216 The 1979 Chicago Crash

dent. All participating pilots agreed that based upon the accident circumstances and the lack of available warning systems, it was not reasonable to expect the pilots of Flight 191 either to have recognized the beginning of the roll as a stall or to recover from the roll. The safety board concurs.

The safety board is also concerned that the designs of the flight control, hydraulic, and electrical systems in the DC-10 aircraft were such that all were affected by the pylon separation to the extent that the crew was unable to ascertain the measures needed to maintain control of the aircraft.

Also, the influence on aircraft control of the combined failure of the hydraulic and electrical systems was not considered. When aircraft controllability was first evaluated based on asymmetric leading edge-devices, it was presumed that other flight controls would be operable and that slat disagree and stall warning devices would be functioning. Flight 191 had accelerated to an airspeed at which an ample stall margin existed. Postaccident simulator tests showed that, if the airspeed had been maintained, control could have been retained regardless of the multiple failures of the slat control, or loss of the engine and numbers one and three hydraulic systems. On this basis alone, the Safety Board would view the design of the leading edge slat system as satisfactory. However, the additional loss of those systems designed to alert the pilot to the need to maintain airspeed was most critical. The stall warning system lacked redundancy; there was only one stickshaker motor; and the left and right stall warning computers did not receive crossover information from the applicable slat position sensors on opposite sides of the aircraft. The accident aircraft's stall warning system failed to operate because d.c. power was not available to the stickshaker motor. Even had d.c. power been available to the stickshaker motor, the system would not have provided a warning based on the slats retracted stall speed schedule, because the computer receiving position information from the left outboard slat was inoperative due to the loss of power on the No. 1 generator bus. Had power been restored to that bus, the system would have provided a warning based on the slat retracted stall speed. However, in view of the critical nature of the stall warning system, additional redundancy should have been provi ded in the design.

In summary, the certification of the DC-10 was carried out in accordance with the rules in effect at the time. The premises applied to satisfy the rules were in accordance with then accepted engineering and aeronautical knowledge and standards. However, in retrospect,