Former NTSB and FAA investigator Jeff Guzzetti explains how a maintenance error committed months earlier led to the left engine separating from the wing of a DC-10 during takeoff from Chicago.
It happened over four decades ago, but its infamy remains unmatched. On May 25, 1979, American Airlines Flight 191, a McDonnell-Douglas DC-10 aircraft crashed shortly after takeoff from Chicago O’Hare Airport. All 271 persons aboard were killed, along with two more souls on the ground. It remains to this day the deadliest aircraft accident on U.S. soil.
The crash occurred a dozen years before I began my career as an investigator. I was a rising senior in high school at the time, and the horrific event ignited my interest in aviation safety. Time magazine published an article after the accident which coined a phrase about my future alma mater. The article discussed how and where people learn to fly and fix airplanes, and it cited Embry-Riddle Aeronautical University as the “Harvard of the Skies.”
Aside from its record death toll, readers of AVM should note that the root cause of the tragedy was “improper maintenance procedures” during an engine removal two months before the doomed Los Angeles-bound flight.
Flight 191 began its takeoff roll at 3:03 pm from runway 32R. As the nose rotated upward during lift-off, the left engine and pylon assembly, along with a chunk of the leading edge of the left wing, separated from the aircraft, rolled over the top of the wing, and fell to the runway. Hydraulic lines ruptured and caused the leading-edge slats on the left wing to retract, degrading the lift capability of the wing. The wounded DC-10 continued to climb but immediately began to roll to the left until the wings were perpendicular to the horizon. The Time magazine article that caught my attention included a haunting photographic that captured the DC-10’s final pose (see graphic 1).
Flight 191 was airborne for only 31 seconds. After achieving its highest altitude of 325 feet, the airliner pitched down and its left wing struck the ground. The aircraft exploded and was scattered onto an open field and trailer park. An aircraft hangar, several cars, and a mobile home were also destroyed (see graphics 2 and 3). The NTSB noted that “the disintegration of the aircraft structure was so extensive that little useful data was obtained from post-impact examination of the wreckage. …” with the exception of the no. 1 (left) pylon and engine, which were found off the side of runway 32R (see graphic 4).
The Investigation
The NTSB “go-team” arrived at the crash site later that evening while first responders continued to put out fires and remove bodies. Elwood “Woody” Driver, a former WWII Tuskegee Airman, was the Vice Chairman of the NTSB at the time. He led the go-team launch and was its spokesperson. During one of his initial press conferences, Driver held up a broken engine pylon bolt (see graphic 5) that had been found on the runway where the engine had separated, implying a structural deficiency of the DC-10’s design.
That assumption was proven false, and Driver’s faux pas was etched into the lexicon of accident investigation training of what not to do when briefing the public early in an investigation
What Driver should have done was hold back on presenting that sole piece of evidence until investigators had a chance to learn the full context and meaning of the bolt’s existence. Patiently following the evidentiary trail without making assumptions preserves the integrity of the investigation and prevents unfounded speculation and distraction.
The NTSB’s first order of business was to locate and download the “black boxes”. The cockpit voice recorder (CVR) indicated an uneventful takeoff roll, with 53-year-old Captain Walter Lux verbalizing the proper “V-speed” callouts to First Officer James Dillard, age 49, who was the pilot flying. Just as the airplane began to lift off, Dillard uttered one word – the final word on the CVR – which was “damn.” The flight data recorder (FDR) ended with the aircraft in a 112° left roll and a 21° nose-down pitch attitude with full counter aileron and rudder controls and nearly full up elevator being applied.
The DC-10 was powered by three GE engines: one on each wing and one on the tail. The engines on the wings were mounted onto pylons, and these pylons were attached to the wings via forward and aft bearings (see graphics 6 and 7). The left engine weighed 11,612 pounds. and its pylon weighed 1,865 pounds., for a total engine-pylon assembly weight of 13,477 pounds.
Investigators discovered that the pylon forward bulkhead and portions of the flange from the pylon aft bulkhead either remained with the separated no. 1 pylon or were scattered along the runway. The no. 1 pylon’s aft wing clevis fitting and portions of the pylon aft bulkhead, thrust link, and pylon forward bulkhead attach assembly remained with the wing (see graphic 8). The thrust link bushing bolt had broken in two parts – the parts that Woody Drive held up to the world – and were found in the grass adjacent to the runway.
Investigators found a 10-inch fracture on the flange of the rear bulkhead of the pylon. The fracture contained a crescent-shaped deformation which matched the shape of the lower end of the wing clevis (see graphics 9 and 10). The gouge appeared to be produced by a fastener head, hitting the clevis with a sliding movement, and the resulting damage weakened the pylon’s structure. But how, and when, did this damage occur?
A 200-Hour Shortcut
About a year before the accident, McDonnell-Douglas issued a service bulletin calling for replacement of the spherical bearings on the forward and aft bulkheads of the pylon clevis (see graphics 8) to “correct service-related unsatisfactory conditions.“ The bulletin specified that the engine should be disconnected from the pylon before the pylon was removed from the wing. Compliance was recommended at the “operator’s convenience” and American opted to perform the work during a “C” check.
However, in an effort to save about 200 hours of maintenance work to accomplish the modification, American wrote an “Engineering Change Order” (ECO) that called for disconnecting the engine and pylon as a single unit and then lowering the unit with a forklift. They based this ECO shortcut on previous experience with older DC-10s for a similar modification. At that time, McDonnell-Douglas reviewed the procedure and advised against it, but American went ahead anyway, with no knowledge by the FAA.
Engineers at American did not conduct a fault analysis regarding the effect a forklift would have on the engine-pylon assembly in the event of a forklift malfunction or a human error. Forklift placement anywhere other than directly beneath the center of gravity would result in a torque that could overstress the joints, resulting in a crack on the pylon bulkhead (see graphic 11).
In the days following the crash, investigators inspected the maintenance procedures of all U.S. airlines that were flying the DC-10. They discovered that Continental and United Airlines copied the 200-hour shortcut devised by American, and they also incorrectly removed the engine and pylon as a single assembly. United used an overhead hoist to lower and raise the assembly, while Continental used the forklift method.
Review of the entire domestic DC-10 fleet revealed the removal and installation of 175 pylon/engine assemblies, of which 88 involved the incorrect method of removing the engine and pylon as a single unit. Of these 88, 12 were lowered and raised with an overhead crane. The remaining 76 were lowered and raised with a forklift.
The fleet inspections revealed six DC-10s with fractured upper flanges on the pylon aft bulkheads: four from American and two from Continental. All six cases involved the use of a forklift. NTSB metallurgists found that the failure modes on the Continental aircraft were similar to those found on American’s DC-10 fleet.
The Midnight Shift and a Forklift
Investigators attempted to reconstruct exactly what happened to the DC-10 that crashed in Chicago. They discovered that the pylon was likely damaged during maintenance performed about two months prior to the accident, on March 30, 1979. American’s maintenance personnel not only removed the pylon and engine as a single unit, they also removed the bearings in the opposite order specified in the ECO. Instead of removing the pylon’s forward bearings first, they removed the aft bearings. This permitted the forward bulkhead to act as a pivot.
The midnight shift started the work and removed the aft bolt before going off duty. The forklift they used to support the assembly remained in place for hours, and investigators suspected that some hydraulic pressure may have bled off overnight and caused the forks to move. Any advertent or inadvertent loss of support to the engine and pylon assembly would produce an upward movement at the aft bulkhead’s upper flange and bring it into contact with the wing clevis.
Sure enough, when the day shift reported for duty, two of the mechanics saw the upper lug of the aft bulkhead come into contact with the bolts attaching the clevis to the wing. Manipulations of the forklift allowed the assembly to rotate, resulting in the pylon’s rear flange contacting the wing clevis. The force from this contact resulted in an undetected crack in the aft bulkhead that grew slightly longer each subsequent flight until it failed during Flight 191.
The Probable Cause
After holding a 10-day public hearing in July 1979, and just before Christmas of that same year, the NTSB issued a very long and involved probable cause. There was plenty of culpability to spread around. The Board ruled that the left wing aerodynamically stalled during takeoff, resulting from “… maintenance-induced damage leading to the separation of the no. 1 engine and pylon assembly at a critical point during takeoff.” The cause also cited, “The separation resulted from damage by improper maintenance procedures which led to failure of the pylon structure.”
The Board also listed numerous “contributing factors” such as the vulnerability of the pylon design to maintenance damage, deficiencies in FAA surveillance and reporting systems, and inadequate practices and communications among the airlines, McDonnell Douglas, and the FAA. The only entity spared of any fault was the flight crew, who had “no reasonable opportunity” to save the aircraft.
The Legacy of Flight 191
Flight 191 became a call to action for the industry and its regulators. The NTSB issued several recommendations that added clarity to quality control processes and reporting requirements. The FAA slapped American and Continental with fines of $500,000 and $100,000, respectively, for improper maintenance.
The DC-10’s reputation had already been tarnished by two previous fatal accidents that had differing circumstances and causes. Two weeks after the Flight 191 tragedy, the FAA grounded the entire DC-10 fleet. The grounding was lifted a few weeks later when the design was exonerated, but the damage was done. The DC-10’s use in passenger service began to plummet, and the McDonnell-Douglas shut down the line a few years later.
The personal toll of the accident was also immense. For example, two years after the accident, a 47-year-old mechanic who served as a crew chief at American’s maintenance facility committed suicide one day before he was to give a deposition in a civil lawsuit regarding his role in the crash. His wife told investigators that he “suffered from guilt” over the tragedy, even though he was not directly involved in the engine/pylon work.
As it echoes throughout the aviation industry 44 years later, the Flight 191 tragedy warns that attempts to streamline maintenance processes may reduce costs, but great care must be taken to ensure that additional safety risks are not introduced. Additionally, the reporting and cross-communication among all industry players regarding critical damage or failure incidents are vital to timely implementation of risk controls by all operators of similar aircraft.