McDonnell Douglas DC-10

Turk Hava Flight TK981, TC-JAV
Paris, France
March 3, 1974
Turk Hava, Flight TK981, a McDonnell-Douglas DC 10-10, departed Orly Airport in Paris, France for London's Heathrow Airport. Approximately 10 minutes after takeoff, Flight TK981's radar signature was seen to split into two, with one part remaining stationary before disappearing from the radarscope. The second part turned left to a heading of 280 degrees. This second radar return was the separation of the cargo door, which occurred at a height of approximately 11,000 feet, at a point when the cabin pressure would have been roughly equal to that of sea level. The ejection in flight of the aft cargo door on the left-hand side was followed by a sudden depressurization which led to the disruption of the floor structure. It caused six passengers and parts of the aircraft to be ejected, rendering the number 2 engine inoperative and impairing the flight controls (tail surfaces) so that it was impossible for the crew to regain control of the aircraft. Seventy-seven seconds later, the airplane crashed in the forest 37 km northeast of Paris.
The Investigation Commission determined that the accident was the result of the in-flight ejection of the aft cargo door on the left-hand side. The sudden depressurization that followed led to the disruption of the floor structure, impairing the flight controls so that it was impossible for the crew to regain control of the aircraft. The underlying factor in the sequence of events leading to the accident was the incorrect engagement of the door latching mechanism before takeoff, made possible by the characteristics of its design.
On Sunday March 3, 1974, Flight TK981 departed Istanbul for Paris and London. The DC-10 landed at Paris-Orly at 11:02 and taxied to stand A2. There were 167 passengers on board of whom 50 disembarked. The aircraft was refueled, and baggage was loaded onto the plane. The planned turnaround time of one hour was delayed by 30 minutes. An additional 216 passengers embarked.

Most of the passengers were booked on this flight because of a strike at British Airways. Throughout Europe, the British Airways strike affected nearly all air travel. The Turk-Hava airplane was normally a charter operation that had been pressed into scheduled service in order to compensate for the lack of British Airways flights.
The door of the aft cargo compartment on the left-hand side was closed at about 10:35. When all preparations were complete, the flight received permission to taxi to runway 08 at 12:24. Four minutes later the crew was cleared to line up for departure, and then cleared for departure route 181 and an initial climb to 4000 feet. The aircraft took off at approximately 12:30 hours, and was cleared to climb to 6000 feet, which was reached at 12:34. The North Area Control Center then cleared TK981 further to 23000 feet. Three or four seconds before 12:40:00 hours, the noise of decompression was recorded on the cockpit voice recorder, and the copilot said, "the fuselage has burst" as the pressurization aural warning sounded. This was caused by the opening and separation of the aft left-hand cargo door. Because of the pressure difference in the cargo bay and passenger cabin, the floor above the cargo door partly collapsed. Two occupied triple seat units were ejected from the aircraft. All the horizontal stabilizer and elevator control cables, routed beneath the floor of the DC-10, were severed. Thrust control on the number 2 engine was also lost. The aircraft turned nine degrees to the left and pitched nose down. The nose-down attitude increased rapidly to -20 deg. Although the numbers 1 and 3 engines were throttled back, the speed increased to 360 knots. The pitch attitude then progressively increased to -4 degrees and the speed increased to 430 knots (800 km/h). In a left bank of 17 degrees, the DC-10 crashed into the forest of Ermenonville, 37 kilometers northeast of Paris.
Six bodies and bits of the fuselage were also found in fields some eight miles from the crash sites. Further analysis of the associated wreckage showed that one of the pieces was the rear cargo door. Investigators found that a support plate, which prevents forced closing of the locking handle and the vent door when the door is not fully latched and locked, was not installed on this door. Maintenance records of modifications accomplished on this airplane by McDonnell-Douglas reflected that the support plate had been installed.


View Larger
Investigation of the accident revealed that prior to takeoff, the cargo door was not properly latched and locked (see Closing of the Cargo Door) (see NTSB video describing door closure system) and the flight deck aft cargo door warning light (see illustration of flight engineer's panel in the cockpit) went out prematurely because of an incorrectly rigged warning switch.
Examination of the latch actuator revealed insufficient extension of the actuator shaft (277.5 mm versus 297 mm for full extension). This resulted in the torque tube not rotating far enough to move the latch hooks into the "over-center" position. See DC-10 Cargo Door Latch Animation for an illustration of this process.
Additionally, the lock pins were not properly rigged to engage had the torque tube been properly rotated. The four lock pins on the lock tube were 1.6 mm short of the rear face of the restraining flanges. With the latch hooks not "over center" and the lock pins not engaged, the loads applied to the latch hooks from fuselage internal pressure were transmitted through the latching mechanism to the latch actuator support bracket, failing the two attachment bolts. When the two attachment bolts failed, the detached latch actuator enabled the latch hooks to slip off the latch spools, resulting in the sudden opening of the cargo door.

View Larger

View Larger
The sudden opening of the aft cargo door resulted in a rapid loss of pressurization in that compartment. The cabin floor was not equipped with pressure relief vents. Thus, the loss of the door caused the full differential pressure between the pressurized passenger cabin and the atmosphere to be exerted on the cabin floor over the compartment. This loading failed the floor support structure and the cabin floor collapsed downward into the cargo compartment.

The collapse of the floor severed cables to the empennage control surfaces. The control cables from the cockpit to the empennage control actuators were routed through the cabin floor beams over this cargo compartment. The severed control cables made it impossible to control the aircraft pitch attitude.
The accident report stated that tests on a door with the same definition as that of TC-JAV revealed - due to incorrect adjustment of the lock tube and the bent link between the locking handle and the vent door shaft - that the vent door could be closed without excessive force. The person that closed the aft cargo door stated that he proceeded as usual, without any particular difficulties, and that he did not notice any abnormalities.
Twenty-one months prior to this Turk Hava accident, an American Airlines DC-10 suffered a similar explosive decompression due to the opening of the aft cargo door near Windsor, Ontario, Canada (see summary of the American Airlines DC-10, Windsor accident).
Regarding the aft cargo door on the left hand side:
- Service Bulletin 52-37, specifying the installation of a support plate designed to prevent forced closing of the locking handle and the vent door in the case of incomplete engagement of the latching system, had not been applied to the aircraft before delivery, and this oversight had not been detected at the time of delivery. It was found, however, that work on the application of this modification had begun on the lock tube where chamfering had been roughly carried out.
- While the aircraft was in service, a modification (direct access to the drive mechanism) had been carried out in a way which did not comply with Service Bulletin 52-38.
- The adjustments of the lock pins and the lock limit warning switch were incorrect.
- The striker of the unlock limit switch had two shims of Douglas origin, surmounted by a shim with no reference and of a quality not to aeronautical standards.

- During the aircraft's stop at Orly, the aft cargo door on the left-hand side had been closed without any apparent abnormality. The locking handle had been pulled down and the vent door closed, although the lock pins were not engaged, and no visual inspection had been made through the view port provided for the purpose of verifying that the lock pins were in place.
- The takeoff and climb progressed without incident until the aircraft reached approximately 11,000 feet at about 1140 hrs. At that time, the aft cargo door on the left-hand side opened in flight and became detached from the aircraft structure.
- The drop in pressure in the cargo compartment caused an immediate pressure differential which was sufficient to cause the disruption of the floor structure and the consequent ejection of six passengers, their cabin seats and various pieces of wreckage.
- The deformation and disruption of the floor led to serious impairment of the controls of number 2 engine and of the flight controls of which the cables run under this part of the aircraft structure. The damage was such that it was impossible for the crew to regain control of the aircraft.
- Because of the design of the mechanism as a whole, the incomplete application of modification SB 52-37 (absence of support plate specified) and the adjustments found on measurement to be incorrect (lock pins and striker), it was possible for the door locking handle to be pulled down without the use of any abnormal force and for the flight deck visual warning light to be switched off when the latches were not fully engaged and the lock pins not in place. The tests and research have confirmed incomplete engagement of the cargo door latches and, in correlation, the non-engagement of the lock pins.
- The investigation into an accident at Windsor (Ontario) on June 12, 1972, had provided evidence of the grave risks entailed by sudden depressurization of the cargo compartment. The inadequacy of the pressure relief vents had resulted in the disruption of the floor under which the flight control cables run, thereby causing the jamming or rupture of the cables.
Causes of the accident
The Commission of Inquiry determined that the accident was the result of the ejection in-flight of the aft cargo door on the left-hand side. The sudden depressurization that followed led to the disruption of the floor structure, causing six passengers and parts of the aircraft to be ejected, rendering number 2 engine inoperative, and impairing the flight controls (tail surfaces) so that it was impossible for the crew to regain control of the aircraft.
The underlying factor in the sequence of events leading to the accident was the incorrect engagement of the door latching mechanism before takeoff. The characteristics of the design of the mechanism made it possible for the vent door to be apparently closed and the cargo door apparently locked when in fact the latches were not fully closed, and the lock pins were not in place.
It should be noted, however, that a view port was provided so that there could be a visual check of the engagement of the lock pins.
The defective closing of the cargo door resulted from a combination of various factors:
- Incomplete application of Service Bulletin 52-37
- Incorrect modification and adjustments which led, in particular, to insufficient protrusion of the lock pins and to the switching off of the flight deck visual warning light before the door was locked.

- The circumstances of the closure of the door during the stop at Orly, and, in particular, the absence of any visual inspection through the view port to verify that the lock pins were effectively engaged. Although at the time of the accident, inspection was rendered difficult by the inadequate diameter of the view port.
Finally, although there was apparent redundancy of the flight control systems, the pressure relief vents between the cargo compartment and the passenger cabin were inadequate. Additionally, all the flight control cables were routed beneath the floor. These factors placed the aircraft in grave danger, in the case of any sudden depressurization, causing substantial damage to that part of the structure.
All these risks had already become evident nineteen months earlier, at the time of the Windsor accident. However, no efficacious corrective action had followed.
Final Report in English - Report published by the French Secretariat of State for Transport translated by the British authorities

Photo copyright BEA France – used with permission
1) After the accident near Windsor, Ontario (see "Precursors"), two safety recommendations were issued by the National Transportation Safety Board (NTSB):
- Recommendation A-72-97 relating to the modification of the cargo door locking system to make it impossible to position the locking handle and vent door to their normal door-locked positions unless the lock pins are fully engaged.
- Recommendation A-72-98 relating to the means of minimizing the effect on the flooring in the event of sudden depressurization of the cargo compartments.
Further, the French investigating authorities made the following comments and recommendations:
"The Ermenonville accident has shown that the modifications made to the locking system, modifications moreover incompletely applied to TC-JAV, were inadequate and that the measures proposed to mitigate sudden decompression had not been carried out.
Since the accident, the Certification Authorities and the manufacturer have decided to put new procedures and modifications into operation.
The Commission is of the opinion that their application should be mandatory and that they should be implemented as soon as possible in the case of all aircraft of the type in question.
In general, the Commission recommends that in the case of all the aircraft particular attention should be paid to the efficacy of the cargo closing, locking and checking systems, and also to the behavior of the flooring in the case of sudden depressurization of the cargo compartments."

Photo copyright Marc Neumann - used with permission
2) Alongside the above measures, the fact remains that the case of TC-JAV has shown that the necessary redundancy of the flight controls could be inadequate when the routing of the systems as a whole was concentrated at points where structural damage could occur.
The case of TC-JAV has also drawn attention to the possible consequences of damage to a control circuit, damage which should never inhibit the operation of the surviving circuits.
3) The Commission recommends that the training of personnel responsible for operating cargo doors or checking their closure should be organized in accordance with a detailed program established by agreement between the manufacturer and the airline and approved by the official services.
4) Examination of the procedures used after the Windsor (Ontario) accident, in order to advise the manufacturer and the airline of the necessary modifications, has shown that the method of the "airworthiness directive" was not used; for that reason, the recommended measures were not mandatory and appropriate means were not employed to bring the matter to the attention of those concerned.
The Commission recommends that the mandatory procedure of "airworthiness directives", whatever the financial repercussions, should be selected whenever safety could be at serious risk.
5) As a result of the magnitude of the disaster and, in particular, the large number of victims, there were considerable difficulties in the recovery, preservation and identification of the bodies. It became apparent, in particular, that the "Institut Médico-Légal" de Paris and the Paris hospitals did not have facilities on a scale related to this type of situation.
The Commission recommends that a study should be made of the measures required to take account of the new problems raised by the large capacity of the aircraft.
Certification Basis
The following regulations were in place at the time the engine and aircraft were certificated:

Photo copyright BEA France – used with permission
14 CFR part 25, dated February 1, 1965, through Amendment 25-22, and Amendment 25-23 for FAR 25.471.
Specifically, 14 CFR 25.365 and 25.783 were most relevant to the cargo door.
At the time of this accident, a British Airways pilot strike had affected air travel throughout Europe. Airlines and airplanes not normally employed on European routes were pressed into service to meet the passenger demand. Turk-Hava normally operated as a charter carrier and did not fly regularly scheduled service between Paris and London. The schedule demands and pressure to maintain "on-time" performance while maintaining airplane maintenance, etc., may have been a contributing factor in the series of events leading to the accident.

Photo copyright O. Ferrante - used with permission
This monument was built on the crash site in the Forest of Ermenonville to remember the Catastrophe of March 3, 1974. There is also a granite memorial with the names of the victims engraved in stone.
Further at this same time, an intense competition existed between the three major manufacturers (Boeing, McDonnell-Douglas, and Lockheed) to capture the wide-body airplane sales market, colloquially known as the "Jumbo Wars". It was widely believed at the time that the market would not support three different airplane models, and to dominate the market, a manufacturer's product had to operate in the market without problems that could affect the sales potential, or marketability, of the airplane.
About a year prior to the Paris accident, the American Airines inflight opening of the aft cargo door at Windsor-Locks, Ontario had exposed a potential problem with the airplane that could have potentially affected the ability to sell the airplane. Following the American Airlines event, the FAA had written, but not released, an Airworthiness Directive aimed at correcting the cargo door failure. McDonnell-Douglas developed three service bulletins for modification of the cargo door and proposed to the FAA that rather than issue an AD, the FAA allow the manufacturer to issue the service bulletin as mandatory (an unprecedented action for an urgent safety issue of this magnitude). The FAA concurred with this proposal, and the service bulletins were issued, but their incorporation was not mandated by the FAA. Many carriers voluntarily incorporated the service bulletin modifications, and retrained ground personnel on the proper operation of the door closure mechanism. At the time of the accident, Turk-Hava had only incorporated two of the three service bulletins, although airplane maintenance records reflected that all three had been incorporated. The lack of the final modification, and the fact that the modifications had not been mandated by the FAA was viewed as a major factor in the chain of events leading to this accident.
The following key safety issues contributed to this incident:
- Closure of the vent door when the door was not fully latched and locked (an open vent door would have prevented the airplane from being pressurized to an unsafe level).
- Cabin floor/flight control arrangement was vulnerable to rapid fuselage compartment venting (i.e. floor collapse).
- Structural integrity of door closure linkage was inadequate (e.g., door closure personnel stronger than expected; actuator bolts unable to withstand backdriving force due to cabin pressure).
- Unreliable cargo door warning light system.

View Larger

The following design and safety assumptions proved to be flawed in this incident:
- Cargo door would be properly closed, latched, and locked prior to flight.
- Door warning system would indicate if cargo door was not closed, latched, and locked.
- The external lock handle cannot be stowed, and the vent door will remain open when the cargo door is not closed, latched, and locked.
- The stowed external lock handle and the closed vent door is a visual indication that the door is locked.
- If the cargo door is not closed, latched, and locked the opened vent door would prevent pressurization of the airplane.
- Personnel closing and locking the cargo door would follow placarded instructions.
- The cargo door would be primarily operated using the normal electrically controlled opening, closing, and latching system, and that manual operation of the door would be infrequent.

Windsor-Locks Accident
Copyright George W. Hamlin - used with permission
On June 12, 1972, American Airlines DC-10 Flight 96 outbound from Detroit, Michigan was damaged substantially when the aft bulk cargo compartment door separated from the aircraft in flight at approximately 11,750 feet near Windsor-Locks, Ontario, Canada. The separation caused rapid decompression, which in turn caused failure of the cabin floor over the bulk cargo compartment. The collapse of the cabin floor damaged a number of the engine and flight control system cables which were routed through the floor beams in that area. The separated door also caused minor damage to the fuselage above the door and substantial damage to the leading edge and upper surface of the left horizontal stabilizer. The crew was able to get the aircraft on the ground safely using differential engine thrust and none of the 67 persons on board were injured.
The National Transportation Safety Board (NTSB) determined that the probable cause of this accident was the improper engagement of the latching mechanism for the aft bulk cargo compartment door during the preparation of the airplane for flight. The design characteristics of the door latching mechanism permitted the door to be apparently closed when, in fact, the latches were not fully engaged and the latch lockpins were not in place.
Two safety recommendations were issued by the NTSB:
- Recommendation A-72-97 - relating to the modification of the cargo door locking system to make it impossible to position the external locking handle and vent door to their normal door-locked positions unless the lock pins are fully engaged.
- Recommendation A-72-98 - relating to the means of minimizing the effect on the flooring in the event of sudden depressurization of the cargo compartments.
The first of these recommendations had given rise to the modifications specified in Alert Service Bulletin 52-35 and in Service Bulletins 52-27 and Service Bulletin 52-37.
There were many similarities between this accident and Turk Hava accident.
Similarities Between the American Airlines and Turk Hava Accidents:
- The latches were not fully closed, and the latch lock pins were not in place.
- The flight deck warning light had gone out before effective locking had occurred.
- The altitude reached by the American Airlines DC-10 (11,750 ft.) was approximately the same as that of TC-JAV (11,000 ft.) when the door opened and the two bolts (connecting the fixed part of the latch actuator to the door structure) failed under the same conditions.
- In the absence of pressure relief vents of adequate size between the passenger cabin and the aft cargo compartment, the sudden decompression in the cargo compartment caused damage to the cabin floor and its structure. This damage was less severe than in the case of TC-JAV in which the floor was more heavily loaded, but the functioning of the control cables was impaired in various ways, although it did not become completely impossible to control the aircraft.
The modified seating configuration on the Turkish aircraft exacerbated the effects of decompression and caused the aircraft control cables to be severed, rendering the aircraft uncontrollable.

As a result of the Flight TK981 accident, the following changes were made:
- Amendment 54 to 14 CFR 25.365(e) added specific opening size equation for pressurized fuselages based upon cross sectional area: Ho=PAs, up to a maximum opening size of 20 square feet. Twenty square feet is approximately the size of the DC-10 aft bulk cargo door, failure of which led to the Turk Hava accident.
- Previous 25.365 failure likelihood of "extremely remote" replaced with "extremely improbable."
- Amendment 54 to 14 CFR 25.783 added the following paragraphs:
(e) There must be a provision for direct visual inspection of the locking mechanism to determine if external doors, for which the initial opening movement is not inward (including passenger, crew, service, and cargo doors), are fully closed and locked. The provision must be discernible under operational lighting conditions by appropriate crew members using a flashlight or equivalent lighting source. In addition, there must be a visual warning means to signal the appropriate flight crew members if any external door is not fully closed and locked. The means must be designed such that any failure or combination of failures that would result in an erroneously closed and locked indication is improbable for doors for which the initial opening movement is not inward.
(f) External doors must have provisions to prevent the initiation of pressurization of the airplane to an unsafe level if the door is not fully closed and locked. In addition, it must be shown by safety analysis that inadvertent opening is extremely improbable.
- Advisory Circular 25.783-1, "FUSELAGE DOORS, HATCHES, AND EXITS," dated December 10, 1986.
- Transport Airplane Directorate Memorandum, "Modification of Outward Opening Doors on Existing Transport Airplanes," dated March 20, 1992. The reason for this memorandum is discussed later.
- Floor venting safety issues on Boeing Model 767-200 and 767-300 series airplanes

by Boeing Service Bulletin 767-25A0300
Subsequently to Paris DC-10 accident, the FAA took action to further enhance safety by requiring that cabin floors be reinforced, and venting improved so as to increase survivability of the aircraft in the event of a major decompression or structural failure.
However, similar unsafe conditions were found present on certain Boeing Model 767 airplanes. To address these conditions, the FAA issued B767 AD 2003-13-03 on June 16, 2003, to correct a floor venting vulnerability on 767-200 and -300 series airplanes. It consisted of installing new insulation blankets as specified by Boeing Service Bulletin 767-25A0300 (see illustration below). The actions specified by this Airworthiness Directive were intended to prevent interference with venting during a rapid decompression in the bulk cargo compartment. Such interference could have caused damage to the floor structure and damage to certain control cables leading to the empennage and could have resulted in reduced controllability of the airplane, similar to the Paris DC-10 accident.
These preventive changes were estimated to affect approximately 739 airplanes in the worldwide fleet, and 296 airplanes of U.S. registry.
The following airworthiness directives were issued as a result of this accident.
- AD 74-08-04 R4 This AD mandated the incorporation of seven McDonnell-Douglas service bulletins to prevent possible in-flight depressurization of the airplane that might result from the opening of an improperly
Photo of the Turk Hava crash site
Copyright BEA France - Used with permission - AD 74-12-07 R1 This AD mandated the incorporation of five McDonnell-Douglas service bulletins to assure that in-flight depressurization will not occur as a result of the opening of a lower cargo door.
- AD 75-15-05 R1 This AD was probably the widest ranging result of the Paris crash. It became known as the "floors and doors" AD and was applied to all wide bodies in service at the time. This AD mandated modification to improve the capability of the passenger and crew compartment floors to withstand, without collapse, an in-flight depressurization caused by the sudden opening of a large hole in the fuselage and was applied to McDonnell-Douglas Model DC-10 Series, Lockheed Model L-1011 Series, Boeing Model B-747 Series, and Airbus Industrie Model A-300 Series airplanes certificated in all categories.
AD 74-08-04 was issued as a telegraphic AD on March 7, 1974, ninety-six hours after the crash to all operators of DC-10 aircraft. The AD directed them to perform the modifications on the cargo doors described in Douglas service bulletins. All of these service bulletins were issued shortly after the American Airlines accident 19 months previously. (SB 52-27, SB 52-37, SB 52-38)
On March 22, 1974, the FAA amended AD 74-08-04 to require the installation of the so-called "closed loop" system for locking the cargo doors.
The FAA did not take any action to review the design of the cargo door systems on other transport airplanes until after the United Airlines B-747 and Evergreen DC-9 inadvertent opening of fuselage doors accidents on February 24, 1989, and March 18, 1989, respectively. After the accidents the Transport Airplane Directorate (TAD), Los Angeles and Seattle ACOs, conducted a Special Certification Review (SCR) of the Type Certificated cargo door systems on transport airplanes for compliance with Amendment 25-54 to 14 CFR 25.783 and AC 25.783-1. The SCR was conducted in compliance with Transport Airplane Directorate memorandum, "Modification of Outward Opening Doors on Existing Transport Airplanes," dated March 20, 1992. Numerous ADs were issued to ensure compliance with Amendment 25-54 to 14 CFR 25.783. For information on the SCR, see Order 8110.4C, paragraph 2-7. e.
Another "cargo door systems" Special Certification Review was initiated in 1996.
Under the guidance of the Transport Airplane Directorate, engineers from the Atlanta, Seattle, and Los Angeles Aircraft Certification Offices and industry personnel reviewed the design of the Supplemental Type Certificated (STC) cargo door systems on the transport airplanes.
The review was to ensure compliance with Amendment 25-54 to 14 CFR 25.783, AC 25.783-1, and TAD "Modification of Outward Opening Doors on Existing Transport Airplanes," memo dated March 20, 1992. Numerous ADs were issued on STCs that did not comply with Amendment 25-54 to 14 CFR 25.783.
Airplane Life Cycle:
- Design / Manufacturing
Accident Threat Categories:
- Structural Failure
- Lack of System Isolation / Segregation
- Pressurization / Decompression Failures
Groupings:
- Loss of Control
- Automation
Accident Common Themes:
- Organizational Lapses
- Human Error
- Flawed Assumptions
- Pre-existing Failures
Organizational Lapses
In 1972, an in-flight incident occurred on an American Airlines flight which exhibited the identical failure mode as the Turk-Hava accident. Investigators concluded that the aircraft required modifications in order to prevent a repeat occurrence. In response to this finding, an emergency airworthiness directive was prepared by the FAA. As an alternative to the AD, McDonnell-Douglas proposed to the FAA Administrator a company campaign to retrofit the DC-10 fleet. This proposal was accepted by the FAA. In retrospect, an airworthiness directive, issued by a civil aviation authority, communicates the highest level of safety urgency and provides the widest notification of corrective actions. However, since aircraft maintenance records of the accident aircraft improperly indicated that corrective service bulletins had been incorporated, it is unclear whether issuance of an airworthiness directive would have been effective in avoiding this accident.

Photo copyright BEA France – used with permission
Flawed Assumption
The pressure relief vent door, incorporated in the design of the bulk cargo door closure mechanism, was intended to prevent airplane pressurization if the cargo door was not properly locked/latched. It was assumed that in the event of an improper cargo door closure, the vent door would remain open. The mechanism was defeated when high closure forces were applied, and the vent door closed, allowing pressurization to levels sufficient to expel the cargo door and damaging the airplane flight control system.
Pre-existing Failure
The cargo door proximity switch, an electronic switch providing indication on the flight deck of an open cargo door, was out of rig, and improperly indicated that the cargo door was closed. This improper rigging problem was common in the fleet at the time of this accident. The improper indication, in combination with the closed pressure relief vent door, indicated that the cargo door was closed and locked when in fact it was not.
Human Error
In attempting to close the cargo door, the ground servicing personnel encountered interference and difficulty in moving the closure mechanism. Application of high force levels appeared to cause the door to close and the locking mechanism to engage. In fact, the applied forces buckled a portion of the locking mechanism and allowed the door to appear locked when the locking mechanism was not fully engaged.
United Airlines flight 811, Boeing 747-100, N4713U
February 24, 1989: United Airlines flight 811 experienced an explosive decompression as it was climbing between 22,000 and 23,000 feet after taking off from Honolulu, Hawaii, en route to Auckland and Sydney. The airplane made a successful emergency landing at Honolulu and the occupants evacuated the airplane. Examination of the airplane revealed that the forward lower lobe cargo door had separated in flight and had caused extensive damage to the fuselage and cabin structure adjacent to the door. Nine of the passengers had been ejected from the airplane and lost at sea.

The NTSB determined that the probable cause was the sudden opening of the forward lower lobe cargo door in flight and the subsequent explosive decompression. The door opening was attributed to a faulty switch or wiring in the door control system which permitted electrical actuation of the door latches toward the unlatched position after initial door closure and before takeoff. Contributing to the cause of the accident was a deficiency in the design of the cargo door locking mechanisms, which made them susceptible to deformation, allowing the door to become unlatched after being properly latched and locked. Also contributing to the accident was a lack of timely corrective actions by Boeing and the FAA following a similar 1987 cargo door opening incident on a Pan Am B-747.
See accident module
Evergreen International Airlines, DC-9-33, N931F
March 18, 1989: The DC-9 arrived at Carswell AFB, Texas at 01:12 CST after a flight from Kelly AFB. The aircraft was off-loaded and re-loaded with cargo by USAF personnel. The engines were then started at 02:04. The crew received taxi instructions for runway 17 and took off from this runway at 02:09. At (or immediately after) rotation, the main cargo door opened. An emergency was declared, and the crew climbed to 2500 feet msl before entering a right turn. When about 5nm north of the airport the captain began a shallow turn to the right (for base leg). The aircraft crossed the extended centerline, and the captain tightened the turn to establish their position relative to the runway threshold. In doing so, the air load on the door probably caused it to rapidly move to its full open over the top position. A sudden opening of the door would also have produced an unexpected change in the yawing and rolling moments. The captain, possibly partially disoriented, may not have sensed the increasing roll and nose tuck and thus failed to correct a changing attitude until a critical bank angle and loss of altitude had occurred. The DC-9 struck the ground in an inverted, nose down, left wing low attitude and disintegrated.
It appeared that the first officer, when closing the main cargo door, didn't hold the door control valve 'T' handle in the closed position long enough for the latching hooks to move into place over the door sill spools. External latched and locked indicators were applied incorrectly, so the first officer thought the door was latched properly when the handle was pointed more toward the 'locked' than the 'unlocked' chevron. It also appeared that one of the two open door warning light switches was malfunctioning. Because of their wiring, this malfunction made the entire door warning system ineffective.
The NTSB determined that the probable cause was the loss of control of the airplane for undetermined reasons following the in-flight opening of the improperly latched cargo door. Contributing to the accident were inadequate procedures used by Evergreen Airlines and approved by the FAA for pre-flight verification of external cargo door lock pin manual control handle, and the failure of McDonnell-Douglas to provide flight crew guidance and emergency procedures for an in-flight opening of the cargo door. Also contributing to the accident was the failure of the FAA to mandate modification to the door-open warning system for DC-9 cargo-configured airplanes, given the previously known occurrences of in-flight door openings.
Technical Related Lessons:
Large breaches of pressurized fuselages can result in significant differential pressures. In order to mitigate the hazardous effects of these pressure differentials, adequate ventilation should be provided. (Threat Category: Pressurization / Decompression Failures)
- In the case of the Turk Hava accident, a door failure resulted in rapid decompression and had catastrophic
Photo of a Turk Hava DC-10
Photo copyright Marc Lehmann - used with permission
Safety features intended to protect against specific failure conditions must be arranged and isolated so that the failure condition does not defeat the safety feature. (Threat Category: Lack of System Isolation / Segregation)
- The bulk cargo door on the DC-10 was designed with a vent door that was intended to provide pressure venting in the event of an improper door closure or locking. If the vent door did not close when securing the cargo door, it indicated that the door was improperly locked/latched, and would also prevent the fuselage from pressurizing, thereby avoiding a cabin floor collapse. However, the design of the vent door closure system allowed it to be forced closed, buckling a rod in the vent door mechanism even though the cargo door mechanism was not properly latched/locked. This resulted in the appearance of proper door closure, and, in the case of the Turk Hava accident, allowed the airplane to pressurize to the extent that the cargo door was ejected, resulting in a cabin floor collapse, damage to control cables, and loss of control of the airplane.
Common theme Related Lessons:
Expected physical misuse/abuse of aircraft equipment (e.g., levers, knobs, handles, etc.) should not result in a catastrophic outcome. (Common Theme: Human Error)
- After the 1972 American Airlines cargo door failure, the FAA had prepared, but not released, an emergency airworthiness directive mandating a redesign of the bulk cargo door closure mechanism. McDonnell-Douglas, rather than concurring with the AD, proposed the release of a company service bulletin and a company-sponsored fleet campaign relative to service bulletin incorporation. The FAA concurred with this proposal as an alternate to issuance of an AD. Following the accident, maintenance records for the accident airplane indicated that the door modifications had been accomplished by the manufacturer; however, actual parts recovered showed that the modifications had been incomplete.
- On the day of the accident, an airline employee who had closed the aft cargo door reported no difficulties in the closing process. However, in order for the vent door to have been closed with the locking pins not properly engaged, a rod controlling the locking mechanism would have to have been buckled, as was observed on the earlier American Airlines incident. The investigators of the Turk Hava accident were unable to determine exactly how the door closure was accomplished at the airport ramp at Paris, or the level of forces which were applied. It was suspected, however, that a force may have been applied to move the lever which exceeded that intended by the designers and caused a rod in the closure mechanism to buckle. The vent door subsequently closed, thereby providing the appearance that the cargo door was properly locked/latched. This same "forced closure" had been previously experienced by American Airlines in 1972, resulting in a cargo door opening in flight, and partial floor collapse. These two nearly identical events underscore the need for robust designs that are tolerant of a wide variety of human capabilities.