Understanding Air Safety in the Jet Age/Disaster Foreshadowed - American Airlines Flight 96

The cargo door after being ripped off|thumb|right On 12 June 1972 Captain Bryce McCormick (age 52), First Officer Peter "Page" Whitney (34), and Flight Engineer Clayton Burke (50) were in the cockpit of American Airlines Flight 96. McCormick was a highly experienced pilot, having amassed more than 24,000 flight hours throughout his flying career. Whitney and Burke were also seasoned airmen with approximately 7,900 flight hours and 13,900 flight hours, respectively. Flight 96 was supposed to be just an ordinary domestic flight operated from Los Angeles to New York, one of hundreds of similar flights that take off every day in the United States. On 12 June it became anything but ordinary. The flight left Los Angeles 46 minutes after its scheduled 13:30 departure due to passenger loading and traffic, and arrived in Detroit at 18:36. In Detroit, the majority of the passengers disembarked, and the aircraft took on new passengers and cargo. Leaving Detroit, the aircraft had 56 passengers and 11 crew. At 19:25, while climbing through 11,750 ft the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. The "thud" was the sound of the rearmost cargo door breaking off, causing a sudden decompression that also caused part of the floor at the rear of the cabin to partially give way. Captain McCormick momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-right position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft and attempted to re-apply power, finding that both wing mounted engines were responsive but engine number 2, in the tail, would not allow its controls to be moved, as control cables had been severed when the floor gave way. Despite the engine failure, and the jammed rudder, McCormick managed to level off and stabilise the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit. In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurisation. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cockpit, the attendants instructed the passengers on emergency landing procedures. The aircraft returned to Detroit, but, when the crew set the flaps for landing, the aircraft stabilised in a 1,900 ft/min descent rate that was far too fast for landing. By applying power to the two working engines, McCormick managed to level off the nose and reduce the descent rate to a much better 700 ft/min. At 19:44 the aircraft touched down immediately veering to the right and eventually leaving the runway surface. First Officer Whitney applied full reverse thrust to the left engine and idled the right one, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped less than 1,000 ft from the end of the runway, with the nose and left gear on the runway and the right on the grass beside it. By great skill and a fair amount of luck a disaster had been averted - McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure. So what had caused the door to blow out? Bad design and bad engineering. Passenger doors on the DC-10 are of the plug variety, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area. To prevent this, the DC-10 used a supposedly "fail-safe" latching system held in place by "over top dead centre latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor. Because the wiring powering the actuator motor was too small, it was possible for the voltage delivered to the motor to drop too low for it to operate as designed under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched. To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place, they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched. In theory, motor failure on the plane could not present a problem because it would fail to close the locking lever. During the investigation, however, a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, deactivating the cockpit warning light. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators shared a single point of failure: the mechanical weakness of the locking system that allowed the handle to be moved. The cabin floor failure was also a matter of poor design. All other areas of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. Because control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor could cut control to the tail section. The National Transportation Safety Board suggested two changes to the DC-10 to ensure that a similar accident couldn't happen again: changes to the locking mechanism to ensure it could not be forced closed, as well as vents in the rear cabin floor. However, in an example of regulators being too close to the industry they regulate, the Federal Aviation Administration, in charge of implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this was expected to prevent a repeat of the accident. Added to this, shortly after the event, Dan Applegate, Director of Product Engineering at Convair, wrote a memo to Convair management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future. If only someone had listened... In spite of these recommendations, on 3 March 1974, less than two years after the near-loss of Flight 96, Turkish Airlines Flight 981 crashed outside Paris, killing all 346 passengers and crew on board in an identical rear cargo door failure. Unlike Flight 96, where the crew still managed to keep enough flight controls to safely return to Detroit, the pilots of Flight 981 completely lost control of the tail surfaces and all hydraulics. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed they had been. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language and had been instructed that as long as the locking handle closed, the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight. In the aftermath of Flight 981, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, it is likely that the crash of Flight 981 would have been prevented. Too late for 346 innocent victims of a failed system - a complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again but it was all far, far too late.