# American Airlines Flight 191

American Airlines Flight 191 was a regularly scheduled domestic passenger flight from O'Hare International Airport in Chicago to Los Angeles International Airport. On the afternoon of May 25, 1979, the McDonnell Douglas DC-10 operating this flight was taking off from runway 32R at O'Hare International when its left engine detached from the wing, causing a loss of control. The aircraft crashed about 4,600 feet (1,400 m) from the end of runway 32R. All 271 occupants on board were killed on impact, along with two people on the ground. With a total of 273 fatalities, the disaster is the deadliest aviation accident to have occurred in the United States.
The National Transportation Safety Board (NTSB) found that as the aircraft was beginning its takeoff rotation, engine number one (the left engine) separated from the left wing, flipping over the top of the wing and landing on the runway. As the engine separated from the aircraft, it severed hydraulic lines that lock the wing's leading-edge slats in place and damaged a 3-foot (1 m) section of the left wing's leading edge. Aerodynamic forces acting on the wing resulted in an uncommanded retraction of the outboard slats. As the aircraft began to climb, the damaged left wing produced far less lift than the right wing, which had its slats still deployed and its engine providing full takeoff thrust. The disrupted and unbalanced aerodynamics of the aircraft caused it to roll abruptly to the left until it was partially inverted, reaching a bank angle of 112°, before crashing in an open field by a trailer park near the end of the runway. The engine separation was attributed to damage to the pylon structure holding the engine to the wing, caused by improper maintenance procedures at American Airlines.

## Background
### Aircraft

The aircraft involved was a McDonnell Douglas DC-10-10 registered as N110AA. At the time of the crash, it had logged just under 20,000 hours of flying time over seven years since it was delivered in 1972. The aircraft was powered by three General Electric CF6-6D engines. A review of the aircraft's flight logs and maintenance records showed that no mechanical discrepancies were noted for May 24, 1979. The logs for the previous flights that had occured on the day of the accident had not been removed from the logbook, in violation of standard procedure, and were destroyed in the accident. The precautions toward making sure the plane was in a full working environment were not taken on the left wing's engine.$^{:76}$

### Flight crew

Captain Walter H. Lux (age 53) had been flying the DC-10 since its introduction eight years earlier. He had logged around 22,000 flying hours, of which about 3,000 were in a DC-10. He was also qualified to pilot 17 other aircraft, including the DC-6, DC-7, and Boeing 727.$^{:75}$ First Officer James Dillard (age 49) and Flight Engineer Alfred Udovich (age 56) were also highly experienced; they had 9,275 hours and 15,000 hours, respectively. Between them, they had 1,830 hours of flying experience in the DC-10.

## Accident

On the accident flight, during the takeoff rotation, the number-one engine and its pylon assembly separated from the left wing, ripping away a 3-foot (1 m) section of the leading edge with it. The combined unit flipped over the top of the wing and landed on the runway.$^{:2}$ Robert Graham, supervisor of maintenance for American Airlines, stated:
   As the aircraft got closer, I noticed what appeared to be vapor or smoke of some type coming from the leading edge of the wing and the number-one engine pylon. I noticed that the number-one engine was bouncing up and down quite a bit and just about the time the aircraft got opposite my position and started rotation, the engine came off, went up over the top of the wing, and rolled back down onto the runway... Before going over the wing, the engine went forward and up just as if it had lift and was actually climbing. It didn't strike the top of the wing on its way; rather, it followed the clear path of the airflow of the wing, up and over the top of it, then down below the tail. The aircraft continued a fairly normal climb until it started a turn to the left. And at that point, I thought he was going to come back to the airport.
What was said in the cockpit in the 31 seconds leading up to the final impact is not known, as the cockpit voice recorder (CVR) lost power when the engine detached. The only crash-related audio collected by the recorder is a thumping noise (likely the sound of the engine separating), followed by the first officer exclaiming, "Damn!", at which point the recording ends. This may also explain why air traffic controllers were unsuccessful in their attempts to radio the crew and inform them that they had lost an engine. This loss of power did, however, prove useful in the investigation, serving as a marker of exactly what circuit in the DC-10's extensive electrical system had failed.$^{:57}$
In addition, due to the loss of the engine, several related systems failed. The number-one hydraulic system, powered by the number-one engine failed, but continued to operate through motor pumps that mechanically connected it to hydraulic system three. Hydraulic system three was also damaged and began leaking fluid, but maintained pressure and operation until impact. Hydraulic system two was undamaged. The number-one electrical bus, the generator of which was attached to the number-one engine, failed as well, causing several electrical systems to go offline, most notably the captain's instruments, his stick shaker, and the slat disagreement sensors. A switch in the overhead panel would have allowed the captain to restore power to his instruments, but it was not used. The flight engineer might have reached the backup power switch (as part of an abnormal situation checklist, not as part of their takeoff emergency procedure) to restore electrical power to the number-one electrical bus. That would have worked only if electrical faults were no longer present in the number-one electrical system. To reach that backup power switch, the flight engineer would have had to rotate his seat, release his safety belt, and stand up. Regardless, the aircraft did not get any higher than 350 feet (110 m) above the ground and was in the air for only 31 seconds between the time the engine separated and the moment it crashed; there was insufficient time to perform such an action. In any event, the first officer was flying the airplane, and his instruments continued to function normally.$^{:52}$
The aircraft climbed to about 325 feet (100 m) above ground level while spewing a white mist trail of fuel and hydraulic fluid from the left wing. The first officer followed the flight director and raised the nose to 14°, which reduced the airspeed from 165 knots (190 mph; 306 km/h) to the takeoff safety airspeed (V$_2$) of 153 knots (176 mph; 283 km/h), the speed at which the aircraft could safely climb after sustaining an engine failure.$^{:53–54}$
The engine separation severed the hydraulic fluid lines that controlled the leading-edge slats on the left wing and locked them in place, causing the outboard slats (immediately left of the number-one engine) to retract under air load. The retraction of the slats raised the stall speed of the left wing to about 159 knots (183 mph; 294 km/h), 6 knots (6.9 mph; 11 km/h) higher than the prescribed takeoff safety airspeed (V$_2$) of 153 knots. As a result, the left wing entered a full aerodynamic stall. With the left wing stalled, the aircraft began banking to the left, rolling over onto its side until it was partially inverted at a 112° bank angle with its right wing over its left wing.
Since the cockpit had been equipped with a closed-circuit television camera positioned behind the captain's shoulder and connected to view screens in the passenger cabin, the passengers may have witnessed these events from the viewpoint of the cockpit as the aircraft dove towards the ground. Whether the camera's view was interrupted by the power loss from the number-one electrical bus is not known. The aircraft eventually slammed into a field around 4,600 feet (1,400 m) from the end of the runway.$^{:2}$ Large sections of aircraft debris were hurled by the force of the impact into an adjacent trailer park, destroying five trailers and several cars. The DC-10 also crashed into an old storage hangar at the edge of the airport at the former site of Ravenswood Airport. The aircraft was destroyed by the impact force and ignition of a nearly full load of 21,000 US gallons (79,000 L; 17,000 imp gal) of fuel; no sizable components other than the engines and tail section remained.
The crash site is a field located northwest of the intersection of Touhy Avenue (Illinois Route 72) and Mount Prospect Road on the border of the suburbs of Des Plaines and Mount Prospect, Illinois.$^{:2}$

## Victims

In addition to the 271 people on board the aircraft, two employees at a nearby repair garage were killed, and two more were severely burned.

### Nationalities of the victims

| Nation | Passengers | Crew | Ground | Total |
| United States | 247 | 13 | 2 | 262 |
| Saudi Arabia | 4 | - | - | 4 |
| South Korea | 1 | - | - | 1 |
| Austria | 1 | - | - | 1 |
| Belgium | 1 | - | - | 1 |
| Netherlands | 4 | - | - | 4 |
| Total | 258 | 13 | 2 | 273 |

#### Passengers

Two of the victims in the crash of Flight 191 were:
* Itzhak Bentov, a Czechoslovakia-born Israeli–American biomedical inventor (the cardiac catheter) and New Age author (Stalking the Wild Pendulum and A Cosmic Book)
* Leonard Stogel, music business producer/manager/promoter/executive for California Jam, California Jam II, Sweathog, The Cowsills, Sam the Sham, Tommy James and the Shondells, Redbone, Gentle Giant, and other musical groups. Stogel's parents had died in an accident in 1962 on American Airlines Flight 1 in New York City.

### Memorial

For 32 years, the victims had no permanent memorial. Funding was obtained for a memorial in 2009 through a two-year effort by the sixth-grade class of Decatur Classical School in Chicago. The memorial, a 2-foot-high (0.6 m) concave wall with interlocking bricks displaying the names of the crash victims, was formally dedicated in a ceremony on October 15, 2011. The memorial is located on the south shore of Lake Opeka, at Lake Park at the northwest corner of Lee and Touhy Avenues, two miles east of the crash site. A remembrance ceremony was held at the memorial on May 25, 2019, the 40th anniversary of the accident.
Thirty victims whose remains were never identified are buried at Green Hills Memorial Park in Rancho Palos Verdes, California. The site of the crash was redeveloped around March 2021, and has been named the future site of an interchange for Interstate 90.

## Investigation

The disaster and investigation received widespread media coverage. The impact on the public was increased by the dramatic effect of an amateur photo taken of the aircraft rolling that was published on the front page of the Chicago Tribune on the Sunday two days after the crash.

### Engine separation

Witnesses to the crash were in universal agreement that the aircraft had not struck any foreign objects on the runway. In addition, no pieces of the wing or other aircraft components were found along with the separated engine, other than its supporting pylon; this led investigators to conclude that nothing else had broken free from the airframe and struck the engine. Hence, the engine/pylon assembly separation could only have resulted from a structural failure. The cockpit instrument panels were damaged so badly that they did not provide any useful information.
During the investigation, an examination of the pylon attachment points revealed some damage done to the wing's pylon mounting bracket that matched the bent shape of the pylon's rear attachment fitting. This meant that the pylon attachment fitting had struck the mounting bracket at some point. This was important evidence, as the only way the pylon fitting could strike the wing's mounting bracket in the observed manner was if the bolts that held the pylon to the wing had been removed, and the engine/pylon assembly was supported by something other than the aircraft itself. Therefore, investigators could now conclude that the observed damage to the rear pylon mount had been present before the crash occurred rather than being caused by it.$^{:18}$
The NTSB determined that the damage to the left-wing engine pylon had occurred during an earlier engine change at the American Airlines aircraft maintenance facility in Tulsa, Oklahoma, between March 29 and 30, 1979.$^{:68}$ On those dates, the aircraft had undergone routine service, during which the engine and pylon had been removed from the wing for inspection and maintenance. The removal procedure recommended by McDonnell-Douglas called for the engine to be detached from the pylon before detaching the pylon itself from the wing. However, American, as well as Continental Airlines and United Airlines, had developed a different procedure that saved about 200 working hours per aircraft and "more importantly from a safety standpoint, it would reduce the number of disconnects (of systems such as hydraulic and fuel lines, electrical cables, and wiring) from 79 to 27."$^{:26}$ This new procedure involved the removal of the engine and pylon assembly as a single unit rather than as individual components. United's implementation involved the use of an overhead crane to support the engine/pylon assembly during removal and reinstallation. The method chosen by American and Continental relied on supporting the engine/pylon assembly with a large forklift.$^{:26}$
If the forklift had been positioned incorrectly, the engine/pylon assembly would not be stable as it was being handled, causing it to rock like a seesaw and jam the pylon against the wing's attachment points. Forklift operators were guided only by hand and voice signals, as they could not directly see the junction between the pylon and the wing. Positioning had to be extremely accurate, or structural damage could result. Compounding the problem, maintenance work on N110AA did not go smoothly. The mechanics started disconnecting the engine and pylon as a single unit, but a shift change occurred halfway through the job. During this interval, even though the forklift remained stationary, the forks supporting the entire weight of the engine and pylon moved downward slightly due to a normal loss of hydraulic pressure associated with the forklift engine being turned off; this caused a misalignment between the engine/pylon and wing. When work was resumed, the pylon was jammed on the wing, and the forklift had to be re-positioned. Whether damage to the mount was caused by the initial downward movement of the engine/pylon structure or by the realignment attempt is unclear.$^{:29–30}$ Regardless of how it happened, the resulting damage, although insufficient to cause an immediate failure, eventually developed into fatigue cracking, worsening with each takeoff and landing cycle during the eight weeks that followed. When the attachment finally failed, the engine and its pylon broke away from the wing. The structure surrounding the forward pylon mount also failed from the resulting stresses.$^{:12}$
Inspection of the DC-10 fleets of the three airlines revealed that while United's hoist approach seemed harmless, several DC-10s at both American and Continental already had fatigue cracking and bending damage to their pylon mounts caused by similar maintenance procedures.$^{:18}$ The field service representative from McDonnell-Douglas stated the company would "not encourage this procedure due to the element of risk" and had so advised American Airlines. McDonnell-Douglas, however, "does not have the authority to either approve or disapprove the maintenance procedures of its customers."$^{:26}$

### Inadequate speed

The NTSB determined that the loss of one engine and the asymmetrical drag caused by damage to the wing's leading edge should not have been enough to cause the pilots to lose control of their aircraft; the aircraft should have been capable of returning to the airport using its remaining two engines.$^{:54}$ The NTSB thus examined the effects that the engine's separation would have on the aircraft's flight control, hydraulic, electrical, and instrumentation systems. Unlike other aircraft designs, the DC-10 was not equipped with a separate mechanism that would lock the extended leading-edge slats into place, relying instead solely on the hydraulic pressure within the system.$^{:53,57}$ The NTSB determined that the engine tore through hydraulic lines as it separated from the DC-10's wing, causing a loss of hydraulic pressure; airflow over the wings forced the left wing slats to retract, which caused a stall over the left wing.$^{:53}$ In response to the accident, slat relief valves were mandated to prevent slat retraction in case of hydraulic line damage.
The wreckage was too severely fragmented to determine the exact position of the rudders, elevators, flaps, and slats before impact. An examination of eyewitness photographs showed only that the right wing slats were fully extended as the crew tried unsuccessfully to correct their steep roll. The position of the left wing slats could not be determined from the blurry color photographs, so they were sent to a laboratory in Palo Alto, California, for digital analysis, a process that pushed the limits of 1970s technology and necessitated large, complicated, and expensive equipment. The photographs were reduced to black-and-white, which made distinguishing the slats from the wing itself possible, thus proving that they were retracted. In addition, the aircraft's tail section was verified to be undamaged, and the landing gear was down.$^{:20–21}$
Wind-tunnel and flight-simulator tests were conducted to help understand the aircraft's trajectory after the engine detached and the left wing slats retracted. Those tests established that the damage to the wing's leading edge and retraction of the slats increased the stall speed of the left wing from 124 kn (143 mph; 230 km/h) to 159 kn (183 mph; 294 km/h).$^{:23}$ The DC-10 incorporates two warning devices that might have alerted the pilots to the impending stall: the slat disagreement warning light, which should have illuminated after the uncommanded retraction of the slats, and the stick shaker on the captain's control column, which activates close to the stall speed. Both of these warning devices were powered by an electric generator driven by the number-one engine, and both became inoperable after the loss of that engine.$^{:54,55,67}$ The first officer's control column was not equipped with a stick shaker; McDonnell Douglas offered the device as an option for the first officer, but American Airlines chose not to have it installed on its DC-10 fleet. Stick shakers for both pilots became mandatory in response to this accident.
As the aircraft had reached V$_1$, the crew was committed to takeoff, so they followed standard procedures for an engine-out situation. This procedure is to climb at the takeoff safety airspeed (V$_2$) and attitude (angle), as directed by the flight director. The partial electrical power failure, produced by the separation of the left engine, meant that neither the stall warning nor the slat retraction indicator was operative. Therefore, the crew did not know that the slats on the left wing were retracting. This retraction significantly raised the stall speed of the left wing. Thus, flying at the takeoff safety airspeed caused the left wing to stall while the right wing was still producing lift, so the aircraft banked sharply and uncontrollably to the left. Simulator recreations after the accident determined that "had the pilot maintained excess airspeed the accident may not have occurred."$^{:54}$

### Probable cause

The findings of the investigation by the NTSB were released on December 21, 1979:
   The National Transportation Safety Board determines that the probable cause of this accident was the asymmetrical stall and the ensuing roll of the aircraft because of the uncommanded retraction of the left wing outboard leading edge slats and the loss of stall warning and slat disagreement indication systems resulting from maintenance-induced damage leading to the separation of the No. 1 engine and pylon assembly at a critical point during takeoff. The separation resulted from damage caused by improper maintenance procedures, which led to the failure of the pylon structure.
   Contributing to the cause of the accident were the vulnerability of the design of the pylon attachment points to maintenance damage; the vulnerability of the design of the leading-edge slat system to the damage which produced asymmetry; deficiencies in Federal Aviation Administration surveillance and reporting systems, which failed to detect and prevent the use of improper maintenance procedures; deficiencies in the practices and communications among the operators, the manufacturer, and the FAA, which failed to determine and disseminate the particulars regarding previous maintenance damage incidents; and the intolerance of prescribed operational procedures to this unique emergency.$^{:69}$

## Legacy of the DC-10

The crash of Flight 191 brought strong criticism from the media regarding the DC-10's safety and design. The DC-10 had been involved in two accidents related to the design of its cargo doors, American Airlines Flight 96 (1972) and Turkish Airlines Flight 981 (1974). The separation of engine one from its mount, the publication of the dramatic images of the airplane missing its engine seconds before the crash, and a second photo of the fireball resulting from the impact, raised widespread concerns about the safety of the DC-10. Another blow to the airplane's reputation was dealt two weeks after the crash when the Federal Aviation Administration (FAA) grounded the aircraft. Although the aircraft itself was later exonerated, the damage in the public's eye was already done.
The investigation also revealed other DC-10s with damage caused by the same faulty maintenance procedure. The faulty procedure was banned, and the aircraft type went on to have a long career as a passenger and cargo aircraft. In response to this accident, American Airlines was fined $500,000 (equivalent to $1.6 million in 2023) by the U.S. government for improper maintenance procedures. Earl Russell Marshall, a crew chief at the American Airlines maintenance facility in Tulsa where the last maintenance procedure on the aircraft had taken place, died by suicide the night before he was to be deposed by McDonnell Douglas attorneys.
On June 6, 1979, two weeks after the accident, the FAA suspended the type certificate for the DC-10, thereby grounding all DC-10s under its jurisdiction. It also enacted a special air regulation banning the DC-10 from U.S. airspace, which prevented foreign DC-10s not under the jurisdiction of the FAA from flying within the country.$^{:47}$ This was done while the FAA investigated whether the airplane's engine mounting and pylon design met relevant requirements. Once the FAA was satisfied that maintenance issues were primarily at fault and not the actual design of the aircraft, the type certificate was restored on July 13, and the special air regulation was repealed. The type certificate was amended, however, stating, "...removal of the engine and pylon as a unit will immediately render the aircraft unairworthy."$^{:94}$
In the wake of the grounding, the FAA convened a safety panel under the auspices of the National Academy of Sciences to evaluate the design of the DC-10 and the U.S. regulatory system in general. The panel's report, published in June 1980, found "critical deficiencies in the way the government certifies the safety of American-built airliners", focusing on a shortage of FAA expertise during the certification process and a corresponding overreliance on McDonnell Douglas to ensure that the design was safe. Writing for The Air Current, aviation journalist Jon Ostrower likens the panel's conclusions to those of a later commission convened after the 2019 grounding of the Boeing 737 MAX. Ostrower faults both manufacturers for focusing on the letter of the law regarding regulatory standards, taking a design approach that addresses how the pilots could address single-system failures without adequately considering scenarios in which multiple simultaneous malfunctions of different systems could occur.
On October 31, 1979, a DC-10 flying as Western Airlines Flight 2605 crashed in Mexico City after a red-eye flight from Los Angeles. The Western crash, however, was due to low visibility and an attempt to land on a closed runway, through, reportedly, confusion of its crew.
The loss of Air New Zealand Flight 901 on November 28, 1979, which killed 257 people, added to the DC-10's negative reputation. The Antarctic sightseeing flight hit a volcano, though this was caused by several human and environmental factors not related to the airworthiness of the DC-10, and the aircraft was later completely exonerated.
Another DC-10 crash 10 years later, United Airlines Flight 232, restored some of the aircraft's reputation. Despite the aircraft losing an engine and all flight controls and crash-landing in a huge fireball (which was caught on video by a local news crew) that killed 112 people, 184 people survived the accident. Experts praised the DC-10's sturdy construction as partly responsible for the high number of survivors.
Orders for DC-10s dropped off sharply after the events of 1979 (the U.S. economic recession of 1979–82 was also a contributing factor in reduced demand for airliners). From there until the end of production 10 years later, the two largest DC-10 customers were FedEx and the U.S. Air Force (KC-10 Extender). Despite initial safety concerns, DC-10 aircraft continued to serve with passenger airlines for over three decades after the crash of Flight 191. DC-10 production ended in 1988, and many retired passenger DC-10s have since been converted to all-cargo use. The DC-10 freighter, along with its derivative, the MD-11, constitute part of the FedEx Express fleet. The DC-10s have been upgraded with the glass cockpit from the MD-11, thereby turning them into MD-10s. American Airlines retired its last DC-10s in 2000 after 29 years of service. In February 2014, Biman Bangladesh Airlines operated the final DC-10 passenger flights.

## Depictions in media

The cable/satellite National Geographic channel produced a documentary on the crash, and an episode from Seconds From Disaster titled "Chicago Plane Crash" detailed the crash and included film of the investigation press conferences. The Canadian television series Mayday profiled the crash in the episode "Catastrophe at O'Hare", which subsequently aired in the U.S. on the Smithsonian Channel and National Geographic Channel's television series Air Disasters. The accident was also discussed in "Breaking Point", the second episode of the first season of TV show Why Planes Crash on MSNBC.
Chicago folk singer Steve Goodman wrote the song "Ballad of Flight 191 (They Know Everything About It)" in response to the crash and the subsequent investigation as the inaugural song for a series of topical songs that aired on National Public Radio in 1979.