TK 981

Complete destruction in the Ermenonville forest

Turkish Airlines Flight 981 was a regularly scheduled flight from Istanbul Yesilköy Airport to London Heathrow Airport with an intermediate stop in Paris at Orly Airport. On 3 March 1974 the McDonnell Douglas DC-10 operating the flight crashed into the Ermenonville forest outside Paris, killing all 346 people on board. At the time, it was the deadliest plane crash ever. It still remains the fourth-deadliest plane crash in aviation history, is the deadliest involving a DC-10, the second deadliest with no survivors, and the deadliest to have occurred on French soil. The crash was also known as the Ermenonville air disaster, from the forest where the aircraft crashed.

The crash was caused when an improperly secured cargo door at the rear of the plane broke off, causing an explosive decompression which severed cables necessary to control the aircraft. Because of a known design flaw left uncorrected before and after the production of DC-10s, the cargo hatches did not latch reliably, and manual procedures were relied upon to ensure they were locked correctly. Problems with the hatches had occurred previously, most notably in an identical incident that happened on American Airlines Flight 96 in 1972. Investigation showed that the handles on the hatches could be improperly forced shut without the latching pins locking in place. It was noted that the pins on the hatch that failed on Flight 981 had been filed down to make it easier to close the door, resulting in the hatch being less resistant to pressure. Also, a support plate for the handle linkage had not been installed, although manufacturer documents showed this work as completed. Finally, the latching had been performed by a baggage handler who did not speak Turkish or English, the only languages provided on a warning notice about the cargo door's design flaws and the methods of compensating for them. After the disaster, the latches were redesigned and the locking system significantly upgraded.

Aircraft

McDonnell-Douglas DC-10-10 'Ankara'

The aircraft, a DC-10 Series 10 (production designation Ship 29), was built in Long Beach, California, under the manufacturer's test registration N1337U, and leased to Turkish Airlines as TC-JAV on 10 December 1972. The plane, owned by Mitsui, was originally to be purchased by All Nippon Airways, but the Japanese airline declined the aircraft in favor of the Lockheed L-1011 TriStar. It had 12 six-abreast first-class seats and 333 nine-abreast economy seats, for a total of 345 passenger seats. At the time of the accident there were only two people seated in first class, while economy class was fully occupied. The flight crew were all Turkish. Flight attendant nationalities included 4 from the U.K, 3 French and 1 Turkish. Flight 981's captain was Nejat Berköz, age 44, with 7,000 flying hours. First Officer Oral Ulusman, 38, had 5,600 hours flying time, and Flight Engineer Erhan Özer, 37, had 2,120 flying hours experience.

Accident

Flight 981 had flown from Istanbul that morning, landing at Paris's Orly International Airport just after 11:00 am local time. The aircraft was carrying just 167 passengers and 11 crew members in its first leg. 50 passengers disembarked in Paris. The flight's second leg, from Paris to London Heathrow Airport, was normally underbooked, but due to strike action by British European Airways employees, many London-bound travellers who had been stranded at Orly were booked onto Flight 981. 216 new passengers boarded the flight. As a result, the layover increased from the normal one hour to one hour and thirty minutes. Among them were 17 English rugby players who had attended a France–England match the previous day; the flight also carried six British fashion models, and 48 Japanese bank management trainees on their way to England, as well as passengers from a dozen other countries.

The aircraft left Orly at 12:32 pm, bound for Heathrow. It took off in an easterly direction, then turned to the north to avoid flying directly over Paris. Shortly after the take off, Flight 981 was cleared to FL230 (23,000 ft.), and started turning to the west, towards London. Shortly after 12:40 pm, just after Flight 981 passed over the town of Meaux, the rear left cargo door blew off. The sudden difference between the air pressure in the cargo area and the pressurised passenger cabin above it, which amounted to 2 pounds per square inch or 14 kilopascals, caused a section of the cabin floor above the open hatch to fail and blow out through the hatch, along with six occupied passenger seats attached to the floor section. The fully recognizable bodies of the six passengers who were ejected from the aircraft were found along with the plane's rear hatch, all having landed in a turnip field near Saint-Pathus, approximately 15 kilometres (9.3 miles) south of where the remainder of the plane would crash. An air traffic controller noted that as the flight was cleared to FL230, he had briefly seen a second echo on his radar, remaining stationary behind the aircraft, likely the remains of the rear cargo door.

When the door blew off, the primary as well as both sets of backup control cables that ran beneath the section of floor that was blown out were completely severed. This resulted in the pilots losing the ability to control the plane's elevators, rudder, and Number 2 and 3 engines. The flight data recorder showed that the throttle for Engine 2 snapped shut when the door failed. The loss of control of these key components meant that the pilots lost control of the aircraft entirely.

"...disintegrated into millions of pieces instantly"

The aircraft almost immediately attained a 20-degree, nose-down attitude, and started picking up speed, while Captain Berköz and First Officer Ulusman struggled to regain control. At some point, one of the crew pressed his microphone button, broadcasting the pandemonium in the cockpit on the departure frequency. Controllers also picked up a distorted transmission from the plane; the aircraft's pressurisation and overspeed warnings were heard over the pilots' words in Turkish, including the co-pilot saying "the fuselage has burst!" As the plane's speed increased, the additional lift started to raise the nose again. Berköz called "Speed!" and once more started to push the throttles forward, to level off. It was too late, however, and 77 seconds after the initial door hatch gave way, the plane slammed into the trees of Ermenonville Forest, a state-owned forest at Bosquet de Dammartin, in the commune of Fontaine-Chaalis, Oise. At the point of impact, the aircraft was travelling at a speed of approximately 430 knots (490 mph; 800 km/h) in a slight left turn, fast enough that the plane disintegrated into millions of pieces instantly. The wreckage was so fragmented that it was difficult to tell whether any parts of the aircraft were missing. The post-crash fires were small, as there were few large pieces of the aircraft left intact to burn. Of the 346 passengers and crew on board, only 40 bodies were visually identifiable with rescue teams recovering some 20,000 body fragments in all. Nine passengers were never identified.

Investigation

The French Minister of Transport appointed a commission of inquiry by the Arrêté 4 March 1974. Because the aircraft was manufactured by an American company, observers from the United States participated. There were many passengers on board from Japan and the United Kingdom, so observers from those countries followed the investigation.

Lloyd's of London insurance syndicate, which covered Douglas Aircraft, retained Failure Analysis Associates (now Exponent, Inc.) to investigate the accident as well. In the company's investigation, Dr. Alan Tetelman noted that the pins on the cargo door had been filed down. He learned that on a stop in Turkey, the ground crews had trouble closing the door. They filed the pins down, reducing them by less than a quarter of an inch (6.4 millimetres), and were then able to close the door effortlessly. It was proven by tests that the door subsequently yielded to about 15 psi (100 kPa) of pressure, in contrast to the 300 psi (2,100 kPa) that it had been designed to withstand.

Cause

Recovered cargo door during the technical examination

The passenger doors on the DC-10 are plug doors, designed to prevent their opening while the aircraft is pressurised. The cargo hatch, however, is not. Owing to its large radius, the cargo hatch on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the hatch was designed to open outward, allowing cargo to be stored directly behind it. The outward-opening design allowed the hatch to be blown open by the pressure inside the cargo area if the latch failed during flight. To prevent this, the DC-10 used a latching system incorporating "over-center latches" – four C-shaped latches mounted on a common torque shaft that were rotated over latching pins ("spools") fixed to the aircraft fuselage. Due to their shape, when the latches were in the proper position, internal pressure on the hatch did not place any torque on them that could cause them to open; they actually seated further onto the pins. The latches were engaged by electric actuators, with a hand crank provided as a backup.

To ensure this rotation was complete and the latches were in the proper position, the DC-10 cargo hatch design included a separate locking mechanism that consisted of small locking pins that slid behind flanges on the lock torque tube (which transferred the actuator force to the latch hooks through a linkage). When the locking pins were in place, any rotation of the latches would cause the torque tube flanges to contact the locking pins, making further rotation impossible. The pins were pushed into place by an operating handle on the outside of the hatch. If the latches were not properly closed, the pins would strike the torque tube flanges and the handle would remain open, visually indicating a problem. Additionally, the handle moved a metal plug into a vent cut in the outer hatch panel. If the vent was not plugged, the fuselage would not retain pressure, eliminating any pneumatic force on the hatch. Also, there was an indicator light in the cockpit, controlled by a switch actuated by the locking pin mechanism, that remained lit unless the cargo hatch was correctly latched.

Similarities American Airlines Flight 96

Cargo door of Flight 96 being observed after landing

The cargo door design flaw, and the consequences of a resulting in-flight decompression, had been noted by Convair engineer Dan Applegate in a 1972 memo. The memo was written after American Airlines Flight 96, another DC-10, had a rear cargo door failure identical to the one that occurred on Flight 981, causing an explosive decompression. Even though the pilots' ability to control the aircraft was compromised by the severing of some of the underfloor cables in the blown-out section of the plane, they were able to land it in Detroit without further injuries. Note: The reason the control cables were not completely severed on American Airlines Flight 96 was because American Airlines had installed a galley above the rear cargo hatch beneath that cabin floor – that reduced the weight on the cabin floor in this location. The galley presumably weighed less than an equivalent number of passengers and their seats sitting in this same location.) The NTSB's investigation into Flight 96 found that the handlers had forced the locking handle closed, in spite of the fact that the latches had not engaged fully because of an electrical problem. The incident investigators discovered that the rod connecting the pins to the handle was weak enough that it could be bent with repeated operation and some force being applied, allowing the baggage handler to close the handle with his knee in spite of the pins interfering with the torque tube flanges. The vent plug and cockpit light were operated by the handle or the locking pins, not the latches, so when the handle was stowed, both of these warning devices indicated that the door was properly closed. In the case of Flight 96, the plane was able to make a safe emergency landing because not all of the underfloor cables were severed, thus allowing the pilots limited control. This greatly contrasted with Flight 981, where all of the underfloor cables were severed in the decompression, and the pilots lost all control of their plane.

In the aftermath of Flight 96, the NTSB made several recommendations. Its primary concern was the addition of venting in the rear cabin floor that would ensure that a cargo area decompression would equalise the cabin area, and not place additional loads onto the floor. In fact, most of the DC-10 fuselage had vents like these; only the rearmost hold lacked them. Additionally, the NTSB suggested that upgrades to the locking mechanism and to the latching actuator electrical system be made compulsory. However, while the FAA agreed that the locking and electrical systems should be upgraded, it also agreed with McDonnell-Douglas that the additional venting would be too expensive to implement, and did not demand that this change be made.

The plane that crashed as Flight 981, TC-JAV, or "Ship 29", had been ordered from McDonnell-Douglas three months after the service bulletin was issued, and was delivered to Turkish Airlines another three months after that. Despite this, the changes required by the service bulletin (installation of a support plate for the handle linkage, preventing the bending of the linkage seen in the Flight 96 incident) had not been implemented. The interconnecting linkage between the lock and the latch hooks had not been upgraded. Through either oversight or deliberate fraud, the manufacturer construction logs nevertheless showed that this work had been carried out. An improper adjustment had been made to the locking pin and warning light mechanism, however, causing the locking pin travel to be reduced. This meant that the pins did not extend past the torque tube flanges, allowing the handle to be closed without excessive force (estimated by investigators to be around 50 pounds-force or 220 newtons) despite the improperly engaged latches. These findings concurred with statements made by Mohammed Mahmoudi, the baggage handler who had closed the door on Flight 981; he noted that no particular amount of force was needed to close the locking handle. Changes had also been made to the warning light switch, so that it would turn off the cockpit warning light even if the handle was not fully closed.

Aft cargo door placards on a DC-10

After Flight 96, McDonnell-Douglas added a small peephole that allowed the baggage handlers to visually inspect the pins, confirming they were in the correct position, and placards to show the correct and incorrect positions of the pins. This modification had been applied to Flight 981's plane. However, Mahmoudi had not been instructed about the purpose of the indicator window; he had been told that as long as the door latch handle stowed correctly and the vent flap closed at the same time, the door was safely latched. Furthermore, the instructions on the plane regarding the indicator window were printed in English and Turkish, but Algerian-born Mahmoudi, who was fluent in three other languages, could read neither of these.

It was normally the duty of either the airliner's flight engineer or the chief ground engineer of Turkish Airlines to ensure that all cargo and passenger doors were securely closed before takeoff. In this case, the airline did not have a ground engineer on duty at the time of the accident, and the flight engineer for Flight 981 failed to check the door personally. Although French media outlets called for Mahmoudi to be arrested, the crash investigators stated that it was unrealistic to expect an untrained, low-paid baggage handler who could not read the warning sticker to be responsible for the safety of the aircraft.

Aftermath

The latch of the DC-10 is a study in human factors, interface design, and engineering responsibility. The control cables for the rear control surfaces of the DC-10 were routed under the floor. Therefore, a failure of the hatch that resulted in a collapse of the floor could impair the controls. If the hatch were to fail for any reason, there was a very high probability the plane would be lost. To make matters worse, Douglas chose a new type of latch to seal the cargo hatch. This possibility of a catastrophic failure as a result of this overall design was first discovered in 1969, and actually occurred in 1970 in a ground test. Nevertheless, nothing was done to change the design, presumably because the cost for any such changes would have been borne as out-of-pocket expenses by the fuselage's subcontractor, Convair. Although Convair informed McDonnell Douglas of the potential problem, Douglas ignored these concerns, because rectification of what Douglas considered to be a small problem with a low probability of occurrence would have seriously disrupted the delivery schedule of the aircraft, and caused Douglas to lose sales. Dan Applegate was Director of Product Engineering at Convair at the time. His serious reservations about the integrity of the DC-10's cargo latching mechanism are a classic case in engineering ethics.

After the crash of Flight 981, the latching system was completely redesigned. The latches were redesigned to prevent them from moving into the wrong positions in the first place. The locking system was mechanically upgraded to prevent the handle from being forced closed without the pins in place, and the vent door was altered to be operated by the pins, thereby indicating when the pins, rather than the handle, were in the locked position. Additionally, the FAA ordered further changes to all aircraft with outward-opening doors, including the DC-10, Lockheed L-1011, and Boeing 747, requiring that vents be cut into the cabin floor to allow pressures to equalise in the event of a blown-out door.

Similar accidents

An outward-opening cargo hatch is inherently less resistant to blowing open than an inward-opening one, also called a plug door. In flight, the air pressure inside the aircraft is greater than that outside, and pushes outward on the hatch. In the case of a plug door, this actually seals the door more tightly. An outward-opening hatch, however, relies entirely upon its latch to prevent it from opening in flight. This makes it particularly important that the locking mechanisms be secure. Aircraft other than DC-10s have also experienced catastrophic failures of hatches. The Boeing 747 has experienced several such incidents, the most noteworthy of which occurred on United Airlines Flight 811 in February 1989. On Flight 811, the cargo hatch failed, causing a section of the fuselage to fail, resulting in the deaths of nine passengers, who were blown out of the aircraft.

The NTSB's recommendations following the earlier Flight 96 incident, which were intended to decrease the possibility of another hatch failure, were not implemented by any airline. As a result, the NTSB now communicates directly with the FAA regarding the former's recommendations for safety improvements, and the FAA may issue Airworthiness Directives based on those recommendations. However, the FAA is not obligated to act on NTSB recommendations.

Source:
https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_981