- American Airlines DC-10 at Chicago
- Accident Overview
- Accident Board Findings
- Accident Board Recommendations
- Relevant Regulations / Policy / Background
- Prevailing Cultural / Organizational Factors
- Key Safety Issue(s)
- Safety Assumptions
- Resulting Safety Initiatives
- Airworthiness Directives (ADs) Issued
- Common Themes
- Related Accidents / Incidents
- Lessons Learned
- American Airlines DC-10 at Chicago
Technical Related Lessons:
Engine separation can result in catastrophic damage. (Threat Category: Lack of System Isolation/Segregation and Structural Failure)
- Especially inflight, an engine separation is a highly uncontrolled event, and the engine trajectory following separation can be somewhat random, based on a number of factors (e.g., thrust at time of separation, nature of failure, aircraft normal load factor, residual structural strength and failure progressions, etc). Some manufacturers have designed for limited engine mount fuse capability for specific on-ground events such as high landing loads, but it is not intended that engine separations occur in flight. In this accident, the separation of the engine and pylon resulted in collateral damage to the hydraulic systems routed through the leading edge of the wing. While hydraulic redundancy existed for extension and retraction of the leading edge slats, the design did not consider the loss of all hydraulics to the outboard leading edge slats, or the resulting asymmetry and its effect on flight characteristics.
Designs for safety critical components or systems should consider all foreseeable failure modes, and strive to design such that when these failures do occur they result in a safe configuration. (Threat Category: Lack of System Isolation/Segregation)
- Loss of the hydraulic system associated with the actuation of the outboard leading edge slats on the left wing allowed the retraction of the slats, and development of a lift asymmetry that became uncontrollable. The design of the leading edge system did not consider the loss of a single hydraulic system leading to an asymmetric leading edge configuration. What proved to be the vulnerability of this design was its inability to accommodate a single failure (loss of hydraulic pressure to the leading edge slats on one wing) during a critical phase of flight. Following the accident, the alleviation to this single failure vulnerability was a redesign to require hydraulic pressure to drive the leading edge slats in either the extend, or retract direction.
Airplane warning/alerting systems should be designed with sufficient redundancy that failure of a component will not result in an unsafe condition or configuration. (Threat Category: Flight Deck Layout/Avionics Confusion)
- The loss of the Number 1 engine, and its associated electrical generator, resulted in the failure of a number of safety and warning systems, including the stick shaker, and slat asymmetry indication system, as well as many of the captain's instruments. With the loss of these safety indicating systems, the flight crew was unaware that a leading edge asymmetry had occurred, and had no means to determine that the left wing had stalled.
Common Theme Related Lessons:
Accident precursor recognition and timely intervention are dependent upon both a knowledgeable safety management workforce and effective information sharing throughout the industry. (Common theme: Organizational Lapses)
- Prior to the failure during reassembly at American Airlines, Continental Airlines had experienced similar failures while using a forklift engine/strut change procedure to comply with the same service bulletins. Had this information been shared with either the manufacturer, or with other airlines performing the same maintenance, the accident could possibly have been avoided.
Maintenance procedures, especially those associated with airworthiness directives and service bulletins, must consider the complexity of tasks being required, and not become so complex that they create new problems or difficulties. (Common Theme: Unintended Effects)
- In this accident, the service bulletin-related maintenance was difficult and time consuming to accomplish. American Airlines developed an alternate procedure to save time. The procedure was not properly validated, and resulted in unintended damage to the areas that had just been inspected. According to the NTSB, proper validation of the procedure would have made apparent the difficulty in manipulating the engine/pylon assembly and the potential for damage to the wing/pylon attachment structure.
Flawed safety assumptions made during design phases can have unintended, catastrophic consequences. (Common Theme: Flawed Assumptions)
- The wing leading edge slat system was designed without an alternate means to lock the slats in the extended position. McDonnell-Douglas assumed that the slats would always retract symmetrically. Further, with loss of the number one electrical generator, the stall warning stick shaker motor and slat asymmetry indications were deactivated, making it impossible for the flight crew to determine that the leading edge asymmetry had occurred and that the left wing had stalled.