|Date||May 25, 1979|
|Summary||Loss of control caused by engine detachment due to improper maintenance|
|Site||Des Plaines, Illinois, U.S. (near O'Hare International Airport) |
|Aircraft type||McDonnell Douglas DC-10-10|
|IATA flight No.||AA191|
|ICAO flight No.||AAL191|
|Call sign||AMERICAN 191|
|Flight origin||O'Hare International Airport|
Chicago, Illinois, U.S.
|Destination||Los Angeles International Airport|
Los Angeles, California, U.S.
American Airlines Flight 191 was a regularly scheduled domestic passenger flight in the United States operated by American Airlines from O'Hare International Airport in Chicago, Illinois, to Los Angeles International Airport in Los Angeles, California. On the afternoon of May 25, 1979, the McDonnell Douglas DC-10-10 operating this flight was taking off from runway 32R when its left engine detached, causing loss of control, and it crashed less than a mile (1.6 km) from the end of the runway. All 258 passengers and 13 crew on board were killed, along with two people on the ground. With 273 fatalities, it is the deadliest aviation accident to have occurred in the United States.
The National Transportation Safety Board (NTSB) found that as the aircraft was beginning its takeoff rotation, engine number one (the left engine) separated from the left wing, flipping over the top of the wing and landing on the runway. As the engine separated from the aircraft, it severed hydraulic fluid lines that lock the wing's leading-edge slats in place and damaged a 3-foot (0.9 m) section of the left wing's leading edge. Aerodynamic forces acting on the wing resulted in an uncommanded retraction of the outboard slats. As the aircraft began to climb, the damaged left wing - with no engine - produced far less lift (stalled) than the right wing, which had its slats still deployed and its engine providing full takeoff thrust. The disrupted and unbalanced aerodynamics of the aircraft caused it to roll abruptly to the left until it was partially inverted, reaching a bank angle of 112°, before crashing in an open field by a trailer park near the end of the runway. The engine separation was attributed to damage to the pylon structure holding the engine to the wing, caused by improper maintenance procedures used at American Airlines.
The aircraft involved was a McDonnell Douglas DC-10-10 registered as N110AA. It had been delivered on February 25, 1972, and at the time of the crash, it had logged just under 20,000 hours of flying time over seven years. The jet was powered by three General Electric CF6-6D engines. A review of the aircraft's flight logs and maintenance records showed that no mechanical discrepancies were noted for May 11, 1979. On the day of the accident, in violation of standard procedure, the records were not removed from the aircraft, and were destroyed in the accident.:76
Captain Walter Lux (age 53) had been flying the DC-10 since its introduction eight years earlier. He had logged around 22,000 flying hours, of which about 3,000 were in a DC-10. He was also qualified to pilot 17 other aircraft, including the DC-6, the DC-7, and the Boeing 727.:75 First Officer James Dillard (age 49), and Flight Engineer Alfred Udovich (56) were also highly experienced: 9,275 hours and 15,000 hours, respectively; between them, they had 1,830 hours' flying experience in the DC-10.
On the accident flight, just as the aircraft reached takeoff speed, the number-one engine and its pylon assembly separated from the left wing, ripping away a 3 ft (0.9 m) section of the leading edge with it. The combined unit flipped over the top of the wing and landed on the runway.:2 Robert Graham, supervisor of maintenance for American Airlines, stated:
As the aircraft got closer, I noticed what appeared to be vapor or smoke of some type coming from the leading edge of the wing and the number-one engine pylon. I noticed that the number-one engine was bouncing up and down quite a bit and just about the time the aircraft got opposite my position and started rotation, the engine came off, went up over the top of the wing, and rolled back down onto the runway... Before going over the wing, the engine went forward and up just as if it had lift and was actually climbing. It didn't strike the top of the wing on its way; rather, it followed the clear path of the airflow of the wing, up and over the top of it, then down below the tail. The aircraft continued a fairly normal climb until it started a turn to the left. And at that point, I thought he was going to come back to the airport.
What was said in the cockpit in the 50 seconds leading up to the final impact is not known, as the cockpit voice recorder (CVR) lost power when the engine detached. The only crash-related audio collected by the recorder is a thumping noise (likely the sound of the engine separating), followed by the first officer exclaiming "Damn!", at which point the recording ends. This may also explain why air traffic control was unsuccessful in their attempts to radio the crew and inform them that they had lost an engine. This loss of power did, however, prove useful in the investigation, serving as a marker of exactly what circuit in the DC-10's extensive electrical system had failed.:57
In addition to the engine's failure, several related systems failed. The number-one hydraulic system, powered by the number-one engine, also failed, but continued to operate through motor pumps that mechanically connected it to hydraulic system three. Hydraulic system three was also damaged and began leaking fluid, but maintained pressure and operation until impact. Hydraulic system two was undamaged. The number-one electrical bus, whose generator was attached to the number-one engine, failed, as well, causing several electrical systems to go offline, most notably the captain's instruments, his stick shaker, and the slat disagreement sensors. A switch in the overhead panel would have allowed the captain to restore power to his instruments, but it was not used. The flight engineer may have been able to reach the backup power switch (as part of an abnormal situation checklist--not as part of their take-off emergency procedure) in an effort to restore electrical power to the number-one electrical bus. That would have worked only if electrical faults were no longer present in the number-one electrical system. To reach that backup power switch, the flight engineer would have had to rotate his seat, release his safety belt, and stand up. Since the aircraft did not get any higher than 350 ft (110 m) above the ground and was only in the air for 50 seconds between the time the engine separated and the moment it crashed, the time was not sufficient to perform such an action. In any event, the first officer was flying the airplane and his instruments continued to function normally.:52
The aircraft climbed to about 325 ft (100 m) above ground level while spewing a white mist trail of fuel and hydraulic fluid from the left wing. The first officer had followed the flight director and raised the nose to 14°, which reduced the airspeed from 165 kn (190 mph; 306 km/h) to the takeoff safety airspeed (V2) of 153 kn (176 mph; 283 km/h), the speed at which the aircraft could safely climb after sustaining an engine failure.:53-54
The engine separation severed the hydraulic fluid lines that controlled the leading-edge slats on the left wing and locked them in place, causing the outboard slats (immediately left of the number-one engine) to retract under air load. The retraction of the slats raised the stall speed of the left wing to about 159 kn (183 mph; 294 km/h), 6 knots higher than the prescribed takeoff safety airspeed (V2) of 153 knots. As a result, the left wing entered a full aerodynamic stall. With the left wing stalled, the aircraft began banking to the left, rolling over onto its side until it was partially inverted at a 112° bank angle (as seen in the Laughlin photograph) with its right wing over its left wing.
As the cockpit had been equipped with a closed-circuit television camera positioned behind the captain's shoulder and connected to view screens in the passenger cabin, the passengers may have been able to witness these events from the viewpoint of the cockpit as the aircraft dove towards the ground. Whether the camera's view was interrupted by the power loss from the number-one electrical bus is not known. The aircraft eventually slammed into a field around 4,600 ft (1,400 m) from the end of the runway.:2 Large sections of aircraft debris were hurled by the force of the impact into an adjacent trailer park, destroying five trailers and several cars. The DC-10 had also crashed into an old aircraft hangar located at the edge of the airport at the former site of Ravenswood International Airport, which was used for storage. The aircraft was completely destroyed by the impact force and ignition of a nearly full load of 21,000 gallons of fuel; no sizable components other than the engines and tail section remained.
In addition to the 271 people on board the aircraft, two employees at a nearby repair garage were killed, and two more were severely burned. The crash site is a field located northwest of the intersection of Touhy Avenue (Illinois Route 72) and Mount Prospect Road on the border of the suburbs of Des Plaines and Mount Prospect, Illinois.:2
The disaster and investigation received widespread media coverage. The impact on the public was increased by the dramatic effect of an amateur photo taken of the aircraft rolling that was published on the front page of the Chicago Tribune on the Sunday two days after the crash.
Witnesses to the crash were in universal agreement that the aircraft had not struck any foreign objects on the runway. Also, no pieces of the wing or other aircraft components were found along with the separated engine, other than its supporting pylon, leading investigators to conclude that nothing else had broken free from the airframe and struck the engine. Hence, the engine/pylon assembly separation could only have resulted from a structural failure. The cockpit instrument panels were too badly damaged to provide any useful information.
During the investigation, an examination on the pylon attachment points revealed some damage done to the wing's pylon mounting bracket that matched the bent shape of the pylon's rear attachment fitting. This meant that the pylon attachment fitting had struck the mounting bracket at some point. This was important evidence, as the only way the pylon fitting could strike the wing's mounting bracket in the observed manner was if the bolts that held the pylon to the wing had been removed and the engine/pylon assembly was being supported by something other than the aircraft itself. Therefore, investigators now could conclude that the observed damage to the rear pylon mount had been present before the crash actually occurred, rather than being caused by it.:18
The NTSB determined that the damage to the left-wing engine pylon had occurred during an earlier engine change at the American Airlines aircraft maintenance facility in Tulsa, Oklahoma, between March 29 and 30, 1979.:68 On those dates, the aircraft had undergone routine service, during which the engine and pylon had been removed from the wing for inspection and maintenance. The removal procedure recommended by McDonnell-Douglas called for the engine to be detached from the pylon before detaching the pylon itself from the wing. However, American Airlines, as well as Continental Airlines and United Airlines, had developed a different procedure that saved about 200 man-hours per aircraft and "more importantly from a safety standpoint, it would reduce the number of disconnects (of systems such as hydraulic and fuel lines, electrical cables, and wiring) from 79 to 27.":26 This new procedure involved the removal of the engine and pylon assembly as a single unit, rather than as individual components. United Airlines' implementation involved the use of an overhead crane to support the engine/pylon assembly during removal and installation. The method chosen by American and Continental relied on supporting the engine/pylon assembly with a large forklift.
If the forklift was incorrectly positioned, the engine/pylon assembly would not be stable as it was being handled, causing it to rock like a see-saw and jam the pylon against the wing's attachment points. Forklift operators were guided only by hand and voice signals, as they could not directly see the junction between the pylon and the wing. Positioning had to be extremely accurate, or structural damage could result. Compounding the problem, maintenance work on N110AA did not go smoothly. The mechanics started to disconnect the engine and pylon as a single unit, but a shift change took place halfway through the job. During this interval, although the forklift remained stationary, the forks supporting the entire weight of the engine and pylon moved downward slightly due to a normal loss of hydraulic pressure associated with the forklift engine being turned off; this caused a misalignment between the engine/pylon and wing. When work was resumed, the pylon was jammed on the wing and the forklift had to be repositioned. Whether damage to the mount was caused by the initial downward movement of the engine/pylon structure or by the realignment attempt is unclear.:29-30 Regardless of how it happened, the resulting damage, although insufficient to cause an immediate failure, eventually developed into fatigue cracking, worsening with each takeoff and landing cycle during the 8 weeks that followed. When the attachment finally failed, the engine and its pylon broke away from the wing. The structure surrounding the forward pylon mount also failed from the resulting stresses.:12
Inspection of the DC-10 fleets of the three airlines revealed that while United Airlines' hoist approach seemed to be harmless, several DC-10s at both American and Continental already had fatigue cracking and bending damage to their pylon mounts caused by similar maintenance procedures.:18 The field service representative from McDonnell-Douglas stated the company would "not encourage this procedure due to the element of risk" and had so advised American Airlines. McDonnell-Douglas, however, "does not have the authority to either approve or disapprove the maintenance procedures of its customers.":26
The NTSB determined that the loss of one engine and the asymmetrical drag caused by damage to the wing's leading edge should not have been enough to cause the pilots to lose control of their aircraft; the aircraft should have been capable of returning to the airport using its remaining two engines.:54 The NTSB thus examined the effects that the engine's separation would have on the aircraft's flight control, hydraulic, electrical, and instrumentation systems. Unlike other aircraft designs, the DC-10 did not include a separate mechanism to lock the extended leading-edge slats in place, relying instead solely on the hydraulic pressure within the system.:53,57 The NTSB determined that the engine tore through hydraulic lines as it separated from the DC-10's wing, causing a loss of hydraulic pressure; airflow over the wings forced the left wing slats to retract, which caused a stall over the left wing.:53 In response to the accident, slat relief valves were mandated to prevent slat retraction in case of hydraulic line damage.
The wreckage was too severely fragmented to determine the exact position of the rudders, elevators, flaps, and slats before impact, and examination of eyewitness photographs showed only that the right wing slats were fully extended as the crew tried unsuccessfully to correct the steep roll they were in. The position of the left wing slats could not be determined from the blurry color photographs, so they were sent to a laboratory in Palo Alto, California, for digital analysis, a process that was pushing the limits of 1970s technology and necessitated large, complicated, and expensive equipment. The photographs were reduced to black-and-white, which made distinguishing the slats from the wing itself possible, thus proving that they were retracted. In addition, the tail section of the aircraft was verified to be undamaged and the landing gear was down.:20-21
Wind-tunnel and flight-simulator tests were conducted to help to understand the trajectory of the aircraft after the engine detached and the left wing slats retracted. Those tests established that the damage to the wing's leading edge and retraction of the slats increased the stall speed of the left wing from 124 kn (143 mph; 230 km/h) to 159 kn (183 mph; 294 km/h).:23 The DC-10 incorporates two warning devices that might have alerted the pilots to the impending stall: the slat disagreement warning light, which should have illuminated after the uncommanded retraction of the slats, and the stick shaker on the captain's control column, which activates close to the stall speed. Both of these warning devices were powered by an electric generator driven by the number-one engine. Both systems became inoperative after the loss of that engine.:54,55,67 The first officer's control column was not equipped with a stick shaker; the device was offered by McDonnell Douglas as an option for the first officer, but American Airlines chose not to have it installed on its DC-10 fleet. Stick shakers for both pilots became mandatory in response to this accident.
As the aircraft had reached V1, the crew were committed to takeoff, so followed standard procedures for an engine out situation. This procedure is to climb at the takeoff safety airspeed (V2) and attitude (angle), as directed by the flight director. The partial electrical power failure (produced by the separation of the left engine) meant that neither the stall warning nor the slat retraction indicator was operative. The crew, therefore, did not know that the slats on the left wing were retracting. This retraction significantly raised the stall speed of the left wing. Thus, flying at the takeoff safety airspeed caused the left wing to stall while the right wing was still producing lift, so the aircraft banked sharply and uncontrollably to the left. Simulator recreations held after the accident determined that "had the pilot maintained excess airspeed the accident may not have occurred.":54
The findings of the investigation by the NTSB were released on December 21, 1979:
The National Transportation Safety Board determines that the probable cause of this accident was the asymmetrical stall and the ensuing roll of the aircraft because of the uncommanded retraction of the left wing outboard leading edge slats and the loss of stall warning and slat disagreement indication systems resulting from maintenance-induced damage leading to the separation of the No. 1 engine and pylon assembly at a critical point during takeoff. The separation resulted from damage by improper maintenance procedures which led to failure of the pylon structure. Contributing to the cause of the accident were the vulnerability of the design of the pylon attachment points to maintenance damage; the vulnerability of the design of the leading-edge slat system to the damage which produced asymmetry; deficiencies in Federal Aviation Administration surveillance and reporting systems, which failed to detect and prevent the use of improper maintenance procedures; deficiencies in the practices and communications among the operators, the manufacturer, and the FAA, which failed to determine and disseminate the particulars regarding previous maintenance damage incidents; and the intolerance of prescribed operational procedures to this unique emergency.:69
The crash of Flight 191 brought strong criticism from the media regarding the DC-10's safety and design. The DC-10 had been involved in two accidents related to the design of its cargo doors, American Airlines Flight 96 (1972) and Turkish Airlines Flight 981 (1974). The separation of engine one from its mount, the widespread publication of the dramatic images of the airplane missing its engine seconds before the crash, and a second photo of the fireball resulting from the impact, raised widespread concerns about the safety of the DC-10. The final blow to the airplane's reputation was dealt two weeks after the crash, when the aircraft was grounded by the Federal Aviation Administration (FAA). Although the aircraft itself was later exonerated, the damage in the public's eye was already done.
The investigation also revealed other DC-10s with damage caused by the same faulty maintenance procedure. The faulty procedure was banned, and the aircraft type went on to have a long career as a passenger and cargo aircraft. In response to this accident, American Airlines was fined $500,000 (equivalent to $1.3 million in 2019 dollars) by the U.S. government for improper maintenance procedures. Earl Russell Marshall, one of the American Airlines mechanics who had last performed this maintenance procedure on the aircraft, subsequently committed suicide the night before he was to be deposed by McDonnell Douglas attorneys.
On June 6, 1979, two weeks after the crash, the FAA suspended the type certificate for the DC-10, thereby grounding all DC-10s under its jurisdiction. It also enacted a special air regulation banning the DC-10 from U.S. airspace, which prevented foreign DC-10s not under the jurisdiction of the FAA from flying within the country.:47 This was done while the FAA investigated whether the airplane's engine mounting and pylon design met relevant requirements. Once the FAA was satisfied that maintenance issues were primarily at fault and not the actual design of the aircraft, the type certificate was restored on July 13 and the special air regulation repealed. The type certificate was amended, however, stating, "...removal of the engine and pylon as a unit will immediately render the aircraft unairworthy."
In the wake of the grounding, the FAA convened a safety panel under the auspices of the National Academy of Sciences to evaluate the design of the DC-10 and the U.S. regulatory system in general. The panel's report, published in June 1980, found "critical deficiencies in the way the government certifies the safety of American-built airliners", focusing on a shortage of FAA expertise during the certification process and a corresponding overreliance on McDonnell Douglas to ensure that the design was safe. Writing for The Air Current, aviation journalist Jon Ostrower likens the panel's conclusions to those of a later commission convened after the 2019 grounding of the Boeing 737 MAX. Ostrower faults both manufacturers for focusing on the letter of the law regarding regulatory standards, taking a design approach that addresses how the pilots could address single-system failures, without adequately considering scenarios in which multiple simultaneous malfunctions of different systems could occur.
On October 31, a DC-10 performing Western Airlines Flight 2605, crashed in Mexico City after a red-eye flight from Los Angeles. The Western crash, however, was due to low visibility and an attempt to land on a closed runway, through, reportedly, confusion of its crew.
The loss of Air New Zealand Flight 901 on November 28, six months after Flight 191, added to the DC-10's negative reputation. The Antarctic sightseeing flight hit a mountain, which was caused by several human and environmental factors not related to the airworthiness of the DC-10, and the aircraft was later completely exonerated.
Ironically, another DC-10 crash 10 years later, United Airlines Flight 232, restored some of the aircraft's reputation. Despite losing an engine, all flight controls, crash landing in a huge fireball (which was caught on video by a local news crew), and killing 112 people, 184 people survived the accident. Experts praised the DC-10's sturdy construction as partly responsible for the high number of survivors.
Orders for DC-10s dropped off sharply after the events of 1979 (the U.S. economic recession of 1979-82 was also a contributing factor in reduced demand for airliners) and from there until the end of production 10 years later, the two largest DC-10 customers were FedEx and the U.S. Air Force (KC-10 Extender). Despite initial safety concerns, DC-10 aircraft continued to serve with passenger airlines for over three decades after the crash of Flight 191. DC-10 production ended in 1988, and many retired passenger DC-10s have since been converted to all-cargo use. The DC-10 freighter, along with its derivative, the MD-11, constitute part of the FedEx Express fleet. The DC-10s have been upgraded with the glass cockpit from the MD-11, thereby turning them into MD-10s. American Airlines retired its last DC-10s in 2000 after 29 years of service. In February 2014, Biman Bangladesh Airlines operated the final DC-10 passenger flights. DC-10s continue to be used extensively in air freight operations, and military variants also remain in service.
Some of the victims in the crash of Flight 191 were:
For 32 years, the victims had no permanent memorial. Funding was obtained for a memorial in 2009, through a two-year effort by the sixth-grade class of Decatur Classical School in Chicago. The memorial, a 2-foot-high (0.6 m) concave wall with interlocking bricks displaying the names of the crash victims, was formally dedicated in a ceremony on October 15, 2011. The memorial is located on the south shore of Lake Opeka, at Lake Park at the northwest corner of Lee and Touhy Avenues, two miles east of the crash site. A remembrance ceremony was held at the memorial on May 25, 2019, the 40th anniversary of the accident.
The cable/satellite National Geographic channel produced a documentary on the crash, and an episode from Seconds From Disaster titled "Chicago Plane Crash" detailed the crash and included film of the investigation press conferences. The Canadian television series Mayday profiled the crash in the episode "Catastrophe at O'Hare", which subsequently aired in the U.S. on the Smithsonian Channel's television series Air Disasters.
Chicago folk singer Steve Goodman wrote the song "Ballad of Flight 191 (They Know Everything About It)" in response to the crash and the subsequent investigation as the inaugural song for a series of topical songs that aired on National Public Radio in 1979.