On August 12, 1985, Japan Airlines Flight 123 departed Haneda Airport in Tokyo, Japan, bound for Osaka. Approximately 12 minutes after takeoff, at an altitude of 24,000 feet and an airspeed of 300 knots, a bang, vibration, and cabin decompression was recorded on the cockpit voice recorder (CVR). The captain was in the right seat and the copilot was in the left seat for training as captain. This was the fifth flight of the day for this airplane. At 46 seconds after decompression, the captain signaled an emergency on the transponder and requested a return to Tokyo.

The cabin decompression was caused by the rapid rupture of the aft pressure bulkhead (located at the aft end of the passenger cabin), starting in an area of the pressure bulkhead that had been repaired several years earlier following a tail-strike event during landing.

The rush of cabin air into the unpressurized fuselage cavity caused an overpressure in that area, resulting in the failure of the APU firewall and the supporting structure for the vertical fin. The vertical fin separated from the airplane. Hydraulic components located in the aft body were also severed, leading to a rapid depletion of all four hydraulic systems. The loss of the vertical fin, coupled with the loss of all four hydraulic systems, left the airplane extremely difficult, if not impossible, to control in all three axes.

The aircraft descended to 22,000 feet and began phugoidal (longitudinal) and dutch-roll (lateral) oscillatory motions that continued for the rest of the flight. Damage from decompression resulted in the loss of all hydraulic fluid, leaving the flight crew unable to control heading or pitch through normal flight control inputs. Steering and adjustments to pitch attitude were accomplished with thrust changes.

The flight crew maintained 22,000 feet and 250 knots for about 20 minutes. Twenty-nine minutes after takeoff, the main landing gear was extended and the dutch roll increased in severity.

The airplane did a slow left turn while descending through 8,000 feet, while severe roll and pitch oscillations continued. At an altitude of 5,300 feet, the flight crew sighted mountains and increased thrust, climbing back to 10,000 feet.

Forty-one minutes after takeoff, the crew began to extend flaps, resulting in an increase in roll amplitude to approximately 60 degrees. An immediate flap retraction was initiated and thrust was increased. At generally the same time, the airplane assumed a nose-down attitude and began to descend at a rate of approximately 18,000 feet per minute. The crew was able to temporarily recover the airplane to a nose-high attitude at approximately 5,000 feet, but ultimately lost control. Forty-six minutes after takeoff (32 minutes after decompression), the airplane struck mountains at 5,000 feet altitude and 340 knots.

As a result of the accident, 505 passengers and 15 crew members were killed. Four survivors were found near the tail section that had broken away from the main wreckage. Ground fire destroyed the majority of the aircraft.

Much of the airplane's vertical tail and aft section were lost from the airplane following decompression. The separated pieces landed in Sugami Bay, southwest of Tokyo, and some pieces were subsequently recovered. Heavier objects, such as the APU, were not recovered. This photograph was taken by a witness prior to the crash. It shows the missing sections of the airplane.

At the time of the accident, the airplane had accumulated a total flight time 25,030 hours and 18,835 landings. The airplane was used for short routes within Japan and was arranged in a high-capacity seating configuration.

Improper Repair

More than seven years prior to the accident, on June 2, 1978, the airplane experienced a severe tail strike incident during landing at Osaka, Japan. Several aft fuselage frames, skin, and the aft pressure bulkhead were substantially damaged, and 25 passengers were injured. At the time of the incident, the airplane had 16,200 hours and 12,300 cycles. The airline contracted to a Boeing Airplane-On-Ground (AOG) team to disposition the aircraft and perform the damage repair.

The prescribed repair that the AOG team accomplished involved replacing and/or repairing a major portion of the aft fuselage, replacement of the tail compartment pressure relief door, and replacement of the lower half of the aft pressure bulkhead. In the post-repair inspection, it was discovered that certain rows of rivets on the newly replaced lower half of the bulkhead had inadequate edge margins. A solution for the inadequate edge margin was engineered and involved installation of a splice plate to join the upper and lower halves of the bulkhead. This rework design called for a single splice plate to be used to provide a continuous load path between the upper and lower halves of the bulkhead. The splice plate was difficult to install, owing to the compound curvature of the splice plate and adjoining structure. The eventual solution, which was a departure from the installation instructions, involved cutting the splice plate into two pieces, and fitting the pieces in place individually. This deviation from the approved repair resulted in a single row of rivets transferring the load to the upper affected web plate instead of the two rows specified in the repair instruction drawing.

This deviation resulted in the bulkhead web being improperly loaded and susceptible to early fatigue. (See Japan Airlines Bulkhead Animation). Furthermore, because of the geometry of the repair and the use of fillet sealant to fill the gap, the splice deviation would visually appear to conform to the approved repair when viewed from either side of the aft pressure bulkhead. The accident board estimated that the strength of the repair decreased to about 70% of the strength that would have resulted from a proper repair.

Failure Mechanism

The fuselage aft bulkhead failed as a result of repeated fatigue cycling and related cracking in the areas adjacent to the improper repair. Over the time period (more than seven years) between the repair and the accident, repeated pressurization cycling of the aft pressure bulkhead allowed fatigue cracks to form and propagate along the row of fasteners that was unintentionally carrying the pressure loads in the repaired area. To initiate the accident, cracking rapidly progressed along the single row of fasteners, through the tear straps, and into the adjacent bays, resulting in a rapid fracture of the aft pressure bulkhead.

The resulting pressure release into the fuselage cavity behind the pressure bulkhead resulted in an overpressure in this area (there was a pressure relief door, but it was sized only to relieve the pressure from the failure of a single bay of the aft pressure bulkhead, not the failure of the entire bulkhead). The overpressure filled the aft body and the lower portion of the vertical stabilizer, which was not designed to withstand a large internal pressure. The internal overpressure caused structural failures in critical fin support structure, causing it to rupture and depart the airplane.

Additionally, the aft portion of the area which was filled by cabin air following the bulkhead failure was contained by the APU firewall. Similar to the structure associated with the vertical fin, the APU firewall failed due to the overpressure. The APU firewall and the vertical fin failed almost simultaneously, approximately .4 seconds after the failure of the aft pressure bulkhead. Tubing for the four hydraulic systems, supplying hydraulic pressure to the flight control components in the vertical and horizontal stabilizer, were routed through the upper portion of the aft fuselage and lower portion of the vertical fin. The simultaneous failure of the APU firewall and vertical fin was suspected to have severed the hydraulic lines to all four systems, leading to the depletion of all four systems.

The loss of inherent stability, coupled with the loss of flight control hydraulics, left the crew with essentially no effective way to control roll, pitch, or yaw of the airplane. The use of engine thrust was used by the crew to initiate limited turning maneuvers and limited altitude changes. As exhibited by the flight path leading to the crash, flight path control was extremely difficult and eventually became impossible as the demands of control in all three axes became too complex to maintain the flight path required for straight and level flight and terrain avoidance.

Hydraulic System

The 747 has four independent hydraulic systems, each pressurized by an engine-driven pump and an air-driven pump, powered by engine bleed air that normally functions as a demand pump. The number-four system also incorporates an electrically driven pump as a standby source for hydraulic power in the event of a failure of all other pumps. The hydraulic system layout was designed so that "get-home" capability is achieved with any single hydraulic source available.

This is a schematic of the 747 hydraulic system, showing the system architecture. The table shows the distribution of various flight controls relative to the four hydraulic systems.

Hydraulic Systems Functional Assignments

The four hydraulic systems are generally separated, isolated from, and independent of each other, such that loss of fluid or a failure in one system will not result in a related failure in the other three systems. Similarly, hydraulic power for the flight control system is distributed among the four systems, so that a failure of a single system will not result in a loss of flight controls.

Due to space limitations in the aft fuselage, hydraulic lines for all four systems are located in close proximity to one another in the aft body, just behind the aft pressure bulkhead. The failure of the aft pressure bulkhead resulted in a large overpressure in the compartment behind the bulkhead, with one of the consequences being the failure of all four hydraulic lines. All four systems were rapidly depleted, leaving the flight crew with no means to move any of the flight control surfaces. The four hydraulic systems were most closely situated in proximity to the horizontal stabilizer jackscrew assembly. The collapse of the local support structure led to the rupture of all four hydraulic systems and to their depletion.

Back to top 

The accident was investigated by the Japan Ministry of Transport's Aircraft Accident Investigation Commission. They issued their aircraft accident investigation report on June 19, 1987. The findings contained in that report are summarized below:

The commission concluded that the accident was caused by deterioration of flying qualities and loss of primary flight control functions resulting from a rupture of the airplane's aft pressure bulkhead and the subsequent rupture of part of the aft fuselage, vertical fin, and all four hydraulic lines. These failures caused a loss of all primary flight control functions.  Empennage structure that departed the airplane as a result of the pressure bulkhead failure is shown below (cross hatched area).

These diagrams copied from the accident report show the details of the structural failures during the breakup sequence. The details document the damage to the aft fuselage, the vertical stabilizer, and the aft pressure bulkhead itself.

The aft pressure bulkhead ruptured because fatigue cracks propagating from the spliced section of the bulkhead's web weakened the bulkhead to the extent that it could no longer endure the in-flight cabin pressure.

The initiation and propagation of the fatigue cracks were attributable to improperly conducted repairs of the bulkhead in 1978. The fact that the fatigue cracks were not found in later maintenance inspections contributed to their propagation, leading to the rupture of the bulkhead.

The single (middle) rivet row became the origin of structural fatigue cracking. The cracks connected rivet-to-rivet and propagated through the "crack stop" straps. The modified splice error could not be found through visual inspection since the gap was filled with fillet sealant. The correct and incorrect configurations would appear identical when viewed from either side.

On June 2, 1978, during a landing incident at Osaka, the airplane experienced a tail strike. Several aft fuselage frames, skin, and aft pressure bulkhead were damaged. At the time, the airplane had 16,200 hours and 12,300 cycles. The airplane was repaired by a Boeing AOG team contracted to perform damage repair.

The AOG team replaced/repaired a major portion of the aft fuselage, replaced the lower half of the pressure bulkhead, and replaced the tail compartment pressure relief door.

The accident board estimated that the strength of the repair decreased to about 70% of the strength that would have resulted from a proper repair.

The Boeing 747SR-100 cabin pressure differential is selectable by the flight crew at 8.9 psi for high altitude/long range flights or 6.9 psi for low altitude/short range flights. The JAL structural inspection intervals were predicated on low altitude/short range flights (6.9 psi). However, JAL regularly operated at 8.9 psi. This operational inconsistency resulted in an acceleration of the fatigue related cracking, and it was estimated that the fatigue life of the bulkhead structure was reduced by approximately 6%.

The complete text of the findings from the accident report is contained at the following link: (Findings)

The complete text of the accident report can be viewed at the following link: (Accident Report)

Back to top

Based on their participation in the accident investigation conducted by the Japanese authorities, the National Transportation Safety Board (NTSB) made the following safety recommendations to the FAA:

Recommendation A-85-133 - December 5, 1985

Require the manufacturer to modify the design of the Boeing 747 empennage so that in the event that a significant pressure buildup occurs in the normally unpressurized empennage, the structural integrity of the stabilizers and their respective control surfaces will be protected against catastrophic failure, and to incorporate associated modifications on all Boeing 747 airplanes. Airworthiness Directive (AD) 86-08-02 was issued to address this recommendation.

Recommendation A-85-134 - December 5, 1985

Require the manufacturer to modify the design of the Boeing 747 hydraulic systems so that in the event a significant pressure buildup occurs in the normally unpressurized empennage, the integrity of all four hydraulic systems will not be impaired, and to incorporate associated modifications on all Boeing 747 airplanes. AD 87-12-04 was issued to address this recommendation.

Recommendation A-85-135 - December 5, 1985

Reevaluate the design of the Boeing 747 and 767 aft pressure bulkheads by requiring Boeing to analyze and test further the bulkhead to demonstrate the validity of the fail-safe "flapping" failure mode. This recommendation was incorporated into recommendation A-85-138.

Recommendation A-85-136 - December 5, 1985

Evaluate any procedures approved to repair Boeing 747 and Boeing 767 aft pressure bulkheads to assure that the repairs do not affect the "fail-safe" concept of the bulkhead design, which is intended to limit the area of pressure relief in the event of a structural failure.

The Structural Repair Manuals for the Boeing Models 707, 737, 747, and 767 were reviewed. The FAA found they do not contain any instructions that would be in conflict with the "fail-safe" concept.

Recommendation A-85-137 - December 5, 1985

Revise the inspection program for the Boeing 747 rear pressure bulkhead to establish an inspection interval wherein inspections beyond the routine visual inspection would be performed to detect the extent of possible multiple site fatigue cracking.

As a result, Boeing issued Service Bulletin 747-53-2275 requesting a visual inspection from the aft side of the pressure bulkhead at 1,000 flight-cycle intervals (for freighters) or at 2,000 flight cycle intervals for passenger airplanes. They further recommended after 20,000 flight cycles that a detailed inspection by high-precision eddy current, ultrasonic wave, and x-rays be accomplished at 2,000 flight-cycle intervals (freighters) or at 4,000 flight-cycle intervals for passenger airplanes.

Recommendation A-85-138 - December 5, 1985

Determine which transport category airplanes have dome-shaped aft pressure bulkheads and ascertain that the "fail-safe" criteria for the pressure bulkheads of those airplanes have been satisfactorily evaluated.

Fatigue testing and damage tolerance testing were completed on the Boeing 747 in March and July 1986, respectively. A reinforced aft pressure bulkhead was installed from line number 672, delivered in February 1987. The modification added two tear straps, a cover plate to the center of the bulkhead, and doublers to both sides of the bulkhead around the APU cutout.

Recommendation A-85-139 - December 5, 1985

Evaluate any procedures approved to repair the aft pressure bulkhead of any airplanes which incorporate a dome-type of design to assure that the affected repair does not derogate the fail-safe concept of the bulkhead. AD 85-22-12 was issued to address this recommendation.

Recommendation A-85-140 - December 5, 1985

Issue a maintenance alert bulletin to persons responsible for the engineering approval of repairs to emphasize that the approval adequately considers the possibility of influence on ultimate failure modes or other fail-safe design criteria.

The FAA issued Action Notice 8110.7, Approved Data, on November 18, 1986. It provides guidance to airworthiness inspectors on approval of major repairs and major alterations.

The complete text of the recommendations from the accident report is available via the following link: (Recommendations)

Back to top

This accident was the result of an improper repair, and as such has no pertinent regulations related to the design or operations of the airplane. 14 CFR part 43, titled "Maintenance, Preventive Maintenance, Rebuilding, and Alteration" addresses certain aspects of the repair performed on the airplane that eventually failed, resulting in the accident.

14 CFR 43.13

Although this airplane was operated by Japan Airlines, the subject repair was performed by the airplane manufacturer under contract to Japan Airlines.

Additionally relevant, if this repair had been performed on an airplane that was owned and/or operated by a U.S. carrier, the referenced regulation would have been fully applicable.

Back to top

Following the tail strike event at Osaka, seven years before the accident, JAL contracted with Boeing to perform the structural repair work. Boeing, as the original equipment manufacturer, would be expected to be in the best position to understand the repair complexity, and also most knowledgeable regarding design details of the model 747. It would also be expected that Boeing would be the most qualified organization to perform the highly complex structural repair. The repair involved a complete replacement of the lower half of the pressure bulkhead, numerous frames, stringers, and fuselage skin. During the bulkhead repair, difficulty in installation of a splice plate resulted in the Boeing repair crew dividing the plate and installing it in two pieces - a deviation from the repair instructions that, when complete, with sealant applied on both fore and aft surfaces, had the same appearance as a correctly installed splice plate.

Back to top

The following key safety issues existed at the time of this accident.

1. Improper repair of the aft pressure bulkhead.
2. Aft pressure bulkhead structural fatigue failure characteristics (i.e., crack propagation through tear stop straps).
3. Lack of independence of four hydraulic systems from a single failure event (zonal hazard). 
4. Vulnerability of the tail compartment to catastrophic damage resulting from explosive decompression (inadequate venting).

Back to top

The following design and safety assumptions proved to be flawed:

• The failure mode of the pressure bulkhead would be a single section flapping failure mode. Circumferential straps intended to prevent more than one sector from failing (i.e., crack stoppers) were an integral component of the design. The assumption was that if a crack were initiated and propagated, it could be detected and repaired before propagating beyond a single bay. A bay is defined as one area of the pressure bulkhead surrounded by stiffeners and tear straps. In this case, cracks initiated and propagated simultaneously in more than one bay and were difficult to detect because they were small. The cracks propagated along rivet holes at web overlaps. Therefore, in this case, the tear stop strap did not prevent a crack from progressing into multiple sections. During the airplane design phase, the configuration of tear stop straps installed on a compound curved panel (like the pressure bulkhead) was not adequately tested. Since the accident, tear strap testing has resulted in significant improvements in tear strap design.
• The independence of four hydraulic control systems was assumed. No zonal hazard analysis was performed on the torque box location.
• The design of the tail compartment pressure relief vent door (the capacity of the door) was predicated on aft pressure bulkhead failure with panel failure assumed to result in flapping of the associated bay. The actual level of pressure venting into the compartment was significantly greater than predicted. Vent door capacity and function are not verified by test.

Back to top

On October 2, 1971, a British European Airways Vickers 951 Vanguard airplane on a flight from London, England to Salzburg, Austria experienced a structural failure of the rear pressure bulkhead at an altitude of 16,400 feet. The aircraft spiraled down out of control and crashed in a field near Aarsele, Belgium, killing all 55 passengers and eight crew members. (Accident Summary)

Examination of the airplane revealed corrosion in the lower part of the rear pressure bulkhead underneath plating that was bonded to the structure. The bond was completely delaminated in this area and the bulkhead material literally eaten away. Tears ran upward and outward from the corroded area. The corrosion had probably required a relatively long period of time to develop and gave way on this particular flight to the stress created by pressurization. When the bulkhead ruptured, air from the cabin rushed into the empennage, which was not designed to withstand such internal pressure. Interior damage and severe distortion of the outer skin led to the failure of the tail surfaces causing the airplane to enter a steep dive from which recovery was impossible.

The corrosion was attributed to fluid contamination. It was not detectable through the normal maintenance procedures that consisted of both visual and radiographic inspection.

Subsequent to the accident, similar corrosion was found in eight other aircraft of the same type in Vanguard's fleet. Inspection procedures were revised, and the airplane modified to improve access to the inspected area. The frequency of inspections was increased considerably.

This accident, like the JAL 123 accident, resulted from a ruptured aft pressure bulkhead, which destroyed much of the control surface of the tail section. The rupture was preceded by fatigue cracking that was never found during inspections because it was very difficult to detect.

Back to top

Prior to this accident 14 CFR 25.365 had been amended at Amendment level 54 as a result of the DC-10 accident in Paris (discussed elsewhere in this library) in order to address the effects of rapid depressurization or bomb explosions. At amendment 71, as a direct result of the JAL 123 accident, 25.365 was further amended to address the affects of rapid depressurization of the pressure vessel into smaller compartments, and the effects on structure whose failure could compromise the capability for continued safe flight and landing. (14 CFR 25.365)

Further, as a result of this accident, several parts of Title 14 of the Code of Federal Regulations were modified to require repair assessment programs in order to operate airplanes with pressurized fuselages beyond certain specified life cycle implementation times. Parts 91, 121, 125, and 129 were all modified to require repair assessment programs. The specific regulations are available at the following links:
14 CFR 91.410 - General Operating and Flight Rules
14 CFR 121.370 - Operating Requirements: Domestic, Flag, and Supplemental Operations
14 CFR 125.248 - Certification and Operations: Airplanes having a Seating Capacity of 20 or More Passengers or a Maximum Payload Capacity of 6,000 Pounds or More; and Rules Governing Persons On Board such Aircraft
14 CFR 129.32 - Operations: Foreign Air Carriers and Foreign Operators of U.S.-Registered Aircraft Engaged in Common Carriage

In Addition, Advisory Circular AC 120-73, DAMAGE TOLERANCE ASSESSMENT OF REPAIRS TO PRESSURIZED FUSELAGES, was released as guidance on incorporating FAA-approved "repair assessment guidelines" in air carrier maintenance or inspection programs subject to Title 14, Code of Federal Regulations (14 CFR) part 121.

Back to top

AD 85-22-12 required a one-time visual inspection of the aft side of the aft pressure bulkhead for evidence of repairs or damage. It further required reporting of a complete description of the findings (sketches, photos, or drawings, as necessary) of the inspections.

AD 86-08-02 was issued on April 4, 1986. This AD became effective on May 19, 1986, and was applicable to all Boeing Model 747 series airplanes. It requires the addition of a structural cover for the opening within the empennage, which provides access to the vertical fin. This is to prevent structural failure of the vertical fin in the event of failure of the aft pressure bulkhead.

On May 26, 1987, the FAA issued AD 87-12-04 to require installation of a hydraulic fuse in the number four hydraulic system on Boeing Model 747 series airplanes. The AD became effective on July 13, 1987.

AD 87-23-10 was effective December 10, 1987, and required inspection for damage and cracking of the aft pressure bulkhead on Boeing Model 747 airplanes. This AD was later superseded by AD 98-20-20 which added repetitive inspections. AD 98-20-20 was, in turn, superseded by AD 2000-15-08, which requires that a one-time inspection to detect cracking of the upper segment of the bulkhead web be accomplished repetitively, and adds additional repetitive inspections to detect cracking of the upper and lower segments of the aft bulkhead web.

Back to top

Airplane Life Cycle:

• Maintenance / Repair / Alteration

Accident Threat Categories:

• Structural Failure
• Lack of System Isolation / Segregation
• Pressurization / Decompression Failures

Groupings:

• Loss of Control

Accident Common Themes:

• Organizational Lapses
• Human Error
• Flawed Assumptions

Back to top

Organizational Lapses

This particular airplane was operated by Japan Airlines in a high density seating configuration for use on short routes between Japanese cities. As such, the maximum enroute altitudes were generally low, well below those where maximum cabin differential pressure would be encountered. Based on the lower enroute altitudes and the lower differential pressures, Japan Airlines had adopted certain maintenance and inspection intervals based on the expected routine use of the lower pressure differentials. Operationally, flight crews tended to use higher differential pressures. The use of these higher pressures accelerated the fatigue-related damage to the aft pressure bulkhead and caused this fatigue damage to progress at a rate higher than the inspection and maintenance program anticipated. Use of the proper pressurization schedule would not have prevented the accident; however, the bulkhead failure would likely have occurred later in the airplane's life.

Human Error

Following the original repair, it was determined that certain fasteners had been installed with insufficient edge margins and required reinstallation. This reinstallation involved the incorporation of a splice plate that was difficult to fit into place. The installers cut the splice plate so that it would then fit properly, but when installed in this manner, the result was that only a single row of fasteners was bearing the entire load transmitted through that section of the pressure bulkhead. This error in installation led to the eventual failure of the fastener row and to the failure of the pressure bulkhead.

Flawed Assumptions

A basic design assumption regarding the aft pressure bulkhead was that only a single "bay" would fail at one time, resulting in a flapping of the failed section, which would be easily discovered. Tear straps, as part of the design, would prevent migration of a crack beyond the limits of a single bay. As it resulted, the eventual failure of the repaired section of the bulkhead rapidly migrated through several tear straps, and effectively separated the upper and lower halves of the bulkhead. The pressure relief features in the aft fuselage were overwhelmed, having only been designed to accommodate the pressure surge from the failure of a single bay. This cascade of failures resulted in the accident.

Unintended Effects

The design of the bulkhead repair was intended to distribute the bulkhead pressure loads among three fastener rows. The modification to the designed repair, in order to facilitate installation, inadvertently resulted in the entire load being borne by a single fastener row. This unplanned load distribution had the unintended effect of reducing the fatigue life of a primary structural element of the airplane.

Back to top

China Airlines Flight CI611, B-18255, May 25, 2002

China Airlines Flight CI611, a Boeing Model 747-200 series airplane, experienced an in-flight breakup over the Taiwan Strait. The most probable cause of the accident was the structural failure of a 22-year-old tail-strike repair located on the aft lower lobe of the fuselage. The skin scratches associated with the tail-strike had not been removed prior to installation of the permanent repair doubler. Over time and airplane cycling, multi-site cracking progressed from the scratches, ultimately leading to a catastrophic failure of the airframe.

See accident module

Aloha Airlines Flight 243, Boeing 737, April 28, 1988

As the airplane leveled at flight level 240 on an inter-island flight from Hilo to Honolulu, an 18-foot-long section of the upper fuselage, a little aft of the forward passenger entrance door, suddenly departed the airplane. This accident was the result of the fatigue failure of a three-row riveted lap splice joint and widespread fatigue damage that had occurred in the joint.

See accident module

Back to top

Technical Related Lessons:

Fatigue properties of complex structural elements should be well understood so that in-service maintenance programs are properly designed. (Threat Category: Structural Failure)

• Fatigue characteristics of the 747 aft pressure bulkhead assumed that a crack in any area of the bulkhead would be stopped/turned by the presence of tear straps and result in pressure venting in only one "bay" of the bulkhead. Post-accident testing revealed that tear straps were ineffective at stopping and turning cracks, in that cracks could propagate completely through the bulkhead, resulting in a catastrophic decompression event.

System redundancy and isolation should include assessment of both physical and zonal hazards. (Threat Category: Lack of System Isolation/Segregation)

• The four hydraulic systems on the 747 were physically isolated from one another and operated completely independently. As a design necessity, all four hydraulic systems had to be routed through the aft fuselage in order to provide hydraulic power to the elevator and rudders. The available space in the aft fuselage behind the aft pressure bulkhead was limited, and it required that hydraulic lines for all four systems be located in close proximity to one another. System isolation was retained, yet the close physical proximity allowed all four systems to be compromised when the aft pressure bulkhead failed. With the failure of the APU firewall, all four hydraulic systems were ruptured and rapidly depleted, leading to the inability to move any of the control surfaces, and eventually, to the loss of control. Following the accident, a hydraulic fuse was added to one of the four hydraulic systems such that if a system were ruptured, the fuse would prevent the loss of hydraulic fluid, and the fused system would continue to function.

Common Theme Related Lessons:

Aircraft maintenance programs should be developed consistent with actual aircraft operations. (Common Theme: Organizational Lapse)

• The accident airplane was configured and operated as a short-haul airplane in a high-density seating configuration and was used to carry a large number of passengers on relatively short trips between Japanese cities. Due to the short length of many flights, the airplane was operated at relatively low altitudes. The 747-maintenance manual allows structural inspection intervals to be based, in part, on selected cabin differential pressures. Lower cabin pressures allowed for longer intervals between inspections, while higher cabin pressures would require more frequent structural inspections. JAL maintenance inspection schedules were based on operations at lower cabin differential pressures. However, investigators determined that this airplane had been regularly operated at higher cabin differential pressures.

Repairs should be accomplished in a manner that preserves the original safety features of the airplane. (Common Theme: Human Error)

• Following the initial repair of the pressure bulkhead, a splice plate was required between the upper and lower halves in order to recover fastener edge margins that had been found to be inadequate. The splice plate turned out to be difficult to install and fit in place, and was cut into two pieces, allowing it to be more easily installed. The division of the splice plate resulted in the tensile loads between the upper and lower bulkhead portions being carried by only a single row of fasteners, rather than multiple rows, as had been intended by the original (one piece) design. The unintended load distribution resulted in a loss of strength in the repaired area, leading to the failure of the aft pressure bulkhead. 

Back to top