|
A Systems Safety Look at UPS Flight 2976
The case shows how legacy certification decisions can persist even after service history points in another direction.
Teresa Konopka
Key Takeaways:
First, my thoughts and prayers go out to the families and friends of the Flight 2976 victims. May their memories be a blessing as loved ones remember the legacies left behind.
The National Transportation Safety Board (NTSB) held two days of investigative hearings last week on UPS Flight 2976, an accident involving a McDonnell Douglas MD-11F on Nov. 4, 2025. In this accident, the left No. 1 engine of the MD-11 separated from the wing shortly after takeoff. The aircraft was momentarily airborne before impacting the ground, triggering an explosion.
The investigation has so far determined that this separation was due to the failure of the pylon aft mount spherical bearing.
Defining Safety Classifications
I am a systems safety engineer who has worked at the Boeing Co. and separately investigated other aircraft accidents. When getting into the primary issues that have been publicly discussed so far, it’s helpful to understand a little bit about the design process and how that impacts the ways parts of the aircraft are classified and maintained.
When designing aircraft, a top-down approach is typically taken. Functional failures are first assessed at a high level, which then trickle down into lower levels.
For example, loss of thrust would be first assessed at catastrophic severity. Subsequent propulsion systems and subsystems are then assessed for their contribution to said high-level hazard. Systems safety engineers must later designate safety classifications for both software and hardware that contribute to these larger systems.
Software safety levels are determined using the Development Assurance Level process, known as DAL. Hardware safety levels are classified based on the consequences of failure. Software with higher DAL levels undergoes more vigorous test verification. Similarly, hardware with safety-significant labeling is subject to greater scrutiny in testing, inspection, repair, etc.
For an aircraft’s structure, the designation that drives the most safety rigor is the Principal Structural Element, or PSE. This has become a very important term for understanding the key issues in the NTSB’s ongoing investigation.
A PSE often requires more stringent analysis for fatigue and damage tolerance. According to the Code of Federal Regulations, a PSE is “a structural element that contributes significantly to the carriage of flight or ground loads, and the fatigue failure of that structural element could result in catastrophic failure of the aircraft.” The full legal definition of PSEs may be found at 14 CFR 29.571 — Fatigue Tolerance Evaluation of Metallic Structure.
Conversely, a Secondary Structural Item (SSI) is a part whose failure does not result in catastrophic events. According to the FAA, SSI is a “structure which carries only air or internal loads generated or within the secondary structure.” The full legal definition of SSIs may be found at AC 25.571-1B — Damage-Tolerance and Fatigue Evaluation of Structure.
MD-11 Safety Classifications
Since its original certification in 1990, the MD-11 has not classified all pylon lugs as PSE. Instead, the pylon lugs were classified as SSI.
When it comes to inspection cycles, those tend to be more frequent for PSEs and less frequent for SSIs. Furthermore, it goes without saying that requests to extend inspection intervals for PSEs are subject to more scrutiny than those for SSIs.
After Boeing acquired McDonnell Douglas, the company assumed responsibility for the MD-11 fleet’s airworthiness. The spherical bearing remained SSI after the 1997 merger and subsequent in-service failure events.
A 2011 service letter from Boeing (MD-11-SL-54-104-A) noted that the spherical bearings did not pose any safety-of-flight concern. In systems safety speak, the bearings were presented as not posing any threat to Continued Safety Flight and Landing, or CSFL.
A Bit of Personal Experience
I haven’t worked on the MD-11, but I’ve worked on the design and sustainment of other Boeing aircraft. When participating in the safety design of aircraft derivatives, it was extremely common to start with the baseline of the original model.
In other words, if a legacy aircraft classified a particular failure or part a certain way, that would greatly influence the safety designation of derivative designs.
I distinctly recall a design discussion on a new aircraft derivative. The distance between air data elements on the aircraft fuselage had been inherited from legacy design years ago.
In this specific instance, the distance between the elements was based on bird dimensions available at the time, such that if a bird collided with one air data element, the other element would be sufficiently far away not to be impacted as well.
I remember several members of the engineering team being ready to proceed with adopting the inherited design. However, when I conducted my own research on the types and sizes of birds that had hit aircraft in recent years, I found the spacing inadequate. I brought this to the attention of the senior design engineer — at the time, I was a junior engineer — who agreed the spacing should be increased.
While this example shows Boeing’s willingness to retrofit legacy designs to adapt to new information, it also shows the instinct to assume legacy designs remain sufficient years later.
MD-11 Reliability Analysis
In 2015, the Boeing Co. submitted a request to the Federal Aviation Administration to extend the inspection interval for engine mounts, including the spherical bearings. Specifically, the request was to extend the inspection interval from once every 19,900 flight cycles to once every 29,260. Given that the bearings were designated SSI rather than PSE, there was not as much hesitation about this request as there probably should have been.
During last week’s hearings, the NTSB reminded both Boeing and the FAA that MD-11 aircraft had experienced relevant failures over the years at lower cycles. From 2002 to 2017, multiple fracture events were reported for the pylon aft bulkhead spherical bearing outer race, which occurred well before 19,900 flight cycles.
Instances prior to the FAA request include: July 2002 at 8,515 flight cycles; August 2007 at 8,663 flight cycles; September 2007 at 6,058 cycles; October 2008 at 11,172 cycles; and February 2009 at 13,650 flight cycles.
There was even a Boeing service letter released in 2011 that discussed failures of these bearings. As stated earlier, the letter noted that the spherical bearings did not pose any safety-of-flight concern.
After Boeing’s request for extension of inspection intervals was granted, failures impacting the bearings continued to occur. In 2017, Boeing was made aware of a lug deformation.
NTSB Chairwoman Jennifer Homendy addressed Boeing and the FAA about this with a damning statement during last week’s hearing.
“My point is, you didn’t even get to 19,900 cycles, but then you put in an application based on 1980s, barely 1990s data.” She continued, “Boeing had put in an increase in inspection intervals from 19,900 to 29,260 and seemingly no one looked at these in-service failures. I don’t understand that.”
More Personal Experience
While working in Boeing’s Aviation Safety department, I would present reliability analyses. For a given failure scenario, I had to show the probability of failure rate.
I recall one briefing to the FAA more than 10 years ago. The FAA had an issue with a failure rate I had cited in a particular fault tree.
The FAA spokesperson — I have since forgotten who exactly — asked me, “Where did this number come from?”
I was a bit flabbergasted as I replied, “These are calculated rates based on service history.”
The inspector then cut back with, “Next time we meet, I want to see everything spelled out with where exactly each number came from.”
As soon as the meeting was over, I went back to my computer to create notes detailing where every single number came from. For added measure, I took screenshots showing the Boeing database used to mine data, the part queried, and the time frame used.
Unfortunately, it appears that this cutthroat approach to accepting failure rates was not applied in the MD-11 proceedings leading up to the accident.
Conclusions
The pylon aft-mount spherical bearing was not assigned an appropriate structural safety designation, and its already-too-long inspection interval was extended beyond a practical cycle for aviation safety. Despite multiple failures and service letters, the bearings were never elevated to the level of PSE.
Substantiation for this continuation of legacy acceptance was based on inherited design analysis that remained largely unquestioned. The extension of inspection intervals was based on outdated probability rates that were decades old. When newer data became available to elevate safety concerns related to the bearing, it was simply not factored into the rationale.
As to why that was, it is a mystery perhaps not even the NTSB can solve.
Teresa Konopka is an aviation safety professional specializing in systems safety engineering for civilian, commercial and military unmanned aircraft. She has served as a mishap investigation engineer and holds a B.S. in Aeronautical Engineering from Rensselaer Polytechnic Institute and an M.S. in Aviation Safety from Embry-Riddle Aeronautical University, with experience at Boeing, General Atomics, and Northrop Grumman.
Guest Post: A Systems Safety Look at UPS Flight 2976
| 
