On May 14, 1977, Dan-Air (G-BEBP) was on a non-scheduled international cargo flight carrying a load of palletized freight from London Heathrow to Lusaka International Airport, Zambia. The flight had two intermediate stops at Athens and Nairobi. After the second intermediate stop, the aircraft took off from Nairobi to Lusaka with a new crew, ground service personnel, and one passenger on board.

History of the Flight

The third flight of the day for the Dan-Air aircraft proceeded normally and without incident, until final approach at Lusaka.

The flight data recorder provided the following details:

• At 0907 hours the copilot contacted Lusaka Approach, and at 0911 the aircraft was cleared to descend to Flight Level (FL) 110 (11,000 feet altitude).
• At 0923 hours the copilot reported that the aircraft was leveling at FL 110 at a Distance Measuring Equipment (DME) range of 37 nautical miles from Lusaka.
• At 0928 hours the copilot reported that the airfield was in sight.
• At 0929 the copilot reported that the airplane was turning downwind.
• At 0932:02 the Lusaka Approach controller gave the aircraft a clearance to make a visual approach to runway 10. The copilot replied "Roger." This was the last transmission received from the aircraft.
• At 0932:53 hours the readout from the cockpit voice recorder (CVR) indicated that 50-degree flaps had been selected.
• At 0933:11 the landing checks had been completed.

Six seconds later, 24 seconds after selection of landing flaps, at 0933:17 hours, a loud "break up" noise was recorded with the CVR record terminating five seconds later, at 0933:22 hours.

Eyewitnesses on the ground observed the Dan-Air flight on what appeared to be a normal approach to runway 10 at Lusaka International Airport. They saw a large piece of the aircraft structure separate in flight. The aircraft pitched rapidly nose down and dived vertically into the ground from a height of about 800 feet, approximately two miles short of the runway threshold, and caught fire upon impact. The accident occurred in daylight and in good weather. All 6 occupants of the aircraft were killed.

The complete right side horizontal stabilizer and elevator assembly were found 200 meters back from the airplane wreckage site, indicating the separation occurred in flight prior to the aircraft pitching nose down into its final dive. The cause of the stabilizer separation became the focus of the investigation.

Horizontal Stabilizer Structure

The horizontal stabilizer is a box structure, with the forward and aft sides of the box being the front spar and rear spar, respectively. The top and bottom surfaces of the stabilizer box are formed by skin structure. The stabilizer is attached to the fuselage by lug and clevis attachments at the front and rear spars. The center of lift of the horizontal stabilizer is located slightly aft, such that the normal load distribution is split between the front spar and rear spar at approximately 5% and 95%, respectively.

Aerodynamic Affect of Horizontal Stabilizer Failure

The diagram below shows the relative locations of aircraft center of gravity, center of lift, and balancing tail load of a typical transport category aircraft in flight:

• The design of transport category aircraft results in a natural tendency to pitch the airplane nose down
• Balance (longitudinal stability) is provided by the downward acting force of the horizontal stabilizer
• Loss of the horizontal stabilizer results in an unbalanced nose-down pitch and loss of control

Description of the Failed Structure

Examination of the detached stabilizer revealed evidence of a fatigue failure of the top chord of the rear spar, initiating at the 11th fastener hole, which is used by both the rear spar upper chord and upper skin structure. The location of the fastener was 14.25 inches outboard of the attachment of the stabilizer attachment pin.

The cracking progressed in fatigue over approximately 60% of the chord, and then began a series of several tensile jumps, separated by small periods of fatigue. The total number of flights between the initiation of the fatigue crack and the final failure of the upper chord was estimated by the investigators to have been approximately 7,200 flights, with 3,500 of the flights being the duration to grow the crack across the exposed surface of the top chord.

Failure of the top chord was followed by fracture of the upper web, center chord, lower web and lower chord, leading to loss of the stabilizer and loss of control of the aircraft.

The investigation discovered no unique feature leading to the cracking at the 11th fastener hole other than high stresses existing in the entire inboard area of the rear spar. The location of the 11th fastener hole is indicated by an arrow in the photo below.

Post-accident inspection of the 707-300 in-service fleet discovered cracking occurring in the rear spar upper chord at the 11th fastener in three other aircraft. Cracks were also found in other fastener holes on either side of fastener hole 11, from holes 2 to 21. In total, cracks were found in 7% of the in-service fleet, equal to 38 of the 521 model 707-300s in operation.

Effect of a Fastener Hole in a Tensile Member: "Stress Concentration"

The top chord of the stabilizer rear spar is loaded in tension. A structural member of uniform cross section will have a uniformly distributed tensile stress across the section.

A structural member having a discontinuity, such as a fastener hole, will develop a stress field that is larger at the edges of the hole. This means that the stresses are higher at the edges of the hole than in the area away from the hole. This phenomenon is called a "stress concentration," and explains one of the causes of cracking typically found to occur at the location of the discontinuity.

Development of the Design of the 707-300 Stabilizer

The Dan-Air aircraft involved in this accident was the first model 707-300 produced by The Boeing Company. The Boeing 707 began with the KC-135 military transport and includes the 707-100, -200, -300, and -400 series of aircraft. The horizontal stabilizer on the early models, the 707-100 and 200 derivatives, are identical and have rear spars of two-chord design.

In order to certify the aircraft, the manufacturer demonstrated that the two-chord design of the horizontal stabilizer was "fail-safe." That is, with a failure of any single structural element, the remaining intact structure could carry the loads anticipated in flight. In the case of the horizontal stabilizer, the failure assumed most likely, and most critical, was the failure of a single lug. In the case of the early 707 two-chord stabilizer design, the Boeing Company demonstrated through a series of dynamic tests that the horizontal stabilizer rear spar upper chord could fail, and that the stabilizer loads were reacted safely by the stabilizer box and remaining chord attachment.

The fail-safe philosophy of the 707-100, supported by the testing performed on the 707-100 two-chord design, was extrapolated to support certification of the 707-300 horizontal stabilizer. However, there were design differences between the two models that made the early tests invalid for the later model.

When the model 707-300 was developed, the stabilizer assembly was extensively redesigned. The stabilizer span was enlarged to increase tail volume. To accommodate the resulting increase in loading on the larger tail, the intended fail-safe characteristic of the structure was achieved by the addition of a third chord, with a lug and clevis attachment point, located at mid-spar depth on the rear spar.

The analysis performed on the new three-lug design of the 707-300 assumed the same failsafe scenario as was proven during testing of the two-lug stabilizer design of the 707-100/200: failure of the stabilizer rear spar upper lug. Testing was not performed to validate the failure scenario on the three-lug design because it was felt the 737-100/200 tests were representative.

For substantiation of the 707-300, Boeing used analysis to show that in the event of the upper lug failure the load would be redistributed to the lower two lugs, which would be able to carry the flight loads safely.

Another design change was made to the 707-300 as a result of a discovery made during the flight test program. Flight testing indicated that the 707-300 horizontal stabilizer lacked sufficient torsional stiffness. In order to correct this deficiency, the stabilizer lower aluminum skin was increased in thickness, and a stainless steel plate was used to replace a portion of the upper aluminum skin. The location of the stainless steel plate is shown as the shaded area on the figure below.

The stainless steel plate was much stiffer than the aluminum structure to which it was attached. Without the plate, the aluminum horizontal stabilizer would deflect a certain amount under flight loading. With the stainless steel plate riveted to the stabilizer, the deflection was less because the steel plate resisted the bending. This bending resistance was transferred to the aluminum stabilizer rear spar through higher-than-expected loading in the fasteners.

The load increase on the stabilizer that occurred as a result of the stiffening of the skin panel led to the development of fatigue cracking in an area outboard of the lug. This outboard location, which was not considered to be a likely failure scenario, was not analyzed by Boeing.

These two design changes in the 707-300 relative to the 707-100 (addition of the third chord and stainless steel plate) became significant factors leading to the loss of the Dan-Air aircraft.

Post Crash Investigation

Dan-Air 707-300, G-BEBP, Basic Aircraft Information:

• Investigation of the pilot and copilot revealed no anomalies.
• Aircraft: Manufactured - 1963
• Total airframe flight hours at time of accident - 47,621
• Total airframe flight cycles at time of accident - 16,723
• Flight hours since last C-check - 662
• Flight cycles since last C-check - 176
• Dan-Air G-BEBP was the first 707-300 produced by Boeing.

After the accident, a fail-safe test was performed on a 707-300 horizontal stabilizer. The top chord was cut to simulate the fatigue damage on the Dan-Air airplane. During testing, the spar fractured completely at a load approximating the load estimated to have been acting on the Dan-Air aircraft at the time of approach and stabilizer separation. Application of up elevator during approach was shown to produce loads 20% greater than the test failure load. This load discrepancy, and the strikingly similar fracture characteristics of the test specimen, indicated that the failure occurred as a result of an inability of the remaining structure to carry the flight loads subsequent to the fracture of the rear spar top chord.

View Dan-Air Horizontal Stabilizer Animation below: 

Back to top 

The accident preliminary investigation was performed by a United Kingdom (UK) accredited representative and a team of advisors, after which the Zambian authorities elected to delegate the investigation to the UK Civil Aviation Authority, Accident Investigation Branch, in accordance with the ICAO convention.

The UK CAA report included 13 findings relative to this accident and cited the probable cause as:

"The accident was caused by a loss of pitch control following the in-flight separation of the right-hand horizontal stabilizer and elevator as a result of a combination of metal fatigue and inadequate failsafe design in the rear spar structure. Shortcomings in design assessment, certification and inspection procedures were contributory factors."

The complete text of the findings can be accessed at the following link: Accident Board Findings

The complete accident report can be viewed at the following link: (Accident Report) 

Back to top

The UK CAA report included recommendations pertaining to the design, certification, and maintenance of aircraft utilizing fail-safe criteria. The recommendations also emphasized the need to identify "significant" details that are considered fail-safe and to ensure these structural details are included in operator maintenance programs. In addition, a caution was written against the use of pre-existing data for certifying derivative aircraft with modified designs.

The complete text of the recommendations can be found at the link: Accident Board Recommendations

Back to top

CAR 4b.270 - Allowed an aircraft manufacturer to demonstrate that structure was either failsafe or free from fatigue cracking for the duration of the service life.

Back to top

At the time of this accident, regulations relative to fatigue of materials were evolving. As a result of the deHavilland Comet accidents in the mid-1950's, "safe-life" concepts of structural integrity had come into question. Fail-safe concepts had then become a prevailing philosophy to maintain structural integrity for the life of an airframe. This Dan-Air accident highlighted the shortcomings of the fail-safe philosophy in the absence of a thorough understanding of the fatigue characteristics of complex structures. As a result of this overall set of accidents, both fail-safe and safe-life concepts were sufficiently questioned so that new concepts began to evolve. The Dan-Air accident became instrumental in the evolution toward damage tolerance requirements. Damage tolerance has become the predominant design philosophy for addressing fatigue characteristics of complex structures.

Back to top

• The impact of this increased loading on the fatigue life of the structure was not recognized.

The replacement of a portion of the upper skin of the horizontal stabilizer with stainless steel plate significantly increased the stiffness in the structure and increased the stress levels and load transfer in the inboard area of the rear spar upper chord.

Back to top

• Certification tests performed to substantiate previous 707 two-chord stabilizer designs were used to validate the stabilizer of the 707-300, which had three chords. The designs were considered sufficiently similar that no validation testing was deemed necessary for the 707-300 design.

Back to top

Several fasteners in the area of the rear spar cracking had previously been replaced on the Dan-Air aircraft. Although no repair records describing the discrepant condition leading to the fastener replacement were found, it is assumed that some type of fastener distress was discovered and remedied through the replacement of the fasteners.

After the accident, both the right and left hand stabilizers of the Dan-Air aircraft were found to have signs of fastener distress at the rear spar upper chord in the area of the fracture. The upper skin around the fasteners was deformed, indicating areas of high stress. This same condition was widespread throughout the 707-300 fleet but was never highlighted by the manufacturer as a potential trouble spot requiring reevaluation.

Back to top

The Dan-Air accident is considered by many to be the final catalyst for the issuance of regulations requiring establishment of damage tolerance-based inspections, whenever practical, for transport category aircraft. At the time of the accident, there were on-going discussions within the aircraft industry regarding the need for an alternative to fail-safety for protection against fatigue in older aircraft and for new type designs.

While the original certification basis for the 707 had been CAR 4b, by the time regulatory changes were promulgated, 14 CFR part 25 had become the effective regulation. As a result, the subject changes were made to 14 CFR part 25. The resulting regulatory change for new airplanes was issued on December 1, 1978, as Amendment 45 to Federal Aviation Regulation (FAR) 25.571. This is the first appearance of a requirement to perform damage tolerance evaluations and, based on the results, establish inspections or other procedures needed to avoid catastrophic failures due to fatigue.

There is a good discussion that contrasts the differences between fail-safety and damage tolerance philosophies in the preamble to FAR 25.571 Amendment 25-72. View this discussion here.

Back to top

Three telegraphic ADs were issued soon after the crash occurred.

1) On May 18, 1977, a telegraphic AD was issued requiring one-time visual inspection of the rear spar upper chord.

2) On May 27, 1977, a second telegraphic AD was issued requiring eddy current or dye penetrant inspection of the rear spar upper chord.

3) On July 11, 1977, the third telegraphic AD was issued requiring improved method of low frequency eddy current be used. This also required one repeat inspection.

Follow-on ADs:

4) AD 77-14-10 was superseded by AD 77-16-11

5) AD 77-16-11

Applicable to all Boeing 707-300/400/300B/300C series airplanes.

This AD supersedes all previous ADs listed.

Requires inspection of the rear spar upper chord within 175 flight cycles from the effective date of the AD to look for cracking. Also requires repeat inspections every 375 flight cycles.

6) AD 78-01-04

Applicable to all Boeing 707-300/400/300B/300C series airplanes.

Requires inspection of the horizontal stabilizer center section rear spar upper chord within 375 flight cycles from the effective date of the AD to look for cracking. Also requires repeat inspections every 375 flight cycles.

7) AD 79-10-16

Applicable to all Boeing 707-300/400/300B/300C series airplanes.

Requires modification of the rear spar to add fourth chord.

8) AD 88-25-03

Applicable to all Boeing 707-300/400/300B/300C series airplanes.

Requires installation of structural improvement kits on the horizontal stabilizer outer panels and center section.

Back to top

Airplane Life Cycle:

• Design / Manufacturing

Accident Threat Categories:

• Structural Failure

Groupings:

• Approach and Landing

Accident Common Themes:

• Flawed Assumptions
• Unintended Effects

Back to top

Flawed Assumptions

The manufacturer assumed that the new three-lug design of the horizontal stabilizer would carry failsafe loading in the same way the previous 707 stabilizer designs carry loading. This led the manufacturer to propose that previous testing adequately represented the revised design and that no further testing was necessary. This flawed assumption was used in the analysis to substantiate the 707-300 horizontal stabilizer design and was ultimately accepted by the FAA in order to certify the airplane.

Unintended Effects

By adding a stainless-steel plate to the design of the horizontal stabilizer upper skin, the manufacturer unintentionally increased the flight loading to this area of the rear spar.

Back to top

de Havilland Comet 1

The de Havilland Comet 1 Aircraft experienced a series of in-flight breakups before it was discovered that the fuselage fatigue life was far shorter than testing had revealed. "Squarish" fuselage windows created stress concentrations which resulted in catastrophic structural failures due to fatigue. These three Comet accidents occurred before the root accident cause was discovered.

See accident module

Aloha Airlines Flight 243, Boeing 737-200, N73711

On April 28, 1988, in Maui, Hawaii, while in cruise, a fatigue-related failure in a fuselage lap joint resulted in the separation of a significant portion of the upper fuselage skin over approximately 1/3 of the fuselage length.

See accident module

Japan Airlines Flight 123, Boeing 747-SR100, JA8119

On August 12, 1985, a fatigue failure in the improperly repaired aft pressure bulkhead caused a depressurization, loss of a major portion of the vertical stabilizer, and total loss of all hydraulic fluid. Loss of hydraulic fluid left the airplane only partially controllable using differential thrust. Control was eventually lost, and the airplane crashed into mountainous terrain in Gunma Prefecture, Japan.

See accident module

Back to top

Technical Related Lessons 

Increasing the strength or stiffness of a structural component has the potential to negatively impact the fatigue characteristics of that component. It is important that structural maintenance or other in-service programs be predicated on a thorough understanding of the fatigue properties. (Threat Category: Structural Failure)

• The 707-300 design was based largely on an extrapolation of the 707-100/200 design, though it was stronger and stiffer than on the 707-100/200. As such, it was believed that the designs were sufficiently similar that fatigue testing was unnecessary. Following the Dan-Air accident, it was determined that the fatigue properties of the 707-300 horizontal stabilizer, larger and stiffer than that on the 707-100, were significantly different than on the preceding design, leading to a significantly shorter fatigue life and the catastrophic failure in this accident. Fatigue properties of the redesigned airplane model were not well understood, and the test results were misleading regarding the airplane's actual fatigue characteristics.

Common Theme Related Lessons

Past assumptions must be confirmed as relevant to present designs. It is necessary to understand the origins of earlier assumptions before they can continue to be considered valid. (Common Theme Category: Flawed Assumptions)

• The horizontal stabilizer of the 707-300 was a "scaled-up" design of the 707-100/200. The structural characteristics of the two designs were assumed to be similar, and extrapolations of assumptions to the new design were considered valid. Results from the fatigue tests conducted on the 707-100/200 were used to validate the assumptions on the 707-300 design, and new testing was not conducted. The accident demonstrated that the basic similarity assumptions were incorrect, and that testing to validate those assumptions should have been conducted in order to properly understand the changes to structural properties inherent in the new design.

Back to Top