screen.
Chinook helicopters, rappelling down to
Further calls to the 747 went unanswered.
where the wreckage lay.
Moments later, a military jet reported “a huge
Th e disaster was now revealed. Flying a
burst of flame in the Nagano Mountains”.
westerly heading, the Boeing 747 had de-
Impact in the mountains: It was dark by
scended into a pine forest near the top of the
the time two search helicopters reached the
northern face of the 5400 ft Mt Osutaka, a
area through showery weather. Attracted by
narrow, steep-sided east-west ridge, explod-
a fire blazing near the top of the 5400 ft Mt
ing into flames and breaking up as it bounced
Osutaka in inaccessible ranges more than
along the ridge line.
60 nm north-west of Tokyo, one helicopter
Th ere was no sign of survivors. In Tokyo,
pinpointed the site of the crash, reporting
the fearful news was confirmed to waiting
flames “over an area about 300 m square”.
media – the highest death toll ever in a single-
One witness, surprised at seeing an airaircraft
accident.
liner above his remote mountain village,
Well down the mountain face, a fireman
described its erratic flight. “All of a sudden,
stood on the steep slope surveying the wreck-
a big aeroplane appeared from between
age. Suddenly he saw something that looked
mountains,” he told police. “Four times
like an arm waving! Sure enough, a young
it leaned to the left, and each time it tried
woman, conscious though suffering a broken
Photo:AAP
AAP
pelvis and a fractured arm, was pinned between
two sets of seats.
Not long afterwards there was more good
news – a 12-year-old schoolgirl was found
wedged in a tree, suffering nothing more serious
than cuts and bruises. Even more was to
come – rescuers discovered another young
woman and her daughter beneath wreckage.
Both suffered fractures. All four survivors
had been seated among the last seven rows of
seats.
Medical staff found some victims had
clearly survived the impact but, wearing only
light summer clothes, had died of exposure
during the night.
Investigation: Th e aircraft had been worked
hard, flying 25,000 hours in the course of
18,800 cycles. Did this demanding utilisation
show up some unknown flaw?
Th e only clue to the loss of control was the
tense radio transmission that the 5R cabin
door – the rear most door on the starboard
side – was “broken”. Could the door have
broken away and struck the tail, disrupting
the multiple hydraulic systems that actuate the
aircraft’s control surfaces?
FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2005 29

COVER STORY
There was no sign of
survivors. In Tokyo, the
fearful news was confirmed
to waiting media – the
highest death toll ever in
a single-aircraft accident.
Th e finding of the door amongst the wreckage
with its latches in the closed position only
deepened the mystery. Why had the flight crew
referred to it as “broken”? Could structural distortion
of the fuselage have caused the door
warning lamp to light up?.
A photograph of the stricken aircraft,
snapped from a mountain village shortly
before the 747 crashed, provided new and dramatic
evidence (see cover photo). A portion of
its vertical fin, together with the section of the
tailcone containing the auxiliary power unit
(APU), was missing.
Th e photographic evidence was confirmed
when a 5 m piece of the aircraft’s fin was found
floating in the bay where the aircraft had been
passing when the emergency developed. Could
the APU’s gas turbine have disintegrated, rupturing
the hydraulic lines to the rudder and
elevators?
While Boeing and US investigators were
on their way to join the Japanese team, other
important evidence was emerging. One of
the surviving passengers described what took
place in the rear passenger cabin.
She was an off-duty JAL flight attendant, sitting
only four rows from the rear of the cabin.
“Th ere was a sudden loud noise, somewhere
to the rear and overhead,” she said. “It hurt my
ears and the cabin filled with white mist. Th e
vent hole at the cabin crew seat also opened.”
Th e white mist was characteristic of sudden
cabin decompressions. Th e “vent hole” was one
of the modifications made to wide-bodied aircraft
as a result of the Turkish Airlines DC-10
disaster near Paris 11 years before in 1974. (See
Flight Safety Australia, March-April 2005).
“Th ere was no sound of any explosion,” the
witness continued, “But ceiling panels fell off,
and oxygen masks dropped down.” Th en she
felt the aircraft going into a “hira-hira” (Japanese
for a falling leaf).
Investigators soon discovered the flight data
recorder (FDR) and cockpit voice recorder
(CVR).
A read-out of the FDR, and a transcription
of the CVR tape, confirmed the flight attendant’s
report.
Th e explosive decompression occurred a
few seconds past 6.24 pm, soon after the 747
reached its cruising level. After the aircraft was
cleared to return to Haneda, the Captain exclaimed:
“Hydraulic pressure has dropped!”
Th e failure of the 747’s multiple hydraulic
control systems completely deprived the
crew of primary control. Stabiliser and aileron
trim were also rendered useless, and the yaw
5

COVER STORY
damper was no longer effective. With the aircraft’s
stability also seriously impaired by the
loss of a substantial part of its fin, it began
combined “phugoid” and “Dutch roll” oscillations,
settling into a pitching, yawing, and
rolling motion.
Th e pitching, in cycles of about 90 seconds,
was taking the aircraft from about 15° noseup
to 5° nose-down, with vertical accelerations
varying between +1.4 g and -0.4 g. Variations
in airspeed and altitude during the cycles
were averaging around 70 kt and 3000 ft, with
peaks of as much as 100 kt and 5000 ft. Th e
yawing and rolling motion was much faster,
the aircraft alternately rolling 50° either way in
cycles of about 12 seconds.
Delicate handling: Holding the aircraft’s attitude
by increasing and decreasing power, the
crew also achieved limited directional control
by applying power asymmetrically. At 6.29
pm they achieved a bank to the right, turning
the aircraft on to a northerly heading while
maintaining an altitude between 23,000 and
25,000 ft.
Desperate efforts: Th e altitude excursions
reached a peak, with the nose pitching down
and the aircraft diving from 25,000 to 20,000
ft in a little over half a minute as the airspeed
rose from 200 kt to 300 kt. Just as quickly the
motion then reversed, the speed falling off
again to 200 kt as the nose rose and the aircraft
began climbing again.
Preoccupied with trying to maintain control,
the flight crew had overlooked donning
their oxygen masks. Nearly 10 minutes had
passed since the decompression and they were
undoubtedly suffering a degree of hypoxia
and some deterioration in judgement. But at
the flight engineer’s prompting, this was remedied.
Th e oxygen took effect quickly, for the pilots
now limited the pitching excursions to about
2000 ft in altitude and 60 kt in airspeed. But
they could do nothing to dampen the continuous
rolling from side to side.
Th e CVR revealed the pilots’ increasingly
desperate efforts to control the aircraft. Over
and over again, the Captain instructed the
co-pilot to “lower the nose”. Just before 6.39
pm, the flight engineer suggested lowering
the undercarriage to help stabilise the motion,
but both Captain and co-pilot countered: “We
cannot decrease the speed!”
A minute later, with the pitch oscillations
reduced to about half, the pilots succeeded in
turning the aircraft towards Haneda Airport,
42 nm distant. As they did so, the flight engineer,
seizing the opportunity as the airspeed
fell below 200 kt at the top of a pitch-up, selected
the undercarriage down.
Although the change of longitudinal trim
required an immediate increase in engine
power, the increased drag dampened the
pitching, reducing the amplitude of the airspeed
and altitude excursions as the aircraft
entered a descent of about 3000 fpm. But the
drag also dampened its response to directional
control and, instead of continuing towards the
airport, it entered a turn to the right, still descending.
But after turning through 360 degrees, the
pilots regained some measure of directional
control at 15,000 ft. Th eir reprieve was shortlived
– the aircraft began turning again, this
time to the left.
Now below 9000 ft and still descending, the
747 was heading north again towards mountainous
country. “Hey – there’s a mountain
– up more!” the Captain called anxiously. Th e
co-pilot carefully applied more power, trying
to juggle the aircraft’s attitude. But with the
undercarriage down, this failed to check the
descent.
Captain: “Turn right! Up! We’ll crash into a
mountain!”
With the application of more power, the aircraft
pitched nose-up, gaining 2000 ft, while
the airspeed fell from 210 to 120 kt.
Captain (urgently): “Maximum power!”
But the coarse application of power triggered
the phugoid oscillation again.
Captain: “Nose down ... nose down!”
Th e co-pilot reduced power again and the
nose pitched down. Th e aircraft was plung -
ing to below 5000 ft with the airspeed rising
quickly to around 280 kt, before recovering
from the dive at a loading of 1.85 g. Th e air -
craft then climbed even more steeply to about
8000 ft and, as its airspeed fell sharply, the stall
warning began sounding.
Captain (dismayed): “Oh no!” (urgently):
“Stall! Maximum power!”
Calls from Tokyo, Approach and Yokota
were ignored as the crew fought to prevent the
747 plunging out of control.
Th e final 108 seconds of the CVR revealed
a string of increasingly desperate instructions
calling for “Nose up”, “Nose down, and “Flap”
as the pilots tried to prevent the aircraft falling
out of control.
Finally, as it entered a tightening descending
turn to the right, the ground proximity warning
system began sounding. Fourteen seconds
later there was the sound of the aircraft striking
tree-tops, followed three seconds later by
the sound of the crash.
Wreckage examination: It was clear that
the explosive decompression, the pre-impact
damage to the fin and rudder, and the loss
of all four hydraulic systems, were somehow
linked. But what was the link – and what had
precipitated it?
As a precautionary measure, the Japanese
Fatal flight: The explosive decompression occurred soon after the 747 reached it’s
cruising level (point of rupture). The crew lost primary control as a result of loss of
hydraulic control systems.
FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2005 31

COVER STORY
DESTRUCTION OF THE REAR PRESSURE BULKHEAD
Tail cone blown off: A Japan Air Lines 747 SR. The red line shows the rear tail cone part
of which was destroyed when the rear pressure bulkhead failed.
Tear stop straps
Line of
cracks
Tremendous force: The rear pressure bulkhead (shown left in blue) must contain tremendous
force from the pressure difference at altitude between the cabin and outside air.
The 4.55 m bulkhead is constructed of reinforced aluminium alloy sheets in a domed shape to
resist pressure. The line of cracks (right) formed mid way between the upper and lower parts of
the dome.
UPPER
BULKHEAD
LOWER
BULKHEAD
Fracture
Upper doubler
plate splice
Lower doubler
plate splice
Tear stop
straps
Line of cracks: A side view of the cracks formed prior to rupture of the bulkhead.
The bulkhead was destroyed after the cracks ran past the tear stop straps.
INCORRECT REPAIR
Fillet seal
NORMAL
BULKHEAD
Stiffener
Rivets
LOWER
UPPER
Filler sealant
Doubler plate
CORRECT
REPAIR
Upper doubler plate
Gap filled with
filler sealant
Lower doubler plate
Forward
JA8119
REPAIR
Over-loaded rivets: A “section” through the bulkhead showing normal construction (left)
a correct repair (centre) and an incorrect repair (right) that led to the JAL 123 tragedy.
In the wrong repair, technicians tried to connect two doubler plates, which forced the
middle row of rivets to carry too much load.
Up
UPPER
LOWER
Bulkhead 4.55 m diameter
Photo: Kjell Nilsson
Civil Aviation Board ordered inspections of all 69
of Japan’s 747s. Boeing, in a telex to 747 operators
world-wide, suggested they inspect the aft portion
of the pressure hull. Airworthiness authorities
world-wide issued airworthiness directives.
Although Boeing 747s had no history of bulkhead
failure, a major bulkhead fracture seemed to
fit the evidence. Pressurised air, escaping from such
a fracture, could have burst the fin.
Th e rear pressure bulkhead was certainly badly
damaged. But had the damage all been sustained in
the impact?
Although Boeing investigators argued that the
design had been tested to a simulated service life
of 20 years, and that the wreckage exhibited no evidence
of corrosion, a profound shock lay in store.
Examining the wreckage, Boeing’s structures engineer
picked up a broken off section of pressure
bulkhead plating. It had been repaired, and the
repair didn’t look right.
Electron microscope photographs of the fracture
surfaces of the doubler plate revealed striations indicative
of metal fatigue.
Th e discovery posed two vital questions: Why
was the bulkhead repaired in the first place? And
why had it been wrongly repaired?
An examination of JAL maintenance records
revealed the rear fuselage of the crashed 747SR
had scraped the ground during a nose-high landing
seven years before. Th e impact had been severe
enough to remove skin panels and crack the rear
pressure bulkhead.
Th e aircraft had been grounded for a month
while Boeing engineers supervised repairs at JAL’s
maintenance facility. Th e repair included replacement
of the lower part of the rear fuselage and a
portion of the lower half of the damaged bulkhead.
Close examination of the bulkhead repair showed
that two separate doubler plates, instead of one continuous
one, were used as reinforcement. Th e result
was excessive load on one row of rivets.
JAL’s maintenance planning manager said the repairs
were examined by the Japanese Civil Aviation
Bureau, and the aircraft test flown after the work
was done. No shortcomings were detected.
Moreover, in the seven years the aircraft had
flown since, six 3000 hourly “C-checks” had been
carried out. Yet these had found nothing.
Lessons: Boeing changed its 747 design to make it
more forgiving to failures like this in the future – in
other words to improve its “fail safety”. Th e manufacturer
strengthened tear-stop straps in the bulkhead
to stop cracks running. It improved venting
of the tail compartment behind the bulkhead to
reduce pressure if a bulkhead failed. And it provided
a cover for an internal access hole to prevent
pressurised air from entering the vertical fin.
FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2005 32

COVER STORY
Modifications were also developed to prevent
a total loss of hydraulic fluid from the
four independent hydraulic control systems
if the lines were severed for any reason, and
to provide additional protection for control
cables.
Boeing had thought about most of these
things when designing the 747, but events
proved they had not tested them suffi ciently.
Aircraft manufacturers have since learned
the value of testing to prove design assumptions.
Th e JAL 123 tragedy reminds us how unforgiving
structural fatigue continues to be
in aviation, long after the infamous Comet
crashes of the 1950s. Accidents resulting from
structural fatigue have killed thousands, including
many in Australia: In 1945, a Stinson
A2W lost a wing, killing 10; and in 1968, a
Vickers Viscount lost a wing, killing 26.
In 1990, an Australian-built Nomad lost a
tailplane, killing the pilot.
Anyone repairing an aircraft needs to carefully
follow approved data. To those repairing
the bulkhead of the Japan Airlines’ 747, the improvised
doubler plate repair probably looked
strong enough – and it was, for a while. But,
the fatigue aspects of a design are not always
obvious. If you can’t install the repair exactly
to the approved data, check with the designer.
In JAL 123’s case, the Boeing repair team
did not communicate well enough with their
own company’s designers. Internal communication
can be a problem for large companies.
Operators should ask for assurance that the
advice they are getting (including the NTO, or
no technical objection) has engineering support,
especially the support of company regulatory
delegates.
It is a good idea to check your old repairs.
Be suspicious of all structural repairs. Be especially
concerned about patches that are
unusually old, large or thick. And be alert for
small cracks emerging from under the edge of
a patch repair.
Look for signs of loose or working rivets,
and be wary of stains streaking from under a
patch. Th ey might be the signature of pressure
or fluid leaks. And take any available opportunity
to check internally for cracks hidden
under external repairs.
An improperly treated scratch on the aircraft
pressure vessel skin, especially if covered
under a repair doubler, could be hidden
damage that might develop into fatigue cracking,
eventually causing structural failure (see
“Hidden hazard”, Flight Safety Australia, September-October
2003).
Anyone operating a large airliner should
check their compliance with Airworthiness
Directive AD/GENERAL/82 Amdt 1. Th e
scope of this airworthiness directive is likely
to expand in the future.
Finally, JAL123 warns owners and maintainers
that fatigue cracks can stay hidden,
even from the most thorough general maintenance.
You need to adopt a systematic approach
(see “Diamond standard maintenance”
below).
Th at’s why airworthiness authorities around
the world are progressively requiring aircraft
manufacturers to upgrade the maintenance
programs they publish for the types they support.
And that’s why Australia’s safety regulator
insists that aircraft owners follow them,
unless they have done a similarly systematic
engineering analysis to justify the safety
equivalence of their alternative.
Fatigue is indiscriminate and inevitable. If
not carefully managed, it can result in catastrophe
for any aircraft, large or small, repaired
or not.
Macarthur Job is an aviation writer and
aviation safety specialist. Steve Swift is a
CASA structural engineer.
DIAMOND STANDARD
MAINTENANCE
By Steve Swift
At an international conference on aeronautical
fatigue held in Hamburg, Germany,
in June this year the concept of diamond
standard maintenance received a lot of
attention.
Site
Detectable
Duration
Scenario
Dangerous
The “diamond”: a new way of
describing the “damage tolerance”
rules for managing structural fatigue.
Diamond standard maintenance is based
on a systematic analysis of how fatigue is likely
to affect all the safety-critical parts of the airframe.
Th e analysis has five elements:
Site: Where could cracks start? Th is is a predictive
element that requires analysis, testing
and service experience, if available.
Scenario: How will cracks grow? For example,
will there be one or many? Will they interact?
Will cracks in one part start cracks in another?
Detectable: What is the smallest detectable
size, considering the nature of the inspection
method and other factors? Once you know
this you can more effectively design your crack
detection regime. Beware of optimism: For
every lucky find of a small crack, there may be
many more misses of large ones.
Dangerous: As a crack continues to grow,
sooner or later it starts to become “dangerous”,
because the structure is about to lose the
strength we want to assure.
Duration: Th is is the time it will take a crack
to grow from “detectable” to “dangerous”. It is
the “safety window”. Th e inspection interval
must be narrower, and must account for uncertainty
and variability.
Airworthiness authorities worldwide are
Crack size
Duration
Detectable
Dangerous
Time
The time between inspections must
be shorter than the “Duration”. So, for
safety, we must know “Detectable”,
“Dangerous” and how fast a crack will
grow.
working with aircraft manufacturers and
operators to put in place diamond-standard
maintenance programs for all aircraft, including
their repairs and modifications.
Diamond standard maintenance programs
are usually called airworthiness limitations or
supplementary inspection documents (SIDs).
With two out of three Australian aircraft
having seen a quarter century of hard service,
the dangers of fatigue are ever present. Th ere is
no room for complacency.
For a copy of the full paper on diamond
standard maintenance (called “Rough
Diamond”), and other safety-related papers
and reports on structural fatigue, visit CASA’s
web site.
FLIGHT SAFETY AUSTRALIA JULY-AUGUST 2005 33