← back to the reports
MY-003 McDonnell Douglas DC-10 · American Airlines 1979

American Airlines Flight 191 — An Engine Tore Off on Takeoff, and a Wing Stalled

engine-separationwidebody-jet1970s
Killed
273
Aircraft
McDonnell Douglas DC-10-10
Operator
American Airlines
Status
Maintenance

Summary

On 25 May 1979, American Airlines Flight 191, a McDonnell Douglas DC-10-10 registered N110AA, crashed seconds after takeoff from Chicago O'Hare International Airport, killing all 271 people aboard and two more on the ground, for a total of 273. It remains the deadliest aviation accident on United States soil. As the aircraft rotated for takeoff on a routine service to Los Angeles, the No. 1 engine — the left wing engine — together with its supporting pylon broke away from the wing, flipped up and back over the wing's leading edge, and fell to the runway. The aircraft, already committed to flight, climbed briefly, then rolled steeply to the left, descended, and struck the ground in an open field near a trailer park about a kilometre beyond the runway, where it disintegrated and burned. The whole sequence, from the engine departing the wing to impact, lasted only about 31 seconds.

The engine separation alone would not necessarily have been fatal — the DC-10 was designed to fly on two engines. What made the loss unrecoverable was a cascade of secondary failures caused by the engine and pylon tearing away. As the pylon ripped from the wing it severed hydraulic and electrical lines in the leading edge. This caused the outboard leading-edge slats on the left wing to retract, while those on the right wing stayed extended. The wing with retracted slats stalled at a higher speed than the other; with one wing flying and one stalled, the aircraft rolled uncontrollably to the left. The same damage disabled the cockpit instruments that would have warned the crew of the slat asymmetry and the impending stall, so the pilots, who could not see their own wings from the cockpit, flew the aircraft by the book for an engine-out climb — exactly the procedure that, with the left slats retracted, drove the dying wing into a deeper stall.

The National Transportation Safety Board investigated. Its report, AAR-79-17, determined that the engine and pylon had separated because of damage inflicted weeks earlier during maintenance. American Airlines, like some other carriers, had adopted a time-saving procedure to remove and reinstall the engine and pylon as a single unit using a forklift, rather than detaching the engine from the pylon first. The procedure was difficult to perform precisely; on N110AA a misalignment during reinstallation had cracked the pylon's aft attachment fitting, and that crack grew under flight loads until the pylon failed on takeoff. The Board's verdict was a maintenance-induced structural failure compounded by design vulnerabilities and oversight gaps. The accident grounded the entire DC-10 fleet for weeks and reshaped how engine maintenance procedures are approved and policed.

Timeline

Late March 1979
The maintenance
N110AA undergoes scheduled maintenance at American's Tulsa facility, during which the No. 1 engine and pylon are removed and reinstalled as a single assembly using a forklift, an unapproved-by-the-manufacturer but airline-adopted procedure.
During reinstallation
The pylon is damaged
A misalignment of the engine-pylon assembly during forklift reinstallation cracks the aft bulkhead flange of the left pylon; the damage is not detected.
March–May 1979
The crack grows
The fatigue and overload crack in the pylon structure propagates over subsequent flights under normal operating loads.
25 May 1979, ~15:02
Takeoff roll
Flight 191 begins its takeoff from runway 32R at Chicago O'Hare, bound for Los Angeles, with 258 passengers and 13 crew aboard.
~15:04
Engine separation
As the aircraft rotates, the left pylon fails; the No. 1 engine and pylon pitch up and over the wing leading edge and fall onto the runway.
Seconds later
Slats retract, instruments fail
The departing pylon severs leading-edge hydraulic lines and electrical wiring; the left outboard slats retract, and the slat-disagreement and stall-warning systems lose power.
~15:04
Asymmetric stall and roll
The crew flies the engine-out climb procedure, slowing toward a speed at which the slat-retracted left wing stalls while the right wing flies; the aircraft rolls left, descends, and strikes the ground about a kilometre beyond the runway.
25 May 1979
Impact and fire
The aircraft disintegrates and burns in an open field near a trailer park; all 271 aboard and two people on the ground are killed.
6 June 1979
The DC-10 is grounded
The FAA suspends the DC-10's type certificate, grounding the US fleet and barring DC-10 operations into US airspace, while pylon attachments are inspected.
July 1979
Fleet returns to service
After inspections reveal pylon cracking on other aircraft and the maintenance procedures are addressed, the DC-10 type certificate is reinstated and the fleet returns to service.
21 December 1979
The NTSB report
The Board issues AAR-79-17, attributing the accident to maintenance-induced damage to the pylon, with contributing design and oversight deficiencies.

The Forklift and the Pylon

The DC-10's wing-mounted engines hung from pylons — strong structural struts that attach the engine to the wing and carry its weight and thrust into the airframe. Removing an engine for maintenance normally meant detaching the engine from the pylon while the pylon stayed bolted to the wing. American Airlines, seeking to save labour and reduce the number of disconnections required for hydraulic and electrical lines, had instead adopted a procedure to remove the engine and its pylon together as one unit, lowering the combined assembly onto a forklift and later raising it back into place. McDonnell Douglas had not sanctioned removing the two as a single piece, and the Board found the practice problematic, but several carriers used variants of it.

The trouble was precision. The combined engine-and-pylon assembly was heavy and awkward, and reinstalling it required aligning the pylon's attachment fittings to the wing within very fine tolerances using the forklift as a crane. During the work on N110AA at American's Tulsa base in the spring of 1979, the assembly was not perfectly aligned during reinstallation — the investigation reconstructed that a loss of forklift positioning, around a shift change, left the assembly resting against the wing in a way that loaded the aft pylon fitting. That contact cracked the flange of the pylon's aft bulkhead, the fitting that held the rear of the pylon to the wing. The damage was not found, and the aircraft was returned to service with a cracked primary structure.

Over the following weeks of normal flying, the crack lengthened under repeated flight loads. The Board later found that several other DC-10s at American and at Continental, which used a similar forklift procedure, also carried fatigue cracking and bending damage in their pylon mounts from the same kind of maintenance — evidence that this was not a one-off slip but a systematic hazard built into the procedure. On N110AA the crack reached the point of failure on the morning of 25 May 1979.

Thirty-One Seconds

Flight 191 began its takeoff roll on runway 32R bound for Los Angeles, a full transcontinental load of passengers and crew. The takeoff was normal until rotation, the moment the nose lifts and the wing takes the aircraft's full weight. At that instant the loads on the cracked left pylon peaked, and the fitting failed. The pylon, with the No. 1 engine still attached, broke upward and backward, rotating over the top of the wing's leading edge and falling away behind the aircraft to land on the runway. Witnesses and the cockpit voice recorder captured the abruptness of it; the crew called out about losing the engine.

The DC-10 could fly on two engines, and had the loss been only an engine, Flight 191 would very likely have returned to land. But the pylon, in tearing away across the leading edge, ripped open the systems running through it. Hydraulic pressure to the left outboard leading-edge slats was lost, and those slats — high-lift devices that let the wing fly at low speed — retracted, while the right wing's slats remained extended. The same damage cut power to the slat-disagreement warning light and to the stall-warning stick shaker, the two instruments that would have told the crew their left wing was now configured differently and was about to stall. The cockpit had no direct view of the wings; the pilots could not see the retracted slats.

Flying blind to the asymmetry, the crew did exactly what their training and the flight manual prescribed for an engine failure on takeoff: they reduced speed toward the recommended engine-out climb speed to maximise climb performance. With the left slats retracted, however, that wing now stalled at a higher speed than the right. As the aircraft slowed through that speed, the left wing stopped flying while the right wing kept generating lift. The aircraft rolled hard to the left, past 90 degrees of bank, the nose dropping. There was no altitude and no warning in which to diagnose and recover. The DC-10 descended in a left roll and struck the ground in an open field near a trailer park about a kilometre beyond the runway end, disintegrating and burning. Everyone aboard died, along with two people on the ground; the entire event had taken roughly 31 seconds.

What the Board Determined

The National Transportation Safety Board's investigation reconstructed both the immediate aerodynamic loss and the maintenance history that set it up. Examination of the wreckage and the pylon fitting established that the separation began with a pre-existing crack in the aft pylon bulkhead, consistent with damage from the engine-and-pylon reinstallation rather than from any in-flight event. The Board's probable-cause determination linked the maintenance damage directly to the unrecoverable stall.

In the report's words, the Board determined that "the probable cause of this accident was the asymmetrical stall and the ensuing roll of the aircraft because of the uncommanded retraction of the left wing outboard leading edge slats and the loss of stall warning and slat disagreement indication systems resulting from maintenance-induced damage leading to the separation of the No. 1 engine and pylon assembly at a critical point during takeoff. The separation resulted from damage by improper maintenance procedures which led to failure of the pylon structure."

The Board listed several contributing causes: the vulnerability of the design of the pylon attach points to maintenance damage; the vulnerability of the leading-edge slat system to the damage that produced the asymmetry; deficiencies in Federal Aviation Administration surveillance and reporting systems that failed to detect and prevent the use of improper maintenance procedures; deficiencies in the communication among operators, the manufacturer, and the FAA that failed to identify and disseminate the particulars of previous maintenance-damage incidents; and the intolerance of the prescribed engine-out operational procedures to this unique emergency. In plain terms: a maintenance shortcut cracked the pylon; the design left no margin for that damage; the systems that would have warned the crew were knocked out by the same failure; the flight manual procedure made the stall worse; and the oversight that should have caught the bad procedure had not.

The Five Factors

01
A maintenance shortcut that damaged primary structure
Removing and reinstalling the engine and pylon as a single forklift-borne unit was a time-saving procedure that the manufacturer had not approved, and it cracked the pylon during reinstallation. A procedure adopted for efficiency must be validated against the loads it imposes on the structure; a method that can damage a flight-critical fitting if performed imperfectly is unsafe by design, not merely by accident.
02
A design with no tolerance for that damage
The pylon attach points and the slat system were both vulnerable to the damage that occurred, and the slats could retract once the pylon tore the lines open. Structures and systems should be designed so that a credible damage event does not cascade into an unrecoverable configuration; the DC-10's slat system had no mechanism to hold the slats extended when their hydraulic line was lost.
03
Redundancy and warnings lost to the same failure
The departing pylon severed the very wiring that powered the slat-disagreement and stall-warning systems, so the event that created the danger also blinded the crew to it. Warning systems must be powered and routed independently of the failures they are meant to warn about; a warning disabled by the same event it should announce is worse than none.
04
A procedure that worsened the emergency
The crew flew the standard engine-out climb speed, which was correct for a simple engine loss but drove the slat-retracted wing into a deeper stall. Emergency procedures written for the expected failure can be lethal in an unanticipated one; crews need configuration awareness, and procedures should account for the possibility that the aircraft is not in the state the checklist assumes.
05
Oversight that missed a fleet-wide hazard
Similar maintenance damage existed on other DC-10s, but FAA surveillance and the information channels among operators, manufacturer, and regulator failed to detect the bad procedure or disseminate the earlier damage incidents. A hazard repeated across a fleet is a regulatory failure, not just an operator's; effective oversight requires that maintenance practices and damage findings be surfaced and shared before they accumulate into an accident.

Aftermath

The response was swift and sweeping. On 6 June 1979 the FAA suspended the DC-10's type certificate, grounding the entire US fleet and barring DC-10 operations in American airspace — an extraordinary measure for a major airliner. Inspections of pylon attachments across the fleet turned up cracking on other aircraft that had undergone the engine-and-pylon removal procedure, confirming the systematic nature of the hazard. The forklift removal method was prohibited, and the certificate was reinstated in July 1979 after the maintenance practices were corrected and the affected structures inspected and repaired. The DC-10's reputation suffered lasting damage, fairly or not, from the public grounding.

The accident's enduring legacy lies in how it reshaped maintenance oversight. It demonstrated that an airline-devised maintenance procedure, undertaken to save time and never properly validated against its structural consequences, could be more dangerous than the manufacturer's slower method, and that regulators could not assume operators would only use approved procedures. It tightened the scrutiny of maintenance programmes and the reporting of maintenance-induced damage, and it stands as a foundational case study in human factors and procedure design: a reminder that the crew of Flight 191 did everything their training demanded and were defeated by a failure their instruments could not show them and their procedures were not written to survive.

Lessons

  1. Validate every maintenance procedure against the structural loads it imposes; a shortcut adopted to save time can damage a flight-critical fitting if it depends on perfect execution to be safe.
  2. Design so that a credible damage event does not cascade into an unrecoverable configuration; a high-lift device that can silently retract when a line is cut is a trap.
  3. Power and route warning systems independently of the failures they announce; a stall or disagreement warning lost to the same event it should report leaves the crew blind at the worst moment.
  4. Recognise that emergency procedures assume a known aircraft state; give crews the configuration awareness to detect when the assumption is wrong, and write procedures that do not deepen an unanticipated failure.
  5. Treat a hazard found on multiple aircraft as a systemic oversight failure; regulators and manufacturers must surface and share maintenance-damage findings before they accumulate fleet-wide.

References