At 10:56 p.m. on April 1, last year, Southwest Airlines Flight 812, en route from Phoenix to Sacramento with 118 passengers aboard, was completing its climb to its cruise altitude of 36,000 feet, above the small town of Blythe, Calif. An air-traffic controller at Los Angeles Center had just acknowledged a routine call from the pilot. But within a minute or so of that exchange, the controller became aware that Flight 812 was in some kind of trouble. The messages were garbled until, finally, he heard the pilot clearly: “declaring an emergency we lost the cabin.”
Shawna Malvini Redden, a 29-year-old doctoral student at Arizona State, had a window seat in row 8. She was a frequent flyer on Southwest and was happy that, during boarding, together with a guy in the aisle seat, she had psyched other passengers into not taking the seat between them. She was settled and doing homework when there was an ear-splitting bang like a loud gunshot. Oxygen masks dropped from the ceiling and the airplane pitched forward.
The Los Angeles controller asked the pilot to repeat the message.
“Request an emergency descent we’ve lost the cabin and we’re starting down.”
In reality, the pilots of Flight 812 were not waiting for air-traffic-control clearance to descend. They had two urgent priorities—to get to a lower altitude and to find an airport for an emergency landing. “We lost the cabin” meant that the airplane had suffered a sudden and extreme loss of cabin pressure. They were diving to 10,000 feet, where the pressure inside the cabin would begin to equalize with the air outside.
As a blast of air rushed through the cabin, Malvini Redden felt reassured by the flight attendants’ composure. But she reached over to the man in the aisle seat and took his hand. “If I’m going to go down,” she thought, “at least I want to feel connected to somebody.”
Flight 812 touched down safely a few minutes later, a hole 59 inches long and 9 inches wide in the roof of the cabin.
At 11:05 p.m. the pilot was able to be more explicit to the controller: “’parently we’ve got a hole in the fuselage in the back of the airplane.”
By this time controllers in Los Angeles, Albuquerque, and Yuma, Ariz., were all handling the emergency; the crew, sounding clipped but steady, considered their options. At first they made a turn to head back to Phoenix but realized that was too far. They were offered Palm Springs or Blythe, but when told that Yuma, near the California border, was only five miles away, they said, “We’ll take Yuma.”
When Flight 812 touched down safely a few minutes later, the reason for the emergency could be more calmly appraised. There was a hole 59 inches long and 9 inches wide in the roof of the cabin. The skin of the airplane had peeled away. To inspectors from the National Transportation Safety Board who arrived at Yuma the next morning, the structural failure must have seemed worryingly familiar: there had been a similar episode involving another Southwest airplane in July 2009; additionally, the airplane type involved, the Boeing 737, had a history of weaknesses in its fuselage skin. When the NTSB took the damaged part of the cabin roof from Flight 812 back to its labs in Washington, they found serious manufacturing flaws. Forty-two rivet holes at joints where the fuselage skin overlapped, called lap joints, were so far out of alignment that the lower holes had become oval, not round, causing fatigue cracks, and paint had leaked from the outer skin into the joints.
This specific plane had been delivered in 1996, a version of the 737 known as the Classics. Immediately after the Flight 812 emergency, Boeing’s chief engineer for the series, Paul Richter, said that Boeing had anticipated some level of cracking in the relevant area, but not so soon in the plane’s lifecycle. And the CEO of Boeing Commercial Airplanes, W. James McNerney, asserted that the problem was poor manufacturing of one airplane, not a broader design issue.
But Boeing was sending out mixed signals. The company insisted that later models of the 737—called the NG, Next Generation, series—which superseded the Classics (and are now far more numerous on U.S. routes) had fuselages that were far more robust; its own engineers and safety experts remained “completely confident” that the 737NGs had a “significantly different and much improved” skin-fastening design and … no danger of premature cracking.” Yet only a month earlier, in a motion submitted as part of a protracted lawsuit in Kansas involving allegations of flawed work on the 737 production line, Boeing had stated that the NG fuselage was considered “existing” and “unchanged” from the Classic.
The 737 Classics were supposed to have a safe service life of 60,000 flights. In fact, to meet that standard, they must be judged to be capable of flying twice that number, 120,000 flights—a safety margin, supposedly, of 100 percent. But the Southwest 737 had accumulated 39,781 cycles, a number so alarmingly below the bar set for safety that it has thrown into question the entire safety regime.
“You look at something like that and you say ‘Wow! This is not just a Monday Morning Mistake on a production line. There is something deeper here,’ ” said Gene Doub, a former air-crash investigator for the NTSB, about the kind of failure the board had found in the case of Flight 812. Pat Duggins, a member of the Aviation Safety Institute with 28 years of experience in the industry, agreed. He told me: “It is impossible for this to have happened on just one airplane, it’s not a flash in the pan. The production regime and the maintenance-checking regimes are failing.”
Was there, in fact, an endemic problem with the 737’s fuselage? Boeing, in a written response to issues raised during this investigation, insists that the “continued safety record and commercial success of the 737 demonstrates that Boeing over time has incorporated many enhancements and technical advances into the airplane’s systems and structure.” But all those enhancements and advances do not alter the fact that the 737 of today has its roots in a 1960s design, which places limits on how much updating can be done. Indeed, experts interviewed for this article are concerned that America’s most heavily used airliner remains prone to cracks caused by metal fatigue, a weakness that can be traced back decades.
Fish in the Cargo Hold: Over the years, the Boeing 737 has been the world’s most popular airliner for intercity routes. One takes off or lands every 2.5 seconds. Its accident rate, compared with other aircraft, is relatively low: one for every 2.5 million hours flown. Even 45 years after the first 737 flew, airlines are so hungry for the latest model 737s that Boeing can barely meet the demand.
Single-aisle jets carrying between 120 and 200 passengers, like the 737, are the sweet spot of the airplane business for both Boeing and its European rival, Airbus, generating a large part of their profits. Forecasters predict that in the next 20 years, airlines will need 25,000 airplanes in this category, worth $2 trillion. All over the world, they are the workhorses that most people fly.
For decades, Boeing had had that market to itself. Then, in the late 1980s, Airbus introduced a competitor, the A320, loaded with the latest technology; Boeing seriously underestimated the European upstart—until itrealized that it could lose a world market that it had created and monopolized. The result was the NG series, which arrived in 1997 and was a huge improvement on the old Classics. The NG had new wings, engines, and avionics systems to match the Airbus. But, surprisingly, the original fuselage was retained, albeit with some refinements.
Sticking with the vintage body was as much a financial decision as a technical one, for two reasons: a new fuselage would not have delivered quantifiable improvement in operational efficiency; and a wholly new airplane would have been far costlier because the old production line would be obsolete. But there was another reason as well: Because, technically, the NG series was a mixture of old and new, the Federal Aviation Administration was not required to treat it as an all-new airplane, which would have involved a long, expensive, and rigorous test program. Instead, the FAA cleared the new model by allowing it what is called an Amended Type Certificate.
Airlines loved the NGs on sight because they were far more efficient. And it appears nobody questioned whether the NG series would be dogged by the same weaknesses in the skin of the fuselage as were the earlier models.
By far the most serious of these weaknesses arose from the strain created by pressurizing the air in the cabin. The safe working life of any jet is determined to a critical degree by how many times it can go through the repeated cycles of cabin pressurization. In order for us to fly in comfort at the cruise altitudes of a modern jet—between 36,000 and 40,000 feet—the air in the cabin is pressurized so that it feels like we are always flying at the equivalent of 8,000 feet. As the airplane climbs to cruise altitude—and into progressively thinner air—the difference in pressure inside and outside the cabin increases. At cruise, the outward force on a typical window is equal to half a ton. In effect, we sit inside an inflated balloon.
The trouble is, if the skin of the airplane is weakened, the pressurized air in the cabin will always find that weak point and attempt to escape. (When smoking was allowed on airplanes, inspectors looking for nascent failures in the skin could spot them as rings of nicotine deposits left as air leaked out). There are two consequences of skin failure: either a rapid decompression, as in the case of the two Southwest flights, during which the crew are able to retain control and make a rapid descent to a safe landing, or an explosive decompression, where the structural failure is extensive, instantaneous, and fatal.
A deadly example took place in 1981, when a 737 flown by a Taiwanese airline suffered a sudden decompression flying at 22,000 feet and plunged to earth, killing all 104 passengers and six crew. Investigators found that the catastrophic failure had originated not in the skin of the passenger cabin but in the cargo hold, which had frequently carried consignments of frozen fish that caused the corrosion that, in turn, led to metal fatigue and structural failure.
Seven years later, an Aloha Airlines 737 flying at 24,000 feet over Maui, Hawaii, suddenly lost an 8-by-12-foot section of the cabin roof, exposing the passengers to the sky. A flight attendant was sucked out and fell to her death, and there were seven serious injuries, but, remarkably, the pilots got the airplane down. It turned out that the Aloha 737 had flown an unusually high number of short-duration flights in humid conditions. The humidity had induced corrosion that, in turn, resulted in metal fatigue and failure.
After the Aloha emergency, Boeing, the NTSB, and specialists in metal fatigue began to focus on structural flaws peculiar to the fuselage of the 737. What was exposed had as much to do with the age of the 737’s design as it had with the age of the airplanes involved.
Flying Under Pressure: Design work on the 737 had begun in 1964. Boeing, responding to longtime rival Douglas, whose DC-9 was winning large orders, countered with a design that had a wider cabin and six seats per row, as opposed to five in the DC-9. To get that cabin into production fast, it took a fuselage design already used on an existing jet, the 727, and shortened it, leaving much of the original structure unchanged.
The engineer leading the team, Jack Steiner, had fathered the 727 and was known for his ingenuity in moving parts from one design to another. Under his leadership, the pressure to go one better than Douglas was intense.
This was also a time when Boeing’s engineering resources were near exhaustion. The company was simultaneously working on the future 747 jumbo jet and a government-subsidized supersonic transport, which would later be canceled. Of the three, the 737 was the least sexy assignment. Nobody foresaw that by 1985, when the Classics arrived with a vastly improved engine, the 737 would become the biggest cash cow in aviation history—and that it would far outlive any other first-generation jet in the world. But as result of that longevity, the 737 would also carry in its DNA an inherent flaw of 1960s airplane construction.
One of the most respected authorities on aging airplanes and metal fatigue is Prof. Tony Ingraffea of Cornell’s School of Civil and Environmental Engineering. His extensive investigation of the Aloha 737’s shattered fuselage, part of a long study published in the 1990s, is a classic aviation text. Looking back at the 737’s origins, he explains that the available engines were barely powerful enough for the new model. The designers needed to save weight; to do so, they used an aluminum alloy for the fuselage skin that was only .036 inches thick (the width, for example, of a guitar string). Ingraffea’s investigation focused on the part of the 737’s fuselage design that also figures in the case of Southwest Flight 812, the lap joints, where the two layers of skin are held together with a combination of rivets and adhesive. It is this joining that has proved to be a persistent weakness in the structure—the “Achilles heel of the 737,” as Ingraffea called it.
Back in the 1960s nobody anticipated the coming of budget airlines, when airplanes would be required—as are the 737s of Southwest and other budget carriers—to make five or six flights a day, each flight involving a pressurization cycle. Ingraffea emphasized to me that you can’t measure the aging of airplanes in years; “it’s the total of flight cycles,” he says, referring to a completed flight from takeoff to cruise to landing, in which the full cycle of pressurization has taken place, with all the stresses that that creates. The greater the frequency of flights, the sooner fatigue cracks appear.
Ingraffea believes that everything goes back to the original problem, the thin skin. “The skin thickness remains constant throughout the series. You can’t change that without changing everything that mates with the skin—it would constitute a radical redesign which was never done.”
Here, it turned out, was where every strand in the saga of the 737’s record came together. Just how many cycles could a 737 fly before there was a high risk of its fuselage cracking open?
Nobody seems sure.
Chronic Skin Cracking: The recurrent problems with the fuselage of the Classics were addressed in the early 1990s, when Boeing designed the NG series. The Aviation Safety Institute’s Pat Duggins told me that 38 changes were made to the fuselage before the NG went into production. And then, to make sure that no critical weaknesses remained, Boeing took a standard 737NG fuselage off the 737 assembly line at Wichita, Kans., and tested it to the breaking point. The airframe was pushed through the equivalent of 225,000 cycles (three times the assumed safe life of 75,000 cycles for the NG series) on short duration flights—exactly the way Southwest, for example, uses the 737.
The problem, Duggins says, was that the test fuselage did not represent the realities of everyday flight. It lacked a wing box, the core load-bearing part of the wings where they meet the fuselage, and also the landing gear, which transmits particularly forceful stresses to the fuselage on every landing. In addition, he does not believe that the design changes would have given the NG series fuselage a significantly longer life. He raised doubts, when I talked to him, that the tests met Boeing’s design requirements. (Boeing disagrees. It asserts that the testing “provides a realistic simulation of complete flights,” and adds that “all these loads were represented”; Boeing did not specifically answer my questions about whether the wing box and landing gear were part of the airframe that was tested.)
Certainly, if the tests were intended to prove that the persistent problems with the 737 fuselage’s basic design had at last been put to rest—that more than three decades of fatigue cracking had now been eliminated—they had the opposite effect. Boeing has acknowledged making 10 more changes as a result of the tests—even while it was delivering hundreds of the new airplanes to airlines. It would take years to see how the NG airframe aged. And, indeed, as new flaws involving cracks did reveal themselves, thousands of 737s already flying required changes.
I discovered just how plagued with weaknesses the 737NG fuselage still is by making a search of what are called Airworthiness Directives issued by the FAA. Every airplane flying in the U.S. is subject to these alerts, which mandate inspections and changes required for problems that show up in service and affect safety, from minor glitches to life-threatening failures.
Between 2000 and 2011, as the number of NG series in the air grew to more than 2,000, I identified 13 directives that specifically concerned cracking and fatigue issues in the model’s fuselage. Of these, six were structural failures that the FAA warned could result in the rapid decompression of the passenger cabin; one in uncontrolled decompression; and one in sudden decompression. There were also two alerts involving the pilots’ cockpit—one, in 2007 (found during Boeing’s own fatigue testing) located cracking in the skin that could cause “consequent decompression of the flight deck” and another, in 2008, cracking around windows serious enough that they “could cause crew communications difficulties or crew incapacitation.”
But the most alarming alert concerned involved a repeatedly troubled area called the aft pressure bulkhead (the rear portion of the cabin). In an Airworthiness Directive dated Nov. 5, 2001, the agency called for “immediate corrective action” to deal with a flaw in the aft pressure bulkhead, which acts like the cap on a bottle of soda and seals, under pressurization, the end of the tube that is the passenger cabin. Its integrity has to be second to none. Action had to be taken immediately, they said, because there was a risk that the airplane’s whole tailfin would tear away. Four airlines had discovered, during checks, that if a 737 made a hard landing, damaging the main landing gear, or simply a certain kind of hard landing that led to shimmying, involving violent swerves on the runway (not uncommon in turbulent weather), the forces transmitted from that impact would end up damaging the aft pressure bulkhead, fatally jeopardizing the tailfin.
There were five alerts about problems with this bulkhead. When Gene Doub, the former NTSB investigator, reviewed this Airworthiness Directive for me, he pointed out that the tailfin of the NG series was significantly larger than the original Classic tailfin and would, therefore, itself transmit proportionately larger loads that would have nowhere else to go but the aft pressure bulkhead, “the path of least resistance” leading to where the tailfin was anchored. Ingraffea, after looking at the same details as Doub, told me in an email: “Skin cracking and aft bulkhead problems are clearly chronic.”
All this underlined what Duggins had pointed out about fatigue testing that had not included the landing gear: It had been left to the four airlines to discover for themselves that the pressure bulkhead could crack if 737s made hard landings. (In a written memo to Newsweek, Boeing claimed that to say that there were “persistent problems” with the bulkhead is “not correct” but did not elaborate.)
Boeing chose not to answer detailed questions about the Airworthiness Directives. In response it wrote, “We do not concur that the AD’s indicate that the 737 structure, whether due to age or any other factor, is unique in the structural performance of the airplane or the degree of cracking or inspection frequency … Today’s system for maintaining safety in service … has been validated over decades, as shown by today’s unmatched safety record.”
To be sure, these operational problems, and the considerable costs of fixing them, have not diminished the airlines’ appetite for the NG series. The 737 is the bestselling airliner in history: almost 10,000 have been sold, and the demand is so great that Boeing aims to deliver 42 a month by 2014. And while 737s have had more accidents than its competitor, Airbus’s A320, Paul Hayes, who oversees one of the world’s most extensive and respected data banks on air safety at the British company Ascend, cautioned me that this disparity could be explained in part by the fact that more 737s than A320s are flown in regions with lax safety regimes (Africa, for example). He said that there was no significant difference in the safety record of the 737 and the A320. “The perception of air safety created by crashes obscures the underlying fact that flying is exceptionally safe—the chances of dying in an air crash are one in 15 million.”
There are two important safeguards that stand between safety and disaster: technology on the one hand and airline safety checks on the other. And the problem is that as the technology of fuselage design has evolved over several decades, the 737’s has not. As a result, the final responsibility for our safety has moved from Boeing to the maintenance and safety checks carried out by the airlines and supervised by the FAA. So far this final safety net has mostly worked—the flaws have been caught before they caused a fatal crash. But that’s no cause for complacency: an aging design with chronic problems remains our most frequently flown plane today.
Certainly, Boeing will not be abandoning its cash cow any time soon. The company had been planning an all-new 737, with a radically changed fuselage using non-corroding composite materials, to be delivered by 2020. The airlines made it clear that they would prefer a new airplane incorporating 21st-century technology—and all the advantages that would bring to both efficiency and safety.
But in December 2010, Airbus announced an upgrade of the A320 called the A320 NEO (New Engine Option). This series was expected to bring such a significant advance in efficiency that it would deliver serious savings to the airlines and keep the A320 viable at least until 2025. In less than nine months Airbus won commitments from airlines for nearly 1,200 NEO A320s.
So Boeing—its resources already fully stretched by producing the radically new 787 Dreamliner and upgrading its other widebodies, the 747 and 777—killed the idea of an all-new 737 and started trumpeting yet another edition of the 737, the 737MAX, which will have a new engine promising to be 10 to 12 percent more fuel efficient. The fuselage will, however, remain much the same—and the MAXes are likely to be flying well beyond 2025.
The decision seems to have paid off. In December Southwest gave Boeing the fattest order in its history—for 208 new 737s, 150 of them to be the MAX. And in January Boeing won its largest European order ever when a Norwegian airline ordered 122 737s.
As Tony Ingraffea had said to me presciently, before this decision to yet again prolong the life of the design was taken: “Boeing are stuck with a design that they want to fly forever.”
Additional reporting by Clark Merrefield.
Take comfort: survivability rates are very high even in violent crashes during landing (as long as there’s no fire). But the newest models of the 737 Next Generation series have suffered shattered fuselages, which makes passenger evacuation difficult – for example, emergency slides are often unusable.
December 2009, Kingston, Jamaica: An American Airlines 737-800 splits open after running off the runway during a rainstorm. All 154 passengers survive, some with injuries.
August 2010, San Andrés Island, Colombia: An Aires Airlines 737-700 rips apart after landing in an electrical storm. One passenger dies, 30 injured.
July 2011, Georgetown, Guyana: A Caribbean Airlines 737-800 ruptures after running off the runway in a rainstorm; 163 passengers survive, some injured.