Case file
- What happened: On 25 July 2000, Air France Flight 4590, a charter Concorde, struck a titanium wear strip on the runway at Paris Charles de Gaulle. The strip had fallen from a Continental DC-10 minutes earlier, after a repair that deviated from approved data. A tyre burst; debris ruptured a wing-integral fuel tank; the leak ignited; the aircraft crashed into a hotel at Gonesse.
- Scale: 100 passengers and 9 crew died, plus 4 people on the ground. Concorde's certificates were withdrawn within weeks; the type returned only in late 2001 and was retired in 2003.
- Root cause: A travelling non-conformance from another operator's maintenance met a latent design exposure – thin, high-pressure tyres beside integral tanks – that two decades of precursor events had described without anyone re-scoring it.
- The bill: 113 lives, a withdrawn certificate, a fleet-wide rescue programme, and the end of supersonic passenger flight.
Here is an uncomfortable observation for anyone who owns occurrence data: on 25 July 2000, Concorde's tyre-burst file was not thin. The type had logged bursts for two decades, including a 1979 event that had already thrown rubber through wing structure and into fuel tanks. Every event got its investigation, its repair, its closure. What nobody did – for a quarter of a century – was re-score severity once debris had proved it could reach a tank. AF4590 is a dormant pathway maturing into a cascade, with all the paperwork already filed.
The situation
Concorde lived at the far end of every parameter: takeoff speeds far above subsonic norms, tyres run thin at very high pressure, and a delta wing whose fuel tanks are integral to the structure – sitting directly above the gear that could throw debris at them. The fleet collected tyre events from entry into service. A 1979 burst at Washington Dulles holed tanks and severed structure. The aircraft landed safely, tyres were modified, the file closed. Residual risk was scored against the mitigations of 1979. Nobody re-scored it against the events that kept arriving.
How it unfolded
Minutes before the Concorde rolled, a Continental DC-10 departed the same runway and shed a wear strip about 44 cm long – titanium sheet where the drawing called for aluminium alloy, with non-conforming fasteners and dimensions. Flight 4590 struck it at roughly 300 km/h. The tyre shredded. A multi-kilo slab of rubber hit the wing underside and ruptured tank 5, opening a kerosene leak measured in tens of litres per second. Ignition followed – the BEA's work points to an electric arc – and the tower saw fire before the cockpit showed anything. Engine 2 surged and was shut down; engine 1 faltered. Past V1 with a burning wing, the crew rotated, could neither climb nor accelerate, and struck the hotel under two minutes after starting the roll.
Root-cause anatomy
Technically, this is an energy chain: a metal strip harder than anything it met on the runway, a tyre built thin for weight, a tank skin a few millimetres thick where the fragment arrived. The BEA's testing indicated the titanium strip cut the tyre in a way a conforming aluminium part would not have. The non-conforming material was decisive, not incidental.
Organisationally, two non-conformances met on the runway. One travelled: a repair executed without approved data, in the wrong material, inside a process that allowed it. One waited: a certified design whose failure-mode file had absorbed twenty years of occurrence data without anyone re-linking the tyre mode to its tank effect. FOD is not an act of God. It is someone else's non-conformance, travelling.
Where the quality system failed
Name the disciplines, because each left a fingerprint. On the PFMEA line, severity sat frozen at certification values while occurrence grew and documented fragment strikes had already reached the tank zone – the score was stale the day the 1979 file closed. At the CAPA gate, each burst exited as "tyre replaced, damage repaired, local event", so the pathway never entered corrective action.
Change control validated the post-1979 modifications against the tyre of 1979, not against the worst credible fragment. And at the repair interface, the audit question nobody asked: where is the approved data for this repair, and how is material conformity verified against the drawing? Titanium where aluminium belongs is a paper-level catch.
An occurrence file nobody re-links is not a safety record – it is the accident drafting itself in instalments.
What would have caught it
None of this needed hindsight technology. It needed ownership of the pathway. A severity re-scoring trigger – any debris strike inside a defined critical zone, or sustained occurrence growth on a known mode, forcing a re-score against the worst documented effect – would have found its anchor sitting unused in the 1979 file. A standing cross-fleet precursor board reading every operator's tyre events as one data set, because the pathway did not respect livery. A repair audit run to approved data: material certification, fastener spec, dimensional record. The deviation was detectable at work-order level, before that DC-10 ever flew. And detection honesty. Inspection monitored tyre condition; nothing monitored runway condition. FOD control needed an owner, a frequency and a sweep, treated like any other process input.
My take
Two decades in automotive and aerospace quality, and the failure shape is familiar. At SNOP, building the QA/QC function for a 900-strong greenfield plant, my first fight was against "local event, no systemic issue" as a closure category – QRQC works because it forces the escape back up the pathway, not just back to the part. At WITTE Automotive, the failure-cost reduction we delivered through QRQC, A3 and a Q-Wall came from re-linking failure modes, not from closing reports faster. On supplier audits under VDA 6.3, the question that saves you is always boring: show me the approved data, the material cert, the fastener spec. A wear strip in the wrong alloy is a five-minute audit find. In my world, an escape like that ruins a programme. On 25 July 2000 it cost 113 lives. That asymmetry is why severity re-scoring is a leadership duty, not a clerk's task.
What this means on your floor
- Re-score severity whenever occurrence history grows. A twenty-year-old severity score is stale data wearing a safety badge.
- Close pathways, not events. The CAPA gate question is "which barrier failed", never "was the part replaced".
- Treat FOD as a travelling non-conformance. Audit repair stations to approved data and material certs, not to the existence of manuals.
- Give every dormant pathway an owner, a review date and a trigger – occurrence growth and zone strikes both re-open the file.
Run the cost-of-poor-quality arithmetic. A wear strip worth a few euros, cut from the wrong sheet and installed without approved data, met a design exposure that twenty years of occurrence data had already described. The bill: 113 lives, withdrawn certificates, a rescue programme of Kevlar liners, NZG tyres and rewired bays – fleet-level 8D, done honestly – and the retirement of an icon in 2003. By any CoPQ measure, it is the most expensive piece of scrap titanium in aviation. The precursors were all there, catalogued and closed. They only protect you if somebody connects them.
