UPS Accident Probe Finds Trail Of Missed Clues

Boeing’s flawed analysis of a 2002 in-service incident masked the significance of nine subsequent occurrences before a 10th led to the fatal crash of UPS Airlines Flight 2976 in November 2025, details released during an NTSB hearing as part of the safety agency’s probe reveal. The troubling chain of events raises concerns about foundational industry processes meant to improve in-service fleet safety through hazard identification and risk analysis.

Testimony and documents made public during the 1.5-day hearing held May 19-20 in Washington show the accident was caused by fatigue cracking that originated in a lubrication channel inside a part within the MD-11’s No. 1 (left) engine pylon. The channel runs along the inside circumference of a collar, or race, that forms part of a steel spherical bearing. The bearing rests within two lug holes, or bores, and houses a bolt that attaches the lugs to a wing clevis, providing one of the two engine attachment points on each wing.

Boeing understood from previous incidents that the race was susceptible to cracking. Several incidents also demonstrated that race damage could affect load distribution across the lugs, causing cracks or deformation.

But Boeing’s analysis concluded that if one lug failed, the second would hold, keeping the engine and pylon attached to the wing. As Flight 2976 proved, Boeing was wrong.

The MD-11’s left engine and pylon tore away from its wing right after rotation, when tension on the cracked lug was highest. Fatigue cracks in the lug bores gave way and both lugs fractured. The engine—its pylon still attached—pivoted forward and up, broke away from the wing, and passed over the MD-11’s rear fuselage.

The stricken widebody lifted off but could not maintain altitude. It went down 4,200 ft. from the end of Louisville International Airport’s Runway 17 Right, in an industrial area. Its maximum recorded radio altitude during the 22-sec. flight was 29 ft. All three UPS pilots onboard and 12 people on the ground were killed.

The accident happened 23 years after Boeing received its initial report of a failed MD-11 aft pylon spherical bearing from an unidentified operator. The bearing’s race broke in half, and the forward lug was bent, leaving a gap of 0.032 in. between the two lug tops. Boeing recommended replacing the bearing immediately and the entire bulkhead at the next heavy maintenance visit.

Investigators found no evidence Boeing reviewed the issue under its continued operational safety (COS) process. COS events go before an internal safety review board and are reported to the FAA.

Agency regulations require type certificate holders to report certain specific events. Among them: “A significant aircraft primary structural defect or failure caused by any autogenous condition (fatigue, understrength, corrosion, etc.).”

MD-11 pylon supplier Rohr conducted an FAA-required damage tolerance analysis on the structure during the aircraft’s development. Rohr determined the lugs are principal structural elements (PSE) under FAA regulations, but the spherical bearings are not. A PSE’s failure “could result in catastrophic failure of the aircraft,” Federal Aviation Regulation 29.751 states.

In August 2007, FedEx filed a service difficulty report with the FAA, detailing a fractured outer race. Boeing approved the bearing’s replacement as a major repair, but there is no evidence that the manufacturer knew the original bearing had broken.

A month later, a maintenance, repair and overhaul provider working on a second unnamed operator’s MD-11 discovered a fractured race and cracked lug. Boeing determined the crack was too large to blend out, so it recommended replacing the entire bulkhead. The aircraft had 6,058 cycles.

Boeing, which signed a formal COS program (COSP) agreement with the FAA in 2005, classified the incident as a COS event. Its internal safety review board concluded the problem was “not a safety issue” because “this bearing failure will not cause the lug joint failure,” the manufacturer told the FAA, documents provided to the NTSB show. Boeing’s rationale: The lug crack analysis “shows practically no growth,” and the lug assembly would hold if one of two lugs failed. The manufacturer also referenced required general visual inspections (GVI) and detailed visual inspections (DVI) every 60 months on alternating schedules, meaning trained mechanics reviewed the assembly every 30 months and would find any problems.

The 2007 COS event and earlier incidents prompted Boeing to redesign the spherical bearing and remove the 0.25-in. lubrication groove where the cracks formed. The airframer also updated the GVI and DVI language to call out signs of “migrated” races protruding from lug bores, signifying bearing damage.

Boeing, which bought MD-11 designer McDonnell-Douglas in 1997, issued a May 2008 service letter recommending operators install the new bearings and update MD-11 manuals. Both its classification and content proved critical.

While service bulletins and alert service bulletins signify notable or potentially critical safety issues, service letters are typically used for informational updates. The 2008 letter discussed a single in-service incident—the 2007 issue flagged as a COS event—and did not reference lug cracking. It also said the current inspections “are sufficient” to detect a complete bearing race failure. UPS evaluated the letter and concluded no action was needed.

Within nine months, Boeing had three more reports of MD-11 spherical bearing issues. One, involving a UPS aircraft, was flagged for COS review as an extension of the 2007 case—not a new event. A second event involving an unidentified operator included lug deformation that left a 0.027-in. gap between the two lugs. An eddy current inspection turned up no lug cracking.

Boeing updated its service letter in February 2011 based on the latest events; it did not mention lug damage. UPS, relying on the airframer’s disclosures and evaluation of the issues, reviewed the 2011 letter and came to the same conclusion as in 2008.

“We’re relying on the data that’s out there and what kind of determination is made on whether it was [safety-critical] or it’s not [safety-critical],” David Springer, senior director of engineering at UPS, testified during the recent NTSB hearing. “The issue was the outer race fractures were causing damage to the forward and aft lug halves. That propagated into what caused our accident. . . . Not only was it a bearing issue, it was the collateral damage that was happening to the lugs.”

The NTSB’s investigation turned up 10 additional in-service incidents of aft mount spherical bearing failures, including three since June 2020. Seven were reported to Boeing and four to the FAA. Only two were reported to both organizations, and one—the most recent, in December 2022 on a FedEx aircraft—was not reported to either.

The incidents prompted one COSP case covering two events. Permissible under the COSP agreement in place in 2007, similar occurrences would result in multiple cases under the current-day process, which could prompt a proactive FAA review.

The November 2025 accident grounded the global MD-11 fleet. UPS inspected its 26 aircraft soon after and found fractured races on three. The carrier retired its MD-11 fleet before the FAA’s early May clearance allowed the model to fly again, provided it has new spherical bearings and undergoes more frequent inspections.

Witnesses repeatedly flagged Boeing’s categorization of the early events as the catalyst in what became a systemic failure.

“There was a misunderstanding initially . . . about the severity of the event that might result from failure of this bearing,” said Melanie Violette, an FAA continued operational safety technical advisor. “There was information on [the September 2007] event that did not make its way into the COSP process—that there was an actual crack in the lug.

“Had that information come to light at the time, the determination might very well have been different,” she added at the NTSB hearing.

Shannon Deckard, director of quality assurance at UPS, said more awareness would have brought the issues to the forefront sooner. “Had we been aware of additional associated hazards, such as the [damage] caused to the lug bore or the lug itself, it would have heightened” the airline’s concerns, Deckard added. “Had we known more, we could have done more with this.”

Boeing does not have complete records of all seven incidents it knew about. Notably, the company does not have the analysis done on the critical first report. The lack of documentation means its representatives cannot explain why only some of the incidents were deemed COSP-reportable.

“I don’t understand the decision protocol that they used,” said Scott Hirsch, Boeing Commercial Airplanes senior director of fleet operations, when asked about the incidents that prompted the updated service letter. “I don’t know how they made their evaluation. I don’t have information that would explain their determination. But sitting here today, they would be COSP-reportable.”

Boeing submits about 4,000 COSP reports annually, said Brian Knaup, FAA continued operational safety branch manager. About half are categorized as potential safety issues. Of these, 50-100 result in airworthiness directives. The reports also feed into the agency’s Monitor Safety/Analyze Data process used to spot fleet trends.

In 2014, Boeing applied to extend Airworthiness Limitation Instruction (ALI) structural inspection program thresholds on 104 MD-11 PSEs, including the lugs. The FAA’s ALI adjustment review process leans heavily on the applicant’s analysis, which factors in certification testing and in-service data, including COSP reports.

The original threshold for the advanced, nondestructive checks was 19,900 cycles. Boeing’s MD-11 package used certification data from an analytical fatigue life calculation to justify a new proposed initial threshold of 29,260 cycles—23,202 more than the MD-11 with the lug crack discovered in September 2007.

The FAA approved the request.