NTSB DC-10 excerpts

From:         rdd@rascal.ics.utexas.edu (Robert Dorsett)
Date:         Wed, 25 Nov 92 02:26:16 CST
View raw article
  or MIME structure

It's been about two years since I last posted this, so...


--------------------

Excerpts from the NTSB accident report on the Chicago O'Hare crash:

Synopsis:

About 1504 CDT, May 25, 1979, American Airlines Flight 191, a McDonnell-Douglas
DC-10-10 aircraft, crashed into an open field just short of a trailer park about
4600' northwest of the departure end of runway 32R at Chicago-O'Hare Internat-
ional Airport, Illinois.

Flight 191 was taking off from Runway 32R.  The weather was clear and the vis-
ibility was 15 miles.  During the takeoff rotation, the left engine and pylon
assembly and about 3 ft of the leading edge of the left wing separated from
the aircraft and fell to the runway.  Flight 191 continued to climb to about
325' above the ground and then began to roll to the left.  The aircraft con-
tinued to roll to the left until the wings were past the vertical position,
and during the roll, the aircraft's nose pitched down below the horizon.

Flight 191 crashed into the open field and the wreckage scattered into an
adjacent trailer park.  The aircraft was destroyed in the crash and subsequent
fire.  Two hundred and seventy-one persons on board Flight 191 were killed;
two persons on the ground were killed, and two others were injured.  An old
aircraft hangar, several automobiles, and a mobile home were destroyed.

The National Transportation Safety Board determines that the probable cause
of this accident was the asymmetrical stall and the ensuing roll of the air-
craft because of the uncommanded retraction of the left wing outboard leading
edge slats and the loss of stall warning and slat disagreement indication sys-
tems resulting from maintenance-induced damage leading to the separation of the
No. 1 engine and pylon assembly at a critical point during takeoff.  The sep-
aration resulted from damage by improper maintenance procedures which led to
failure of the pylon structure.

Contributing to the cause of the accident were the vulnerability of the design
of the pylon attach points to maintenance damage; the vulnerability of the
design of the leading edge slat system to the damage which produced asymmetry;
deficiencies in Federal Aviation Administration surveillance and reporting sys-
tems which failed to detect and prevent the use of improper maintenance proced-
ures; deficiencies in the practices and communications among the operators,
the manufacturer, and the FAA which failed to determine and disseminate the
particulars during previous maintenance damage incidents; and the intolerance
of prescribed operational procedures to this unique emergency.



Findings (p. 67)

1.  The engine and pylon assembly separated either at or immediately after
takeoff.  The flightcrew was committed to continue the takeoff.

2.  The aft end of the pylon assembly began to separate in the forward flange
of the aft bulkhead.

3.  The structural separation of the pylon was caused by a complete failure of
the forward flange of the aft bulkhead after its residual strength had been
critically reduced by the fracture and subsequent service life.

4.  The overload fracture and fatigue cracking on the pylon aft bulkhead's 
upper flange were the only preexisting damage on the bulkhead.  The length of 
the overload fracture and fatigue cracking was about 13 inches.  The fracture 
was caused by an upward movement of the aft end of the pylon which brought the 
upper flange and its fasteners into contact with the wing clevis.

5.  The pylon to wing attach hardware was properly installed at all attachment
points.

6.  All electrical power to the No. 1 AC generator bus and No. 1 DC bus was
lost after the pylon separated.  The captain's flight director instrument, the
stall warning system, and the slat disagreement warning light systems were
rendered inoperative.  Power to these buses was never restored.

7.  The No. 1 hydraulic system was lost when the pylon separated.  Hydraulic
systems No. 2 and No. 3 operated at their full capability throughout the flight.
Except for spoiler panels No. 2 and No. 4 on each wing, all flight controls 
were operating.

8.  The hydraulic lines and followup cables of the drive actuator for the left 
wing's outboard leading edge slat were severed by the separation of the pylon 
and the left wing's outboard slats retracted during climbout.  The retraction 
of the slats caused an asymmetric stall and subsequent loss of control of the 
aircraft.  

9.  The flightcrew could not see the wings and engines from the cockpit.  
Because of the loss of the slat disagreement light and the stall warning system,
the flightcrew would not have received an electronic warning of either the slat
asymmetry or the stall.  The loss of the warning systems created a situation 
which afforded the flightcrew an inadequate opportunity to recognize and 
prevent the ensuing stall of the aircraft.

10.  The flightcrew flew the aircraft in accordance with the prescribed emer-
gency procedure, which called for the climbout to be flown at V2 speed.  V2 
was 6 KIAS below the stall speed for the left wing.  The deceleration to V2 
speed caused the aircraft to stall.  The start of the left roll was the only 
warning the pilot had of the onset of the stall.

11.  The pylon was damaged during maintenance performed on the accident aircraft
at American Airline's Maintenance Facility at Tulsa, Oklahoma, on March 29 and 
30, 1979.

12.  The design of the aft bulkhead made the flange vulnerable to damage when 
the pylon was being separated or attached.

13.  American Airlines engineering personnel developed an ECO to remove and 
reinstall the pylon and engine as a single unit.  The ECO directed that the 
combined engine and pylon assembly be supported, lowered, and raised by a 
forklift.  American Airlines engineering personnel did not perform an adequate 
evaluation of either the capability of the forklift to provide the required 
precision for the task, or the degree of difficulty involved in placing the 
lift properly, or the consequences of placing the lift improperly.  The CO 
did not emphasize the precision required to place the forklift properly.

14.  The FAA does not approve the carriers' maintenance procedures, and a 
carrier has the right to change its maintenance procedures without FAA approval.

15.  American Airlines personnel removed the aft bulkhead's bolt and bushing 
before removing the forward bulkhead attach fittings.  This permitted the 
forward bulkhead to act as a pivot.  Any advertent or inadvertent loss of 
forklift support to the engine and pylon assembly would produce an upward 
movement at the aft bulkhead's upper flange and bring it into contact with 
the wing clevis.

16.  American Airlines maintenance personnel did not report formally to their
maintenance engineering staff either their deviation from the removal sequence 
contained in the ECO or the difficulties they had encountered in accomplishing 
the ECO's procedures.

17.  American Airline's engineering personnel did not perform a thorough 
evaluation of all aspects of the maintenance procedures before they formulated
the ECO.  The engineering and supervisory personnel did not monitor the 
performance of the ECO to ensure either that it was being accomplished properly
or if their maintenance personnel were encountering unforeseen difficulties in
performing the assigned tasks.

18.  The nine situations in which damage was sustained and cracks were found on 
the upper flange were limited to those operations wherein the engine and pylon 
assembly was supported by a forklift.

19.  On December 19, 1978, and Feb. 22, 1979, Continental Airlines maintenance 
personnel damaged aft bulkhead upper flanges in a manner similar to the damage 
noted on the accident aircraft.  The carrier classified the cause of the damage 
as maintenance error.  Neither the air carrier nor the manufacturer interpreted 
the regulation to require that it further investigate or reprot the damages to 
the FAA.

20.  The original certification's fatigue-damage assessment was in conformance 
with the existing requirements.

21.  The design of the stall warning system lacked sufficient redundancy; there 
was only one stickshaker motor; and further, the design of the system did not 
provide for crossover information to the left and right stall warning computers 
from the applicable leading edge slat sensors on the opposite side of the 
aircraft.

22.  The design of the leading edge slat system did not include positive 
mechanical locking devices to prevent movement of the slats by external loads 
following a failure of the primary controls.  Certification was based upon 
acceptable flight characteristics with an asymmetrical leading edge slat 
condition.

23.  At the time of DC-10 certification, the structural separation of an engine 
pylon was not considered.  Thus, multiple failures of other systems resulting 
from this single event was not considered.


Additional excerpts:

[design requirements for slats]
	"The motion on the flaps on opposite sides of the plane of symmetry
	must be synchronized unless the aircraft has safe characteristics with
	the flaps retracted on one side and extended on the other."

Since the left and right inboard slats are controlled by a single valve and 
actuated by a common drum and the left and right outboard slats receive their 
command from mechanically linked control valves which are "slaved" to the 
inboard slats by the followup cable, the synchronization requirement was 
satisfied.  However, since the cable drum actuating mechanisms of the left and 
right outboard slats were independent of each other, the possibility existed 
that one outboard slat might fail to respond to a commanded movement.  
Therefore, the safe flight characteristics of the aircraft with asymmetrical 
outboard slats were demonstrated by test flight.  These flight characteristics
were investigated within an airspeed range bounded by the limiting airspeed for 
the takeoff slat positions--260 kts--and the stall warning speed; the flight 
test did not investigate these characteristics under takeoff conditions.  
In addition, a slat disagree warning light system was installed which, when 
illuminated, indicated that the slat handle and slat position disagree, or 
the slats are in transit, or the slats have been extended automatically.

The program engineer stated that the commanded slat position is held by trapped
fluid in the actuating cylinder, and that no consideration was given to an 
alternate locking mechanism.  The slats' hydraulic lines and followup cables 
were routed as close as possible to primary structure for protection; however, 
routing them behind the wing's front spar was not considered because of 
interference with other systems.

"The branch chief of the Reliability and Safety Engineering Organization of the
Douglas Aircraft Company described the failure mode and effects analysis (FMEA) 
and fault analysis.  The witness indicated that the FMEA was a basic working 
document in which rational failure modes were postulated and analyzed; vendors 
and subcontractors were requested to perform similar analyses on equipment they 
supplied to McDonnell-Douglas.  Previous design and service experience was 
incorporated in the initial DC-10-10's FMEA's, and analyses were modified as 
the design progressed.  The FMEA's were synthesized to make fault analyses, 
which were system-oriented summary documents submitted to the FAA to satisfy 14 
CFR 25.1309.  The FAA could have requested and could have reviewed the FMEA's.

The basic regulations under which the slats were certified did not require 
accountability for multiple failures.  The slat fault analysis submitted to the
FAA listed 11 faults or failures, all of which were correctable by the 
flightcrew.  However, one multiple failure--erroneous motion transmitted to 
the right-hand outboard slats and an engine failure on the appropriate side--
was considered by McDonnell-Douglas in its FMEA.  The FMEA noted that the 
"failure increases the amount of yaw but would be critical only under the most 
adverse flight or takeoff conditions.  The probability of both failures 
occurring is less than 1 x 10e-10 [a popular number with airframe 
manufacturers!]."

[...]

"The December 1, 1978 revision of 14 CFR 25.571 retitled the regulation 
"Damage-Tolerance and Fatigue Evaluation of Structure."  The fail-safe 
evaluation must now include damage modes due to fatigue, corrosion, and 
accidental damage.  According to the manufacturer, the consideration for 
accidental damage was limited to damage which can be inflicted during routine 
maintenance and aircraft servicing."

[...]

"Because of the designed redundancy in the aircraft's hydraulic and electrical
systems, the losses of those systems powered by the No. 1 engine should not have
affected the crew's ability to control the aircraft.  However, as the pylon
separated from the aircraft, the forward bulkhead contacted and severed
four other hydraulic lines and two cables which were routed through the wing 
leading edge forward of the bulkhead.  These hydraulic lines were the operating 
lines from the leading edge slat control valve, which was located inboard of 
the pylon, and the actuating cylinders, which extend and retract the outboard 
leading edge slats.  Two of the lines were connected to the No. 1 hydraulic 
system and two were connected to the No. 3 system, thus providing the 
redundancy to cope with a single hydraulic system failure.  The cables which 
were severed provided feedback of the leading edge slat position so that the 
control valve would be nulled when slat position agreed with position commanded 
by the cockpit control.

The severing of the hydraulic lines in the leading edge of the left wing could 
have resulted in the eventual loss of No. 3 hydraulic system because of fluid 
depletion.  However, even at the most rapid rate of leakage possible, the system
would have operated throughout the flight.  The extended No. 3 spoiler panel on 
the right wing, which was operated by the No. 3 hydraulic system, confirmed that
this hydraulic system was operating.  Since two of the three hydraulic systems 
were operative, the Safety Board concludes that, except for the No. 2 and No. 4 
spoiler panels on both wings which were powered by the No. 1 hydraulic systems, 
all flight controls were operating.  Therefore, except for the significant 
effect that the severing of the No. 3 hydraulic system's lines had on the left 
leading edge slat system, the fluid leak did not play a role in the accident.

During takeoff, as with any normal takeoff, the leading edge slats were 
extended to provide increased aerodynamic lift on the wings .  When the slats
are extended and the control valve is nulled, hydraulic fluid is trapped in the 
actuating cylinder and operating lines.  The incompressiblity of this fluid 
reacts against any external air loads and holds the slats extended.  This is 
the only lock provided by the design.  Thus, when the lines were severed and 
the trapped hydraulic fluid was lost, air loads forced the left outboard slats 
to retract.  While other failures were not critical, the uncommanded movement 
of these leading edge slats had a profound effect on the aerodynamic performance
and controllability of the aircraft.  With the left outboard slats retracted 
and all others extended, the lift of the left wing was reduced and the airspeed 
at which that wing would stall was increased.  The simulator tests showed that 
even with the loss of the No. 2 and No. 4 spoilers, sufficient lateral control 
was available from the ailerons and other spoilers to offset the asymmetric 
lift caused by left slat retraction at airspeeds above that at which the wing 
would stall.  However, the stall speed for the left wing increased to 159 KIAS.

[...]

The Safety Board is also concerned that the designs of the flight control, 
hydraulic, and electrical systems in the DC-10 aircraft were such that all
were affected by the pylon separation to the extent that the crew was unable to 
ascertain the measures needed to maintain control of the aircraft.

The airworthiness regulations in effect when the DC-10 was certificated were
augmented by a Special Condition, the provisions of which had to be met before
the aircraft's fully powered control system would be certificated.
The Special Condition required that the aircraft be capable of continued
flight and of being landed safely after failure of the flight control system, 
including lift devices.  These capabilities must be demonstrated by analysis 
or test, or both.  However, the Special Condition, as it applied to the slat 
control system, was consistent with the basic airworthiness regulations in 
effect at the time.  The basic airworthiness regulations specified requirements
for wing flap asymmetry only and did not include specific consideration of 
other lift devices.  Because the leading edge slat design did not contain any 
novel or unusual features, it was certificated under the basic regulation.  The
flap control requirements for symmetry and synchronization were applied to and 
satisfied by the slat system design.  Since a malfunction of the slat actuating 
system could disrupt the operation of an outboard slat segment, a fault analysis
was conducted to explore the probability and effects of both an uncommanded
movement of the outboard slats and the failure of the outboard slats to respond
to a commanded movement.  The fault analysis concluded that the aircraft could 
be flown safely with this asymmetry.

Other aircraft designs include positive mechanical locking devices to prevent 
movement of slats by external loads following a primary failure.  The DC-10 
design did not include such a feature nor was it deemed necessary, since 
compliance with the regulations was based upon analysis of those failure modes 
which could result in asymmetrical positioning of the leading edge devices and 
a demonstration that sufficient lateral control was available to compensate for 
the asymmetrical conditions throughout the aircraft's flight envelope.  The 
flight tests conducted to evaluate the controllability of the aircraft were 
limited to a minimum airspeed compatible with stall-warning activation 
predicated upon the slat-retracted configuration.