Jherrod ThomasThe Lion of Functional Safety™

June 17, 2026 · 15 min read

14 CFR 25.571 PSEARP4761A FHAMSG-3 / 25.1529 ICA

When the Service Letter Said "Not Safety of Flight": The UPS MD-11 Pylon-Separation Crash Through a 14 CFR 25.571 and ARP4761A Lens

Every safety engineer has seen the document. It is the in-service bulletin that describes a part failing exactly the way it will eventually kill people, and then ends with a sentence saying the failure does not affect safety of flight. The 2011 Boeing Service Letter on the MD-11 pylon aft-mount spherical bearing is that document. It told operators the bearing race had fractured four times on three airplanes, identified the precise fatigue origin, offered a redesigned part that removed that origin, and then classified the whole thing as a maintenance-economic item on a 60-month visual check. Fourteen years later, UPS Flight 2976 rotated off runway 17R in Louisville, the left engine and pylon came off the wing, and fifteen people died.

This post does what the Service Letter did not. It re-frames the bearing race as part of a Principal Structural Element whose in-flight failure is Catastrophic, walks the misclassification through 14 CFR 25.571 and ARP4761A, and writes down the five derived requirements that would have moved this inspection out of an advisory letter and into the Airworthiness Limitations Section where an unsafe single-load-path failure belongs.

1. The public record

On November 4, 2025, at about 1714 eastern standard time, United Parcel Service flight 2976 — a Boeing (McDonnell-Douglas) MD-11F, registration N259UP — was destroyed after it struck buildings and the ground shortly after takeoff from runway 17R at Louisville Muhammad Ali International Airport. The three crewmembers and eleven people on the ground were killed; one further ground victim died of injuries 51 days later, bringing the toll to fifteen. Two more were seriously injured and twenty-one sustained minor injuries. The flight was a Part 121 cargo run bound for Honolulu. (NTSB Investigative Update, DCA26MA024)

Airport surveillance video showed the left (No. 1) engine and pylon separating from the wing just after rotation, with fire igniting near the left pylon-to-wing attachment. Four days later, on November 8, the FAA issued Emergency AD 2025-23-51 prohibiting further flight of all MD-11 and MD-11F airplanes until inspected. On November 14 the agency issued 2025-23-53, superseding it and extending the same unsafe-condition finding to the MD-10 and the full DC-10 family — MD-10-10F, MD-10-30F, DC-10-10/-15/-30/-40 and their freighter and KC-10A/KDC-10 variants — based on shared pylon-mount design heritage; that AD took effect December 1, 2025. (Federal Register 2025-20804; AVweb)

The NTSB held a two-day investigative hearing on May 19 and 20, 2026. It was not kind. Board member John DeLeeuw, reviewing the prior bearing failures, put it plainly: "We had something here, we just didn't do anything about it." UPS engineering testified that Boeing's documentation never characterized the bearing failure as a flight-safety risk and never explained the extent of structural damage that could follow. Boeing acknowledged it had not routinely mined the FAA Service Difficulty Report database for trend analysis, citing data-quality concerns. (Air Data News, May 20, 2026; FlightGlobal)

The engineering facts that matter sit in the NTSB Materials Laboratory findings, and they are unusually clean.

2. The standards lens: a Principal Structural Element that was inspected like a wear item

The pylon aft-mount bulkhead is an assembly of two independent fittings bolted together, with a forward lug and an aft lug that together house a single spherical bearing assembly — a ball element riding inside a one-piece bearing race. That bearing is the aft load path connecting the engine pylon to the wing clevis. On the accident airplane, both lugs were found fractured, and the bearing race had split into forward and aft portions. The NTSB Materials Laboratory found that the interior surface of the race had fatigue cracking originating around the entire circumference at the edge of a design recess groove, propagating outward through the thickness. Fatigue accounted for about 75% of the fracture surface; the remaining 25% was overstress. (NTSB Investigative Update)

That is a single-load-path structural element in the engine installation. Under 14 CFR 25.571, "Damage tolerance and fatigue evaluation of structure," any structure whose failure could contribute to a catastrophic outcome is a Principal Structural Element (PSE) and must be evaluated so that catastrophic failure due to fatigue is avoided throughout the operational life of the airplane — by analysis supported by test, and by an inspection program that detects damage before it reaches critical size. The engine-mount structure carries that obligation as squarely as a wing spar does. AC 25.571-1D is explicit that single-load-path elements demand inspection thresholds and intervals derived from crack-growth analysis, not from convenience.

Here is the inversion at the center of this accident. Per Boeing Service Letter MD-11-SL-54-104-A, dated February 7, 2011, the spherical bearing assembly (part number S00399-1) was to be inspected as part of a general visual inspection (GVI) and detailed visual inspection of the pylon aft mount, at a repetitive 60-month interval. The maintenance manual was updated so technicians would check whether the bearing race had migrated — protruded forward or aft beyond the lug faces. In other words, the only sanctioned in-service detection was for a race that had already fractured all the way around and started walking out of its housing. The Service Letter also introduced a new bearing, P/N S00399-523, that eliminated the design recess groove — the exact fatigue origin — but stopped short of prohibiting continued installation of the old S00399-1. Boeing's review, the letter stated, "determined it would not result in a safety of flight condition." (NTSB Investigative Update)

That single classification did all the damage. If the failure is "not safety of flight," it does not belong in the Airworthiness Limitations Section, it does not require an AD, the redesigned part stays optional, and the detection method is allowed to be "look for the part falling out." If the failure condition is instead recognized as the first event in a Catastrophic single-load-path separation, none of those choices survive a 25.571 review.

3. A worked snippet: the FHA row, the failure effect category, and the fault tree

Start with the airplane-level Functional Hazard Assessment that ARP4761A would expect for the engine installation. Loss of an engine in flight is survivable and is normally classified Hazardous at most; departure of the engine and pylon as a structure is a different animal, because it changes the wing, severs systems, and starts a fire at the wing root. It is Catastrophic.

| FHA ID | Failure condition | Phase | Classification | Substantiation basis | |--------|-------------------|-------|----------------|----------------------| | FHA-PROP-07 | In-flight separation of engine + pylon from wing | Takeoff / climb | Catastrophic | 14 CFR 25.571(b) damage tolerance — not 25.1309 numerical probability | | FHA-PROP-07.1 | Aft-mount spherical bearing race circumferential fracture | All | Catastrophic precursor (single load path) | Crack-growth analysis from recess groove; inspection in ALS |

Note the substantiation column. Structure is not certified by showing the failure is Extremely Improbable at 1e-9 per flight hour the way a system is under 25.1309. Structure is certified by damage tolerance: you assume the crack exists, you analyze how fast it grows, and you inspect often enough to catch it with margin. The bearing race had a known fatigue origin and a known failure mode. The damage-tolerance machinery existed. It simply was not pointed at this part, because the failure effect category was set wrong.

That category error is the whole story. Compare how the bearing was treated against how a PSE single-load-path element must be treated:

| Attribute | As classified (2011 Service Letter) | As a 25.571 PSE should be | |-----------|--------------------------------------|----------------------------| | Failure effect category | Economic / "not safety of flight" | Safety — Catastrophic precursor | | Detection method | GVI for race migration past lug face | Detailed/special inspection for subsurface fatigue at recess groove | | Interval basis | Fixed 60-month convenience interval | Crack-growth analysis; interval at most one-half time-to-critical | | Document status | Advisory Service Letter | Airworthiness Limitations Section, AD-backed | | Redesigned part (S00399-523) | Optional on unserviceable bearing | Mandatory; old part not reinstallable |

And the fault tree the Particular Risks / single-load-path analysis should have produced:

TOP  In-flight separation of left engine + pylon  (Catastrophic)
        |
       [OR]
        |------------------------------------------------.
        |                                                |
  Aft-mount load path fails                       Fwd/mid mount fails
  (SINGLE LOAD PATH: one element                  (not the accident
   fracture is sufficient)                         sequence)
        |
  Spherical bearing race fractures circumferentially  +  lugs fracture
        |
       [OR]
        |---------------------------------.
        |                                 |
  Fatigue crack initiates at         Overstress of remaining
  design recess groove,              ligament (~25% of section)
  grows around full circumference
  (~75% of fracture surface)
        |
       [AND]   <-- latent condition that makes the basic event undetected
        |---------------------------------.
        |                                 |
  60-month GVI cannot detect         Migration check only flags a race
  subsurface fatigue at groove       that has ALREADY fully fractured

The AND gate at the bottom is the part that should keep structures engineers up at night. The basic event (fatigue from the recess groove) was paired with a latent condition: the only in-service detection was for a state that occurs after the failure has already happened. A detection method that activates after the failure condition is not a detection method. It is a post-mortem.

4. Derived requirements (excerpt)

Five requirements, traceable IDs, the kind of thing that belongs in the structural substantiation and the Instructions for Continued Airworthiness rather than in a letter:

5. What the headline really tells us

The headline is "FAA grounds the MD-11, DC-10 and MD-10 fleets after a fatal pylon separation." The engineering reality is narrower and worse. This was not an unknown failure mode discovered in the wreckage. It was a documented fatigue origin, with a documented redesign, observed four times — and, per the hearing, on the order of ten times across the fleet including three FedEx freighters since 2020, with only four events formally reported to the FAA. The detection method was set to trigger after the failure had occurred. The redesigned part that removed the fatigue origin was left optional. And the single word that allowed all of that — the classification of a single-load-path PSE fracture as "not a safety of flight condition" — was never re-examined as the in-service evidence stacked up. (Air Data News; Spectrum News 1, May 20, 2026)

Reframe it as a missing artifact and the lesson generalizes past aging trijets. The failure here was a failure effect category. Get the FEC wrong on a single-load-path element and every downstream choice — inspection method, interval, document status, whether the fix is mandatory — inherits the error and points in the wrong direction. It does not matter whether the element is a pylon bearing, a rotorcraft hub-shaft, an infusion-pump battery latch, or a robot's single torque sensor. If the artifact that says "this failure is Catastrophic, and here is the inspection that catches it before it happens" does not exist, then the field reports will write it for you, one fracture at a time, until the fracture happens on rotation with a full fuel load. The MD-11 fleet has flown for thirty-five years. The artifact was thirty-five years late.

Sources

— Jherrod Thomas, The Lion of Functional Safety™