Summary - Applying lessons learned from accidents

An excellent report from an article entitled Applying lessons learned from accidents. Complete report in English, excerpts in French
...............................................................................................................................................................

Le 3 mars 1974, Turk Hava, vol TK981, immatriculé TC-JAV. C’est un McDonnell Douglas DC-10, il décolle de l'aéroport d'Orly à Paris, en France à destination de Londres, Heathrow. Le temps était idéal. Il est 12:30. L'avion a été autorisé à décoller et à monter au niveau de vol 230.

Environ 10 minutes après le décollage, le vol TK981 a été vu, sur les écrans radars, se scinder en deux, une partie du fuselage se détache avant de disparaître des radars. La deuxième partie tourneà gauche sur un cap de 280 degrés. Le contrôleur aérien venait clairement d’observer la séparation de la porte cargo, qui s’est produite à une altitude de 11.000 pieds au-dessus du village de Saint-Pathus. L’incident s’est produit au moment où la pression de la cabine aurait dû être à peu près égale à celle du niveau de la mer. Soixante-dix-sept secondes plus tard, l'avion s'est écrasé dans la forêt, au nord est de Paris.

Lorsque les sauveteurs sont arrivés sur les lieux, seuls quelques petits morceaux de l'avion étaient restés intacts sur une zone 2.300 pieds de long et 300 pieds de large. Tous les 346 passagers à bord de l'avion ont été tués, dont 12 membres d'équipage. Les enquêteurs ont réussi à localiser à la fois enregistreur de données de vol et l'enregistreur phonique, ce qui a témoigné des derniers moments du vol TK981.

Alors que l'avion était à 9000 pieds et volait à à 300 noeuds, il y eût une explosion sourde et un bruit d’air important, ce qui indique une brusque décompression. Dans le même temps, la manette des gaz du moteur n°2 fût fermée et le moteur a commencé à décélérer. Le commandant de bord a demandé au copilote ce qui se passait. Il a répondu, «Le fuselage est ouvert!" L'avion a commencé à descendre en virant sur la gauche. Le commandant de bord a tiré sur le manche et remis de la puissance. Il dît au copilote de relever le nez de l’appareil. «Je ne peux pas le remettre en place, il ne répond pas!" A ce moment précis, l'avion était incliné à 20 degrés, en piqué, et continuait d'accélérer.

À 32 secondes après l'explosion, l'avertisseur sonore de survitesse sonne. Quarante-cinq secondes plus tard, l'appareil a percuté le sol à 430 noeuds. Comme il n'y avait pas d’antécédents, et que les débris étaient en très petits morceaux, les enquêteurs ont d'abord cru à un accident causé par une bombe. Cependant, peu de temps après l'accident, un fermier s’est manifesté indiquant que six corps étaient tombés dans son champs à quelque 8 milles du lieu du crash. Des morceaux du fuselage ont également été trouvés dans la zone.

Les corps retrouvés étaient encore sanglés dans leurs sièges en deux rangées de trois. L'examen de l'épave et des corps n'a révélé aucun indice de bombe. En fait, l'examen anatomopathologique a montré que les corps étaient en bonne condition physique et que la mort fût liée à l'impact avec le sol. Une analyse plus poussée de l'épave a révélé que l'un des morceaux était la porte cargo arrière.

Les enquêteurs ont découvert que la plaque d'appui, qui doit empêcher la fermeture forcée de la poignée de verrouillage de la porte de soute et la dépressurisation lorsque la porte n'est pas complètement verrouillée ou déverrouillé, n'a pas été installée sur cette porte.

L’enquête de l'accident a révélé que, avant le décollage, la porte cargo n'a pas été correctement verrouillée à clé et que le voyant d'alarme de la porte cargo arrière s'est éteint prématurément en raison d’une défaillance électrique.

L'examen du vérin a révélé une insuffisance du loquet d’extension de la tige de vérin (277.5mm contre 297 mm pour l'extension complète). Voir Figure 9. Cela s'est traduit par une rotation du couple tube insuffisante pour déplacer le crochet de verrouillage.

En outre, les goupilles de verrouillage a été bien tournées. Les quatre broches de verrouillage sur le cadenas du tube étaient de 1,6 mm trop courts. Avec les serrure crochets non positionnées "sur le centre" et les goupilles de verrouillage non engagées, les charges appliquées à la serrure et aux crochets ont été transmis par l'intermédiaire du mécanisme de verrouillage de la serrure Vérin sur deux boulons de fixation. Lorsque les deux boulons de fixation ont sautés, le vérin de verrouillage a permis aux crochets de verrouillage de glisser, aboutissant à l'ouverture soudaine de la porte cargo.

La brusque ouverture de la porte cargo arrière a entraîné une rapide perte de pressurisation dans ce compartiment. Le plancher de la cabine n'était pas équipé pour résister à une telle décompression. La perte de la porte a causée le renvoi de la différence de pression entre la pression cabine et l'atmosphère sur le plancher de la cabine.

La cabine s'est effondrée vers le bas dans la soute à bagages, expulsant deux rangées de sièges avec des passagers.

L'effondrement de la cabine a entraîné la perte de l'utilisation des surfaces de contrôle de l'empennage. Les câbles qui vont du cockpit à l'empennage passaient par la soute. Avec la rupture des câbles de contrôle, il a été impossible de contrôler pour le redresser.

Des essais sur une porte de même type que celle de TC-JAV a révélée que la porte pouvait être fermée sans exercer une force excessive. La personne qui a fermé la porte cargo arrière a indiqué avoir procédé « comme d'habitude, sans difficultés particulières », et qu'il n'avait remarqué aucune anomalie.

Vingt et un mois avant l'accident Turk Hava, un DC-10 d’American Airlines a été victime d'une incident similaire de décompression due à l'ouverture de la porte cargo arrière, près de Windsor, en Ontario, au Canada. En raison de la similitude de ces deux accidents, on fpît le rapprochement avec la catastrophe du 3 mars 1974. Voir le DC-10 d’American Airlines, Windsor, Résumé de l'accident.

Le Secrétariat d'Etat français aux Transports, Commission des Enquêtes et Conclusions:

La porte cargo arrière sur le côté gauche:

1. Bulletin de service 52-37, qui préconise l'installation d'une plaque de support conçue pour empêcher la fermeture forcée de la poignée et le verrouillage des portes d'évacuation en cas d'engagement incomplète du mécanisme de verrouillage, elle n'avait pas été appliquée sur l'avion à la livraison et cela n’a pas été relevé au moment de la livraison. Il a été constaté, cependant, que les travaux sur l'application de cette modification avait commencé mais non terminé.

2. Alors que l'avion était en service, la modification (accès direct au mécanisme d'entraînement) a été réalisée d'une manière telle qu’il n'était pas conforme au bulletin de service 52-38.

3. Les ajustements des goupilles de verrouillage et de l'interrupteur de verrouillage étaient incorrectes.

4. L'amorce de déverrouillage (interrupteur a deux cales) , surmontée d'une cale sans référence n’était pas dans les normes aéronautiques.

Lors de l'escale à Orly, la porte cargo arrière sur le côté gauche a été fermée sans aucune anomalie apparente, mais les goupilles de verrouillage n’ont pas été engagées et contrôle visuel n’avait été fait par l'intermédiaire du hublot prévu à cet effet

Le décollage et la montée se passent sans incident jusqu'à ce que l'avion atteigne 12.000 pieds à environ 11-40 heures. À ce moment, la porte cargo arrière sur le côté gauche s’ouvre en vol et se sépare de la structure de l'avion.

La baisse de pression dans la soute a causé immédiatement une différence de pression qui était suffisante pour causer une perturbation de la structure du plancher et l'éjection de six passagers, des sièges de cabine et divers morceaux du fuselage.

La déformation et la rupture du plancher a conduit à de graves altérations des commandes du moteur numéro 2 et des commandes de vol. Les câbles de commande courraient sous ce plancher et les dommages étaient tels qu'il était impossible pour l'équipage de reprendre le contrôle de l'appareil. L’équipage avait néanmoins considérablement l’assiette de l’avion avant le crash.

En raison de la conception du mécanisme dans son ensemble, l'application incomplète de la modification SB 52-37 (absence de la plaque de support spécifié), il était possible d’opérer le verrouillage des portes sans avoir à utiliser une force excessive et sans que les alarmes ne le détecte. Les essais et les recherches ont confirmé l'engagement incomplet des serrures de la porte cargo.

L'enquête l’accident à Windsor (Ontario) le 12 juin 1972 a fournie des preuves de la gravité des risques encourus par une brusque dépressurisation de la soute à bagages: dépressurisation, effondrement du plancher avec pour conséquence la rupture des câbles de commande.

La Commission d'enquête a déterminée que l'accident était le résultat de l'éjection en vol de la porte cargo arrière sur le côté gauche. La soudaine dépressurisation qui a suivi a conduit à la défaillance de la structure du plancher, provoquant l’expulsion de six passagers avec des éléments du fuselage. La conséquence fût une panne du moteur n°2 et l’altération des commandes de vol (empennage) de sorte qu'il était impossible pour l'équipage de maîtriser l'aéronef. Le facteur sous-jacent dans la chronologie des événements ayant mené à l'accident était le mauvais enclenchement du mécanisme de verrouillage des portes avant le décollage. Les caractéristiques de la conception du mécanisme a permis à la porte d’être fermée alors qu’en fait, les serrures n'étaient pas entièrement fermées et les goupilles de verrouillage n'étaient pas en place. Il convient de noter, toutefois, qu’il était prévu dans le protocole un contrôle visuel qui ne fût pas effectué.

..............................................................................................................................................................

Warning this door may spring open - On the placard giving instructions how to close the cargo door.

On March 3, 1974, Turk Hava, Flight TK981, registration TC-JAV, a McDonnell Douglas DC-10-10, departed Orly Airport in Paris, France for London's Heathrow Airport. The weather was ideal for the 12:30 P.M. departure and the airplane was cleared for ascent to flight level 230.

Approximately 10 minutes after takeoff, Flight TK981's radar label was seen to split into two, with one part remaining stationary before disappearing from the radarscope. The second part turned left on to a heading of 280 degrees. What the air traffic controller had observed was the separation of the cargo door, which occurred at a height of 11,000 feet over the village of Saint-Pathus – at a point when the cabin pressure should have been roughly equal that of sea level. Seventy-seven seconds later, the airplane crashed in the forest north by north east of Paris.

When rescuers reached the scene, only bits of the aircraft remained intact in an area 2,300 feet long and 300 feet wide. All 346 passengers aboard the aircraft were killed, including 12 crewmembers. Investigators were able to locate both the flight data recorder and the cockpit voice recorder, which revealed many insights about the final moments of Flight TK981.

Just as the aircraft was passing through 9,000 feet at 300 knots, there was a muffled explosion and the sound of air rushing, which indicated a sudden decompression. At the same time, the No. 2 throttle lever closed and the engine began to spool down. The captain asked the copilot, who was flying the airplane, what had happened. He replied, "The fuselage has burst!" The aircraft began to descend while banking to the left. The captain pulled the other throttles back and told the copilot to bring the nose up. To that he responded, "I can't bring it up, she's not responding!" By this time, the aircraft was in a 20-degree nose down attitude and was continuing to accelerate.

At 32 seconds after the explosion, the aircraft's overspeed warning horn sounded. Forty-five seconds later the aircraft struck the ground at 430 knots. Because there were no prior indications of a problem and the debris was in small pieces, investigators first believed the accident to have been caused by a bomb. However, shortly after the accident, a farmer called claiming that six bodies had fallen into his fields some 8 miles from the crash sites. Bits of the fuselage were also found in the area.

The bodies recovered were still strapped into their seats in two rows of three. Examination of the bodies and associated wreckage revealed no evidence of any bomb residue. In fact, pathological examination showed that the bodies were in good physical condition and death was entirely a result of impact with the ground. Further analysis of the associated wreckage revealed that one of the pieces was the rear cargo door.

Investigators found that a support plate, which prevents forced closing of the locking handle and the vent door when the door is not fully latched and locked, was not installed on this door. Douglas records reflected that the support plate was installed.

Investigation of the accident revealed that prior to take-off, the cargo door was not properly latched and locked and the flight deck aft cargo door warning light went out prematurely because of a maladjusted warning switch.

Examination of the latch actuator revealed insufficient extension of the actuator shaft (277.5mm versus 297mm for full extension). See Figure 9. This resulted in the torque tube not rotating far enough to move the latch hooks into the "over-center" position.

Additionally, the lock pins were not properly rigged to engage had the torque tube been properly rotated. The four lock pins on the lock tube were 1.6 mm short of the rear face of the restraining flanges. With the latch hooks not "over center" and the lock pins not engaged, the loads applied to the latch hooks from fuselage internal pressure were transmitted through the latching mechanism to the latch actuator support bracket, failing the two attachment bolts. When the two attachment bolts failed, the detached latch actuator enabled the latch hooks to slip off the latch spools, resulting in the sudden opening of the cargo door.

The sudden opening of the aft cargo door resulted in a rapid loss of pressurization in that compartment. The cabin floor was not equipped with pressure relief vents. Thus, the loss of the door caused the full differential pressure between the pressurized passenger cabin and the atmosphere to be exerted on the cabin floor over the compartment.

This loading failed the floor support structure and the cabin floor collapsed downward into the cargo compartment, sucking two rows of seats with passengers still strapped in them out of the opening.

The collapse of the floor resulted in the loss of use of the empennage control surfaces. The control cables from the cockpit to the empennage control actuators were routed through the cabin floor beams over this cargo compartment. The severed control cables made it impossible to control the aircraft pitch attitude.

Tests on a door with the same definition as that of TC-JAV revealed that because of the incorrect adjustment of the lock tube and the bent link between the locking handle and the vent door shaft, the vent door could be closed without excessive force. The person that closed the aft cargo door stated that he proceeded as usual, without any particular difficulties, and that he did not notice any abnormality.

Twenty one months prior to this Turk Hava accident an American Airlines DC-10 suffered a similar explosive decompression due to the opening of the aft cargo door near Windsor, Ontario, Canada. Because of the similarity of both of these accidents, the student should have knowledge of the American Airlines accident before proceeding with this lesson. See the American Airlines DC-10, Windsor Accident Summary.

The French Secretariat of State for Transport, Commission of Inquire findings were:

Regarding the aft cargo door on the left hand side:

1. Service Bulletin 52-37, specifying the installation of a support plate designed to prevent forced closing of the locking handle and the vent door in the case of incomplete engagement of the latching system, had not been applied to the aircraft before delivery and this oversight had not been detected at the time of delivery. It was found, however, that work on the application of this modification had begun on the lock tube where chamfering had been roughly carried out.

2. While the aircraft was in service, a modification (direct access to the drive mechanism) had been carried out in a way which did not comply with Service Bulletin 52-38.

3. The adjustments of the lock pins and the lock limit warning switch were incorrect.

4. The striker of the unlock limit switch had two shims of Douglas origin, surmounted by a shim with no reference and of a quality not to aeronautical standards.

During the aircraft's stop at Orly, the aft cargo door on the left-hand side had been closed without any apparent abnormality, the locking handle had been pulled down and the vent door closed, although the lock pins were not engaged and no visual inspection had been made through the view port provided for the purpose of verifying that the lock pins were in place.

The take-off and climb progressed without incident until the aircraft reached approximately 12,000 feet at about 1140 hrs. At that time, the aft cargo door on the left-hand side opened in flight and became detached from the aircraft structure.

The drop in pressure in the cargo compartment caused an immediate pressure differential which was sufficient to cause the disruption of the floor structure and the consequent ejection of six passengers, their cabin seats and various pieces of wreckage.

The deformation and disruption of the floor led to serious impairment of the controls of No. 2 engine and of the flight controls of which the cables run under this part of the aircraft structure and the damage was such that it was impossible for the crew to regain control of the aircraft.

Because of the design of the mechanism as a whole, the incomplete application of modification SB 52-37 (absence of support plate specified) and the adjustments found on measurement to be incorrect (lock pins and striker), it was possible for the door locking handle to be pulled down without the use of any abnormal force and for the flight deck visual warning light to be switched off, when the latches were not fully engaged and the lock pins not in place. The tests and research have confirmed incomplete engagement of the cargo door latches and in correlation the non-engagement of the lock pins.

The inquiry into an accident at Windsor (Ontario) on 12 June 1972 had provided evidence of the grave risks entailed by sudden depressurization of the cargo compartment: the inadequacy of the pressure relief vents had resulted in the disruption of the floor under which the flight control cables run, thereby causing the jamming or rupture of the cables.

The Commission of Inquire determined that the accident was the result of the ejection in flight of the aft cargo door on the left-hand side. The sudden depressurization which followed led to the disruption of the floor structure, causing six passengers and parts of the aircraft to be ejected, rendering No. 2 engine inoperative and impairing the flight controls (tail surfaces) so that it was impossible for the crew to regain control of the aircraft. The underlying factor in the sequence of events leading to the accident was the incorrect engagement of the door latching mechanism before take-off. The characteristics of the design of the mechanism made it possible for the vent door to be apparently closed and the cargo door apparently locked when in fact the latches were not fully closed and the lock pins were not in place. It should be noted, however, that a view port was provided so that there could be a visual check of the engagement of the lock pins.

The defective closing of the cargo door resulted from a combination of various factors:

1. Incomplete application of Service Bulletin 52-37.

2. Incorrect modification and adjustments which led, in particular, to insufficient protrusion of the lock pins and to the switching off of the flight deck visual warning light before the door was locked.

The French Secretariat of State for Transport, Commission of Inquire Aircraft Accident Report LTS/2201/75/FRENCH/JHB, dated February 1976 is different from the NTSB Accident Reports in that the report did not have a Recommendation Section.

Unsafe Conditions The following unsafe conditions contributed to this incident:

1. Closure of the vent door when the door was not fully latched and locked (an open vent door would have prevented the airplane from being pressurized to an unsafe level).

2. Cabin floor/flight control arrangement was vulnerable to rapid fuselage compartment venting (i.e., floor collapse).

3. Structural integrity of door closure linkage was inadequate (i.e., door closure personnel stronger than expected).

4. Unreliable cargo door warning light system. Design and Safety Assumptions The following design and safety assumptions proved to be flawed in this incident:

5. Cargo door would be properly closed, latched, and locked prior to flight.

6. Door warning system would indicate if cargo door was not closed, latched, and locked.

7. The external lock handle cannot be stowed and the vent door will remain open when the cargo door is not closed, latched, and locked.

8.. The stowed external lock handle and the closed vent door is a visual indication that the door is locked.

9. If the cargo door is not closed, latched, and locked the opened vent door would prevent pressurization of the airplane.

Personnel closing and locking the cargo door would follow placarded instructions.

placard

The cargo door would be primarily operated using the normal electrically controlled opening, closing and latching system, and that manual operation of the door would be infrequent.

Precursors American Airlines DC-10 flight from Detroit, Michigan suffered a similar explosive decompression as the airplane climbed through 12,000 feet near Windsor-Locks, Ontario, Canada, on June 12, 1972. The crew was able to get the aircraft on the ground safely using differential engine thrust and none of the 67 persons on board were injured. There were a lot of similarities between this incident and Turk Hava accident.

Similarities Between the American Airlines and Turk Hava Accidents:

The latches were not fully closed and the latch lockpins were not in place.

The flight deck warning light had gone out before effective locking had occurred.

The altitude reached by the American Airlines DC-10 (10,750 ft) was of the same order as that of TC-JAV (11,000 ft) when the door opened and the two bolts (connecting the fixed part of the latch actuator to the door structure) failed under the same conditions.

Precursors (continued)  In the absence of pressure relief vents of adequate size between the passenger cabin and the aft cargo compartment, the sudden decompression in the cargo compartment caused damage to the cabin floor and its structure. This damage was less severe than in the case of TC-JAV in which the floor was more heavily loaded, but the functioning of the control cables was impaired in various ways, although it did not become completely impossible to control the aircraft.

Deformation of the mechanism (link between the locking handle and the vent door shaft was bent) providing control transmission for the operation of the lock tube. This permitted the vent door to close although the lockpins were not in place. S/B 52-37 was issued to correct this problem.

Resulting ACs, Regulatory Guidance and Policy As a result of the Flight TK981 accident, the following changes were made:

Amendment 54 to 14 CFR 25.365(e) added specific opening size equation for pressurized fuselages based upon cross sectional area: Ho=PAs.

Previous 25.365 failure likelihood of "extremely remote" replaced with "extremely improbable."

Amendment 54 to 14 CFR 25.783 added the following paragraphs:

(e) There must be a provision for direct visual inspection of the locking mechanism to determine if external doors, for which the initial opening movement is not inward (including passenger, crew, service, and cargo doors), are fully closed and locked. The provision must be discernible under operational lighting conditions by appropriate crewmembers using a flashlight or equivalent lighting source. In addition, there must be a visual warning means to signal the appropriate flight crewmembers if any external door is not fully closed and locked. The means must be designed such that any failure or combination of failures that would result in an erroneously closed and locked indication is improbable for doors for which the initial opening movement is not inward.

(f) External doors must have provisions to prevent the initiation of pressurization of the airplane to an unsafe level if the door is not fully closed and locked. In addition, it must be shown by safety analysis that inadvertent opening is extremely improbable.

Resulting ACs, Regulatory Guidance and Policy (continued)  Advisory Circular 25.783-1, "FUSELAGE DOORS, HATCHES, AND EXITS," dated December 10, 1986. View AC 25.783-1 at:

 Transport Airplane Directorate Memorandum, "Modification of Outward Opening Doors on Existing Transport Airplanes," dated March 20, 1992. The reason for this memorandum will be discussed later.

Airworthiness Directives Issued The following airworthiness directives were issued as a result of this event. View the ADs below in the FAA's Regulatory and Guidance Library at: http://www.airweb.faa.gov/Regulatory_and_Guidance_Library/rgWebcomponents.nsf/HomeFrame?OpenFrameSet.

AD 74-08-04 R4 This AD mandated the incorporation of seven McDonnell Douglas service bulletins to prevent possible in-flight depressurization of the airplane that might result from the opening of an improperly secured cargo door.

AD 74-12-07 R1 This AD mandated the incorporation of five McDonnell Douglas service bulletins to assure that in-flight depressurization will not occur as a result of the opening of a lower cargo door.

AD 75-15-05 R1 This AD mandated modification to provide additional venting capability or an increase in floor strength, or both, as necessary, to prevent floor collapse caused by the decompression effects resulting from a sudden large in-flight opening in any portion of any lower deck cargo compartment. The affectivity of this AD is McDonnell Douglas Model DC-10 Series, Lockheed Model L-1011 Series, Boeing Model B-747 Series, and Airbus Industrie Model A-300 Series airplanes.

AD 74-08-04 was issued as a telegraphic AD on March 7, 1974, ninety-six hours after the crash to all operators of DC-10 aircraft. The AD directed them to perform the modifications on the cargo doors described in Douglas service bulletins. All of theses service bulletins were issued shortly after the American Airlines accident 19 months previously.

On March 22, 1974, the FAA amended AD 74-08-04 to require the installation of the so-called "closed loop" system for locking the cargo doors.

The FAA should have conducted a Special Certification Review for both the Type Certificated and Supplemental Type Certificated cargo door system designs immediately after the Turk Hava DC-10 accident on March 3, 1974, especially since the FAA was aware of a similar accident (American Airlines DC-10) that occurred 21 months earlier.

The following lessons should be learned from this event:

The root cause of major incidents or accidents must be identified and resolved through adequate and timely corrective action(s) or risk being repeated.

It is important to isolate the safety monitoring system from the fault being protected against.

The failure of a warning indication can lead to a catastrophic event.

Failures resulting in rapid decompression can have catastrophic secondary effects.

Human factors must include a very wide range of considerations (e.g., personnel strength, etc.).

If other types of airplanes have similar systems (in this case an outward opening cargo door) as that in which unsafe features were uncovered, a design review of those airplane systems should be immediately conducted.

How to close the cargo door

: Bulk (Aft) Cargo Door Lockpin Viewing Port and Placards Location

Closing of the Cargo Door

To close the cargo door, the door control switch that is located on the Control Panel is held in the CLOSE position. This provides power to the door actuator, closing the door. Closing the door removes power from the door actuator and provides power to the latch actuator, closing the latches and illuminating the lock light (Green), indicating the door is ready to lock. Then, the external door handle is rotated inward until secured by the trigger. This locks the latches, closes the vent door and turns off the door warning lights in the cockpit. Through the viewing port located just above a latch access door, a visual check of the lockpin can be made to verify that the door is properly locked.

From in side

This illustration shows a typical aft cargo door with five latches. The aft cargo door on the accident airplane had four latches. The view is from inside of the aft cargo compartment looking forward.

door-position.jpg

Figure 4: Aft Cargo Door Latching/Locking Mechanism – Pre-accident Configuration
(Select here to return)

Revised design

Figure 5: Aft Cargo Door Latching/Locking Mechanism – Post-accident Configuration
(Select here to return)

door-detail.jpg

Figure 6: Aft Cargo Door Latching/Locking Mechanism (Locked)
(Select here to return)

The graphic below shows the actual door latching/locking mechanism. When the door is locked, the door warning lights in the cockpit turn off. Through the viewing port located just above a latch access door, a visual check of the lockpin can be made to verify that the door is properly locked.

latch.jpg

Figure 9: Cargo Door Latch – Correct/Incorrect Closure

American Airlines DC-10, Windsor Accident Summary

On June 12, 1972, American Airlines, Flight 96, a DC-10-10, departed Detroit-Metropolitan Airport for Buffalo-Greater Buffalo International Airport at 1920. There were 56 passengers and a crew of 11 aboard the aircraft.

At about 1925, near Windsor, Ontario, Canada, while the airplane was at approximately 11,750 feet altitude and climbing at 260 knots Indicated Airspeed (KIAS), the aft cargo door separated from the airplane. The flight crew heard and felt a "thud." Simultaneously, dust and dirt flew up into their faces, the rudder pedals moved to the full left rudder position, all three thrust levers moved back to near the flight idle position, and the airplane yawed to the right. The captain reported that he lost his vision momentarily; he thought that a midair collision had occurred and that the windshield had been lost.

In the cabin most of the flight attendants heard a loud noise, observed "fog" in the cabin, and felt motion of the cabin air. They recognized the rapid decompression of the cabin air. The decompression of the cabin air through the aft cargo compartment door caused the cabin floor in the aft lounge area to fall downward and partially drop into the cargo compartment. No passengers were in this area of the cabin; however, two flight attendants, who were in their seats at the aft exits, were thrown to the floor and received minor injuries.

An emergency was declared and the airplane began to return to Detroit-Metropolitan Airport. The fight crew was having problems flying the airplane. The No. 2 engine thrust lever could not be moved. The elevator response was extremely sluggish and directional control required continuous left aileron input. Also the rudder control was not available and the airplane remained in a right yaw. The captain applied power on the Nos. 1 and 3 engines to assist in pitch-up control. The airplane landed safely at 1944.


Earlier, the ramp service agent who serviced the aft cargo door reported that he was not able to close the door handle with normal force. He forced the handle closed with his knee, but the vent door was closed in a slightly cocked position. The agent brought this to the attention of a mechanic who gave his approval for release of the aircraft.

After the accident, a subsequent test of the door mechanism demonstrated that the door handle could actually be stowed without the lockpins in place if a force of 120 pounds was applied to the handle. Deflection of an interconnecting linkage in the closing mechanism permitted this to happen. The same deflection might have permitted the pilot indicator switch to make contact, which, in this system, prevents illumination of the cockpit warning light. Thus, the crew had no warning that the door mechanism was not functioning properly.

Shortly after the accident, the FAA sent an engineer to the accident scene. Based upon information that the FAA engineer obtained, a telegraphic AD was prepared to ground all DC-10 aircraft until the required modifications were accomplished. However, the AD was not issued since the FAA Administrator apparently made a "gentleman's agreement" with the president of McDonnell Douglas to downgrade the AD to three service bulletins, which did not require immediate grounding of the aircraft. The McDonnell Douglas president was afraid that ADs would hurt marketing of the DC-10, which was competing with Lockheed's L1011 for the "jumbo" jet market.

One of the service bulletins was S/B 52-37, dated July 3, 1972, which provided the operators with instructions to modify and adjust the door closing mechanism assembly and also to install a support plate for the link between the locking handle and the vent door shaft. Incorporation of this service bulletin will prevent the vent door handle from being forced to the closed position when the lockpins are not engaged properly.

On July 6, 1972, the NTSB issued two safety recommendations for this accident. They were:

A-72-97 – Require a modification to the DC-10 cargo door locking system to make it physically impossible to position the external locking handle and vent door to their normal door locked positions unless the locking pins are fully engaged.

A-72-98 – Require the installation of relief vents between the cabin and aft cargo compartment to minimize the pressure loading on the cabin flooring in the event of sudden depressurization of the cargo compartment.

The FAA on July 7, 1972 responded to the recommendations with the following statements:

"All operators of DC-10-10 airplanes are currently performing 100 hour functional checks on the cargo door system and will incorporate necessary modifications in accordance with McDonnell Douglas Service Bulletins 52-27 and A52-35 within 300 hours. These modifications pertain to improvements in the inspection and operation of locking and vent mechanisms.

Additional modifications to the cargo door locking and pressurization systems are being considered as part of a continued investigation effort. While a preliminary investigation indicates that it may not be feasible to provide complete venting between cabin and cargo compartments. Your recommendations will be considered with respect to further action taken."

The FAA did not issue Airworthiness Directives to mandate the above actions.
American Airlines DC-10, Windsor Accident Summary

McDonnell Douglas Service Bulletin 52-27 was issued to replace the wire between the circuit breaker and the latch actuator with a heavier gauge to correct the excessive voltage drop to the latch actuator which reduced the output torque.

Service Bulletin A52-35 was issued to install a viewing window on each cargo door that will permit visual inspection to determine if the doors are latched and locked prior to flight.

NTSB Aircraft Accident Report No. AAR-73-2, dated February 28, 1973, reported that the probable cause of this accident was, "The improper engagement of the latching mechanism for the aft bulk cargo compartment door during the preparation of the airplane for flight. The design characteristics of the door latching mechanism permitted the door to be apparently closed when, in fact, the latches were not fully engaged, and the latch lockpins.

...........................................................................................................................................................

Richard.Bolai / Bruno Druesne © 2008