At about 10:35 on the morning of Sunday 3 March 1974, by Greenwich time, a cargo handler employed by a contractor at Orly airport, south of Paris, closed the aft cargo door on the left-hand side of a Turkish Airlines DC-10. The door had been opened to take out 915 kilograms of baggage and 335 kilograms of mail. Nothing went in. The handler’s name was Mahmoudi. He told the French inquiry afterwards that “he proceeded as usual, without any particular difficulties, and that he did not notice any abnormality.” He also said that he did not look through the small window set in the door beside the handle, “a procedure which he had seen but which he never carried out himself and the purpose of which he did not know.”

The window had been there for about twenty months. It had been put into every DC-10 in the world after June 1972, when the same door on an American Airlines aircraft had opened at 11,750 feet over Windsor, Ontario, and the cabin floor above it had fallen into the hold. The window was small. Behind it, if the door was locked, a lock pin could be seen lying behind its latch. If the door was not locked, the pin was not there. Nobody at Orly looked.

The aircraft was fuselage number 29 of the DC-10 line at Long Beach, California, delivered to Turkey fifteen months before. Its registration was TC-JAV. The manufacturer’s bulletin that ordered a plate to be fitted behind the door’s handle, so that the handle could not be forced down when the pins were not in, did not list it.

Who ran it

The DC-10 was built by the Douglas Aircraft Company division of the McDonnell Douglas Corporation at Long Beach, in competition with the Lockheed TriStar for the same airlines in the same years. The fuselage, with its doors, was subcontracted to the Convair division of General Dynamics at San Diego. The aircraft at Windsor, N103AA, had been handed over to American Airlines on 28 July 1971 and had flown 2,142 hours by the following June.

The United States government was in the story three times over. The Federal Aviation Administration certificated the aircraft and could make a correction compulsory by an airworthiness directive, which has the force of law for every American operator and goes by right to the government of every other country whose airlines fly the type. Its Administrator in 1972 was John H. Shaffer; its Western Region at Los Angeles, which dealt with Douglas, was run by Arvin O. Basnight, with Richard S. Sliff as chief of its aircraft engineering division. The National Transportation Safety Board, under its chairman John H. Reed, investigated accidents and recommended, and could compel nothing. And when the second aircraft fell, two subcommittees of Congress, the Senate’s on aviation and the House’s special subcommittee on investigations, asked how the first had been dealt with.

In France the Minister for Transport appointed a Commission of Inquiry by decree on 4 March 1974, the day after the crash, under René Lemaire, head of the Inspectorate of Civil Aviation, with Jean Forestier as vice-president. Representatives of the United States and Turkey took part under the Chicago Convention; Britain and Japan, which had lost the most passengers, were allowed observers.

What they were trying to find out

A cargo door low in a pressurised fuselage cannot be made to open inward, as a passenger door does, because the hold is full. It has to open outward, and then the whole pressure of the cabin, four or five pounds on every square inch of it at height, is trying to open it. The DC-10’s designers answered this with a mechanism in four parts. Four hooks on the lower edge of the door were driven by an electric actuator over four spools on the door sill; when the hooks had gone past the centre of their travel, over-centre, as the engineers say, the pressure on the door held them shut instead of pushing them open. A sliding tube inside the door then put a lock pin behind each hook, so that the hooks could not move whatever happened. The tube was moved by a handle on the outside of the door, and the same handle closed a small vent door, a flap in the big door, which was meant to stay open unless the pins were home, so that an aircraft with an unlocked cargo door could not be pressurised at all. A switch at the end of the lock tube turned off a warning light in the cockpit.

The hypothesis was in the design: that the door could not be apparently closed unless it was actually closed. If the latches had not gone over-centre, the pins could not go in; if the pins were not in, the handle could not be stowed and the vent door would stay open; if the vent door was open the aircraft would not hold pressure; and in any case the light would stay on. Four independent signs, and a man on the ramp need only read one of them. The companion piece “The door” follows the mechanism part by part, and the tests the two inquiries made on it.

There was a second claim folded into the first. The cabin floor over the aft hold was not vented to it. If the hold lost its pressure suddenly, the floor would carry the whole difference, something over three tonnes on every square metre, and the cables that moved the elevators, the rudder and the tail engine all ran through the floor beams at that point. The design assumed the door would not open. The floor was built on that assumption, and it was the floor, not the door, that would decide whether anyone lived.

The first claim had been tested on the ground before the aircraft was certificated, and had failed. Sliff told a reporter in March 1974 that a faulty early version of the door caused the floor of a test aircraft to collapse during pressurisation tests, that the door would “blow off the test article” at about five pounds per square inch, and that “the structure above the door—the floor—deformed toward the door.” The door was redesigned before certification, and the floor was not. From then on the test was the fleet.

What they built

By the summer of 1972 the DC-10 had been in service a year, and its cargo doors were already a nuisance. Three operators had reported that the electric actuators could not always drive the latches home, because the voltage dropping along the wiring left the motors without enough torque; the latches then had to be worked by hand with a flexible drive, and flights were delayed. On 30 May 1972 Douglas issued Service Bulletin 52-27, recommending heavier wire between the circuit breakers and the actuators. A service bulletin is the manufacturer’s advice to its customers. It is not law. American Airlines had not done it by 12 June. Nothing required them to.

Thirteen days after that bulletin, the door spoke.

Flight 96

American Airlines Flight 96 was a DC-10 from Los Angeles to New York by way of Detroit and Buffalo. It reached Detroit at 6:36 in the evening of 12 June 1972, Eastern Standard Time, with fifty-six passengers aboard and a crew of eleven. The last compartment to be closed before the flight was dispatched was the aft bulk cargo compartment.

The National Transportation Safety Board’s report tells what happened at the door in three sentences. “The ramp service agent who serviced the aft cargo compartment had difficulty closing the door. He stated that he closed the door electrically. He listened for the motor to stop running and then attempted to close the door handle.” The handle would not go down with normal force, so he put his knee to it. “This caused the handle to stow properly, but the vent door was closed in a slightly cocked position. The agent brought this to the attention of a mechanic who gave his approval for release of the aircraft.” The flight left the ramp at 7:11 with the door in that condition. The cargo-door light in the cockpit, the flight engineer said, never came on.

In command was Captain Bryce McCormick, fifty-two, with 24,043 hours of flying behind him and fifty-six of them in the DC-10. The first officer, Peter Whitney, thirty-four, was flying the aircraft; the flight engineer was Clayton Burke, fifty. Flight 96 took off from Runway 3 Right at 7:20, was cleared up to 21,000 feet, and handed to the Cleveland centre. At about 7:25, climbing through 11,750 feet at 260 knots, over the Canadian side of the river, the crew “heard and felt a definite ‘thud.’” Dust and dirt flew up into their faces. The three thrust levers came back to idle and the aircraft yawed to the right. The captain, the report says, “lost his vision momentarily; he thought that a midair collision had occurred and that the windshield had been lost.”

The cockpit voice recorder has the thud as a “sound of high amplitude noise” at 24 minutes and 37 seconds past the hour, by Greenwich time, and the captain’s first words: “What the hell was it?” “We’ve hit something,” the flight engineer said. “We’ve lost, lost an engine here,” said the first officer. “Which one is it?” “Two.” Number two was the engine in the tail. McCormick disconnected the autopilot and took the controls, and kept them for the rest of the flight.

What had happened was this. The latches had never gone over-centre. As the cabin pressure rose, the load on the four hooks had passed back through the linkage to the two bolts holding the actuator, instead of into the stops, and at about four and a half pounds per square inch the bolts broke. The hooks sprang off their spools; the door swung out into the airstream, tore, and fell into a field several miles from the airport, hitting the left tailplane on its way. The hold lost its air in a moment. The cabin above did not, and the floor of the aft lounge, nine beams of it, broke on the left side, bent on the right, and dropped into the hold. No passenger was sitting there. The two flight attendants at the rear exits were thrown to the floor as it went.

The cables ran through those beams. Both left elevator cables parted. The right rudder cable was stretched tight by the fallen floor and the pedal jammed beyond its stop, so that the aircraft flew with the rudder deflected and the captain’s foot on a pedal that did nothing. The cables to the tail engine’s throttle and fuel shut-off failed, and the engine ran down. Almost everything that passed through that floor was damaged.

At 25 minutes and 51 seconds the first officer told the Windsor controller they were holding 12,000 feet, and when the controller asked the type of emergency the captain answered: “We have a control problem, we have no rudder, got full jam, we’ve had something happen, I don’t know what it is.” A minute and a half later: “I got a hole in the cabin, I think we’ve lost number two engine, we’ve got a jammed rudder full left rudder and we need to, ah, get down and make an approach, I guess Detroit Metro would be the best and, ah, can you vector us around?” “I have no rudder control whatsoever,” he added, “so our turns are gonna have to be very slow and cautious.”

The first officer, at 28 minutes and 33 seconds, said the thing that saved them. “Okay we’ve got full control on this though, however, so I guess we’re slow enough so we can probably use differential directions with engines.” The aircraft would turn, if the wing engines were pushed unequally. The elevator answered, but only to heavy force from both pilots, and they flew the approach without trim, because the indicator was dead. The captain asked for a long final so that the turns could be gentle, did not dump fuel, because he did not know what was damaged in the tail, and brought the aircraft down at 160 to 165 knots with its nose so flat that at touchdown he doubted the wheels were out. “I have no rudder to straighten it out with when it hits,” he said a minute before landing.

Flight 96 touched down at 7:44, 1,900 feet along Runway 3 Left, and swerved to the right at once. McCormick put both wing engines into reverse; Whitney pulled the right one out of reverse and the left into full reverse, and that gave them the direction back. The aircraft stopped 8,800 feet from the threshold with its right main gear on the grass, and the cabin was emptied down the slides in about thirty seconds. Nine passengers and two stewardesses had minor injuries. The companion pieces “The cockpit” and “The cabin” give the flight from the ramp to the slides as the crew, the attendants and the recorder told it.

The Board commended the flight crew “for the manner in which they successfully coped with the unusual in-flight emergency.” It then said what the emergency had been. The door had been found with its four latches nearly closed, its lock pins not engaged, its vent door jammed open beyond its normal travel, and its handle in the stowed position. At Douglas Aircraft the investigators had a door rigged as the Windsor door had been and tried to stow the handle with the pins out. “The force required to stow the handle was approximately 120 pounds. When the door linkage was forced overcenter, the locking pins did not engage. It was noted further that the sliding lock tube was deflected, and the cap end made contact with the cockpit door warning indicator actuating arm. The indicator switch can be actuated with less than one-eighth inch travel of the actuating arm.” The handle could be forced. Forcing it bent the mechanism. Bending the mechanism closed the vent door and put out the light. The four independent signs were one sign, and it could be defeated by a man’s knee.

The probable cause, adopted on 28 February 1973, was the improper engagement of the latches “during the preparation of the airplane for flight,” and then this: “The design characteristics of the door latching mechanism permitted the door to be apparently closed when, in fact, the latches were not fully engaged and the latch lockpins were not in place.” On the floor the Board was plainer still. “The Board believes that the lack of pressure relief vents in this cargo compartment represents a significant hazard; sudden loss of pressurization in this compartment should not jeopardize the safety of the flight.”

What it looked like from inside

The Board had not waited for its report. On 23 June 1972, eleven days after Windsor, it adopted two recommendations to the Administrator, and issued them on 6 July. “The design of the door should have precluded the dispatch of the aircraft with this door improperly closed,” the letter to Shaffer said; and, of the floor, “the Board believes that sudden loss of pressure in this cargo compartment for any reason should not jeopardize the safety of the flight.” Recommendation A-72-97 asked the FAA to “require a modification to the DC-10 cargo door locking system to make it physically impossible to position the external locking handle and vent door to their normal door locked positions unless the locking pins are fully engaged.” A-72-98 asked it to “require the installation of relief vents between the cabin and aft cargo compartment.”

The FAA’s Western Region had already drafted the instrument for the first. Four days after Windsor, by the account the Washington Post gave in March 1974, Basnight’s office at Los Angeles wrote the first of what were to be several airworthiness directives. It was never issued. What happened instead was set out, nearly two years later, in a letter from Shaffer’s successor, Alexander P. Butterfield, to Reed at the Safety Board: the FAA had drafted a directive “a few days after the Canadian incident,” but “upon appeal to the administrator by the manufacturer, a decision was made to forego the issuance of ADs,” and instead “to seek the modification of the cargo compartment door latching mechanism through voluntary compliance by operators with McDonnell-Douglas service bulletins.” The appeal had been made by the president of the Douglas division, Jackson McGowen, to Shaffer himself. In the hearings of 1974 the arrangement was called a gentlemen’s agreement. Basnight explained the difference between the two instruments to the Post: an airworthiness directive “has the force of law, and it invokes the FAA’s inspector personnel to check it,” while on a service bulletin the inspectors “may do it, but are not required to do it.” A directive goes to the governments of foreign operators as of right. A bulletin need not.

The bulletins came out one after another. Alert Service Bulletin A52-35, dated 19 June 1972, put the inspection window into every cargo door, with a placard beside it, and called for a functional check of the door. Service Bulletin 52-37, dated 3 July 1972, replaced the strike plate, adjusted the switches on all three cargo doors and, on the aft door, added “a support and plate”: a bracket behind the vent-door shaft that would stop the linkage bending when the handle was forced, which was the thing Windsor had shown. The FAA’s reply to the Safety Board on 7 July 1972, over Shaffer’s signature, said that all DC-10 operators were performing functional checks of the doors every hundred hours and “will incorporate necessary modifications in accordance with McDonnell Douglas Service Bulletins 52-27 and A52-35 within 300 hours.” Of the floor it said that “a preliminary investigation indicates that it may not be feasible to provide complete venting between cabin and cargo compartments,” and that the recommendation would be considered. The companion piece “The bulletins” gives the recommendation, the reply and the bulletins in order and at length.

Inside the subcontractor there was a man who did not believe the bulletins were enough. On 27 June 1972 the director of product engineering at Convair, Dan Applegate, wrote to his superior a memorandum that came to light in the lawsuits after Paris. “The potential for long term Convair liability has been causing me increasing concern for several reasons,” it began, by the text printed in the case study of 1992; and, by the sentence that every later account has quoted: “It seems to me inevitable that, in the 20 years ahead of us, DC-10 cargo doors will come open and I would expect this to usually result in the loss of the airplane.” Convair’s management, weighing its contract with Douglas, did not pass the memorandum on.

The floor went by correspondence. On 2 February 1973 the FAA wrote to the chief engineer at Douglas: “We believe the loss of an airplane because the floor collapses under such conditions and disrupted vital systems, would be unacceptable.” Douglas answered on 15 March 1973 that to design the floor against a large cargo door opening would mean “a considerable increase in floor and fuselage weight,” fewer passengers or less cargo, and: “In our opinion, this is unwarranted, due to the excellent safety record of structure in service aircraft.” On 13 February 1974 the FAA asked more precisely for the feasibility of some arrangement of venting. Douglas replied on 25 February that it was not “in a position to accept this burden alone,” that the FAA might “consider the possibility of funding this study because of the magnitude of the effort required,” and: “We will not plan any further action on your Feb. 13, 1974, letter until we hear from you further.” The letter was six days old when the door opened over Saint-Pathus.

Fuselage number 29 had made its first flight at Long Beach on 27 February 1972, four months before Windsor, and was still the manufacturer’s through the summer in which the bulletins were written. It was delivered to Türk Hava Yolları on 10 December 1972, and registered TC-JAV ten days later. Service Bulletin 52-37, the French Commission found, “does not list TC-JAV among the aircraft affected by the relevant modification which ought to have been carried out by the manufacturer before delivery. As a result of an oversight by the manufacturer, the aircraft was delivered without the modification.” The chamfer that the bulletin specified on the end of the lock tube had been roughly filed by hand, which “seems to show that work had begun on correcting the error retrospectively.” The support plate itself, the bracket behind the handle, had not been installed. The FAA’s own account of the accident, written for its engineers, puts it in one sentence: “Maintenance records of modifications accomplished on this airplane by McDonnell-Douglas reflected that the support plate had been installed.” Douglas’s president, John Brizendine, conceded in a statement at the end of March 1974 that the Turkish aircraft’s door “did not incorporate all the approved changes,” and did not say why.

The rigging was wrong as well. The Commission straightened the lock tube from the wreckage, fitted a new warning switch, and found ten shims under its striker, 15.9 millimetres of them, so that the switch put the cockpit light out while the pins were still three millimetres from the latch flanges, where the manual allowed two. It set the door’s adjustable rods to the lengths measured on the wreck, fitted them to a new door lent by Douglas with the support plate removed, and closed it: the pins went behind the latches 1.6 millimetres short, where the manual required them a quarter of an inch, 6.35 millimetres, proud. Then it opened the latches and pulled the handle down. With the rigging as the manufacturer required, “it is physically impossible to force the handle even in the absence of the support plate.” With the rigging as found on TC-JAV, “the handle could therefore be closed (and the vent door apparently closed) with a force of 22 daN (about 50 lbs).” At Windsor it had taken 120 pounds and a knee. Douglas’s production records showed the pins on fuselage 29 set to the full quarter of an inch when it left Long Beach: “These documents merely provide guarantees in accordance with prescribed forms.” Somebody since had altered the rods, drilled a hole through the actuator’s instruction plate to get at the drive by hand, and put a third shim of crumpled metal leaf under one of the switches. The door “had had to be closed by the manual drive tool on numerous earlier occasions.” The companion piece “The new door” gives the Commission’s measurements in full.

That was the aircraft that came into Orly from Istanbul at 10:02 on 3 March 1974 as Flight 981, with 167 passengers aboard, fifty of them for Paris. The company’s resident engineer at Orly was in Istanbul on a course; an aircraft mechanic named Engin Ucok, forty-five, had been carried on the flight in his place, with the duty of supervising the loading and the turn-round. The stop was meant to last an hour and lasted ninety minutes, because 216 passengers were added at the last minute from British Airways and Air France, their own flights stopped by a strike at British Airways. Contract handlers emptied the aft hold by 10:25, and Mahmoudi closed its door at about 10:35. The Commission could find no one who saw the engineer or any crew member look through the window at the pins, “and their non-engagement was therefore not detected.” It added a plain thing: once the handler had finished, “inspection would have entailed the positioning of equipment beneath the view port in order to gain access.” The window was above a man’s reach from the apron.

What happened

TC-JAV was pushed back from stand A2, taxied to Runway 08, and took off at 11:30 and 30 seconds with 334 passengers and twelve crew, the aircraft commander Nejat Berköz, forty-four, with 7,003 hours, the co-pilot Oral Ulusman, thirty-eight, the flight engineer Erhan Özer, thirty-seven, eight cabin staff, and Ucok. The Commission’s count of the dead was 346; the load sheet had six children and one infant among them; 177 were British, 48 Japanese, 56 Turkish, 25 American, 16 French. It was cleared to 6,000 feet, held there for two minutes, was cleared to flight level 230 by the North area control centre at 11:36, and turned left towards Montdidier on the way to London. By 11:38 it was climbing at 300 knots and 2,200 feet a minute on a heading of 345 degrees, under the autopilot, and the cabin, by the Commission’s reckoning, was at or near sea level with between 4.7 and 5.2 pounds per square inch across the hull, “figures of the same magnitude as those estimated in connection with the previous accident at Windsor.”

Three or four seconds before 11:40, at about 11,500 feet, the cockpit voice recorder caught the noise of decompression, and the co-pilot said: “the fuselage has burst.” The pressurisation warning sounded. At 11:40 and 13 seconds the controller watching Flight 981 heard a transmission he could not make out: a heavy noise behind words in Turkish, the pressurisation horn, and then the overspeed warning. As the overspeed horn came on, the flight’s label disappeared from his secondary radar. On the primary radar the echo split in two. One part stayed where it was, about 24 nautical miles from Orly on a bearing of 045 degrees, for two or three minutes, and faded; it was the door, part of the floor, two triple seat units and the six people in them, falling 3,600 metres on to the ploughed fields of Saint-Pathus. The other part curved away to the left.

The two bolts had sheared; the Commission put the force at 4,700 decanewtons. The latches had never gone over-centre. The actuator’s shaft was found extended 277.5 millimetres, against the 297 that closes the latches; its motor was never found, so the Commission could not say whether a torque limiter had slipped, a thermal cut-out had tripped, the power had been interrupted, or the switch had been held for too short a time. The marks of the pins on the latch cranks showed that the door had been closed short of over-centre before, more than once. What was different on 3 March was the height and the load. Flight 96 had had an empty lounge over its hold. Flight 981 had a full cabin. The excess pressure above the floor, the Commission calculated, was of the order of 36 kilopascals, about 3.6 tonnes on every square metre, and the floor over the door did not deform this time but went out through the hole, with the seats on it.

Everything that moved the tail ran through that floor. In the first two seconds, by the flight data recorder, both rudders went ten degrees left, the elevators went three degrees down, and the tail engine’s speed fell to forty-five per cent. The nose went down; twenty-two seconds after the decompression it was 20 degrees below the horizon at 362 knots, though the wing engines had been throttled back. The ailerons still answered, and the bank never exceeded 20 degrees. At 430 knots the aircraft found an attitude of its own, four degrees nose down, and held it. At 11:41 and 13 seconds the voice recorder stopped. The aircraft went into the pines of the forest of Ermenonville, at a place called the Bosquet de Dammartin in the commune of Fontaine-Chaalis, thirty-seven kilometres north-east of Paris, at 423 knots, banked 17 degrees left, four degrees nose down, cutting a swath 700 metres long and 100 wide. The Commission’s finding on the time between the noise and the ground is seventy-seven seconds. There was no fire to speak of; the fuel went into the trees. Nearly 20,000 fragments of the people aboard were listed at the Institut Médico-Légal in Paris; 188 of the dead were identified, by fingerprints where there were national records, by teeth, by bones, by clothes. The six at Saint-Pathus were whole.

After

The FAA acted in ninety-six hours. On Thursday 7 March 1974 it adopted a telegraphic airworthiness directive, effective at once for every American DC-10, “because of an apparent in-flight depressurization which may have been associated with an improperly secured cargo door.” Before further flight each aircraft was to have the windows and placards of Alert Bulletin A52-35, the wiring of 52-27, and “a support and plate on the aft cargo door” of 52-37: the bulletins of June and July 1972, word for word. Before every flight a crew member was to look through the window at the pins. A second telegram on 22 March required Service Bulletin 52-49 by 1 July, the “closed loop,” as the FAA called it, which would not let the aircraft be pressurised unless the door was locked. Butterfield explained the change of method to the Safety Board in the same weeks: soon after the crash “I learned that certain of these modifications had not been carried out, and that there were some uncertainties in the records available to us with regard to the status of DC-10 aircraft.” “An AD was issued that day. It meant, of course, that no DC-10 could be flown by a U.S. operator except in compliance with its terms.” When the FAA then inspected all 134 DC-10s, Basnight said, two were found without the bulletins’ modifications, both with foreign airlines; one was the Turkish aircraft. The companion piece “The directive” gives its text and what followed it.

In London on 14 March the Secretary of State for Trade, Peter Shore, told the Commons that 345 people had died, about two hundred of them British subjects, in “the most terrible air disaster ever to occur,” and that Laker Airways, the only British operator of the type, had been warned by the Civil Aviation Authority on 5 March and had ordered its two aircraft’s rear cargo doors closed for good, with a metal plate screwed over the handles.

The Senate’s aviation subcommittee sat on 26 and 27 March, the House subcommittee on 27 March and 9 April. The Post’s reports of the documents, which Senator Vance Hartke had read into the Congressional Record on 28 March, carried the Butterfield letter and the exchange of letters on the floor. Douglas, through Brizendine, answered that to imply its reply of 25 February could have prevented the tragedy was “both irresponsible and malicious.” Basnight’s observation was dry: “The attitude of McDonnell-Douglas has changed with the demonstration of the two accidents now. The company has adopted the position that whatever is required, they’ll do it.” In December a member of the House subcommittee, J. J. Pickle of Texas, summed up its finding for the House: “There we found that the FAA was put on notice almost 2 years previously by a near miss at Detroit that there was a problem with the door closing mechanism.”

The French Commission held its last meeting on 6 November 1975 and its report was published in 1976, with an English translation by the British Accidents Investigation Branch. Its cause was the ejection of the door and the sudden depressurisation that followed, which “led to the disruption of the floor structure, causing six passengers and parts of the aircraft to be ejected, rendering No 2 engine inoperative and impairing the flight controls (tail surfaces) so that it was impossible for the crew to regain control of the aircraft.” The underlying factor was the incorrect engagement of the latches before take-off, made possible by “the characteristics of the design of the mechanism,” through three things together: the incomplete application of Service Bulletin 52-37, the incorrect adjustments, and the closing of the door at Orly without anyone looking through a window whose diameter the Commission called inadequate. Its fourth recommendation was addressed across the Atlantic. The examination of what had been done after Windsor “has shown that the method of the ‘airworthiness directive’ was not used; for that reason, the recommended measures were not mandatory and appropriate means were not employed to bring the matter to the attention of those concerned. The Commission recommends that the mandatory procedure of ‘airworthiness directives’, whatever the financial repercussions, should be selected whenever safety could be at serious risk.” Its last sentence before the signatures was the one about Windsor. “All these risks had already become evident, nineteen months earlier, at the time of the Windsor accident, but no efficacious corrective action had followed.”

The floor was dealt with last. In 1975 the FAA issued what its engineers still call the “floors and doors” directive, AD 75-15-05, requiring the floors of every wide-bodied airliner then in service to be made able to stand a sudden hole in the hull without collapsing. Then the certification rule itself was changed. Amendment 25-54 wrote into the regulations that a pressurised fuselage must be designed for a sudden opening of up to twenty square feet, which is about the size of the DC-10’s aft cargo door, and that an outward-opening door must have a window through which its locks can be seen, a warning that cannot be falsely cleared, and a means of preventing pressurisation if it is not locked.

What it taught

The Windsor door had done the whole experiment in one afternoon. It showed that the four independent signs of a locked door were one sign; that the sign could be defeated with a knee; that the floor would fall when the door went; that the cables ran through the floor; and that the result was an aircraft without a rudder, with an elevator that answered only to force, and with its tail engine running down, which two pilots could bring home if the lounge above the hole was empty and the weather was fine. The failure that followed came out of the instrument chosen to carry the correction.

A bulletin measures willingness; a directive measures compliance. The service bulletins of June and July 1972 were, on their face, the same as the directive that was drafted and not sent: the same windows, the same wiring, the same plate. What differed was who was obliged to check. Basnight’s distinction, that a directive “invokes the FAA’s inspector personnel to check it” and a bulletin does not, is the difference between an instrument that is read and one that is written. It was not until after 3 March that the Administrator “learned that certain of these modifications had not been carried out.”

A record of a fix is a record. Fuselage 29 is the clearest case in these pages of a measurement taken from paper. At Long Beach the bulletin did not list it, the plate was never fitted, and the records said it had been. The pins were set to a quarter of an inch when it was built and the production documents guaranteed it, “in accordance with prescribed forms”; then the rods were shortened and nothing took a second reading. The FAA’s own engineers, writing the lesson for their successors, were honest about the limit of their remedy: since the records of the accident aircraft “improperly indicated that corrective service bulletins had been incorporated, it is unclear whether issuance of an airworthiness directive would have been effective in avoiding this accident.” That is the complication, and it should be allowed its weight. A directive would have sent the French and Turkish authorities the same paper the airline had. The difference is that a directive is a law with an inspector attached, and the inspector’s job is to go and look at the door.

A safety feature that can be beaten by an ordinary man has measured the man. The vent door was the DC-10’s idea of an interlock: a flap that stayed open unless the pins were in, so that the aircraft could not be pressurised unlocked. At Windsor it closed under 120 pounds and a knee. At Orly, with the plate missing and the pins rigged short, it closed under fifty. Each operator’s mechanics learned, as Turkish Airlines’ did, that the door “had had to be closed by the manual drive tool on numerous earlier occasions”; the people on the ramp learned to make it shut. The lesson the design taught the handlers was that the door needed force, and they supplied it. The closed loop of 1974 removed the question by making the handle follow the pins. That was the modification the Safety Board had asked for in July 1972, in the words “physically impossible.”

The second claim was never put to the test the first had failed. The floor was not vented because the door would not open. When the door opened, in the ground test before certification and over Windsor, the floor’s premise was gone, and the floor was defended by letter: “unwarranted, due to the excellent safety record of structure in service aircraft.” The FAA wrote in February 1973 that the loss of an aircraft this way “would be unacceptable,” and then wrote again a year later to ask whether a study was feasible. In the R101 the trials were shortened until there was nothing left to hear; here the instrument spoke in full, over Windsor, and the people who heard it answered the half of the message that was cheap. The airship’s certificate attested reports that had not been written. Fuselage 29’s records attested a plate that had not been fitted. In both cases the document was in order, and in both cases the thing it described was the thing that failed.

The complication that remains is the one Shaffer himself raised afterwards, and it is a real one: that the FAA of 1972 relied on manufacturers to certify their own fixes and did not go and check them, so that a directive might have produced the same records; that a directive to Turkey would have been a copy sent to a government, not an inspector; that the papers of fuselage 29 would have read the same. What a directive would have changed is not certain. What is certain is the order of events. The design was tested on the ground and failed. It was tested at Windsor and failed, and the test was read exactly. The correction was then made voluntary by an appeal to the Administrator, carried by paper that nobody was obliged to read, recorded as complete on an aircraft on which it had not been done, and given nineteen months, during which the second claim was answered in correspondence. Six days after the correspondence stopped, the door at Orly closed under fifty pounds, and at the height at which the first door had opened the second did, with seventy-seven seconds to the ground.

Sources

• National Transportation Safety Board, Aircraft Accident Report: American Airlines, Inc., McDonnell Douglas DC-10-10, N103AA, near Windsor, Ontario, Canada, June 12, 1972, NTSB-AAR-73-2, adopted 28 February 1973. The history of the flight, the ramp agent and the mechanic, the crew, the damage to the door and the floor and the cables, the tests at Douglas (the 120 pounds, the deflected lock tube and the warning switch), the findings and probable cause, Service Bulletin 52-27 and the absence of a directive, the cockpit voice recorder transcript (Appendix D), the cargo door drawing (Appendix F), and the recommendation letter of 6 July 1972 with the FAA’s reply of 7 July (Appendix G). Scanned copy, Federal Aviation Administration. faa.gov; the Board’s own page on the accident, with recommendations A-72-97, A-72-98 and A-74-27 to 29. ntsb.gov
• Secrétariat d’État aux Transports, Commission d’Enquête, Accident to Turkish Airlines DC-10 TC-JAV in the Ermenonville Forest on 3 March 1974: Final Report, translated by the Accidents Investigation Branch, Department of Trade, as Aircraft Accident Report 8/76 (HMSO, 1976). The Commission’s membership, the stop at Orly and the people who handled the aircraft, Mahmoudi’s and the engineer’s parts, the times, the crew, fuselage 29’s history and the bulletins applied to it, the wreckage at Saint-Pathus and in the forest, the examination of the door and actuator, the tests at Saclay and Zurich, the shims and the rigging, the comparison with Windsor, the analysis, the findings, the causes and the recommendations. gov.uk; the French original, Rapport final, February 1976, scanned copy, SKYbrary. skybrary.aero
• Federal Aviation Administration, Airworthiness Directive, McDonnell-Douglas DC-10 Series Airplanes, Docket 13593, Amendment 39-1811, Federal Register vol. 39 no. 64, 2 April 1974, pp. 11991–11992: the telegraphic directive of 7 March 1974, its amendment of 22 March, and the service bulletins and dates it made compulsory; and the same directive as revised in AD 74-08-04, effective 1 December 1975. govinfo.gov, faa.gov
• Congressional Record, Senate, 28 March 1974, pp. 8744–8746: Senator Vance Hartke’s remarks, and the two Washington Post reports by Jack Egan which he had printed, “FAA Safety Proposal, Later Erased, Might Have Averted DC-10 Crash” and “FAA Aide Criticizes Agency for Canceling Safety Order”. The Butterfield letter to Reed, the FAA–Douglas letters of 2 February 1973, 15 March 1973, 13 February 1974 and 25 February 1974, Basnight’s and Sliff’s statements, the inspection of 134 aircraft, and Brizendine’s statements, all at second hand through the Post. govinfo.gov
• Congressional Record, House, 4 December 1974, p. 38216: Representative J. J. Pickle on the Special Subcommittee on Investigations’ hearing on the cargo door. govinfo.gov
• Hansard, Commons, 14 March 1974, “Aircraft Accident (France)”: Peter Shore’s statement and the questions on it; Lords, the same day, “Turkish Airlines DC-10 Disaster Inquiry”. Commons, Lords
• Federal Aviation Administration, Lessons Learned from Civil Aviation Accidents, “McDonnell Douglas DC-10, Turk Hava Flight TK981, TC-JAV”: the maintenance records on the support plate, the bulletins Turkish Airlines had and had not applied, the directives of 1974 and 1975, Amendment 25-54, and the agency’s own caveat on what a directive would have changed. faa.gov
• John H. Fielder and Douglas Birsch, eds., The DC-10 Case: A Study in Applied Ethics, Technology, and Society (SUNY Press, 1992), which prints the Applegate memorandum of 27 June 1972; its opening sentence is quoted here as the Wikipedia article on Dan Applegate quotes it from page 165, and the sentence on the twenty years as a Clyde & Co case study of 2025 prints it. Neither was read in the book. Dan Applegate, Clyde & Co
• Wikipedia, “Turkish Airlines Flight 981”, for the nationalities of the dead and the dates of the hearings and the litigation, checked where possible against the report. en.wikipedia.org