Designed for Disaster: The DC-10 Airliner, Part 1

The Cargo Door Fiasco - American Airlines Flight 96: Prelude to a Catastrophe.

Of all the airliners certificated over the years by the Federal Aviation Administration and its predecessors, the DC-10 stands out. None of the certification rules existing at the time were broken but that’s more an indictment of the way the rules were written then a pat on the airframe manufacturers back.

Within the fabric of that macro, there were several micro areas of the DC-10’s design that were sufficiently deficient to result in “loss of the hull” — an aerospace industry euphemism for a crash.

But it was the design shortcomings of the cargo door that was most troubling because clear warnings showed up both in testing and during a nearly fatal incident over Windsor, Ontario.

To make matters worse, the Federal Aviation Administration failed to act after the Ontario incident - apparently due to a conversation between the airframe manufacturer’s president and the Administrator of the FAA.

Finally, like a Greek tragedy, the DC-10 story also had a hero: an engineer who tried to do the right thing.

Airliner Doors

Doors in the passenger compartments of virtually all the worlds’ jet airliners are of the plug variety. Through various pivoting schemes, they can sometimes swing outside the airplane when open, but when closed they’re pressed against the fuselage from the inside which means they cannot open in flight.

In contrast, many cargo doors are placed on the outside of the fuselage, closing against a sealing flange by use of various leveraging approaches. A cargo door hung inside the fuselage would need substantial maneuvering room, which would eat up valuable storage space, so a cargo bay plug door is generally a non-starter because lost cargo space means lost revenue to an airline.

The engineering challenge therefore is to make the cargo door’s mechanism robust enough to remain closed once it’s stowed in spite of a substantial pressure delta since most airliners maintain an apparent 8,000 foot cabin and cargo bay environment even at 35,000 feet.

Such a requirement means the door design must include fool proof latching and all design guidance for cargo doors says that the latching must be positive and include fail safe features to prevent opening due to the pressure differential. The initial DC-10 cargo door specification followed this convention but unfortunately, subsequent events compromised the intent.

The DC-10 Cargo Door

Convair division of General Dynamics, a respected aerospace company, was selected in a competitive bid process to become the DC-10’s sub-contractor for the fuselage. Convair’s forte was structures and its reputation was excellent.

The initial cargo door specification called for hydraulic pressure to be used to pivot the door and to position numerous clasps that would engage in a positive manner.  The system was similar to the time tested method used on the DC-8 and DC-9 airliners.

However, in response to a request from American Airlines, McDonnell-Douglas changed the hydraulic actuation design to an electrical system with a manual backup in order to save 28 pounds of weight.  The new system’s design was unproven and less reliable due to undersized wiring being used for the electric motor that replaced the hydraulic actuators plus it had a very complex locking mechanism.

If the electrical system failed, the alternative closure method involved manually cranking the door shut followed by a manual locking procedure. And if the mechanism’s parts didn’t line up, they could be forced and the door would close.

Unfortunately, the door didn’t always lock.

The Warning

In July of 1970, before the airplane was certified, a test airframe was pressure tested as part of the pre-certification procedures. The airframe was not powered so the electrically operated portion of the cargo door was unusable.

The test crew manually cranked the door closed but failed to fully engage the locking pins. They also failed to notice that the external latch position indicator showed that the latches were not fully engaged. What happened next was a dress rehearsal for future events.

When the pressure delta reached 3 psi, the cargo door blew open resulting in a failure of the cabin floor above the cargo area. The collapsing floor destroyed all the control systems for the horizontal and vertical tail flight surfaces as well as the controls for the tail mounted engine. This secondary failure mode was possible because of a decision to run the controls down the center of the cabin floor.

In addition to the control routing and door design problems, the incident pointed to another design problem: Although vents had been provided in the cabin floor in all other areas of the airplane (to quickly equalize pressures between the passenger compartment and the cargo bay in the event of an explosive decompression), no such vents were cut in the floor in the vicinity of the rear cargo door.

Without the vents, the only option for the floor in that area was to collapse due to the pressure differential when the cargo bay door blew open. If the failure had happened in flight, the aircraft would have been rendered uncontrollable. The test episode door blow out and floor collapse was warning number one.

American Airlines Flight 96

On June 12^th, 1972, after lifting off from Detroit, the crew of American Airlines Flight 96 heard a thud while climbing through 11,750 feet over Windsor, Ontario. When the noise occurred, the rudder pedals moved to a full-left rudder position and the engine controls moved to idle. Unknown to the crew, the aft cargo door had just departed the aircraft.

The captain immediately tried to re-apply power but found that while engines 1 and 3 would respond, tail mounted engine number 2 wouldn’t allow its controls to be moved. With the rudder jammed in the full left position, the captain had to hold right aileron to maintain level flight but was able to level off and stabilize the speed at 250 knots. He found that the flight controls were very sluggish.

In the cabin, the flight attendants recognized they had a depressurization episode on their hands from the fog in the air. Two of the cabin crew were in the rear galley area and the floor under their feet partially collapsed into the cargo hold resulting in minor injuries.

The collapsing floor had partially severed the flight controls to the tail surfaces and had disabled the controls for the tail mounted engines. It was the same thing that had happened to the test article two years earlier but this time the aircraft was airborne.

Somehow, the floor collapse had not been total so not all the controls for the rear flight surfaces have been cut or jammed. The flight crew was able to return to Detroit for a safe landing using what flight controls they still had plus differential power from the two wing mounted engines. It was an extremely close call.

Investigators determined that the baggage loader operating the cargo door had found it difficult to close. He told them he had closed the door electrically and waited for the sound of the actuator motor to stop. When he no longer heard the motor noise, he assumed the door was closed and tried to operate the locking handle but found it very difficult to close.

Adding force with his knee had moved the handle into the stowed position. He consulted a mechanic who agreed the door was closed and latched. There was no door closure warning light in the cockpit.

Examination of the cargo door, which was found in one piece, and mostly intact, showed that the latches had in fact not locked although they were sufficiently close to the engaged position to have caused the door warning switch to open its contacts which extinguished the cockpit warning lamp.

With the latches only partially closed, the pressure forces on the door were transmitted back into the actuator, eventually overwhelming it. Since the door was not fully locked, the actuator had not gone to an over-center position and the pressure forces had overcome the mechanical resistance present in the closure mechanism.

The rapid depressurization when the door broke free caused the un-vented floor above it to fail, which pulled the rudder cable to its extension limit and severed the cables controlling the number 2 engine. The event was warning number two.

The FAA

Arvin Basnight was a career employee of the Federal Aviation Administration and in charge of the FAA’s Western Region. As such, he was responsible for oversight of McDonnell-Douglas and several other aircraft manufacturers located in the western United States.

Upon hearing of the near disaster over Windsor, and knowing the history of the test airframe episode, Basnight had his inspectors set about creating an Airworthiness Directive to correct the wiring deficiency in the cargo door motor as well as the closure and latching problems associated with the door itself.

The AD may have also included instructions to correct the control routing issue and the vent problem with the passenger floor but we’ll never know for certain because Basnight received a call from Jason McGowen, president of the Douglas Division of McDonnell-Douglas, advising that he (McGowen) had spoken with Jack Shaffer, FAA Administrator and Basnight’s boss.

McGowen explained to Basnight that he and the Administrator had reviewed the plans Douglas engineers had developed to address the cargo door problems and the Administrator thought there was no need for a far ranging Airworthiness Directive beyond the change to the motor wiring that was already in the works.

With no AD on the most serious problems, the stage was set for a disaster. But there was one last chance to avoid a loss of life in the person of Dan Applegate, Director of Product Engineering, Convair division of General Dynamics.

Next Monday we’ll look at his actions and the events that led to the crash of Turkish Airlines flight 981 and loss of 346 lives.

John Loughmiller is an Electrical Engineer, Commercial Pilot, Flight Instructor and a Lead Safety Team Representative for the FAA.

He can be reached at [email protected].

(All imagery in this article was obtained either from US Government accident reports or from Wikimedia Commons media library and are public domain.)