Cause Mapping Example:
Sir Geoffrey de Havilland built the first commercial jet that reached production, the Comet. The Comet design was finalized in 1945, as the British aircraft industry was attempting to establish a commercial aircraft industry post-World War II. Prior to 1954, there had been some problems (a collision at take-off and a mid-air breakup) and some fixes to the hydraulic control system. Then, on January 10, 1954 a Comet broke up in mid-air. Flights were temporarily voluntarily suspended, then resumed. On April 8, 1954, another Comet broke up in air. (Both flights were taking off from Rome.) The lives of 56 passengers and crew were lost in these two incidents, as well as two planes. Additionally, the prestige of the British aviation industry suffered a blow. Below, we outline the problem with the information we know, as well as the impact to the goals. Any loss of life is a safety impact. The loss of the planes is a material impact. I’ll consider the lost prestige of British aviation a customer service impact.
Now we will cause map the various causes that led to the break-ups. Although there were two separate plane breakups, the cause maps are the same (based on the analysis and investigation performed after the accidents). The lost prestige was due to the loss of two planes, which was due to the breakup of the airplane. This, in turn, was caused by rapid depressurizing of the airplane, which was also what killed the passengers and crew. The rapid depressurizing of the plane was due to structural failure of the pressure cabin.
The structural failure occurred because the fuselage skin was extremely thin, in order to make a lightweight design, and because a crack length in the airplane structure exceeded the critical crack length (in essence, the crack length at which crack propagation is so rapid as to be uncontrollable). The crack length exceeded the critical crack length because the crack grew to the critical point, and the critical crack length is a function of the material used (chosen, again, for the lightweight design).
The crack growth to the critical point occurred because there was some initiation of a crack. In this case, rivet holes that punctured the skin, which were used to attach the aircraft windows, acted as the “flaw” where cracking could begin. Fatigue cracking caused the crack to grow, and there was nothing to stop the crack from propagating, because the crack growth was extremely fast. (Investigators noted that once the crack was 1/4″ long, 95% of the fatigue life had been used up.) The investigators pointed out that as they had trouble finding 1/4″ long cracks, and they were specifically looking for them with equipment designed just for that purpose, that it would be very difficult to find on routine inspections.
The fatigue cracking of the cabin occurred because the actual pressure cycles exerted on the cabin were more than the allowable (or where cracking would occur). This was because the allowable pressure cycles were miscalculated (more on this later) and because the aircraft cabin sees pressure cycles.
The pressure cycles are due to the pressurization and depressurization of the cabin. This occurs because the cabin is pressurized for passenger comfort while the exterior air pressure is variable due to changes in altitude.
The allowable pressure cycles were miscalculated for several reasons. We’ll cover each one in more detail later on. First, there was an inadequate test program. Second, the actual stress was above the predicted stress. Third, there was a general lack of knowledge about fatigue. And fourth, the design of the Comet stretched beyond the bounds of experience.
First, the inadequate test program. There was no prototype, which was a design decision. Also, the fatigue tests were misleading. In one test, testing was performed on a section with extended life. (More on this later.) In another test, the results were influened by boundary conditions because the section tested was small, and was strengthened by clamping and sealing.
The extended life was due to the fact that the section had reduced tensile stresses, and that the testing was performed after the tensile stress was reduced. The reduced tensile stress occurred because the material around the windows was forced into compression after the cabin was subjected to twice design pressure, which plastically deformed the window area, and then the pressure was removed.
Next, the actual stress was above the predicted stress. This occurred because 1) the square shaped windows caused pressure stresses to be distributed unevenly and 2) because the actual stress increased in localized areas. The local stress at rivet holes is far above general stress (usually along the order of three times general stress) and two rows of rivets were used to attach the window frame.
While the comet was being developed, there was a general lack of knowledge about fatigue. Many designers (de Havilland included) thought that fatigue was associated with vibration, which did not affect jet engines. Additionally, the spread in fatigue results is large (some experts quote as high as 9:1), meaning that one plane could fail nine times faster (or more slowly) than another. You can see how this is a problem with a small test sample.
A last problem was that the design of the comet stretched the bounds of experience. The comet was designed to fly at twice the speed of other airliners, at twice the height, and at twice the cabin pressure (for passenger comfort). As such, the design was a great extension of the existing body of knowledge in not just one, but three dimensions.
Probably the most important lesson to come from the de Havilland comet accidents is the importance of proper testing. Once the cause was discovered, the Comet was redesigned and flew successfully, although by then Boeing had mostly taken over the market share. It’s tragic that these accidents had to occur before the problem was solved.