American Airlines Flight AA191, Source: [27]

Fig. 1.17 AA DC-10-10 N110AA,

Werner Fischdickc On May 25 1979, the American Airlines

widebody DC-10-10, registered N110AA, was preparing at Chicago O’Hare Interna-tional Airport for departure with 271 peo-ple aboard on the transcontinental flight AA191 to Los Angeles, California. At the start on the runway, the DC-10’s accelera-tion and takeoff roll seemed perfectly nor-mal at a flap setting of 10 degrees and left rudder with right aileron use as compensa-tion for the right crosswind. But at 6000 feet down the runway, just before rotating into the takeoff attitude, pieces of the port

(No 1) engine pylon fell away from the aircraft, and white vapour began to stream from the mounting. A moment later, during the rotation itself, the entire No 1 en-gine and pylon tore themselves loose from the aircraft, flew up over the top of the wing, and smashed back onto the runway behind the still accelerating DC-10 as it lifted into the air. The aircraft’s port wing had dropped slightly as the DC-10 lifted off, but this was quickly picked up by application of aileron and rudder and the DC-10 continued to climb out with its wings level while accelerating to a maxi-mum speed of 172 knots. The nose up attitude of about 14^◦, as well as the air-craft’s heading, appeared stable with the right aileron and right rudder being used

Fig. 1.18 Main developments in the DC-10’s disastrous takeoff, from engine separation to impact, (MT/AA)

to maintain equilibrium and it seemed that, despite the loss of its port engine, the DC-10 was responding well to control. But 10 seconds later, when the DC-10 had climbed to about 300 feet, the speed decreased to 159 knots and it began to roll to the left at an increasing rate, despite the crew’s application of right aileron. The roll quickly steepened alarmingly, even though increasing amounts of opposite rudder and aileron were being applied, and it began yawing to the left as well. Simultane-ously, the nose lowered and the aircraft began to loose height, despite increasing the up elevator. At the same time, the bank increased still further. Finally, the DC-10’s wings were past the vertical in a 112 degree left roll and a 21 degree nosedown atti-tude, with full opposite aileron and rudder, and almost full up elevator being applied.

At this point the wingtip struck the ground, pivoting the DC-10 into the ground, nose first, with enormous impact. The aircraft exploded in an enormous flash of flames and a cloud of black smoke. The DC-10 had been airborne for only 31 seconds, and none of the occupants survived. The trajectory of this ill-fated flight is illustrated in fig. 1.18.

During the subsequent investigation by the National Transportation Safety Board NTSB, two key questions dominated the investigators’ minds: What had caused the engine pylon to break away so unexpectedly from the aircraft’s wing under perfectly normal operating conditions? And why had this led to such a complete loss of con-trol? In theory, the DC-10 should certainly have been aerodynamically capable of climbing away successfully after the physical loss of the engine, and returning for

a safe landing. The overall investigation therefore concentrated primarily on two major areas:

1. Identifying the structural failure which led to the engine-pylon separation and determining its cause;

2. Determining the effects of the structural failure on the aircraft’s performance and systems, and identifying what led to the loss of control.

The following observations in these areas were made during the analysis:

1. The analysis of the pylon structural failure revealed that fractures in the upper flange of the pylon rear bulkhead at the joint between the pylon and wing re-sulted in this structural failure. Moreover, a subsequent fleetwide grounding and inspection of all US registered DC-10’s revealed that in total six other American Airlines and Continental aircraft had similar fractures. All six had been subjected to the same maintenance procedures, involving removal and reinstallation of the engines and pylons. Both airlines had individually devised a procedure which they believed to be more efficient than that one recommended by the manufac-turer, involving the removal of the engine and pylon as a single unit instead of removing the engines from the pylons before the pylons are removed from the wing. Altogether the evidence was compelling that the cracks in the rear bulk-head upper flanges were being introduced as a result of these irregular main-tenance practices, which were unauthorized by the manufacturer as well as the FAA.

2. During the wreckage analysis, it was found that a three metre section of the port wing’s leading edge, just forward of the join between the No 1 engine pylon and the wing, was torn away with the pylon, severing the hydraulic system’s lines for the port wing’s outboard slats. Thirty five of the 36 leading edge slat tracks were subsequently examined, disclosing that, at impact, the port wing’s outboard slats were retracted, while its inboard slats, together with the starboard wing’s inboard and outboard slats, were in an extended position, as illustrated in fig. 1.19. This retraction of the port wing’s outboard slats was caused by the combination of a lack of hydraulic pressure and the air loads. This retraction was critical since it had a profound effect on the aerodynamic performance and controllability of the aircraft. The lift on the port wing was reduced and its stalling speed increased to 159 knots. Since the aircraft’s speed reduced to 159 knots during the 14^◦pitch attitude climb¹, the port wing stalled and the roll to the left was initiated. With the loss of engine No 1, all other accessories driven by this engine were lost, namely the pressure pumps of hydraulic system No 1 and the No 1 AC genera-tor². The separation also severed electrical wiring, resulting in the loss of power to the captain’s instrument panel, the slat disagreement warning system, stall warning system and its stick-shaker function. This implied that there was little or

1In accordance with the airline’s prescribed engine failure procedures.

2These accessories would have remained operational when an engine ceased to operate, but these were severed in this situation because of the physical separation of the engine from the aircraft and the damage to the hydraulic power and other lines.

(a) Artist impression of the dam-aged aircraft during its 31 second flight, note the retracted outboard slats on the port wing, (MT/AA)

(b) Picture of the dam-aged aircraft just before impact, source: [3]

(c) Picture of the dam-aged aircraft just after impact, source: airdis-asters.com

Fig. 1.19 Drawings and pictures of heavy damage to AA DC-10-10 N110AA

no warning to the pilot of the onset of the stall on the outboard section of the port wing. The loss of control of the DC-10 was thus the result of a combination of three events: the retraction of the port wing’s outboard leading edge slats, the loss of the slat disagreement warning system, and the loss of the stall warning sys-tem. All were consequences of the separation of the engine and pylon assembly.

Each on its own would not have resulted in the crew losing control. But together, during a highly critical phase of flight, they posed a problem that gave the crew insufficient time to recognize and correct.

The National Transportation Safety Board finally determined the cause of the accident to be the asymmetric stall and ensuing roll of the aircraft because of the retraction of the port wing outboard leading edge slats, and the loss of stall warning and slat disagreement indicator systems resulting from the separation of the No 1 engine and pylon assembly, at a critical point during takeoff. The separation resulted from damage inflicted by improper maintenance procedures which led to the failure of the pylon structure.

Contributing to the cause were:

• The vulnerability of pylon attachment points to maintenance damage and of the leading edge slat system to the damage which produced asymmetry;

• Deficiencies in the FAA’s surveillance and reporting systems in failing to detect improper maintenance procedures;

• Deficiencies in communication between the aircraft operators, the manufacturer and the FAA in failing to disseminate details of previous maintenance damage;

• The inadequacy of prescribed engine failure crew procedures to cope with unique emergencies.

Post accident analysis has indicated that the pilot had about 15 seconds to react to the failure before control was completely lost. If corrective action had been taken, the plane could have been saved [26]. Obviously, under such emergency conditions, an automatic fault-tolerant control system could have been extremely useful to assist

the pilots, and on-line generated diagnostic information could have been useful to recover the plane. However, it should be noted that once the pilot let the speed decrease to V2, the angle of attack of the affected left wing exceeded its stall limit thus causing a non recoverable loss of control. It is important to realize that the main contribution fault tolerant control could most probably provide in this situation, was to improve the reaction time of the pilot to recover and stabilize the aircraft and to prevent the speed to decay by taking into account the minimum speed limit. Once the stall limit was exceeded, fault tolerant control could not recover from this fatal condition anymore as there would not be enough control authority by the remaining effectors to recover from the loss of control. From an operational standpoint, a too low airspeed combined with a very low altitude leads to a lack of sufficient energy to escape from this catastrophic situation.