1. 1
DC-10 Problems
Whose Responsibility?
Glenn C. Graber Christopher D. Pionke
Philosophy Mechanical, Aerospace & Biomedical Engineering
1974 – Paris – DC-10 Ship 29
• Turkish Airlines – 346 passengers
• 10,000 feet
• Cargo door failed, floor of passenger
compartment collapsed
• All hydraulic & electrical connections
were severed
• Airplane uncontrollable
• Plane crashed
• All aboard were killed
What Went Wrong?
Who is Responsible?
2. 2
Design Process
• In designing the airframe,
McDonnell-Douglas chose to
make the DC-10 much like the
older DC-8 and DC-9, two very
successful and safe aircraft.
– PRO: sped up design process;
• fitted “an oft-stated company policy of
technological caution”
– CON: question as to whether same
principles apply to wide-body aircraft
“technological caution”
Quotes from McDonnell-Douglas
company literature expressing this
aspect of corporate culture:
– “Be not the first by whom the
new are tried / Nor yet the last
to lay the old aside.”
(Alexander Pope)
– “Pioneering don’t pay.” (Andrew
Carnegie)
More Info About Process
• The DC-10 engineers were constrained by
management to use the existing airframe
technology (which was not necessarily adequate
for an aircraft the size of the DC-10)
• Both Boeing and Lockheed had made several
advancements in their airframe structural
designs for the 747 and the L-1011,
respectively.
• These design advances were not proprietary
• So one might argue that the accepted
engineering practice for building a jumbo jet
was significantly different from what McDonnell-
Douglas was doing. (Fledderman, 76)
Another opinion:
“There are a few points on which most
experts agree, however:
– the DC-10 is fully airworthy in the
sense that it meets all federal
standards for airworthiness;
– from a statistical point of view, it
has been, like the other jet-powered
aircraft, a very safe airplane; . . .
– and the airlines that operate DC-10s
appear satisfied that it does the job
for which it was intended” (Newhouse, 2, p.84)
3. 3
Airworthiness
“If in inspecting an airplane, the
F.A.A. sees a need to repair or
modify something, it issues what is
called an airworthiness directive.
Once issued, such a directive has the
force of law.” (Newhouse, 2, p. 84)
83 directivesDC-10
56 directives747
58 directivesL-1011
As of May 25, 1982, McDonnell-Douglas was well ahead:
“In most ways that matter to airlines, the DC-10 is
similar and does not compare unfavorably with the
other wide-bodies.”
Cargo-Door Latching System
• 3 choices: Plug design / Hydraulic / Electric
– Plug (DC-9) infeasible for larger door
– Electric
• Lighter, fewer parts, easier to maintain
• Exerts pressure only when switched on; irreversible
• If it fails to close completely, it holds more securely
• but more catastrophic failure – sudden
depressurization at high altitude
– Hydraulic
• Heavier, more parts, harder to maintain
• Continually exerts pressure; not irreversible
• If it fails to close completely, more frequent failures
• but less catastrophic failures – less violent
depressurization at much lower altitude
Cargo-Door Latching System
• McDonnell-Douglas went with the
electrical system
– Failure less likely
– More catastrophic if it does fail
4. 4
Passenger Floor Supports
• Followed DC-9 format for number of floor
supports.
• In retrospect, this was relatively few floor
supports given the wide-bodied nature of
the plane.
• WHY? The principle of “technological
caution,” together with severe financial
straits of the company “was apparently
interpreted by its engineers to dictate that
corners be cut and existing Douglas
technology be used, even if it meant that
some systems that were rejected as inferior
by its competitors would be designed into
the DC-10.” (French, 6)
Redundancies of hydraulic & electrical systems
• DC-10: 3 redundant systems
– Both competitors had 4 systems
– How many redundancies becomes a
waste?
• Location of systems
– DC-10: all 3 systems ran in parallel
under the cabin floor
– Boeing: control lines run through the
ceiling above the cabin
FMEA Report
(Failure Mode and Effects Analysis)
One of nine possible failure sequences that
could result in life endangering hazards:
Door will close and latch, but will not
safety lock. Indicator light will indicate
normal position. Door will open in flight--
resulting in sudden depressurization and
possibly structural failure of floor; also
damage to empennage by expelled cargo and/or
detached door. Class IV hazard in flight.
– “Class IV hazard” = possible loss of life
– “empennage” = tail assembly
This report was never submitted to the FAA
Ship 1 (1970)
• the prototype ship was undergoing
standard pressurization tests
• on the ground outside Long Beach
plant
– The cargo door blew and
– The cabin floor collapsed
5. 5
1972 – Windsor, Ontario
• Cargo door failed in flight
• Floor of passenger cabin buckled
• Several (but not all) of the hydraulic
lines were severed
• Pilot maintained control of plane and
landed safely
Remediation (?) after Windsor
• Agreement reached with FAA for
modification of cargo doors
• July 1972 – Ship 29 to Long Beach
“The plant records for July 1972 indicate
that three inspectors stamped the work
records for Ship 29 to indicate the
modifications had been completed and that the
plane was in compliance with FAA guidelines.”
• None of the work had actually been
done
Stated Company Policy
“You are responsible for any work that
your stamp appears on record for
accepting.”
Actual Company Practice
• One of the inspectors explained the
presence of his stamp by saying “it was
high summer” and he probably became
confused.
• The other 2 offered no explanation at all.
• Corporate executives rushed to deny any
responsibility for seeing that the work
was actually done
6. 6
French’s Analysis:
• “the McDonnell-Douglas system . . . Is
fundamentally weak and easily compromised by
employees who have fallen into a rather
automatic pattern of behavior encouraged by
that company policy and procedure.” (French, 9)
• “The evidence supports the view that over the
years McDonnell-Douglas established an
inspection procedure that invites or tempts
inspectors to be lax and careless and some of
the inspectors, either through inadvertence
or because of conditioning to laxness,
cursorily performed tasks that, given the
basically poor design of the aircraft, called
for the closest attention to detail to insure
safety.” (French, 9)
Who’s to blame? French says:
• “The actions of the three inspectors
are not excusable . . .
• but it would be a grand offense to
our moral intuitions . . . to hold
these inspectors primarily
responsible for the crash of Ship 29.
• We are brought back to the principal
actor in the design, manufacture, and
sale of Ship 29, McDonnell-Douglas
Corporation.” (French, 10)
Corporate, not Individual Responsibility
Two Speculative Scenarios:
1. “invites or tempts” – Inspectors hear
management complain frequently about
government mandates, expressing the
view that the modifications ordered are
meaningless and make no difference with
regard to safety.
2. The company’s financial straits leads to
cutting several personnel lines for
inspectors. Those remaining are given
heavier workloads than they can possibly
carry out. When they complain, they are
told “Do the best you can.”
Bibliography
• Peter French, “What is Hamlet to
McDonnell-Douglas or McDonnell-Douglas to
Hamlet?” Business & Professional Ethics
Journal vol. 1, no. 2 (1982), pp. 1-13.
• Daniel A. Vallero, and P. Aarne Vesilind.
Socially Responsible Engineering Justice in
Risk Management. (Hoboken, NJ John Wiley
& Sons, 2007), pp. 66-71.
• Charles B. Fleddermann. Engineering Ethics.
(Upper Saddle River, NJ Prentice Hall,
1999).
7. 7
Bibliography (2)
John Newhouse, “A Reporter at
Large: A Sporty Game,” The
New Yorker
1. “Betting the Company” – June 14,
1982 (pp. 48-105)
2. “Turbulent” – June 21, 1982 (pp. 46-
93)
3. “Big, Bigger, Jumbo” – June 28,
1982 (pp. 45-86)
4. “A Hole in the Market” – July 5, 1982
(pp. 44-89)
Webography
• Applying Lessons Learned from
Accidents: Turk Hava Flight TK981, DC-10, Paris
http://faalessons.workforceconnect.org/l2/Turk/
• Aviation Safety Network
http://aviation-safety.net/database/type/type.php?type=352
