No Way Out - American Airlines Flight 191.

Five years had passed since the crash of Turkish Air flight 981 outside Paris. In the intervening years, there had been several incidents involving the DC-10 and one accident with fatalities - a Continental Airlines flight in Los Angeles.

In the L.A. accident, the crew heard a loud sound during the takeoff roll and aborted the takeoff. Due to their speed, they couldn’t stop the airplane before running out of runway and the landing gear had been torn off, followed by a fire, which destroyed the airplane. The sound had been caused by a tire blowing out.

After the disaster in France, each time there was an unflattering story about the DC-10 in the media, the flying public noticed. And they didn’t see a difference between an accident caused by a design problem and any other accident.  All they knew was DC-10 airplanes seemed to have a lot of problems.

On May 25^th, 1979, any remaining confidence seasoned travelers may have had in the DC-10 would be shattered when American Airlines flight 191 crashed immediately after take off in Chicago. An iconic photograph of a crashing DC-10, with one engine missing, would be seared into the consciousness of newspaper readers everywhere.

A Slow Motion Tragedy

To be fair to McDonnell-Douglas, it has to be pointed out that the aircraft was certified by the FAA and met all of the certification rules in force at the time. Still, there were decisions made that were not based on good engineering practices.

And a few of the decisions were based on requests made by end users whose motives may have been more related to profit than safety.

The first bad decision was simple enough.  American Airlines, the launch customer for the DC-10, wanted to delete something called the stick shaker from the co-pilot’s flight controls, presumably to save weight and money.

A stick shaker is a device that causes an impossible-to-ignore vibration and buzzing noise in the flight controls if the aircraft’s wing is about to stall and to delete it from either pilot’s controls is impossible to understand from a safety standpoint.

But certification standards in effect at the time allowed the fitting of such a device only on the captain’s controls so McDonnell-Douglas accommodated the customer - apparently not having learned a lesson from agreeing to American’s earlier request to change the design of the cargo door.

Design mistake number 2 involved how the remaining stick shaker was powered.

The device drew its power only from the number 1 engine, the engine on the captain’s side. There was no automatic cut-over to another source. In the event the number 1 engine failed, power for the stick shaker could be switched manually by the flight engineer to another source. But the engineer could not reach the appropriate switch while seated at his station.

The next poor decision was related to the wing’s leading edge slats.

When aircraft wings are pulled or pushed through the air, the air accelerates as it moves over the curved, top surface of the wing. The accelerating air creates a low pressure on the top surface of the wing which generates a force called lift that opposes gravity.

Wings are not equally efficient at all airspeeds however so the wing on most aircraft is optimized for highest efficiency at cruise airspeed where it will spend most of its time in flight.

Fig 1. In this photo of a military version of the DC-10, note how the leading edge of the wing is smooth. The high lift slats are retracted into the wing and the wing is optimized for cruise flight. 

In order to keep the lift enabling boundary layer of air attached to the top surface of the wing at low airspeeds, high lift devices are deployed to delay the detachment of the layer which allows the wing to continue to produce lift at the lower airspeeds used for takeoffs and landings.

The flaps at the rear of the wing are examples of high lift devices. On the front of the wing, there are similar high lift devices called slats.  The slats and flaps are deployed using hydraulic pressure.

Fig 2. The slats are extended in this photo. Extending the slats changes the way the air flows over the wing causing the boundary layer of air to remain attached to the top surface of the wing at the low airspeeds used for take-off and landing.

On the DC-10, the design specified that a back-up pump provide pressure to deploy the slats or keep them deployed in the event of a failure of the primary system.

Unfortunately, the hydraulic lines for both the primary and the back up systems were clustered close together along the leading edge of the wing. Serious damage to one hydraulic system would therefore almost certainly mean damage the other hydraulic systems.

And if all the hydraulic systems were compromised, there were no mechanical locking devices like those used on other aircraft. Such devices would have been the last line of defense against uncommanded retraction of one or both sets of slats but they were not part of the design.

The last design error involved the decision to run a bundle of electrical cables along the leading edge of the wing instead of placing them in the middle of the wing as is normally done. Within this bundle were sensors that notified the crew of the high lift slat device positions during normal operations. Sensors attached to some of the wires in the bundle also advised if only one slat was extended. In such a situation, logic circuitry in the cockpit would inform the crew that an asymmetrical slat condition existed.

American Airlines Maintenance Facility, Tulsa, Oklahoma

Virtually all accidents have a series of events leading up to the actual accident and the crash of American Airlines flight 191 was no different. The series began with the design decisions made back in the late 1960s and continued in a maintenance hangar in Tulsa, Oklahoma where a routine engine change was to be performed.

Changing a wing mounted engine on a DC-10 is not an easy procedure. The engine has to be removed from a pylon and that requires removal of difficult to reach hardware.  Eventually, the maintenance group at the American Airlines Tulsa facility determined that if a large forklift were used, the engine and pylon could be removed as an assembly in much less time.  The difficult to access hardware could then be easily removed once the engine and pylon were in a cradle on the floor.

But McDonnell-Douglas had not approved the procedure. In fact, their maintenance manual specifically called for the engine to be removed first before any detachment of the pylon was attempted.

And although the procedure saved time, it was not without problems.

The forklift had to be positioned exactly right otherwise the engine and pylon assembly would rock against the pylon attachment points on the wing as the assembly was being unbolted.

Since the forklift operator could not see the actual detachment procedure, he or she had to be guided by hand signals and voice commands which made the job even more difficult to do without damaging the engine, pylon or wing.

In the weeks before Flight 191 crashed, the aircraft that would be used for the flight was scheduled to undergo engine maintenance at the Tulsa facility and the job did not go smoothly.

Halfway through the pylon disconnect procedure, a shift change occurred. When the work began again with the next shift, the assembly became jammed and the forklift had to be re-positioned.

After the re-positioning, the work was resumed but damage had occurred to a clevis pin assembly that was used to attach the pylon to the wing. The undiscovered damage would cause a stress fracture in the housing of a self aligning bearing and the fracture would propagate during each flight made after the maintenance had been performed.

May 25^th, 1979

American Airline’s Flight 191’s crew was extremely competent. Walter Lux was a senior captain and had been flying the DC-10 ever since it was added to the fleet. He had over 22,000 hours of flight time. James Dillard, the First Officer and Alfred Udovich, the Flight Engineer, had nearly 25,000 hours between them. The aircraft, fresh from the heavy maintenance event 8 weeks earlier in Tulsa, had been in the fleet 8 years. It had logged 20,000 hours of flight time and had no deferred maintenance items that would have prevented its use that late spring day.

Flight 191 pushed back from its gate at Chicago’s O’Hare airport at 2:50 PM CDT in clear weather with a destination of Los Angeles International. At 3:02 PM, Captain Lux  turned control over to First Officer Dillard - who was slated to fly the outbound leg. Dillard push the throttles up to the take-off power setting and the aircraft began to accelerate down the runway.

Just after the airspeed reached V1, the point where a take-off is continued in the event of loss of power from an engine, the stress fracture in the pylon caused by the unauthorized engine change procedure became complete. The engine thrust caused the rear of the pylon to break free, pivoting on the forward attachment point. The Cockpit Voice Recorder captured a single word:  “Damn”.

Fig 3. When the engine work was done on the aircraft that would become American Airline Flight 191 eight weeks later, undetected damage occurred to the pylon’s rear attachment hardware. On May 25th, 1979, the damaged part would fail with disastrous results.

The unrestrained force of take-off thrust made the pylon continue to pivot, tearing a 3 foot section out of the left wing’s leading edge. It then broke free and passed over the top of the wing.

As the engine and pylon assembly tore the hole in the leading edge, it severed the wiring bundle and the hydraulic lines running along the front of the wing which caused a loss of slat position notification plus it started a bleed down of the hydraulic pressure holding the left side slats in the high lift, take-off position.

The departing engine was also the power source for the Cockpit Voice Recorder and when it tore free, the recording stopped.

With the engine physically gone, there was no power available to operate Captain Lux’s stick shaker device. And First Officer Dillard, who was actually flying the aircraft at the time, had no stick shaker because McDonnell-Douglas had deleted it from the installed equipment list at American Airlines’ request.

The crew immediately knew they had lost the thrust from the left engine, however from their position, they could not see that they had literally lost an engine.  They continued the take-off since a loss of thrust after V1 speed was attained meant it was statistically safer to get the airplane into the air then try to stop on the remaining runway pavement.

Dillard continued the take-off and initiated a climb, reaching an altitude of just over 300 feet. At their weight and existing atmospheric conditions, engine out procedures called for the aircraft to be flown at an airspeed of 153 knots.

Since the airspeed was indicating 165 knots, Dillard reduced airspeed to the engine out speed per procedure.

As he was doing so, the slats on the left wing, no longer held in place by hydraulic pressure, began an uncommanded retraction.  The slats on the right wing remained extended.  With the loss of the left wing’s slats, lift became asymmetrical as the boundary layer of air above the left wing detached, causing that wing to stall.

Normally, as the boundary layer begins to detach, the stick shaker will provide a warning. However, because Dillard had no stick shaker and Lux’s stick shaker ceased to function when the left engine was lost, there were no warning of an impending stall.  The asymmetrical lift caused a steadily increasing left bank which eventually reached over 100 degrees relative to the horizon.

Fig 4. In this retouched photo of a DC-10, the left engine is missing and the aircraft has rolled more than 90 degrees as the left wing stalled.  A copyrighted photo of American Airlines Flight 191, taken from a different perspective, was snapped just seconds before it crashed. That widely distributed photo and accompanying news story helped destroy public confidence in the airliner. 

Captain Lux and First Officer Dillard would have been trying to sort things out as all of this was happening: Neither had a stick shaker signal, and because the wiring bundle had been severed, there was no warning of an asymmetrical slat condition, yet they were in an uncommanded left roll that could not be arrested.

They were at the correct airspeed to safely climb out and Dillard had control authority for the ailerons and rudder which, coupled with the correct engine out airspeed, should have made control of the airplane possible. Both Lux and Dillard had practiced loss of an engine at V1 time after time in the simulator and knew that if you followed the procedure, everything worked out.

Now it was for real but the procedure wasn’t working. The crew ran out of ideas and altitude a few seconds later.

Design decisions made over 10 years earlier had set a trap and the improper engine change procedure had sprung it.  31 seconds after take off, the DC-10 slammed into an open field slightly less than a mile from the airport and 273 people ceased to exist.

Aftermath

Immediately following the crash of flight 191, Langhorne Bond, Administrator of the FAA, suspended the airworthiness certificate of the DC-10 which grounded the aircraft all over the world since no country would allow the aircraft to fly if the certifying country said it wasn’t airworthy.

Only after the details surrounding the cause of the crash came to light, and the design and maintenance problems with the airplane were addressed, did the FAA restore the certification. The National Transportation Safety Board (NTSB) report simply listed the probable cause as an asymmetrical stall. They also said that improper design was a secondary cause along with the improper maintenance procedure used in Tulsa. For once, they did not blame the flight crew.

For the flying public, the crash of flight 191 was the final straw. Businessmen, businesswomen and frequent flyers began avoiding the airplane like the plague. Travel agents intentionally avoided booking their clients on the airplane and openly admitted it. Many customers would refuse to board their flight if the airline changed the equipment from another type to the DC-10.

It was a very dark time for McDonnell-Douglas. Their share price dropped 20%, and even though their employees tried to gin up support for the beleaguered DC-10 by public displays of confidence in the design, times were tough. Fatal crashes in Mexico City and in Antarctica - crashes that did not involve design or maintenance errors - followed the Chicago crash and caused further erosion of what support was left for the aircraft.

If ever there was a star-crossed airliner design, it was the DC-10.

Eventually however, enough time passed for a trickle of passengers to resume flying in the airplane. With each passing year, things got a little better for the airlines flying the aircraft.  The DC-10 seemed to have finally weathered the storm.

But ten years after the crash of flight 191, one last design shortcoming would come to light and remind passengers why they had avoided the airplane.

Although United Airlines Captain Al Haynes and his crew would save 185 lives due to their skill, over a hundred additional fatalities would be added to the DC-10’s toll as all three hydraulic systems were compromised when a defective rotor disc burst in the center engine. As a result, none of the flight controls worked and the airplane could only be controlled by varying the thrust of the two remaining engines.

The story of United Flight 232 will be told next Monday in the final installment of Designed for Disaster: The DC-10 Airliner.

John Loughmiller is an Electrical Engineer, Commercial Pilot, Flight Instructor and a Lead Safety Team Representative for the FAA.

(All imagery in this article was obtained either from US Government accident reports or from Wikimedia Commons media library and is public domain.)