A Legal and Moral Question: The crash of Turkish Airlines flight 981 and the DC-10 cargo door saga
Note: this accident was previously featured in episode 5 of the plane crash series on October 7th, 2017, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
On the 3rd of March 1974, a packed Turkish Airlines DC-10 was rocked by a tremendous explosion shortly after takeoff from Paris. A huge hole had opened up near the back of the cabin, throwing part of the floor, two rows of seats, and six passengers out into the sky. The pilots tried to save their crippled plane, but the pitch controls had been destroyed, sending the plane into an irrecoverable dive, and the jet crashed less than two minutes later in the Ermenonville Forest, killing all 346 passengers and crew.
Investigators would find that this incomprehensible tragedy was completely avoidable. Two years earlier, the same thing happened to another DC-10 operating American Airlines flight 96, leading to a harrowing fight for control which culminated in a successful emergency landing that saved the lives of 67 people. The cause: a poorly designed cargo door locking mechanism which allowed the door to come open in flight. The case should have been open and shut, the resulting design changes uncontroversial. But by the time of the Turkish Airlines disaster, nothing was fundamentally different, thanks to one of the most infamous cases of corporate malfeasance in the history of commercial aviation. This is the story of that sordid saga, that years-long dance of critically flawed business decisions, conflicting motivations, and failures of governance that led directly to one of the deadliest plane crashes of all time.
◊◊◊
By the second half of the 1960s, famed aircraft manufacturer Douglas was in trouble. Their gamble on propeller planes had failed; the DC-8 and DC-9, their belated entries into the jet market, were not selling particularly well; and escalating inefficiency on the production line had left the company struggling to fulfill orders. Boeing was on track to take over the jet market, while Douglas fell into such a deep financial hole that its banks suspended its credit and company executives searched in despair for an injection of cash, no matter where it came from.
In 1967, Douglas admitted defeat. To avoid bankruptcy, the company agreed to a purchase offer from the McDonnell Aircraft Corporation, a prominent defense contractor which promised to shake up the management and get the production lines rolling again. And so McDonnell Douglas was born: a beast with a storied pedigree and increasingly little to show for it.
The new management was able to speed up production and get the orders finished on time, but that was only half the battle. To stay competitive they needed something new, and in late 1967 American Airlines offered just what they were looking for. The president of America’s largest airline wanted a wide body jet that could carry 300 to 400 people across the country, but was smaller than the Boeing 747 and could take off from regular runways. But before McDonnell Douglas could even begin drafting a proposal, rival manufacturer Lockheed announced that it would produce the L-1011 TriStar: a wide body, three-engine jet that would meet all of American Airlines’ specifications. Two months later, despite not having any concrete plans, McDonnell Douglas announced that it would build the same thing, except better, and they would get it done faster. After all, if Lockheed captured this new market, McDonnell Douglas would probably cease to exist; everything thus depended on the success of the new plane: the DC-10.
As the frantic effort to produce a new wide-body jet got underway, McDonnell Douglas adopted a mantra of “Fly before they roll:” in other words, the goal was for the DC-10 to make its maiden flight before the first L-1011 had emerged from the hangar. In order to raise capital, both manufacturers courted orders from America’s largest airlines, and the battle lines were drawn: TWA and Eastern chose the L-1011, while American and United opted for the DC-10. The airlines pressed hard for the features they wanted, knowing that the manufacturers could not refuse for fear of losing the order, and both companies scrambled to design and build all the thousands of pieces that go into an airliner in as short a time as possible. But while Lockheed wanted the L-1011 to advance the state of the industry and introduce radical new technological concepts, McDonnell Douglas preferred to stick with what it already understood: don’t try anything that hasn’t been tried before, and get it done quickly.
The result was that the DC-10 indeed flew before the L-1011 rolled, first taking to the skies on August 29th, 1970. In just two years, one of the biggest planes ever built at the time had gone from the drawing board to reality, an incredible feat of engineering. By the following year, most of the obvious kinks had been ironed out, and the DC-10 entered passenger service with American Airlines in August 1971. The Lockheed L-1011 TriStar, now lagging far behind its upstart rival, didn’t follow suit until April 1972. But, with the gift of hindsight, it is possible to say that being the first was both a blessing and a curse.
◊◊◊
On the 12th of June 1972, American Airlines flight 96 prepared to depart Detroit, Michigan en route to Buffalo, New York, the second leg of a routine cross-country trip from Los Angeles to New York City. The DC-10 operating this flight was less than a year old and was in excellent condition. Certainly her crew, consisting of Captain Bryce McCormick, First Officer Peter Whitney, and Flight Engineer Clayton Burke, could not have expected that their brand new plane, flying in perfect weather, was about to throw them into a terrifying fight for survival.
Lightly loaded with just 56 passengers and 11 crew, the DC-10 took off from Detroit at 19:20 and climbed away into the evening sky, heading east over Canada. The eight flight attendants, certain that they would have little to do, sat chatting in the cabin; the pilots, having placed their plane into a steady climb, admired a Boeing 747 overtaking them in the near distance. The altimeter showed them climbing through 11,750 feet.
And then, like thunder out of a clear sky, a powerful explosion rocked the plane. In an instant, all the air rushed out of the pressurized fuselage, blasting the cockpit door off its hinges and sucking the pilots’ hats back into the passenger cabin. A dense, white fog filled the plane as water vapor instantly condensed out of the air. Ceiling panels came crashing to the ground, and a hatch flew up from the floor and smacked a passenger in the face. Everything that wasn’t tied down rushed toward the back of the plane, where, to the immense horror of the cabin crew, a gaping hole had opened in the floor, through which clouds could be seen hurtling past at great speed. One of the flight attendants had fallen half way into the hole, buried under a tangle of fractured ceiling panels, where she lay screaming for help. Her companion, who had herself been thrown to the ground by the force of the blast, came to her aid, and together they managed to scramble to safety.
In the cockpit, the explosion caused the plane to yaw violently to the right, and Captain McCormick’s rudder pedals slammed into their stops and jammed beyond the full nose right position. All three throttle levers snapped back to idle and the plane began to pitch down. Dirt and dust blasted upward into McCormick’s face, temporarily blinding him.
“What the hell was it?” he shouted.
Warnings started to blare, indicating a fire, although there was none.
“We’ve hit something!” Flight Engineer Burke exclaimed. Indeed, the pilots immediately assumed that they had been involved in a mid-air collision; in their minds, it was the only possible explanation for so many simultaneous failures.
As his sight returned, Captain McCormick found the plane turning hard to the right and losing altitude. With the rudder pedals jammed, he had to turn left using the ailerons instead, putting the plane into an awkward crab-like attitude as it streaked through the sky. He accelerated the engines back to full power, but the number two engine in the tail refused to respond. When he tried to pitch up, the elevators barely moved, and intense pressure on the control column was needed just to prevent the plane from going into a dive.
It would have been tempting to immediately try to return to the airport, but with the plane no longer in danger of spiraling into the ground, McCormick decided to first take stock of the situation. Together, the pilots ran through what was working and what wasn’t. They had no rudder, barely any pitch control, one engine was dead, the master warning was blaring, and the cabin had depressurized. But they did have full use of the ailerons, engines one and three, and all their hydraulic systems, small comfort as that may have been.
Having peeled herself off the floor, a flight attendant entered the cockpit and asked, “Is everything alright up here?”
“No!” Captain McCormick fired back. Keying his mic to speak to air traffic control, he announced, “Center, this is American Airlines flight 96, we got an emergency!”
Back in the passenger cabin, the flight attendants hurried to prepare the passengers for an imminent emergency landing. The cabin crew moved passengers away from the hole, briefed exit row occupants on how to open the doors; and attempted to render first aid to the woman hit by the floor hatch, who was bleeding profusely. Passengers pulled out their safety cards and practiced the brace position. One way or another, it was going to be a rough landing.
As Captain McCormick steered his plane slowly back toward Detroit, he knew that they were in a delicate situation. If he tried to turn too far to the left using the ailerons, this could, counterintuitively, result in a spin to the right. To turn left, the ailerons increase the angle of attack of the right wing and reduce the angle of attack of the left wing, causing the right wing to generate more lift and turn the plane. But in such an extreme right yaw, the right wing was already in danger of stalling and spiraling in; therefore, using too much left aileron could push the angle of attack beyond the critical point and cause a catastrophic loss of lift on the right side. McCormick managed to solve this problem by making his turns primarily with the engines, using differential thrust to adjust their heading, while holding the ailerons just far enough left to keep the wings level.
But as flight 96 approached the airport, a whole new set of problems presented themselves. When the pilots extended the landing gear and flaps, the extra drag caused their rate of descent to escalate to 1,800 feet per minute, twice the desired value, which forced Captain McCormick to increase engine power. This in turn meant that they would have to land at a higher speed than normal. And to make matters worse, the jammed rudder meant that they would have no directional control after landing.
Seconds from touchdown, Captain McCormick and First Officer Whitney both grabbed their yokes and hauled back together, overcoming the jammed elevators in order to flare the airplane. American Airlines flight 96 touched down at high speed on its main landing gear, but within seconds the DC-10 began to veer to the right, rumbling off the runway and across the grass, headed straight for a cluster of airport buildings. After all he had done, for a moment Captain McCormick feared that it would be in vain. But then, thinking quickly and without waiting for instructions, First Officer Peter Whitney increased reverse thrust on the left engine while simultaneously moving the right engine to forward thrust, causing the plane to veer back to the left. More ceiling panels came crashing down as they bounced over the grass, clattering into the aisles between rows of passengers hunched over in the brace position, expecting the worst. But the worst did not come. Twenty harrowing minutes after the explosion, American Airlines flight 96 came to a stop half on, half off the runway, all 67 passengers and crew shaken but alive.
Upon exiting the plane, the cause of all their difficulties was plainly apparent: the rear cargo door had somehow opened in flight. The sudden departure of the door caused all the air to rush out of the cargo compartment, taking with it a number of items, including an occupied coffin. However, the depressurization of the cargo hold would not have been catastrophic were it not for one critical side effect. As it turned out, when the hold depressurized, the passenger cabin above it did not. This created a pressure differential between the cabin and the hold which amounted to several tons per square meter, a force that the floor was not designed to withstand. A large section of the floor near the last few rows of seats consequently failed, collapsing down into the cargo hold.
In order to move the DC-10’s massive control surfaces, the pilots’ inputs are transferred throughout the plane by means of mechanical cables which feed their commands to an array of hydraulic actuators. The most logical place to route these cables was through the cabin floor. When the floor collapsed during the depressurization, the left rudder cable was severed, causing the right rudder cable to go into tension, which resulted in an irreversible right rudder hardover. The collapse also severed the cables that controlled the number two engine and the left elevator, while the right elevator cable was crimped within a buckled floor section, making it difficult to move. Despite these failures, the pilots were able to save their plane using the ailerons, wing engines, and the right elevator. They could also have controlled pitch using the stabilizer trim, which adjusts the plane’s resting pitch angle, because the cables connecting it to the electric trim switches in the cockpit were intact. However, the trim position indicator had broken, causing the pilots to believe the stabilizer was inoperative.
As the National Transportation Safety Board began its investigation, their first priority was to examine the cargo door to understand why it had come open. The door, along with the coffin and the other contents of the rear cargo hold, had fallen to earth near the city of Windsor, Ontario, and was found in relatively good condition. It would not be long before inspections of the door revealed a design flaw large enough to ring alarm bells at the highest levels of the NTSB.
When designing an airplane door, the greatest challenge is to ensure that it will not fail under the intense pressure differentials at high altitude. One easy way to do this is to create a plug door, which opens inward and is bigger than its frame, causing the interior pressure to force it ever more tightly closed as the plane climbs; such a door is all but impossible to open in flight. Passenger doors are designed based on this principle. But a cargo door that is also a plug door would be impractical because of its size, which greatly increases the forces it would have to withstand, and because a cargo door that opens inward would severely decrease the amount of available cargo space.
While designing their respective airplanes, McDonnell Douglas and Lockheed took very different approaches to this problem. In keeping with its overall design philosophy, Lockheed devised an ingenious system that turned the rear cargo door into a “semi-plug” door. Lockheed’s door opened outward, but it would also slide downward before latching such that a set of hooks on the edges of the door slipped snugly into detents on the door frame. Pressure acting on the door would then force the hooks deeper into the detents, holding the door closed. This door was all but impossible to open in flight, but it necessitated a complex opening and closing mechanism which was difficult to design.
Instead of taking Lockheed’s route, McDonnell Douglas decided to design a much simpler “over-center” door. The concept of “over-centering” is found most commonly in a household light switch: once the switch is pushed past the center point, it will slip into the opposite detent, and only a new force equal to the original force will push it back.
The design that they came up with worked something like this. Upon closing the DC-10’s cargo door, hook-shaped latches attached to the bottom of the door grasp round latch spools attached to the doorframe. An electric motor called the latch actuator then drives the latches clockwise around the spools using a hinged extension mechanism. When the arm of the latch actuator is fully extended, the hinge is pushed “over-center,” and the only way to bend the hinge back the other way is to retract the actuator arm. Any force transmitted through the latches themselves will attempt to push the hinge even farther over-center, which is rendered impossible by a metal stop that limits the movement of the hinge. This stop absorbs most of the forces acting upon the door in flight. However, if the hinges are not over-center, pressurization loads imparted through the latches will not be absorbed by the stop, but will instead be transmitted up the latch actuator arm and into the bolts attaching the actuator to the door. These bolts cannot withstand the pressure differential at altitudes higher than approximately 11,500 feet.
One of the fundamental issues with the original design was that there was no way to tell from the outside whether the hinge was in fact over-center or not. McDonnell Douglas thus devised a locking system which, unlike most similar systems, was not intended to keep the door shut, but simply to indicate whether it was properly closed.
To lock the door, a ground handler pushes down on a handle on the outside of the door. This handle is connected to a torque tube and a push rod that convert the movement of the handle into lateral movement of the lock tube, a metal rod to which several locking pins are attached. If the hinges are not over-center, the locking pins will run into flanges on the hinges and come to a stop, preventing the handle from moving to the locked position. If the hinges are over-center, the lock pins will slide past the flanges and the handle will close easily; simultaneously, the lock tube will make contact with a switch that extinguishes the “door open” warning light in the cockpit.
Later in the design process, McDonnell Douglas also decided to borrow a safety feature that Boeing used on the 747, which had a somewhat similar door design. The 747 had a small plug-type “vent door” within the cargo door, which was driven closed by the lock tube itself; if the lock tube did not fully extend, the vent door would not close, indicating that the door was not locked. Furthermore, if the vent door was not closed, pressure would leak out as soon as the plane started climbing, preventing an improperly locked door from failing catastrophically at altitude. But when McDonnell Douglas copied this feature, they made a crucial mistake: unlike Boeing’s design, their vent door was driven by the torque tube attached to the locking handle instead of the lock tube. The result was that the vent door simply indicated the position of the locking handle, and could not warn of a failure of the locking mechanism. This was especially problematic given that the mechanism was extremely weak, and the torque tube would bend under as little as 80 pounds (355 Newtons) of force, well within the capability of the average human.
Problems are to be expected when any new plane first enters service, and the DC-10 was certainly no exception. Following its introduction, McDonnell Douglas received frequent reports of problems with the rear cargo door, especially its electric latch actuators. The company had originally planned to use a hydraulic actuator, which was more reliable and would always apply positive pressure, unlike an electric actuator, which could act on the latch mechanism only when turned on. But American Airlines had requested an electric actuator because it was lighter and easier to maintain, so McDonnell Douglas acquiesced. In service, however, the electric actuators turned out to be a major annoyance, because they suffered frequent voltage drops that prevented them from driving the latches fully closed. Ground personnel had to latch the doors manually using a crank. To solve these recurring problems, in 1972 McDonnell Douglas devised a more robust wire which would mitigate the voltage drops, and issued a service bulletin encouraging DC-10 operators to install it. But the change was voluntary, and airlines were slow to adopt it; by the time of the flight 96 incident, American Airlines had yet to fit the new wire to its DC-10 cargo doors.
Before American Airlines flight 96 departed Detroit on June 12th, 1972, baggage handler William Eggert loaded the coffin and several bags into the rear cargo hold, then moved to close the door. But as he held down the button to drive the latch actuator, the voltage dropped and the actuator stopped before the hinges could move over-center. Eggert then moved to close the locking handle, only to find that it would not close all the way. He had no idea that this might be a sign that the door was not fully latched, nor did he know that trying to force it would cause mechanical damage, and so he decided to apply more force to the handle using his knee. The locking pins then ran into the sides of the flanges and stopped, the torque tube bent downward in the middle, the locking handle moved into the locked position, and the cockpit warning light went out. But the vent door didn’t quite close, so Eggert called over his supervisor for advice. The supervisor explained that this was a common occurrence, and that it was not dangerous since the pressure would force the vent door into its frame once the plane started climbing. All systems intended to ensure that the door was properly closed had now been overcome, and American Airlines flight 96 took to the air without anyone realizing that its rear cargo door had become a ticking time bomb. As the plane climbed, the pressure acting on the door was transmitted through the hinges and into the latch actuator bolts, until the bolts sheared off under the strain at 11,750 feet, causing the cargo door to depart the airplane.
As a result of its findings, the NTSB recommended that the Federal Aviation Administration require McDonnell Douglas to redesign the door locking system so that it would be “physically impossible to position the external locking handle and vent door to their normal locking positions unless the locking pins are fully engaged.” Concerned about the collapse of the floor and its potential to lead to a loss of control, the NTSB also recommended that the FAA require vents to be installed in the cabin floor which will open to relieve the pressure if the cargo hold depressurizes in flight. (A few such vents already existed for air circulation purposes, but they were too small to handle an explosive decompression.) This was in fact the most pressing concern for the NTSB, because while the cargo door was certainly dangerous, it was the collapse of the floor that was likely to lead to the loss of the airplane in such an event, and indeed the crew of flight 96 had only escaped disaster by the thinnest of margins.
To the NTSB’s surprise, however, the FAA declined to mandate either of its proposed changes. Instead, McDonnell Douglas issued a non-binding service bulletin reminding DC-10 operators to install the new wire and requesting that they add a placard telling ground agents not to apply more than 50 pounds of force to the locking handle. (How baggage handlers were supposed to know whether they were applying more or less than 50 pounds of force was not explained.) McDonnell Douglas followed this up later with a new service bulletin requesting (but again, not mandating) the installation of a small window through which the locking pins could be seen, along with a placard containing a diagram and the words “Caution: verify latch pins engaged.” They also asked that airlines increase the maximum extension of the lock tube by 6 millimeters and install a support plate around the torque tube, which would together ensure that no human could produce enough force to close the locking handle if the door wasn’t locked.
◊◊◊
Meanwhile, McDonnell Douglas continued to sell DC-10s, now with the changes to the door incorporated prior to delivery. However, earlier in 1972, they had run into an unexpected hiccup. A holding company in Japan had purchased six DC-10s with the expectation that they could up-sell them to All Nippon Airways; but due to some kind of backroom deal, that airline decided to buy the Lockheed L-1011 instead. However, it was too late to stop production of the six DC-10s, so McDonnell Douglas decided to finish them and park the planes next to its facility at Long Beach Airport in California until a buyer could be found. But these were the medium range model of the DC-10, which was rather unpopular, and finding a buyer was easier said than done.
McDonnell Douglas eventually decided to target Turkey’s state-owned flag carrier THY, known in Turkish as Turk Hava Yollari and in English as Turkish Airlines. This relatively small airline had only recently made the upgrade to jet aircraft and was by no means ready to buy something as large and complex as the DC-10. But McDonnell Douglas felt that if they could get a Middle Eastern airline to buy the DC-10, then the rest of the region might follow suit, giving them a major new market. And Turkish Airlines seemed like the easiest place to begin.
THY was understandably reluctant to take on the responsibility of operating the DC-10, given the state of their knowledge and infrastructure. However, a number of factors eventually compelled them to agree to the purchase of three of the orphaned DC-10s sitting at Long Beach Airport. McDonnell Douglas lobbied them extremely hard, insisting that they couldn’t miss out on this opportunity, and offered them 20% less than the usual asking price. Furthermore, they would only have to put up 10% of that cost right away; the US Export-Import Bank would give them a special low-interest loan to cover the rest.
On the Turkish side, Air Force officials who were deeply involved in the management of the airline also liked the idea of the DC-10. Although relevant sections of the Turkish Airlines board meeting minutes were redacted for national security reasons, it is thought that the Turkish Air Force wanted the DC-10s because they expected an imminent outbreak of war in Cyprus, and the DC-10 could carry 350 troops at a time into the airport in Nicosia. Facing these twin pressures, Turkish Airlines agreed to buy the planes on three conditions: that the cargo doors be made safe; that McDonnell Douglas provide extensive technical support; and that the planes be ready to fly in time for the Christmas travel rush. (Although most Turks are Muslim, the government heavily subsidized travel costs for Turkish migrant workers in Europe who used the Christmas holiday to come home to Turkey, and THY was eager to cash in.)
The deal was closed in late September 1972, leaving very little time to get the planes — and the airline — ready by Christmas. Most European airlines planned to take two years to incorporate the DC-10 into their fleets; Turkish Airlines wanted to do it in twelve weeks. Somewhere in this mad rush to get the planes ready, a critical step was missed: no one fitted fuselage #29 with the torque tube support plate or lengthened the maximum extension of its lock tube. Nevertheless, McDonnell Douglas told Turkish Airlines that the modifications to the door were complete, and the work cards for both tasks were stamped by McDonnell Douglas inspectors, even though the work was not done. Nor could it have been done — the stamps were dated July 18th 1972, before any instructions for the repair had even been drafted. Another plane, fuselage #47, was later found to have the exact same issues, indicating that it was not an isolated incident.
There were a number of other things wrong with the cargo door on fuselage #29 as well. The lock tube was nearly 8mm short of the correct position, which meant that the locking pins only partially overlapped the flanges even at full extension, instead of passing beyond them. Most probably someone had attempted to extend the lock tube but simply twisted it the wrong way. In this mis-rigged position, the lock tube didn’t move far enough to consistently extinguish the door warning light in the cockpit, so someone had welded several shims onto the end of the lock tube to improve its contact with the switch. The problem was that with the addition of the shims, the lock tube would strike the switch and extinguish the warning light before the locking pins moved into the locked position, rendering the warning pointless.
It has never been conclusively determined whether these improper adjustments were made by McDonnell Douglas or Turkish Airlines. Forensic evidence showed that they must have been carried out after the plane arrived in Turkey, although Douglas engineers continued to perform maintenance on it for some time following its arrival. But if it was Turkish Airlines that made the adjustments, that would not have surprised any of the Douglas employees who were charged with helping THY incorporate the DC-10 into its fleet. In fact, it was obvious that selling the DC-10 to THY in the first place was a dubious idea. There was no hangar at Istanbul Airport that was big enough for a DC-10, so all maintenance work had to be done with the tail sticking out into the weather. The only runway at the airport long enough for a DC-10 was in a state of disrepair. Turkish Airlines had to rush the DC-10 training course for its pilots; there was hardly anyone in Turkey who was qualified even to start flight engineer training; the flight engineers they did manage to find had no idea what they were doing; ground engineers complained that their training was rushed and they didn’t understand English well enough to read the manuals; spare parts were hard to procure; turnaround times were too short to complete maintenance tasks; and all the documentation almost immediately disappeared.
Douglas pilots and engineers who were stationed in Istanbul to assist Turkish Airlines found that their job was nearly impossible and lamented that the airline wouldn’t be ready to operate the DC-10s on its own for years. Nevertheless, after six months McDonnell Douglas ordered them to come home after THY announced it could no longer afford to pay the manufacturer’s minimum fee for the services. So was it THY that mis-rigged the cargo door after the Americans went home? The Douglas engineers thought it was, but we’ll probably never know.
The terrifying result of the mis-rigging is, however, well-established. With the locking pins overlapping the flanges by only 2.5 millimeters even at full extension, and no support plate to stop the torque tube from bending, only 13 pounds (57 Newtons) of force were required to bend the torque tube and lock a door that was not fully over-center. This force would have been indistinguishable from that required during normal door operation.
Somehow, Turkish Airlines flew this plane for 15 months without the cargo door coming open in flight. But disaster was undoubtedly inevitable.
◊◊◊
On the 3rd of March 1974, Paris’s Orly Airport was in chaos. Employees at British European Airways had gone on strike in order to secure higher pay ahead of a planned merger with BOAC, and all across Europe, passengers who had been scheduled with BEA were making their way to Paris to find a flight, any flight, back to London. At 11:02 that morning, Turkish Airlines flight 981, a regular DC-10 service from Istanbul to London via Paris, arrived at Orly Airport with a load of 167 passengers. Fifty Paris-bound passengers disembarked, and baggage handlers opened the rear cargo door to remove their luggage. Little did they know that the largely empty DC-10 was about to become ground zero for the effort to move hundreds of stranded travelers onward to London.
As soon as airline officials became aware of the hundreds of empty seats aboard the Turkish DC-10, they began to fill them at an astonishing rate. Flight 981 took on over 100 amateur English rugby players, a group of Spanish models, and several dozen Japanese trainee bank managers. They were joined by numerous solo travelers, couples, families, businesspeople, and vacationers from all walks of life. By the time the DC-10 was full, there were 335 passengers on board, hailing from 21 different countries. Ten seats remained empty, but these too would have been filled if not for a bookkeeping error at the gate.
After an extended and chaotic boarding process, ground crews prepared flight 981 for departure shortly after noon. Baggage handler Mohammed Mahmoudi was assigned to deal with the rear cargo door, but after waiting for some time, he was told that no bags would be placed there and that he should close the door. He got up on the step ladder, held down the button until he thought he heard the latches close, and then shut the locking handle. It moved into place normally, the vent door closed, and the warning light went out in the cockpit. He did not know that the hinges had not moved over-center and the locking pins were not in place. The only way for him to find out would have been to look through the little viewing window to determine the position of the locking pins, but this was explicitly not his job. Mahmoudi had been told that this was the responsibility of the Turkish Airlines ground engineer who was permanently stationed at Orly Airport. Today, however, the engineer was away attending training, which meant that this duty fell to Engin Ucok, another ground engineer who was riding aboard the plane to service it during its stopovers. But Ucok never showed up either, so no one checked the locking pins.
Minutes later, Turkish Airlines flight 981 took off from Orly Airport and began climbing toward its cruise altitude of 23,000 feet. The 335 passengers and 11 crew could not have known that their plane was already doomed.
As the DC-10 passed through 11,500 feet, the pressure load being transmitted through the hinges to the latch actuator bolts became so great that the bolts sheared, the door swung open, and the air rushed out of the cargo hold with tremendous force. The floor immediately collapsed under the weight of the pressurized air above it, ejecting three rows of seats containing six Japanese bank managers out into the sky three kilometers above the French countryside. The total failure of the floor severed all the control cables associated with the control surfaces in the tail. The plane yawed sharply left, the nose dropped, and all three engines rolled back to idle.
The pilots, Captain Nejat Berköz, First Officer Oral Ulusman, and Flight Engineer Erhan Özer, had no idea what hit them. Captain Berköz tried to pull up, but there was no response. “What happened?” he shouted.
“The cabin blew out!” First Officer Ulusman exclaimed.
“Are you sure?”
The plane was diving ever more steeply toward the ground, spiraling downward faster and faster, hurtling toward the fields, forests, and villages below.
“Bring it up, pull her nose up!” Berköz yelled
“I can’t bring it up — she’s not responding!” said Ulusman.
“Nothing is left!”
“Seven thousand feet!”
The overspeed warning began to blare as the plane accelerated through 362 knots. Any faster and the plane could break apart in midair. Flight 981 was diving twenty degrees nose down, banked to the left in a steep descending spiral.
“Hydraulics?” Berköz asked.
“We have lost it!” Ulusman replied.
“It looks like we’re going to hit the ground!” Berköz shouted. “Speed!” The sheer speed of the plane was causing lift to increase, thus raising the nose, but they weren’t pulling up fast enough. Berköz tried increasing engine power, but he reversed his input as their speed increased toward 430 knots.
In the final sixteen seconds, no one said a word. All the pilots fought with everything they had to pull out of the dive, but all their controls were useless; there was nothing they could do. At 12:41 and 43 seconds, Turkish Airlines flight 981 plowed into the dark pines of the Ermenonville Forest, pitched four degrees nose down and traveling at a speed of 423 knots — 783 kilometers per hour. The DC-10 plowed through the trees for the better part of a kilometer, disintegrating utterly as it went, carving out a hellish trail of shattered pine trees, riven soil, and pulverized metal.
◊◊◊
Five minutes after the crash, local police Captain Jacques Lannier was having lunch with his family at the Officers’ Club in the nearby village of Senlis when he received a phone call from his personal assistant: apparently a plane had gone down in the Ermenonville Forest. Lannier assumed it was a small plane from the local gliding club, and he told his assistant to dispatch some squad cars to the scene.
Moments later, his assistant called him back to report that the plane was in fact a Turkish Airlines DC-10 with at least 185 people on board.
As every policeman and firefighter in Senlis rushed into the Ermenonville Forest, Lannier didn’t know what to expect. The young nurses and paramedics who joined the search certainly thought they were going to be treating survivors. No one, not even the experienced police captain, could have been prepared for what they actually found. As Lannier rolled up beside a fire truck near the intersection of two dirt tracks deep in the forest, a firemen emerged and told him: “Bodies all over the place, like. There are no survivors.”
Lannier and the other first responders had come upon a scene which could only be described as apocalyptic. The forest had been sheared off and then flattened over an area of more than 65,000 square meters, a vast debris field that bore more resemblance to Verdun or the Somme than the site of a plane crash. The DC-10 had disintegrated into hundreds of thousands of pieces, and, horrifically, so had its passengers. Everywhere Captain Lannier looked, there were body parts, lying on the ground, mixed into the wreckage, impaled on trees. With the morbid stoicism of an experienced police officer, he duly noted the presence of a pair of hands, detached from their owners, but apparently still clasped in a final embrace.
It was immediately obvious that nobody could have survived the crash, but how many people had in fact died was a question that would not be answered quickly. During the rush to get people onto flights, record-keeping at the Turkish Airlines gate had been spotty, and rescuers were initially given a figure of 185, which would in itself have made this the deadliest plane crash ever at the time. Only later that day did airport officials inform police and the press that the actual number of people on board was at least 344. Even this was uncertain; it would be weeks before the death toll was pinned at 346, the number cited today, but the chief pathologist who led the painstaking task of organizing the 18,000 body parts and identifying the victims was certain that he worked with fragments of either 350 or 351 people.
The day after the crash, French investigators were made aware of the fact that most of the cargo door, various chunks of the cabin floor, several seats, and the bodies of six Japanese passengers had been found in a farmer’s field near the village of Saint-Pathus. NTSB Aviation Safety Bureau Chief Charles Miller was on the scene when French experts examined the door in the field, and what he saw confirmed his worst fears: it was the Windsor incident all over again, only this time a fully loaded jumbo jet had gone down, killing everyone on board. It was a tragedy which manifestly should not have happened.
It turned out that the sheer number of passengers probably made the difference between a repeat of the Windsor incident and the total disaster which actually occurred. Quite simply, the extra weight of passengers caused the cabin floor to fail more completely than in the Windsor incident, when no passengers were seated in the area above the rear cargo hold. The more extensive collapse of the floor severed all the control cables to the tail, rather than most of them, rendering it impossible for the pilots to control their plane’s pitch. As far as investigators were able to tell, there was no way that Berköz and Ulusman could have recovered.
The NTSB was understandably upset that the recommendations it made after the Windsor incident, which could have prevented the Turkish Airlines disaster, were not implemented. It was in this line of inquiry, one which was pursued by the press rather than by investigators themselves, where some of the most enduring revelations came to light. Most damning of all: McDonnell Douglas and its contractors knew exactly how dangerous the failure of the cargo door could be, and deliberately stymied efforts to do something about it.
The design of the cargo door was, of course, flawed from the beginning. It wasn’t strong enough, it didn’t accomplish its intended goals, and it was possible to adjust the components such that its supposed failsafes were overridden. An FAA report later called it “an inelegant design worthy of Rube Goldberg.” But it didn’t have to be that way.
On May 29th, 1970, McDonnell Douglas was conducting on-ground pressurization tests of the first DC-10 hull when the cargo door exploded open, causing a blast which collapsed part of the cabin floor and destroyed many control cables. But instead of considering whether the design of the door itself was flawed, Douglas blamed the failure on human error by a mechanic. Technically this might have been true, but it missed a rather more salient point: that a door which could fail violently, possibly resulting in the loss of the airplane, if one lowly mechanic deviated slightly from proper procedure, was quite simply an accident waiting to happen. But McDonnell Douglas never wavered from its belief that human error was the only cause of cargo door failures, as the company blamed the Windsor incident on ground agent William Eggert, and even attempted initially to pin the Turkish airlines disaster on the “illiterate” baggage handler Mohammed Mahmoudi, who hadn’t even deviated from proper procedure (Mahmoudi also pointed out that he was in fact literate in three languages, thank you very much!).
McDonnell Douglas’s response to this serious failure in testing was to make a few minor changes to the design of the door. The incident led to the addition of the manual locking handle and the vent door, which didn’t resolve the underlying problem (that it was possible to pressurize the airplane even if the latches were not over-center, eventually leading to an explosive decompression). The vent door was of course meant to solve this, but it was entirely useless because it was not driven by the locking pins and thus could not indicate whether the hinges were over-center. Furthermore, the FAA failed to discover this obvious design flaw during certification of the airplane. In fact, 75% of the DC-10’s certification items were handled by FAA-designated engineers who worked for McDonnell Douglas, a practice known as delegation. Delegation is necessary to some extent because the FAA lacks enough staff to certify every part of every new airplane. But in this case, the engineer who the FAA had assigned to certify the vent door was the same man who had conducted the tests of the door on behalf of McDonnell Douglas. This was a conflict of interest and violated the principle of having a second set of eyes. As a result, the engineer failed to notice the problem, and the FAA accepted that the vent door met regulatory requirements even though it clearly did not.
Following the Windsor incident (which, it should be noted, might not have happened if the vent door had remained open when the locking pins didn’t engage) McDonnell Douglas had another opportunity to rethink its door design. But doing so would be costly, and besides, in McDonnell Douglas’s view it was the baggage handler’s fault. However, the head of the Western regional office of the FAA, which oversaw McDonnell Douglas, clearly saw the danger of the cargo door design, and knew that it would eventually need to issue a mandatory Airworthiness Directive (AD) legally requiring the manufacturer to implement a redesign or risk the planes being grounded. While various parties explored a design solution, the Western regional office planned to issue a series of ADs mandating interim fixes, beginning with a requirement to implement McDonnell Douglas’s improvement to the latch actuator wire. But before the office could finish drafting even this first most insignificant directive, Jackson McGowen, president of the Douglas division of McDonnell Douglas, telephoned FAA Administrator John Shaffer in order to intervene. McGowen feared that an Airworthiness Directive, which is public and would be released to the media, might harm sales of the DC-10 relative to the L-1011. McGowen allegedly promised that the DC-10s would be fixed “by Friday” and that there was no need for an AD; everything could be resolved through a sort of informal “gentlemen’s agreement.”
This “gentlemen’s agreement” blindsided the Western regional office, but there was nothing they could do; the order had come from the very top. The NTSB was also shocked by the FAA’s refusal to implement its recommendations. Its anger was justified by recent history. In 1968, 88% of NTSB recommendations were adopted within one year by the FAA, a number which would seem unbelievably high today. But as soon as President Nixon granted leadership of the FAA to John Shaffer, a man with close ties to the industry he was regulating, that percentage began to drop rapidly. (The resulting friction eventually led to Charles Miller being forced out of the NTSB for being too vocal in his criticism of the FAA. Shortly after this, legislation was thankfully passed to make the NTSB independent of the Department of Transportation.)
The result of the gentlemen’s agreement was, of course, that modifications to the cargo door proceeded on a voluntary basis with no firm timeline. Had a binding regulation been issued, it is more likely that the door on fuselage #29 would have been properly modified and in good working order when it was delivered to Turkish Airlines, and the disaster might not have happened.
Meanwhile, back in 1972, engineers at the Convair division of General Dynamics, which Douglas had contracted to manufacture the fuselage and doors according to its specifications, began to express concern about the design of the aircraft’s floor. Shortly after the Windsor incident, Dan Applegate, the head of product engineering at Convair, wrote a memo urging his superior J. B. Hurt to take his concerns about the DC-10’s floor to McDonnell Douglas. In no uncertain terms, Applegate explained that even if the fundamentally flawed cargo door was fixed, the floor design could still lead to disaster. In his memo, he wrote: “It seems to me inevitable that, in the 20 years ahead of us, DC‐10 cargo doors will come open and cargo compartments will experience decompression for other reasons, and I would expect this to usually result in the loss of the airplane.” Furthermore, because Convair was aware that this could occur, the company could be exposed to liability in these future accidents. The solution, in Applegate’s mind, was to make sure McDonnell Douglas changed the design of the floor as quickly as possible. (Convair, while responsible for fabricating the fuselage including the floor, had no authority to change the design unilaterally.)
J. B. Hurt carefully considered the contents of the so-called Applegate memo, and eventually decided to reject Applegate’s suggestion. There was nothing actually wrong with Applegate’s argument, he wrote in his official reply — the possibility of failure was real, as was the likelihood that Convair would be held liable in the event of a crash. But Hurt explained that McDonnell Douglas already knew about this potential for catastrophe, and if Convair brought it up to them that could be a liability in and of itself, because the terms of their contract stated that Convair was required to raise an objection to any design elements that it felt were unsafe prior to the fabrication of those elements. Obviously they had not done this, which meant that Convair could be found legally in breach of its contract if it revealed these concerns only after the floors had been built and installed on airplanes. The considerable expense of retroactively changing the floor design could thus be placed on Convair. (Unstated in either memo was the fact that Convair had little choice but to agree to Douglas’s design decisions.) Furthermore, Hurt believed that McDonnell Douglas’s lack of action to fix the floor meant that they were waiting for an excuse to make Convair pay for it. J. B. Hurt called this “an interesting legal and moral problem.” And in the end, he chose the legal over the moral.
The real bombshell in the Applegate memo and Hurt’s reply was not so much that Convair declined to tell McDonnell Douglas about the issue, but rather the fact that the memos contained confirmation that both companies knew the design of the DC-10’s floor was likely to cause a major disaster. Despite knowing of this vulnerability, and also knowing that airlines had reported over 1,000 issues with the DC-10s rear cargo door (a rate of more than 10 per plane at the time), McDonnell Douglas actively campaigned to avoid any binding requirement to fix this obvious danger. And even worse, it hid this knowledge from the FAA. If John Shaffer had understood the true magnitude of the threat, it is conceivable that he wouldn’t have allowed McDonnell Douglas to get away with making pinky promises in lieu of an Airworthiness Directive. Through this series of actions, McDonnell Douglas knowingly ensured that another DC-10 would eventually crash due to an in-flight opening of the cargo door. And by aggressively marketing the DC-10 to Turkish Airlines, then giving this ill-prepared carrier a defective airplane, they all but ensured that that crash would happen at THY.
Four days after the crash of Turkish Airlines flight 981, the FAA issued a series of Airworthiness Directives mandating a redesign of the cargo door and the installation of vents in the floors of all large jets to relieve a pressure spike. No serious incidents involving the DC-10 cargo door ever again occurred. But that came much too late for the 346 victims of the tragedy in the Ermenonville Forest and the countless bereaved loved ones that they left behind. The families of the victims eventually won from McDonnell Douglas what was at that time the largest ever monetary settlement stemming from an air disaster. Furthermore, safety concerns prevented the company from selling as many DC-10s as they had hoped. In the end, it would have been less expensive for McDonnell Douglas if they had just fixed the planes.
Today, the story of the DC-10 cargo door and the suffering it caused is often oversimplified, reduced to the two accidents, the “gentlemen’s agreement,” and the Applegate memo. But the deaths of 346 people in a forest outside Paris were really the culmination of a complex, interconnected web of events, driven by a large number of people who each did what they thought was necessary or right, whether that was the baggage handler who locked a door that wasn’t closed, or the McDonnell Douglas executive who feared that the company would fail and he would lose his job if he didn’t sell enough DC-10s. Countless side characters stepped in and out of the picture, from the engineer who certified his own work and missed a clear design flaw, to the Turkish Air Force officials who wanted to use the DC-10 to carry troops to Cyprus, each of them unwittingly playing a small but possibly crucial role in the buildup to disaster. It wasn’t just a door — it was the system itself which failed.
That system, although it has undergone radical changes, is still similar in several key ways. So similar, in fact, that in 2017 the Boeing 737 MAX 8 could be produced with an egregious design flaw, kept hidden from the FAA, which resulted in two preventable crashes at unready airlines in developing countries, killing (coincidentally) 346 people. And so, while it is true that flying today is much safer than it was in 1974 — passengers today need not worry about their planes crashing because of badly designed doors — the same basic factors that led to the DC-10 cargo door saga still exist and still cause accidents. And unless major systemic improvements are made, such as drastically increasing funding for FAA oversight, such a sequence of events may yet happen again.
_________________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 200 similar articles.
You can also support me on Patreon.
