The most important document in this story is a memo. It was written on 27 June 1972 by an engineer named Dan Applegate, it ran to a few pages, and it said clearly what was going to happen.

Twenty months later it happened. Three hundred and forty-six people died in a forest north of Paris.

The memo was never sent to the aircraft’s manufacturer. It came to light only when lawyers went looking through the files afterwards.

A door that opens the wrong way

Passenger doors on an airliner are plug doors. They are slightly larger than the hole they fill and they open inward first, so cabin pressure holds them shut. It is impossible to open one in flight, which is exactly the point.

Cargo doors on the DC-10 were not plugs. A big inward-opening door would have eaten into the hold, so McDonnell Douglas made them swing outward — which means the entire pressure load has to be carried by the locking hardware.

That hardware was five C-shaped latches on a common torque shaft, rotating over fixed pins on the fuselage frame. Rotate them fully over centre and cabin pressure simply seats them harder. Stop short of over centre and the same pressure feeds straight back through the linkage into the electric latch actuator and its two mounting bolts.

There were meant to be three independent backstops. Lock pins slid through holes behind the latches. If the pins could not enter, the external handle would not stow. The same handle drove a plug into a vent in the door skin, so an unlatched door meant an unpressurised hold. And a light on the flight engineer’s panel would stay on.

All three depended on the same piece of linkage — and that linkage was weak enough to be forced. On the manufacturer’s own test rig, the handle could be pushed closed with the pins still out.

Windsor, 1972: the warning

On 12 June 1972, American Airlines Flight 96 climbed out of Detroit with 67 people aboard. At 11,750 feet the aft cargo door left the aircraft. Dirt blew into the pilots’ faces; Captain Bryce McCormick briefly thought they had had a mid-air collision.

The floor partially collapsed, the rudder pedals slammed to full right, and the number two engine’s control cables were severed. But no hydraulic system was ruptured, the cabin load was lighter than it would be on TC-JAV, and McCormick — who had practised flying the aircraft on throttles alone in the simulator — had enough control left. He landed at Detroit. Nobody died.

The NTSB was unambiguous. Its recommendation A-72-97 asked for the door locking system to be modified so that the external handle and vent door simply could not reach the locked position unless the lock pins were fully engaged. Recommendation A-72-98 asked for the cabin floor to be protected against sudden hold decompression.

Neither became a legal requirement. The FAA drafted an airworthiness directive and did not release it. McDonnell Douglas proposed issuing service bulletins instead and treating them as mandatory itself. The FAA agreed — an arrangement usually described as a gentlemen’s agreement between FAA administrator John Shaffer and McDonnell Douglas aircraft division head Jackson McGowen.

How the DC-10 acquired its reputation — the design, the commercial pressure and the accidents.

The memo

Fifteen days after Windsor, Dan Applegate, Director of Product Engineering at Convair — the General Dynamics division that had designed and built the DC-10 fuselage and its doors — wrote to his supervisor.

He also noted that the aircraft had already demonstrated its susceptibility to catastrophic failure in explosive decompression during ground tests in 1970, and objected to the change of the latch actuation from hydraulic to electric.

Convair did not forward it. The fixes Applegate wanted — particularly to the cabin floor — would have meant grounding aircraft, and there was an internal argument about whether Convair or McDonnell Douglas would pay. A smaller set of changes was made instead: some locking parts strengthened, and a small inspection window added so somebody could look in and check the pins.

Baggage handlers were not told what the window was for.

Orly, 3 March 1974

A British European Airways strike had stranded thousands of travellers across Europe, and TK981 — normally a charter operation — was pressed into scheduled Paris-London service. Fifty passengers got off at Orly. Two hundred and sixteen got on. Among them was an amateur rugby team from Bury St Edmunds, returning from the France-England match, and a number of journalists who had covered it.

The aft cargo door was closed at about 10:35. The handler pulled the handle down. The vent door closed. The lock pins did not engage. Nobody looked through the window.

TC-JAV left Orly at about 12:32. At roughly 11,000 feet, three or four seconds before 12:40, the door departed. The co-pilot is recorded saying that the fuselage had burst.

The floor above the hold had no pressure-relief venting. It failed downward, taking two triple seat units and six passengers with it — their bodies were found in a field near Saint-Pathus, roughly 15 kilometres from the crash site. Every horizontal stabiliser and elevator control cable ran beneath that floor. All of them were severed, along with thrust control of the tail engine, whose throttle snapped shut.

What the crew had left was two wing engines and roll control. The aircraft turned nine degrees left, pitched to twenty degrees nose down, and accelerated. Berköz is recorded calling out “Speed!” and pushing the throttles forward as he tried to level off. It struck the trees seventy-seven seconds after the door left, at around 430 knots.

Of 346 people, 188 bodies could be identified. Rescue teams recovered around 20,000 fragments.

The Flight 981 investigation, from the missing door to the memo.

What the investigators found on the door

The French Commission’s findings are precise and damning. The latch actuator shaft had extended 277.5 mm instead of 297 mm, so the hooks never went over centre. The four lock pins sat 1.6 mm short of the restraining flanges. The pressure load went into the actuator support bracket and broke its two attachment bolts — the same two bolts that had failed over Windsor.

McDonnell Douglas’s own maintenance records said the plate had been fitted. It had not. A second modification, under SB 52-38, had been carried out in a way that did not comply with the bulletin. The lock pins and the lock warning switch were incorrectly adjusted, and the door proximity switch was out of rig — a problem the FAA later noted was common across the fleet at the time.

The Commission’s recommendation on the regulatory failure needs no interpretation: the airworthiness directive procedure, it said, should be used whatever the financial repercussions, whenever safety could be at serious risk. All the risks, it added, had been evident nineteen months earlier at Windsor, and no effective corrective action had followed.

McDonnell Douglas’s own promotional film on how the DC-10 was built — made before any of this.

Después

The FAA issued a telegraphic airworthiness directive 96 hours after the crash, mandating the door modifications it had declined to mandate in 1972. The cargo door and its locking system were completely redesigned. In 1975 came AD 75-15-05, the “floors and doors” directive, which required every wide-body then flying — DC-10, TriStar, 747 and A300 — to have a cabin floor able to survive a sudden large hole in the fuselage.

The certification rules themselves were rewritten. Part 25 now specifies an opening-size equation for pressurised fuselages, capped at 20 square feet — approximately the size of a DC-10 aft cargo door. It demands direct visual inspection of the locking mechanism on any outward-opening door, a flight-deck warning designed so that a false “locked” indication is improbable, and provisions preventing the aircraft from pressurising to an unsafe level if a door is not properly closed.

The families sued. McDonnell Douglas tried to shift responsibility onto the FAA, onto Turkish Airlines, onto General Dynamics. When that failed, the parties settled out of court for an estimated $100 million, with roughly $80 million from McDonnell Douglas. The Applegate memorandum was central to the case.

No DC-10 or MD-11 has ever suffered a comparable accident since. Which is the uncomfortable ending: the fix worked, it existed in 1972, and the only thing standing between it and 346 people was the decision not to make it compulsory.

Sources: French Secretariat of State for Transport, Final Report on the accident to TC-JAV (12 May 1976); NTSB report AAR-73-02 (American Airlines Flight 96); FAA Lessons Learned from Transport Airplane Accidents; Wikipedia; Wikimedia Commons.