2,000 Greater & Lesser Mysteries/2,000 Greater and Lesser Mysteries.iso/geninfo/mys00596.txt/text0034.txt

Text File | 1994-06-10 | 17.9 KB | 318 lines

It's been about two years since I last posted this, so...


--------------------

Excerpts from the NTSB accident report on the Chicago O'Hare crash:

Synopsis:

About 1504 CDT, May 25, 1979, American Airlines Flight 191, a McDonnell-Douglas
DC-10-10 aircraft, crashed into an open field just short of a trailer park about
4600' northwest of the departure end of runway 32R at Chicago-O'Hare Internat-
ional Airport, Illinois.

Flight 191 was taking off from Runway 32R.  The weather was clear and the vis-
ibility was 15 miles.  During the takeoff rotation, the left engine and pylon
assembly and about 3 ft of the leading edge of the left wing separated from
the aircraft and fell to the runway.  Flight 191 continued to climb to about
325' above the ground and then began to roll to the left.  The aircraft con-
tinued to roll to the left until the wings were past the vertical position,
and during the roll, the aircraft's nose pitched down below the horizon.

Flight 191 crashed into the open field and the wreckage scattered into an
adjacent trailer park.  The aircraft was destroyed in the crash and subsequent
fire.  Two hundred and seventy-one persons on board Flight 191 were killed;
two persons on the ground were killed, and two others were injured.  An old
aircraft hangar, several automobiles, and a mobile home were destroyed.

The National Transportation Safety Board determines that the probable cause
of this accident was the asymmetrical stall and the ensuing roll of the air-
craft because of the uncommanded retraction of the left wing outboard leading
edge slats and the loss of stall warning and slat disagreement indication sys-
tems resulting from maintenance-induced damage leading to the separation of the
No. 1 engine and pylon assembly at a critical point during takeoff.  The sep-
aration resulted from damage by improper maintenance procedures which led to
failure of the pylon structure.

Contributing to the cause of the accident were the vulnerability of the design
of the pylon attach points to maintenance damage; the vulnerability of the
design of the leading edge slat system to the damage which produced asymmetry;
deficiencies in Federal Aviation Administration surveillance and reporting sys-
tems which failed to detect and prevent the use of improper maintenance proced-
ures; deficiencies in the practices and communications among the operators,
the manufacturer, and the FAA which failed to determine and disseminate the
particulars during previous maintenance damage incidents; and the intolerance
of prescribed operational procedures to this unique emergency.



Findings (p. 67)

1.  The engine and pylon assembly separated either at or immediately after
takeoff.  The flightcrew was committed to continue the takeoff.

2.  The aft end of the pylon assembly began to separate in the forward flange
of the aft bulkhead.

3.  The structural separation of the pylon was caused by a complete failure of
the forward flange of the aft bulkhead after its residual strength had been
critically reduced by the fracture and subsequent service life.

4.  The overload fracture and fatigue cracking on the pylon aft bulkhead's
upper flange were the only preexisting damage on the bulkhead.  The length of
the overload fracture and fatigue cracking was about 13 inches.  The fracture
was caused by an upward movement of the aft end of the pylon which brought the
upper flange and its fasteners into contact with the wing clevis.

5.  The pylon to wing attach hardware was properly installed at all attachment
points.

6.  All electrical power to the No. 1 AC generator bus and No. 1 DC bus was
lost after the pylon separated.  The captain's flight director instrument, the
stall warning system, and the slat disagreement warning light systems were
rendered inoperative.  Power to these buses was never restored.

7.  The No. 1 hydraulic system was lost when the pylon separated.  Hydraulic
systems No. 2 and No. 3 operated at their full capability throughout the flight.
Except for spoiler panels No. 2 and No. 4 on each wing, all flight controls
were operating.

8.  The hydraulic lines and followup cables of the drive actuator for the left
wing's outboard leading edge slat were severed by the separation of the pylon
and the left wing's outboard slats retracted during climbout.  The retraction
of the slats caused an asymmetric stall and subsequent loss of control of the
aircraft.

9.  The flightcrew could not see the wings and engines from the cockpit.
Because of the loss of the slat disagreement light and the stall warning system,
the flightcrew would not have received an electronic warning of either the slat
asymmetry or the stall.  The loss of the warning systems created a situation
which afforded the flightcrew an inadequate opportunity to recognize and
prevent the ensuing stall of the aircraft.

10.  The flightcrew flew the aircraft in accordance with the prescribed emer-
gency procedure, which called for the climbout to be flown at V2 speed.  V2
was 6 KIAS below the stall speed for the left wing.  The deceleration to V2
speed caused the aircraft to stall.  The start of the left roll was the only
warning the pilot had of the onset of the stall.

11.  The pylon was damaged during maintenance performed on the accident aircraft
at American Airline's Maintenance Facility at Tulsa, Oklahoma, on March 29 and
30, 1979.

12.  The design of the aft bulkhead made the flange vulnerable to damage when
the pylon was being separated or attached.

13.  American Airlines engineering personnel developed an ECO to remove and
reinstall the pylon and engine as a single unit.  The ECO directed that the
combined engine and pylon assembly be supported, lowered, and raised by a
forklift.  American Airlines engineering personnel did not perform an adequate
evaluation of either the capability of the forklift to provide the required
precision for the task, or the degree of difficulty involved in placing the
lift properly, or the consequences of placing the lift improperly.  The CO
did not emphasize the precision required to place the forklift properly.

14.  The FAA does not approve the carriers' maintenance procedures, and a
carrier has the right to change its maintenance procedures without FAA approval.

15.  American Airlines personnel removed the aft bulkhead's bolt and bushing
before removing the forward bulkhead attach fittings.  This permitted the
forward bulkhead to act as a pivot.  Any advertent or inadvertent loss of
forklift support to the engine and pylon assembly would produce an upward
movement at the aft bulkhead's upper flange and bring it into contact with
the wing clevis.

16.  American Airlines maintenance personnel did not report formally to their
maintenance engineering staff either their deviation from the removal sequence
contained in the ECO or the difficulties they had encountered in accomplishing
the ECO's procedures.

17.  American Airline's engineering personnel did not perform a thorough
evaluation of all aspects of the maintenance procedures before they formulated
the ECO.  The engineering and supervisory personnel did not monitor the
performance of the ECO to ensure either that it was being accomplished properly
or if their maintenance personnel were encountering unforeseen difficulties in
performing the assigned tasks.

18.  The nine situations in which damage was sustained and cracks were found on
the upper flange were limited to those operations wherein the engine and pylon
assembly was supported by a forklift.

19.  On December 19, 1978, and Feb. 22, 1979, Continental Airlines maintenance
personnel damaged aft bulkhead upper flanges in a manner similar to the damage
noted on the accident aircraft.  The carrier classified the cause of the damage
as maintenance error.  Neither the air carrier nor the manufacturer interpreted
the regulation to require that it further investigate or reprot the damages to
the FAA.

20.  The original certification's fatigue-damage assessment was in conformance
with the existing requirements.

21.  The design of the stall warning system lacked sufficient redundancy; there
was only one stickshaker motor; and further, the design of the system did not
provide for crossover information to the left and right stall warning computers
from the applicable leading edge slat sensors on the opposite side of the
aircraft.

22.  The design of the leading edge slat system did not include positive
mechanical locking devices to prevent movement of the slats by external loads
following a failure of the primary controls.  Certification was based upon
acceptable flight characteristics with an asymmetrical leading edge slat
condition.

23.  At the time of DC-10 certification, the structural separation of an engine
pylon was not considered.  Thus, multiple failures of other systems resulting
from this single event was not considered.


Additional excerpts:

[design requirements for slats]
    "The motion on the flaps on opposite sides of the plane of symmetry
    must be synchronized unless the aircraft has safe characteristics with
    the flaps retracted on one side and extended on the other."

Since the left and right inboard slats are controlled by a single valve and
actuated by a common drum and the left and right outboard slats receive their
command from mechanically linked control valves which are "slaved" to the
inboard slats by the followup cable, the synchronization requirement was
satisfied.  However, since the cable drum actuating mechanisms of the left and
right outboard slats were independent of each other, the possibility existed
that one outboard slat might fail to respond to a commanded movement.
Therefore, the safe flight characteristics of the aircraft with asymmetrical
outboard slats were demonstrated by test flight.  These flight characteristics
were investigated within an airspeed range bounded by the limiting airspeed for
the takeoff slat positions--260 kts--and the stall warning speed; the flight
test did not investigate these characteristics under takeoff conditions.
In addition, a slat disagree warning light system was installed which, when
illuminated, indicated that the slat handle and slat position disagree, or
the slats are in transit, or the slats have been extended automatically.

The program engineer stated that the commanded slat position is held by trapped
fluid in the actuating cylinder, and that no consideration was given to an
alternate locking mechanism.  The slats' hydraulic lines and followup cables
were routed as close as possible to primary structure for protection; however,
routing them behind the wing's front spar was not considered because of
interference with other systems.

"The branch chief of the Reliability and Safety Engineering Organization of the
Douglas Aircraft Company described the failure mode and effects analysis (FMEA)
and fault analysis.  The witness indicated that the FMEA was a basic working
document in which rational failure modes were postulated and analyzed; vendors
and subcontractors were requested to perform similar analyses on equipment they
supplied to McDonnell-Douglas.  Previous design and service experience was
incorporated in the initial DC-10-10's FMEA's, and analyses were modified as
the design progressed.  The FMEA's were synthesized to make fault analyses,
which were system-oriented summary documents submitted to the FAA to satisfy 14
CFR 25.1309.  The FAA could have requested and could have reviewed the FMEA's.

The basic regulations under which the slats were certified did not require
accountability for multiple failures.  The slat fault analysis submitted to the
FAA listed 11 faults or failures, all of which were correctable by the
flightcrew.  However, one multiple failure--erroneous motion transmitted to
the right-hand outboard slats and an engine failure on the appropriate side--
was considered by McDonnell-Douglas in its FMEA.  The FMEA noted that the
"failure increases the amount of yaw but would be critical only under the most
adverse flight or takeoff conditions.  The probability of both failures
occurring is less than 1 x 10e-10 [a popular number with airframe
manufacturers!]."

[...]

"The December 1, 1978 revision of 14 CFR 25.571 retitled the regulation
"Damage-Tolerance and Fatigue Evaluation of Structure."  The fail-safe
evaluation must now include damage modes due to fatigue, corrosion, and
accidental damage.  According to the manufacturer, the consideration for
accidental damage was limited to damage which can be inflicted during routine
maintenance and aircraft servicing."

[...]

"Because of the designed redundancy in the aircraft's hydraulic and electrical
systems, the losses of those systems powered by the No. 1 engine should not have
affected the crew's ability to control the aircraft.  However, as the pylon
separated from the aircraft, the forward bulkhead contacted and severed
four other hydraulic lines and two cables which were routed through the wing
leading edge forward of the bulkhead.  These hydraulic lines were the operating
lines from the leading edge slat control valve, which was located inboard of
the pylon, and the actuating cylinders, which extend and retract the outboard
leading edge slats.  Two of the lines were connected to the No. 1 hydraulic
system and two were connected to the No. 3 system, thus providing the
redundancy to cope with a single hydraulic system failure.  The cables which
were severed provided feedback of the leading edge slat position so that the
control valve would be nulled when slat position agreed with position commanded
by the cockpit control.

The severing of the hydraulic lines in the leading edge of the left wing could
have resulted in the eventual loss of No. 3 hydraulic system because of fluid
depletion.  However, even at the most rapid rate of leakage possible, the system
would have operated throughout the flight.  The extended No. 3 spoiler panel on
the right wing, which was operated by the No. 3 hydraulic system, confirmed that
this hydraulic system was operating.  Since two of the three hydraulic systems
were operative, the Safety Board concludes that, except for the No. 2 and No. 4
spoiler panels on both wings which were powered by the No. 1 hydraulic systems,
all flight controls were operating.  Therefore, except for the significant
effect that the severing of the No. 3 hydraulic system's lines had on the left
leading edge slat system, the fluid leak did not play a role in the accident.

During takeoff, as with any normal takeoff, the leading edge slats were
extended to provide increased aerodynamic lift on the wings .  When the slats
are extended and the control valve is nulled, hydraulic fluid is trapped in the
actuating cylinder and operating lines.  The incompressiblity of this fluid
reacts against any external air loads and holds the slats extended.  This is
the only lock provided by the design.  Thus, when the lines were severed and
the trapped hydraulic fluid was lost, air loads forced the left outboard slats
to retract.  While other failures were not critical, the uncommanded movement
of these leading edge slats had a profound effect on the aerodynamic performance
and controllability of the aircraft.  With the left outboard slats retracted
and all others extended, the lift of the left wing was reduced and the airspeed
at which that wing would stall was increased.  The simulator tests showed that
even with the loss of the No. 2 and No. 4 spoilers, sufficient lateral control
was available from the ailerons and other spoilers to offset the asymmetric
lift caused by left slat retraction at airspeeds above that at which the wing
would stall.  However, the stall speed for the left wing increased to 159 KIAS.

[...]

The Safety Board is also concerned that the designs of the flight control,
hydraulic, and electrical systems in the DC-10 aircraft were such that all
were affected by the pylon separation to the extent that the crew was unable to
ascertain the measures needed to maintain control of the aircraft.

The airworthiness regulations in effect when the DC-10 was certificated were
augmented by a Special Condition, the provisions of which had to be met before
the aircraft's fully powered control system would be certificated.
The Special Condition required that the aircraft be capable of continued
flight and of being landed safely after failure of the flight control system,
including lift devices.  These capabilities must be demonstrated by analysis
or test, or both.  However, the Special Condition, as it applied to the slat
control system, was consistent with the basic airworthiness regulations in
effect at the time.  The basic airworthiness regulations specified requirements
for wing flap asymmetry only and did not include specific consideration of
other lift devices.  Because the leading edge slat design did not contain any
novel or unusual features, it was certificated under the basic regulation.  The
flap control requirements for symmetry and synchronization were applied to and
satisfied by the slat system design.  Since a malfunction of the slat actuating
system could disrupt the operation of an outboard slat segment, a fault analysis
was conducted to explore the probability and effects of both an uncommanded
movement of the outboard slats and the failure of the outboard slats to respond
to a commanded movement.  The fault analysis concluded that the aircraft could
be flown safely with this asymmetry.

Other aircraft designs include positive mechanical locking devices to prevent
movement of slats by external loads following a primary failure.  The DC-10
design did not include such a feature nor was it deemed necessary, since
compliance with the regulations was based upon analysis of those failure modes
which could result in asymmetrical positioning of the leading edge devices and
a demonstration that sufficient lateral control was available to compensate for
the asymmetrical conditions throughout the aircraft's flight envelope.  The
flight tests conducted to evaluate the controllability of the aircraft were
limited to a minimum airspeed compatible with stall-warning activation
predicated upon the slat-retracted configuration.