American Airlines Flight 96
Encyclopedia
American Airlines Flight 96 was a regular McDonnell Douglas
DC-10-10 flight operated by American Airlines
. The flight suffered a cargo door failure on 12 June 1972 while flying over Windsor, Ontario
; it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which led to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The cable controls to the number two (tail) engine were severed, causing that engine to shut down. Fortunately, there was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator and the horizontal stabilizer. However, because the right elevator cable was partially restricted, both pilots had to apply back pressure on the yoke
for the landing flare. Additionally, the approach and landing had to be made at high speed, to prevent the sink rate from becoming too high. The tendency to turn right was offset by using 45 degrees of left aileron, combined with asymmetrical thrust of the two wing engines. In spite of the partial restriction of the controls, the pilots were able to make a safe landing at Detroit Metropolitan Wayne County Airport
with no major injuries.
The cause was later traced to the door latching system, which had failed to close completely. A separate locking system was supposed to ensure this could not happen, but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system to avoid a repeat, but two years later Turkish Airlines Flight 981
's rear cargo door failed for exactly the same reason, causing the aircraft to lose all control and crash outside Paris
with a loss of 346 passengers and crew, the deadliest air disaster to that point.
with stops in Detroit Metropolitan Wayne County Airport
and Buffalo Niagara International Airport
. On 12 June it was being flown by DC-10-10 N103AA. It left Los Angeles 46 minutes after its scheduled 1:30 pm departure due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At Detroit the majority of the passengers disembarked, and the plane took on new passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11 crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before capturing V-554 (a victor airway), then climb to flight level 210 (21,000 ft).
At 7:25 pm while climbing through 11,750 ft, the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. Captain Bryce McCormick reported that he momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-left position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft, and attempted to re-apply power, finding that engines 1 and 3 would respond normally, but engine 2, in the tail, would not allow its controls to be moved. McCormick was able to level off and stabilize the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.
In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cabin, the attendants instructed the passengers on emergency landing procedures. A number of passengers later reported that the aircraft safety cards proved useful in locating the nearest exit.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for landing, the aircraft stabilized in a 1,900 ft/min descent that was far too fast for landing. By applying power to the 1 and 3 engines, McCormick was able to level off the nose and reduce the descent to 700 ft/min. The aircraft touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the right and eventually leaving the runway surface. The first officer, Peter Whitney, applied full reverse thrust to the left engine and idled the right, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped 880 ft from the runway threshold, with the nose and left gear on the runway and the right on the grass beside it. It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. A similar technique was used in 1989 following a complete loss of hydraulic pressure on another DC-10, United Airlines Flight 232
.
Investigators interviewed the ground crew at Detroit and learned that the cargo loader operating the rear door found it difficult to close. He stated that he closed the door electrically, and waited for the sound of the actuator motors to stop. When they did, he attempted to operate the locking handle, but found it very difficult to close. Adding force with his knee he was able to get the latch to lock, but noticed that the vent plug (see below) was not entirely closed. He brought this to the attention of a mechanic, who cleared the flight. The flight engineer reported that the "door ajar" warning light on his panel was not lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely intact, demonstrated that the latches had not rotated to their locked position. In their locked position, pressure on the door presses the latches further shut, and no force is transmitted into the actuator system that closes and opens them. With the latches only partially closed, forces on the door were transmitted back into the actuator, eventually overwhelming it at about 6,600 lbf. The rapid depressurization when the door broke off caused the floor above it to fail, which pulled the rudder cable to its extension limit and severed several other operating cables.
, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by "over top dead center latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the aircraft fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and actually further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was possible for the voltage delivered to the motor to be too small to drive it under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.
To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.
In theory, the motor failure on Flight 96 could not present a problem because the locking lever would not be able to close. However, during the investigation a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, turning the warning light off. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators had a single common point of failure, the mechanical weakness of the locking system that allowed the handle to be moved.
The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. However, because the control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor would cut controls to the tail section.
In response, the FAA, in charge of actually implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system, and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this should prevent a repeat of the accident.
Shortly after the event, Dan Applegate
, Director of Product Engineering at Convair
, wrote a memo to Convair
management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future.
In spite of these recommendations, two years later Turkish Airlines Flight 981
suffered an almost identical failure, but lost all control of the tail surfaces. The plane crashed outside Paris
, killing all 346 passengers and crew onboard. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed it had. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language, and had been instructed that as long as the locking handle closed the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.
In the aftermath of that accident, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas
, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, the Turkish Airlines disaster would have been avoided.
A complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again.
N103AA's airframe was broken up at Phoenix Goodyear Airport
in 2002, after being assigned to the FedEx
MD-10
program.
show Mayday
(known as Air Emergency in the US, Mayday in Ireland and Air Crash Investigation in the UK and the rest of world). The episode is entitled "Behind Closed Doors".
American Airlines Flight 96 was a regular McDonnell Douglas
DC-10-10 flight operated by American Airlines
. The flight suffered a cargo door failure on 12 June 1972 while flying over Windsor, Ontario
; it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which led to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The cable controls to the number two (tail) engine were severed, causing that engine to shut down. Fortunately, there was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator and the horizontal stabilizer. However, because the right elevator cable was partially restricted, both pilots had to apply back pressure on the yoke
for the landing flare. Additionally, the approach and landing had to be made at high speed, to prevent the sink rate from becoming too high. The tendency to turn right was offset by using 45 degrees of left aileron, combined with asymmetrical thrust of the two wing engines. In spite of the partial restriction of the controls, the pilots were able to make a safe landing at Detroit Metropolitan Wayne County Airport
with no major injuries.
The cause was later traced to the door latching system, which had failed to close completely. A separate locking system was supposed to ensure this could not happen, but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system to avoid a repeat, but two years later Turkish Airlines Flight 981
's rear cargo door failed for exactly the same reason, causing the aircraft to lose all control and crash outside Paris
with a loss of 346 passengers and crew, the deadliest air disaster to that point.
with stops in Detroit Metropolitan Wayne County Airport
and Buffalo Niagara International Airport
. On 12 June it was being flown by DC-10-10 N103AA. It left Los Angeles 46 minutes after its scheduled 1:30 pm departure due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At Detroit the majority of the passengers disembarked, and the plane took on new passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11 crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before capturing V-554 (a victor airway), then climb to flight level 210 (21,000 ft).
At 7:25 pm while climbing through 11,750 ft, the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. Captain Bryce McCormick reported that he momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-left position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft, and attempted to re-apply power, finding that engines 1 and 3 would respond normally, but engine 2, in the tail, would not allow its controls to be moved. McCormick was able to level off and stabilize the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.
In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cabin, the attendants instructed the passengers on emergency landing procedures. A number of passengers later reported that the aircraft safety cards proved useful in locating the nearest exit.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for landing, the aircraft stabilized in a 1,900 ft/min descent that was far too fast for landing. By applying power to the 1 and 3 engines, McCormick was able to level off the nose and reduce the descent to 700 ft/min. The aircraft touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the right and eventually leaving the runway surface. The first officer, Peter Whitney, applied full reverse thrust to the left engine and idled the right, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped 880 ft from the runway threshold, with the nose and left gear on the runway and the right on the grass beside it. It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. A similar technique was used in 1989 following a complete loss of hydraulic pressure on another DC-10, United Airlines Flight 232
.
Investigators interviewed the ground crew at Detroit and learned that the cargo loader operating the rear door found it difficult to close. He stated that he closed the door electrically, and waited for the sound of the actuator motors to stop. When they did, he attempted to operate the locking handle, but found it very difficult to close. Adding force with his knee he was able to get the latch to lock, but noticed that the vent plug (see below) was not entirely closed. He brought this to the attention of a mechanic, who cleared the flight. The flight engineer reported that the "door ajar" warning light on his panel was not lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely intact, demonstrated that the latches had not rotated to their locked position. In their locked position, pressure on the door presses the latches further shut, and no force is transmitted into the actuator system that closes and opens them. With the latches only partially closed, forces on the door were transmitted back into the actuator, eventually overwhelming it at about 6,600 lbf. The rapid depressurization when the door broke off caused the floor above it to fail, which pulled the rudder cable to its extension limit and severed several other operating cables.
, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by "over top dead center latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the aircraft fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and actually further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was possible for the voltage delivered to the motor to be too small to drive it under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.
To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.
In theory, the motor failure on Flight 96 could not present a problem because the locking lever would not be able to close. However, during the investigation a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, turning the warning light off. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators had a single common point of failure, the mechanical weakness of the locking system that allowed the handle to be moved.
The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. However, because the control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor would cut controls to the tail section.
In response, the FAA, in charge of actually implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system, and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this should prevent a repeat of the accident.
Shortly after the event, Dan Applegate
, Director of Product Engineering at Convair
, wrote a memo to Convair
management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future.
In spite of these recommendations, two years later Turkish Airlines Flight 981
suffered an almost identical failure, but lost all control of the tail surfaces. The plane crashed outside Paris
, killing all 346 passengers and crew onboard. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed it had. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language, and had been instructed that as long as the locking handle closed the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.
In the aftermath of that accident, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas
, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, the Turkish Airlines disaster would have been avoided.
A complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again.
N103AA's airframe was broken up at Phoenix Goodyear Airport
in 2002, after being assigned to the FedEx
MD-10
program.
show Mayday
(known as Air Emergency in the US, Mayday in Ireland and Air Crash Investigation in the UK and the rest of world). The episode is entitled "Behind Closed Doors".
American Airlines Flight 96 was a regular McDonnell Douglas
DC-10-10 flight operated by American Airlines
. The flight suffered a cargo door failure on 12 June 1972 while flying over Windsor, Ontario
; it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which led to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The cable controls to the number two (tail) engine were severed, causing that engine to shut down. Fortunately, there was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator and the horizontal stabilizer. However, because the right elevator cable was partially restricted, both pilots had to apply back pressure on the yoke
for the landing flare. Additionally, the approach and landing had to be made at high speed, to prevent the sink rate from becoming too high. The tendency to turn right was offset by using 45 degrees of left aileron, combined with asymmetrical thrust of the two wing engines. In spite of the partial restriction of the controls, the pilots were able to make a safe landing at Detroit Metropolitan Wayne County Airport
with no major injuries.
The cause was later traced to the door latching system, which had failed to close completely. A separate locking system was supposed to ensure this could not happen, but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system to avoid a repeat, but two years later Turkish Airlines Flight 981
's rear cargo door failed for exactly the same reason, causing the aircraft to lose all control and crash outside Paris
with a loss of 346 passengers and crew, the deadliest air disaster to that point.
with stops in Detroit Metropolitan Wayne County Airport
and Buffalo Niagara International Airport
. On 12 June it was being flown by DC-10-10 N103AA. It left Los Angeles 46 minutes after its scheduled 1:30 pm departure due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At Detroit the majority of the passengers disembarked, and the plane took on new passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11 crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before capturing V-554 (a victor airway), then climb to flight level 210 (21,000 ft).
At 7:25 pm while climbing through 11,750 ft, the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. Captain Bryce McCormick reported that he momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-left position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft, and attempted to re-apply power, finding that engines 1 and 3 would respond normally, but engine 2, in the tail, would not allow its controls to be moved. McCormick was able to level off and stabilize the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.
In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cabin, the attendants instructed the passengers on emergency landing procedures. A number of passengers later reported that the aircraft safety cards proved useful in locating the nearest exit.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for landing, the aircraft stabilized in a 1,900 ft/min descent that was far too fast for landing. By applying power to the 1 and 3 engines, McCormick was able to level off the nose and reduce the descent to 700 ft/min. The aircraft touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the right and eventually leaving the runway surface. The first officer, Peter Whitney, applied full reverse thrust to the left engine and idled the right, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped 880 ft from the runway threshold, with the nose and left gear on the runway and the right on the grass beside it. It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. A similar technique was used in 1989 following a complete loss of hydraulic pressure on another DC-10, United Airlines Flight 232
.
Investigators interviewed the ground crew at Detroit and learned that the cargo loader operating the rear door found it difficult to close. He stated that he closed the door electrically, and waited for the sound of the actuator motors to stop. When they did, he attempted to operate the locking handle, but found it very difficult to close. Adding force with his knee he was able to get the latch to lock, but noticed that the vent plug (see below) was not entirely closed. He brought this to the attention of a mechanic, who cleared the flight. The flight engineer reported that the "door ajar" warning light on his panel was not lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely intact, demonstrated that the latches had not rotated to their locked position. In their locked position, pressure on the door presses the latches further shut, and no force is transmitted into the actuator system that closes and opens them. With the latches only partially closed, forces on the door were transmitted back into the actuator, eventually overwhelming it at about 6,600 lbf. The rapid depressurization when the door broke off caused the floor above it to fail, which pulled the rudder cable to its extension limit and severed several other operating cables.
, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by "over top dead center latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the aircraft fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and actually further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was possible for the voltage delivered to the motor to be too small to drive it under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.
To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.
In theory, the motor failure on Flight 96 could not present a problem because the locking lever would not be able to close. However, during the investigation a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, turning the warning light off. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators had a single common point of failure, the mechanical weakness of the locking system that allowed the handle to be moved.
The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. However, because the control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor would cut controls to the tail section.
In response, the FAA, in charge of actually implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system, and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this should prevent a repeat of the accident.
Shortly after the event, Dan Applegate
, Director of Product Engineering at Convair
, wrote a memo to Convair
management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future.
In spite of these recommendations, two years later Turkish Airlines Flight 981
suffered an almost identical failure, but lost all control of the tail surfaces. The plane crashed outside Paris
, killing all 346 passengers and crew onboard. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed it had. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language, and had been instructed that as long as the locking handle closed the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.
In the aftermath of that accident, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas
, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, the Turkish Airlines disaster would have been avoided.
A complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again.
N103AA's airframe was broken up at Phoenix Goodyear Airport
in 2002, after being assigned to the FedEx
MD-10
program.
show Mayday
(known as Air Emergency in the US, Mayday in Ireland and Air Crash Investigation in the UK and the rest of world). The episode is entitled "Behind Closed Doors".
McDonnell Douglas
McDonnell Douglas was a major American aerospace manufacturer and defense contractor, producing a number of famous commercial and military aircraft. It formed from a merger of McDonnell Aircraft and Douglas Aircraft in 1967. McDonnell Douglas was based at Lambert-St. Louis International Airport...
DC-10-10 flight operated by American Airlines
American Airlines
American Airlines, Inc. is the world's fourth-largest airline in passenger miles transported and operating revenues. American Airlines is a subsidiary of the AMR Corporation and is headquartered in Fort Worth, Texas adjacent to its largest hub at Dallas/Fort Worth International Airport...
. The flight suffered a cargo door failure on 12 June 1972 while flying over Windsor, Ontario
Windsor, Ontario
Windsor is the southernmost city in Canada and is located in Southwestern Ontario at the western end of the heavily populated Quebec City – Windsor Corridor. It is within Essex County, Ontario, although administratively separated from the county government. Separated by the Detroit River, Windsor...
; it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which led to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The cable controls to the number two (tail) engine were severed, causing that engine to shut down. Fortunately, there was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator and the horizontal stabilizer. However, because the right elevator cable was partially restricted, both pilots had to apply back pressure on the yoke
Yoke (aircraft)
A yoke, alternatively known as control column, is a device used for piloting in most fixed-wing aircraft.- Principle :The aviator uses the yoke to control the attitude of the plane, usually in both pitch and roll. Rotating the control wheel controls the ailerons and the roll axis...
for the landing flare. Additionally, the approach and landing had to be made at high speed, to prevent the sink rate from becoming too high. The tendency to turn right was offset by using 45 degrees of left aileron, combined with asymmetrical thrust of the two wing engines. In spite of the partial restriction of the controls, the pilots were able to make a safe landing at Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport , usually called Detroit Metro Airport, Metro Airport locally, or simply DTW, is a major international airport covering in Romulus, Michigan, a suburb of Detroit. It is Michigan's busiest airport....
with no major injuries.
The cause was later traced to the door latching system, which had failed to close completely. A separate locking system was supposed to ensure this could not happen, but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system to avoid a repeat, but two years later Turkish Airlines Flight 981
Turkish Airlines Flight 981
Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
's rear cargo door failed for exactly the same reason, causing the aircraft to lose all control and crash outside Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
with a loss of 346 passengers and crew, the deadliest air disaster to that point.
Accident details
Flight 96 was a regularly scheduled flight from Los Angeles to LaGuardia AirportLaGuardia Airport
LaGuardia Airport is an airport located in the northern part of Queens County on Long Island in the City of New York. The airport is located on the waterfront of Flushing Bay and Bowery Bay, and borders the neighborhoods of Astoria, Jackson Heights and East Elmhurst. The airport was originally...
with stops in Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport , usually called Detroit Metro Airport, Metro Airport locally, or simply DTW, is a major international airport covering in Romulus, Michigan, a suburb of Detroit. It is Michigan's busiest airport....
and Buffalo Niagara International Airport
Buffalo Niagara International Airport
Buffalo Niagara International Airport is an airport located in Cheektowaga CDP, Town of Cheektowaga, in Erie County, New York, USA. It is named after the Buffalo – Niagara Falls metropolitan area. The airport serves Buffalo, New York as well as Southern Ontario, Canada...
. On 12 June it was being flown by DC-10-10 N103AA. It left Los Angeles 46 minutes after its scheduled 1:30 pm departure due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At Detroit the majority of the passengers disembarked, and the plane took on new passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11 crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before capturing V-554 (a victor airway), then climb to flight level 210 (21,000 ft).
At 7:25 pm while climbing through 11,750 ft, the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. Captain Bryce McCormick reported that he momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-left position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft, and attempted to re-apply power, finding that engines 1 and 3 would respond normally, but engine 2, in the tail, would not allow its controls to be moved. McCormick was able to level off and stabilize the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.
In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cabin, the attendants instructed the passengers on emergency landing procedures. A number of passengers later reported that the aircraft safety cards proved useful in locating the nearest exit.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for landing, the aircraft stabilized in a 1,900 ft/min descent that was far too fast for landing. By applying power to the 1 and 3 engines, McCormick was able to level off the nose and reduce the descent to 700 ft/min. The aircraft touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the right and eventually leaving the runway surface. The first officer, Peter Whitney, applied full reverse thrust to the left engine and idled the right, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped 880 ft from the runway threshold, with the nose and left gear on the runway and the right on the grass beside it. It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. A similar technique was used in 1989 following a complete loss of hydraulic pressure on another DC-10, United Airlines Flight 232
United Airlines Flight 232
United Airlines Flight 232 was a scheduled flight from Stapleton International Airport in Denver, Colorado, to O'Hare International Airport in Chicago, with continuing service to Philadelphia International Airport...
.
Investigation
The problem that caused the accident was immediately obvious, as the cargo door was missing and had caused damage to the left horizontal stabilizer as it flew off. Investigators immediately studied the maintenance history and found that on 3 March 1972 the handlers reported that the door had not latched electrically and had to be closed manually. On 30 May McDonnell Douglas issued Service Bulletin 52-27, DC-10 SC 612, which called for the upgrading of the electrical wiring that drove the latches because "Three operators have reported failure of the electrical latch actuators to latch/unlatch the cargo doors. Latch actuator failure is attributed to an excessive voltage drop reducing the output torque to the actuator. This condition may prevent electrical latching/unlatching of the hooks." The modification was not compulsory, however, and had not been carried out on N103AA.Investigators interviewed the ground crew at Detroit and learned that the cargo loader operating the rear door found it difficult to close. He stated that he closed the door electrically, and waited for the sound of the actuator motors to stop. When they did, he attempted to operate the locking handle, but found it very difficult to close. Adding force with his knee he was able to get the latch to lock, but noticed that the vent plug (see below) was not entirely closed. He brought this to the attention of a mechanic, who cleared the flight. The flight engineer reported that the "door ajar" warning light on his panel was not lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely intact, demonstrated that the latches had not rotated to their locked position. In their locked position, pressure on the door presses the latches further shut, and no force is transmitted into the actuator system that closes and opens them. With the latches only partially closed, forces on the door were transmitted back into the actuator, eventually overwhelming it at about 6,600 lbf. The rapid depressurization when the door broke off caused the floor above it to fail, which pulled the rudder cable to its extension limit and severed several other operating cables.
Cause
Passenger doors on the DC-10 are of the plug varietyPlug door
A plug door is a door designed to seal itself by taking advantage of pressure difference on its two sides and is typically used on pressurised aircraft...
, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by "over top dead center latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the aircraft fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and actually further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was possible for the voltage delivered to the motor to be too small to drive it under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.
To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.
In theory, the motor failure on Flight 96 could not present a problem because the locking lever would not be able to close. However, during the investigation a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, turning the warning light off. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators had a single common point of failure, the mechanical weakness of the locking system that allowed the handle to be moved.
The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. However, because the control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor would cut controls to the tail section.
Aftermath
The NTSB suggested several changes to the system to ensure that the Windsor accident would not recur. These included changes to the locking mechanism to ensure it could not be forced closed, as well as venting cut into the rear cabin floor.In response, the FAA, in charge of actually implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system, and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this should prevent a repeat of the accident.
Shortly after the event, Dan Applegate
Dan Applegate
F. D. "Dan" Applegate was Director of Product Engineering for Convair, a McDonnell Douglas subcontractor during the early 1970s. He rose from relative obscurity to become the subject of a classic case in engineering ethics when he penned what became known as the "Applegate Memorandum".On June 12,...
, Director of Product Engineering at Convair
Convair
Convair was an American aircraft manufacturing company which later expanded into rockets and spacecraft. The company was formed in 1943 by the merger of Vultee Aircraft and Consolidated Aircraft, and went on to produce a number of pioneering aircraft, such as the Convair B-36 bomber, and the F-102...
, wrote a memo to Convair
Convair
Convair was an American aircraft manufacturing company which later expanded into rockets and spacecraft. The company was formed in 1943 by the merger of Vultee Aircraft and Consolidated Aircraft, and went on to produce a number of pioneering aircraft, such as the Convair B-36 bomber, and the F-102...
management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future.
In spite of these recommendations, two years later Turkish Airlines Flight 981
Turkish Airlines Flight 981
Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
suffered an almost identical failure, but lost all control of the tail surfaces. The plane crashed outside Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
, killing all 346 passengers and crew onboard. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed it had. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language, and had been instructed that as long as the locking handle closed the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.
In the aftermath of that accident, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas
McDonnell Douglas
McDonnell Douglas was a major American aerospace manufacturer and defense contractor, producing a number of famous commercial and military aircraft. It formed from a merger of McDonnell Aircraft and Douglas Aircraft in 1967. McDonnell Douglas was based at Lambert-St. Louis International Airport...
, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, the Turkish Airlines disaster would have been avoided.
A complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again.
N103AA's airframe was broken up at Phoenix Goodyear Airport
Phoenix Goodyear Airport
Phoenix Goodyear Airport , formerly known as Goodyear Municipal Airport, is a public airport located one mile southwest of the central business district of Goodyear, in Maricopa County, Arizona, United States....
in 2002, after being assigned to the FedEx
FedEx
FedEx Corporation , originally known as FDX Corporation, is a logistics services company, based in the United States with headquarters in Memphis, Tennessee...
MD-10
McDonnell Douglas DC-10
The McDonnell Douglas DC-10 is a three-engine widebody jet airliner manufactured by McDonnell Douglas. The DC-10 has range for medium- to long-haul flights, capable of carrying a maximum 380 passengers. Its most distinguishing feature is the two turbofan engines mounted on underwing pylons and a...
program.
Dramatization
The story of the disaster was featured on the fifth season of Canadian National Geographic ChannelNational Geographic Channel
National Geographic Channel, also commercially abbreviated and trademarked as Nat Geo, is a subscription television channel that airs non-fiction television programs produced by the National Geographic Society. Like History and the Discovery Channel, the channel features documentaries with factual...
show Mayday
Mayday (TV series)
Mayday, also known as Air Crash Investigation in the United Kingdom, Australia and Asia and Air Emergency and Air Disasters in the United States, is a Canadian documentary television programme produced by Cineflix investigating air crashes, near-crashes and other disasters...
(known as Air Emergency in the US, Mayday in Ireland and Air Crash Investigation in the UK and the rest of world). The episode is entitled "Behind Closed Doors".
See also
- Flight with disabled controlsFlight with disabled controlsSeveral aviation incidents and accidents have occurred in which the control surfaces of the aircraft became disabled, often due to failure of hydraulic systems or the flight control system. Other incidents have occurred where controls were not functioning correctly prior to take-off, either due to...
- List of notable accidents and incidents on commercial aircraft
- List of notable decompression accidents and incidents
- Loss of control
- Turkish Airlines Flight 981Turkish Airlines Flight 981Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
- United Airlines Flight 811United Airlines Flight 811United Airlines Flight 811 experienced a cargo door failure in flight on Friday, February 24, 1989, after its stopover at Honolulu International Airport, Hawaii...
External links
American Airlines Flight 96 was a regular McDonnell Douglas
McDonnell Douglas
McDonnell Douglas was a major American aerospace manufacturer and defense contractor, producing a number of famous commercial and military aircraft. It formed from a merger of McDonnell Aircraft and Douglas Aircraft in 1967. McDonnell Douglas was based at Lambert-St. Louis International Airport...
DC-10-10 flight operated by American Airlines
American Airlines
American Airlines, Inc. is the world's fourth-largest airline in passenger miles transported and operating revenues. American Airlines is a subsidiary of the AMR Corporation and is headquartered in Fort Worth, Texas adjacent to its largest hub at Dallas/Fort Worth International Airport...
. The flight suffered a cargo door failure on 12 June 1972 while flying over Windsor, Ontario
Windsor, Ontario
Windsor is the southernmost city in Canada and is located in Southwestern Ontario at the western end of the heavily populated Quebec City – Windsor Corridor. It is within Essex County, Ontario, although administratively separated from the county government. Separated by the Detroit River, Windsor...
; it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which led to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The cable controls to the number two (tail) engine were severed, causing that engine to shut down. Fortunately, there was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator and the horizontal stabilizer. However, because the right elevator cable was partially restricted, both pilots had to apply back pressure on the yoke
Yoke (aircraft)
A yoke, alternatively known as control column, is a device used for piloting in most fixed-wing aircraft.- Principle :The aviator uses the yoke to control the attitude of the plane, usually in both pitch and roll. Rotating the control wheel controls the ailerons and the roll axis...
for the landing flare. Additionally, the approach and landing had to be made at high speed, to prevent the sink rate from becoming too high. The tendency to turn right was offset by using 45 degrees of left aileron, combined with asymmetrical thrust of the two wing engines. In spite of the partial restriction of the controls, the pilots were able to make a safe landing at Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport , usually called Detroit Metro Airport, Metro Airport locally, or simply DTW, is a major international airport covering in Romulus, Michigan, a suburb of Detroit. It is Michigan's busiest airport....
with no major injuries.
The cause was later traced to the door latching system, which had failed to close completely. A separate locking system was supposed to ensure this could not happen, but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system to avoid a repeat, but two years later Turkish Airlines Flight 981
Turkish Airlines Flight 981
Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
's rear cargo door failed for exactly the same reason, causing the aircraft to lose all control and crash outside Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
with a loss of 346 passengers and crew, the deadliest air disaster to that point.
Accident details
Flight 96 was a regularly scheduled flight from Los Angeles to LaGuardia AirportLaGuardia Airport
LaGuardia Airport is an airport located in the northern part of Queens County on Long Island in the City of New York. The airport is located on the waterfront of Flushing Bay and Bowery Bay, and borders the neighborhoods of Astoria, Jackson Heights and East Elmhurst. The airport was originally...
with stops in Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport , usually called Detroit Metro Airport, Metro Airport locally, or simply DTW, is a major international airport covering in Romulus, Michigan, a suburb of Detroit. It is Michigan's busiest airport....
and Buffalo Niagara International Airport
Buffalo Niagara International Airport
Buffalo Niagara International Airport is an airport located in Cheektowaga CDP, Town of Cheektowaga, in Erie County, New York, USA. It is named after the Buffalo – Niagara Falls metropolitan area. The airport serves Buffalo, New York as well as Southern Ontario, Canada...
. On 12 June it was being flown by DC-10-10 N103AA. It left Los Angeles 46 minutes after its scheduled 1:30 pm departure due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At Detroit the majority of the passengers disembarked, and the plane took on new passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11 crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before capturing V-554 (a victor airway), then climb to flight level 210 (21,000 ft).
At 7:25 pm while climbing through 11,750 ft, the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. Captain Bryce McCormick reported that he momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-left position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft, and attempted to re-apply power, finding that engines 1 and 3 would respond normally, but engine 2, in the tail, would not allow its controls to be moved. McCormick was able to level off and stabilize the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.
In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cabin, the attendants instructed the passengers on emergency landing procedures. A number of passengers later reported that the aircraft safety cards proved useful in locating the nearest exit.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for landing, the aircraft stabilized in a 1,900 ft/min descent that was far too fast for landing. By applying power to the 1 and 3 engines, McCormick was able to level off the nose and reduce the descent to 700 ft/min. The aircraft touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the right and eventually leaving the runway surface. The first officer, Peter Whitney, applied full reverse thrust to the left engine and idled the right, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped 880 ft from the runway threshold, with the nose and left gear on the runway and the right on the grass beside it. It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. A similar technique was used in 1989 following a complete loss of hydraulic pressure on another DC-10, United Airlines Flight 232
United Airlines Flight 232
United Airlines Flight 232 was a scheduled flight from Stapleton International Airport in Denver, Colorado, to O'Hare International Airport in Chicago, with continuing service to Philadelphia International Airport...
.
Investigation
The problem that caused the accident was immediately obvious, as the cargo door was missing and had caused damage to the left horizontal stabilizer as it flew off. Investigators immediately studied the maintenance history and found that on 3 March 1972 the handlers reported that the door had not latched electrically and had to be closed manually. On 30 May McDonnell Douglas issued Service Bulletin 52-27, DC-10 SC 612, which called for the upgrading of the electrical wiring that drove the latches because "Three operators have reported failure of the electrical latch actuators to latch/unlatch the cargo doors. Latch actuator failure is attributed to an excessive voltage drop reducing the output torque to the actuator. This condition may prevent electrical latching/unlatching of the hooks." The modification was not compulsory, however, and had not been carried out on N103AA.Investigators interviewed the ground crew at Detroit and learned that the cargo loader operating the rear door found it difficult to close. He stated that he closed the door electrically, and waited for the sound of the actuator motors to stop. When they did, he attempted to operate the locking handle, but found it very difficult to close. Adding force with his knee he was able to get the latch to lock, but noticed that the vent plug (see below) was not entirely closed. He brought this to the attention of a mechanic, who cleared the flight. The flight engineer reported that the "door ajar" warning light on his panel was not lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely intact, demonstrated that the latches had not rotated to their locked position. In their locked position, pressure on the door presses the latches further shut, and no force is transmitted into the actuator system that closes and opens them. With the latches only partially closed, forces on the door were transmitted back into the actuator, eventually overwhelming it at about 6,600 lbf. The rapid depressurization when the door broke off caused the floor above it to fail, which pulled the rudder cable to its extension limit and severed several other operating cables.
Cause
Passenger doors on the DC-10 are of the plug varietyPlug door
A plug door is a door designed to seal itself by taking advantage of pressure difference on its two sides and is typically used on pressurised aircraft...
, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by "over top dead center latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the aircraft fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and actually further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was possible for the voltage delivered to the motor to be too small to drive it under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.
To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.
In theory, the motor failure on Flight 96 could not present a problem because the locking lever would not be able to close. However, during the investigation a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, turning the warning light off. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators had a single common point of failure, the mechanical weakness of the locking system that allowed the handle to be moved.
The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. However, because the control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor would cut controls to the tail section.
Aftermath
The NTSB suggested several changes to the system to ensure that the Windsor accident would not recur. These included changes to the locking mechanism to ensure it could not be forced closed, as well as venting cut into the rear cabin floor.In response, the FAA, in charge of actually implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system, and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this should prevent a repeat of the accident.
Shortly after the event, Dan Applegate
Dan Applegate
F. D. "Dan" Applegate was Director of Product Engineering for Convair, a McDonnell Douglas subcontractor during the early 1970s. He rose from relative obscurity to become the subject of a classic case in engineering ethics when he penned what became known as the "Applegate Memorandum".On June 12,...
, Director of Product Engineering at Convair
Convair
Convair was an American aircraft manufacturing company which later expanded into rockets and spacecraft. The company was formed in 1943 by the merger of Vultee Aircraft and Consolidated Aircraft, and went on to produce a number of pioneering aircraft, such as the Convair B-36 bomber, and the F-102...
, wrote a memo to Convair
Convair
Convair was an American aircraft manufacturing company which later expanded into rockets and spacecraft. The company was formed in 1943 by the merger of Vultee Aircraft and Consolidated Aircraft, and went on to produce a number of pioneering aircraft, such as the Convair B-36 bomber, and the F-102...
management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future.
In spite of these recommendations, two years later Turkish Airlines Flight 981
Turkish Airlines Flight 981
Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
suffered an almost identical failure, but lost all control of the tail surfaces. The plane crashed outside Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
, killing all 346 passengers and crew onboard. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed it had. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language, and had been instructed that as long as the locking handle closed the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.
In the aftermath of that accident, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas
McDonnell Douglas
McDonnell Douglas was a major American aerospace manufacturer and defense contractor, producing a number of famous commercial and military aircraft. It formed from a merger of McDonnell Aircraft and Douglas Aircraft in 1967. McDonnell Douglas was based at Lambert-St. Louis International Airport...
, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, the Turkish Airlines disaster would have been avoided.
A complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again.
N103AA's airframe was broken up at Phoenix Goodyear Airport
Phoenix Goodyear Airport
Phoenix Goodyear Airport , formerly known as Goodyear Municipal Airport, is a public airport located one mile southwest of the central business district of Goodyear, in Maricopa County, Arizona, United States....
in 2002, after being assigned to the FedEx
FedEx
FedEx Corporation , originally known as FDX Corporation, is a logistics services company, based in the United States with headquarters in Memphis, Tennessee...
MD-10
McDonnell Douglas DC-10
The McDonnell Douglas DC-10 is a three-engine widebody jet airliner manufactured by McDonnell Douglas. The DC-10 has range for medium- to long-haul flights, capable of carrying a maximum 380 passengers. Its most distinguishing feature is the two turbofan engines mounted on underwing pylons and a...
program.
Dramatization
The story of the disaster was featured on the fifth season of Canadian National Geographic ChannelNational Geographic Channel
National Geographic Channel, also commercially abbreviated and trademarked as Nat Geo, is a subscription television channel that airs non-fiction television programs produced by the National Geographic Society. Like History and the Discovery Channel, the channel features documentaries with factual...
show Mayday
Mayday (TV series)
Mayday, also known as Air Crash Investigation in the United Kingdom, Australia and Asia and Air Emergency and Air Disasters in the United States, is a Canadian documentary television programme produced by Cineflix investigating air crashes, near-crashes and other disasters...
(known as Air Emergency in the US, Mayday in Ireland and Air Crash Investigation in the UK and the rest of world). The episode is entitled "Behind Closed Doors".
See also
- Flight with disabled controlsFlight with disabled controlsSeveral aviation incidents and accidents have occurred in which the control surfaces of the aircraft became disabled, often due to failure of hydraulic systems or the flight control system. Other incidents have occurred where controls were not functioning correctly prior to take-off, either due to...
- List of notable accidents and incidents on commercial aircraft
- List of notable decompression accidents and incidents
- Loss of control
- Turkish Airlines Flight 981Turkish Airlines Flight 981Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
- United Airlines Flight 811United Airlines Flight 811United Airlines Flight 811 experienced a cargo door failure in flight on Friday, February 24, 1989, after its stopover at Honolulu International Airport, Hawaii...
External links
American Airlines Flight 96 was a regular McDonnell Douglas
McDonnell Douglas
McDonnell Douglas was a major American aerospace manufacturer and defense contractor, producing a number of famous commercial and military aircraft. It formed from a merger of McDonnell Aircraft and Douglas Aircraft in 1967. McDonnell Douglas was based at Lambert-St. Louis International Airport...
DC-10-10 flight operated by American Airlines
American Airlines
American Airlines, Inc. is the world's fourth-largest airline in passenger miles transported and operating revenues. American Airlines is a subsidiary of the AMR Corporation and is headquartered in Fort Worth, Texas adjacent to its largest hub at Dallas/Fort Worth International Airport...
. The flight suffered a cargo door failure on 12 June 1972 while flying over Windsor, Ontario
Windsor, Ontario
Windsor is the southernmost city in Canada and is located in Southwestern Ontario at the western end of the heavily populated Quebec City – Windsor Corridor. It is within Essex County, Ontario, although administratively separated from the county government. Separated by the Detroit River, Windsor...
; it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which led to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The cable controls to the number two (tail) engine were severed, causing that engine to shut down. Fortunately, there was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator and the horizontal stabilizer. However, because the right elevator cable was partially restricted, both pilots had to apply back pressure on the yoke
Yoke (aircraft)
A yoke, alternatively known as control column, is a device used for piloting in most fixed-wing aircraft.- Principle :The aviator uses the yoke to control the attitude of the plane, usually in both pitch and roll. Rotating the control wheel controls the ailerons and the roll axis...
for the landing flare. Additionally, the approach and landing had to be made at high speed, to prevent the sink rate from becoming too high. The tendency to turn right was offset by using 45 degrees of left aileron, combined with asymmetrical thrust of the two wing engines. In spite of the partial restriction of the controls, the pilots were able to make a safe landing at Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport , usually called Detroit Metro Airport, Metro Airport locally, or simply DTW, is a major international airport covering in Romulus, Michigan, a suburb of Detroit. It is Michigan's busiest airport....
with no major injuries.
The cause was later traced to the door latching system, which had failed to close completely. A separate locking system was supposed to ensure this could not happen, but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system to avoid a repeat, but two years later Turkish Airlines Flight 981
Turkish Airlines Flight 981
Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
's rear cargo door failed for exactly the same reason, causing the aircraft to lose all control and crash outside Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
with a loss of 346 passengers and crew, the deadliest air disaster to that point.
Accident details
Flight 96 was a regularly scheduled flight from Los Angeles to LaGuardia AirportLaGuardia Airport
LaGuardia Airport is an airport located in the northern part of Queens County on Long Island in the City of New York. The airport is located on the waterfront of Flushing Bay and Bowery Bay, and borders the neighborhoods of Astoria, Jackson Heights and East Elmhurst. The airport was originally...
with stops in Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport
Detroit Metropolitan Wayne County Airport , usually called Detroit Metro Airport, Metro Airport locally, or simply DTW, is a major international airport covering in Romulus, Michigan, a suburb of Detroit. It is Michigan's busiest airport....
and Buffalo Niagara International Airport
Buffalo Niagara International Airport
Buffalo Niagara International Airport is an airport located in Cheektowaga CDP, Town of Cheektowaga, in Erie County, New York, USA. It is named after the Buffalo – Niagara Falls metropolitan area. The airport serves Buffalo, New York as well as Southern Ontario, Canada...
. On 12 June it was being flown by DC-10-10 N103AA. It left Los Angeles 46 minutes after its scheduled 1:30 pm departure due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At Detroit the majority of the passengers disembarked, and the plane took on new passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11 crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before capturing V-554 (a victor airway), then climb to flight level 210 (21,000 ft).
At 7:25 pm while climbing through 11,750 ft, the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. Captain Bryce McCormick reported that he momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-left position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft, and attempted to re-apply power, finding that engines 1 and 3 would respond normally, but engine 2, in the tail, would not allow its controls to be moved. McCormick was able to level off and stabilize the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.
In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cabin, the attendants instructed the passengers on emergency landing procedures. A number of passengers later reported that the aircraft safety cards proved useful in locating the nearest exit.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for landing, the aircraft stabilized in a 1,900 ft/min descent that was far too fast for landing. By applying power to the 1 and 3 engines, McCormick was able to level off the nose and reduce the descent to 700 ft/min. The aircraft touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the right and eventually leaving the runway surface. The first officer, Peter Whitney, applied full reverse thrust to the left engine and idled the right, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped 880 ft from the runway threshold, with the nose and left gear on the runway and the right on the grass beside it. It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. A similar technique was used in 1989 following a complete loss of hydraulic pressure on another DC-10, United Airlines Flight 232
United Airlines Flight 232
United Airlines Flight 232 was a scheduled flight from Stapleton International Airport in Denver, Colorado, to O'Hare International Airport in Chicago, with continuing service to Philadelphia International Airport...
.
Investigation
The problem that caused the accident was immediately obvious, as the cargo door was missing and had caused damage to the left horizontal stabilizer as it flew off. Investigators immediately studied the maintenance history and found that on 3 March 1972 the handlers reported that the door had not latched electrically and had to be closed manually. On 30 May McDonnell Douglas issued Service Bulletin 52-27, DC-10 SC 612, which called for the upgrading of the electrical wiring that drove the latches because "Three operators have reported failure of the electrical latch actuators to latch/unlatch the cargo doors. Latch actuator failure is attributed to an excessive voltage drop reducing the output torque to the actuator. This condition may prevent electrical latching/unlatching of the hooks." The modification was not compulsory, however, and had not been carried out on N103AA.Investigators interviewed the ground crew at Detroit and learned that the cargo loader operating the rear door found it difficult to close. He stated that he closed the door electrically, and waited for the sound of the actuator motors to stop. When they did, he attempted to operate the locking handle, but found it very difficult to close. Adding force with his knee he was able to get the latch to lock, but noticed that the vent plug (see below) was not entirely closed. He brought this to the attention of a mechanic, who cleared the flight. The flight engineer reported that the "door ajar" warning light on his panel was not lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely intact, demonstrated that the latches had not rotated to their locked position. In their locked position, pressure on the door presses the latches further shut, and no force is transmitted into the actuator system that closes and opens them. With the latches only partially closed, forces on the door were transmitted back into the actuator, eventually overwhelming it at about 6,600 lbf. The rapid depressurization when the door broke off caused the floor above it to fail, which pulled the rudder cable to its extension limit and severed several other operating cables.
Cause
Passenger doors on the DC-10 are of the plug varietyPlug door
A plug door is a door designed to seal itself by taking advantage of pressure difference on its two sides and is typically used on pressurised aircraft...
, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by "over top dead center latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the aircraft fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and actually further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was possible for the voltage delivered to the motor to be too small to drive it under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.
To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.
In theory, the motor failure on Flight 96 could not present a problem because the locking lever would not be able to close. However, during the investigation a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, turning the warning light off. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators had a single common point of failure, the mechanical weakness of the locking system that allowed the handle to be moved.
The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. However, because the control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor would cut controls to the tail section.
Aftermath
The NTSB suggested several changes to the system to ensure that the Windsor accident would not recur. These included changes to the locking mechanism to ensure it could not be forced closed, as well as venting cut into the rear cabin floor.In response, the FAA, in charge of actually implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system, and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this should prevent a repeat of the accident.
Shortly after the event, Dan Applegate
Dan Applegate
F. D. "Dan" Applegate was Director of Product Engineering for Convair, a McDonnell Douglas subcontractor during the early 1970s. He rose from relative obscurity to become the subject of a classic case in engineering ethics when he penned what became known as the "Applegate Memorandum".On June 12,...
, Director of Product Engineering at Convair
Convair
Convair was an American aircraft manufacturing company which later expanded into rockets and spacecraft. The company was formed in 1943 by the merger of Vultee Aircraft and Consolidated Aircraft, and went on to produce a number of pioneering aircraft, such as the Convair B-36 bomber, and the F-102...
, wrote a memo to Convair
Convair
Convair was an American aircraft manufacturing company which later expanded into rockets and spacecraft. The company was formed in 1943 by the merger of Vultee Aircraft and Consolidated Aircraft, and went on to produce a number of pioneering aircraft, such as the Convair B-36 bomber, and the F-102...
management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future.
In spite of these recommendations, two years later Turkish Airlines Flight 981
Turkish Airlines Flight 981
Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
suffered an almost identical failure, but lost all control of the tail surfaces. The plane crashed outside Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
, killing all 346 passengers and crew onboard. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed it had. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language, and had been instructed that as long as the locking handle closed the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.
In the aftermath of that accident, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas
McDonnell Douglas
McDonnell Douglas was a major American aerospace manufacturer and defense contractor, producing a number of famous commercial and military aircraft. It formed from a merger of McDonnell Aircraft and Douglas Aircraft in 1967. McDonnell Douglas was based at Lambert-St. Louis International Airport...
, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, the Turkish Airlines disaster would have been avoided.
A complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again.
N103AA's airframe was broken up at Phoenix Goodyear Airport
Phoenix Goodyear Airport
Phoenix Goodyear Airport , formerly known as Goodyear Municipal Airport, is a public airport located one mile southwest of the central business district of Goodyear, in Maricopa County, Arizona, United States....
in 2002, after being assigned to the FedEx
FedEx
FedEx Corporation , originally known as FDX Corporation, is a logistics services company, based in the United States with headquarters in Memphis, Tennessee...
MD-10
McDonnell Douglas DC-10
The McDonnell Douglas DC-10 is a three-engine widebody jet airliner manufactured by McDonnell Douglas. The DC-10 has range for medium- to long-haul flights, capable of carrying a maximum 380 passengers. Its most distinguishing feature is the two turbofan engines mounted on underwing pylons and a...
program.
Dramatization
The story of the disaster was featured on the fifth season of Canadian National Geographic ChannelNational Geographic Channel
National Geographic Channel, also commercially abbreviated and trademarked as Nat Geo, is a subscription television channel that airs non-fiction television programs produced by the National Geographic Society. Like History and the Discovery Channel, the channel features documentaries with factual...
show Mayday
Mayday (TV series)
Mayday, also known as Air Crash Investigation in the United Kingdom, Australia and Asia and Air Emergency and Air Disasters in the United States, is a Canadian documentary television programme produced by Cineflix investigating air crashes, near-crashes and other disasters...
(known as Air Emergency in the US, Mayday in Ireland and Air Crash Investigation in the UK and the rest of world). The episode is entitled "Behind Closed Doors".
See also
- Flight with disabled controlsFlight with disabled controlsSeveral aviation incidents and accidents have occurred in which the control surfaces of the aircraft became disabled, often due to failure of hydraulic systems or the flight control system. Other incidents have occurred where controls were not functioning correctly prior to take-off, either due to...
- List of notable accidents and incidents on commercial aircraft
- List of notable decompression accidents and incidents
- Loss of control
- Turkish Airlines Flight 981Turkish Airlines Flight 981Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed in Fontaine-Chaalis, Oise, France, outside Senlis, on 3 March 1974...
- United Airlines Flight 811United Airlines Flight 811United Airlines Flight 811 experienced a cargo door failure in flight on Friday, February 24, 1989, after its stopover at Honolulu International Airport, Hawaii...
External links