Calculated Risk: The crash of Continental Airlines flight 603
On the 1st of March 1978, a Continental Airlines DC-10 with 200 people on board blew a tire on takeoff from Los Angeles International Airport. Over a period lasting mere seconds, this seemingly minor failure escalated rapidly, triggering a sequence of events that sent the plane sliding off the runway in flames. As passengers rushed to escape the burning airliner, the exit slides failed, leaving dozens of people trapped inside. Those still on board were forced to jump down from the doors and the wing, resulting in serious injuries, while four people perished in the smoke and flames.
In investigating the crash, the National Transportation Safety Board not only discovered the chain of events that turned a blown tire into a fatal accident, but found that numerous gaps in the regulatory safety net had allowed the incident to spiral out of control. Potential failure scenarios hadn’t been considered, requirements that seemed logical in hindsight didn’t exist, and assumptions had been made that didn’t accurately reflect real conditions. Closing these gaps turned out to be a monumental task — one which continued for more than 20 years after the crash.
Continental Airlines flight 603 was a regularly scheduled flight from Los Angeles, California, to Honolulu, Hawaii. As was typical of off-season flights to Hawaii, the majority of the passengers were part of a group of retirees headed to the tropical islands for a spring vacation; among the 186 passengers booked on the flight, the average age was 60. Joining them on board the wide body McDonnell Douglas DC-10 were 14 crewmembers, including Captain Charles Hershe, First Officer Michael Provan, and Flight Engineer John Olsen, all of whom had thousands of hours of experience. Hershe, at 59 years old, was in fact one of the most experienced pilots at Continental Airlines; he had flown for Continental since 1946 and had nearly 30,000 flight hours. The round trip to Hawaii was to be his last before retirement, and his wife was riding along to celebrate the occasion.
Before every flight leaves the gate, the pilots use standardized reference tables and a calculator to determine the decision speed, or V1, for the runway on which they plan to take off. V1 is defined as the speed above which the plane cannot be safely stopped in the remaining length of the runway using maximum braking power and no reverse thrust. V1 is also called “decision speed” because it is the latest point at which the pilots can make the decision to abort the takeoff in case of a problem, such as an engine failure; above this speed, it is considered safer to continue the takeoff. In 1978, the exact value of V1 depended on the weight of the aircraft, the length of the runway, the direction and speed of the wind, runway slope, airfield altitude, and a few other variables.
At the gate, Hershe and Provan determined flight 603’s weight to be 194,909 kilograms (429,700 pounds), only 136 kilograms (300 pounds) under the maximum takeoff weight. Counterintuitively, this prevented the flight from taking off on either of LAX’s longest runways, because those runways included an overpass that was not rated to withstand the weight of a fully loaded wide body jet. Although renovations were underway to resolve this problem, they had not yet been completed, and flight 603 was forced to use the shorter runway 6R instead. Taking into account these factors, and a five knot headwind, the pilots calculated that V1 for this takeoff would be 156 knots (289km/h). No adjustment was made to compensate for the fact that light drizzle had been falling all morning and the runway was wet, nor was such an adjustment required.
At around 9:20 a.m., flight 603 pushed back from the gate and began taxiing to the runway. For an aircraft’s tires, taxiing is one of the most stressful periods of the flight. The tires — on a DC-10, there are 10 of them — must support the entire weight of the plane while withstanding significant frictional forces as they roll across the airport surface. As a result, tires wear down quickly. The average aircraft tire had a lifespan of only about 150 flights; however, this could be extended by retreading the tire. During the retreading process, the tires are inspected for damage, then the old tread is stripped away and new tread is affixed to the tire casing, allowing the tire to be returned to service. Continental Airlines allowed its aircraft tires to be retreaded up to three times, significantly increasing their service lives.
On the DC-10 operating flight 603, several of the tires had previously been retreaded. The tires on the two main landing gear bogies are assigned numbers 1–8, starting with the four across the front followed by the four across the rear; these eight tires must bear most of the plane’s weight. Of these, tires one and two had been retreaded three times, and both had experienced over 900 landings. Several other tires had been retreaded once or twice, and a few were new.
Of key interest were tires 1 and 2, occupying the front two positions on the left main landing gear. Tire 2 was a different brand than tire 1, and its sidewall was not as stiff, causing it to compress more when weight was placed on the gear. This had the effect of transferring a larger share of the load to tire 1, and over time the rubber in this tire began to suffer from fatigue cracking. At the same time, tire 2 had several repair patches that might have been at the end of their useful lives.
At 9:25, flight 603 lined up with runway 6R and began its takeoff roll. As the plane accelerated down the runway, it is thought that the repair patches on tire 2 began to leak, allowing air to escape between the tread and the main body of the tire. This leakage caused the tread to progressively peel off the rest of the tire until it separated completely, throwing chunks of rubber out onto the runway. Within seconds, the tire “carcass” blew out due to damage caused by direct contact with the runway surface without the protection afforded by the tread. The weight that had originally been borne by both tires 1 and 2 was entirely transferred to tire 1, which in its deteriorated state also failed almost immediately.
When the two tires blew out, flight 603 had accelerated to a speed of 152 knots, only four knots below V1. In the cockpit, Captain Hershe heard a loud metallic bang and the aircraft began quivering. Knowing only that some kind of mechanical failure had occurred, he immediately decided to abort the takeoff; however, by the time he had actually processed what was happening and began taking action to stop the aircraft, it had accelerated to 159 knots, slightly above V1. Because V1 calculations didn’t include the stopping power provided by reverse thrust, they should in theory have been able to stop despite this. Per his training, Hershe slammed on the brakes and activated the thrust reversers as quickly as possible.
Unknown to either pilot, the effectiveness of the brakes on the left main landing gear was severely reduced due to damage caused by the tire failures, a problem which was only exacerbated by the wet runway surface, which could have reduced braking power by up to 30%. This problem was further amplified several seconds later when flying debris from the disintegrating tires 1 and 2 struck and damaged tire 5, causing it to deflate as well. Neither Hershe nor Provan was aware that as a result of the wet ground and the loss of brake effectiveness, it would be impossible to stop the DC-10 on the runway.
Sparks flying from its bare wheel rims, the DC-10 began to slow down, but it soon became apparent to Captain Hershe that they wouldn’t be able to stop in time. In an attempt to avoid a row of approach lights directly beyond the end of the runway, he steered to the right to go around them, putting the plane into a skid. Still traveling at 68 knots (126km/h), flight 603 ran off the end of runway 6R and onto a non-load bearing area paved with old fashioned tarmac.* Most of the weight on the left main landing gear bogie was concentrated on the still-inflated tire 6, and the tarmac surface proved unable to withstand this much weight distributed over such a small area. As the plane skidded across the tarmac, the left main gear broke through the surface and dug in, tearing it out of the wing. The separated gear took with it a large section of the bottom wing skin and part of a bulkhead, breaching the fully loaded fuel tanks and immediately sparking a massive blaze. By the time the plane finally came to rest, lying askew with its left wing on the ground, a raging fire was already well underway.
(*While tarmac is usually a misnomer, this area was actually paved with honest-to-god tar-macadam.)
Terrified by the sight of the wall of flames right outside their windows, passengers immediately jumped up from their seats and began pressing toward the exits in a mad rush to escape. Flight attendants pushed past the crowd of people and began opening the emergency exits, but three of the four exits on the left side were blocked by fire and couldn’t be used. The L1 door was opened but its slide didn’t deploy, so all the passengers had to evacuate through the four usable exits on the right side of the plane. One fire truck, whose crew witnessed the crash, arrived on the scene and started attacking the fire right as the first passengers slid down and ran away from the plane.
More than half the passengers had evacuated but a significant number were still on board when disaster struck: the 4R slide broke after becoming overloaded, and due to radiant heat from the huge fire, all three other exit slides began to melt and also quickly deflated. For the dozens of passengers and crewmembers trapped on the burning plane, only two options remained: either they could jump several meters down from the doors or from the right wing, or they could slide down a rope out the first officer’s window. As passengers — many of them retirees — began to jump down onto the tarmac, events took a dark turn. People suffered broken bones and serious head injuries on impact; others, wandering dazed after the fall, walked straight into the flames and caught fire. Two people who were injured during the jump quickly died of smoke inhalation and burns while lying beneath exit 4R. Firefighters rushed to extinguish several other people who were walking around in burning clothes. After four minutes, several more fire trucks arrived, and within six minutes of the crash all the passengers were out and the fire had been extinguished. By the time it was over, two people were dead and dozens of others had suffered serious injuries ranging from rope burns to broken ribs to fractured vertebrae. Three months later, two seriously injured passengers died in hospital, by unofficial counts bringing the death toll to four.
Upon being notified of the crash, investigators from the National Transportation Safety Board assembled a team to uncover the cause, arriving at LAX several hours later. By the time they arrived, cleanup crews had already removed the pieces of the tires from the runway, complicating efforts to determine the sequence of events. Another disappointment arrived in short order: although the flight data recorder had been functioning normally, the cockpit voice recorder didn’t work because the tape was broken. Captain Hershe had observed this while checking the CVR before the flight and had alerted maintenance to the discrepancy, because the CVR is required to be functional in order to take off. However, no one checked to make sure it was working after the alleged repair, and neither pilot realized that the maintenance workers never actually fixed the CVR.
Despite these setbacks, investigators were able to determine the basic chain of events. First, tire 2 threw off its tread and blew out; the extra weight on tire 1, which had been degraded by fatigue, caused it to fail as well; and flying debris destroyed tire 5. From there, the reduced braking power from the damaged wheels and the wet runway combined to prevent the aircraft from stopping in time, despite the crew’s application of full manual brakes and reverse thrust.
The first question that investigators had to ask was why the tires failed in the first place. Several scenarios were developed that could explain how the tread separated from tire 2, but underlying all of them was one causal factor: no rules for the retreading of aircraft tires existed. Airlines were completely free to use whatever retreading procedures they liked. Some airlines inspected their tires before retreading them, but Continental did not; in fact, none of the failed tires on flight 603 had been inspected for hidden damage before being retreaded, nor were they required to be. The lack of any minimum requirements allowed for the possibility of tire damage going undetected until the tires eventually failed.
Also contributing to the problem were the requirements under which the tires were designed. The tires used on this DC-10 were rated to withstand up to 24,400 kilograms (53,800 pounds) of static load, and were expected to bear no more than 23,405 kilograms (51,600 pounds) of static load at any point during their normal service life. However, this assumed an equal distribution of weight on the tires and left little margin of error if one tire had to bear considerably more weight than its mate on the same axle. In the case of flight 603, the failure of tire 2 placed a large load on tire 1 and caused it to also fail. The fact that each tire was not able to individually bear the weight normally carried by both tires eliminated any redundancy provided by having two tires on each axle in the first place. The NTSB had been aware of this problem since at least 1962, but attempts to get the Federal Aviation Administration to take action had been unsuccessful, and by 1978 tires were still not required to withstand the extra loads imparted by the failure of an adjacent tire.
Looking into the second major component of the crash — the failure to stop on the runway — the NTSB found more glaring safety gaps. In fact, the entire premise of the “decision speed” seemed to be flawed. V1 calculations were not required to account for a wet or slippery runway, even though this could significantly increase stopping distance. In 1977, the FAA commissioned a study of runway overrun accidents which identified 5 aircraft losses and 98 fatalities between 1964 and 1975 that could have been prevented if decision speeds had accounted for the frictional state of the runway. The implication was that pilots were aborting takeoffs due to failures that occurred prior to the calculated V1 but after the real V1, resulting in runway overruns despite the pilots following all rejected takeoff procedures correctly. In the case of flight 603, the formulae for calculating stopping distance — which were based off an engine failure at V1 on a dry runway — suggested that the plane would stop with 800 feet (244m) of runway to spare; however, accounting for the wet surface brought this down to zero, even without including the additional effect of the damaged brakes. It was therefore apparent that the measures being used to prevent runway overruns on takeoff did not reflect real world conditions.
In fact, all regulations and pilot training related to rejected takeoffs assumed a dry runway and an engine failure as the cause of the rejection. This was despite the fact that tire failures accounted for 74% of all rejected takeoffs. The “engine failure on a dry runway” mindset was so pervasive that simulators were not even capable of simulating a rejected takeoff with blown tires or on a wet runway, and pilots were trained in dry-runway engine failure scenarios only. Furthermore, certification requirements for new aircraft specified a maximum allowable stopping distance that was based an engine failure at V1 on a dry runway, with the assumption that this was the most critical situation in which the pilots would abort a takeoff. This was despite the fact that the failure of multiple tires on a wet runway was clearly a more critical scenario, at least in terms of the aircraft’s ability to stop. (The FAA had in fact been aware of this problem for some time, and its British counterpart had incorporated a wet runway into its stopping distance requirements clear back in 1962, but the United States lagged behind due to conflict over whether the new requirements would place an undue burden on operators by effectively banning certain planes from certain airports.)
To make matters worse, pilots used V1 as a cutoff point for any occurrence during the takeoff, including tire failures, even though V1 calculations assumed maximum braking power, something which often wasn’t available if the wheels were damaged. Pilots also did not receive any training that would prepare them for the exigencies of a rejected takeoff at V1 on a slippery runway. Taken together, these findings illustrated an obvious blind spot for the industry that had killed before and had cost lives once again on Continental Airlines flight 603. Had the pilots known the real decision speed, they would have continued the takeoff; in fact, the NTSB showed that the tire failure on flight 603 would not have interfered in any way with the plane’s ability to become airborne.
The safety problems didn’t end after the plane ran off the runway, however. The accident would have been a footnote if the landing gear hadn’t collapsed, sparking the fatal fire. But all airliners, including the DC-10, were supposedly built so that the landing gear would break away harmlessly in a crash landing without breaching the fuel tanks. This was no minor requirement — the rule had been put in place after the 1965 crash of a United Boeing 727 in Salt Lake City, in which 43 people died in the fire after an otherwise survivable accident. But in this case, as it turned out, unique circumstances prevented the landing gear from breaking away as expected. Instead of a clean front-to-back or side-to-side force shearing it off, the landing gear was wrenched off in a twisting motion when it dug into the tarmac while the plane was in a skid. This bypassed the built in failure mechanism and ripped out the wall of the fuel tank, starting the fire. At the time, McDonnell Douglas was already working on an updated landing gear design that would break off cleanly when subjected to loads above its design limit regardless of how they were applied.
The second problem that resulted in four deaths and dozens of injuries was the failure of the emergency slides, which melted under the intense radiant heat from the fire. The NTSB was concerned to discover that the design requirements for such slides made no mention of any ability to withstand fire or heat. When the FAA wrote the rules that slides must follow, they had neglected to consider the possibility that fire could compromise them before everyone was off the plane, instead assuming that any heat-related failure would only occur after the evacuation was over. The NTSB took the time in its final report to praise the flight attendants and pilots for their initiative in finding alternate escape routes after the failure of the slides, which ensured that almost all of the elderly passengers still got off the plane and avoided a situation that easily could have ended with mass fatalities.
Six months after the crash, the NTSB issued a series of recommendations intended to close the gaps in the safety net, including that tires have “adequate margins” for normal operations; that standards for retreaded tires be drafted; that the use of different tires from different brands on the same axle be banned; that inspections be required on both new and retreaded tires; that a limit be established on the number of times a tire can be retreaded; that FAA requirements for aircraft stopping distances take into account wet runways and events other than engine failures; that simulators be reprogrammed to include the effects of wet runways in stopping distance; and that pilots be trained on the most critical rejected takeoff scenarios. As a result of these recommendations, the FAA drafted new, tougher rules for the loads tires must be able to bear, how they must be inspected, and how they should be retreaded. The new requirements came into effect in 1984 and were subsequently strengthened in 2006.
Getting the FAA to take action on stopping distances took much longer. An initial amendment added a flat increase to the stopping distance requirements for all new planes certified after 1978, but didn’t explicitly include any adjustment for wet runways or bad brakes. After 10 years of the FAA dragging its feet, the NTSB eventually closed the recommendation and classified it as an “unacceptable response,” indicating that it didn’t consider the intent of the recommendation to be fulfilled. It wasn’t until 1998, 20 years after the crash of Continental flight 603, that the FAA issued a sweeping new amendment requiring that stopping distance calculations both for aircraft certification and for determining V1 assume worn brakes on a wet runway. Planes whose original type certificate was issued prior to 1978 — such as the Boeing 737 — are still held to the less restrictive stopping distance requirements that existed before the crash of flight 603. But in day-to-day operations, pilots on these planes calculate V1 using the same criteria as everyone else.
The FAA also made changes to improve the crashworthiness of every airliner. Beginning in 1983, escape slides were required to undergo radiant heat testing to prove that they would not even begin to deflate until at least 90 seconds after opening. (90 seconds is the time limit in which an evacuation is supposed to be completed.) Slides were also required to withstand the force of a large number of adults crowding at the top of the slide and jumping down each lane at a rate of one per second without the slide collapsing. The number of passengers per minute that slides were required to accommodate was increased from 30 to 60, and the maximum time allowed for the slide to inflate was decreased from 25 seconds to 10. In subsequent decades, these requirements were again strengthened to 70 passengers per minute and 6 seconds inflation time, respectively. In 1999, the radiant heat test was also revised so that the average time to failure must be at least 180 seconds (although the minimum of 90 seconds for any individual slide remained in place).
Although some of the changes were slow to be implemented, the breadth of the safety improvement from this relatively obscure accident is remarkable. In many ways, it was a microcosm of the safety problems of the 1970s: for several of the factors that led to the crash, regulations simply didn’t exist. The lack of a safety net in so many areas turned what could have been a very minor incident into a crash that killed four people, which was unfortunately a common occurrence at the time. Today, however, an accident like this would be unimaginable, and the rules in 1978 look sloppy by comparison. A modern plane suffering such a tire failure near V1 would have a much larger margin in which to stop, thanks to the improved list of factors that must be included in the determination of V1. And even if it were to run off the runway anyway — because, say, the pilots fail to apply maximum braking power — the plane would probably not even be damaged, due to runway environments that are designed to bring a plane to a halt intact as quickly as possible. And if the landing gear did somehow collapse, it probably wouldn’t start a fire, because vastly improved landing gear designs ensure that the fuel tanks are almost never breached in a universally survivable crash. For this, we can thank the persistent efforts of the NTSB and the eventual compliance of the FAA. Because of the lessons learned from Continental Airlines flight 603, we can say with confidence that in the United States, a similar accident will probably never happen again.
__________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 130 similar articles.
You can also support me on Patreon.
