The entry says that the DC-10’s cargo door could be apparently closed when it was not closed, and that two inquiries found out how. This piece follows the mechanism part by part, and then the first set of tests, the Safety Board’s at the Douglas plant after Windsor. The second set, the French Commission’s, is in the companion piece “The new door”. Everything quoted here is from the Board’s report of February 1973.
Outward
The aft bulk cargo compartment of the DC-10 is the last of three holds under the passenger floor, behind the wing, on the left side of the fuselage. Its door is in the lower curve of the hull. A passenger door on an airliner is a plug: it is bigger than its hole and opens inward first, so that the pressure of the cabin pushes it harder into its frame the higher the aircraft climbs. A cargo door low in the hull cannot do that, because the hold behind it is packed to the roof. It opens outward, and so the whole of the cabin pressure, which at the heights where these two doors opened was between four and a half and five pounds on every square inch of the door, works to open it. Everything about the door’s design was an answer to that.
The answer had four parts, in sequence.
The first was the latches. Along the lower edge of the door were four hooks, which the Board’s drawing calls latches and the Commission calls latch hooks. On the sill of the doorway were four spools. When the door swung down and shut, an electric actuator, a screw-jack driven by a motor, turned a torque tube inside the door, and cranks on the tube rotated the four hooks down over the spools. The hooks were designed to travel past the centre of their arc, over-centre. Once they were over-centre the load on the door, instead of pushing the hooks open, pushed them against fixed stops in the door structure, and the whole chain from hook to actuator was, in the Commission’s word, irreversible: the pressure could not drive it backwards. If the hooks stopped short of over-centre, the chain ran the other way. The force on the hooks was passed back to the actuator instead of into the stops, and the actuator, a screw that cannot be back-driven, passed it into the two bolts that held its fixed end to the door. Those were titanium bolts a quarter of an inch in diameter. They were the weakest link by accident, because nobody had designed them to carry that load.
The second part was the lock. Behind each hook’s crank was a flange, and inside the door, parallel to the torque tube, ran a sliding lock tube with four pins on it. Pushed to the locked position, the tube put a pin behind each flange, so that the hooks could not rotate back whatever happened to the actuator. The maintenance manual’s rule of adjustment was that in the locked position each pin should protrude 6.35 millimetres, a quarter of an inch, beyond the rear face of its flange; in the unlocked position its end should stand no more than two millimetres from the front face. The pins could only go home if the hooks were over-centre, because until then the flanges stood in their way. That was the point of them. A pin that would not go in was the sign that the latch had not gone round.
The third part was the handle and the vent door. The lock tube was moved by a handle on the outside of the door, through a link, a shaft, a bellcrank and a push rod. The same shaft carried the vent door, a small flap in the big door. With the handle up, the vent door stood open; pulling the handle down to its stowed position closed it. The design intention was that if the pins were stopped by the flanges, the handle could not come down, the vent door could not close, and the aircraft could not be pressurised, because the hold would breathe through the open vent. The Board’s recommendation letter of July 1972 says what should have been true: “With the lock-pins not engaged, a small vent door on the cargo door should have remained open, preventing normal pressurization of the aircraft. Also, the vent door handle should not have stowed.”
The fourth part was the light. A switch at the end of the lock tube, the lock limit warning switch, was struck by the tube when it reached the locked position and broke the circuit to a light on the flight engineer’s panel. While the light was on, a door was unlocked. When it went out, every cargo door was locked. There were other switches on the door, for the actuator’s limits and for the cockpit call, but this was the one that told the crew.
So the door gave four signs, and in a correctly rigged door each depended on the one before: no lock without over-centre, no handle without lock, no pressure without handle, no dark light without lock. The experiment of 1972 to 1974 was the discovery of how many of them could be false at once.
What the wreckage said
The Windsor door was recovered from a field several miles from Detroit’s airport, with about eighty per cent of its skin still hanging on the hinge in the aircraft. The Board’s investigators found it “with the four latches nearly closed, with the lockpins not engaged, with the vent door overtraveled beyond the open position and with the door handle in the stowed position.” The hooks were about three-sixteenths of an inch from fully closed; their cranks were 0.35 of an inch short of the over-centre stops. The link from the handle to the torque tube had broken in tension near its lower end, and the two broken ends were several inches apart and could not be pulled together. The torque tube was bent. The bellcrank that turned the handle’s vertical motion into the lock tube’s horizontal motion had broken at its pivot. The forward end of the lock tube was bent outboard, and the door frame was partly fractured where it had bent.
The actuator was taken to its manufacturer. Its extend limit switch was found closed; worked by hand until the switch opened, the unit measured 11.777 inches fully extended and 9.959 retracted, and it had been recovered at 11.040: the latches had been driven most of the way and no further. Under a test load, with a new motor, it crept slowly at 1,500 pounds and 13 volts, and crept at 2,600 pounds and 18 volts; its clutch was set at 2,900. The original motor had separated and was never found. The actuator’s support bracket was in place but its two bolts were sheared, and the paint on the bracket carried chafe marks that showed it had moved 1.05 inches against its mount: the record of a door that had been pushed from outside, through the hooks, through the linkage, into the bolts, by the air inside the aircraft. Brinelling on the bushing of the actuator’s attachment lug showed the same. The Board’s arithmetic was that with the cranks 0.47 of an inch short of their stops, as the manufacturer said they would have been for that extension, a pressure difference of about 4.5 pounds per square inch across the door would have been enough to fail two fasteners with an ultimate shear strength of 6,600 pounds, and that the figure was approximate, “since redundancy of the system, tolerances, deflections, and variances in rigging can all affect the load transmitted through the mechanism.”
Why had the actuator stopped short? The Board’s finding was low voltage at the motor, the condition that Service Bulletin 52-27 of 30 May 1972 had been issued to cure, by heavier wire between the circuit breakers and the actuators. The bulletin’s own text said why it was needed: three operators had reported that the actuators failed to latch or unlatch the doors, “attributed to an excessive voltage drop reducing the output torque to the actuator,” and “failure to provide adequate torque necessitates manual latching/unlatching of the doors resulting in flight delays.” American had not done it. Nothing required them to.
The two tests
Two tests were then run at Douglas Aircraft, and they are the heart of the Windsor report.
In the first, the investigators asked whether a DC-10 could be pressurised with the vent door open. It could, up to a point: the nylon baggage curtain that hung inside the hold, “acting as a seal enveloping the vent door cage,” held about five pounds per square inch, and “above 5 p.s.i., the curtain was sucked into the vent door cage and pressurization was lost.” The vent, in other words, might not vent, if the hold was full.
In the second, they rigged a door as the Windsor door had been and tried to stow the handle with the pins out. “The second test revealed that the force required to stow the handle was approximately 120 pounds. When the door linkage was forced overcenter, the locking pins did not engage. It was noted further that the sliding lock tube was deflected, and the cap end made contact with the cockpit door warning indicator actuating arm. The indicator switch can be actuated with less than one-eighth inch travel of the actuating arm.”
The Board put the sentences together in its analysis. The lockpins could not have engaged, “since the latches did not attain their fully closed positions, and the door handle should not have stowed.” The ramp agent had said the handle did not close normally and that he had forced it with his knee. The test showed that the handle “could actually be stowed without the lockpins in place if a force of 120 pounds was applied to the handle. Deflection of the mechanism permitted this to happen. The same deflection might have permitted the pilot indicator switch to make contact, which, in this system, prevents illumination of the cockpit warning light. Thus, the crew had no warning that the door mechanism was not functioning properly.” The four signs had collapsed into one. A bent lock tube closed the vent door, stowed the handle and put out the light together, and all it needed was a man who wanted to go home.
What the Board asked for, and what it got
The Board’s recommendation A-72-97 followed from the second test, and its word was “physically”: a modification “to make it physically impossible to position the external locking handle and vent door to their normal door locked positions unless the locking pins are fully engaged.” Service Bulletin 52-37, which Douglas dated 3 July 1972, answered with a support plate, a bracket behind the vent-door shaft that the Commission later described as “designed precisely to prevent such deformation.” It also replaced the strike plate and adjusted the switches. Alert Bulletin A52-35, of 19 June, had already added the inspection window beside the handle, through which the pin’s position could be seen, with a placard telling the handler to look.
None of these changed the principle. They stiffened the chain and added an eye at the end of it. The change of principle, the “closed loop” that would not let the aircraft pressurise unless the door was locked, was Service Bulletin 52-49, dated 25 October 1973, and it was not compulsory until 22 March 1974. By then the Commission in France had a new door on a bench, and was measuring how little force the stiffened chain needed when its plate was missing and its pins were set short. That is the next piece.