Aviation Accident Investigation: The Engineering Role

ICAO Annex 13 has been the governing standard since 1951 and has been revised repeatedly as investigations revealed gaps. Its core logic is simple: an accident investigation and a court proceeding have incompatible goals. Courts are adversarial; investigators need complete candour from crews, maintenance engineers, and manufacturers. If every flight crew admission could be used to prosecute them, crews would say as little as possible, and the investigation would learn nothing. Annex 13 therefore calls for investigation reports to be focused on safety improvements and not on apportioning blame or liability.

The structure Annex 13 establishes is jurisdictional. The state where the accident occurs (state of occurrence) leads the investigation. The state whose flag the aircraft carried (state of registry) and the state where the aircraft was manufactured (state of design) each have the right to appoint an accredited representative who participates fully in the technical work. When an accident occurs in open ocean, the state where the airline is based typically takes the lead by agreement. Major manufacturer countries, such as the United States for Boeing accidents, participate in almost every large investigation worldwide.

The Annex 13 report has a defined structure: factual information, analysis, findings, contributing factors, and safety recommendations. The finding of probable cause (used by the NTSB) or of causal and contributory factors (used by the AAIB) sits at the end of the analysis, supported by the physical and recorded evidence the engineering teams have assembled. Safety recommendations go to manufacturers, regulators, and operators and are tracked through a public response process.

When a metal component has failed and investigators want to know whether it broke before the accident or because of it, the first tool is a careful look at the fracture surface with the unaided eye and then under a scanning electron microscope. The surface texture is not random; it records the mechanics of failure in recognisable patterns.

• Beach marks (macroscopic): curved bands visible to the naked eye on a fatigue fracture. Each band marks a pause or change in loading, often corresponding to a period of ground operation between flights. Multiple bands mean the crack grew over many cycles.
• Fatigue striations (microscopic): finer ripples inside each beach-mark band, visible under SEM. Each striation corresponds to one loading cycle. Striation spacing records crack-growth rate and, combined with known loading spectra, can estimate how many cycles elapsed during crack growth.
• Ratchet marks: ridges running radially away from the origin zone, indicating that multiple cracks initiated at closely spaced sites and joined. Common at fastener holes and notches where stress concentrations cluster.
• Overload zone: the region of final fracture once the crack has grown large enough that the remaining cross-section cannot carry the load. Fibrous and dimpled under SEM if the material was ductile; flat and crystalline (cleavage) if the material was brittle at the failure temperature.

The Comet 1 fracture surfaces, once recovered and cleaned from the Mediterranean seabed, showed beach marks converging on the corners of the automatic direction finding (ADF) window cut-out on the upper fuselage. The corner radius was approximately 0.04 inches, producing a stress concentration factor that the static-load design criteria had not addressed. Farnborough engineers built a full-scale fuselage test rig, submerged it in water (to limit the energy of any rupture), and repeatedly pressurised it. The test airframe failed at 3,060 cycles of pressurisation. The in-service aircraft had flown 1,290 flights before its first Elba crash. The test confirmed that the window geometry was the cause and gave the data to set new design rules for minimum corner radius and the fatigue-test requirements that now apply to all commercial aircraft type certificates.

A modern commercial aircraft carries a Flight Data Recorder (FDR) and a Cockpit Voice Recorder (CVR), both installed in the aircraft tail in crash-hardened units designed to survive fires up to 1,100 degrees Celsius for 30 minutes and impact forces exceeding 3,400 g. Under ICAO Annex 13, investigation access to recorder data is protected: the CVR transcript in particular is shielded from public release in most jurisdictions to keep crew communication candid. Investigators access the data; lawyers and journalists generally do not.

The systems engineer's job is to correlate recorder parameters (altitude, airspeed, control surface positions, engine N1/N2, fuel flow, hydraulic pressures) against the maintenance history and component genealogy to build a timeline of what happened before the first structural event. A hydraulic pressure drop three minutes before impact may be the cause or an early consequence of something else. Separating cause from effect requires both the recorder data and the fracture-surface evidence from the structural teams working in parallel.

Component tracing is equally important. Every Part 21 certified component on a commercial aircraft carries a serial number and a maintenance record (Form 1 in the UK, FAA Form 8130-3 in the USA). Investigators trace suspect components from the wreckage serial number through the maintenance release history back to manufacture, looking for a missed inspection, a non-standard repair, or an early life fatigue accumulation that the operator may not have been tracking correctly.

Engine-blade liberation events generate a specific forensic challenge: the primary failed component is often destroyed or fragmented by the liberation itself, so investigators must reconstruct the failure mode from secondary evidence. The fan case, the nacelle liners, and the surrounding airframe structure carry impact signatures that, when mapped against the engine's geometry, identify which stage and which blade position was the origin.

The two primary failure mechanisms are low-cycle fatigue (LCF) and foreign object damage (FOD). LCF fractures show beach marks and striations originating at the blade-root attachment features, specifically at stress concentrations in the fir-tree dovetail slot. FOD fractures show a blunt-impact dent or a leading-edge notch that acted as the fatigue initiation site. A third mechanism, manufacturing defect (a void or inclusion in the titanium alloy), is rarer but documented, most famously in the United Airlines Flight 232 crash at Sioux City in 1989, where a titanium hard-alpha inclusion in the CF6-6 engine's fan disk caused an uncontained disk burst.

On-condition maintenance replaced the old fixed-interval philosophy because it is both safer and more economical for components whose health can be reliably measured. Eddy-current, ultrasonic, and fluorescent penetrant inspection can detect cracks well below the critical length at which a component would fail in service. The logic is: inspect regularly, retire when a crack reaches the threshold size, and never have a component in service with a crack that could reach critical length before the next inspection.

That logic breaks down in three ways that investigators look for. First, the inspection interval may have been set correctly for the original fleet usage pattern but not updated when operators began flying shorter, more frequent sectors, cycling the pressurisation system faster than the original fatigue analysis assumed. Second, the inspection technique may not be sensitive enough at the required depth or orientation. Third, inspectors may have missed an indication that a correctly calibrated instrument would have shown, which is a human factors failure rather than an engineering one. All three failures appear in the aviation record.

• Interval drift: the gap between inspections expressed in cycles, not calendar time, matters most for pressurisation fatigue. Short-haul operators accumulate cycles faster and need shorter inspection intervals.
• Technique sensitivity: a crack at 90 degrees to the inspection beam in an eddy-current scan may produce a smaller signal than the rejection threshold. Technique validation with artificial defects at the expected orientation is part of the certification requirement.
• Human performance: fatigue, shift handover errors, and task interruption all affect inspector reliability. The human factors team within an investigation evaluates maintenance records and interviews inspectors to distinguish a programme failure from an execution failure.

The NTSB and AAIB reach similar conclusions by somewhat different structural routes. The NTSB report identifies a probable cause: a single finding (which may be compound) that defines the most critical failure in the chain. The AAIB report lists causal factors and contributory factors without ranking them into a single probable cause, a deliberate choice reflecting the view that assigning a single cause to a multi-factor system failure is intellectually dishonest.

Both bodies produce safety recommendations as a separate section, addressed to named parties with a deadline for response. The FAA, EASA, and national civil aviation authorities are required to formally accept, reject, or defer each recommendation, and the response is published. Open safety recommendations with overdue responses are tracked publicly by both the NTSB and the AAIB, creating a reputational and regulatory pressure for follow-through.