American Airlines Flight 191

A scheduled departure from Chicago

American Airlines flight 191 taxied for departure from Chicago O'Hare on 25 May 1979, bound for Los Angeles. Its McDonnell Douglas DC-10-10 was registered N110AA and carried 258 passengers and thirteen crew members. The flight was a regularly scheduled passenger service. Personnel watching engine start, pushback and the beginning of taxi saw nothing unusual. The weather was clear. The attachment structure had been damaged during earlier maintenance, with no visible indication of the problem during departure preparations.

The crew received clearance for runway 32R and then takeoff clearance at 15:02:38. The report uses central daylight time. The takeoff data card specified the aircraft configuration and the engine-failure climb speed.

The takeoff roll remained normal until the approach to rotation. Witnesses then saw material from the left engine pylon leave the aircraft and smoke or vapour in that area. During rotation the complete engine and pylon separated, passed over the wing and fell onto the runway. It damaged structure and systems in the adjacent wing at precisely the point when the flight was committed to becoming airborne and had little height available.

A brief climb followed by uncontrollable roll

The DC-10 initially climbed with its wings broadly level. Surviving flight data showed corrective aileron and rudder inputs restoring the attitude after liftoff. The crew continued a climb consistent with the engine-out procedure. For a short interval that response produced stable heading and pitch. The fatal aerodynamic condition developed through the additional wing-system damage and the change in speed as the prescribed climb was flown.

The flight remained airborne for only 31 seconds. During the climb it decelerated, then began rolling left as the damaged left wing reached its stall condition. Increasing opposite aileron and rudder did not arrest the roll. The nose pitched down and the bank passed through the vertical before impact. The recorder preserved substantial control inputs opposing the developing roll and descent. The cockpit voice recorder had already lost power during rotation.

The aircraft struck an open field and an adjacent trailer park northwest of the runway. Impact and the subsequent fire destroyed it. All 271 people aboard died; two people on the ground also died and two others were injured. The crash occurred about 15:04 central daylight time. Wreckage damage was extensive, but the separated engine-pylon assembly had fallen near the runway and provided key physical evidence. That separation of an initiating component from the main crash destruction helped investigators examine the pre-existing attachment failure.

The surviving data recorded the response of the remaining engines as well as the aircraft's attitude. Power on the centre engine increased during the climb, while the right engine remained close to its takeoff setting. The initial correction restored the wings to level and stabilised the heading. The aircraft accelerated before beginning the deceleration associated with the prescribed climb. Once the left roll developed, the rudder and aileron inputs increased against it. Elevator input also increased as the nose dropped. The recording ended with counter-roll controls and nearly full up elevator applied, showing the continuing control effort through the final descent.

Why the left wing stalled first

The pylon's departure severed hydraulic lines and follow-up cables associated with the left wing's outboard leading-edge slats. Those slats retracted during the climb. A slat extends the wing's ability to sustain lift at the high angles of attack used at low speed; retracting it on one side changed that wing's stall boundary relative to the other. The aircraft therefore still had functioning flight controls but acquired an asymmetric aerodynamic condition.

At the same time, electrical consequences removed the stall warning and slat-disagreement indication. The crew could not see the wings and engines from the cockpit. The NTSB found that the pilots had an inadequate opportunity to identify and prevent the ensuing stall. The system failures took away precisely the information that would have distinguished this emergency from the engine failure for which the ordinary procedure had been written.

The prescribed climb called for the takeoff safety speed, but that speed was below the stall speed of the damaged left wing. Deceleration toward the prescribed target therefore led into the asymmetric stall. The NTSB expressly found that the crew flew the required emergency procedure. This is central to the accident: procedural compliance, aircraft controllability and adequate warning were no longer compatible after the combined damage. The final cause statement included the inability of the prescribed operational procedure to accommodate this unique emergency among the contributing factors.

The separation also interrupted the electrical supply to functions on the captain's side. The captain's flight-director instrument became inoperative together with the stall warning and slat-disagreement lights, and power to the affected buses was never restored. Hydraulic capability remained in the surviving systems, so most flight controls continued to operate. The severed lines and follow-up cables at the left outboard slat actuator were the specific damage that allowed those lift devices to retract. As the aircraft slowed, the onset of the left roll became the pilot's only warning of the stall. The warning loss and aerodynamic change occurred together during the same short climb.

The maintenance damage behind the separation

The NTSB traced the attachment failure to maintenance at American's Tulsa facility on 29 and 30 March 1979. The engine and pylon had been removed and reinstalled as one supported assembly. American had developed a procedure using a forklift to lower and raise that combined mass. The attachment geometry demanded precise positioning, but the engineering evaluation had not adequately assessed the equipment's ability to supply that precision or the consequences of misalignment.

The removal sequence allowed the forward attachment to act as a pivot after the aft bolt and bushing were removed. Loss or movement of the supporting lift could raise the rear of the pylon and bring the aft bulkhead flange into contact with the wing clevis. The NTSB found an overload fracture and subsequent fatigue damage that reduced the remaining strength. The attach hardware itself was properly installed.

Maintenance personnel did not formally report either departures from the written sequence or the difficulties encountered while performing it. Engineering and supervisory personnel had not sufficiently monitored the process to learn whether the procedure was being accomplished as intended. A latent defect could therefore remain after a task had apparently been completed. The accident connected maintenance execution, procedure design and feedback: damage created during a ground intervention later progressed in service until the attachment could no longer carry the loads imposed during takeoff.

The combined removal procedure required the forklift to support the engine and pylon while their attachments were released. With the aft bolt and bushing already removed, the remaining forward connection allowed the assembly to pivot. A change in support could then move the aft flange upward against the wing clevis. American's written engineering instruction did not emphasise the precision needed in placing the lift. The engineering evaluation had also failed to assess fully how difficult correct placement would be. The NTSB linked these omissions to the lack of formal reports from the workforce and insufficient monitoring of the procedure by engineering and supervisory staff.

Design and oversight as part of the chain

It found the pylon attachment vulnerable to maintenance damage and the slat design vulnerable to the consequences of separation. The slat system lacked positive mechanical locks that would prevent movement under external loads after the primary control connections failed. Certification had accepted asymmetric slat behaviour on the basis of controllability, but the accident also removed warning information. The design assumptions had not accommodated the combined effects of structural separation on these neighbouring systems.

Earlier similar damage at another operator had been classified as maintenance error without generating the wider investigation and reporting that could have warned the industry. The NTSB identified deficiencies in communications among operators, the manufacturer and the FAA. The regulatory surveillance and reporting system did not detect and prevent the improper maintenance practices.

The adopted probable cause combines the aerodynamic event with its origins: an asymmetric stall and roll followed uncommanded slat retraction and lost warning systems after maintenance-induced pylon separation. Design vulnerability, surveillance shortcomings, deficient exchange of previous damage information and procedural limitations contributed. The initiating failure, the altered wing and the missing cues each mattered to the loss of control.

What the recommendations sought to change

The NTSB called for urgent inspection of pylon attachments and of aircraft whose assemblies had been removed and reinstalled. It recommended detecting cracks hidden by sealant using suitable methods, including eddy-current inspection, and discontinuing combined engine-pylon handling in favour of the manufacturer's separate removal sequence. These measures addressed the latent structural failure directly. The recommendations were framed as immediate protection for other aircraft while the wider design and procedural implications were also examined.

Other recommendations sought hazard analysis of maintenance procedures affecting important structure and clearer reporting of damage regardless of whether it arose in flight, ground operation or maintenance. The Board also wanted certification to consider maintainability and combinations of system failures following structural damage. Its concern was that a single physical event could defeat several functions normally evaluated separately. The recommendations linked warning redundancy and protection against lift-device asymmetry to the effects of structural damage.

The report additionally called for evaluation of takeoff-climb speed schedules and flight-director logic to improve stall margins during secondary emergencies.

The urgent inspection request covered the wing-mounted aft bulkhead, its forward flange, the attaching spar web and the fasteners. The NTSB wanted sealant removed where it could conceal cracking and an inspection technique capable of finding the damage underneath. It also sought pylon inspections after engine failures involving substantial imbalance or severe side loads. For future certification, the Board proposed attention to access for inspection, retention of connecting hardware and clearances between adjoining parts. These maintainability questions concerned the geometry that made important structure vulnerable during removal and installation, as well as the ability to discover damage after it had occurred.