NTSB Preliminary Report – UPS Boeing MD-11F Crash [pdf]
ntsb.gov
ntsb.gov
The timing and manner of the break make a lot more intuitive sense when you consider that the engine is essentially a massive gyroscope. As the plane starts to rotate, the spinning engine resists changes to the direction of its spin axis, putting load on the cowling. When the cowling and mount fail, that angular momentum helps fling the engine toward the fuselage.
It seems like both are true, but doesn't necessarily prove WHY the mount failed.
There are lots of candidates for a failing engine yeeting itself in any direction.
For the precise trajectory, certainly; for the general direction, not so much. Could you describe a combination of forces that would have thrown that engine to the left of the direction of travel? (We're talking about this accident, not any engine anywhere.)
Foreign object gets yeeted to the right. Internal component gets yeeted to the right. Engine exploded on its right side.
I think each of those is more likely than gyroscopics since the engine went to the left. Not left and up.
Whatever you're describing, it's not this accident. Over and out.
My broad comment is that gyroscopic precession having any critical role in this is incredibly far fetched. That said, I've never flown or worked on a turbofan so ¯\_(ツ)_/¯.
* why it failed at rotation (the first/only sudden change of direction under full throttle) rather than as soon as it was mounted onto the plane, while taxiing, as soon as they throttled up, mid-flight, or on landing. This is important because at rotation is the worst possible time for this failure: no ability to abort take-off, no ability to land safety under no or severely limited power, little time to react at all, full fuel. Knowing these failures are likely to manifest then stresses the importance of avoiding them.
* why it failed in such a way that it damaged the rest of the plane.
Not so much what was wrong with the mounting in the first place, if that's what you're asking. Presumably it was designed to withstand the forces of this moment and clearly has done so many times before.
The report seems to suggest metal fatigue in the motor mount may be a possible culprit.
But yes, the report mentions stress factures where the aft pylon mount failed.
The final reports are always much more comprehensive.
Or are some metals impervious?
> The fatigue limit or endurance limit is the stress level below which an infinite number of loading cycles can be applied to a material without causing fatigue failure.[1] Some metals such as ferrous alloys and titanium alloys have a distinct limit,[2] whereas others such as aluminium and copper do not and will eventually fail even from small stress amplitudes.
> At the time of the accident, N259UP had accumulated a total time of about 92,992 hours and 21,043 cycles [..] A special detailed inspection (SDI) of the left pylon aft mount lugs would have been due at 29,200 cycles and of the left wing clevis support would have been due at 28,000 cycles
This isn't talking about replacement, only inspection; and it wasn't going to happen in the near future: 7k cycles at four flights/day means inspection is due in 5 years.
It wasn't doing four flights per day. As a long-distance cargo aircraft it was doing two flights per day, and I doubt it was flying every single day of the week.
So we are talking about at least 10 years before that inspection was due.
Fatigue cracking would be a maintenance issue too but that's more like passive negligence while the 191 situation was actively disregarding the manual to cut corners. The crew chief of the 191 maintenance incident died by suicide before he could testify.
[0] https://en.wikipedia.org/wiki/American_Airlines_Flight_191#E...
To be clear, a crew chief (Earl Russell Marshall) did. But he wasn't directly involved in maintenance of the specific DC-10 that crashed. Or at least, I haven't found a source saying he was, and some sources say he wasn't. https://www.upi.com/Archives/1981/03/26/The-wife-of-an-airli...
Now, of course, if that maintenance schedule was not FAA-approved or if the check was not performed at X miles, that's going to be classified as improper maintenance.
There was a lubrication task in October, but according to tech comments that would just in greasing the zero fittings, no taking apart anything.
I'm very curious what the metallurgic analysis of the mirror part on the other wing will come up with, especially whether there are any signs of stress fractures in there. If there are that will have substantial consequences for the rest of the still flying MD11's, about 50 or so are still in service.
From this it seems like the aft lug was way fucked, and the forward lug was hanging on for dear life, until it could not.
I don't think they're going to be skimpy on the metallurgy report so looking forward to the analysis of the mirror parts on the other wing. Those will tell without a doubt whether it was maintenance related or age related fatigue. Right now I would bet on the latter but the former could also still be a factor, for instance, that bearing might not have had enough lubricant.
In other words, a slow motion video of a camera aimed at that part during the accident would have shown one of the four connections giving way due to fatigue cracks and then the other three got overstressed and let go as well, in the process damaging the housing of the spherical bearing.
The part at the bottom of page 9 is the key bit. Now I very much want to see the state of the mirror part on the other wing, that will show beyond a doubt whether it was maintenance or an over-estimation of the design life of that part.
It would also be interesting to have a couple of these pulled from the fleet and tested to destruction to determine how much reserve they still have compared to the originally engineered reserve.
That it was so far from the maintenance schedule to be inspected AND that the fatigue cracks seem to have formed in areas that would be hard to visually inspect anyway points to either a engineering problem (especially bad, since the DC10 problem of a similar nature happened in roughly the same parts, albeit due to different abuse - you’d think the engineers would overdo it there, if nothing else), or some specific type of repeated abuse that particular pylon received, which is pointing more to a design problem.
No kidding, especially given the lack of redundancy in the design.
Airlines have to follow the approved maintenance manual procedures; that manual called for engine removal and installation from a pylon that was on the wing. American was improvising a maintenance procedure without the legal authority to do so, resulting in 191.
It did have ample engineering reserve beyond the load it was subject to... before fatigue damage initiated a crack which then grew until there was no reserve left. The question is why the fatigue crack initiated prematurely? Maintenance damage? Analysis mistake? We don't know yet.
Admiral Cloudberg has a great article on AA 191 that covers exactly what happened: https://admiralcloudberg.medium.com/rain-of-fire-falling-the...
https://en.wikipedia.org/wiki/El_Al_Flight_1862
Pictures of that accident are not for the faint of heart so think twice before clicking.
Planes can safely land with 0 engines, though this is obviously "not ideal." See: Gimli Glider.
(Mostly putting that out there for others.)
But beyond figuring out why the engine mount failed, I am very interested in what caused the actual crash. "Just" losing thrust in a single engine is usually not enough to cause a crash, the remaining engine(s) have enough margin to get the plane airborne. Of course this was a major structural failure and might have caused additional damage.
EDIT: It seems there was damage to the engine in the tail, even though this was not specified in the preliminary report, likely because it has not been sufficiently confirmed yet.
Seems like the risk/reward just isn't really there for the few of them still in service, and if anything happened it would be a PR nightmare on top of a tragedy.
Definitely an end of an era!
And air freight just gets a lot less public attention, I think they are going to keep flying them if they don't get grounded.
(Blancolirio points out that the DC-10 tanker is what they modernized to relatively recently -- before that they were flying even more dangerous WW2 airframes for firefighting.)
I agree on the end of an era. Hearing something else besides just Airbus- or Boeing-something always gives me a bit of joy. Even though MDs and DCs are of course Boeings in a sense now as well.
[1] https://www.boeing.com/content/dam/boeing/boeingdotcom/compa...
The MD-11 had a pretty short service life as a passenger aircraft because it simply wasn't very fuel efficient compared to the competition, safety wasn't really the motivating factor. However fuel consumption was behind some of the poor design choices McDonnell/Boeing made. In broad strokes: McDonnell/Boeing shrunk the control surfaces to improve fuel consumption "necessitating" poorly designed software to mask the dodgy handling and higher landing speeds. This exacerbated a DC-10 design "quirk" where hard landings got out of hand very quickly and main landing gear failure would tend to flip the plane.
Yeah you can train around this but when something else goes tits up you've got a lot less leeway to actually recover safely.
That’s the entire worldwide fleet.
Sucks for the pilots flying them for sure tho.
Now, Boeing, et. al. are trying to evaluate the deficiencies in existing D checks and put together an inspection regime (i.e., NDT) that would proactively identify fatigue that would economically permit continued serviceable operation. If this feat turns out to be impossible for technical or cost reasons, then and only then will the grounding will become permanent.
"you know what this motorized piece of anything needs, less power"
-nobody, ever
You realize this is not quite how aerospace engineering works, right?
The plane which ended up being the final nail in the MD-11's coffin, the 777, didn't start development until the 90s. Of its three initial engine choices, two were derivatives of engines that were around when the trijets came to be. The initial version of that Rolls Royce engine was so late (and so unreliable) that it essentially killed the Lockheed trijet. The third option, the GE90, was the largest turbofan engine at its introduction until it was succeeded in 2020 by the GE9X.
Scaling these earlier engines up to fit an MD-11 sized twin was never an option.
Several comments, including yours, seem to have misconstrued that to mean I think the MD-11 in particular could be retrofitted into a twinjet. That's, uh, wildly mistaken, and not something I've ever claimed. I just think trijets in general are a design dead-end. Again, that doesn't mean it didn't make sense in 1960s when the DC-10 was being designed.
It is possible “to make appropriate decisions” up to a certain size. They didn’t stop making new quadjets because the design doesn’t work as well as a twin engine, but because airlines don’t need/want aircraft that large. You wouldn’t build a successor to the A380 as a twin engine.
There's a lot of other changes, of course, but more powerful wing engines let you build a bigger plane in the same kind of shape. Changes in flight rules are also significant; if twin jets can't serve all your routes, you most likely want trijets to cover the routes that can't be served by twins and don't demand a quad ... with current flight rules and current engines, twin engine covers pretty much everything.
The 737 MAX suffered a number of bad design decisions to accommodate its newer, more powerful engines. Its engines topped out at about 8% more powerful than the 737 NG engines.
Once the reason went away, better designs took over.
They were designed to allow smaller jets to fly over the ocean further than a two engine jet was allowed (at the time). Airlines didn’t want to waste all the fuel and expense of a huge 4 engine jet, but 2 wouldn’t do. Thus: the trijet.
The rules eventually changed and two engine jets were determined to be safe enough for the routes the trijets were flying.
Using two engines that were rated safe enough used less fuel, so that’s what airlines preferred.
It was never designed to be used anywhere else as a general design. Two engines did that better.
In the case of the trijets the MD-11 lived on as a freighter because it had a much higher capacity than anything else smaller than a 747.
It was never designed to be used anywhere else as a
general design. Two engines did that better.
Other than being able to identify a couple of famous ones I don’t know a ton about military airplanes either.
Thanks!
And the failure of an engine mounted on the left wing can cause debris to cross through the fuselage structure and cause a failure of the engine mounted on the right wing, or to fly thousands of feet in any particular direction, as happened to American Airlines in both a ground run incident, and in their Flight 883 accident.
https://www.dauntless-soft.com/PRODUCTS/Freebies/AAEngine/
https://aerossurance.com/safety-management/uncontained-cf6-a...
And here's a more detailed description of that ground run incident. It also found that the failure was related to a design flaw, and mandated that aircraft be grounded for inspection and rework. https://skybrary.aero/accidents-and-incidents/b762-los-angel...
I'm not a regulator or aerospace engineer or anything like that so I can't really say which actions are or are not appropriate. But I do want to observe that these are all unique failures with unique risk profiles that can't all be painted with a single broad brush. All I was trying to do in the previous post was speculate on why a MD-11 failure could result in a grounding of the DC-10 and KC-10A as well. The first thing that came to mind is that I think those are the only remaining trijets of that general shape that are still around. Though I suppose another possibility is that they all share an identical pylon design or something like that.
They're very closely related planes (MD-11 is an upgraded DC-10; KC-10A is a military version of the DC-10), so that wouldn't be surprising. Likely the KC-10A has the same pylon, and the MD-11 has one that's similar enough that it's worth being cautious.
I think you're confused? It's nothing like the 707, and is a trijet. https://en.wikipedia.org/wiki/McDonnell_Douglas_KC-10_Extend...
EDIT re your edit: it's still a military version, even if militaries have retired it.
Besides the technical aspects that flight is an impressive example of resilience and skill. Bringing that plane down to the ground in nearly one piece was essentially impossible and a one in a million chance in itself.
[1] https://en.wikipedia.org/wiki/United_Airlines_Flight_232
It's true that you can never get to zero. There's always a chance of some catastrophic failure. The lesson of modern airline safety is that you can get extremely close to zero by carefully analyzing and learning from the failures, which is exactly why these thorough investigations are done. The lesson from UA232 was to make sure one failure can't take out all of the hydraulic systems.
In this specific instance, "the engine fell off and took out another engine, leaving the aircraft with insufficient power to climb" is definitely not in the realm of "probabilities will get you eventually." It's very much in the realm of a mechanical failure that should not happen, combined with a bad design flaw that turns that failure from a mere emergency into pretty much guaranteed death.
Cargo is held to a lower standard than passenger service, but I suspect this will still spell the end of the DC-10 and MD-11, at least in the US. Engines will fail, and for an aircraft of this size, that needs to be survivable in all phases of flight just for the safety of people on the ground.
I think you conflated flights (several 10Ks per day) with passengers (several million per day).
One in a million flights is one accident every few decades.
> at least in the US. Engines will fail
As per the report, this appears to be a structural failure, not an engine failure.
The US sees about 25,000 airline flights per day, or around 9 million per year. So with one in a million flights crashing, we'd expect roughly 9 crashes per year.
I have heard it said that "every air safety rule is written in blood."
https://www.cnn.com/2024/01/02/travel/tokyo-plane-crash-safe...
From the photos, it’s clear it went up over the wing and impacted the fuselage with a (at least) minor explosion, which would have thrown foreign objects into the third engine in the tail for sure.
Losing 2/3 of the engines isn’t survivable on takeoff for this class of plane, at the weights they were at.
It's an engine - the thing pushing the entire plane forwards. Provided it is running (and at takeoff that's definitely the case), an engine being liberated from its plane suddenly has a lot less mass holding it back, so the logical thing to do is to shoot forwards. And because the wing is attached to the upper side of the engine, anything short of an immediate failure of all mounting points is probably also going to give it an upwards trajectory.
Add in air resistance, and you get the "swing across the wing and back" seen in the photos.
It’s clear from the photos this wasn’t the engine failing at all, and in fact the engine kept producing a ton of thrust (probably until it ran out of fuel as it pulled it’s fuel line apart while departing the wing), and instead the thing that is supposed to be so incredibly strong that it restrains all this chaos failed.
Which is a pattern in this family of aircraft, but definitely not a common or normal thing in general eh?
Most aircraft, the engine stays with the airframe even if it turns into a giant burning pile of shrapnel and dead hopes and dreams.
The up and over is usually actually the safer direction I think? But in this case it also moved laterally, which is possibly what fouled the tail engine and made it unrecoverable. Will be interesting to see the final report.
Yes, the initial videos were showing the tail engine flaming out. And in the 1979 crash, the engine also severed hydraulic lines that hold the slats extended. So they folded in due to the aerodynamic pressure, essentially stalling the wing.
Not really. There are zero left in passenger service, they pretty much only serve cargo now.
If I'm parsing this correctly, they're saying that fatigue cracks should have been visible in the aft pylon mount, and that the forward mount was similarly fatigued but showed no damage on the outside?
If you can get to the report, Figure 7 shows the left pylon, with the forward and aft lug enlarged in the inset. Both lugs cracked on two sides. They're saying both cracks on the aft lug as well as the inboard crack on the forward lug were observed to be fatigue cracks, but the forward lug outboard fracture was observed to be entirely a stress crack.
Outboard and inboard are just away from and towards the center of the plane. On the left pylon, that's left and right, respectively. So, it looks like the left side crack in the forward lug developed from overstress, but the other three cracks were from fatigue. My expectation is that fatigue should be apparent upon the right kind of inspection, if timely, even if the metal has yet to fracture.
"Make sure to not use a proxy/cloud service for visiting AVH (e.g. Apple Users turn off your private relay) but your native IP address, then access should be possible without a problem again."
No thank you, AV Herald.
Every so often they sneak in new blocks of IP addresses though so you're playing whack-a-mole with a particularly scummy opponent.
https://www.cloudflare.com/en-au/ips/
Or if you prefer:
Again, you're usually lucky to even get a return packet.
> Page not found
> The page you're looking for doesn't exist.
Also in case that link stops working I got it from this page https://www.ntsb.gov/investigations/Pages/DCA26MA024.aspx
EDIT: nevermind immediately after posting this comment it is now giving a 403 error
Not that puzzling: the most likely explanation is pilot suicide and the Indian government does not want to acknowledge that.
Nothing puzzling. Straight-up cover-up.
Now, the interesting part would be to know what is being covered-up. Pilot error? Pilot suicide? Or a critical system malfunction Boeing cannot afford?
The referenced AA Flight 191 is shockingly similar. It makes me wonder if aviation really is back sliding into a dangerous place.
The murder suicides in the last few decades seem more concerning.
https://en.wikipedia.org/wiki/American_Airlines_Flight_191
I assume the erroneous maintenance procedures that led to the loss of AA191 were rectified a long time ago.
There's no such thing as "This is fixed forever". If lax maintenance oversight has led to companies re-introducing known dangerous maintenance procedures or departing from known good ones, then we will be back in the 70s in terms of airplane safety and people will have to die again to relearn those lessons.
Someone's always trying to claw you in the less safe direction. It's a constant battle to not regress.
But IDK, hopefully this plane just got some sort of "unlucky" about fatigue somehow, and it doesn't have far reaching consequences.
https://www.easa.europa.eu/en/document-library/type-certific...
The way the situation played out is different but the failure mode seems to be very similar if not the same.
The NTSB report itself even references AA-191 as the only "similar event".
Where does this report say proper maintenance would have prevented the incident?
If someone did the same thing again, that would be rather unfortunate. Just more deaths for profit, even though we know it was dangerous.
The parts that seem to have fatigued and failed were only like 80% of the way through their inspection period. They were to be inspected after 28k cycles. They were at 21k cycles.
It sure looks the same from "Engine pulled itself off and flew away" angle, but if there is any similarity under the surface that's very bad. Flying was much much less safe in the 70s.
I think it's cut throat capitalism at its best. Surely it was much too safe before, let's see how far back we can scale maintenance on the operations front but also how far back can you scale cost during development and production and then see where it takes us. If that changes the risk for population from 0.005 to 0.010, the shareholders won't care and it's great for profits.
I think we can see both but especially the latter with Boeing.
It produced an aircraft that failed to meet its performance targets, was a brute to fly and was obsolete the moment its rivals flew.
Douglas* by the early 1990s was a basket-case of warmed-over 1960s designs without the managerial courage to launch the clean-sheet project they needed to survive.
* as a division of MDC
> A review of the inspection tasks for the left pylon aft mount found both a general visual inspection (GVI) and a detailed visual inspection of the left pylon aft mount, required by UPS's maintenance program at a 72-month interval, was last accomplished on October 28, 2021.
NATIONAL TRANSPORTATION SAFEN'BOAFID
:J11...:i= of ArutiOn SMel@LA5 301
A.,r Tral1C.IYU';UQlt-Ort!!
NTS,B ri@ss @at.Joo JurtJer
DCA26 22\C2<Nontheless the pdfs have been replaced and the newer ones don't seem contain these errors anymore.
The new document is an image.
Dropping an engine entirely is a similar situation to a failure - with the benefit that you now have a substantially lighter if imbalanced aircraft.
Should this plane have been able to fly by design even with an engine fallen off?
https://www.reddit.com/r/aviation/comments/1p276xx/ntsb_issu...
That in turn reminds me of the DHL flight out of Baghdad in 2003 that was hit by a missile [0]. Absolutely amazing that they managed to keep it together and land with damage like that.
[0] https://en.wikipedia.org/wiki/2003_Baghdad_DHL_attempted_sho...
After AA 191 the DC-10 was equipped with a locking system: loss of pressure now results in the slats getting stuck in their current position. The MD-11 will undoubtedly also have this system, so a direct repeat of AA 191 is unlikely.
(yeah, it's one of those weird metrics where "bigger is worse", so you're absolved)
And even if they worked the fire might've damaged the plane enough.
For example https://www.faa.gov/lessons_learned/transport_airplane/accid...
when they lost tail engine, all of the hydraulics went down
(Also, as a result of the Sioux City crash you linked, there were several ADs issued requiring changes to hydraulics in these airframes.)
It doesn't seem aircraft are designed to survive these types of catastrophic failures.
Shortly after liftoff, 20 feet (6.1 m) above and 7,000 feet (2,100 m) down the runway, the No. 2 engine separated from the wing and struck the No. 1 engine's inlet cowling, causing it to produce drag and reduced thrust. Even with full right aileron and rudder, the plane started to descend and drift to the left. The captain lowered the nose and leveled the wings, which was followed by the plane making multiple contacts with the runway. After touchdown, the plane drifted left and departed the runway, crossing a taxiway before coming to rest in a saltwater marsh. A fire erupted which consumed the top of the cabin and the cockpit. All three crew members survived.
https://en.wikipedia.org/wiki/Omega_Aerial_Refueling_Service...
Obviously the DC-10 is not the MD-11, but the MD-11 is a direct descendant, including the trijet configuration.
Needless to say they’re going to be scrutinizing everything to determine what the cause is and the sequence of events that created the accident, but I also suspect everyone involved is just as annoyed at this as I am, given that this exact situation should have been fixed already.
* Annoyed = seething rage
And no, this is not just pedantry. A bulkhead fracturing from impact damage and its mounting point failing from fatigue cracking are nowhere near the same thing, even if they might lead to the same outcome.
My point - and from what I see in the report, a grievance shared by the NTSB, given their citation of AA191 - is that both aircraft come from the same lineage (DC-10/MD-11), the same manufacturer (McDonnell-Douglas, now Boeing), had the same failure (engine separating from wing assembly during takeoff roll), and with all involved parties throwing up their hands and swearing they followed all the rules and maintenance schedules.
And that’s too many coincidences to just dismiss outright from the get-go.
I'm not sure how to say this in a way that does not come across as rude, and I apologise in advance if it does, but I got those conclusions (in actuality, statements of fact) from actually reading the reports and understanding the terms and diagrams in them, where it is pretty clearly detailed that the sequence of events does not start with engine separation? You can quite literally read for yourself in both reports (as opposed to relying on a shallow pop culture understanding of the parts involved) the differences in the initial damage to the pylon.
Like, it is understandable that not everyone is an aviation nerd, but it is quite a bit silly to go "the engine separated so they're the same thing which should have been fixed by now". Or to put it another way - do you drive a car? Do you understand the car you drive, as well as cars in general - do you understand that e.g. there are many different things that can cause a flat tyre and so it makes little sense to point to two road accidents as being the same because they both "start" with a flat tyre, even if they involve the same vehicle + tyre manufacturer?
> My point - and from what I see in the report, a grievance shared by the NTSB, given their citation of AA191
I feel quite comfortable in saying that you are projecting your grievance on the investigating body, actually, especially considering that you've manufactured a narrative out of whole cloth where "all involved parties [threw] up their hands and [swore] they followed all the rules and maintenance schedules". In reality, the investigation detailed within about a month that American Airlines (as well as Continental Airlines and United) was most decidedly not following the maintenance guidance from McDonnell Douglas, which had directly led to the fracture of the aft pylon bulkhead (again, a different part from the one that failed in the UPS crash). But of course, that does not fit into the easy-to-swallow "McDonnell Douglas bad" story that people prefer over actually reading and understanding these reports for themselves.
The NTSB doesn't ever accept the "sometimes bad things happen, shrug" excuse and kudos to the professionals there.
I expect all remaining aircraft will be getting new rear pylon lugs with shortened inspection intervals - provided the replacement cost is below the value of continued usage.