American Airlines Flight 96 was a regular McDonnell Douglas DC-10-10
flight operated by American Airlines. On June 12, 1972, the aircraft's rear cargo
door blew off while flying over Windsor, Ontario, en route from Detroit
Metropolitan Wayne County Airport to Buffalo Niagara International Airport;
it is thus sometimes referred to as the Windsor incident.
The rapid decompression in the cargo hold caused a partial collapse of the
passenger compartment floor, which in turn jammed or restricted some of the
control cables which led to various flight control hydraulic actuators. The
jamming of the rudder control cable caused the rudder to deflect to its
maximum right position. The cable controls to the number two engine were
severed, causing that engine to shut down. Fortunately, there was no rupture
of any hydraulic system, so the pilots still had control of the ailerons, the
right elevator and the horizontal stabilizer. However, because the right
elevator cable was partially restricted, both pilots had to apply back pressure
on the yoke for the landing flare. Additionally, the approach and landing
had to be made at high speed, to prevent the sink rate from becoming too high.
The tendency to turn right was offset by using 45 degrees of left aileron,
combined with asymmetrical thrust of the two wing engines. In spite of the
partial restriction of the controls, the pilots were able to make a safe landing
at Detroit Metropolitan Wayne County Airport with no major injuries.
The cause was later traced to the door latching system, which had failed to
close completely. A separate locking system was supposed to ensure this could
not happen, but proved to be inadequate. McDonnell Douglas instituted a number of
minor changes to the system in an attempt to avoid a repeat, but two years
later, on March 3rd, 1974, Turkish Airlines Flight 981's rear cargo door
blew off for exactly the same reason, causing the aircraft to lose all control
and slam into a forest outside Paris, killing all 346 people on board, which
was the deadliest plane crash in aviation history until the Tenerife
disaster, and was deadliest single aircraft crash until Japan Airline
Flight 123. Incident details
Flight 96 was a regularly scheduled flight from Los Angeles to LaGuardia
Airport with intermediate stops at Detroit Metropolitan Wayne County
Airport and Buffalo Niagara International Airport. On 12 June, it
was being flown by DC-10-10 N103AA, with a flight crew consisting of Captain
Bryce McCormick, age 52, First Officer Peter Whitney, age 34, and Flight
Engineer Clayton Burke, age 50. McCormick was a highly experienced
pilot, having amassed more than 24,000 flight hours throughout his flying
career. Whitney and Burke were also seasoned airmen with approximately 7,900
flight hours and 13,900 flight hours, respectively, under their belts. Between
them, the crew had accumulated 176 hours of flight time in the DC-10.
The flight left Los Angeles 46 minutes after its scheduled 1:30 pm departure
due to passenger loading and traffic, arriving in Detroit at 6:36 pm. At
Detroit, the majority of the passengers disembarked, and the plane took on new
passengers and cargo. Leaving Detroit the aircraft had 56 passengers and 11
crew. The flight departed at 7:20 pm, climbing to 6,000 for a hold before
capturing V-554, then climb to flight level 210.
At 7:25 pm, while climbing through 11,750 ft at 260 knots, the crew heard a
distinct "thud" and dirt in the cockpit flew up into their faces. The "thud" was
the sound of the rearmost cargo door breaking off, causing a sudden
decompression that also caused part of the floor at the rear of the cabin to
partially give way. Captain McCormick momentarily believed they had suffered a
mid-air collision and the cockpit windows had been smashed. At the same
time, the rudder pedals moved to their full-left position and the engine
controls moved to idle. McCormick immediately took manual control of the
aircraft, and attempted to re-apply power, finding that engines 1 and 3
would respond normally, but engine 2, in the tail, would not allow its controls
to be moved, as control cables had been severed when the floor gave way.
McCormick was able to level off and stabilize the speed at 250 knots,
although at this speed control was very sluggish. They declared an emergency and
requested routing back to Detroit. In the cabin, the flight attendants saw
a "fog" form within the cabin and immediately recognized it as a
depressurization. Two crew were in the rear lounge area, and the floor under
their feet partially collapsed into the cargo hold, giving them both minor
injuries. In spite of this, the cabin crew immediately attempted to ensure the
oxygen masks had deployed properly, but having occurred below the 14,000 ft
limit, the masks had not deployed. One of the attendants obtained a walk-around
oxygen bottle and called the cockpit on the intercom to inform them that the
damage was in the rear of the aircraft. On instructions from the cockpit, the
attendants instructed the passengers on emergency landing procedures. A number
of passengers later reported that the aircraft safety cards proved useful in
locating the nearest exit. A casket with a body of a woman who has died out of
state fell from the cargo hold and fell to the ground near Windsor, Canada.
The flight returned to Detroit, but when the crew set the flaps to 35 degrees for
landing, the aircraft stabilized in a 1,900 ft/min descent that was far too
fast for landing. By applying power to the 1 and 3 engines, McCormick was able
to level off the nose and reduce the descent to 700 ft/min. The aircraft
touched down at 7:44 pm 1,900 ft down Runway 03R, immediately veering to the
right and eventually leaving the runway surface. First Officer Whitney applied
full reverse thrust to the left engine and idled the right, straightening the
aircraft's path, and eventually starting to bring the aircraft back to the
runway. The aircraft stopped 880 ft from the runway threshold, with the nose and
left gear on the runway and the right on the grass beside it. It happened that
while training to convert his expertise to flying the DC-10, McCormick had
practiced, in a simulator, controlling the plane with the throttles in this
fashion, in the worst-case scenario of a hydraulic failure. A similar technique
was used on another DC-10 in 1989 following a complete loss of hydraulic
pressure on United Airlines Flight 232. Investigation
The problem that caused the accident was immediately obvious, as the rear cargo
door was missing and had caused severe damage to the left horizontal stabilizer
as it blew off. Investigators immediately studied the maintenance
history and found that on March 3rd, 1972, three months before the accident,
the handlers reported that the door had not latched electrically and had to be
closed manually. On May 30th, McDonnell Douglas issued Service Bulletin 52-27,
DC-10 SC 612, which called for the upgrading of the electrical wiring that
drove the latches because "Three operators have reported failure of the
electrical latch actuators to latch/unlatch the cargo doors. Latch
actuator failure is attributed to an excessive voltage drop reducing the
output torque to the actuator. This condition may prevent electrical
latching/unlatching of the hooks." The modification was not compulsory,
however, and had not been carried out on N103AA, the plane involved in the
incident. Investigators interviewed the ground
crew at Detroit and learned that the cargo loader who operated the rear door
had found it extremely difficult to close. He stated that he closed the door
electrically, and waited for the sound of the actuator motors to stop. When
they did, he attempted to operate the locking handle, but found it very
difficult to close. Only by applying force with his knee was he able to get
the latch to lock, but he noticed that the vent plug was not entirely closed.
He brought this to the attention of a mechanic, who cleared the flight. The
flight engineer reported that the "door ajar" warning light on his panel was not
lit at any time during the taxi out or flight.
Examination of the aircraft and the cargo door, which was recovered largely
intact in Windsor, demonstrated that the latches had never rotated to their
locked position. In their locked position, pressure on the door presses
the latches further shut, and no force is transmitted into the actuator system
that closes and opens them. With the latches only partially closed, forces on
the door were transmitted back into the actuator, eventually overwhelming it at
about 6,600 lbf. The rapid depressurization when the door broke off
caused the floor above it to partially cave in, which pulled the rudder cable
to its extension limit and severed several other operating cables.
Cause of door failure Passenger doors on the DC-10 are of the
plug variety, which prevents the doors from opening while the aircraft is
pressurized. The cargo door, however, is not. Due to its large area, the cargo
door on the DC-10 could not be swung inside the fuselage without taking up a
considerable amount of valuable cargo space. Instead, the door swung outward,
allowing cargo to be stored directly behind it. The outward-opening door, in
theory, allowed it to be "blown open" by the pressure inside the cargo area.
To prevent this, the DC-10 used a "fail safe" latching system held in place by
"over top dead center latches", five C-shaped latches mounted on a common
torque shaft that are rotated over fixed latching pins fixed to the fuselage.
Because of their shape, when the latches are in the proper position, pressure on
the door does not place torque on the latches that could cause them to open,
and actually further seats them on the pins. Normally the latches are opened
and closed by a screw jack powered by an electric actuator motor.
Because of the under-designed cabling powering the actuator motor, it was
possible for the voltage delivered to the motor to be too small to drive it
under high loads. In these cases, the motor would stop turning even if the
latches had not rotated over the pins. Since the operators listened for the
motors to stop as an indication of their complete rotation, a failure in the
drive system during operation would erroneously indicate that the door was
properly latched. To ensure this rotation had completed
and the latches were in the proper position, the DC-10 cargo door also
included a separate locking mechanism. The locks consisting of small pins that
were slid horizontally through holes on the back of the latches, between the
latch and the frame of the aircraft. When the pins were in place, they
mechanically prevented movement back into the open position, so even the
actuator motor could no longer open them. If the latches were not in their
correct positions, the pins could not enter the holes, and the operating
handle on the outside of the door would remain open and visually indicate that
there was a problem. Additionally, the handle moved a metal plug into a vent
cut in the outer door panel; if the vent was not plugged the door would not
retain pressure, eliminating any force on the door. Lastly, there was an
indicator light in the cockpit that would remain on if the door was not
correctly latched. In theory, the motor failure on the
plane could not present a problem because the locking lever would not be
able to close. However, during the investigation a McDonnell Douglas test
rig demonstrated that the entire locking pin operating system was too weak,
allowing the handle to be forced closed even with the pins out of the locking
holes. This occurred on Flight 96, when the handler forced the handle closed
with his knee. In spite of the vent not closing completely, neither the handler
nor the engineer considered this to be serious. Although the vent door remained
partially open, it closed enough to cause it to "blow shut", and thereby
allow pressurization of the cargo hold. Although the handle did not seat the
pins entirely, the small amount of motion it managed to cause was enough to
press on the warning indicator switch, deactivating the cockpit warning light.
It was only the combination of all of these failures that allowed the accident
to happen. Yet all of these indicators had a single common point of failure:
the mechanical weakness of the locking system that allowed the handle to be
moved. The cabin floor failure was also a
matter of poor design. All of the other portions of the cargo holds had holes
cut into the cabin floor above the cargo areas. In the case of a pressure loss on
either side of the floor, the air would flow through the vents and equalize the
pressure, thereby eliminating any force on the floor. Only the rearmost portion
of the cabin lacked these holes, and it was that portion that failed. However,
because the control cables ran through the floor for the entire length of the
aircraft, a failure at any point on the floor would cut controls to the tail
section. Aftermath
The NTSB suggested several changes to the system to ensure that the Windsor
accident would not recur. These included changes to the locking mechanism to
ensure it could not be forced closed, as well as venting cut into the rear cabin
floor. In response, the FAA, in charge of
actually implementing these recommendations, agreed with McDonnell
Douglas that the additional venting would be difficult to install. Instead,
they proceeded with the modification of the locking system, and additionally
added a small clear window set into the bottom of the cargo door that allowed
operators to directly inspect whether or not the latches were in place. Combined
with the upgrades to the wiring that had already been on the books, this should
prevent a repeat of the accident. Shortly after the event, Dan Applegate,
Director of Product Engineering at Convair, wrote a memo to Convair
management pointing out several problems with the door design. McDonnell Douglas
had subcontracted design and construction of the DC-10 fuselage to
Convair, and Applegate had overseen its development in ways that he felt were
reducing the safety of the system. In particular, he noted that the actuator
system had been switched from a hydraulic system to an electrical one,
which he felt was less safe. He also noted that the floor would be prone to
failure if the door was lost, and this would likely sever the control cables,
leading to a loss of the aircraft. Finally, he pointed out that this
precise failure had already occurred in ground testing in 1970, and he concluded
that such an accident was almost certain to occur again in the future.
In spite of these recommendations, on March 3, 1974, less than two years after
the near-loss of Flight 96, Turkish Airlines Flight 981 crashed outside
Paris, killing all 346 passengers and crew on board for an identical rear
cargo door failure. Unlike Flight 96, where the crew still managed to keep
enough flight controls to safely return to Detroit, the pilots of Flight 981
lost complete control of the tail surfaces and all hydraulics.
Investigators discovered that the upgrades had never been carried out on
this airframe, although the construction logs claimed they had been. One
modification had been carried out, the installation of the inspection window,
along with a placard beside the door controls printed in English and Turkish
that informed the operators how to inspect the latches. The operator in
Paris was Algerian and could not read either language, and had been instructed
that as long as the locking handle closed, the door was safe. He also noted
that he did not have to force the handle, and investigators concluded that
it had already been bent on a prior flight.
In the aftermath of Flight 981, the Applegate memorandum was discovered and
introduced into evidence during the massive civil lawsuit that followed.
Many commentators subsequently blamed the aircraft manufacturer, McDonnell
Douglas, and other aviation authorities, for failing to learn lessons from the
Flight 96 accident. Although there had been some redesign of the DC-10 cargo
door system, it had only been implemented voluntarily and haphazardly
by various airlines. If the warning signs of Flight 96 had been heeded, it
is likely that the crash of Flight 981 would have been prevented. A complete
redesign of the entire door system followed, and no DC-10 or MD-11 ever
suffered a similar accident again. N103AA's airframe was broken up at
Phoenix Goodyear Airport in 2002, after having been assigned to the FedEx
McDonnell Douglas DC-10 program. Dramatization
The story of this disaster was featured on the fifth season of Canadian National
Geographic Channel show Mayday. The episode is entitled "Behind Closed
Doors", as a double feature that also covered the crash of Turkish Airlines
Flight 981. The episode "Crash Detectives" of
Survival in the Sky featured the accident.
See also Flight with disabled controls
List of notable accidents and incidents on commercial aircraft
List of notable decompression accidents and incidents
List of airliner crashes involving loss of control
Turkish Airlines Flight 981 United Airlines Flight 811
References External links
NTSB Report