|
Items in cart [0] |
Questions? Call 888-624-8373 |
PAPERBACK PDF BOOK Free Resources |
||||||||||||||||
|
||||||||||||||||
|
|
|||||||||||||||
| ||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||
| Copyright © 2009. National Academy of Sciences. All rights reserved. Terms of Use and Privacy Statement |
Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 87
Appendix B
Excerpts From Official Accident Reports
This section contains excerpts from official reports of
two accidents involving jet transport aircraft that
illustrate deficiencies in design, manufacturing, main-
tenance, or service. They are: -Dan-Air Services, Ltd.,
Boeing 707-321C, G-BEBP near Lusaka, Zambia, May 14,
1977 (Aircraft Accident Report 9/78, Department of Trade,
Accidents Investigation Branch, London); and American
Airlines, Inc., McDonnell-Douglas DC-10-10, N 110Ah,
Chicago O'Hare International Airport, Illinois, May 25,
1979 (NTSB AAR-79-17)
DAN-AIR SERVICES, LTD., BOEING 707-321 C, MAY 14, 1977
The aircraft was engaged on a nonscheduled interna-
tional cargo flight, on behalf of International Aviation
Services for Zambian Airlines, from London Heathrow to
Lusaka International Airport, with intermediate stops at
Athens and Nairobi, where there was a crew change. The
flight from London to Nairobi was without incident and
only minor aircraft unserviceabilities were recorded en
route.
The aircraft took off from Nairobi for Lusaka at
7:17 a.m. with a fresh crew on board comprising a com-
mander, copilot, two flight engineers (one under train-
ing), and a loadmaster.- In addition, there was one pas-
senger on board, a ground service engineer whose duty
was to supervise ground handling during transit stops.
The flight proceeded normally and apparently without
incident at cruise altitude. At 9:07 a.m., the copilot
87
OCR for page 88
IMPROVING AI RCRAFT SAFETY/8 8
contacted Lusaka Approach on radio and the aircraft was
cleared to descend. At 9:23 a.m. the copilot reported
that the aircraft was leveling at 11,000 feet, 37 nauti-
cal miles from Lusaka. The aircraft was then cleared by
Lusaka Approach to a lower altitude following behind
another aircraft also bound for Lusaka International
Airport.
The copilot reported that the airfield was in sight.
Lusaka then cleared the aircraft to descend to an alti-
tude of 6,000 feet (2,221 feet above touchdown eleva-
tion). A minute later, the copilot reported that the
aircraft was turning downwind with the preceding aircraft
in sight ahead. The Lusaka approach controller then gave
the aircraft a clearance to make a visual approach to
runway 10 and to report leaving 6,000 feet. At 9:32 a.m.
the copilot contacted the tower controller and reported
that the aircraft was turning on base leg with an air-
craft in sight on the runway. The tower controller then
cleared the aircraft to land. The copilot replied
"Roger"; this
the aircraft.
A readout of the Cockpit Voice Recorder (CVR) indi-
cated that 50 degree flap was selected at 9:32 a.m. and
that the landing checks were completed by 9:33 a.m. Six
seconds later' a loud N break-up" noise was recorded.
The record terminated five seconds after the fact.
Eyewitnesses on the ground observed that the aircraft
had established what appeared to be a normal approach to
runway 10 at Lusaka International Airport. They saw a
large portion of aircraft structure separate in flight.
The aircraft then pitched rapidly nose down and dived
vertically into the ground from a height of about 800
feet and caught fire.
The accident was observed from the airfield: the
fire and rescue services responded rapidly and were
quickly at the scene of the accident. When the fire was
under control, it became apparent that the degree of dam-
age to the cockpit structure was such that no one could
have survived the impact forces. In fact, all six occu-
pants were killed. There were no casualties to persons
on the ground.
The complete right-hand horizontal stabilizer and
elevator assembly was found some 200 yards back along
the flight path, indicative of having become detached in
flight prior to the final nose down pitch maneuver.
was the last transmission received from
OCR for page 89
89/Appendix B
Aircraft #G-BEBP was the first aircraft off the
707-300C series convertible passenger/freighter produc-
tion line. Since manufacture, it had been operated in
the passenger-carrying role registered as N765PA. After
it was withdrawn from service in March 1976, it was put
into storage in Florida. In June 1976, the aircraft was
flown to the United Kingdom where it went through a mod-
ification and overhaul program at the Dan-Air engineering
facility prior to the issue of a U.S. Export Certificate
of Airworthiness which was the basis for the issue of a
U.K. Certificate of Airworthiness in the Transport cate-
gory (passenger) on October 14, 1976.
During service on the U.S. register, the aircraft
had been maintained in accordance with an FAA-approved
schedule and, subsequent to its transfer onto the British
register, it had been maintained to a U.K. CAA-approved
schedule. The records indicate that the aircraft had
not been involved in any incidents which might have
affected the aircraft's structure. It has been estab-
lished that both the horizontal stabilizers on the air-
craft at the time of the accident were those fitted at
the time of manufacture. Both left and right horizontal
stabilizers were removed and reinstalled by Dan-Air to
provide access to the stabilizer center section and for
minor refurbishment.
Consideration was given to reports that the aircraft
pitch trim was unusual in its response on the previous
flight. No evidence was found that could be related to
these reports, which referred to an unusually sensitive
stabilizer trim brake. Such behavior could only be
related to the stabilizer structural failure had there
been stabilizer torsional deflections large enough to
affect significantly the aircraft's flight character-
istics. It is considered that such gross torsional
deflections would have produced total failure at that
time and the reported behavior is not therefore con-
sidered relevant to the accident.
Examination of the detached stabilizer revealed evi-
dence of a fatigue failure of the top chord of the rear
spar. The rear spar center chord, and lower chord, and
the front spar root attachments had failed in overload
because the stabilizer had bent downwards. There was
evidence of a preexisting fracture of the rear spar upper
web between the top chord (adjacent to the fracture),
and the center chord, and in certain sections of the
closure rib and associated structure.
OCR for page 90
IMPROVING AIRCRAFT SAFETY/9 0
The aircraft struck the ground with 50-degree tailing
edge flap and leading edge flaps fully extended, with the
landing gear down. Engine power could not be accurately
assessed in the field but the damage to each unit indi-
cated a low to moderate power setting. It was later
established that the spoilers were retracted at impact.
The stabilizer trim screw jack and associated cable
drum were recovered from adjacent, but separate, areas
of wreckage. Both units were found to be set at posi-
tions consistent with a stabilizer setting of 6-1/4 units
aircraft nose up.
It was not possible to establish rudder and aileron
trim settings although the cockpit rudder trim indicator
was found at an approximately neutral setting. However,
the impact attitude tended to rule out any significant
directional or roll trim problems.
All structures which became separated in the air,
together with the left horizontal stabilizer, stabilizer
center section, stabilizer jack screw and trim drum, and
the power level console were transported to the United
Kingdom for more detailed investigation.
The detailed investigation of the wreckage was con-
fined primarily to the stabilizer and rear fuselage
structure to establish (i) the reason for and age of the
fatigue failure and (ii) why the fail-safe structure in
the rear spar had failed to carry the flight loads once
the top chord had fractured as a result of fatigue.
In order to check the accuracy of existing stabilizer
flight-load data, which had been based on wind tunnel
tests and on extrapolation of flight data obtained from
earlier models of the 707 aircraft, the Boeing company
conducted a flight test program on a suitably instru-
mented 707-300 series aircraft during which horizontal
stabilizer flight loads were recorded throughout the
normal flight envelope. In general, the load values
obtained approximated quite closely the predicted values.
The maximum (normal operational) horizontal stabilizer
down loads were experienced with the aircraft in the
landing configuration with 50 degree wing flap extended
and the landing gear down. In the normal landing config-
uration, the flight tests indicated that the horizontal
stabilizer bending moment during a simulation of the
Lusaka approach was 75 percent of the value which caused
the static test specimen to fail. Analysis shows that
application of up elevator could increase this figure to
about 120 percent of the test failure load.
OCR for page 91
91/Appendix B
It was found that, during a normal landing roll,
with spoilers deployed and using reverse thrust, the
horizontal stabilizers were subjected to oscillating
loads which peaked at a value of 80 percent of the
maximum load on a typical flight. These oscillating
loads, which were found to be caused by speed-brake
deployment, were not accounted for during the initial
fatigue analysis and explain the higher than expected
crack growth rate on G-BEBP.
Both the U.S. and U.K. regulations contain safe
fatigue life or fail-safe design options. The Boeing
707 was designed to comply with the requirements of the
fail-safe option. Neither the U.S. nor the British air-
worthiness regulations specifically required fatigue
testing. In both cases, the manufacturer was permitted
to demonstrate compliance "by analysis and/or tests."
Also, for the safe fatigue life case, it was acceptable
that the service history of aircraft of similar design,
taking into account differences in operating conditions
and procedures, be used as a basis for fatigue life
assessment.
A review of the 707 fleet worldwide in June 1977
showed that 521 aircraft were then operating fitted with
the 300 series horizontal stabilizer. A survey of post-
accident inspections of these aircraft revealed that 38
of these aircraft (i.e., 7 percent of the fleet) were
found to have horizontal stabilizer rear spar cracks of
varying sizes. Four of these required spar replacement.
The original Boeing 707-300 series stabilizer dif-
fered from the 100 series design by having increased
span and a redesigned rear spar of three chord construc-
tion. The rear
spar was redesigned because the fail-
safe capability of the original structure with a top
chord failure would not have been adequate to cope with
the increased loads acting on the larger stabilizer. It
was during the initial 300 series design phase that the
assessment of fatigue sensitivity and fail-safe capa-
bility was made for the purposes of certification.
~ ~A ~. . · -
,
r accrue cescs on one earlier lUU Series StaOlilZerS
had produced a crack in the top chord of the rear spar
after a period representing some 240,000 flight cycles.
The crack was caused by loads which were being fed into
the chord by the trailing edge structure at a point where
there was a change in chord geometry. There were no
OCR for page 92
IMPROVING AIRCRAFT SAFETY/92
indications of problems arising out of loads from the
torsion box. The new 300 series spar chords were con-
tinuous extrusions with integral terminal fittings and
had no abrupt changes in section.
sortable to conclude that, because
the 100 and 300 series structures
It was therefore rea-
of the similarity of
in the undamaged state,
these spar chores would nave an Improved fatigue life
over the original 100 series chords. The manufacturer
appears to have taken this view and considered the rear
spar safe in terms of fatigue in a normal service envi-
ronment. However, the design was certificated on the
basis that it was fail-safe, not as a result of fatigue
tests.
During the initial flight test program, a lack of
stabilizer torsional stiffness became apparent. This
shortcoming was cured by stiffening the top and bottom
inner torsion box skins which, in the case of the top-
skin, was achieved by a change in material from light
alloy to stainless steel. This modification was made
after the basic stress analysis work had been carried
out. Because the stabilizer was certificated on static
strength fail-safe capability, restressing was limited
to that necessary to ensure that the static strength was
not reduced by the modification.
It was known that the greater stiffness of the stain-
less steel skin would result in higher skin loadings,
and hence higher fastener loads in the steel "hi-shear"
fasteners toward the root end of the rear spar top chord.
These higher fastener loads would also increase the bear-
ing stress in the chord forward flange. However, given
the existing chord flange design, there was little that
could be done to improve this situation because the use
of larger diameter fasteners to reduce the bearing
stresses would have reduced the edge margin to an unac-
ceptable level. (Boeing's current 1978 fatigue design
practice is to use larger edge margins than were used on
the 300 series.) However, it was considered that the
design was adequate in this area, given the general
acceptance at that time of its fail-safe capability. It
was not realized that the skin modification, while
improving the static strength, would significantly reduce
the fatigue strength. This was the first of a chain of
events which culminated in the accident to G-BEBP.
It is considered that the design employed is evidence
of a responsible approach on the part of the manufacturer
OCR for page 93
93/Appendix B
.
in attempting to cover, with additional margins of
safety, the failure case which they considered to be the
most critical, or the most likely to occur. However,
the apparent lack of attention given to potential top
chord failure cases outboard of the terminal fittings
strongly suggests that the earlier work on the 100 series
design influenced thinking on the 300 series design.
While it might be considered reasonable to view the
707-100 and 300 series horizontal stabilizer structures
as being broadly similar, this line of thought is only
appropriate when the structures are completely undamaged.
Subsequent to a top chord failure, the 300 series stabi-
lizer structure behaves in a fundamentally different
manner to that of the 100 series stabilizer.
The failure to appreciate the influence which the
top chord and upper web inboard of the fracture have on
the local stress distribution was the principal factor
in bringing about the final spar failure which resulted
in the accident to G-BEBP.
The U.K. Accident Investigation Branch summarized
its findings as follows:
· The aircraft had been maintained to an approved
maintenance schedule and its documentation was
in order.
The crew were properly licensed and adequately
experienced to carry out the flight.
Pitch control was lost following the in-flight
separation of the right-hand stabilizer and
elevator, which occurred shortly after the
extension of 50-degree flap.
The stabilizer variable incidence screw jack
actuator fractured in the stabilizer separation
sequence allowing the left-hand stabilizer to
travel to the fully nose-up position under aero-
dynamic loads, thereby increasing the aircraft
rate of pitch, nose down.
The right-hand stabilizer rear spar top chord
had failed prior to the accident flight as a
result of long-term fatigue damage. The fatigue
crack had existed for about 7,200 flights, of
which approximately 6,750 flights were made
when the aircraft was on the U.S. register.
Following the failure of the stabilizer rear
spar top chord, the structure could not sustain
OCR for page 94
IMPROVING AIRCRAFT SAFETY/94
.
.
.
.
the flight loads imposed upon it long enough to
enable the failure to be detected by the then
existing inspection schedule. It cannot, there
fore, be classified as fail-safe.
Insufficient consideration had been given at
the design and certification stages to the
stress distribution in the horizontal stabi
lizer spar structure following a top chord fail
ure in the region outboard of the closure rib.
The replacement of the horizontal stabilizer
light alloy top skin by stainless steel signif
icantly altered the stiffness distribution of
the structure, creating the high fastener load
ings which led, ultimately, to the fatigue fail
ure in the rear spar top chord in G-BEBP.
Neither the inspections detailed in the approved
maintenance schedule nor those recommended by
the manufacturer were adequate to detect partial
cracks in the horizontal stabilizer rear spar
top chord, but would probably have been adequate
for the detection of a completely fractured top
chord.
The inspections required by the Dan-Air U.K.
CAA-approved maintenance schedule in respect of
the stabilizer rear spar top chord were less
specific than those recommended by the manu
facturer.
No fatigue tests were carried out on the 707-300
series horizontal stabilizer structure prior to
U.S. or U.K. certification. Neither at the
time of certification nor at the time of writ
ing were such repeated load tests required by
either U.S. or U.K. legislation for structures
declared to be fail-safe.
A post-accident survey of the 707-300 fleet,
worldwide, revealed a total of 38 aircraft with
fatigue cracks present in the stabilizer rear
spar top chord. Of this number, four stabi
lizers required chord replacement.
Post-accident flight tests revealed that deploy
ment of speed brakes during the landing roll
produced a horizontal stabilizer load condition
spectrum which was significantly different to
that used in the original design.
OCR for page 95
95/Appendix B
· Cause:
The accident was caused by a loss of pitch
control following the in-flight separation
of the right-hand horizontal stabilizer
and elevator as a result of a combination
of metal fatigue and inadequate fail-safe
design in the rear spar structure. Short-
comings in design assessment, certifica-
tion, and inspection procedures were
contributory factors.
AMERICAN AIRLINES , INC., MCDONNELL-DOUGLAS DC-10-10
May 25, 1979
About 3:04 p.m., CDT, May 25, 1979, American Air-
lines, Inc.'s, Flight 191, a McDonnell-Douglas DC-10-10
aircraft, crashed into an open field just short of a
trailer park about 4,600 feet northwest of the departure
end of runway 32R at Chicago O'Hare International Air-
port, Illinois.
Flight 191 was taking off from runway 32R. The
weather was clear and the visibility was 15 miles. Dur-
ing the takeoff rotation, the left engine and pylon
assembly and about three feet of the leading edge of the
left wing separated from the aircraft and fell to the
runway. Flight 191 continued to climb to about 325 feet
above the ground and then began to roll to the left
until the wings were past the vertical position. During
the roll, the aircraft's nose pitched down below the
horizon.
Flight 191 crashed into the open field and the wreck-
age scattered into an adjacent trailer park. The air-
craft was destroyed in the crash and subsequent fire.
All two hundred and seventy-one persons on board were
killed; two persons on the ground were killed; and two
others were injured. An old aircraft hangar, several
automobiles, and a mobile home were destroyed.
The National Transportation Safety Board determined
that the probable cause of this accident was the asym-
metrical stall and the ensuing roll of the aircraft
because of the uncommanded retraction of the left-wing
outboard leading edge slats and the loss of stall warning
and slat disagreement indication systems resulting from
the separation of the No. 1 engine and pylon assembly at
OCR for page 96
IMPROVING AIRCRAFT SAFETY/9 6
a critical point during takeoff. The separation resulted
from damage by improper maintenance procedures which led
to failure of the pylon structure.
Contributing to the cause of the accident were the
vulnerability of the design of the pylon attach points
to maintenance damage; the vulnerability of the design
of the leading edge slat system to the damage which pro-
duced asymmetry; deficiencies in Federal Aviation Admin-
istration surveillance and reporting systems which failed
to detect and prevent the use of improper maintenance
procedures; deficiencies in the practices and communica-
tions among the operators, the manufacturer, and the FAA
which failed to determine and disseminate the particulars
regarding previous maintenance damage incidents; and the
intolerance of prescribed operational procedures to this
unique emergency.
After the accident, the Federal Aviation Administra-
tion required a fleetwide inspection of the DC-10. Dur-
ing these inspections, discrepancies were found in the
pylon assemblies. Among these discrepancies were vari-
ances in the clearances on the spherical bearing's fore
and aft faces; variances in the clearance between the
bottom of the aft wing clevis and the fasteners on the
upper spar web; interferences between the bottom of the
aft clevis and the upper spar web fasteners; pylons with
either loose, failed, or missing spar web fasteners; and
aft pylon bulkheads with upper flange fractures. The
fractured flanges were found only on the DC-10-10 series
aircraft.
During postaccident inspections, six DC-lOs were
found to have fractured upper flanges on the pylon aft
bulkheads (four American Airlines DC-lOs and two Conti-
nental Airlines
DC-lOs).
The failure modes on the Continental Airlines' air-
craft that were examined by metallurgists were similar
to those found on the American Airlines' DC-lOs. Of the
two Continental fractures discovered during the post-
accident inspections, one crack was six inches long, and
the other three inches long; neither crack showed any
evidence of fatigue propagation.
The investigation also disclosed that two other Con-
tinental Airlines DC-lOs had had fractures on their upper
flanges. These two aircraft were damaged on December 19,
1978, and February 22, 1979. The damage was repaired
and both aircraft were returned to service. In addition,
OCR for page 97
97/Appendix B
a United Airlines' DC-10 was discovered to have a cracked
upper spar web on its No. 3 pylon and 26 damaged fas-
teners.
The damaged pylon aft bulkheads of the four other
American Airlines' DC-lOs were also examined at the
Safety Board's metallurgical laboratory. Each of these
aft bulkheads contained visible cracks and obvious down-
ward deformations along their upper flanges. The longest
crack--about six inches--was the only one in which
fatigue had propagated. The fatigue area was about 0.03
inch long at each end of the overstress fracture.
Of the nine DC-lO's with fractured flanges, only the
accident aircraft had shims installed on the upper sur-
face of the flange.
The National Transportation Safety Board summarized
its findings as follows:
1. The engine and pylon assembly separated either
at or immediately after liftoff. The flightcrew was
committed to continue the takeoff.
2. The aft end of the pylon assembly began to sepa-
rate in the forward flange of the aft bulkhead.
3. The structrual separation of the pylon was caused
by a complete failure of the forward flange of the aft
bulkhead after its residual strength had been critically
reduced by the facture and subsequent service life.
4. The overload fracture and fatigue cracking on
the pylon aft bulkhead's upper flange were the only pre-
existing damage on the bulkhead. The length of the over-
load fracture and fatigue cracking was about 13 inches.
The fracture was caused by an upward movement of the aft
end of the pylon which brought the upper flange and its
fasteners into contact with the wing clevis.
5. The pylon to wing attach hardware was properly
installed at all attachment points.
6. All electrical power to the No. 1 a.c. generator
bus and No. 1 d.c. bus was lost after the pylon sepa-
rated. The captain's flight director instrument, the
stall warning system, and the slat disagreement warning
light systems were rendered inoperative. Power to these
buses was never restored.
7. The No. 1 hydraulic system was lost when the
pylon separated. Hydraulic systems No. 2 and No. 3 oper-
ated at their full capability throughout the flight.
Except for spoiler panels No. 2 and No. 4 on each wing,
all flight controls were operating.
OCR for page 98
IMPROVING AIRCRAFT SAFETY/98
8. The hydraulic lines and followup cables of the
drive actuator for the left wing's outboard leading edge
slat were severed by the separation of the pylon and the
left wing's outboard slats retracted during climbout.
The retraction of the slats caused an asymmetric stall
and subsequent loss of control of the aircraft.
9. The flightcrew could not see the wings and
engines from the cockpit. Because of the loss of slat
disagreement light and the stall warning system, the
flightcrew would not have received an electronic warning
of either the slat asymmetry or the stall. The loss of
the warning systems created a situation which afforded
the flightcrew an inadequate opportunity to recognize
and prevent the ensuing stall of the aircraft.
10. The flightcrew flew the aircraft in accordance
with the prescribed emergency procedure which called for
the climbout to be flown at V2 speed. V2 speed was
6 KIAS below the stall speed for the left wing. The
deceleration to V2 speed caused the aircraft to stall.
The start of the left roll was the only warning the pilot
had of the onset of the stall.
11. The pylon was damaged during maintenance per-
formed on the accident aircraft at American Airline's
Maintenance Facility at Tulsa, Oklahoma, on March 29 and
30, 1979.
12. The design of the aft bulkhead made the flange
vulnerable to damage when the pylon was being separated
or attached.
13. American Airlines engineering personnel devel-
oped an ECO [Engineering Change Order] to remove and
reinstall the pylon and engine as a single unit. The ECO
directed that the combined engine and pylon assembly be
supported, lowered, and raised by a forklift. American
Airlines engineering personnel did not perform an ade-
quate evaluation of either the capability of the fork-
lift to provide the required precision for the task, or
the degree of difficulty involved in placing the lift
properly, or the consequences of placing the lift improp-
erly. The ECO did not emphasize the precision required
to place the forklift properly.
14. The FAA does not approve the carriers' mainte-
nance procedures, and a carrier has the right to change
its maintenance procedures without FAA approval.
15. American Airlines personnel removed the aft
bulkhead's bolt and bushing before removing the forward
OCR for page 99
99/Appendix B
bulkhead attach fittings. This permitted the forward
bulkhead to act as a pivot. Any advertent or inadvertent
loss of forklift support to the engine and pylon assembly
would produce an upward movement at the aft bulkhead's
upper flange and bring it into contact with the wing
clevis.
16. American Airlines maintenance personnel did not
report formally to their maintenance engineering staff
either their deviation from the removal sequence con-
tained in the ECO or the difficulties they had encoun-
tered in accomplishing the ECO's procedures.
17. American Airline's engineering personnel did
not perform a thorough evaluation of all aspects of the
maintenance procedures before they formulated the ECO.
The engineering and supervisory personnel did not monitor
the performance of the ECO to insure either that it was
being accomplished properly or if their maintenance per-
sonnel were encountering unforeseen difficulties in n~r-
forming the assigned tasks.
18. The nine situations in which damage was sus-
tained and cracks were found on the upper flange were
limited to those operations wherein the engine and pylon
assembly was supported by a forklift.
19. On December 19, 1978, and February 22, 1979,
Continental Airlines maintenance personnel damaged aft
bulkhead upper flanges in a manner similar to the damage
noted on the accident aircraft. The carrier classified
the cause of the damage as maintenance error. Neither
the air carrier nor the manufacturer interpreted the
regulation to require that it further investigate or
report the damages to the FAA.
20. The original certification's fatigue-damage
assessment was in conformance with the existing require-
ments.
21. The design of the stall warning system lacked
sufficient redundancy; there was only one stickshaker
motor; and further, the design of the system did not
provide for crossover information to the left and right
stall warning computers from the applicable leafing edge
slat sensors on the opposite side of the aircraft.
22. The design of the leading edge slat system did
not include positive mechanical locking devices to pre-
vent movement of the slats by external loads following a
failure of the primary controls. Certification was based
upon acceptable flight characteristics with an asymmet-
rical leading edge slat condition.
OCR for page 100
IMPROVING AIRCRAFT SAFETY/10 0
23. At the time of the DC-10 certification, the
structural separation of an engine pylon was not con-
sidered. Thus, multiple failures of other systems
resulting from this single event was not considered.
Representative terms from entire chapter:
rear spar
