American Airlines Flight 191 is the deadliest aviation accident on US soil. During the takeoff roll at Chicago O’Hare, the entire Number 1 engine and pylon separated from the left wing as a single unit, rolling over the wing and severing hydraulic lines to the left wing’s leading edge slat actuators. As the slats retracted, the left wing’s stall speed increased above the aircraft’s speed. The aircraft rolled left and struck the ground seconds after rotation. Two hundred and seventy-three people died.
The pylon had been cracked by a maintenance shortcut. American Airlines was removing and installing engine-pylon assemblies as a single unit using a forklift — a procedure that was faster and cheaper than the approved method but that introduced stress loads into the pylon structure that cracked the aft bulkhead. The aircraft had been accumulating damage in its engine pylon, invisibly, until it fractured on the takeoff roll.
AA 191 is the case where the aircraft’s design could have survived the engine separation — if the slats had not retracted. The slats retracted because the engine that separated took the hydraulics with it. The maintenance shortcut created the engine separation. The design architecture made it unsurvivable.
Date | 25 May 1979 |
Flight | AA 191 |
Aircraft | McDonnell Douglas DC-10-10 |
Operator | American Airlines |
Fatalities | 273 — all on board and 2 on the ground |
Category | Engine Separation / Maintenance Shortcut / Slat System Cascade / Certification |
Location | Chicago O’Hare International Airport, USA |
The Event
- American Airlines uses a forklift to remove and reinstall engine-pylon assemblies as a single unit
- The approved procedure requires engine and pylon to be handled separately, using engine mounts
- The forklift method introduces abnormal stress loads into the pylon’s aft bulkhead during removal and installation
- The Number 1 pylon aft bulkhead develops a fatigue crack during the non-standard maintenance procedure
- 25 May 1979: On the takeoff roll, the Number 1 pylon fails; the engine and pylon separate as a single unit
- The assembly rolls over the wing, severing hydraulic lines to the leading edge slats
- The slats retract; the left wing stall speed increases above the aircraft’s current speed
- The aircraft rolls left and strikes the ground near the runway
- All 273 on board die; 2 on the ground die
The forklift maintenance method had been used by American Airlines and, investigation found, by United Airlines as well. Both fleets were immediately inspected. United Airlines’ fleet was found to have similarly cracked pylons on several aircraft — suggesting the accident was only narrowly avoided on multiple occasions.
Systems Engineering Perspective
From a systems engineering perspective, AA 191 presents a cascade failure initiated by a maintenance-induced structural defect: a pylon crack from an unapproved maintenance method → engine separation → slat hydraulic severance → slat retraction → wing stall → loss of control. Each step in the cascade was geometrically guaranteed once the pylon failed.
The design could have survived the engine separation if the slats had held. The slats failed because the hydraulics ran through the same area as the departing engine. The design architecture created the cascade. The maintenance shortcut created the initiating event.
The Maintenance Shortcut — Cost Over Compliance
The approved procedure for removing a DC-10 engine required separating the engine from the pylon before removal, using the aircraft’s own engine mounts as structural reference points. The forklift method — treating the engine and pylon as a single unit — was faster and cheaper. It was also unapproved and structurally hazardous.
When the forklift carried the combined engine-pylon assembly, stress loads were transferred into the pylon structure at angles and magnitudes for which the pylon was not designed. The aft bulkhead — a safety-critical structural element — was cracked by these loads. The crack then propagated under flight loads until it reached critical size during the takeoff roll of AA 191.
An unapproved maintenance method that introduces stress loads for which the structure was not designed is not a shortcut — it is a structural modification with no engineering validation. Its consequences are the consequences of modifying aircraft structure without approval.
The Slat-Hydraulics Architecture
The DC-10’s left wing leading edge slat hydraulics ran through the wing pylon area. An engine separation that involved pylon movement — as opposed to a clean engine separation leaving the pylon intact — was therefore likely to damage the slat hydraulic lines.
The certification analysis for engine separation survivability had addressed the case of engine separation without pylon movement. The actual failure — engine and pylon separating together, rolling over the wing — had a different damage envelope. The certification basis had not specifically addressed this specific failure geometry.
Human Factors Perspective
The human factors analysis of AA 191 is a maintenance practice and oversight case study. The crew’s response to the engine separation was correct. They had no means of knowing about the slat retraction.
The Crew’s Correct Response to Engine Loss at V1
The crew of AA 191 followed correct procedure at V1: continue the takeoff. This is the correct decision when an engine fails at or after V1 — the aircraft is committed, stopping is no longer safe, and the aircraft is certified to fly with one engine inoperative.
The problem was that V1 logic assumes the aircraft is controllable with one engine inoperative. AA 191 was not controllable because the engine separation had simultaneously removed the slat hydraulics. The correct procedure led to a situation the certification basis had not prepared them for.
V1 procedures assume a structurally intact aircraft with a failed engine. When the engine separation also removes flight critical system hydraulics, the procedure’s assumptions are violated. The crew could not know this.
The Institutional Shortcut
The forklift method was not the action of one rogue engineer. It was the institutional practice of at least two major airlines. It had been in use for sufficient time to crack multiple aircraft structures without causing a failure. This is normalisation of deviation at the institutional level: a practice that was unapproved, structurally hazardous, and widely adopted, that had not yet produced a catastrophe — until it did.
System Interaction Breakdown
1. Unapproved Maintenance Method Cracking Pylon Bulkhead
The forklift method introduced structural loads that cracked the pylon aft bulkhead. The approved method would not have done so.
2. Pylon Separation Geometry Damaging Slat Hydraulics
The specific geometry of the combined engine-pylon separation took the slat hydraulic lines with it — a scenario not in the certification basis.
3. Slat Retraction Raising Stall Speed Above Aircraft Speed
With slats retracted, the left wing stall speed exceeded the aircraft’s speed at rotation. The roll was uncontrollable.
Significance in Aviation Risk
1. Forklift Method Immediately Prohibited
The FAA immediately prohibited the forklift method for all DC-10 engine-pylon maintenance.
2. Worldwide Pylon Inspection
All DC-10 pylons worldwide were inspected; multiple cracked pylons were found on American and United Airlines aircraft.
3. Certification Analysis of Engine Separation Damage Envelope
The certification analysis for engine separation survivability was revised to address the specific geometry of combined engine-pylon separation and its interaction with adjacent systems.
4. Maintenance Method Approval Process
The concept of an ‘approved equivalent method’ in maintenance was reviewed; equivalent method approval was required to include structural analysis of the loads the alternative method imposed on adjacent structure.
Related Aviation Risk Lab Content
Pillar Pages
Maintenance and Airworthiness: Maintenance And Airworthiness
Systems Engineering: Systems Engineering
Design and Certification: Design And Certification
Related Case Studies
Case Study 4: Turkish Airlines 981 — A Door That Was Never Safe: Turkish 981
Case Study 43: El Al 1862 — When the Engine Takes the Wing: El Al 1862
Case Study 5: American Airlines 96 — The Door That Nearly Did It First: AA 96 1972
Closing Perspective
American Airlines 191 is the deadliest accident on US soil, produced by the combination of a maintenance shortcut that cracked an engine pylon and a design architecture that made the specific pylon failure geometry unsurvivable. Both failures were independent. Both were preventable.
The maintenance shortcut was in institutional use across multiple airlines. It was faster and cheaper than the approved method. The structural consequence was invisible until the pylon failed. The approved method existed specifically to prevent this — by handling the pylon in a way that did not introduce the loads that cracked it.
‘Faster and cheaper’ is not an acceptable criterion for selecting a maintenance method for safety-critical structural components. That is the lesson AA 191 leaves. Two hundred and seventy-five people paid for it.
AA 191 is the case that made ‘approved method’ non-negotiable for engine-pylon maintenance. The shortcut was institutional. The consequence was structural. The cost was 273 lives.
Related Posts
