Case file
- What happened: On 28 April 1988, Aloha Airlines Flight 243, a 19-year-old Boeing 737-200 flying Hilo to Honolulu, lost an 18-foot section of upper fuselage at 24,000 feet. Explosive decompression swept one flight attendant overboard to her death; the crew landed the crippled jet at Kahului Airport, Maui.
- Scale: About 95 people aboard; one killed, dozens injured, the aircraft written off. The airframe had logged roughly 89,700 flight cycles – among the highest tallies of any 737 in service at the time.
- Root cause: NTSB finding: disbonds from the cold-bond adhesive process used on early lap joints admitted moisture and corrosion; fatigue cracks at multiple joints linked into one critical failure. The maintenance and inspection programme, while compliant, was inadequate for a high-cycle ageing airframe.
- The bill: One life, a hull, an airline's reputation – and an industry-wide rewrite: the Aging Aircraft Safety Act of 1991 and widespread-fatigue-damage mandates that still govern old fleets.
Here is an uncomfortable observation from twenty years of auditing plants: nothing in the Aloha 243 findings surprises me. The maintenance programme was approved. The inspections were performed as mandated. The paperwork was in order – and the roof still came off at 24,000 feet. Every quality professional has met a version of this system. One that verifies everything except the assumption it was built on. This case file is a study of what that costs.
The situation
Boeing designed the 737-200's fuselage splices in the late 1960s around bonded lap joints: adhesive carrying load and sealing the joint, rivets backing it up. The fail-safe philosophy underneath was simple – any single fatigue crack would surface and be caught at inspection long before it mattered. Aloha then flew the aircraft that design never imagined. Short island hops, each one a full pressurisation cycle, in salt-laden air, several times a day. Nineteen years of that produced a fleet leader in cycles whose flight hours still looked modest. Nobody recalibrated the inspection logic to the asset actually being flown.
How it unfolded
Climbing through 24,000 feet, fatigue cracks along the lap joints linked up and the skin unzippered from just aft of the cockpit to the wing. The cabin went from sealed to open in a second. Structure gone above the passenger seats, one flight attendant swept out, belted passengers sitting in the slipstream. There is no checklist for a missing roof. The crew slowed to limit aerodynamic loads, communicated by hand signals, and put the remains of a 737 onto the runway at Kahului minutes later. One person died. Dozens were injured. Everyone still inside survived.
Root-cause anatomy
Technically, this was multiple site damage – many small cracks, each subcritical, linking into one critical crack. The enabler sat in manufacturing, years earlier. The cold-bond adhesive process used on early 737 lap joints left disbonds between skin layers, and a disbonded joint stops sharing load and starts holding water. Moisture tracked in, corrosion took hold, and fatigue cracks initiated along rivet rows in skin no mandated inspection could see into. Each crack was harmless alone. At altitude, collectively, they were not.
Organisationally, three components of one system stopped matching. The design assumed bonds stay bonded and cracks appear one at a time. Manufacturing had delivered disbonds the mandated visual inspection could not detect. And the maintenance programme was calibrated – and approved – for an airframe far younger with far fewer cycles. The NTSB did not indict a single part. It indicted the mismatch. When design assumptions, process quality and detection capability drift apart, the gap opens at 24,000 feet.
Where the quality system failed
Put this on a PFMEA and the wound is precise. Detection had been scored for the failure mode as designed – a visible crack at a bonded joint – not for the failure mode that grew after delivery: hidden disbonds, concealed corrosion, linked cracks under intact-looking skin. A detection ranking inherited from the design case is invalid for the fielded case. Failure modes that develop in service and link up demand their own scoring. That revision never happened.
The audit question is the uncomfortable one. A VDA 6.3 or AS9100 audit asks whether you execute your plan correctly, and Aloha's programme largely did – that is the horror of it. The missing discipline was auditing the plan against reality. Who revalidated inspection intervals when utilisation data showed cycles running years ahead of assumptions? The CAPA gate failed too: early evidence of lap-joint disbonds and cracking in the wider fleet was treated as isolated trivia rather than a systemic trigger.
Compliant and adequate are not synonyms – drift is the distance between them.
What would have caught it
Nothing that would have stopped this was exotic.
- Physics-matched detection. Eddy-current inspection of lap-joint rivet rows finds subsurface cracking that visual checks cannot – precisely what post-accident mandates required. Score detection against the hidden mechanism, not the visible one.
- Usage-triggered re-baselining. Pressurisation fatigue is driven by cycles, not calendar hours. Crossing a defined cycle threshold should force a formal review of the inspection plan, not a note in a log.
- Fleet-wide CAPA on the first crack. A lap-joint crack found anywhere in a fleet is an 8D trigger with read-across, not a local finding to close and forget.
- Change control across fielded units. When a bonding process changes on the line, the aircraft already flying keep the old failure modes – and need the inspection logic that goes with them.
My take
This case looks familiar from the other side of the audit table. In automotive plants I have inherited control plans still citing process capabilities measured years earlier, on tooling that had since drifted; the paperwork was current, the assumptions were not. Re-baselining detection against equipment as it actually was – QRQC walls, A3s, the unglamorous archaeology of failure costs – produced the largest cost-of-poor-quality reductions of my career, including at a greenfield plant where the quality system was young enough to be built right from the start. The pattern is always the same. Detection scored against history instead of against the asset as it is today.
And I read that Maui landing with professional respect. The crew solved an unstudiable problem in minutes: triage, stabilise, protect what remained. That is de-escalation in its purest form, and it is the discipline I draw on when a customer escalation has already gone wrong and the only question left is how much you save.
What this means on your floor
- Score PFMEA detection for failure modes that grow and link after delivery; a D-rating from the design case does not survive contact with the fielded population.
- Trigger inspection reviews on the usage driver that causes the damage – cycles, loads, doses – never on hours or calendars alone.
- Treat the first crack found anywhere in a fleet or product family as a systemic CAPA signal with mandatory read-across.
- Audit assumptions, not just records: when a process or tool changes, re-baseline the inspection logic for everything already in service.
Aloha 243 was never a story about one cold bond or one missed crack. It is the story of a system whose parts no longer matched: a design that assumed permanence, a process that shipped flaws, a detection regime calibrated for a younger aircraft. Ageing – of fleets, tooling, products – is a systems problem, and the system protects you only while its parts stay aligned. When they drift, the gap does not announce itself in a report. It opens mid-climb, on a scheduled flight that had passed every check on the books.
