DC-10 Cargo Door Crash Kills 346 in Paris

Lost Cargo Door Brings Down DC-10 in ParisBy Patrick MondoutOn March 3, 1974, a Turkish Airways (THY) DC-10 on a regularly scheduled flight from Orly Airport in Paris to London's Heathrow lost a cargo door and crashed killing all 346 aboard. To this point in aviation history, this was the worst accident of all time.A strike by British European Airways (BEA) ground engineers left many Brits stranded at Orly and elsewhere in Europe and most were willing to take any flight they could get back to England. THY was only able to sell 167 of the 345 seats before the strike. They were able to nearly fill the plane by noon.The DC-10, operating as Flight 981, took off under the command of THY Captain Mejat Berkoz about half past noon. The aircraft climbed to 13,000 feet before the cargo door gave way. When it did, the rapid decompression ripped away parts of the aircraft around the door. This damaged hydraulic lines used to control the aircraft. Although the pilots attempted to fly the aircraft and had some control for a short time, it was only a matter of time before it crashed. It was later determined that the cargo door was not properly locked before takeoff. DC-10A Sabena Airlines DC-10 under construction in Long Beach with a modified cargo door open.Image courtesy of HYPERLINK quot;
http://members.aol.com/aircal737/aircal.htmquot;
quot;
_blankquot;
AirNikon. Find more of his photos atAirliners.net The cash-strapped McDonnell Douglas blamed an quot;
illiteratequot;
baggage handler at Orly for failing to close the door properly. While it was true that Algerian-born Mahmoud Mahamoudi spoke no English (the language of instructions printed on this DC-10), it was not his fault that MD had made a faulty cargo door locking mechanism which should have been fixed.In fact, this was a repeat of an accident which happened on June 12, 1972 to an American Airlines flight. The damage was not quite as severe (one body exited the aircraft, though it was in a coffin near the cargo door) and the plane landed safely. The following is from the National Transportation Safety Board accident report for the American Airlines flight:quot;
[The NTSB] determines that the probable cause of this accident was the improper engagement of the latching mechanism for the aft bulk cargo compartment door during the preparation of the airplane for flight. The design characteristics of the door latching mechanism permitted the door to be apparently closed when, in fact, the latches were not fully engaged, and the latch lockpins were not in place.quot;
The NTSB investigates accidents and makes recommendations to the FAA to prevent such accidents from occurring in the future, but the NTSB cannot force an airline or aircraft manufacturer to do anything - only the FAA can. It is a widely held - if cynical - belief that the NTSB exists to keep passengers safe and the FAA exists to keep the NTSB off the back of the airlines and aircraft manufacturers by taking NTSB demands and turning them into mere recommendations.Though the seriousness of the design deficiency should have warranted grounding all DC-10s until the changes were made (such a grounding would happen in 1979 after the horrible American Airlines crash in Chicago), Jackson McGowen, then president of the Douglas division of McDonnell Douglas and worried about the effect it would have on marketing his new plane, was able to make a gentleman's agreement with J.H. Shaffer of the FAA to not issue an AD (Airworthiness Directive). Such an AD might have grounded all DC-10s and would have required changes to be made.The NTSB asked the FAA to require changes to prevent a reoccurrence. The FAA's J.H Shaffer declined the recommendations with a bit of spin in a letter dated July 7, 1972 to NTSB Chairman John Reed,quot;
All operators of DC-10-10 airplanes are currently performing 100 hour functional checks on the cargo door system and will incorporate necessary modifications in accordance with McDonnell Douglas Service Bulletins 52-27 and A52-35 within 300 hours. These modifications pertain to improvements in the inspection and operation of locking and vent mechanisms.quot;
This did not require that the changes be made. However, in June of 1972, three inspectors at the McDonnell Douglas facility in Long Beach certified that the Turkish DC-10 had been modified in accordance with MD's own recommendations prior to its December 1972 delivery. It had not - resulting in the deaths of 346 passengers and crew.McDonnell Douglas was not able to play ball with the FAA this time and an Airworthiness Directive mandating a closed loop system on all DC-10 cargo doors was issued.The DC-10 was starting to get a reputation it would never quite outrun as a dangerous aircraft. Sneak Analysis (SA) is a methodology for identifying design errors. It got its rather ridiculous name in the 1960’s from early work on electrical systems by the Boeing company. In the mid-seventies, it began to be applied to process systems though the name ‘Sneak Analysis’ was not then used and the methodology tended to be used mainly in the USA. However, by 1979 it was beginning to be HYPERLINK quot;
http://www.saunalahti.fi/ility/SneakAnalysis.htmlquot;
quot;
Taylor1quot;
recognised, at least in parts of Europe, as a means of process hazard identification. In the early nineties, several workers (Taylor, Taylor, HYPERLINK quot;
quot;
Whetton1quot;
Whetton) began to apply the methodology seriously to process systems, a short book was published, and several important points were established: Sneak Analysis is good for identifying design errors. It works best when applied in conjunction with HAZOP. It is very good for dealing with systems which have multiple states – such as batch and semi-batch plant. The methodology required for process systems is somewhat different from that for electrical systems. Throughout the last ten years there has been continuous progress (Armstrong, HYPERLINK quot;
quot;
Whetton3quot;
Whetton, HYPERLINK quot;
quot;
Whetton4quot;
Whetton) in the application of Sneak Analysis to process systems – especially in applications to batch plant – and the methodology is now wellrecognised. Definition: A Sneak is a design condition (possibly in conjunction with a single-point failure) which gives rise to an unintended event or which inhibits an intended event. In this context, an event can be: A change in the state of the plant. A transfer of material, energy, information, etc. A program operation The concept can be illustrated by the following six examples. Sneak Flow right0A sneak flow is the unintended transfer of material, energy, information, etc. which occurs along an unintended path, either as a result of a combination of intended actions or as a result of a single failure. The figure, right, shows a simple example of a process sneak flow. If both drain valves are opened together, it is very probable that there will be a sneak flow from vessel B (which contains nitrogen tetroxide) to vessel A (which contains naphtha). A sneak flow contributed to the Three Mile Island (TMI) incident which began when operators tried to clear a blocked vessel by making a temporary connection from the instrument air supply to the vessel. Unfortunately, the pressure in the vessel rose above that of the air, reverse flow occurred, and the instrument air system filled with water – with disastrous consequences. A similar incident is recounted by HYPERLINK quot;
quot;
Kletz1quot;
Kletz, in which the drinking water supply was used to prime a pump. With the result that, in Kletz’ words: quot;
The tea tasted funny.quot;
In general, sneak flows arise from: Gross design errors, especially cross connections. Deviations in one or more external states that cause a stoppage or flow reversal in one or more lines. Deviations in one or more external states cause stoppages or flow reversals within the process. Deviations from the intended state of the internal active elements cause stoppage or flow reversal of one or more external states. Deviations from the intended state of the internal active elements cause stoppage or flow reversal within the system Further examples are given in the sneak clue database, Holmes. ility Engineering has developed a logical procedure for analysing sneak flows and details are available in our training courses. Sneak Indication right0A sneak indication is a false or ambiguous indication of system conditions. The figure, left, shows a common example of a sneak indication. The temperature transmitter is supposed to indicate liquid temperature – yet it is not in contact with the liquid. Whatever it is indicating, it will be a different temperature from the liquid. This is a very common problem and has led to some serious accidents. Sneak Indications have been responsible for or contributing factors to several notable incidents, in aviation and the process industries, including: Ermenonville Three Mile Island Hickson and Welch These are briefly examined in the following paragraphs. Further examples are given in the sneak clue database, Holmes. Ermenonville right0In 1974, a Turkish Airlines (TAL) DC-10 crashed at Ermenonville, France, shortly after takeoff from Paris, Orly. There were no survivors. Because it was not closed properly, the aft cargo door blew open. Air pressure then caused the rear floor of the passenger compartment to collapse, severing the main control linkages to the tail and sending the aircraft out of control. The incident was the subject of a well written book by Eddy and the Sunday Times quot;
Insightquot;
team. A grossly simplified schematic of the door latching arrangement is shown in the figure right. As originally conceived, the DC-10 cargo doors hinged outward and upward. When closed, a series of dogs on a rotating shaft at the bottom of the door engaged with a corresponding set of hooks and pulled the door tight against the rubber pressure seal. Originally, the status of the door latch was shown by a metal plate attached to the transfer rod and located behind a sight-glass in the door; when closed, the plate showed green; when open, it showed red. Unfortunately, this was difficult for the operator to see, especially in the dark, and was made even more difficult by the operating lever being at the top of the door and the sight glass at the bottom. Also, it required considerable force to operate the lever against the resistance offered by the rubber seals. Inevitably, an aircraft took off without the cargo door being properly closed. There was a near miss. At about 8,000 feet, the door flew open, the cargo – including an occupied coffin – fell out, part of the cabin floor collapsed, and two out of the three control paths to the tail surfaces were lost. Fortunately, the aircraft was able to land safely. None of the obvious lessons were learned from this incident. Instead, it was decided to replace the door latch indicator with an electrical system. However, there was no room to retrofit a switch down at the level of the shaft carrying the latch dogs. Instead, it was placed where it could be operated by an extension of the door closure lever, as shown in the figure. In the TAL incident, the baggage handler closed the lever to lock the door. In later testimony, he said that it took an unusual amount of force to close but eventually the green light came on. What in fact had happened was that the dogs were not able to engage because the door was not closed far enough to begin with. In applying extra force, the baggage handler had bent the transfer rod, allowing the door handle extension to close the switch and turn on the green light. The door flew open at an altitude of about 2,500m and the disaster followed. The following points are worth noting: This is a classic sneak indication: the door closed indicator showed the position of the door handle, not the door latch. All three redundant control linkages to the tail ran in the same conduit down the centre of the aircraft and so were vulnerable to common mode failure: when the floor collapsed it severed all three linkages. The tragedy was compounded by the fact that the aircraft was fitted with a fly-by-wire autopilot which connected to the tail surfaces by a different route and which probably survived the incident. The pilots had not yet been trained how to use it but later simulations showed that it could have been used to control the aircraft safely. Three Mile Island right0One of the contributory factors to the 1979 incident at the Three Mile Island (TMI) nuclear reactor was a sneak flow, as described above; another factor was a sneak indication. The TMI sneak indication is shown in the figure, right; it is almost an exact logical copy of the sneak indication in the Ermenonville disaster, described above. Unfortunately, nuclear, process and aircraft engineers rarely read about each others’ mistakes. Still less do they learn from them. In the figure, the two relief valves were operated from the control panel and a panel indicator was supposed to display the valve status. Actually, the lamp indicated the switch status and bore no relation whatsoever to the state of the valves. During the TMI incident, the lamp indicated that the PORV’s were closed when in fact they were open – leading to a loss of reactor coolant. Hickson and Welch right0The 1992 accident at Hickson and Welch was also caused in part by a sneak indication. In the Hickson and Welch incident, shown in simplified form in the figure, right, operators were attempting to clean a deposit from the bottom of a vessel. They heated the deposit with steam (which was labelled by pressure, not by temperature) and used a thermometer to monitor the temperature of the deposit. The thermometer was not in contact with the deposit which reached its auto-ignition temperature and exploded, shooting a jet of flame several tens of feet into a temporary control room and killing the occupants. Sneak Label right0A sneak label is an ambiguous or misleading label, an example of which is shown in the figure, right. The author once saw four transformers in the switchyard of a plant; each transformer was about two metres high; none of the labels was larger than 10 cm square and they were all in different locations (they were actually attached to a chain-link fence in front of the transformers). All the letters were in blue except III which was in yellow – which probably did not show well under sodium lights, at night. Quick! Go and pull the manual isolator on transformer number three. With the increasing use of windowing in plant control displays, the question of sneak labels is becoming more important. Some general rules for information displays, derived from an analysis of sneak labels, are: Labels should be unambiguous – increasing from left to right, etc. – and should match the user’s expectations. Labels should not change. Symbols should be unambiguous. Colour should be used carefully. While few people are truly colour blind, most people have difficulty seeing some colour combinations. E.g. green on blue. Further examples are given in the sneak clue database, Holmes. Sneak Energy right0Sneak energy is the presence of unintended energy at some point in the system or the presence of energy at an unintended place. Sneak energy is surprisingly common: especially the case shown in the figure, right. Here, two liquids have been poured into a reactor without the agitator running – an all too common mistake. The liquids are of widely differing densities and react violently when mixed. Just after the last drop of liquid A was added someone realised that they had forgotten to turn on the agitator. They turned it on. Apart from the near universal problem of failure to agitate – referred to above – sneak energy is most commonly encountered as trapped pressure, especially during maintenance. Other examples include products of reaction and static electricity. Further examples are given in the sneak clue database, Holmes. Trapped Pressure Examples of pressure trapped in pipelines and vessels and leakage via non-return valves are widespread in the literature ( HYPERLINK quot;
quot;
Kletz1quot;
Kletz, Lees, HYPERLINK quot;
quot;
Whetton4quot;
Whetton) and have long been recognised. A serious problem, which regularly causes deaths and injuries, is pressure trapped within a system which is accidentally released during maintenance. It is most unfortunate that the process maintenance engineer has no equivalent of the electrician’s voltmeter with which to test a pipe or vessel for pressure before beginning to open it. It does, however suggest, that any pipe, vessel, or other structure that can be subject to pressure and that is liable to disassembly for maintenance should be fitted with a test-port and valve to which a gauge can be attached to confirm that no significant pressure is present. Such a system has been a significant safety feature on submarine torpedo-tubes for the last seventy years. Products of Reaction One common example of Sneak Energy is the storage tank which has been taken out of service and sealed. Corrosion takes place within the tank and atmospheric oxygen is absorbed, leading to a partial vacuum (the sneak energy) which causes the tank to collapse. Another example of sneak energy is the opposite case, where gasses are evolved leading to rupture of the tank. Such cases are well documented in HYPERLINK quot;
quot;
Kletz1quot;
Kletz; in another work, thirty-five examples of sneak energy were identified out of 153 sneak-related incidents. Static Electricity right0Static electricity occurs whenever electrons are added to or removed from a substance. Chemical engineers may be surprised to learn that you can strip electrons from the outer shells of atoms simply by rubbing them but this is indeed what happens when static electricity is generated by friction. Most plastics and liquid hydrocarbons are electrical insulators and can easily achieve high static charges by flowing over other insulators, as the followingexample shows. A university laboratory built a new store room to comply with the latest regulations for storing and dispensing flammable liquids, as shown schematically in the figure, above. Each liquid was stored inside a steel cupboard, which was electrically grounded, purged, and fitted with temperature and vapour sensors. The steel cupboards were themselves in a basement room, with fire-resistant walls, extractor fans, and a full fire suppression system. One day, an experienced postgraduate student came to fill two plastic bottles with solvent. He filled the first bottle and in doing so, a few drops of solvent ran down the side of the bottle and also onto his fingers. The bottle was quite large, and as it filled became heavier and heavier so that by the time it was full he was holding it several inches below the spout. When the bottle was full, but not yet capped, he placed it on the floor, next to the steel cabinet, before reaching into the pockets of his laboratory coat for the cap. As he put the bottle down, his fingers brushed against the cabinet, he felt an electric shock, and the bottle burst into flames. He received severe burns to the right side of his body. The subsequent investigation showed that static electricity was almost certainly the culprit, possibly made worse by the hot, dry climate. The system was modified such that: The plastic pipe and delivery valve were replaced with metal, securely bonded to the grounded cabinet. The delivery spout was lengthened so that liquid could always flow to the bottom of the receptacle without splashing. Grounded wrist-straps were introduced to prevent operators having any static charge. Sneak Procedure A sneak procedure is the occurrence of events in an unintended or conflicting sequence, at an unintended time, or for an unintended duration. Ambiguous procedures are very common; those that are recognised as such are sometimes replaced by unofficial and unrecorded procedures. Similarly, awkward or lengthy procedures may be bypassed or replaced by unofficial ‘custom and practice’. All are examples of sneak procedures. A batch procedure required a liquid to be boiled until it had reduced to half its original volume. The normal volume was 1000 l and the procedure read: quot;
Boil until the volume reaches 500 ±20 lquot;
. One day, a batch of only 700 l was processed… Another classic instance, which also reveals the difficulty which can occur in trying to distinguish between sneak labels and sneak procedures, is the HYPERLINK quot;
quot;
Milnequot;
Camelford incident where material was delivered to the wrong tank because one key fitted the locks to each. right0Sneak procedures often arise through the absence of an official procedure, in which cases the operators invent something, or in the transfer of information from one party to another, such as at shift changes. The figure, right, shows one (greatly simplified) example of this type of problem, taken from HYPERLINK quot;
quot;
Kletz1quot;
Kletz. A plant that was being cleaned and re-validated after some modifications had been made. Reactor R3 was charged with toluene, using the pump, manifold, and flexible hose. After refluxing, half of the batch was transferred each to R1 and R2, where reflux again took place. Next, R3 was charged with isopropanol and the sequence was repeated. Finally, all three vessels were drained and washed with water. At the end of operations, the foreman noticed a film of dust inside R1. He recorded this in the log book, together with a note to the shift manager to: quot;
Agitate R1 with 150 l HNO3 solution for 4h at 80ºCquot;
. The foreman assumed that quot;
the usual methodquot;
, which had been practised for many years, would be used; this was to fill the vessel with about 3.5 m3 of water and then pump in 150 l of 53% nitric acid. Unfortunately, the shift manager was unaware of quot;
. He began to charge R1 with 150 l of concentrated nitric acid, using the pump and flexible hose. After about 120 l of acid had been charged, gas began to evolve rapidly in R1, the relief valve lifted and the shift manager ran. The vessel ruptured but he received no injuries. As an example of Sneak Procedure, it shows the danger of assuming that every one knows quot;
. The usual method was not written down but was simply a matter of 'custom and practice'. The example also demonstrates a case of Sneak Reaction. The pump, which had last been used to transfer isopropanol to R3, had not been completely drained and still contained about 5 l of isopropanol which was pumped into R3 along with the concentrated nitric acid. There, it formed unstable isopropyl nitrate which decomposed explosively. As with Sneak Indications, Sneak Procedures also crop up in fiction. The story Sulphur, in the late Primo Levi's collection The Periodic Table can be read as a tale of Sneak Procedure, Indication, and Reaction. Although clearly set in the 1950's, only the fact that the hero, Lanza, smokes as he tends the batch distinguishes it from modern practice. ility Engineering has developed a logical procedure for analysing sneak procedures and details are available in our training courses. Sneak Reaction A sneak reaction is an unintended reaction or the unintended catalysis of a reaction – like the day an inquisitive rat fell into the open-topped peroxide storage tank. Sneak Reactions typically arise from: Unanticipated changes to process conditions Reaction with unintended material Catalysis by unintended material Gaseous chlorine was being added to a solution of aromatic monomer in carbon tetrachloride at 50ºC. When about 10% of chlorine had been added, a violent reaction occurred, lifting the top of the vessel, buckling the pipework, and spraying solution over the two operators. It was subsequently established that ferric chloride had entered the reactor from the stainless steel chlorine lines and that ferric chloride catalyses a violent reaction between chlorine and aromatic monomers. Sneak Analysis Procedure The following briefly describes a procedure for performing Sneak Analysis on a plant. More detailed procedures are given in the literature. Sneak Analysis is usually done in conjunction with HAZOP but the SA portion of the procedure can be summarised as: Assemble complete, as-built drawings of the plant, including utilities. Construct the Substance Matrix and identify those pairs of substances which are known (or thought) to be hazardous if they come into contact. Note all energy sources on the P&ID. Prioritize the hazardous substance pairs in the Substance Matrix. For each energy source and for each substance pair construct a Sneak Flow Graph, as described below. For each potential sneak flow, ask the relevant questions – as described below. Apply any Sneak Clues to each item in the potential sneak path. Substance Matrix Sneak flows are to be avoided because they can bring together incompatible materials – with disastrous consequences. The first step is to determine what materials can come together and what their potential consequences are. This can be done with the aid of a substance matrix. The substance matrix is a square matrix of all substances, including intermediates, that occur during the process, together with the standard substances and pseudo-substances listed in the following table. The EnvironmentInstrument airProcess waterSewersPurge airFire waterPurge nitrogenBreathing air Purge steamCooling water Process steamDrinking water Other substances may be added at the discretion of the analyst. The idea behind the substance matrix is to determine what will happen if {things in the rows} come into contact with {things in the columns}. It is assumed that substances do not react with themselves, so the intersection of each row with its corresponding column is marked with an 'X'. However, if it is known to be dangerous, or extremely undesirable, for certain pairs of substances to come into contact these are indicated by a 'D' (for dangerous). The property of being dangerous is not always reciprocal. For example, while it is dangerous for Sewers to flow into Drinking Water, it is not dangerous (though certainly wasteful) for Drinking Water to flow into the Sewers. Once constructed, the substance matrix directs the analysis because it defines: Undesirable pairs of substances. The marked intersections of the {from row} {to column} pairs identify those substances that are of primary interest. Undesirable directions of flow. The matrix distinguishes between directions of flow, as in the example of Sewers and Drinking Water, above. Priorities. Priorities can easily be assigned, either by code letter or by colour, though it is recommended that this not become too sophisticated. A possible scheme is: Red Definitely dangerous Orange Unknown Yellow Undesirable, but not a major problem Green Definitely not a problem Sneak Flow Graph right0The next step is to produce a set of Sneak Flow Graphs. While these are not strictly necessary – the same effect could be obtained by marking the P&ID with coloured pencils – they do greatly facilitate the documentation and make checking much easier. A typical Sneak Flow Graph (SFG) is shown above for the simple two-vessel system discussed when introducing sneak flows. The graph merely formalises and clarifies each possible undesired flow, as determined by the Substance Matrix. The analyst must then decide whether the flow is credible by posing six questions, whether or not: An unintended path exists or can be created. An intended path can be activated at the wrong time. An intended path can be cut at the wrong time. An intended path can be diverted. Two paths exist allowing an unintended mixing. A person or object can move into a path at the wrong time. Sneak Clues Sneak clues are statements about equipment, processes, and equipment configurations that prompt the analyst to look for certain hazards. So far, several hundred Sneak Clues have been identified. The process of identifying relevant clues is simplified by co-ordinating them with equipment types and HAZOP keywords. A typical Sneak Clue might read: Pumps, Centrifugal: note that priming lines are a potential sneak path. Priming lines are not always shown on P&I diagrams and are often temporary connections. Space and time do not permit a more detailed discussion of this topic but further details can be found in the references. Turkish Airlines Flight 981 HYPERLINK quot;
http://www.answers.com/library/Wikipedia-cid-3704998quot;
Wikipedia:Turkish Airlines Flight 981 Sponsored Links Book Turkish Airlines@ Great Rate, Easy & Secure Booking on Cleartrip.com. Book Now! www.cleartrip.comTurkish Airlines FlightGet Offers On International Flights At MakeMyTrip. Easy Booking. Hurry! MakeMyTrip.com/Turkish_Airlines Home > Library > HYPERLINK quot;
http://www.answers.com/main/reference.jspquot;
Miscellaneous > HYPERLINK quot;
http://www.answers.com/library/Wikipedia-cid-3704998quot;
Wikipedia Turkish Airlines Flight 981CG render of TC-JAV moments after failure of the cargo hatch.Accident summaryDate3 March 1974TypeCargo hatch failure and control cable failuresSiteErmenonville, FrancePassengers333Crew13Injuries0Fatalities346 (all)Survivors0Aircraft typeMcDonnell Douglas DC-10-10Aircraft nameAnkaraOperatorTurkish AirlinesTail numberTC-JAVFlight originYesilköy International AirportLast stopoverOrly Airport (Paris)DestinationLondon Heathrow Airport Turkish Airlines Flight 981 was a McDonnell Douglas DC-10, registered TC-JAV and named the Ankara, that crashed just outsideSenlis, France, on 3 March 1974. Known as the quot;
Ermenonville air disasterquot;
, from the forest where the aircraft crashed, the accident resulted in the deaths of all 346 on board. The crash of Flight 981 was the deadliest air disaster of all time before the Tenerife Disasterevent of 1977, and remained the deadliest single-airliner disaster until the crash of Japan Airlines Flight 123 in 1985. Flight 981 has the highest death toll of any aviation accident in France and the highest death toll of any accident involving a McDonnell Douglas DC-10 anywhere in the world. The crash resulted from the failure of the rear cargo hatch latching system, which allowed the hatch to blow off in flight. The resulting decompression of the cargo hold caused the cabin floor above the hatch to collapse. The flight control cables for the airplane that ran through the floor were severed, leaving the pilots with almost no control over the aircraft. Problems with the latching system and the potential failure mode that led to the crash were known to HYPERLINK quot;
http://www.answers.com/topic/convairquot;
quot;
_topquot;
Convair, the fuselage's builder, with the information passed on to McDonnell Douglas several years prior to the accident. Changes that addressed the problem had been found, but were not applied to TC-JAV, nor any other aircraft in the DC-10 fleet. McDonnell Douglas instead chose a solution less disruptive to schedules but failed to ensure that personnel were trained to follow the new procedures to ensure the hatch had locked. McDonnell Douglas's reputation and the reputation of the DC-10 were harmed.[ HYPERLINK quot;
http://en.wikipedia.org/wiki/Wikipedia:Citation_neededquot;
quot;
Wikipedia:Citation neededquot;
quot;
AnswersQueryWindowquot;
citation needed] Contents [hide]1 Aircraft2 Accident3 Passengers4 Investigation5 Cause6 Aftermath7 Similar accidents8 Notable passengers9 See also10 Footnotes11 References12 Further reading13 External links Aircraft The aircraft was built in Long Beach, California and was delivered to the airline in December 1972.[1] Accident Flight 981 had flown from Istanbul that morning, landing at Paris's HYPERLINK quot;
http://www.answers.com/topic/orly-airportquot;
quot;
_topquot;
Orly International Airport just after 11:00 am local time. The aircraft, a McDonnell Douglas DC-10, was carrying just 167 passengers and 13 crew members in its first leg. 50 passengers disembarked at Paris. The flight's second leg, from Paris to London's Heathrow Airport, was normally underbooked, but due to a strike by British European Airways (BEA) employees, many London-bound travelers who had been stranded at Orly were booked onto Flight 981. Among them were 17 English rugby players who had attended a France-England match the previous day; the flight also carried four British fashion models, 48Japanese bank management trainees on their way to England, as well as passengers from a dozen other countries.[citation needed] The aircraft departed Orly at around 12:30 pm for its flight to Heathrow. It took off in an easterly direction, then turned to the north to avoid flying directly over Paris. Shortly thereafter the flight was cleared to flight level 230, and started turning to the west for London. Just after Flight 981 passed over the town of HYPERLINK quot;
http://www.answers.com/topic/meauxquot;
quot;
_topquot;
Meaux, controllers picked up a distorted transmission from the plane; the aircraft's pressurization and overspeed warnings were heard over the pilots' words in Turkish, including the co-pilot saying quot;
the fuselage has burst.quot;
[citation needed] The flight disappeared from radar shortly afterwards and its wreckage was later found at the Grove of Dammartin in the HYPERLINK quot;
http://www.answers.com/topic/ermenonvillequot;
quot;
_topquot;
Ermenonville forest, close to the town of Senlis. The aircraft had disintegrated. The post-crash fires were small as there were few large pieces of the aircraft left intact to burn. Of the 346 onboard, only 40 bodies were visually identifiable. Nine passengers were never identified.[ HYPERLINK quot;
http://en.wikipedia.org/wiki/Wikipedia:Citation_neededquot;
quot;
Wikipedia:Citation neededquot;
quot;
AnswersQueryWindowquot;
citation needed] The wreckage had been so extensively broken up that immediate investigation suggested that a bomb had been placed on-board. Turkish news reports suggested that a group had intended to bomb a BEA aircraft but had switched planes along with the other passengers. Two terrorist groups soon called to claim responsibility.[2] Passengers Most of the passengers were British. Among the British passengers were members of an amateur rugby team and trade union leader James Conway. The Japanese embassy sources said that a total of 49 Japanese were on board. Turkish sources said that 15 Turks were on board.[3] Among the passengers was Dr. Wayne Wilcox, a cultural attaché of the Embassy of the United States in London, his wife, and two of his four children. 38 passengers were Japanese university graduates who were touring Europe and were planning to join Japanese firms after the end of their tour.[1] Investigation Investigators were able to retrieve both the flight data recorder and cockpit voice recorder. These showed that the first hint the flight crew had of any problem was a muffled explosion that took place just after the aircraft passed over Meaux. The explosion was followed by a loud rush of air, and the throttle for the tail-mounted No. 2 engine snapped shut at the same moment. At some point, one of the crew pressed his microphone button, broadcasting the pandemonium in the cockpit on the departure frequency. The aircraft quickly attained a 20 degree nose-down attitude and started picking up speed while Captain Mejat Berkoz and First Officer Oral Ulusman struggled to gain control. As the speed increased the additional lift started to raise the nose again, and Berkoz called quot;
Speed!quot;
and started to push the throttles forward again in order to level off. It was too late, however, and 72 seconds after decompression the airliner slammed into the forest at a speed of about 430 knots (497 miles per hour, or 796 km/h) in a slight left turn. Naturally, this great speed of impact caused the airliner to disintegrate. The wreckage was so fragmented that it was difficult to tell whether any parts of the aircraft were missing. An air traffic controller noted that as the flight was cleared to FL230, he had briefly seen a second echo on his radar, remaining stationary behind the aircraft.[4] A farmer soon telephoned in, and it was discovered that the rear cargo-hold hatch beneath the floor, portions of the interior floor, and six passenger seats (still holding dead passengers) had landed in a turnip field near the town of Saint-Pathus, approximately 15 kilometers south of the main crash site. French investigators determined that the rear cargo hold hatch had failed in flight. When it failed, the cargo area decompressed, but not so in the passenger area above it. The difference in air pressure, several pounds per square inch, caused the floor to fail, blowing a section of the passenger cabin immediately above the hatch out through the open hatch. The control cables, which were beneath the floor, were severed, and the pilots lost control of the airliner's elevators, its rudder, and the number two engine. Without these controls, it was impossible to control the aircraft. Cause The passenger doors on the DC-10 are of the plug door variety, which prevents the doors from opening while the aircraft is pressurized. The cargo hatch, however, is not. Due to its large radius, the cargo hatch on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the hatch was swung outward, allowing cargo to be stored directly behind it. The outward-opening hatch allowed it, in the event of a latch failure, to be quot;
blown openquot;
by the pressure inside the cargo area. To prevent that, the DC-10 used a supposedly fail-safe latching system held in place by quot;
over top dead center latchesquot;
- five C-shaped latches mounted on a common torque shaft that were rotated over latching pins (quot;
spoolsquot;
) fixed to the aircraft fuselage. Due to their shapes, when the latches are in the proper position, pressure on the hatch does not place any torque on them that could cause them to open, and they actually further seat onto the pins. To ensure this rotation was complete and the latches were in the proper position, the DC-10 cargo hatch design included a separate locking mechanism that consisted of small locking pins that slid through holes on the back of the latches. When the locking pins were in place, any rotation of the latches would jam the pins against the fuselage, making further rotation impossible. The pins were pushed into place by an operating handle on the outside of the hatch. If the latches were not properly closed the pins could not enter the holes and the handle would remain open, visually indicating a problem. Additionally, the handle moved a metal plug into a vent cut in the outer hatch panel: if the vent was not plugged the fuselage would not retain pressure, eliminating any pneumatic force on the hatch. Also, there was an indicator light in the cockpit that would remain lit if the cargo hatch was not correctly latched. In 1972, American Airlines Flight 96, another DC-10, had its cargo hatch blow off in flight. In the ensuing investigation it was discovered that the handlers had forced the locking handle closed in spite of the fact that the latches had not rotated completely - because of an electrical problem. The incident investigators discovered that the rod connecting the pins to the handle was weak enough that it could be bent with repeated operation and some force being applied, allowing the baggage handler to close the handle with his knee in spite of the pins remaining out of their locking holes. Both the vent plug and cockpit light were operated by the handle or the locking pins, not the latches, so when the handle was stowed both of these warning systems indicated that the door was properly closed. In the case of Flight 96, the airliner was able to make a safe emergency landing as not all the underfloor cables had been severed, thus allowing the pilots limited control.see 'loading' In the aftermath of the Flight 96 incident, the NTSB made several recommendations. Its primary concern was the addition of venting in the rear cabin floor that would ensure that a cargo area decompression would equalize the cabin area, and not place additional loads onto the floor. In fact, most of the DC-10 fuselage had vents like these: it was only the rearmost hold that lacked them. Additionally, the NTSB suggested that upgrades to the locking mechanism and to the latching actuator electrical system be made compulsory. However, while the FAA agreed that the locking and electrical systems should be upgraded, the FAA also agreed with McDonnell Douglas that the additional venting would be too expensive to implement, and the FAA did not demand that this change be made. Although the DC-10 had been ordered three months after the service bulletin was issued, and it had been delivered to Turkish Airlines three months later, the changes required by the service bulletin had never been implemented. The interconnecting linkage between the lock and the latch hooks had not been upgraded. Through either deliberate fraud or oversight, the construction logs nevertheless showed that this work had been carried out. Mohammed Mahmoudi, the baggage handler who had closed the door on Flight 981, noted that no particular amount of force was needed to close the locking handle. Investigators concluded that the system had already been fatigued in prior flights. The fix that was implemented by McDonnell Douglas after the American Airlines flight 96 incident was the addition of a small window that allowed the baggage handlers to visually inspect the pins, confirming they were in the correct position, and placards were added to inform them of proper operation. This modification had been carried out on TC-JAV. However, Mahmoudi had not been advised as to what the indicator window was for. He had been told that as long as the door latch handle stowed correctly and the vent flap closed at the same time, the door was safe. Furthermore, the instructions regarding the indicator window were posted on the aircraft in English and Turkish, but the Algerian-born Mahmoudi, who could read and write three languages fluently, could not read either language. It was normally the duty of either the airliner's flight engineer or the chief ground engineer of Turkish Airlines to ensure that all cargo and passenger doors were securely closed before takeoff. In this case, the airline did not have a ground engineer on duty at the time of the accident, and the flight engineer for Flight 981 failed to check the door personally. Although French media members called for Mahmoudi to be arrested, the crash investigators stated that it was unrealistic to expect an untrained, low-paid baggage handler who could not read the warning sticker (due to the language difference) to be responsible for the safety of the aircraft. Aftermath The image showing the cargo door torn off The latch of the DC-10 is a study in human factors, interface design and engineering responsibility. The control cables for the rear control surfaces of the DC-10 are routed under the floor, so a failure of the hatch could lead to the collapse of the floor, and disruption of the controls. To make matters worse, Douglas chose a new latch design to seal the cargo hatch. If the hatch were to fail for any reason, there was a very high probability the plane would be lost. This possibility was first discovered in 1969 and actually occurred in 1970 in a ground test. Nevertheless, nothing was done to change the design, presumably because the cost for any such changes would have been borne as out-of-pocket expenses by the fuselage's sub-contractor,Convair. Although Convair had informed McDonnell Douglas of the potential problem, rectifying what the airline considered a small problem with a low probability of occurrence would have seriously disrupted delivery of the aircraft and cost sales so Convairs concerns were ignored. Dan Applegate was Director of Product Engineering at Convair at the time. His serious reservations about the integrity of the DC-10's cargo latching mechanism are considered a classic case in the field of engineering ethics. After Flight 981, a complete re-design of the latching system was finally implemented. The latches themselves were re-designed to prevent them from moving into the wrong positions in the first place. The locking system was mechanically upgraded to prevent the handle from being able to be forced closed without the pins in place, and the vent door operation was changed to be operated by the pins, so that it would properly indicate that the pins were in the locked position, not that the handle was. Additionally, the FAA ordered further changes to all aircraft with outward-opening doors, including the DC-10, Lockheed L-1011, and Boeing 747, requiring that vents be cut into the cabin floor to allow pressures to equalize in the event of a blown-out door. The name given to the crashed DC-10, quot;
Ankaraquot;
, is still used on an Airbus A340-300 (TC-JDL, MSN: 57) in Star Alliance Livery. Similar accidents Outward-opening cargo hatches are inherently not fail-safe. An inward-opening hatch (a plug door) that is unlatched will not fly open, because the difference in air pressure between the aircraft cabin and the air outside will seal the hatch shut. However, an outward-opening, non-plug type hatch needs to be locked shut to prevent any unwanted opening. This makes it particularly important that the locking mechanisms be secure. American Airlines Flight 96experienced the same problem before the accident of flight 981 happened, but the NTSB's recommendations to prevent it from happening again were not implemented by any airline. As a result, now whenever the NTSB comes up with recommendations to prevent certain accidents from happening, they talk to the FAA, consequently, FAA will issue an Airworthiness Directive to help prevent certain types of accidents from happening. Aircraft types other than the DC-10 have also experienced catastrophic failures of a hatch. The Boeing 747 has experienced several such incidents, the most noteworthy of which occurred aboard United Airlines Flight 811 in February 1989, when the cargo hatch failed and caused a section of the fuselage to fail, causing the deaths of nine passengers who were expelled from the aircraft. A somewhat similar problem led to a cockpit window's being blown out of British Airways Flight 5390.

DC-10 Cargo Door Crash Kills 346 in Paris

Recommended

Recommended

More Related Content

What's hot

What's hot (9)

Viewers also liked

Viewers also liked (6)

Similar to DC-10 Cargo Door Crash Kills 346 in Paris

Similar to DC-10 Cargo Door Crash Kills 346 in Paris (20)

DC-10 Cargo Door Crash Kills 346 in Paris