In-flight break-up involving Cessna T210M, VH-SUX

inspection program or life limit was necessary. Textron also advised that work on a certification program to install a new spar in the C210 with an updated configuration and material was ongoing. The ATSB acknowledged the safety action taken by Textron and welcomed its ongoing efforts to address the risk of cracking in wing spar carry-through structure of C210 aircraft used for low-level geophysical survey operations. However, the ATSB remained concerned by the indefinite nature of the proposed analysis and certification program. As such, the ATSB issued a recommendation to Textron that further action be taken to address this safety issue. Other significant safety action included FAA airworthiness directive (AD) AD 2020-03-16 for C210 models G through M. This AD, adopted on 21 February 2020, required visual and eddy current inspections of the carry-through spar lower cap and application of a protective coating and corrosion inhibiting compound. On 11 May 2021, the FAA also issued a notice of proposed rulemaking for a one-time inspection for C210 N and R, and C177 models. Safety message Maintenance inspections are often the sole opportunity to detect damage within an aircraft structure. When designing or altering maintenance inspections and their schedules, it is important to ensure that appropriate engineering judgment is applied to safeguard the ongoing airworthiness of the aircraft type. In this instance, had the previous eddy current inspection remained in place, it is almost certain that the fatigue crack within the wing spar carry-through would have been detected prior to the accident. This accident also shows that even when flying within operational limits, if an aircraft is operated in a flight profile for which it was not originally intended, its structure can fatigue more rapidly. The ATSB cautions geophysical survey aircraft operators that the terrain following flight profile may significantly increase aircraft fatigue damage accumulation. › v ‹ Contents Safety summary ....................................................................................................................... iii The occurrence ......................................................................................................................... 1 Context ....................................................................................................................................... 2 Personnel information 2 Pilot 2 Observer 2 Meteorological data 2 Aircraft details 2 Cessna 210 2 Wing spar carry-through structure 4 Cessna 177 5 VH-SUX 5 Aircraft loading 7 Operational information 8 Geophysical survey 8 Wreckage and site information 10 Visual examination 13 Scanning electron microscopy 18 Corrosion 20 Pitting corrosion 20 Corrosion damage growth 23 Operator system of maintenance 23 Wing spar carry-through inspections 23 Service letters and airworthiness directive 25 Inspection results 26 Airframe fatigue 26 Fatigue management 26 Wing fatigue components 27 Accident flight weight limit exceedance 27 Fatigue damage design guidance 27 Flight load fatigue spectra 27 Advisory Circular AC 23-13A 28 Recorded data 28 Survey acquisition system data 28 Survey flight data gathering and analysis 29 Data analysis findings 30 Similar occurrences 32 Safety analysis ........................................................................................................................ 34 Introduction 34 In-flight break up 34 Crack initiation 34 Maintenance inspection requirements 35 Inspections required at the time of the accident 35 Previous inspections 35 Flight profile fatigue damage and guidance 35 Aircraft modifications 36 Findings ................................................................................................................................... 38 Contributing factors 38 Other factors that increased risk 38 Other finding 38 › vi ‹ Safety issues and actions ..................................................................................................... 39 Safety recommendation to Textron Aviation 40 General details ........................................................................................................................ 42 Pilot details 42 Observer details 42 Glossary ................................................................................................................................... 43 Sources and submissions .................................................................................................... 44 Appendices.............................................................................................................................. 46 Appendix A – Wing spar carry-through examination 46 Scanning electron microscopy of corrosion damage 46 Metallurgical characterisation 55 Appendix B – In-flight fatigue load data gathering 59 Setup and Analysis of VH-JEI Survey Data 59 Methodology 60 Data verification 61 Accelerometer specifications 64 Appendix C – Maintenance inspection details 65 Supplemental Inspection 53-11-01 65 Airworthiness Directive AD/C210/61 Amendment 2 65 Australian Transport Safety Bureau ................................................................................... 67 ATSB – AO-2019-026 › 1 ‹ The occurrence At 1407 Eastern Standard Time1 on 26 May 2019, a Cessna Aircraft Company T210M (C210), registered VH-SUX (SUX) and operated by Thomson Aviation, departed Mount Isa Airport for an aerial geophysical survey flight with a pilot and observer on board. The survey segment of the flight commenced about 14 km to the north-west of the airport and was conducted at a height of about 200 ft above ground level (AGL) along parallel east and west lines (Figure 1). Figure 1: Accident flight overview with the accident site location (inset) At 1422, the flight crew commenced surveying in an easterly direction and then progressed northward with each subsequent survey line. One hour and 25 minutes later, at 1547, as the aircraft was flown west along the sixth survey line at a speed of 147 kt and a height of 193 ft AGL, the right wing separated from the aircraft. The structural failure led to a rapid loss of control and collision with terrain. The accident occurred about 25 km north-east of Mount Isa Airport. Both crewmembers were fatally injured, and the aircraft was destroyed. 1 Eastern Standard Time (EST): Universal Coordinated Time (UTC) + 10 hours. ATSB – AO-2019-026 › 2 ‹ Context Personnel information Pilot The pilot held a Commercial Pilot Licence (Aeroplane), a current Class 1 medical certificate and had accumulated about 3,955 hours of aeronautical experience. In the 90 days preceding the occurrence, the pilot had flown about 105 hours, all of which were in the C210 aircraft type. Observer The observer also held a Commercial Pilot Licence (Aeroplane), a current Class 1 medical certificate and had accumulated about 1,565 hours of aeronautical experience. In the 90 days preceding the occurrence, the observer had flown 3 hours (none of which were in a C210) and completed a gas turbine engine endorsement. Meteorological data A meteorological report for Mount Isa Airport, recorded at 1600, (13 minutes after the accident) included a south-easterly wind of 8 kt, visibility greater than 10 km, broken cloud2 at 9,221 ft above mean sea level (AMSL) and a temperature of 28 °C. Aircraft details Cessna 210 The Cessna Aircraft Company (Cessna) 210 is a high cantilever wing, piston-engine aircraft with a three-blade variable-pitch propeller and retractable tricycle landing gear (Figure 2). While suitable for the operation, the aircraft was not designed for dedicated low-level survey operations and was normally fitted with six seats for the transportation role. 2 Cloud cover: in aviation, cloud cover is reported using words that denote the extent of the cover – ‘broken’ indicates that more than half to almost all the sky is covered. ATSB – AO-2019-026 › 3 ‹ Figure 2: An unmodified Cessna T210M The aircraft type was produced and certified under United States Civil Air Regulations Part 3, effective 15 May 1956. Part 3 of the Civil Air Regulations did not require the calculation or provision of a defined fatigue life (see the section titled Airframe fatigue). The regulations required the aircraft designer to: ‘…avoid points of stress concentration where variable stresses above the fatigue limit are likely to occur in normal service’. During the period the aircraft type was manufactured, it underwent many variations and improvements. Often, when the manufacturer incorporated a variation, this was denoted by a change in the suffix letter of the aircraft designator. This commenced with the C210 and C210A, progressing alphabetically until the last manufactured model, the C210R which was released in 1985. Turbocharged and pressurised models were prefixed as T210 and P210, respectively. Early C210 models incorporated a strut-braced wing design. Commencing with the manufacture of the C210G model, the wing design was changed to a cantilever design removing the supporting struts of earlier models (Figure 3). The C210G was the first model to incorporate a carry-through structure, similar to that of SUX. The cantilever wing design continued through all subsequent models of the C210 until production concluded in 1986. In all, about 9,300 C210 type aircraft were produced by Cessna of which 7,225 had the cantilever wing design. Of these, 4,296 (models G through to M) had the same wing carry-through section as SUX. In 1992, the Textron industrial conglomerate purchased Cessna. At the time of the accident, Textron Aviation provided support for the aircraft type. ATSB – AO-2019-026 › 4 ‹ Figure 3: A 1960 C210A with wing struts (left) and a 1980, cantilever winged, C210N (right) Wing spar carry-through structure The wing spar carry-through is the primary structural element for carrying cantilever wing design lateral and bending loads. It comprises a single-piece forging fixed within the roof cavity, straddled directly overhead the front seats within the cabin region (Figure 4). The forging incorporates an I- beam shaped cross-section, with integral lugs at each end for wing attachment. Lugs integral to the forging ends also attached the wing spar carry-through to the root rib of the upper fuselage. Figure 4: Carry-through structure showing the left-wing attachment points For the C210G to C210M models, the carry-through structure was not painted with corrosion-inhibiting primer during manufacture and remained either bare metal or coated with a corrosion-inhibiting (non-primer) coating. For these models, the upper surface of the carry-through structure also formed part of the external top surface of the fuselage to which adjoining external skins were abutted. A foam section was glued to the underside surface of the carry-through structure to provide padding for the cabin headliner. In service experience showed that in these C210 models, the top surface design allowed moisture ingress and the foam section also absorbed and retained moisture. This led to the carry-through underside surface being susceptible to corrosion damage, particularly in the region of the foam ATSB – AO-2019-026 › 5 ‹ pad. Therefore, beginning with the C210N model, the design was changed to reduce corrosion susceptibility. These changes included the outer metal skin passing over and enclosing the carry-through top surface. The structure was also coated during manufacture with a corrosion inhibiting primer paint. Material Technical documentation supplied by the aircraft manufacturer for the construction of the carry-through spar specified a 2014-T6-series aluminium alloy, die forged and machined-finished to final dimensional tolerance. The 2014-series wrought aluminium alloys can be precipitation hardened.3 Cessna 177 The Cessna 177 (C177) is a four-seat high cantilever wing, piston-engine aircraft built by the Cessna Aircraft Corporation between 1968 and 1978. The C177 incorporated a similar wing spar carry-through structure as the C210. VH-SUX The aircraft (serial number 21061042) was manufactured in the United States in 1976 as a turbocharged T210L model which was updated to a T210M model prior to entry into service.4 History From 13 January 1976 until 31 August 1981, the aircraft was owned by the manufacturer, Cessna (Figure 5) and undertook flight testing and transport flights. Excluding the origin and destination of the transport flights, their purpose was unknown. Similarly, the specific nature of the flight testing was for the most part unknown. Flight records listed some as engine test, ice flight test or were referenced simply as ‘flight test’. Figure 5: VH-SUX (US registration N2075S) in service with Cessna Source: Cavanagh J & Shields K 1995, Standard catalog of Cessna single engine aircraft p748, Jones publishing, Wisconsin USA In August 1981, the aircraft was sold by Cessna. At that time, the aircraft had accrued 1,180.3 hours in service. Detailed records of the subsequent use of the aircraft while in the United States were not available. 3 Material strengths can be increased through a homogenising (solution) heat treatment followed by an artificial aging process; creating a distribution of micro-precipitates throughout the alloy that provides metallurgical strengthening effects. This solution-treated and artificially aged state is known as the T6 condition. 4 Changes from L to M model included the relocation of some switches to the glareshield, provision for a weather radar screen, a new landing gear handle design and relocation of the fuel gauges to the cabin floor. ATSB – AO-2019-026 › 6 ‹ In 2011 the aircraft was purchased by Thomson Aviation and imported into Australia. At that time, the aircraft had 5,933.8 flight hours in service. After arriving in Australia, the aircraft was modified for geophysical survey work. This included the removal of the passenger seats and the installation of specialised equipment. In June 2013, the aircraft commenced survey operations. The aircraft conducted 1,739 flights and accumulated 6,241.1 flight hours in the 6 years it was on the Australian register (an average of 3.59 hours per flight). It was operated exclusively as a geophysical survey aircraft during that time. The maintenance release was recovered from the wreckage and showed that: • There were no outstanding defects or maintenance requirements. • The last scheduled maintenance was a 110 hourly inspection conducted on 17 May 2019, 9 days prior to the accident, at 12,117.2 hours in service. • The total time in service before the accident flight was 12,174.9 flight hours. Suitability for operation The aircraft was used in the geophysical survey role as the C210 provided an economical platform which combined good speed, manoeuvrability, and its design provided maximum magnetic sensor performance. At the time of the accident, Thomson Aviation utilised five C210 aircraft for geophysical survey operations. Modifications Numerous modifications were incorporated into the aircraft during its service life as shown in Tables 1 and 2: Table 1: Modifications incorporated in the United States. Date Modification Note 1979 Conversion from L to M model August 1981 Complete de-ice system installation Removed June 2013 August 1981 Fuel system modification March 2001 Increase in maximum gross weight from 1,723 kg to 1,814 kg At 4,662 hours in service July 2010 Turbo-charged Continental TSIO-520 engine replaced with a naturally-aspirated Continental IO-550-P3B engine and matched propeller Table 2: Modifications incorporated in Australia Date Modification Note June 2013 • auxiliary fuel tanks installed in the left and right wing tips • radio altimeter installed • weather radar removed • satellite telephone system installed • survey equipment, including tail magnetometer, installed • four-point harnesses installed in pilot and observer positions ATSB – AO-2019-026 › 7 ‹ Figure 6 shows SUX in its modified configuration for geophysical survey flights, including the magnetometer boom. Figure 6: VH-SUX (as configured at the time of the accident) Source: Aircraft operator, annotated by the ATSB Auxiliary fuel tanks The aircraft was fitted with auxiliary fuel tanks providing an additional 125 litres of fuel capacity under a United States Federal Aviation Administration (FAA) supplemental type certificate (STC).5 These comprised an additional fuel tank in each wing tip from which the pilot could transfer fuel to the main fuel tanks using selectable electric pumps. This installation included the following operational limitation: For Models 210K, T210K, 210L, T210L, 210M, T210M, and 210N: “Design weights 3,800 lbs (1,723 kg). max. provided each wing tip contains 7 gallons (26.5 L) or more fuel and main tanks are 2/3 full or more. 3530 lbs (1,601 kg). max. with no fuel in wing tips.” The 1,723 kg maximum weight limitation of the auxiliary fuel tank installation conflicted with a previous FAA STC modification increasing maximum weight to 1,814 kg. The operational documentation provided for the aircraft did not provide a resolution to this conflict. The operator’s documentation for the aircraft listed the maximum take-off weight of 1,723 kg. The operator also advised that it was not aware of the modification increasing maximum gross weight to 1,814 kg and that all Australian operations had been undertaken with 1,723 kg as the assumed maximum allowable gross weight. Aircraft loading Standard loading for survey operations was one crewmember and full main and tip fuel tanks. This resulted in a take-off weight of about 1,672 kg and ensured the centre of gravity remained within balance limits. For the accident flight, the main fuel tanks were reportedly filled but the wing tip tanks were left empty. This was done to ensure the total weight remained below 1,723 kg while allowing for the increased weight of the observer. The weight and balance of the accident flight was estimated using: 5 A change to the design of a type-certificated aircraft, aircraft engine or propeller must be approved by an appropriate authority before it can be used. A supplemental type certificate is one method of obtaining such approval. ATSB – AO-2019-026 › 8 ‹ • recorded aircraft weight and balance data • the estimated weights of the pilot, the observer, and their personal belongings • the weight of the fuel reported to have been on board. The aircraft was calculated to have been inside balance limits with a take-off weight of 1,644 kg. This was 43 kg above the 1,601 kg maximum allowable weight for operations with the wing tip fuel tanks empty The maximum weight limitation for operation with tip tanks empty is intended to maintain similar bending loads for the wing and carry-through structure as those of an unmodified aircraft. Operations exceeding this weight without fuel in the tip tanks will increase fatigue damage accumulation within the carry-through structure (see the section titled Accident flight weight limit exceedance). Operational information Geophysical survey The operation was a geophysical survey of a large area of land surrounding Mount Isa (Figure 7). The flight was to be conducted at a target height of 60 m (200 ft) AGL and the normal C210 cruise speed of about 150 kt along parallel east and west lines, spaced about 90 m apart. These were supplemented by north and south data quality assurance survey lines spaced about 200 m apart (Figure 8). Figure 7: Overview of Mount Isa survey area with a close-up of the survey pattern (inset) Source: Operator and Google Earth, annotated by the ATSB ATSB – AO-2019-026 › 9 ‹ Figure 8: Recorded GPS flight path of accident flight Source: Recovered survey computer data and Google Earth, annotated by ATSB Topography The topography of the survey area included rugged hills separated by undulating valleys. The predominant vegetation was low open woodland over spinifex hummock grassland. The elevation range of the survey area varied from 1,000 ft to 1,700 ft AMSL. Flight profile and maneuvering As the survey flight path encountered terrain or obstacles along a survey line, the pilot climbed and descended the aircraft within the operational and performance limitations of the aircraft to maintain the target height as closely as possible. This resulted in a ‘draping’6 flight profile (Figure 9). At the completion of each survey line, the pilot climbed the aircraft to about 500 ft AGL and performed a turn at about 45° angle of bank to commence the next survey line in the opposite direction. 6 The flight profile was known as ‘draping’ due to its similarity to the appearance of a thin sheet draped over objects on a flat surface. ATSB – AO-2019-026 › 10 ‹ Source: Recovered survey computer data and Google Earth, annotated by the ATSB. Gust loading (turbulence) At the low levels of the survey flight profile, the survey aircraft were often affected by mechanical and thermal turbulence.7 Other survey pilots reported that turbulence experienced during survey flights was often severe. The operator had instructed the survey pilots to use their judgement to determine when the turbulence became too severe to continue survey operations. Crewing Normal crewing for a survey flight was one pilot. In addition to the pilot, the accident flight also carried an observer. The observer was a pilot for the operator and had recently arrived in Mount Isa to join the ongoing survey as an operating pilot. As was the operator’s normal practice, prior to commencing survey operations, a flight was operated with the new pilot in an observer role. The purpose of the observation was to familiarise this incoming pilot with the survey area including the pattern, airport, and topography. Wreckage and site information The accident site was located about 25 km north-east of Mount Isa Airport in flat, arid scrub land (Figure 10). The wreckage trail was on an approximate east to west heading, in line with the survey flight path. The right wing (Figure 11) was the first major component in the wreckage trail and was located about 130 m from the main wreckage. The aircraft impacted terrain about 90 m from the right wing, coming to rest a further 40 m away. 7 Mechanical turbulence is created by the movement of air across the terrain, vegetation, or any obstacles. The strength of the turbulence will increase with an increase in wind speed but will often be present even at light wind strengths. Thermal (convective) turbulence occurs when the sun heats the earth's surface unevenly. Certain surfaces, such as barren ground, rocky and sandy areas, are heated more rapidly than vegetation or water. Isolated convective currents are created leading to turbulence as an aircraft passes through. ATSB – AO-2019-026 › 11 ‹ Figure 10: Accident site overview looking south-east Source: ATSB Figure 11: Separated right wing viewed from the inboard end Source: ATSB All major aircraft components were accounted for at the site. The structure was significantly disrupted with the aircraft fuselage, tail, and left wing located towards the end of the wreckage trail. The left wing was fractured into two pieces, resting upside down and in the opposite direction ATSB – AO-2019-026 › 12 ‹ to flight. The wing spar carry-through structure attached to the left wing showed a fracture surface that corresponded with the remaining carry-through section from the right wing (Figure 12). Figure 12: The fractured carry-through structure as removed from the wreckage viewed from the rear Source: ATSB On-site site examination of the wreckage indicated the right wing and part of the wing spar carry-through (see the section titled Wing spar carry-through structure) had separated from the aircraft. Preliminary examination of the carry-through spar identified that it had fractured through an area of pre-existing fatigue cracking inboard of the wing attachment lugs (Figure 13). The carry-through structure was removed from the accident site and transported to the ATSB technical facilities in Canberra for detailed metallurgical examination. ATSB – AO-2019-026 › 13 ‹ Figure 13: Main spar carry-through fracture surface showing area of fatigue cracking on the lower spar cap Note: The two brown blemishes in the area of fatigue cracking were substances deposited onto the fracture surfaces during the accident. Source: ATSB Further examination of the wreckage was limited by the extensive damage to the aircraft. However, the evidence indicated that the engine was driving the propeller at impact. Other than the wing spar carry-through structure cracking, no pre-existing defects were identified. Metallurgical examination Visual examination A visual inspection of the carry-through structure showed that it had fractured just outboard of a thickness transition between the wing lug base region and the central beam; approximately 290 mm from the right root rib attachment lug (Figure 14). ATSB – AO-2019-026 › 14 ‹ Figure 14: An exemplar Cessna 210N wing spar showing the approximate location where cracking had developed on the carry-through from SUX Note: This C210N wing spar carry through was coated during manufacture with a corrosion inhibiting primer paint. Source: Civil Aviation Safety Authority, annotated by the ATSB Almost the entirety of the spar was a light yellow/green colour, which was consistent with the application of the specified corrosion inhibiting chromate surface film. No evidence was found to indicate the chromate had been reapplied since manufacture. The foam section normally glued to the underside surface of the carry-through structure was absent. The uppermost portion of the spar had been painted white, consistent with the C210M design where that portion of the spar formed a segment adjoining the external roof skin panels of the aircraft (Figure 15). Figure 15: The carry-through spar in the ATSB laboratory Source: ATSB The visual examination also identified that pitting corrosion damage had developed at multiple discrete locations along the underside surface of the spar (Figure 16). The corrosion damage was also identified adjacent to the fracture plane and confined to the underside surface with no evidence of corrosion on other parts of the structure. ATSB – AO-2019-026 › 15 ‹ Figure 16: Carry-through underside surface showing pitting corrosion. Source: ATSB Fracture surfaces The fractured section of the carry-through spar was examined at varying magnifications using a binocular microscope. The lowermost section of the carry-through spar contained two separate failure mechanisms. Most obvious, was a region of generally flat fracture containing a series of concentric marks (beach marks), consistent with the typical appearance of fatigue cracking (Figure 17). The remaining regions on the fractured spar presented a dull, fibrous and angular appearance consistent with ductile fracture from overstress conditions (Figure 18). Figure 17: Key measurements of the fatigue portion along the fracture surface Note that cracking has commenced on the underside surface (inverted in figure) of the carry-through spar. Source: ATSB ATSB – AO-2019-026 › 16 ‹ Figure 18: The spar fracture surfaces showing a side-by-side comparison Source: ATSB The concentric radiating features present on the fracture showed that fatigue cracking had initiated at a localised underside surface position. A series of ridges (river lines) across the fracture plane at the intersection with the underside surface indicated that fatigue cracking had initiated from a discrete origin (Figure 19). Further inspection revealed that the crack origin was associated with the presence of pitting corrosion that had penetrated and damaged the spar (Figure 20). ATSB – AO-2019-026 › 17 ‹ Figure 19: Close-up view of the fracture surface surrounding the corrosion pit cluster at the fatigue crack origin The fracture surface shown was located on the inboard portion of the carry-through structure. Source: ATSB ATSB – AO-2019-026 › 18 ‹ Figure 20: View of the underside surface showing a corrosion pit cluster at the fatigue crack origin The surface shown was located on the inboard portion of the carry-through structure. Source: ATSB As the fatigue crack had grown and approached a critical size,8 10 to 12 outer bands of crack progression were linked by bands of tearing (or overstress). These bands were an indicator of accelerating, rapid crack growth that developed in the final period of operation prior to the accident. Detailed measurement of the final band prior to the fatigue-overstress indicated a length of between 0.4 to 0.5 mm. The optical examination did not identify any evidence of finer fatigue striations that might have been associated with an individual load cycle, or a discrete event such as a ground-air-ground cycle (take-off and landing). Crack measurements Measurements of the significant features from the fractured spar structure showed that the fatigue cracking grew transversely in a vertical plane before reaching a critical depth of approximately 16 mm toward the web. When measured from the underside surface, the crack had a surface length of approximately 42 mm. The extent of fatigue cracking in the critical section of lower flange was calculated to represent close to 38 per cent of the cross-sectional area of the spar that was in tension (during positive-G flight). Scanning electron microscopy Scanning electron microscopy (SEM) techniques were used to closely examine and characterise the surfaces of the fractured carry-through spar and to further support the visual assessment. 8 Critical crack size is the length at which a crack becomes unstable at certain applied stress. In an unstable crack, crack propagation, once started, continues spontaneously without an increase in magnitude of the applied stress. Overstress failure occurs very rapidly once an advancing crack reaches a critical size. ATSB – AO-2019-026 › 19 ‹ Semi-quantitative energy dispersive x-ray spectroscopy was also used to assist in analysis of the products that had formed within the corrosion pits (refer to Appendix A for additional detail). SEM of fractured lower carry-through spar Distinct fracture morphologies (origin, fatigue and overstress) from the section of lower carry- through spar were confirmed via examination in the scanning electron microscope. SEM of the fracture origin identified that the corrosion pit damage that initiated the cracking was characterised by an amorphous corrosion product. The corrosion damage transitioned into an underlying zone of intergranular cracking at the base of the pit, before transitioning toward fatigue cracking. Other corrosion pits that were examined on the underside surface of the carry-through spar were also identified to have generated fine intergranular corrosion cracks that penetrated into the base alloy. The fatigue portion of the fracture was a mixture of predominantly transgranular striations interspersed with some ductile tearing. The fatigue cracking was clearly identifiable through the presence of ‘river’ lines that were directed from a single region of corrosion pitting on the underside surface. The overstress region was defined almost entirely by micro-void coalescence, features that confirmed that the final fracture was ductile in nature. Crack analysis The fatigue crack that had initiated within the lower spar cap reached a critical depth of about 16 mm (measuring 42 mm in length along the underside surface), at which point structural failure occurred. Tear bands developed as the crack increased in depth as it progressed through the structure toward the web. The tear bands showed that the stresses within the structure were increasing and further indicated that the rate of crack growth was accelerating as it progressed. Crack growth rate In-service exposure to stresses within the wing spar carry-through are variable and their magnitude is affected by factors such as aircraft weight, take-off and landing cycles, speed and the type and severity of operations being flown. Gusts and manoeuvres of varying magnitudes are the typical in-flight loads affecting wing structure fatigue life. The load regime imparted though the wings to the carry-through structure during the service life of the aircraft throughout the period of crack growth was normalised to the following load types. • gust loads/aerodynamic buffeting (short interval, less than 2 seconds, both negative- and positive-G • manoeuvre loads (longer interval, typically greater than 2 seconds, both negative-G and positive-G) • taxiing loads • take-off and landing loads (ground-air-ground cycles) Each load type varied in magnitude; however, it was the take-off and landing loads (ground-air- ground cycles) that were most likely to impart an identifiable, unique and repeatable signature on the fatigue fracture surfaces. This was due to the equivalent loading sequence imparted as the lower spar cap transitions from tension (during flight) to compression (during landing). The SEM examination also revealed a very high number of striations present throughout the fatigue fracture surface (Figure 21). These were only evident and able to be identified when viewed at very high magnifications (1,400 to 2,500 times magnification) and were less than 1-micron in spacing. It is probable that the very fine sub-micron striations leading to crack growth were produced from lesser loads as the aircraft was manoeuvred and affected by gust loads. Separating the very fine striations were regions identified as ‘unique’ progression bands. In this case, the ‘unique’ progression bands were identified across almost the entirety of the fatigue fracture surface and consisted of regularly repeating units. Due to the regularity of the progression ATSB – AO-2019-026 › 20 ‹ marks, in combination with their identifiable and consistent features, it was probable that these bands represented ground-air-ground cycles. Figure 21: Scanning electron microscopy of the fracture surface The fracture surface shown was located on the inboard portion of the carry-through structure. Source: ATSB Measurement of the unique features was performed across the fatigue crack front. The number of unique progression bands during this period of crack growth was estimated by taking the average spacing between each measurement interval and dividing this striation spacing into the interval, then summating the numbers for each interval. The distance between each ‘unique’ progression band was one flight cycle. A quantitative assessment of the fracture established that fatigue cracking had probably developed over a sustained period of operation of about 3,300 hours of time in service. Corrosion Pitting corrosion Pitting corrosion, (Figure 22) as found in the carry-through underside surface on SUX, was described in the Cessna C210 service manual as: The most common effect of corrosion on polished aluminium parts is called pitting. It is first noticeable as a white or grey powdery deposit, similar to dust, which blotches the surface. When the deposit is cleaned away, tiny pits can be seen in the surface. ATSB – AO-2019-026 › 21 ‹ Figure 22: Pitting corrosion diagram Source: Textron Aviation Accident spar corrosion damage To the unaided eye, the underside surface of the fractured spar appeared in relatively good condition. There were minor amounts of pitting damage along the underside surface, but no significant corrosion products (aluminium oxides), nor any significant scoring, gouging or related mechanical damage present. Very fine marks were noted on the underside surface, which were consistent with the final-finish machining processes and very likely remnant from original manufacture. The were no indications of rework or blending of the underside surfaces that might have otherwise indicated repair of previously identified corrosion damage. Inspection of the carry-through spar surfaces at higher magnifications using a binocular microscope identified the extent to which the structure had sustained corrosion damage during its service life, prior to the failure. The corrosion had led to the development of clusters of micro-pits on the underside of the carry-through spar. In the absence of corrosion protection, pitting of that nature is not unusual for the aluminium alloy used in the manufacture of the spar. Detailed visual inspection of the corrosion damage on the underside surfaces suggested there were no other secondary micro-cracks present in the structure. To confirm that visual assessment, a non-destructive examination of the spar structure was completed using fluorescent penetrant techniques (Figure 23Error! Reference source not found.). No additional cracks were detected on the structure, including the underside surface (where the cracking had initiated) as well as the outboard attachment lugs. ATSB – AO-2019-026 › 22 ‹ Figure 22: Composite image of the carry-through spar during liquid fluorescent penetrant inspection Source: ATSB Corrosion assessment and repair Prior to the accident, Textron Aviation and Civil Aviation Safety Authority (CASA) maintenance inspections stipulated that if corrosion was identified during inspection then either Textron Aviation or another authorised design organisation should be contacted. The authorised organisation (usually Textron Aviation) would assess the damage and either recommend a repair, or in severe cases, replacement of the carry-through. In the event that a repair scheme was recommended by a design organisation other than Textron, CASA would assess and approve the repair scheme for compliance. Textron Aviation advised that, prior to the accident and for the level of corrosion found on the structure recovered from SUX (without knowledge of any fatigue cracking), the following repair process would have been provided: a. Remove any corrosion using a 20:1 blend ratio. b. Measure remaining thickness of the spar as well as the thickness of both upper and lower caps and web at the blended location. c. Report measurements to Cessna Customer Service on the Structural Damage Report form d. Repair engineering would use the measurements to determine if the spar is still serviceable with the noted measurements. Following the accident, the manufacturer provided the following criteria to assess the damage severity: Scenario 1: “Nothing to see here” If the intent of the service letter [see the section titled Service letters and airworthiness directive] is complied with, no cracks are noted after non-destructive inspection (NDI), and the corrosion is surface corrosion only, the customer will just send us the Carry-thru Inspection Report and no further input is needed from us. Scenario 2: “Superficial corrosion” If the intent of the SEL is complied with, no cracks are noted after NDI, but more than minor surface corrosion is noted and removed, than any material removal less than 0.010” (0.254 mm) deep may be considered minor provided a thorough review of the aircraft’s maintenance records/logbook indicates no prior blending to the carry-thru spar has occurred. If no prior blending is discovered, a Minor repair memo can be issued…if a detailed damage report all pertinent repair data is provided. Scenario 3: “Material removed and needs engineering review” If the intent of the SEL is complied with, no cracks are noted after NDI, and the removal is in excess of 0.010” (0.254 mm) deep than a detailed damage report (same as Scenario 2 above) must be sent to Textron Aviation Engineering for specific detailed analysis and review for a FAA approved field repair. ATSB – AO-2019-026 › 23 ‹ Scenario 4: “Replace the carrythru” If inspection (visual or NDI) reveals a crack indication, severe intergranular corrosion or material removed in the ‘arm pit’ is in excess of 0.040” (1.016 mm) deep (Models “G” thru “M”) or in excess of 0.030” deep (Models “N” & “R”) the spar carrythru must be replaced and no further flight is permissible. Based on the manufacturer’s criteria, most of the corrosion identified on the carry-through under surface of SUX was in the scenario 2 ‘superficial corrosion’ (less than 0.010 inches (0.254 mm) deep) which would have required minor repair. However, there were four corrosion pits identified that were in the scenario 3 ‘material removed and needs engineering review’ (exceeding 0.010 inches (0.254 mm) but less than 0.040 inches (1.016 mm) deep). Corrosion damage growth The rate of corrosion damage growth to an alloy such as 2014-T6 changes with exposure to external factors such as: • oxygen availability • presence of electrolytes (e.g. salts) • mechanical stress • time of exposure The unknown variations in these factors prevented determination of the rate of corrosion growth for the corrosion identified on the recovered wing spar carry-through structure. Maintenance Operator system of maintenance The operator had their own CASA-approved system of maintenance. The maintenance schedule incorporated the: • generic Civil Aviation Safety Authority system of maintenance (CAAP 42B-1(1)) • Cessna Supplemental Inspection Documents (SID’s) • Cessna corrosion prevention and control program (CPCP). The addition of geophysical survey equipment resulted in several other inspections also being integrated. Due to the high hours and low cycles generated by the work undertaken, the system of maintenance allowed for 100 hourly inspections to be extended to 110 hours and 200 hourly inspections to be extended to 220 hours. The frequency of the inspections of the wing carry-through structure in the area of the fatigue crack was not altered from the normal Cessna maintenance schedule as it was based on calendar time, not flight hours. For maintenance purposes the operator considered that the aircraft was being operated in a severe9 environment and severe usage in accordance with the Cessna maintenance schedule. Wing spar carry-through inspections Removing the cabin interior roof lining allowed good access to the carry-through structure for inspections (Figure 24). 9 Two types of inspection requirements were available (Typical and Severe) based on operating usage and environment. ATSB – AO-2019-026 › 24 ‹ Figure 23: View of the carry-through structure looking aft with the cabin lining removed Note: This C210N wing spar carry-through was coated during manufacture with a corrosion inhibiting primer paint. Source: ATSB The entire wing spar carry-through structure had several inspection requirements which could be either calendar time and/or flight time based. If the scheduled checks were solely determined by calendar time, the number of flights between inspections was unrestricted. Such inspections were generally designed to identify corrosion, which is unaffected by flight cycles. Required inspections The area of the fatigue crack in SUX was subject to a manufacturer-directed visual inspection and a similar visual inspection directed by a CASA-issued airworthiness directive. It should be noted that all inspections of the underside surface of the structure at the time of the accident were calendar time based. Prior to the accident, the last detailed visual inspections undertaken of the carry-through structure were: • Supplemental Inspection (SID) number 53-11-01 – Carry-through spar corrosion inspection, initial interval 10 years with repeat inspections every 3 years. The last inspection was conducted on SUX on 10 November 2017, 1,746.4 flight hours prior to the accident. Maintenance logs recorded no defects were identified. • AD/Cessna 210/61 Amdt 2 – Inspection of entire wing carry-through structure for corrosion every 10 years. Thereafter every 6 years, or if the spar carry-through has been subjected to an approved corrosion protection scheme, 12 years. This inspection was last conducted on SUX on 22 December 2017, 1,531.6 flight hours prior to the accident. Maintenance logs recorded no defects were identified. Cancelled inspection As a result of fatigue concerns resulting from incidents on other models, on 1 July 1992, the manufacturer introduced Continued Airworthiness Program (CAP) inspection number 57-10-08. ATSB – AO-2019-026 › 25 ‹ That inspection required a visual and eddy-current10 inspection of the underside surface of the carry-through. For normal operations, it was to be undertaken initially at 12,000 hours of service and repeated every 6,000 hours. For the low-level overland survey flight profile, the inspection required significantly reduced intervals: Should any history of low-level overland survey or patrol exist then the initial inspection compliance is 4000 hours with repeat inspections at 400-hour intervals thereafter. The manufacturer advised that testing of a C210G carry-through structure showed the lower centre wing attachment lug to be a critical area. These test results led to the introduction of the inspection. The manufacturer could not produce any documentation indicating why the underside surface of the carry-through structure was also included in this inspection. This inspection was subsequently cancelled by the manufacturer in 2012 (1 year before SUX commenced operations in Australia). SUX started low-level overland survey flights in 2013 at 5,933.8 total hours in service and did not reach the threshold for the initial inspection requirements before the inspection was cancelled. CAP inspection 57-10-08 was replaced with the visual supplemental inspection number 53-11-01, which was mandatory in Australia. The manufacturer stated that the requirement for an eddy current inspection was removed because: Cessna decided to develop history based SID documents for the 100 and 200 series fleet… The inspections were intended to be visual for lower time airplanes. Non‐destructive inspections were called out only for high time airplanes or in situations where visual inspections would not reliably find the crack. There was no field history of the carry‐thru spar cracking. The only cracks were those observed in cyclic testing which were found in the lower lugs [wing attachment points]. The known field issue with the carry‐through is corrosion, and there have been many instances of corrosion being severe enough to require replacement of the carry‐thru. Thus, the SID addressed the history of the part which are the corrosion inspections found in 53‐11‐01. Post-accident Cessna 210 fleet inspections Service letters and airworthiness directive On 24 June 2019, the manufacturer released service letters SEL-57-06 for the C210 and SEL-57- 07 for the C177. These service letters required a one-off inspection of the carry-through structure and communication of inspection findings to the manufacturer. On 4 November 2019, following the analysis of findings from the previously released service letters, the manufacturer released updated SEL-57-08 for the C210 and SEL-57-09 for the C177. On 19 November 2019, the manufacturer released further minor revisions to these updated service letters. On 21 February 2020, the United States Federal Aviation Administration (FAA) adopted Airworthiness Directive (AD) AD 2020-03-16 for all Cessna model 210G, T210G, 210H, T210H, 210J, T210J, 210K, T210K, 210L, T210L, 210M, and T210M aircraft. This AD required: • visual and eddy current inspections of the carry-through spar lower cap • corrective action if necessary • application of a protective coating and corrosion inhibiting compound • reporting the inspection results to the FAA. 10 Eddy-current testing is an electromagnetic testing method used in non-destructive testing. This testing makes use of electromagnetic induction to detect and characterise surface and sub-surface flaws in conductive materials. ATSB – AO-2019-026 › 26 ‹ Inspection results Service letter inspection results Following the release, Textron Aviation advised that 196 reports had been received regarding SEL-57-06. Of these, 69 (35 per cent) reported that corrosion was identified and 11 carry-through structures (6 per cent) were removed from service. FAA AD inspection results At the time of writing, the FAA had received 923 reports. Of these, 430 (47 per cent) reported corrosion and 57 carry-through structures (6 per cent) were removed from service. These inspection results were provided to the ATSB which highlighted a considerable variance across the fleet. Some aircraft displayed significant corrosion damage to the underside surface of the carry-through spar (Figure 25). For those aircraft, there appeared to be major intergranular cracks present. While it was not known how many of these structures were subsequently inspected for fatigue cracking, additional instances of fatigue cracking, as found in SUX, were reported. Figure 24: Examples of severe carry-through structural corrosion damage identified through SEL 57-06 inspections Source: Textron Aviation Airframe fatigue Aircraft should be designed so that the stresses in their structures from the expected flight loads do not exceed the strength of the materials from which they are constructed. However, the materials used to construct aircraft can be damaged by fluctuations in those stresses, even if they are below the static strength of the material.11 The damage from each stress fluctuation is small, but the accumulation of many stresses over time can result in significant damage. The accumulated damage from these fluctuating stresses is referred to as ‘fatigue damage’. Fatigue damage leads to the formation of cracks in the aircraft’s structure. Cracks reduce the load-carrying capability of the structure, which if not managed, can ultimately lead to in-flight structural failure. Fatigue management There are currently three basic design approaches for managing fatigue in aircraft structures: safe-life, fail-safe, and damage tolerance. The FAA document AC 23-13A ‘Fatigue, Fail-Safe, and Damage Tolerance Evaluation of Metallic Structure for Normal, Utility, Acrobatic, and Commuter 11 The static strength of the material is the maximum strength the material can sustain if the load is applied slowly then held constant. ATSB – AO-2019-026 › 27 ‹ Category Airplanes’ (see also the section titled Fatigue damage design guidance) defines these approaches as follows: The safe-life of a structure is that number of events, such as flights, landings or flight hours, during which there is a low probability that the strength will degrade below its design ultimate value due to fatigue cracking. Fail-safe is the attribute of the structure that permits it to retain its required residual strength for a period of unrepaired use after the failure or partial failure of a principal structural element. Damage tolerance is the attribute of the structure that permits it to retain its required residual strength for a period of use after the structure has sustained a given level of fatigue, corrosion, accidental, or discrete source damage. Safe-life design is intended to have the structure retired before there is a likelihood of fatigue cracks affecting its strength. Fail-safe means that redundant structure will cope with the failure of major structure until it is discovered during an inspection program. Damage tolerance relies on detection of cracks through a specifically designed inspection program to ensure that cracks from fatigue, corrosion or accidental damage are identified before they become large enough to sufficiently degrade the remaining strength. Wing fatigue components Wing fatigue life calculations break the analysis down into four loading spectra components: • flight loads • taxi loads • landing impact loads • ground-air-ground cycles. Flight loads are further split into gust and manoeuvre components. The fatigue life is split into various components to enable designers to then apply those components of the calculation to their assumed flight load profile. For example, training aircraft will have a more severe manoeuvre loading spectra and ground-air-ground cycles than an executive aircraft. Likewise, low-level survey aircraft will have a more severe gust loading spectra than a personal aircraft. When determining the fatigue damage endured by a structure, it is straightforward to separate flight loads from landing loads or taxi loads as they are distinct phases of flight. Separating manoeuvres from gusts is more difficult, particularly as they can occur simultaneously at different magnitudes. Accident flight weight limit exceedance The aircraft commenced the accident flight with a gross weight about 43 kg above the 1,601 kg maximum allowable weight for operations with the wing tip fuel tanks empty. The ATSB assessed this exceedance to determine its possible contribution to the accident. As the fatigue crack was well developed prior to the accident flight and the aircraft remained within other weight and balance limitations, this exceedance was determined to not have had a significant effect on fatigue damage accumulation for SUX or otherwise have contributed to the accident. Fatigue damage design guidance Flight load fatigue spectra Regardless of the fatigue management approach used, designers aim to understand how the in-flight stresses vary within the structure over the life of the aircraft. This will depend on a broad range of factors, from the weight for each flight, the environment in which the aircraft is operated, ATSB – AO-2019-026 › 28 ‹ to the manner the aircraft is operated. The designer cannot know all of these factors in advance for each aircraft, so they typically use an assumed load spectrum that will represent that design. Flight load spectra for fatigue analysis purposes are typically presented as the distribution of the number of times that a flight load factor would be exceeded for a range of flight load factors within the normal flight envelope. For example, flight load factors of about 1g would be expected to occur often, whereas loads near the limit load factor would be rare. Since the design of the C210, the FAA has developed and released its own flight load spectra for aircraft operating in various roles. These are contained in FAA Advisory Circular AC 23-13A. Advisory Circular AC 23-13A In 2005, the FAA released Advisory Circular AC 23-13A ‘Fatigue, Fail-Safe, and Damage Tolerance Evaluation of Metallic Structure for Normal, Utility, Acrobatic, and Commuter Category Airplanes’. This details an acceptable means of showing compliance with Title 14 Code of Federal Regulations (14 CFR), Part 23. This guidance is applicable to fatigue, fail-safe, and damage tolerance evaluations of metallic structure in normal, utility, acrobatic, and commuter category airplanes. In developing the Advisory Circular, multiple aircraft in various operational and airworthiness categories were used to record data. This data was manipulated to generate gust and manoeuvre load spectra graphs. These were combined for multiple aircraft in a given category to develop an average load spectrum as defined in the FAA Memorandum associated with AC 23-13A.12 Assessments were then made with regards to developing curves that would capture an adequate number of aircraft in the fleet and ensure the resulting failure rate would be tolerable. The FAA chose 1.5 standard deviations above the mean value to ensure a 99.9777 per cent chance of an aircraft meeting its claimed fatigue life without developing a detectable crack. Thus, data in the Advisory Circular is presented against both the design requirements and a mean distribution to give context to the results. It should be noted that review of technical documentation referenced by the Advisory Circular shows that AC 23-13A spectra for survey aircraft were developed from two sample aircraft conducting pipeline patrol survey13 work. Recorded data Survey acquisition system data The survey system on board SUX recorded various parameters including laser height, radio height and barometric pressure along with differential GPS positions (Figure 26).14 Data was recovered from this system which captured the accident flight until a point 160 m prior to the initial impact point. This included indications consistent with the separation of the right wing commencing about 285 m prior to the initial impact point. 12 FAA Memorandum Method of Establishing Flight Load Spectra for Safe-Life Fatigue Analysis, March 25, 2005. 13 Pipeline patrol survey operations are typically conducted at higher level and do not involve the terrain-following profile of geophysical survey flights. 14 Differential GPS uses differential calculation techniques to improve the accuracy of GPS location data. ATSB – AO-2019-026 › 29 ‹ Figure 25: Depiction of the recorded GPS data of the final moments of the accident flight Source: Recovered survey computer data and Google Earth The data showed that immediately prior to the in-flight breakup, the aircraft was in near level flight at a height of 193 ft AGL and a ground speed of 147 kt. Analysis of differential GPS data The ATSB further examined the differential GPS data to determine a manoeuvre fatigue load spectrum for the aircraft during the accident flight. However, limitations in the derivation of these loads prevented a robust analysis. The sample rate of the data (2 Hz) was not sufficient to determine gust loads and could only be used to derive a manoeuvre spectrum. Additionally, there was no effective way of validating the accuracy of the derived accelerations. To address the limitations of the data recovered from SUX, the ATSB, in cooperation with the operator, undertook data gathering to determine in-flight loads associated with the geophysical survey flight profile. To do this, an accelerometer module was fitted to another Thomson Aviation C210N, VH-JEI (JEI). Survey flight data gathering and analysis The accelerometer fitted to JEI was rigidly mounted, near the aircraft’s centre of gravity and sampled by the survey computer at 20 Hz. This resolution enabled derivation of both manoeuvre and gust spectra. Data encompassing 95 flights (374.6 hours and 49,755 NM) over a period of 10 weeks during autumn in 2020 was sampled and analysed. This included the survey commenced by SUX near Mount Isa and a section of another survey area near Parkes, New South Wales. As the C210 was certified under Part 3 of the United States Civil Air Regulations and has no defined fatigue life, no comparative data was available. Therefore, the aim of the data gathering was to compare results to FAA manoeuvre and gust load spectra for survey work as provided in AC 23-13A. The aircraft was assessed against Advisory Circular flight load spectra for executive usage15 and survey (pipeline patrol). The FAA presented data from multiple sources based on sampling flights and aircraft in a similar manner to this project. In fact, in designing this program of data gathering, elements were chosen such that correlation with past data collection would be achievable. However, data collection has 15 single-engine executive usage (non-pressurised, engine power output greater than 185 hp) ATSB – AO-2019-026 › 30 ‹ changed over the years. The original data collection in the 1970’s used photographic film exposed to light. For this program, completely digital methods were being used. When differentiating manoeuvres from gusts, the ATSB considered any loading event which deviated from normal acceleration (1g) for more than 2 seconds as a manoeuvre and any less than 2 seconds is a gust. This is the same method as that used in AC23-13A. Data analysis findings Manoeuvre loads Examination of the data from JEI identified that, with respect to manoeuvre loads, the rate of heavier pitch up manoeuvres (above 2g) were about usual for a survey aircraft but lighter pitch up manoeuvres (up to 1.75g) tended to occur much more often, even above the AC 23-13A survey spectra design curve. For pitch down manoeuvres, virtually all manoeuvre counts greatly exceeded the mean and design curves. Only for pitch down manoeuvres below -0.15g did the manoeuvre counts fall below the design criteria. For the type of survey work being conducted by the operator, quite forceful manoeuvring was required, particularly for pitch down manoeuvres. Additionally, the total number of manoeuvres was high and the balance of pitch up and pitch down manoeuvres was relatively equal. For normal operations (personal, training, executive) pitch up manoeuvres are assumed to outnumber pitch down manoeuvres by a significant margin. In fact, between 0.7g and 1g away from normal acceleration, the number of pitch up manoeuvres will exceed equivalent pitch down manoeuvres by a factor of 30. However, the need for geophysical survey aircraft to ‘terrain follow’ meant pitch down and pitch up manoeuvres were virtually equal. Only manoeuvring at the end of survey runs and away from the survey area slightly increased the number of pitch up manoeuvres. When assessed against the executive usage profile presented in AC 23-13A (Figure 27) the results showed that the aircraft exceeded usage assumptions for lighter pitch up manoeuvres and far outstripped pitch down manoeuvres. It was up to 50 times the rate for 0.5g pitch up and pitch down manoeuvres (±0.2 acceleration fractions16). 16 Acceleration fraction is used in guidance material to cater for aircraft having different load limits. An acceleration fraction of +1 equates to either the maximum positive manoeuvre limit or maximum positive gust limit of the aircraft. An acceleration fraction of -1 equates to either the maximum negative manoeuvre limit or maximum negative gust limit. An acceleration fraction of zero is equal to ‘1g’ or level flight. ATSB – AO-2019-026 › 31 ‹ Figure 26: Recorded manoeuvre spectrum compared with executive and survey spectra Note: FAA memo mean frequency refers to that defined in the FAA Memorandum and is that used to calculate the equivalent design curve in AC23-13A. Source: ATSB Gust loads When assessed against the survey usage profile presented in AC 23-12A (Figure 28), positive gusts were generally found to be slightly higher than the design criteria for light gust (<1.8g), reducing to slightly below design criteria for more severe positive gusts (>1.8g) though remaining well above mean frequency. This data was collected in late autumn and did not contain summer data that would be expected to include more turbulence,17 though this may be offset by winter data. For negative gusts, again the aircraft experienced light gusts around design criteria above +0.5g with the accumulation of more severe gust experiences dropping to about average by -0.5g and below average by -1.5g. The gust loading experienced by JEI did not show an exceedance as severe as the manoeuvre loading, but greatly exceeded the executive aircraft assumptions. 17 Higher summer temperatures typically result in increased thermal turbulence. ATSB – AO-2019-026 › 32 ‹ Figure 27: Recorded gust spectrum Note, FAA memo mean frequency refers to that defined in the FAA Memorandum associated with AC23-13A. Source: ATSB Similar occurrences Fatal accidents due to metallic fatigue have occurred throughout aviation history and resulted in the introduction of specific fatigue design and maintenance requirements. Most of these accidents occurred in aeroplanes type certificated prior to specific fatigue requirements. Additionally, some of the accidents in aeroplanes with fatigue in their certification bases can be traced to excessive loading spectrum, beyond the assumptions used in the type design. This accident was the first reported occurrence of a carry-through fatigue cracking or fracture in a Cessna 210 aircraft. The ATSB identified two other accidents, detailed below, involving an undetected fatigue crack that led to a fracture and in-flight wing separation. It is noted that they involved different aircraft types and operation to that associated with the VH-SUX accident. ATSB investigation AO-2013-187 On 24 October 2013, the pilot of a modified PZL Mielec M18A Dromader, registered VH-TZJ, was conducting a firebombing mission about 37 km west of Ulladulla, New South Wales. On approach to the target point, the left wing separated. The aircraft immediately rolled left and descended before impacting terrain, fatally injuring the pilot. The ATSB found that the left wing separated because it had been weakened by a fatigue crack in the left wing’s lower attachment fitting. The fatigue crack originated at small corrosion pits in the fitting. These pits formed stress concentrations that accelerated the initiation of fatigue cracks. ATSB – AO-2019-026 › 33 ‹ National Transportation Safety Board investigation ERA18FA120 On April 4 2018, a Piper PA-28R-201, N106ER, collided with terrain following an in-flight separation of the left wing near the wing root during climb after a touch-and-go manoeuvre at Daytona Beach International Airport, Florida, United States. Both pilots were fatally injured, and the airplane was destroyed. Metallurgical examination of the accident airplane's left-wing main spar lower cap found that it exhibited fracture features consistent with fatigue through more than 90 per cent of the cross-section, almost completely reducing its residual strength capability. ATSB – AO-2019-026 › 34 ‹ Safety analysis Introduction On the afternoon of 26 May 2019, while undertaking a geophysical survey flight from Mount Isa, Queensland, the right wing of a Cessna T210M, registered VH-SUX (SUX) separated from the aircraft. The wing separation resulted in an immediate loss of control of the aircraft and collision with terrain, fatally injuring the two crewmembers. A review of the recorded survey data and aircraft maintenance documentation indicated that the pilot did not manoeuvre the aircraft in a way that directly contributed to the in-flight break up. Furthermore, the failed structure was found to conform to required technical and material specifications. As such, this analysis focuses on the reasons for the failure of the structure and operational factors which led to the in-flight break up. In-flight break up The in-flight separation of the right wing was associated with an overstress fracture of the wing spar carry-through structure at an area of pre-existing fatigue cracking. The wing spar carry-through spar represented a critical load path between the fuselage and wing section. Bending and shear loads during flight were transmitted from the wing and into the fuselage via attachment fittings to the carry-through structure. The loss in structural integrity resulting from the fatigue crack within the carry-through, in combination with normal operational loads, resulted in the overstress failure and separation of the wing. The location of fatigue crack initiation and direction of crack progression indicated that the carry-through spar cracking had developed and then, on the accident flight, fractured at a change in section thickness, in a region associated with increased tensile stresses. The underside surface of the spar was exposed to the loads imposed by upward bending of the wing (aerodynamic lift loads). Without any redundant load paths, the fracture of the spar led to the separation of the right wing and an immediate loss of control. Crack initiation Relatively minor corrosion damage, associated with the initiation of the fatigue cracking, was evident along the underside surface of the carry-through structure. An area of isolated corrosion pit damage to the alloy structure was identified as the crack initiator. This pitting created a localised stress concentration at a thickness transition between the wing lug base region and the central beam allowing the initiation of micro-cracking, reducing the fatigue endurance of the spar. A fine network of shallow intergranular cracks was found to have developed at the base of the corrosion pitting. This intergranular cracking, in combination with the pitting damage, raised stresses at that location, further accelerating the fatigue damage. Intergranular cracking associated with corrosion pit damage was also found at other locations on the underside surface of the carry-through spar. However, no other fatigue cracking was identified. The crack length along the underside surface was approximately 42 mm and penetrated upward into the material until reaching a critical depth of approximately 16 mm. The extent of fatigue cracking in the critical section of lower flange represented close to 38 per cent of the cross-sectional area of the spar that was in tension, significantly reducing the strength of the structure. ATSB – AO-2019-026 › 35 ‹ Maintenance inspection requirements Inspections required at the time of the accident The last inspections of the area of the crack were undertaken 17 months (1,531.6 flight hours) and 19 months (1,746.4 flight hours) prior to the accident. Both inspections were visual inspections for corrosion detection. No defects were identified during either inspection. After detailed metallurgical examination and analysis, the ATSB concluded that the fatigue crack (and therefore the initiating corrosion damage) was probably present within the structure for about 3,300 flight hours. The rate of corrosion growth is influenced by several factors, including the condition of the corrosion inhibiting surface treatment and the aircraft’s operating environment. Therefore, it could not be determined if the corrosion pitting present at the time of the last inspection was of a detectable size using the stipulated inspection method (visual). A post-accident ATSB assessment of the corrosion damage depth indicated that it was not at a level that would be considered severe. At the time of the last inspections, for corrosion of a similar level to that found post-accident, the correct maintenance response would have included a request for an engineering assessment from the aircraft manufacturer. The manufacturer advised that had such an assessment occurred, given the relatively minor corrosion, it would not have resulted in the instruction of a non-destructive inspection (such as an eddy-current inspection) before returning the aircraft to service. Without a requirement for such an inspection, detection of any underlying crack was not assured. Previous inspections Introduced in 1992, Continued Airworthiness Program (CAP) inspection 57-10-08 required both visual and eddy-current inspections of the carry-through initially at 12,000 hours in-service, and then repeated at 6,000 hourly intervals. However, when an aircraft was operated in the low-level survey (including geophysical survey), or pipeline patrol flight profile these intervals were significantly reduced to 4,000 hours and 400 hours, respectively. The manufacturer could not provide historical information regarding the engineering justification for introducing this more stringent requirement for the low-level survey or pipeline patrol flight profile. When creating the supplementary inspection documents for the C210 in 2011, the manufacturer reviewed the history of the aircraft’s structure. As no wing spar carry-through cracking had been identified prior to that time, including during the 19 years that CAP inspection 57-10-08 was in place, and with the knowledge that corrosion of the wing carry-through and surrounding structure was a known issue with the Cessna 210 aircraft, the manufacturer removed those inspections and replaced it with a visual corrosion inspection. While SUX was undertaking survey operations in Australia, two visual inspections were required (four were completed). However, had CAP inspection 57-10-08 remained in place during that period, 15 visual and eddy-current inspections would have been required. Given how long the fatigue crack was probably present within the structure, inspections conducted in accordance with that program would almost certainly have detected the fatigue cracking prior to the accident. Flight profile fatigue damage and guidance Data recovered from the survey computer in SUX indicated that in-flight manoeuvring or gust loads may have been contributory to the development of the fatigue crack. However, limitations in the derivation of these loads prevented a robust analysis. Therefore, another survey C210 (VH-JEI), was instrumented to gather data to determine the loads sustained by the aircraft during the low-level terrain following profile. Using this aircraft, data for 374.6 hours (95 flights and almost 50,000 NM) of survey operations was recorded. The C210 was certified in 1957 under regulations which did not require specific fatigue damage analysis. Furthermore, no comparative data was available from that time. However, design fatigue ATSB – AO-2019-026 › 36 ‹ spectra was provided in 2005 by the Federal Aviation Administration (FAA) in Advisory Circular AC 23-13A as guidance to designers and modifiers of aircraft. The ATSB undertook a comparison of the flight data obtained from JEI to FAA guidance material on fatigue analysis. The fatigue spectra for an executive aircraft was used for the comparison as this spectra best reflected the operational profile for which the C210 are typically operated. Also used for comparison was the survey (pipeline patrol) spectra as this most closely aligned with the geophysical flight profile. For JEI undertaking survey work, the comparison found that minor gust loads experienced during operations slightly exceeded those presented in AC 23-13A for survey aircraft, but more severe loadings were less than the design guidance. However, the repeated loading and unloading of the wing and carry-through structure associated with the intense pitch up and down manoeuvres was found to be more damaging. The recorded data also showed that the flight profile exceeded, by an even greater amount, the design curves across the whole spectrum for gust and manoeuvres for the Executive profile (detailed in the section titled Data analysis findings). It was found that almost all manoeuvres were being conducted at a rate 10 times the guidance criteria for executive aircraft and for the pitch up and pitch down manoeuvres of the draping profile it was up to 50 times the assumed rate. Fatigue profiles are used to determine the expected loads for aircraft structures designed in accordance with Federal Aviation Regulation Part 23. These loads determine the design of both structures and associated maintenance inspections. Any underrepresentation in these spectra may lead to inadequate structure and/or inspections with detrimental outcomes for aircraft safety. However, the ATSB assessed that once additional mitigating factors were also taken into account, the likelihood of the loss of an aircraft designed using this spectra did not meet the threshold criteria for a safety issue. The C210 was designed and manufactured prior to the introduction of Part 23 and the release of the guidance contained in AC 23-13A. Therefore, the manufacturer was not required to determine a safe-life (fatigue profile) for the aircraft type. In that context, any underrepresentation of in-flight loads, should they exist, and consequential fatigue damage could not reasonably be considered as contributory to the accident. At the time of writing this report, there was no data available to determine the extent of the fatigue damage incurred by the C210 operating the geophysical survey flight profile and the extent to which the safe-life of the structure was reduced. Aircraft modifications Over the life of the aircraft, many modifications were incorporated into both the airframe and systems. In most part, these modifications were incorporated in a manner that should not have increased the fatigue life damage accumulation of the wing spar carry-through structure. However, the modification increasing the aircraft’s maximum gross weight from 1,723 kg to 1,814 kg (detailed in the section titled Modifications), incorporated in March 2001 at 4,698.9 hours in service, would have resulted in an increase in the fatigue damage accumulation whenever the aircraft was operated above 1,723 kg. Records of the aircraft’s use (prior to its importation to Australia) were not available, therefore the investigation was unable to determine the extent to which the aircraft was operated above 1,723 kg while overseas. In June 2013 (at 5,933.8 hours in service), the aircraft was imported into Australia. Its Australian operator was not aware of the incorporation of the modification increasing the maximum gross weight to 1,814 kg. All operator documentation relating to the aircraft listed a 1,723 kg maximum weight and, as normal loading for the survey flights resulted in a take-off weight below the 1,723 kg limit, the higher limit was not utilised. ATSB – AO-2019-026 › 37 ‹ Therefore, the use of the increase in maximum gross weight was most likely very limited. The other modifications were incorporated in a manner which did not increase fatigue damage to the wing spar carry-through structure. Consequently, the ATSB determined that the modifications incorporated into the airframe did not significantly increase the fatigue damage accumulated by the structure. ATSB – AO-2019-026 › 38 ‹ Findings From the evidence available, the following findings are made with respect to the in-flight break-up involving Cessna 210, VH-SUX, 25 km north-east of Mount Isa Airport, Queensland on 26 May 2019. Contributing factors • During a low-level geophysical survey flight, a pre-existing fatigue crack in the aircraft’s wing spar carry-through structure propagated to a critical size resulting in an overstress fracture of the structure and separation of the right wing. • Relatively minor pitting corrosion near a highly stressed location on the lower surface of the wing spar carry-through progressed to inter-granular corrosion within the aluminium alloy structure. This increased stress concentration in this area that led to initiation and growth of a fatigue crack, significantly reducing the strength of the structure. • Following an assessment of historical data, the aircraft manufacturer replaced a flight hour-based repetitive eddy current inspection for cracking of the carry-through structure with a three-yearly visual corrosion inspection for all operation types. This significantly limited the opportunities to identify fatigue cracking within the carry-through structure of low-level survey aircraft prior to a crack reaching a critical size. (Safety issue) Other factors that increased risk • The cyclic loads induced by the low-level survey flight profile were significantly greater than those associated with the higher-level flight profile originally intended for the aircraft type. This probably increased the risk of a fatigue-related structural failure. • While not contributory to this accident and not applicable to the Cessna 210, the current guidance to determine fatigue damage for survey aircraft designed in accordance with United States Federal Aviation Regulation Part 23 probably underrepresents the rate of damage accumulated by aircraft intended to be used for low-level terrain following. This may reduce the airworthiness assurance for survey aircraft designed under Part 23. Other finding • The airframe and system modifications incorporated into the aircraft did not significantly increase the fatigue damage accumulated by the wing spar carry-through structure. ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual. ATSB – AO-2019-026 › 39 ‹ Safety issues and actions Fatigue damage detection inspection requirements Safety issue description Following an assessment of historical data, the aircraft manufacturer, Textron Aviation, replaced a flight hour based repetitive eddy current inspection for cracking of the carry-through structure with a three-yearly visual corrosion inspection for all operation types. This significantly limited the opportunities to identify fatigue cracking within the carry-through structure of low-level survey aircraft prior to a crack reaching a critical size. Proactive safety action taken by Textron Aviation On 24 June 2019, Textron Aviation (Textron) released mandatory service letters SEL-57-06 and SEL-57-07 for the Cessna 210 (C210) and Cessna 177 (C177) aircraft. These service letters required a one-off inspection of the structure and communication of inspection findings to the manufacturer. On 4 November 2019, following the receipt and analysis of results from the previously released service letters, Textron released updated service letters SEL-57-08 for the C210 and SEL-57-09 for the C177. Textron subsequently advised the ATSB that it was undertaking a fatigue analysis of the C210 wing spar carry-through. This analysis included information from the VH-SUX accident and inspections of other aircraft and aimed to determine whether a modified inspection program or life limit was necessary. Textron also advised that work on a certification program to install a new spar in the C210 with an updated configuration and material was ongoing. ATSB Comment The ATSB acknowledges the safety action taken by Textron and welcomes its ongoing efforts to address this safety issue. However, the ATSB remains concerned by the indefinite nature of the Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. The initial public version of these safety issues and actions are provided separately on the ATSB website, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website as further information about safety action comes to hand. Issue number: AO-2019-026-SI-02 Issue owner: Textron Aviation Transport function: Aviation: General aviation Current issue status: Open - Safety action pending. Action number: AO-2019-026-NSA-048 Action organisation: Textron Aviation Action date: 24 June 2019 Action status: Closed ATSB – AO-2019-026 › 40 ‹ proposed analysis and certification program. As such, the ATSB issues the following safety recommendation to Textron to take further action to address this safety issue. Safety recommendation to Textron Aviation The Australian Transport Safety Bureau recommends that Textron Aviation takes further safety action to address the risk of fatigue cracking within the carry-through structure of Cessna 210 aircraft operating in low-level geophysical survey roles. Proactive safety action taken by the United States Federal Aviation Administration On 21 February 2020, the FAA adopted airworthiness directive (AD) AD 2020-03-16 for all Cessna model 210G, T210G, 210H, T210H, 210J, T210J, 210K, T210K, 210L, T210L, 210M, and T210M aircraft. This AD required: • visual and eddy current inspections of the carry-through spar lower cap • corrective action if necessary • application of a protective coating and corrosion inhibiting compound • reporting the inspection results to the FAA. On 11 May 2021, the FAA issued a notice of proposed rulemaking for a one-time inspection for 210N, 210R, P210N, P210R, T210N, T210R, 177, 177A, 177B, 177RG, and F177RG models. On 25 June 2021, the consultation period for the notice of proposed rulemaking closed. At the time of writing, the FAA was reviewing the received comments. Proactive safety action taken by the Civil Aviation Safety Authority On 12 July 2019, the Civil Aviation Safety Authority (CASA) released Airworthiness Bulletin AWB 53-011 providing additional information to assist with managing the airworthiness of Cessna 210 (C210) and Cessna 177 (C177) wing carry-though spar structures. This bulletin recommended that operators and maintainers of C177 and C210 aircraft with cantilevered (unstrutted) wings undertake actions including: The ATSB makes a formal safety recommendation, either during or at the end of an investigation, based on the level of risk associated with a safety issue and the extent of corrective action already undertaken. Rather than being prescriptive about the form of corrective action to be taken, the recommendation focuses on the safety issue of concern. It is a matter for the responsible organisation to assess the costs and benefits of any particular method of addressing a safety issue. Recommendation number: AO-2019-026-SR-01 Responsible organisation: Textron Aviation Recommendation status: Released Action number: AO-2019-026-NSA-50 Action organisation: United States Federal Aviation Administration Action date: 21 February 2020 Action status: Closed Action number: AO-2019-026-NSA-049 Action organisation: Civil Aviation Safety Authority Action date: 12 July 2019 Action status: Closed ATSB – AO-2019-026 › 41 ‹ • C210 service letter SEL-57-06 and C177 service letter SEL-57-07 or later revisions as appropriate which relate to one-time inspections of the lower surface of the carry-though lower cap. It is prudent to extend the enhanced inspection (10 x magnification and bright light source) to the upper surface of the lower cap and the carry-through web where visible using a mirror and/or borescope. Note: CASA recognises that some maintenance programs already require compliance with these Cessna service letters. • For Cessna Models with skin attaching to the carry-through (C210 G-M models), the following is recommended in addition to carrying out the Cessna service letter procedure: Visually inspect the serviceability of the fuselage cabin skin to carry-through forward and aft joints for the condition of the sealant, any signs of bulging of the skin and for any loose or missing solid rivets. If corrosion is suspected, disassemble the joint to allow for a detailed visual inspection for corrosion or cracking. If the joint is opened, it is recommended that fay surface sealant is applied as per Cessna Service Manual 2A-30-01. If the joint edge sealant is found deteriorated, clean up and reapply the edge seal as per Cessna Service Manual 2A-30-01. ATSB – AO-2019-026 › 42 ‹ General details Occurrence details Pilot details Licence details: Commercial Pilot Licence (Aeroplane) Endorsements: Manual Propeller Pitch Control; Retractable Undercarriage; Gas Turbine Engine Ratings: Multi-Engine Aircraft; Single Engine-Aircraft; Instrument Rating – Single Engine Aircraft; Night VFR – Single Engine Aircraft, Low Level Operations (Aeroplane) Medical certificate: Class 1, valid to March 2020 Aeronautical experience: Approximately 3,955 hours Last flight review: 12 April 2019 Observer details Licence details: Commercial Pilot Licence (Aeroplane) Endorsements: Manual Propeller Pitch Control; Retractable Undercarriage; Tail-Wheel Undercarriage, Gas turbine engine Ratings: Multi-Engine Aircraft; Single Engine-Aircraft; Instrument Rating – Multi Engine Aircraft; Instrument Rating – Single Engine Aircraft; Night VFR – Single Engine Aircraft, Low Level Operations (Aeroplane) Medical certificate: Class 1, valid to August 2019 Aeronautical experience: Approximately 1,565 hours Last flight review: 23 July 2018 Aircraft details Date and time: 26 May 2019 – 1547 EST Occurrence class: Accident Occurrence categories: In-flight break up, Collision with terrain Location: 25 km north-east of Mount Isa Airport, Queensland Latitude: 20° 31.22’ S Longitude: 139° 40.57’ E Manufacturer and model: Cessna Aircraft Company T210M Registration: VH-SUX Operator: Thomson Aviation Serial number: 21061042 Type of operation: Aerial work Departure: Mount Isa, Queensland Destination: Mount Isa, Queensland Persons on board: Crew – 2 Passengers – Nil Injuries: Crew – 2 (Fatal) Passengers – Nil Aircraft damage: Destroyed ATSB – AO-2019-026 › 43 ‹ Glossary AC Advisory circular AD Airworthiness directive AGL Above ground level AMSL Above mean sea level AWB Airworthiness bulletin CAP Continuing airworthiness program CASA Civil Aviation Safety Authority CASR Civil Aviation Safety Regulations FAA Federal Aviation Administration GPS Global positioning system IAS Indicated airspeed NDI Non-destructive inspection SEL Service letter SEM Scanning electron microscopy STC Supplemental type certificate ATSB – AO-2019-026 › 44 ‹ Sources and submissions Sources of information The sources of information during the investigation included the: • Civil Aviation Safety Authority • Queensland Police Service • aircraft operator and manufacturer • United States Federal Aviation Administration • United States National Transportation Safety Board • maintenance organisation for VH-SUX • Bureau of Meteorology • recorded data from the survey computer from VH-SUX and VH-JEI. References Burian BK, Barshi I & Dismukes K 2005, The challenge of aviation emergency and abnormal situations, National Aeronautics and Space Administration Technical Memorandum NASA/TM- 2005-213462. Cavanagh J & Shields K 1995, Standard catalog of Cessna single engine aircraft, Jones publishing, Wisconsin USA. United States Federal Aviation Administration 2005, AC 23-13A, Fatigue, Fail-Safe, and Damage Tolerance Evaluation of Metallic Structure for Normal, Utility, Acrobatic, and Commuter Category Airplanes, Washington DC, USA. United States Federal Aviation Administration 1993, DOT/FAA/CT-91/20 General Aviation Aircraft Normal Acceleration Data and Collection Project, Washington DC, USA. United States Federal Aviation Administration 1999, DOT/FAA/AR-99/14 An Evaluation of Methods to Separate Maneuver and Gust Loads Factors from Measured Acceleration Time Histories, Washington DC, USA. United States Federal Aviation Administration 1973, AFS-120-73-2 Fatigue Evaluation of Wing and Associated Structures on Small Airplanes, Washington DC, USA. Submissions Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. A draft of this report was provided to the following directly involved parties: • Civil Aviation Safety Authority (CASA) • United States National Transportation Safety Board (NTSB) • United States Federal Aviation Administration (FAA) • aircraft manufacturer • aircraft operator • aircraft maintainer • the pilot and observer’s next of kin Submissions were received from: ATSB – AO-2019-026 › 45 ‹ • CASA • NTSB • FAA • the observer’s next of kin The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly. ATSB – AO-2019-026 › 46 ‹ Appendices Appendix A – Wing spar carry-through examination Scanning electron microscopy of corrosion damage Measurements indicated that the corrosion penetrated into the surface approximately 2.9 mm in length by 0.30 mm in depth (Figures A1 to A7). The pit damage that initiated the cracking was characterised by an amorphous corrosion product. Notably, the corroded region transitioned into an underlying zone of intergranular cracking at the base of the pit, before transitioning toward fatigue cracking. Other pits that were examined on the underside surface of the carry-through spar were also identified to have generated fine intergranular corrosion cracks that also penetrated into the base alloy. Semi-quantitative chemical analysis of the corrosion product located at the fatigue crack origin (as well as other corroded regions) was completed using an energy dispersive spectrometer (EDS) attachme