The entry says that the correction after Windsor went out as a manufacturer’s advice instead of a government’s order. This piece sets the documents of 1972 and 1973 in order: what each said, who signed it, and what it bound. The companion piece “The directive” takes the paper on from March 1974. The Safety Board’s letter and the FAA’s reply are from the Windsor report; the bulletins’ dates and contents are from the airworthiness directive that eventually made them compulsory; the letters on the floor and the Administrator’s letter of March 1974 are known here only as the Washington Post reported them, in two articles that Senator Vance Hartke had printed in the Congressional Record on 28 March 1974.
Before Windsor: Service Bulletin 52-27
A service bulletin is a manufacturer’s document to the operators of its aircraft. It describes a change, gives a reason, and may call itself an alert; it binds no one. Douglas issued Service Bulletin 52-27 on 30 May 1972, thirteen days before Windsor, and the Safety Board printed its reason: “Three operators have reported failure of the electrical latch actuators to latch/unlatch the cargo doors. Latch actuator failure is attributed to an excessive voltage drop reducing the output torque to the actuator. This condition may prevent electrical latching/unlatching of the hooks. Failure to provide adequate torque necessitates manual latching/unlatching of the doors resulting in flight delays. Increasing the wire gage between the circuit breakers and the actuators will reduce the voltage drop and provide adequate torque to operate the latch hooks under all anticipated conditions.” The bulletin’s subject, in other words, was delay. The Board’s tenth finding on Windsor was that the latches had not gone over-centre and that “this condition was attributed to low voltage to the latch motor,” and its eleventh that “a service bulletin to correct this condition was in effect at the time of the accident, but the recommended modification had not been incorporated.”
June 1972: the draft directive and the appeal
By the Post’s account, which it attributed to documents it had obtained and to the FAA’s Western Region director, Arvin Basnight, the region “four days after the Canadian incident” drafted the first of what were to be several airworthiness directives to prevent a recurrence. An airworthiness directive is a regulation. It is adopted under the Federal Aviation Act, published in the Federal Register, binds every United States operator of the type on pain of grounding, and is sent by right to the governments of foreign operators. It was not issued. The Administrator at the time, John H. Shaffer, “could not be reached for comment” by the Post in March 1974; the account of what happened is his successor’s, Alexander P. Butterfield’s, in a letter to the Safety Board’s chairman John Reed that week, which the Post quoted: the FAA drafted a directive “a few days after the Canadian incident,” but “upon appeal to the administrator by the manufacturer, a decision was made to forego the issuance of ADs and, instead, to seek the modification of the cargo compartment door latching mechanism through voluntary compliance by operators with McDonnell-Douglas service bulletins.” The Post added that the language of the bulletin, “and in an FAA telegram to the airlines, was the same as in the scrapped directive but it merely specified rather than legally requiring the modifications.”
Basnight, under subpoena to the two congressional subcommittees and declining to say who had recalled his order, told the Post the difference in one breath. An airworthiness directive “has the force of law, and it invokes the FAA’s inspector personnel to check it,” while on a service bulletin the FAA’s inspectors “may do it, but are not required to do it. For foreign airlines, an AD is not mandatory, but it must be sent to the governments of all airlines operating a particular aircraft while a service bulletin does not have to be provided to the foreign government.”
19 June to 3 July 1972: the three bulletins
The documents that went out instead were three.
Alert Service Bulletin A52-35, dated 19 June 1972: “Install inspection ports and placards in all cargo doors and perform functional check of door systems and operation.” This was the window beside the handle through which the lock pin’s position could be seen, and the notice telling the handler to look.
Service Bulletin 52-27, dated 30 May 1972, the wiring, now given a second purpose: “Modify all cargo door latch actuator wiring.”
Service Bulletin 52-37, dated 3 July 1972: “replace the strike plate and adjust the switches on all forward, center, and aft cargo doors and install a support and plate on the aft cargo door.” The support plate was the bracket behind the vent-door shaft that Windsor had shown to be wanting, the one modification of the three that addressed the force of a man’s knee rather than the eye that might catch its result.
These descriptions are the FAA’s own, from the directive that incorporated the bulletins in 1974; the bulletins themselves were not seen for this entry. Two more followed that year and the next which the directive also swept up: Service Bulletins 52-43 of 6 October 1972 and 52-44, revised 14 August 1973, on the door warning system’s wiring, the second of which gave the operator a light to show that the actuator’s shaft had reached the end of its travel; and 52-54, revised 14 April 1973, covers for the door’s limit switches. And on 25 October 1973 Douglas issued Service Bulletin 52-49, the rework of the latching and warning system that the FAA would call the closed loop, which would not let the aircraft pressurise unless the door was locked. It was revised on 15 March 1974, twelve days after Ermenonville.
23 June and 6 July 1972: the Safety Board’s letter
The Board adopted its recommendations on 23 June and issued them on 6 July, to “Honorable John H. Shaffer, Administrator.” The letter is short enough to give nearly whole.
“The National Transportation Safety Board is investigating an accident involving an American Airlines McDonnell Douglas DC-10-10, N103AA, which occurred shortly after takeoff from Detroit Metropolitan-Wayne County Airport on June 12, 1972. The aft left-hand cargo door opened while the aircraft was at approximately 12,000 feet. The cabin floor over this cargo compartment then failed as a result of depressurization loading, and the floor dropped partially into the cargo compartment. This displacement of the floor caused serious disruption of the control cables which are routed through the floor beams to the empennage control systems and the engine controls. With the exception of the right rudder pedal cable, all of the cables on the left side of the fuselage broke. The cable runs on the right side were also damaged—the cable guides tore from their attachments to the floor beams, and the cables were deflected downward by the floor structure.
“Preliminary investigation has revealed that the door latches were not driven fully closed, and the lock-pins which should have prevented the latches from opening were not in place. The reason these door latches were not driven over center to the fully closed position has not yet been determined. However, although the Safety Board believes this was relevant and a contributing factor, we are more concerned over the failure of the door safety features to preclude dispatch with an unlocked door. The design of the door should have precluded the dispatch of the aircraft with this door improperly closed. With the lock-pins not engaged, a small vent door on the cargo door should have remained open, preventing normal pressurization of the aircraft. Also, the vent door handle should not have stowed.
“However, tests conducted at Douglas Aircraft Company have demonstrated that the vent door can be closed, and the handle stowed, without the lock-pins engaged. Apparently, some combination of deflection of the operating mechanisms and tolerances permitted such operation when a force of approximately 120 pounds was applied to the operating handle. During these tests our investigator observed bending of the sliding lock-tube which caused the cap end of the tube to make contact with the pilot indicator switch actuating arm. This arm moves through a very small arc to actuate the switch, and the Board believes that a similar contact on the accident aircraft door probably actuated the switch and gave the pilots a door safe indication on the annunciator light panel.
“Finally, the Board believes that sudden loss of pressure in this cargo compartment for any reason should not jeopardize the safety of the flight. In this case, the loss of the door and resultant cabin floor failure caused an unwanted rudder input, severely restricted the elevator control available to the crew and disrupted the No. 2 engine controls.
“We are aware of the inspection procedures currently in effect to ensure safety of operations of the DC-10 as well as the existing safety features of the door design. Nevertheless, in order to preclude the recurrence of similar accidents, the Safety Board recommends that the Federal Aviation Administration:
“1. Require a modification to the DC-10 cargo door locking system to make it physically impossible to position the external locking handle and vent door to their normal door locked positions unless the locking pins are fully engaged.
“2. Require the installation of relief vents between the cabin and aft cargo compartment to minimize the pressure loading on the cabin flooring in the event of sudden depressurization of the cargo compartment.”
The two recommendations were numbered A-72-97 and A-72-98. Each begins with the word “Require.”
7 July 1972: the Administrator’s reply
Shaffer’s answer, dated 7 July 1972 and printed by the Board beside its letter, is four paragraphs.
“This is to acknowledge your Safety Recommendations A-72-97 and 98 issued on 6 July 1972 which included recommendations resulting from an inadvertent cargo door opening reported on a Douglas DC-10-10 airplane.
“All operators of DC-10-10 airplanes are currently performing 100 hour functional checks on the cargo door system and will incorporate necessary modifications in accordance with McDonnell Douglas Service Bulletins 52-27 and A52-35 within 300 hours. These modifications pertain to improvements in the inspection and operation of locking and vent mechanisms.
“Additional modifications to the cargo door locking and pressurization systems are being considered as part of a continued investigation effort. While a preliminary investigation indicates that it may not be feasible to provide complete venting between cabin and cargo compartments, your recommendations will be considered with respect to further action taken.”
The reply does not use the word “require,” and it does not mention a directive. “Will incorporate” is a prediction about operators who were under no obligation. The Board, printing both letters in its report seven months later, let them stand without comment beyond the sentence in its narrative that no directive on DC-10 cargo doors had been in effect on 12 June 1972.
February 1973 to February 1974: the floor by letter
The second recommendation went nowhere in writing for a year and then went by correspondence, which the Post summarised and quoted from and which the entry can give only at that remove.
On 2 February 1973 the FAA wrote to the chief engineer of the aircraft’s manufacturer: “We believe the loss of an airplane because the floor collapses under such conditions and disrupted vital systems, would be unacceptable.”
On 15 March 1973 McDonnell Douglas answered that there would need to be “a considerable increase in floor and fuselage weight” if the aircraft were redesigned against the possibility of a large cargo door opening, cutting down either the passengers or the cargo it could carry. “In our opinion, this is unwarranted, due to the excellent safety record of structure in service aircraft.”
On 13 February 1974 the FAA asked more specifically for information on the feasibility of some kind of venting arrangement.
On 25 February 1974 McDonnell Douglas replied that it was not “in a position to accept this burden alone” of undertaking the study the FAA was requesting, that the “questions involve the whole transport aircraft industry,” and that it suggested “the FAA consider the possibility of funding this study because of the magnitude of the effort required.” The letter ended: “We will not plan any further action on your Feb. 13, 1974, letter until we hear from you further.”
The Post’s sentence after that one is: “Six days later the Paris crash occurred.” The company’s answer to the Post, through the president of its Douglas division, John C. Brizendine, was that there was no connection between its February correspondence and the accident: “To imply that a different response on our part could have prevented the tragedy is both irresponsible and malicious.” The company’s statement also said that after Windsor it “took immediate action to make the cargo door latching mechanism failsafe, regardless of human error or abuse of the mechanism.” What the directive of March 1974 then made of these documents is the next piece.