Subject: The DC-10 yet once again (Re: A brief commentary)

From: [email-masked] (Robert Dorsett)
Date: 09 Jul 96 13:09:43

In article <[email-masked]> [email-masked] (Richard Shevell) writes:
> The NTSB report was faulty. For example there was no failure of the control
> system.

The slats are considered part of the flight control system.

>  The crash was due to a stall.

Which was engendered by inadvertent retraction of the flaps.  Duh.

> Because the wing leading edge had been damaged by the
> trajectory of the nacelle, the stall speed was increased. Because the
> wing leading edge had been damaged by the
> trajectory of the nacelle, the stall speed was increased.

Apart from the absence of the slats, there is no indication that any
aerodynamic or structural deformity contributed to the higher stall
speed of that wing

Since you have apparently forgotten much of the report (the accuracy of
which has never been contested by any responsible authority), here you
go:

1.11 	Flight Recorders

The aircraft was equipped with a Fairchild Model A-100 CVR, serial No.
2935. The CVR was recovered and brought to the Safety Board's laboratory
where a transcript of the recording was prepared. The recording was
incomplete because of the loss of electrical power to the recorder
during aircraft rotation. However, the aircraft's gross weight,
stabilizer trim setting, V1, and VR callouts were recorded.

The aircraft was equipped with a Sundstrand digital flight data recorder
(DFDR), serial no. 2298. The recorder had been damaged structurally, but
there was no fire or heat damage. The recording tape was broken; upon
removal from the recorder the tape was spliced together and a readout
was made. Two 6-sec areas of data were damaged because of the breaks in
the tapes; however, most of these data was recovered.

The DFDR recorded 50 sec of data during the takeoff roll and 31 sec of
airborne data before the recording ended. (See appendix H.) The DFDR
readout showed that the stabilizer trim setting for takeoff was 6.5!
aircraft noseup. The DFDR'S tolerance for this parameter is + 1!.
Because of unusual aircraft attitudes during the last few seconds of the
flight, the recorded altitude and airspeed data were not correct.
Therefore, the DFDR altitude and indicated airspeed values cited
hereafter have been corrected for the position errors resulting from the
aircraft's attitudes during the last few seconds of the descending
flight.

Correlation of the DFDR and CVR recordings disclosed that the flightcrew
had set the flaps and stabilizer trim at 10! and about 5! aircraft
noseup, respectively, for takeoff. A rolling takeoff was made, takeoff
thrust was stabilized at 80 KIAS, and left rudder and right aileron were
used to compensate for the right crosswind. The V1 and VR callouts were
made about 2 sec after these speeds were recorded by the DFDR. The
elevator began to deflect up at VR. The aircraft began to rotate upward
immediately and continued upward at a rate of 1.5! per sec. Flight 191
accelerated through V2 speed during rotation and before it lifted off
the runway. The last stable takeoff thrust on the No. 1 engine was
recorded 2 sec before liftoff. One second later, the word "damn" was
recorded on the CVR, and then the CVR ceased operating.

One second before liftoff and simultaneous with the loss of the CVR and
the No. 1 engine's parameters, the DFDR ceased recording the positions
of the left inboard aileron, left inboard elevator, lower rudder, and
Nos. 2 and 4 left wing leading edge slats. The DFDR continued to record
all other parameters including the position of the upper rudder, the
outboard aileron, the outboard elevator, and the No. 4 leading edge
slats on the right side of the aircraft. The electrical power for the
CVR and the sensors for the lost DFDR functions were all derived from
the aircraft's No. 1 a.c. generator bus.

Flight 191 became airborne about 6,000 ft from the start of the takeoff
roll and remained airborne for 31 sec. It lifted off at V2 + 6 KIAS and
at 10! pitch attitude. Two seconds after liftoff, the DFDR reading for
the No. 1 engine's N1 was zero, the No. 2 engine's N1 speed was
increasing through 101 percent, and the No. 3 engine's N1 was
essentially at the takeoff setting.

The flight lifted off in a slight left wing-down attitude. Application
of right wing-down aileron and right rudder restored the flight to a
wings-level attitude and the heading was stabilized between 325! and
327!. The flight maintained a steady climb about 1,150 feet per minute
(fpm) at a 14! noseup pitch attitude--the target pitch attitude
displayed by the flight director for a two-engine climb. During the
climb, the No. 2 engine N1 speed increased gradually from 101 percent to
a final value of 107 percent; the no. 3 engine N1 speed did not change
appreciably from the takeoff setting. During the initial parA of the
climb, the aircraft accelerated to a maximum speed of 172 KIAS; it
reached this value about 9 sec after liftoff and about 140 ft a.g.l.

Flight 191 continued to climb about 1,100 fpm. The pitch attitude and
heading were relatively stable. Right wing-down aileron and right rudder
were used to control and maintain the heading and the roll attitude
during the climb in the gusty right crosswind.

During the climb, the aircraft began to decelerate from 172 KIAS at an
average rate of about 1 kn per second. At 20 sec after liftoff, at 325
ft a.g.l. and 159 KIAS, the flight began to roll to the left and passed
through 5! left wing down. The left roll was accompanied by increasing
right-wing- down aileron deflection. At this point, the previously
stabilized right rudder deflected suddenly to zero, remained at zero for
1 sec, and then moved toward its previous deflection. The flight began
to turn to the left, and the left roll increased even though increasing
right rudder and right-wing- down aileron deflections were being
applied. At 325 ft a.g.l. the flight had turned through the runway
heading and was rolling to the left at 4! per second. The right rudder
deflection increased during the turn. The previously stable pitch
attitude began to decrease from 14! even though the elevator was being
increased to the full aircraft noseup deflection. The maximum pitch rate
of about 12! per second was reached just before the crash.

Flight 191 continued to roll and turn to the left despite increasing
right rudder and right-wing-down aileron deflections. Three seconds
before the end of the DFDR tape, the aircraft was in a 90! left bank and
at a 0! pitch attitude. The DFDR recording ended with the aircraft in a
112! left roll and a 21! nosedown pitch attitude with full counter
aileron and rudder controls and nearly full up elevator being applied.

DFDR longitudinal and vertical acceleration data were integrated to
determine the headwind components at points where the aircraft attained
certain speeds and where it lifted off; to establish an altitude
profile; and to determine the location where the DFDR stopped. These
data showed that the DFDR ceased operation 14,370 ft from the southeast
end of runway 32R and 820 ft left of the runway's extended centerline.
Examination of the crash site showed that the first point of impact was
14,450 ft beyond the southeast end of runway 32R and 1,100 ft left of
its extended centerline. Based on these data and the corrected
altitudes, the DFDR ceased operating at impact. The flight reached a
maximum altitude of 350 ft a.g.l.

1.16.4 	Wind Tunnel and Simulator Tests

The wind tunnel at the National Aeronautics and Space Administration's
Langley Research Center was used to determine the aerodynamic
characteristics of a DC-10 wing with the left engine and pylon missing,
left wing leading edge damaged, and the- left wing's outboard leading
edge slats retracted. In this configuration, the aircraft's stall speed,
minimum control speeds with the critical engine inoperative (VMC), and
controllability were calculated. The effects that the loss of the No. 1
hydraulic system and the possible loss of the No. 3 hydraulic system
would have on the aircraft's control authority were also investigated
and calculated.

The DFDR data, aerodynamic data derived from wind tunnel tests, and the
atmospheric conditions on the day of the accident were integrated into
the Douglas Motion Base Simulator. The following conditions were
simulated: (1) The separation of the No. 1 engine and pylon and the
aerodynamic effects of the separation and resultant damage, such as
changes in the aircraft's gross weight and lateral and longitudinal
e.g.; (2) the uncommanded retraction of the left wing's outboard leading
edge slats; (3) the loss of the No. 1 and No. 3 hydraulic systems; (4)
the loss of power from the No. 1 a.c. electrical bus and resultant loss
of the captain's flight instruments; and (4) both the loss and retention
of the stall warning system and its stickshaker function.

The wind tunnel data for the damaged aircraft were correlated with the
DFDR data so that the simulator data reflected those derived from Flight
l91's DFDR. With the slats extended, the all- engine-operating stall
speed was 124 KIAS; the asymmetric slat-retracted stall speed for the
left wing was 159 KIAS; and the estimated wings-level VMc for the
damaged aircraft was 128 KIAS. With a 4! left bank-- a bank into the
missing engineQ 159 KIAS was the minimum speed at which directional
control could be maintained with the engines operating at takeoff
thrust.

Each of the thirteen pilots who participated in the simulation was
thoroughly briefed on the flight profile of Flight 191. In the simulator
the No. 1 engine and pylon assembly was programmed to separate at 10! of
rotation on all takeoffs with simultaneous loss of the No. 1 hydraulic
system. On some test runs the No. 3 hydraulic system was also programmed
to fail. Generally, slats began to retract about 1 sec after the engine
and pylon separated and were fully closed in about 2 sec. Some test runs
were conducted with the slat retraction beginning 10 to 20 sec after the
engine and pylon separated. Speed control guidance from the flight
director was available for all runs, and the stickshaker, programmed for
the slat-retracted-airspeed schedule, was operational on some runs.

During the tests, about 70 takeoffs and 2 simulated landings were
conducted. In all cases where the pilots duplicated the control inputs
and pitch attitudes shown on the Flight l91's DFDR, control of the
aircraft was lost and Flight l91's flight profile was duplicated. Those
pilots who attempted to track the flight director's pitch command bars
also duplicated Flight l91's DFDR profile.

According to American Airline's procedures, the standard rate of
rotation is between 3! to 4! per second, whereas Flight 191 rotated at
only about 1.5! per second. In those simulations in which the standard
rate was used, the aircraft lifted off at a lower airspeed, and the
airspeed did not increase to the levels recorded by Flight l91's DFDR.
The left roll began at 159 KIAS; however, because of the lesser amount
of excess airspeed, the roll started below 100 ft a.g.l. In those cases
where slat retraction was delayed, the left roll started at a higher
altitude but its characteristics remained the same. In all cases,
however, the roll began at 159 KIAS. In many cases, the pilots, upon
recognizing the start of the roll at a constant pitch attitude, lowered
the nose, increased airspeed, recovered, and continued flight. The roll
angles were less than 30!, and about 80 percent right rudder and 70
percent right-wing-down aileron were required for recovery. In those
cases where the pilot attempted to regain the 14! pitch attitude
commanded by the flight director command bars, the aircraft reentered
the left roll.

On those test runs with an operative stickshaker programmed to begin at
the slat-retracted-airspeed schedule, the stickshaker activated 7 sec
after liftoff and the pilot flew the aircraft at the stickshaker
boundary speed of 167 to 168 KIAS (V2 + 15). Also, when V2 + 10 was
obtained and the pilot disregarded the pitch command bars, a stable
climb was readily achieved. Attempts to duplicate the l-sec interval of
zero rudder displacement did not have any noticeable effect on the
flight profile.

Based on the probable electrical configuration existing after the
takeoff of Flight 191, pilots and test pilots who testified at the
Safety Board's public hearing believed that the stall warning system and
the slat disagreement warning light were inoperative. They stated that
the flightcrew cannot see the No. 1 engine and left wing from the
cockpit and, therefore, the first warning the flightcrew would have
received of the stall was the beginning of the roll. Under these
circumstances, none of these pilots believed that it was reasonable to
expect the flightcrew of Flight 191 to react in the same manner as did
the simulator pilots who were aware of Flight 191's profile and were
able to recover from the stall.

The FAA conducted a second series of tests to determine the takeoff and
landing characteristics of the DC-10 with an asymmetrical leading edge
slat configuration. The slat configuration which existed on Flight 191
before impact was duplicated during about 84 simulated takeoffs and 28
simulated landings. Takeoffs were performed at both normal and slow
rotation rates, at normal V speeds, at VR -5 kn, and with thrust reduced
to- simulate a limiting weight condition during a second-segment climb.

The "slat disagree" light, takeoff warning system, and stall warning
system were programmed to operate properly for both the normal and
asymmetric outboard slat configuration.

Landings were performed at the maximum landing weight, 50! of flap, and
a normal approach speed. The simulator was programmed so that a left
outboard slat failure would cause the slat to fully retract at altitudes
as low as 30 ft a.g.l. The FAA concluded that "The speed margins during
the final portion of the landing approach are also very small; however,
the landing situation is considered less critical since powered slat
retraction from the landing configuration requires 18 seconds and an
additional thrust is readily available to adjust the flight path."{1}

During these tests, none of the pilots experienced problems with
aircraft controllability. In many of the test runs, the stickshaker
activated at or just after liftoff, and the pilots altered the
aircraft's attitude and airspeed in response to the warning. A loss of
thrust from an engine during the takeoff roll was not simulated during
any of the tests. Based on a study performed by the J. H. Wiggins
Company{2}, the best estimates of the probabilities of an uncommanded
slat retraction during takeoff ranged from one chance in one hundred
million (1 x 10-8 ) to two chances in a billion (2 x 10-9 ) per flight.

1.17.3 	DC-10 Certification

The DC-lO's pylon structure, flight controls, hydraulic system, and
electrical system were certificated in accordance with the applicable
provisions of 14 CFR Part 25 effective February I, 1965, as amended, and
Special Condition No. 25-18-WE-7, January 7, 1970, as amended. (See
appendix E.)

Special Condition No. 25-18-WE-7, Docket No. 10058, was issued pursuant
to 14 CFR 21.16 because the airworthiness regulations of Part 25 did not
contain adequate or appropriate safety standards for the aircraft
because of a novel or unusual design feature. In the case of the DC-10,
this feature was the fully powered flight control system.

The function of assessing compliance with certain aspects of the type
certification was delegated to FAA Designated Engineering
Representatives who were employed by McDonnell-Douglas. Such
representatives are designated by the FAA to represent the Administrator
pursuant to Section 314 of the Federal Aviation Act of 1958 and 14 CFR
183.29. According to FAA and McDonnell- Douglas witnesses, the workload
involved in the certification process far exceeds the FAA's manpower
resources.

The chief of the FAA's Western Region Aircraft Engineering Division
stated that during the type certification process the review of the
basic data and the most critical tests are reserved to the FAA itself.
The fault analysis data are reviewed and approved by FAA engineering
personnel. He also said that little delegation is done in the flight
test area. The chief of the FAA's Western Region Flight Test Branch
stated that the DC-lO's type certification required 500 hrs of flight
testing, and 90 percent of that time was flown by FAA test pilots.

The principle underlying the regulations concerning the certification
the aircraft's systems was redundancy. This principle contemplates that,
while each critical component of a system is required to perform
functions within the design envelope of the aircraft, its failure will
nevertheless be assumed. Accordingly, appropriate analyses and tests are
required to insure that sufficient redundancy exists so that after a
single failure of any component or element its functions will be
distributed to other components capable of assuming them safely. The
criteria for the certification of the aircraft's pylon and its
components were contained in 14 CFR 25.571, "Fatigue Evaluation of
Flight Structure". (See appendix E) This regulation required the
manufacturer to show, by analysis, tests, or both, that those parts of
the structure whose failure could result in catastrophic failure of the
aircraft would be able to withstand the repeated loads of variable
magnitude expected in flight, that catastrophic failure or excessive
structural deformation that could adversely affect the flight
characteristics of the aircraft are not- probable after fatigue failure
or obvious failure of a single principal structural element, and that
after this type of failure of a single principal structural element, the
remaining structure must be able to provide an alternate load path. The
regulation only required that fatigue damage be evaluated. The chief of
the FAA's Western Region Aircraft Engineering Division testified that
under normal loading there was "extremely low stress" on the upper
flange and "the possibility of fatigue was believed to be extremely low,
low enough that you would not consider fatigue failure.

Because all flight controls were hydraulically actuated and the basic
regulations did not cover this configuration, Special Condition No.
25-18-WE-7 was formulated. However, the trailing edge flap and leading
edge slat systems were certified under the basic regulations.

The leading edge slat system was certified in accordance with 14 CFR
25.671-general control system requirements, 14 CFR 25.675--control
system stops, 14 CFR 25.685-detailed design requirements for flight
control systems, and 14 CFR 25.689--cable system design. The chief
program engineer at McDonnell-Douglas said that the flap control
requirements of 14 CFR 25.701(a) were also applied to the slats.
Paragraph (a) states:

"The motion on the flaps on opposite sides of the plane of symmetry must
be synchronized unless the aircraft has safe characteristics with the
flaps retracted on one side and extended on the other."

Since the left and right inboard slats are controlled by a single valve
and actuated by a common drum and the left and right outboard slats
receive their command from mechanically linked control valves which are
"slaved" to the inboard slats by the followup cable, the synchronization
requirement was satisfied. However, since the cable drum actuating
mechanisms of the left and right outboard slats were independent of each
other, the possibility existed that one outboard slat might fail to
respond to a commanded movement. Therefore, the safe flight
characteristics of the aircraft with asymmetrical outboard slats were
demonstrated by test flight. These flight characteristics were
investigated within an airspeed range bounded by the limiting airspeed
for the takeoff slat positions --260 kns--and the stall warning speed;
the flight test did not investigate these- characteristics under takeoff
conditions. In addition, a slat disagree warning light system was
installed which, when illuminated, indicated that the slat handle and
slat position disagree, or the slats are in transit, or the slats have
been extended automatically.

The program engineer stated that the commanded slat position is held by
trapped fluid in the actuating cylinder, and that no consideration was
given to an alternate locking mechanism. The slats' hydraulic lines and
followup cables were routed as close as possible to primary structure
for protection; however, routing them behind the wing's front spar was
not considered because of interference with other systems.

The branch chief of the Reliability and Safety Engineering Organization
of the Douglas Aircraft Company described the failure mode and effects
analysis (FMEA) and fault analysis. The witness indicated that the FMEA
was a basic working document in which rational failure modes were
postulated and analyzed; vendors and subcontractors were requested to
perform similar analyses on equipment they supplied to
McDonnell-Douglas. Previous design and service experience was
incorporated in the initial DC-10-10's FMEA's and analyses were modified
as the design progressed. The FMEA's were synthesized to make fault
analyses, which were system-oriented summary documents submitted to the
FAA to satisfy 14 CFR 25.1309. The FAA could have requested and could
have reviewed the FMEA's.

The basic regulations under which the slats were certified did not
require accountability for multiple failures. The slat fault analysis
submitted to the FAA listed 11 faults or failures, all of which were
correctable by the flightcrew. However, one multiple failure--erroneous
motion transmitted to the right-hand outboard slats and an engine
failure on the appropriate side--was considered by McDonnell-Douglas in
its FMEA. The FMEA noted that the "failure increases the amount of yaw
but would be critical only under the most adverse flight or takeoff
conditions. The probability of both failures occurring is less than 1 x
10-10 ." The evidence indicated that this FMEA was not given to the FAA
formally but was available for review.

Special Condition No. 25-18-WE-7 requires the applicant to show that the
aircraft is capable of continued flight and landing after "any
combination of failures not shown to be extremely improbable." According
to FAA witnesses, the definition for extremely improbable that they have
been using "nd have been accepting for a number of years is one chance
in a billion, or 1 x 10

The regulation, 14 CFR 25.207, requires that "Stall warning with
sufficient margin to prevent inadvertent stalling with the flaps and
landing gear in any normal position must be clear and distinctive to the
pilot in straight and turning flight." The warning can be furnished
through the inherent aerodynamic qualities of the aircraft or by a
mechanical or electronic device. A visual warning device is
unacceptable. The warning must begin at a speed exceeding the stall
speed or the minimum speed demonstrated "....by seven percent or at any
lesser margin if the stall warning has enough clarity and duration,
distinctiveness, or similar properties." The flight testing of the DC-10
disclosed that the inherent aerodynamic stall warning exceeded the
required regulatory margin in all flap configurations until the landing
flap configuration (50!) was reached. According to the chief of the
FAA's Flight Test Branch, with 50! flaps the stall buffet still precedes
stall onset, "but it occurs quite close, within just a few knots of the
aerodynamic stall." Since the margin did not meet the regulatory
criteria, a stall warning system was installed.

The initial DC-10 design incorporated the left (No. 1) and right (No. 2)
autothrottle speed computers (AT/SC) as stall warning computers. The No.
1 and No. 2 AT/SC's were powered by the No. 1 and No. 3 a.c. buses,
respectively. The No. 1 AT/SC received inputs from the left inboard flap
position transmitter, from a position sensor on the left outboard slat
section, and the left angle-of-attack sensor. The No. 2 AT/SC received
its inputs from counterpart sensors and components on the right side of
the aircraft. The stickshaker motor was mounted on the captain's control
column and was powered by the No. 1 d.c. bus. A stall signal from either
computer would actuate the stickshaker motor. The design contained
provisions for a second stickshaker motor to be mounted on the first
officer's control column; however, the second stickshaker was a customer
designated option. The accident aircraft's stall warning system did not
incorporate the second stickshaker described above.

The December 1, 1978, revision of 14 CFR 25.571 retitled the regulation
"Damage-Tolerance and Fatigue Evaluation of Structure." The fail-safe
evaluation must now include damage modes due to fatigue, corrosion, and
accidental damage. According to the manufacturer, the consideration for
accidental damage was limited to damage which can be inflicted during
routine maintenance and aircraft servicing.

The FAA's Aircraft Engineering Division chief also stated that while the
recertification process disclosed a deficiency in design data on file
with the FAA it did not disclose any deficiency in the pylon's design.
In some cases, the manufacturer had the data on file. In one instance,
the data concerning the alternate load paths for thrust loads following
a thrust-link failure were questioned. The manufacturer's analysis
assumed the loads would be carried by the forward bulkhead. The
manufacturer also stated that the thrust loads could be carried out by
the aft bulkhead. The FAA asked McDonnell-Douglas to substantiate this
claim, and they did so successfully.

As a result of the postaccident simulator tests, an AD was issued which
required, as a condition for reinstatement of the type certificate, that
the aircraft be operated either with both AT/SC's installed and
operating, or with a modified single AT/SC that would receive slat
information from both sides of the aircraft. (See appendix F).

On July 30, 1979, a Notice of Proposed Rule Making (NPRM), docket No.
79WE-17AD, was issued. (See appendix F.) The NPRM contained an AD which
will require that the stall warning system incorporate two AT/SC's and
two stickshaker motors, and that the AT/SC's be modified to receive
position information from both outboard wing leading edge slat groups.

1.17.8 	Flightcrew Procedures

American Airline's Operating Manual contains the recommended procedures
for operating the DC- 10 aircraft and its personnel are required to
comply with the procedures set forth therein. Since the failure of the
pylon and engine did not occur until after V1, only those company
procedures relating to continued flight were examined. These procedures
are contained in the Emergency Procedures Section of the Operating
Manual.

The Emergency Procedures Section is prefaced with the following
guideline:

"The procedures on the Emergency Checklist are those where immediate and
precise action on the part of the crew will substantially reduce the
possibility of personal injury or loss of life. The emergency
procedures in this section are presented as the best way to handle these
specific situations. T hey represent the safest, most practical manner
of coping with emergencies, based on the judgment of the most
experienced Pilots and F/E's, the FAA approved procedures, and the best
available information. If an emergency arises for which these procedures
are not adequate or do not apply, the crew's best judgment should
prevail.S

The manual also provides guidelines as to how the flightcrew will use
the emergency checklist. The manual states, in part:

The checklist is a tool provided to minimize usually hasty and perhaps
improper action. Though all checklist procedures are not required to be
committed to memory it is expected that all crewmen understand fully
each and every procedure. :

The nature and seriousness of any given emergency cannot always be
immediately and accurately determined. As a professional you will always
fly the aircraft and/or immediately correct the obvious prior to any
specific reference to the cockpit checklist. Some of the items which
fall into the category of attending to the obvious are donning of O2
masks and goggles, establishing interphone communications, resetting the
fire aural warning, etc.

The emergency procedure for a takeoff engine failure, flaps 15! or less
or 22!, states, in part:

"This procedure assumes indication of engine failure where the takeoff
is continued. Each takeoff should be planned for the possibility of an
engine failure. Normal takeoff procedures ensure the ability to handle
an engine failure successfully at any point.

If an engine failure occurs when making a Standard Thrust takeoff,
Standard Thrust on the remaining engines will produce the required
takeoff performance. If deemed necessary, the remaining engines may be
advanced to Maximum Take-Off Thrust.

Speed 	CLIMB OUT AT V2 UNTIL REACHING
	800 FEET AGL OR OBSTACLE CLEARANCE
	ALTITUDE, WHICHEVER IS HIGHER
	THEN LOWER NOSE AND ACCELERATE"

The Operating Manual's discussion of the procedure contained an annotated profile drawing of the
takeoff. (See figure 14.) The annotations accompanying the profile sketch state (after the aircraft is
airborne), "Continue rotation to V2 (Deck angle 12!-20!)." Over the next picture of the aircraft is
the note, "Positive rate-Gear up." The next picture shows the aircraft level at 800 ft AGL and
contains the accelerate instructions noted above.
 Q 47Q

On July 23, 1979, American Airlines issued Operations Bulletin No.
DC-10-73 which amended the procedure. The bulletin states, in part:

"The following climb speeds will be utilized to obstacle clearance
altitude when an engine failure occurs after V1 on takeoff:

-	If engine failure occurs after V but not above V2, maintain
V2 to obstacle clearance altitude.

-	If engine failure occurs after V2, maintain speed attained
at time of failure but not above V2 + 10 to obstacle
clearance altitude.

- If engine failure occurs at a speed higher than V2 + 10, reduce speed to and maintain V2
+ 10 to obstacle clearance altitude.

NOTE: If the FD Take-Off mode is engaged at the time of engine failure the Pitch
Command Bar (and the Fast/Slow Indicator) will command V2 . Therefore, if the failure
occurs above V2, disregard these indications and fly the speed called for in the above
procedure."

2.  ANALYSIS

Aircraft and Flightcrew Performance

The flightcrew of Flight 191 were certificated properly and were
qualified for the flight. There was no evidence that their performance
was affected by medical problems.

The No. 1 engine and pylon assembly separated after the flightcrew was
committed to continuing the takeoff. Witnesses saw the pylon and engine
assembly travel up and over the left wing after it separated, and the
deformation of the pylon's forward bulkhead was consistent with their
observations. The left wing's leading edge skin forward of the pylon's
front bulkhead was found on the runway with the pylon structure. There
was no evidence that the pylon and engine assembly struck any critical
aerodynamic surfaces of the aircraft or any of the flight control
surfaces.

Since the loss of thrust provided by the No. 1 engine and the asymmetric
drag caused by the leading edge damage would not normally cause loss of
control of the aircraft, the Safety Board sought to determine the
effects the structural separation had on the aircraft's flight control
systems, hydraulic systems, electrical systems, flight instrumentation
and warning systems, and the effect, if any, that their disablement had
on the pilot's ability to control the aircraft.
As the engine separated from the aircraft, those accessories which
were driven by the engine were lost. This incIuded the pumps which
provided pressure to the aircraft's No. 1 hydraulic system, and the a.c.
generator which provided electrical power to a.c. generator bus No. 1.
During a routine emergency wherein the No. 1 engine ceases to operate,
all of the services provided by these accessories will remain operable,
deriving their respective hydraulic pressure and electrical power from
redundant sources driven by one or both of the remaining aircraft
engines. However, when the engine separates from the aircraft, the
hydraulic pressure and supply lines connecting the pumps with the system
are severed, the hydraulic system loses all of its fluid, and thus,
hydraulic pressure is not recoverable.

The separation of the engine and pylon also severed the electrical wire
bundles inside the pylon. These included the main feeder circuits
between the generator and the No. 1 a.c. generator bus. Although this
would remove the normal source of power from the bus, the bus could have
been powered by the a.c. tie bus, which is powered by generators on the
other engines. The No. 1 a.c. generator bus is connected to the a.c. tie
bus through a bus tie relay. Protective logic is provided in the
aircraft's electrical system. If an electrical fault is detected on the
generator bus, the protective logic will cause the bus tie relay to
trip, which will open the circuit between the generator bus and the tie
bus. This prevents a fault on one generator bus from affecting the
aircraft's remaining electrical services. In this accident, the loss of
the CVR and certain parameters on the FDR provided evidence that the No.
1 bus tie relay opened when the engine separated, probably as a result
of transient short circuits during the separation. The Safety Board
concludes that the electrical system's protective circuitry functioned
as it was intended and power to the No. 1 generator bus and the services
powered by that bus, including d.c. bus No. 1 and left emergency a.c.
and d.c. buses, were lost. None of these buses was restored for the
remainder of the flight.

The flightcrew might have been able to restore the No. 1 generator bus
and all of its services by activating the guarded bus tie relay switch
on the electrical and generator reset panel. This action would have been
effective only if the bus fault sensed during the separation was
temporary. The evidence indicated that the left emergency a.e. and d.c.
buses, and the No. 1 d.c. bus could have been restored separately by the
activation of the emergency power switch and the No. 1 d.c. tie switch
in the cockpit. There was no evidence to indicate that this was done.

The Safety Board believes that the flightcrew probably did not try to
restore the lost electrical power, either because of the nature of the
overall emergency involving other systems, which they probably perceived
to be more critical than the electrical problems, or because the time
interval did not permit them to evaluate and respond to the indicated
electrical emergency. The Safety Board does not criticize the crew's
inaction in this regard; however, since electrical power was not
restored, the captain's flight director instrument, several sets of
engine instruments and, most importantly, the stall warning and slat
disagree warning light systems remained inoperative.
Because of the designed redundancy in the aircraft's hydraulic and
electrical systems, the losses of those systems powered by the No. 1
engine should not have affected the crew's ability to control the
aircraft. However, as the pylon separated from the aircraft, the forward
bulkhead contacted and severed four other hydraulic lines and two cables
which were routed through the wing leading edge forward of the bulkhead.
These hydraulic lines were the operating lines from the leading edge
slat control valve, which was located inboard of the pylon, and the
actuating cylinders, which extend and retract the outboard leading edge
slats. Two of the lines were connected to the No. 1 hydraulic system and
two were connected to the No. 3 system, thus providing the redundancy to
cope with a single hydraulic system failure. The cables which were
severed provided feedback of the leading edge slat position so that the
control valve would be nulled when slat position agreed with position
commanded by the cockpit control.

The severing of the hydraulic lines in the leading edge of the left wing
could have resulted in the eventual loss of No. 3 hydraulic system
because of fluid depletion. However, even at the most rapid rate of
leakage possible, the system would have operated throughout the flight.
The extended No. 3 spoiler panel on the right wing, which was operated
by the No. 3 hydraulic system, confirmed that this hydraulic system was
operating. Since two of the three hydraulic systems were operative, the
Safety Board concludes that, except for the No. 2 and No. 4 spoiler
panels on both wings which were powered by the No 1 hydraulic systems,
all flight controls were operating. Therefore, except for the
significant effect that the severing of the No. 3 hydraulic system's
lines had on the left leading edge slat system, the fluid leak did not
play a role in the accident.

During takeoff, as with any normal takeoff, the leading edge slats were
extended to provide increased aerodynamic lift on the wings. When the
slats are extended and the control valve is nulled, hydraulic fluid is
trapped in the actuating cylinder and operating lines. The
incompressibility of this fluid reacts against any external air loads
and holds the slats extended. This is the only lock provided by the
design. Thus, when the lines were severed and the trapped hydraulic
fluid was lost, air loads forced the left outboard slats to retract.
While other failures were not critical, the uncommanded movement of
these leading edge slats had a profound effect on the aerodynamic
performance and controllability of the aircraft. With the left outboard
slats retracted and 811 others extended, the lift of the left wing was
reduced and the airspeed at which that wing would stall was increased.
The simulator tests showed that even with the loss of the No. 2 and No.
4 spoilers, sufficient lateral control was available from the ailerons
and other spoilers to offset the asymmetric lift caused by left slat
retraction at airspeeds above that at which the wing would stall.
However, the stall speed for the left wing increased to 159 KIAS.

The evidence was conclusive that the aircraft was being flown in
accordance with the carrier's prescribed engine failure procedures. The
consistent 14! pitch attitude indicated that the flight director command
bars were being used for pitch attitude guidance and, since the
captain's flight director was inoperative, confirmed the fact that the
first officer was flying the aircraft. Since the wing and engine cannot
be seen from the cockpit and the slat position indicating system was
inoperative, there would have been no indication to the flightcrew of
the slat retraction and its subsequent performance penalty. Therefore,
the first officer continued to comply with carrier procedures and
maintained the commanded pitch attitude; the flight director command
bars dictated pitch attitudes which decelerated the aircraft toward V2,
and at V2 + 6, 159 KIAS, the roll to the left began.

The aircraft configuration was such that there was little or no warning
of the stall onset. The inboard slats were extended, and therefore, the
flow separation from the stall would be limited to the outboard segment
of the left wing and would not be felt by the left horizontal
stabilizer. There would be little or no buffet. The DFDR also indicated
that there was some turbulence, which could have masked any aerodynamic
buffeting. Since the roll to the left began at V2 + 6 and since the
pilots were aware that V was well above the aircraft stall speed, they
probably did not suspect that the roil to the left indicated a stall. In
fact, the roll probably confused them, especially since the stickshaker
had not activated.

The roll to the left was followed by a rapid change of heading,
indicating that the aircraft had begun to yaw to the left. The left yaw
-- which began at a 4! left wing down roll and at 159 KIAS--continued
until impact. The abruptness of the roll and yaw indicated that lateral
and directional control was lost almost simultaneous with the onset of
the stall on the outboard section of the left wing.

The simulator tests showed that the aircraft could have been flown
successfully at speeds above 159 KIAS, or if the roll onset was
recognized as a stall, the nose could have been lowered, and the
aircraft accelerated out of the stall regime. However, the stall warning
system, which provided a warning based on the 159 KIAS stall speed, was
functioning on the successful simulator flights. Although several pilots
were able to recover control of the aircraft after the roll began, these
pilots were all aware of the circumstances of the accident. All
participating pilots agreed that based upon the accident circumstances
and the lack of available warning systems, it was not reasonable to
expect the pilots of Flight 191 either to have recognized the beginning
of the roll as a stall or to recover from the roll. The Safety Board
concurs.

In addition, the simulator tests showed that the aircraft could have
been landed safely in its accident configuration using then current
American Airlines procedures. The simulator tests also disclosed that
the aircraft could have been landed with an asymmetric leading edge slat
configuration. The speed margins during the final positions of the
landing approach are also very small; however, the landing situation is
considered less critical since additional thrust is readily available as
required to either adjust the flightpath or accelerate the aircraft. In
addition, service experience has shown that loss of slats on one wing
during the approach presents no significant control problems.

The pilot's adherence to the airspeed schedules contained in the
company's engine-out emergency procedure resulted in the aircraft's
entering the stall speed regime of flight. Had the pilot maintained
excess airspeed, or even V+ 10, the accident may not have occurred.
Since the airspeed schedules contained in American Airlines' emergency
procedures at the time of the accident were identical to those currently
contained in the emergency procedures of other air carriers, the Safety
Board believes that speed schedules for engine-out climb profiles should
be examined to insure that they afford the maximum possible protection.
In summary, the loss of control of the aircraft was caused by the
combination of three events: the retraction of the left wing's outboard
leading edge slats; the loss of the slat disagreement warning system;
and the loss of the stall warning system -- all resulting from the
separation of the engine pylon assembly. Each by itself would not have
caused a qualified flightcrew to lose control of its aircraft, but
together during a critical portion of flight, they created a situation
which afforded the flightcrew an inadequate opportunity to recognize and
prevent the ensuing stall of the aircraft.

DC-10 Design and Certification

The pylon design, and in particular the aft bulkhead and its upper
flange, satisfied the fail- safe requirements of the 1965 Federal
Aviation Regulations. The stress analysis of the pylon structure showed
that the stress level in the upper flange of the aft bulkhead was well
below the fatigue damage level and the material was not considered to be
vulnerable to stress corrosion. Therefore, since it was not necessary to
apply fail-safe criteria to the flange, the design did not provide an
alternate path for the transmittal of loads in the event the flange
failed. Although the flight tests conducted after the accident disclosed
that additional thrust loads were being imposed on the aft bulkhead
which were not accounted for in the original certification analysis, the
stress levels were still below the fatigue-damage level. In addition,
postaccident tests and analyses of alternate load paths for other pylon
structural members showed that, even with a failed thrust link, the
bulkheads could carry the takeoff thrust load. Furthermore, the
postaccident inspections of the DC-lO's did not disclose any evidence of
fatigue damage on any of the bulkheads within the fleet. Therefore, the
Safety Board finds that the original certification's fatigue-damage
assessment of fatigue damage was in conformance with the existing
requirements.

The Damage-Tolerance concept embodied in the December 1, 1978, amendment
to 14 CFR 25.571 levies different requirements on the certification of
structural design. While the regulations in effect prior to the adoption
of this amendment considered susceptibility of undamaged structure to
fatigue, this new concept requires that an evaluation of the strength,
detail design, and fabrication must show that catastrophic failure due
to fatigue, corrosion, or accidental damage will be avoided throughout
the operational life of the aircraft. The evaluation must include a
determination of the probable locations and modes of damage due to
fatigue, corrosion, or accidental damage. If a part is determined to be
susceptible to these types of damage, its operational life must be
established by analysis and supporting tests. The operational life must
be consistent with the onset of damage and its subsequent growth during
testing. The results of these tests and analyses are used to establish
inspection areas and frequencies to monitor the structural integrity of
the part.

Had the requirement for accidental damage evaluation been in effect when
the the DC-10 was designed, one might expect that such consideration
would have been given to accidental damage to the upper flange of the
pylon aft bulkhead. However, this would still have depended upon the
interpretation of the type of accidental damage required to be
considered. The manufacturer contends that accidental damage should be
limited to damage which can be inflicted during routine aircraft
maintenance or servicing, such as contact at galley and cargo doors or
dropping of tools in areas of frequent maintenance. Based on this
interpretation, the accidental contact between the pylon aft bulkhead
and the wing-mounted clevis probably would not have been considered
since it did not constitute routine maintenance. And, even had this
accidental contact been considered, the design may not have been
different; however, more stringent inspection requirements might have
been imposed, particularly following maintenance. Following the
accident, the FAA required McDonnell- Douglas to conduct a
damage-tolerance assessment of the pylon structure in accordance with
the new regulation. When the program was conducted it was presumed that
a crack in the bulkhead flange could be detected visually before it was
3 inches long and that the residual strength of the damaged element
would far exceed the operational load requirements. Based on these
criteria, the analysis and tests showed that the design meets the
current damage-tolerance requirement.

Although the design of the pylon complied with the strength requirements
of the regulations, the Safety Board believes that neither the designers
nor the FAA certification review team adequately considered the
vulnerability of the structure to damage during maintenance. In several
places, clearances were unnecessarily small and made maintenance
difficult to perform. Historically, pylons have had to be lowered and
replaced for many reasons, such as ground accidents, fatigue, and
corrosion. In fact,- parts of the pylon structure are either on a
sampling inspection or l 00-percent inspection schedule. Under these
circumstances, McDonnell-Douglas should have foreseen that pylons would
be removed, and therefore, the mating parts of the aft bulkhead should
have been designed to eliminate, or at least minimize, vulnerability to
damage during maintenance. Whenever major components are made up of
parts that can be removed, the design must protect each part from damage
during removal or reinstallation. Either the parts should be made strong
enough to withstand inadvertent contact, or clearances should be
provided that will not allow contact. The pylon aft bulkhead could have
been designed so that the upper part of the lug would bottom on the base
of the wing-mounted clevis, before the upper spar web and aft bulkhead
flange assembly contacted the clevis ear. On the actual design there is
only .080-inch clearance between the bolt heads on the flange assembly
and the clevis with the pylon installed. With adverse tolerances, this
clearance of the fitting can be reduced to less than .030 inch. The
evidence, provided by a dimensional analysis, which included the
thickness of the shims, showed that an interference fit of about .030
inch could have existed. Following the accident, interference was also
found in some other aircraft in which shims were installed.

In order to reinstall a pylon with an interference fit between the aft
bulkhead flange assembly and the wing clevis, the flange assembly would
have to be brought into contact with the wing clevis and the flange
would have to be loaded and deflected enough to allow the bushing and
bolt to be inserted through the clevis and spherical joint. Although
tests showed that the load required to create this deflection would not
fracture the flange, the maintenance operation, regardless of the
procedures used, would be difficult to perform and would be particularly
vulnerable to damage-producing errors. Thus, the Safety Board concludes
that the basic design of the aft attachment of the pylon to the wing was
unnecessarily vulnerable to maintenance damage.

The Safety Board is also concerned that the designs of the flight
control, hydraulic, and electrical systems in the DC-10 aircraft were
such that all were affected by the pylon separation to the extent that
the crew was unable to ascertain the measures needed to maintain control
of the aircraft.

The airworthiness regulations in effect when the DC-10 was certificated
were augmented by a Special Condition, the provisions of which had to be
met before the aircraft's fully powered control system would be
certificated. The Special Condition required that the aircraft be
capable of continued flight and of being landed safely after failure of
the flight control system, including lift devices. These capabilities
must be demonstrated by analysis or tests, or both. However, the Special
Condition, as it applied to the slat control system, was consistent with
the basic airworthiness regulations in effect at the time. The basic
airworthiness regulations specified requirements for wing flap asymmetry
only and did not include specific consideration of other lift devices.
Because the leading edge slat design did not contain any novel or
unusual features, it was certificated under the basic regulation. The
flap control requirements for symmetry and synchronization were applied
to and satisfied by the slat system design. Since a malfunction of the
slat actuating system could disrupt the operation of an outboard slat
segment, a fault analysis was conducted to explore the probability and
effects of both an uncommanded movement of the outboard slats and the
failure of the outboard slats to respond to a commanded movement. The
fault analysis concluded that the aircraft could be flown safely with
this asymmetry.

Other aircraft designs include positive mechanical locking devices to
prevent movement of slats by external loads following a primary failure.
The DC-10 design did not include such a feature nor was it deemed
necessary, since compliance with the regulations was based upon analysis
of those failure modes which could result in asymmetrical positioning of
the leading edge devices and a demonstration that sufficient lateral
control was available to compensate for the asymmetrical conditions
throughout the aircraft's flight envelope. The flight tests conducted to
evaluate the controllability of the aircraft were limited to a minimum
airspeed compatible with stall-warning activation predicated upon the
slat- retracted configuration.

The takeoff regime at lower airspeeds was not examined in flight.
However, analysis of the takeoff regime showed that, with all engines
operating, the aircraft would be accelerated to and maintain a positive
stall margin throughout the flight. The analysis also showed that if a
loss of engine thrust and slat retraction were to occur during takeoff,
the aircraft's capability to accelerate to and maintain a positive stall
margin was compromised. Further consideration of this hazardous
combination was limited to a mathematical probability projection, which
showed that the combination was extremely improbable. Thus, the design
was accepted as complying with the requirements. If the structural loss
of a pylon had been included in the probability projection, the
vulnerability of the hydraulic lines and position feedback cables may
have influenced adversely the probability projection.

Also, the influence on aircraft control of the combined failure of the
hydraulic and electrical systems was not considered. When aircraft
controllability was first evaluated based on asymmetric leading edge
devices, it was presumed that other flight controls would be operable
and that slat disagree and stall warning devices would be functioning.
Flight 191 had accelerated to an airspeed at which an ample stall margin
existed. Postaccident simulator tests showed that, if the airspeed had
been maintained, control could have been retained regardless of the
multiple failures of the slat control, or loss of the engine and Nos. 1
and 3 hydraulic systems. On this basis alone, the Safety Board would
view the design of the leading edge slat system as satisfactory.
However, the additional loss of those systems designed to alert the
pilot to the need to maintain airspeed was most critical. The stall
warning system lacked redundancy; there was only one stickshaker motor;
and the left and right stall warning computers did not receive crossover
information from the applicable slat position sensors on opposite sides
of the aircraft. The accident aircraft's stall warning system failed to
operate because d.e. power was not available to the stickshaker motor.
Even had d.c. power been available to the stickshaker motor, the system
would not have provided a warning based on the slats retracted stall
speed schedule, because the computer receiving position information from
the left outboard slat was inoperative due to the loss of power on the
No. 1 generator bus. Had power been restored to that bus, the system
would have provided a warning based on the slat retracted stall speed.
However, in view of the critical nature of the stall warning system,
additional redundancy should have been provided in the design.

In summary, the certification of the DC-10 was carried out in accordance
with the rules in effect at the time. The premises applied to satisfy
the rules were in accordance with then accepted engineering and
aeronautical knowledge and standards. However, in retrospect, the
regulations may have been inadequate in that they did not require the
manufacturer to account for multiple malfunctions resulting from a
single failure, even though that failure was considered to be extremely
improbable. McDonnell-Douglas considered the structural failure of the
pylon and engine to be of the same magnitude as a structural failure of
a horizontal stabilizer or a wing. It was an unacceptable occurrence,
and therefore, like the wing and horizontal stabilizer, the pylon
structure was designed to meet and exceed all the foreseeable loads for
the life of the aircraft. Therefore, just as it did not analyze the
effect the loss of a wing or horizontal stabilizer would have on the
aircraft's systems, McDonnell- Douglas did not perform an analysis based
on the loss of the pylon and engine.

Logic supports the decision not to analyze the loss of the wing and
horizontal stabilizer. With the loss of either of these structures,
further flight is aerodynamically impossible and the subsequent effect
of the loss on the aircraft's systems is academic. However, similar
logic fails to support the decision not to analyze the structural
failure and loss of the engine and pylon, since the aircraft would be
aerodynamically capable of continued flight. The possibility of pylon
failure, while remote, was not impossible. Pylons had failed. Therefore,
fault analyses should have been conducted to consider the possible
trajectories of the failed pylon, the possibilities of damage to
aircraft structure, and the effects on the pilot's ability to maintain
controlled flight. Since the capability of continued flight was highly
probable, the fault analysis might have indicated additional steps or
methods which could have been taken to protect those systems essential
to continued flight.

Therefore, the Safety Board concludes that the design and
interrelationship of the essential systems as they were affected by the
structural loss of the pylon contributed to this accident. 3.1 Findings

FINDINGS

10. The flightcrew flew the aircraft in accordance with the prescribed
emergency procedure which called for the climbout to be flown at V2
speed. V2 speed was 6 KIAS below the stall speed for the left wing. The
deceleration to V2 speed caused the aircraft to stall. The start of the
left roll was the only warning the pilot had of the onset of the stall.

FOOTNOTES********************************

{1}	 Report to the Administrator on the Investigation of the
Compliance of the DC-10 Series Aircraft with Type Certification
Requirements under Asymmetric Slat Condition, July 9, 1979.

{2}	 Technical Report No. 79-1365, Estimating the Probability of
Asymmetric Deployment of the Leading Edge Slat System of the DC-10
Aircraft, J. H. Wiggins Company.